RFQ 2031JW25Q00073 STD-LTD Insur.pdf

RFQ 2031JW25Q00073

Short-Term Disability (STD)/Long-Term Disability (LTD) Insurance Program

This document is a combined synopsis/solicitation pursuant to Federal Acquisition Regulation (FAR) Part 12.603, “Streamlined solicitation for commercial products or commercial services.”

The content of this combined synopsis/solicitation is as follows:

(1) Action Code: N/A

(2) Date: August 5

(3) Year: 2025

(4) Contracting Office ZIP Code: 20219

(5) Product or Service Code: G006, “Social – Government Life Insurance Programs”

(6) Contracting Office Address: The Office of the Comptroller of the Currency (OCC) Headquarters, Acquisition Management, 400 7th Street, SW, Washington, DC

(7) Subject: Synopsis/Solicitation for Short-Term Disability (STD)/Long-Term Disability (LTD) Insurance Program

(8) Proposed Solicitation Number: 2031JW25Q00073

(9) Closing Response Date: See paragraph (16)(xv) below.

(10) Contact Point or Contracting Officer: Patrick Reil (Contract Specialist) and John R.

Baumert (Contracting Officer)

(11) Contract Award and Solicitation Number: N/A and 2031JW25Q00073

(12) Contract Award Dollar Amount: N/A

(13) Line Item Number: See Part I, paragraphs 2.0 and 2.1 of this solicitation.

(14) Contract Award Date: N/A

(15) Contractor: N/A

(16) Description:

(i) This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

(ii) The solicitation number for this requirement is 2031JW25Q00073 and the solicitation is issued as a request for quote (RFQ).

(iii) This solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) Number 2025-04, effective June 11, 2025.

(iv) This solicitation is not set-aside and the associated North American Industry Classification System (NAICS) code for the requirement is 524113, “Direct Life Insurance Carriers,” and small business size standard is $47.0 million.

(v) List of line-item number(s) and items, quantities, and units of measure (including option(s), if applicable). See Part I, paragraphs 2.0 and 2.1 of this solicitation.

(vi) Description of requirements for the items to be acquired. See Statement of Work (SOW) in Part II of this solicitation.

(vii) FOB delivery shall be made in accordance with Part II, paragraph 10.0 “Deliverables” of the SOW.

(viii) Provision at 52.212-1, Instructions to Offerors-Commercial Products and Commercial Services, applies to this acquisition and is incorporated by reference to this solicitation.

(ix) Provision at 52.212-2, Evaluation-Commercial Products and Commercial Services, applies to this solicitation and is incorporated in full text, and the specific evaluation criteria to be included in paragraph (a) of that provision is: Corporate Experience, Technical Capability, Past Performance, and Price.

(x) Quoters shall include a completed copy of the provision at 52.212- 3, Offeror Representations and Certifications-Commercial Products and Commercial Services, with its quote if not already completed their Representatives and Certifications with the System for Award Management (SAM) entity record.

(xi) Clause at 52.212-4, Contract Terms and Conditions-Commercial Products and Products and Commercial Services, applies to this acquisition and is incorporated by reference to this solicitation.

(xii) Clause at 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Services, applies to this acquisition and is incorporated in full text to this solicitation.

(xiii) There are no additional contract requirement(s) or terms and conditions outside of this solicitation.

(xiv) The Defense Priorities and Allocations System (DPAS) and assigned rating is not applicable to this solicitation.

(xv) Quotations are due on Wednesday, August 27, 2025 at 3:00 PM (Eastern) via email at patrick.reil@occ.treas.gov and john.baumert@occ.treas.gov.

(xvi) The Contract Specialist for this solicitation is Patrick Reil. He can be reached at

(202) 285-4189 or via email at Patrick.reil@occ.treas.gov. The Contracting Officer (CO) for this solicitation is John R. Baumert. He can be reached at (202) 809-7720 or via email at john.baumert@occ.treas.gov.

(17) Place of Contract Performance: Contractor’s site

(18) Set-aside Status: N/A

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0. GENERAL

The contractor must provide the services specified in the Statement of Work (SOW). The North American Industry Classification System (NAICS) for this requirement is 524113, Direct Life Insurance Carriers, with a small business size standard of $47.0 Million.

1.1. TYPE OF CONTRACT

A Firm Fixed Price Contract will be awarded pursuant to this solicitation at the rates specified in each Contract Line-Item Number (CLIN) Description. These prices shall be in effect through the base period of the contract and all option periods, if exercised.

1.2. CONTRACT LINE-ITEM NUMBER DESCRIPTIONS

The number of eligible employees enrolled in the Short-Term Disability (STD) and eligible employees covered by Long-Term Disability (LTD) plans is estimated and used for the purposes of establishing a funding amount for each performance period. The Office of the Comptroller of the Currency (OCC) employee population may fluctuate within each performance period resulting in an increase or decrease throughout the year (i.e., there may be a variation in quantity). The OCC will remit premium payment based on the actual benefit eligible employee population for that month for LTD at the performance period’s fixed unit rate.

Funds for LTD will be obligated at time of award for the base period (or at the time each option period is exercised if the Government chooses to exercise an option). The contractor must notify the Contracting Officer (CO) when 75% of these funds have been invoiced to the OCC. The contractor must provide an estimate of additional funds required for the remainder of the period of performance.

2.0 LTD Pricing

The total price for the base and option periods is anticipated to be $ (based on covered payroll). This amount and the amount associated with the total price for each year (i.e., column 3 in the tables below) are estimates used to establish a contract value. Monthly premium payments are to be based on the actual number of benefit eligible employees and the monthly payroll at the time of payment. The unit rate(s) for this contract are “fixed” for each year as specified below. Rates shall not include commissions/fees to any selling agent.

0001 Base Year (January 1, 2026 through December 31, 2026) Type of Coverage Monthly Rate Per $100 of

Coverage Estimated Total Price for Base (based on covered payroll)

Long-Term Disability Maximum Monthly Benefit: $222,000

1001 Option Year 1 (January 1, 2027 through December 31, 2027) Type of Coverage Monthly Rate Per $100 of

Coverage Estimated Total Price for Option Year 1 (based on covered payroll)

Long-Term Disability Maximum Monthly Benefit: $222,000

2001 Option Year 2 (January 1, 2028 through December 31, 2028)

Coverage Estimated Total Price for Option Year 2 (based on covered payroll)

Long-Term Disability

3001 Option Year 3 (January 1, 2029 through December 31, 2029)

Coverage Estimated Total Price for Option Year 3 (based on covered payroll)

Long-Term Disability

4001 Option Year 4 (January 1, 2030 through December 31, 2030)

Coverage Estimated Total Price for Option Year 4 (based on covered payroll)

Long-Term Disability

2.1 STD PRICING

The total price for the base and option periods is anticipated to be $ ( based on covered payroll). The unit rates for this contract are fixed for each year as specified below. Bi-weekly premium payments are to be based on the actual number of employees enrolled and the bi-weekly payroll at the time of payment.

0002 Base Year (January 1, 2026 through December 31, 2026) Maximum Weekly Benefit Age Brackets Biweekly Rate Per $10 of

Weekly Coverage

Annual Cost: Voluntary Employee Pays 100% of premium (Adjusted base salary) x (60%) / (52) / (10) x (Age Rate) = bi-weekly premium X 26 = Annual Cost

$4,269 <35 35-39 40-44 45-49 50-54 55-59 60>

1002 Option Year 1 (January 1, 2027 through December 31, 2027)

Weekly Coverage

Annual Cost: Voluntary Employee Pays 100% of premium (Adjusted base salary) x (60%) / (52) / (10) x (Age Rate) = bi-weekly premium X 26 = Annual Cost

$4,269 <35 35-39 40-44 45-49 50-54 55-59 60>

2002 Option Year 2 (January 1, 2028 through December 31, 2028)

Weekly Coverage

Annual Cost: Voluntary Employee Pays 100% of premium (Adjusted base salary) x (60%) / (52) / (10) x (Age Rate) = bi-weekly premium X 26 = Annual Cost

$4,269 <35 35-39 40-44 45-49 50-54 55-59 60>

3002 Option Year 3 (January 1, 2029 through December 31, 2029)

Weekly Coverage

Annual Cost: Voluntary Employee Pays 100% of premium (Adjusted base salary) x (60%) / (52) / (10) x (Age Rate) = bi-weekly premium X 26 = Annual Cost

$4,269 <35 35-39 40-44 45-49 50-54 55-59 60>

4002 Option Year 4 (January 1, 2030 through December 31, 2030)

Weekly Coverage

Annual Cost: Voluntary Employee Pays 100% of premium (Adjusted base salary) x (60%) / (52) / (10) x (Age Rate) = bi-weekly premium X 26 = Annual Cost

$4,269 <35 35-39 40-44 45-49 50-54 55-59 60>

PART II – STATEMENT OF WORK (SOW)

1.0 OCC BACKGROUND

The OCC is a non-appropriated federal financial regulatory bureau of the U.S. Department of the Treasury. The OCC charters, regulates, and supervises all national banks and federal savings associations. It also supervises the federal branches and agencies of foreign banks. The OCC is headquartered in Washington, DC. It also has primary locations in Chicago, Dallas, Denver and New York to supervise the international activities of national banks. The OCC employs approximately 3,592 benefit eligible employees in approximately 70 cities nationwide.

The OCC is a federal government agency that has authority to offer compensation and benefits programs outside of those offered by the federal government. The OCC sponsored benefit programs include, but are not limited to, dental, vision, life insurance, accidental death and dismemberment insurance, business travel accident insurance, flexible spending accounts, 401(k) plans, STD and LTD insurances.

The Office of Financial Research (OFR), which was established within Treasury as a result of Dodd- Frank, has a Memorandum of Understanding with the OCC for the provision of services related to some of the benefits that the OFR provides to its employees; therefore, the OFR became a participant in the OCC’s STD and LTD plans, in which its employees were able to enroll starting in July 2011. Currently, the OFR employs approximately 200 benefit eligible employees located in Washington, DC and New York.

Both the OCC and the OFR, as governmental plans, are specifically exempted from Title I of Employee Retirement Income Security Act (ERISA).

2.0 SCOPE OF WORK

2.1 GENERAL

The OCC is seeking an experienced and qualified contractor to underwrite and administer its STD and LTD insurance programs for its employees as well as the employees of the OFR. The contractor must administer these programs from an integrated disability management approach to ease the transition from STD to LTD. This integrated approach should enhance employees’ overall experience that aids in the return-to-work efforts, vocational rehabilitation, claim filing process, and early social security notice.

Federal employees are ineligible for state disability benefits. Both STD and LTD are fully insured plans.

The OCC and the OFR provide its employees leave that is consistent with all applicable laws and regulations. This includes sick leave, annual leave, leave without pay (LWOP), family and medical leave (FMLA), leave transfer and leave bank programs. The OCC’s policy is to administer the STD and LTD benefits in conjunction with the usage of sick leave, leave donated from the leave transfer or leave bank programs. The period in which employees receive STD/LTD benefits, they must be in a non-pay status with the OCC.

Additionally, in support of the OCC’s efforts to educate employees on healthy living and their benefit options, the successful contractor must attend a virtual and/or on-site health benefits fair. If on-site it will be at OCC’s headquarters location at 400 7th Street, SW, Washington, DC. Generally, the fair is held in November every year. The contractor is to supply handouts and giveaways and be prepared to answer employee questions concerning the OCC STD/LTD disability insurance programs.

2.1 PLAN DESIGN

The STD and LTD plans shall be administered from an integrated disability management approach. The OCC’s intent is to increase the benefit maximum amount from $330,000 maximum (60 percent $198,000) to $370,000 maximum (60 percent $222,000). The OCC’s policy is to administer the STD and LTD benefits in conjunction with the usage of sick leave, leave donated from the leave transfer or leave bank programs. Employees must be in a non-pay status/LWOP for any period that an STD/LTD benefit is payable. Federal employees are ineligible for state disability benefits. Claimants are not required to retire under this plan design.

The following tables summarize the plan design that the OCC plans to implement under this contract.

Plan Design STD LTD Benefit 60% weekly salary 60% monthly salary Benefit Max/Min* ($370,000 maximum at 60 percent $222,000)

$4,269/$25* $18,500/greater of $100 or 10% of monthly benefit*

Benefit Waiting Period Seven (7) calendar days plus the use of all accrued sick leave and leave donated from the leave bank or leave transfer programs

90 calendar days plus the use of all accrued sick leave and leave donated from the leave bank or leave transfer programs

Late Enrollment Penalty 30 calendar days plus the use of all accrued sick leave and leave donated from the leave bank or leave transfer programs Note: The Late Enrollment penalty does not apply to a disability caused by accidental injury (injury to the body)

N/A

Maximum Benefit Period 90 calendar days Varies (age at the time of disability (see current LTD certificate of insurance (attachment 3)

*Minimum Benefit is not applicable while in a paid status from the OCC or OFR.

2.2 ELIGIBILITY

For STD and LTD, the eligibility requirement is defined as a regular employee (full-time or part-time) or temporary employee with an appointment greater than one year who is actively at work at least 60 hours biweekly.

Note: Employees who are on an authorized/excused absence from duty, often referred to as “administrative leave,” are ineligible to enroll or file a claim for STD/LTD benefits.

2.3 ENROLLMENT EFFECTIVE DATES

Employees have two opportunities to enroll in STD:

New Hire – Employees who enroll within 60 days of hire.

Late Enrollment – Employees who decide not to enroll as a new hire may enroll at any time, but they will be subject to a late enrollment penalty.

LATE ENROLLMENT PENALTY

The late enrollment penalty is applicable in lieu of medical underwriting/pre-existing clauses. The late enrollment penalty changes the benefit-waiting period from seven (7) calendar days to 30 calendar days.

During this period, employees are required to exhaust all accrued sick leave and the time is concurrent with the 30 calendar days. The penalty will apply if employees file a claim for an illness, pregnancy or a mental disorder during the first 12 months after the employees’ effective date of coverage. After the first 12 months of coverage, the benefit-waiting period reverts to the seven (7) calendar days. The late enrollment penalty does not apply to a disability caused by accidental injury (injury to the body).

The OCC plan provides for a late enrollment penalty in lieu of medical underwriting.

EFFECTIVE DATES

For STD, enrollments are effective the first of the month following the receipt of a completed enrollment form by Human Resources. Employees are required to meet the eligibility requirements.

For LTD, coverage is effective on the date employees meet the eligibility requirements.

ENROLLMENT DATA

The OCC maintains the STD enrollment data for its employees and the employees of OFR. For LTD, eligible employees are covered as of the date of hire or when the eligibility requirement is met, and no enrollment is necessary, and the population data is maintained by the OCC.

3.0 CLAIM FILING

At a minimum, the Contractor must provide telephonic claims filing for claimants. At a minimum, the Contractor must accept the employment data from the OCC via email. Employees are not required to retire to apply and receive LTD benefits. The Contractor must provide written notification of claim status to the claimant and the OCC electronically.

CLAIM PORTAL

The Contractor must provide an accessible software system for claimants and the OCC to review claim information. At a minimum, the system should include details related to the status of the claim, benefit approval or denial (with simple explanation for denials), benefit start and end date, and track claim payments.

4.0 FUTURE OCC BENEFITS ENROLLMENT PLATFORM

At any point during the period of performance, the OCC reserves the right to implement its own benefits enrollment platform to manage the STD/LTD insurance. If at any future date the OCC implements its own benefits enrollment platform, the Contractor must collaborate with the OCC and participate on a project team to assist with file development for electronic exchanges related to claim filing.

5.0 PREMIUM COST

For STD, OCC and OFR employees pay 100 percent of the premium via payroll deductions on a bi-weekly basis. The premium is deducted on an after-tax basis and benefit payments are non- taxable. On a biweekly basis, STD premium payments will be remitted electronically via the payroll vendor, the National Finance Center (NFC). This is applicable for the OCC and the OFR employees.

For LTD, the OCC and the OFR pay 100 percent of the premium for its employees; therefore, 100 percent of the benefit payment is subject to taxation for employees. For STD/LTD, the contractor shall be responsible for all tasks related to tax reporting. This includes the preparation and distribution of appropriate tax filing documents, e.g., 1099 and W-2 for each claimant for paid benefits in accordance with the plan.

OCC will determine the LTD monthly cost, based on eligible employees/payroll, and prepare separate self-billed invoices monthly for both the OCC and the OFR. OCC will send the vendor a copy of the invoice electronically via email to the Contractor to prepare their invoice to submit via the Invoice Processing Platform (IPP).

6.0 WORKLOAD REQUIREMENTS

The Contractor must provide services in accordance with this SOW regardless of the actual number of services or fluctuation in services and eligible participants. There is no guaranteed minimum number of services to be covered. Any information in this SOW regarding estimated or historical services is intended to aid the Contractor in understanding the requirements associated with the services and in submitting an appropriate proposal.

Table 1: Estimated Population Summary

The information below is related to the enrolled number of participants for STD and the number of covered employees for LTD. Population fluctuates throughout the year. The census data is subject to change during the performance period of this contract. The census data is provided as informational only (see attachment 1).

OCC Estimated Population Summary Service Type Service

Requirement Population Fluctuates Location

OCC Short-Term Disability Annually

1,411 Benefit Eligible Enrolled Employees

Worldwide and Continental

US

OCC Long-Term Disability Annually 3,592 Benefit Eligible Covered Employees

Worldwide and Continental

US

OFR Estimated Population Summary Service Type Service

Requirement Population Fluctuates Location

OCC Short-Term Disability Annually

58 Benefit Eligible Enrolled Employees

Worldwide and Continental

US

OCC Long-Term Disability Annually 200 Benefit Eligible Covered Employees

Worldwide and Continental

US

7.0 CLAIMS

The contractor must support the agency with processing all claims for both STD/LTD plans.

8.0 CUSTOMER SERVICE

The contractor must provide customer service to employees who file an STD/LTD claim. All contractor employees that handle Personal Identifiable Information (PII) will need to adhere to the requirements of OCC Clause 1052.204-8008 - CITIZENSHIP OR RESIDENCY REQUIREMENTS OF CONTRACTOR

PERSONNEL.

9.0 KEY PERSONNEL

The contractor must provide an account manager that will be a single point of contact and serve as a liaison to the OCC to address day-to-day matters. The individual must have a minimum of three years of account management experience in the insurance industry.

10.0 PLACE OF PERFORMANCE

The contractor shall perform all its duties relating to this contract at the contractor’s work location.

11.0 DELIVERABLES

See attachment 6 for the list of deliverables and associated due dates.

12.0 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information, including forms, reports, etc., to the Contracting Officer (CO) or the Contracting Officer’s Representative (COR) shall be paid by the Contractor.

13.0 MARKING

All information submitted to the CO or the COR shall be clearly marked to show the following:

Name of the Contractor

Contract Number

Consignee’s name and address

Date of Submission

14.0 REPORT COVER SHEET

Each report submitted by the Contractor must have a cover sheet containing the following information:

Title of report

Report number or type

Period covered by the report

Contract number

Name and address of the Contractor

Name of the COR

Date of Submission

15.0 ACCEPTANCE CRITERIA

The COR will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/ requirements. The contractor must ensure the accuracy and completeness of all deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or “padding,” shall be considered deficiencies and shall be subject to correction by the contractor, at no additional cost to the Government. Unless otherwise indicated, the Government will require ten (10) business days to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will return it for correction and brief comments on deficiencies.

16.0 REJECTION PROCEDURES

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

After notification that the deliverable did not meet the acceptance criteria, the contractor must re-submit an updated/corrected version within five (5) business days after receipt of Government comments.

Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, the Government may consider the Contractor as having deficient performance with respect to the deliverable. The Government will return deficient deliverables until they meet contract requirements, as necessary.

17.0 SECTION 508

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps.

A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) 2.0 guidelines success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3) A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.5, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

4) E202 – General Exceptions Authorized by OCC as applicable.

The following items are identified as containing ICT:

Software Applications & Operating Systems

Web-based Intranet and Internet Information and Applications

Information, Documentation, and Support

Hardware

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

E207 – WCAG Level A & AA Success Criteria

E302 – Functional Performance Criteria

E502 – Interoperability with Assistive Technology

E503 – Application

E504 – Authoring Tool *

E501 – Web-based applications, independent of platform services *

Applicable requirements for electronic documents and/or support services:

E205 – WCAG Level A & AA Success Criteria

E302 – Functional Performance Criteria

E602 – Support Documentation

E603 – Support Services

18.0 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the COR.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2

Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the STD and LTD Insurance system.

Security Updates and Patches. The contractor shall ensure that the STD and LTD Insurance system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the STD and LTD Insurance system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email:

“Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met.

The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S.

Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

Authorization Boundary Deliverables

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial: Within 30 Days of

Award

Non-Federal External Service Provider (ESP) Security Documentation Deliverables

Removal of Data Deliverables Section Deliverable Frequency Due Date

IV. F. Information Ownership.

Removal of OCC Data

IV. D. Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

1.0. ATTACHMENTS

Attachment 1 - STD/LTD Census Data

Attachment 2 - STD Certificate of Insurance

Attachment 3 - LTD Certificate of Insurance

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization. SSAE 18 Requirements.

E. Continuous Monitoring. Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and annually

Within 30 Days after Award

Annual: NLT May 1

PART III – CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

Attachment 4 - STD/LTD Claims Data

Attachment 5 - STD/LTD Premium History

Attachment 6 - Deliverables

Attachment 7 - Technical Capability Questionnaire

Attachment 8 - Non-Disclosure Agreement (NDA)

1.0. CLAUSES

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available. Also, the full text of a clause may be accessed electronically at the following address: https://www.acquisition.gov

(End Clause)

1.1. FEDERAL ACQUISITION REGULATION (FAR) CLAUSES INCLUDED BY REFERENCE

FAR Clause Title Date 52.204-13 System for Award Management Maintenance OCT 2018 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-19 Incorporation by Reference of Representations and Certifications DEC 2014 52.212-4 Contract Terms and Conditions-Commercial Products and

Commercial Services

NOV 2023

1.2. FAR CLAUSES INCLUDED IN FULL TEXT

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION

SYSTEMS (NOV 2021)

(a) Definitions. As used in this clause—

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

PART IV – CLAUSES

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b)Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect…