RFQ1331L524Q13040012 Hotline Services PWS.docx

PERFORMANCE WORK STATEMENT

U.S. Department of Commerce—Office of Inspector General Hotline Services

1.0 Purpose

The Department of Commerce (DOC), Office of Inspector General (OIG) is awarding a contract to perform Hotline complaint intake services, including phone, email, and online complaint form submissions, for any allegations of fraud, waste, abuse, and mismanagement. The Contractor will host and operate, and may develop, a web-based OIG Hotline complaint intake form on Contractor owned and operated IT infrastructure. The Contractor shall forward OIG Hotline reports to the DOC OIG managed case management system (CMS) using Government Furnished Equipment (GFE) provided by DOC OIG.

This contract is designated a moderate risk contract.

The contract type is Firm Fixed Price (FFP).

The Period of Performance will be for One (1) year, plus Four (4) option years.

2.0 Client Mission

The Inspector General Act of 1978 (Pub. Law No. 95-452), as amended, provides the authority for the DOC OIG to conduct investigations and audits into suspected fraud, waste, abuse, or mismanagement involving DOC programs and operations. Additionally, OIG has statutory law enforcement authority to conduct criminal investigations related to DOC programs and operations. As part of fulfilling its mandate, the OIG maintains a Hotline to facilitate the reporting of allegations of fraud, waste, abuse, or mismanagement in DOC programs or operations. Allegations may be reported by DOC employees, contractors/grantees, or the public.

Hotline submitters are encouraged to provide relevant and specific details of their complaints, including the identity of the person, company, and/or organization alleged to have engaged in wrongdoing; a description of the alleged impropriety; the DOC facility and program affected by the alleged improprieties; contract/grant numbers; date(s) of alleged wrongdoing; how the caller is aware of the alleged impropriety; the identity of potential witnesses; and the identity and location of supporting documentation.

3.0 Objective

The services and requirements under this contract are vital to the Government and must be continued without interruption from the existing contract to the new contract.

The objective of this Performance Work Statement (PWS) is to acquire contractor services to provide OIG Hotline complaint intake services by receiving and documenting any allegations of fraud, waste, abuse, and mismanagement by the following methods:

1. Contractor hosting, managing, and operating a public website that allows the public to submit DOC OIG hotline requests via webform. See example site: www.govcomhotline.com/DOC1;

2. Contractor shall accept submissions by email;

3. Contractor shall accept submissions by phone call.

The contractor shall expeditiously forward the reports on to OIG Hotline staff for disposition. The contractor shall enter complaint information directly into OIG’s case management system. The amount of online web submission, emails, and telephone calls received on a yearly basis is approximately 1,000 contacts (excluding spam).[footnoteRef:2] [2: Over the past five years, OIG received approximately 928 (2023), 792 (2022), 1023 (2021), 2,191 (2020), and 1,061 (2019) contacts via the OIG Hotline (excluding spam designated contacts). ]

4.0 Requirements.

1. Continuity of Services. The services and requirements under this contract are vital to the Government and must be continued without interruption from the existing contract to the new contract. The contractor shall provide their methodology and transition-in plan to accomplish this requirement. (See Section 17.0 below for further information.)

2. Telephone Calls. The contractor shall provide 24-hour, 7 day per week, phone, and voicemail access to a Hotline.

a. Live Hotline trained operators shall answer phone calls during government business hours from 7:00 a.m. to 6:00 p.m. Eastern Standard Time (EST) Monday through Friday excluding Federal Holidays.

b. Messages left on voice mail during non-government business hours shall be called back by the next government business day.

c. Messages left on voice mail because the operators were busy taking other DOC OIG Hotline calls shall be returned within four (4) hours.

d. Calls should be answered within 5 rings.

e. Phone calls answered by a live operator and emails/web submissions shall be entered into the OIG ‘s case management system using GFE the same business day.

f. Callback requests shall be responded to the following business day.

g. For certain non-DOC-related complaints (e.g., sweepstake scams), the contractor shall provide the caller with forwarding information to the federal entity (e.g., Federal Trade Commission) that can best address their complaint.

h. The Contractor shall ask complainants who report by phone to specify whether they would like OIG to keep their contact/identifying information confidential.

i. Calls Shall Not Be Recorded or Traced.

3. Online Form Submissions. The Contractor shall operate a publicly accessible, web-based Hotline complaint intake form on Contractor owned and operated IT infrastructure. The web-based complaint form must be customized and/or tailored to meet the specific needs of the OIG. Online form submissions are reviewed and processed on a regular basis during the workday. The online forms should be uploaded into OIG’s case management system (CMS) in PDF format.

a. The Contractor shall ensure that all IT infrastructure meets or exceeds all Federal IT moderate risk security requirements, standards, directives, and memorandums.

b. The Contractor shall ensure their IT resources are sufficient to support 24/7/365 access to the web form and continuity of operations resources are also in place.

4. Email submissions. Emails are reviewed and processed on a regular basis during the workday. Information from emails received by the OIG Hotline should be uploaded into a “Complaint Report Form” that has been customized/tailored to meet the specific needs of DOC OIG. Both the complaint report form and underlying email, including any attachments, should be uploaded to OIG’s CMS in PDF format.

5. System Boundary. The contractor IT resources processing OIG’s Hotline complaint intake must be segregated from other contractor IT resources not processing OIG’s Hotline compliant intake through a Virtual Local Area Network (VLAN) or similar setup.

6. Government Furnished Equipment, as defined in FAR 45.101, will be furnished to the contractor for purposes of entering complaint data into the OIG’s case management system, which must be accessed through the OIG firewall into servers residing on an internal OIG network.

a. The contractor shall enter complaint information directly into the OIG’s case management system using OIG GFE.

b. In an event of GFE outage or OIG’s case management system outage, the contractor shall alert OIG as soon as possible, and work with OIG to work out procedures to meet the performance requirements while troubleshooting is made on the GFEs and the OIG’s case management system. This may include sending OIG complaints to OIG Hotline staff via secure means such as Secure File Transfer (SFT).

c. The contractor shall work with OIG to accommodate any change that OIG needs to make to the existing GFEs and the OIG’s case management system with best effort to meet the performance requirements during the changes.

7. Security Requirements for Information Technology Resources. The contractor will ensure adherence to the relevant provisions of 48 C.F.R. § 1352.239-72, incorporated here by reference and NIST 800-53 series for recommended security controls for Federal information systems and organizations.

a. Information provided to the contractor through complaints, via telephone or email must be protected via a secure means and encrypted with NIST 140-2 cryptographic modules.

b. Contractor shall provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained on behalf of the agency; in compliance with 44 C.F.R. § 3544. T

c. The contractor shall ensure each personnel that requires system access has their own account and credentials are kept confidential. The contractor understands that sharing of system credentials is strictly prohibited.

d. The contractor shall complete all initial and subsequent IT Security, Controlled Unclassified Information (CUI), and Records Management training requirements to maintain system access annually. The contractor shall report compliance to the COR upon completion of the required training.

8. Privacy. Contractor shall adhere to federal privacy laws and guidance to ensure that the collection, use, and maintenance of sensitive information, such as personally identifiable information and business identifiable information, is properly safeguarded in adherence to privacy regulations:

a. Freedom of Information Act (FOIA), 5 U.S.C. § 552

b. Privacy Act of 1974, 5 U.S.C. § 522a

c. The E-Government Act of 2002, Pub. L. No. 107-347

d. Trade Secrets Act, 18 U.S.C. § 1905

e. Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541

f. Paperwork Reduction Act of 1995 (PRA), Pub. L. No. 104-13

g. OMB Memoranda M-03-22, M-06-15, M-06-16, M-06-19-M-07-16, M-10-23

h. Department of Commerce IT Privacy Policy, http://www.osec.doc.gov/opog/

9. Exporting Data. The contractor’s system must have the ability to create and export data files to be compatible with OIG’s case management system. Acceptable formats to export the data files will be, in order of preference, emails will be required to be converted to Adobe PDF; attachments received from complainants can be provided in Adobe PDF or a Microsoft Office program such as Word; Excel; and PowerPoint. Any complaint document transmissions from contractor to DOC OIG program manager will be via encrypted means.

10. Both the telephone operator call format and the web-based complaint form must be customized and/or tailored to meet the specific needs of the DOC OIG.

11. The contractor shall provide existing mechanisms (e.g., reference or pin number) by which people contacting the Hotline can submit follow-up information pertaining to their complaints and by which the DOC OIG may provide responses to complainants.

12. The contractor shall analyze, summarize, and report every minute detail/fact as presented to them by the complainant. The contractor shall not make any judgments or decisions on ultimate disposition of complaints.

13. The contractor shall ensure the following:

Deliverables shall be submitted electronically as attachments to electronic mail (e-mail) messages. The text portions of the reports and plans must be in an editable format (e.g. Microsoft Word). Any graphic data (excluding schedules) may be submitted as an embedded file within a Microsoft Word document, or as a separate file in a mutually agreed upon format.

Task 1: Kickoff Meeting. Within five days after the contract has been awarded, a kickoff meeting will be held between the government and the contractor. At this meeting, the Contractor will provide OIG with its proposals for addressing the following items:

Task 2: Standard Operating Procedures (SOP). Within 7 days of the kickoff meeting, the contractor shall provide SOPs to the government. The government will have 7 days to review the SOP and provide comments to the contractor. The contractor will then have 7 days to submit the final SOP to the government. The contractor shall update the SOP annually and provide a copy to OIG for review.

Task 3: Security Plan. At the kick-off meeting, the contractor shall provide the Security Plan to the government. The security plan, prepared by the contractor, shall provide an overview of the security requirements, and describes the security controls in place or planned for meeting the OIG Hotline requirements at the start of the contract. The plan shall provide sufficient information to understand the intended or actual implementation of each security control.

The government will have ten days to review the Security Plan and provide comments to the contractor. The contractor will then have ten days to submit the final Security Plan to the government.

Task 4: Nondisclosure Plan. The contractor shall provide at the kick-off meeting a nondisclosure plan for information obtained during the contract. The contractor shall specify in the plan provisions for data portability, data breach notification, and data disposal during the period of performance. The government will have ten days to review the Nondisclosure plan and provide comments to the contractor. The contractor will then have ten days to submit the final Nondisclosure Plan to the government. The Contractor shall be required that each employee is required to sign a non-disclosure statement before working on this contract.

Task 5: Weekly Reports. The Contractor shall submit a weekly report to the COR by 10:00 a.m. ET on Monday of the following week. The report should include the following:

—Report number of each complaint received, —Date of receipt by contractor, —Source of complaint (e.g., email, online web form submission, or telephone), —Nature of allegation, —Subject location, and —Summary of the complaint.

Task 6: Monthly Reports. The Contractor will submit to COR a summary report from the previous month reflecting the total number of complaints received (including total number of DOC-related complaints versus those referred by contractor to other federal entities (e.g., Federal Trade Commission). The monthly report shall be submitted by the 10th of every month.

Task 7: Media and Equipment Sanitization Plan. Upon the end of the contract period of performance the contractor shall be required to sanitize all media and equipment that contain OIG Hotline material. The contractor shall submit at the kick-off meeting the contractor’s plan for sanitizing such media and equipment. Storage media shall be sanitized using several methods (e.g., degaussing, manual destruction). The contractor shall provide the government attestation that the storage media and equipment was sanitized when the contract ends or when equipment is replaced for repair or as part of “tech refresh.” NIST SP 800-88, “Guidelines for Media Sanitization.”

Task 8: Transition-In Plan. The contractor shall provide their plan to transition from the existing contract to the new contract with any changes or recommendations to ensure continuity of services between the old and new contract are accomplished.

6.0 Performance Standards

The performance standard includes meeting the specific requirements set forth in the Table below and that complainants are always treated professionally. Performance level is satisfactory. The method of surveillance is periodic surveillance through the test call method described above. The Contractor shall have the sole responsibility for resolving internal matters brought to their attention.

Performance Management. The contractor’s performance shall be evaluated according to the following categories: Quality, Timeliness, Business Relations, and Customer Satisfaction. This performance measurement/rating will be utilized when considering the contractor’s past performance (evaluation criteria) for future awards. As part of performance management, OIG personnel will regularly make “test” calls and other contacts, including site visits, to monitor the performance of the contractor (See Appendix A). The contractor’s performance during the test calls will also be utilized when considering the contractor’s past performance for future awards. The contractor is required to document 100 percent of all calls and other contacts involving DOC programs and operations. Failure to do so may constitute grounds for termination of the agreement.

(2) 90% of calls, emails, and other Hotline contacts are to be processed and submitted to OIG within 24 hours of receipt. Any calls, emails or other Hotline contacts not provided appropriately to the OIG within five working days from receipt will constitute unsatisfactory performance.

This measure will be checked by OIG personnel making periodic test calls to evaluate contractor responsiveness.

7.0 Period of Performance

The period of performance is anticipated as follows: one base year and four one-year options (if exercised).

NOTE: The Government may be required to cancel the public website hosting requirements (Section 4.0.3 Online Form Submissions) of this contract starting in option year one due to federal .gov requirements. All proposals shall include option year costs that have these services removed from the contract but still require all remaining requirements.

8.0 Place of Performance.

The contractor company shall be physically located in the United States of America.

The contractor will supply its own secure work site, to include telephones, office supplies, and other equipment, in the United States of America (Government will furnish up to four laptops to be shared by vendor approved staff).

9.0 Staffing

1. The Contractor shall provide qualified personnel in sufficient quantities, including operators, supervisors, and support staff, to meet the requirements of this contract.

a. The Contractor’s Project Manager shall be designated as key personnel. The Project Manager shall be the Contractor’s authorized point of contact for all communications with the COR and the Contracting Officer and shall be responsible for the overall success of the project. The individual proposed and accepted as the Project Manager is expected to remain dedicated to the contract. Substitutions will be allowed only when the OIG specifically agrees to the substitution in writing. Any proposed substitute must have qualifications equal to or better than those of the person initially proposed. The Project Manager:

i. Must be a U.S. citizen or lawful permanent resident.

ii. Must possess at least two years of experience in managing Hotline complaint intake services for allegations of fraud, waste, abuse, and mismanagement.

iii. Must already possess a current background clearance from a federal government agency with reciprocity capabilities or a current federal government issued PIV card.

b. Other Contractor personnel:

i. Must be U.S. citizens or lawful permanent residents.

ii. Must be able to speak, read, and write English fluently.

iii. Must possess proven expertise and/or experience in answering and reporting on Hotline fraud issues and interviewing techniques.

iv. Must already possess a current background clearance from a federal government agency with reciprocity capabilities or a current federal government issued PIV card.

The Contractor shall provide supervisory/management personnel required for effective project management. The Contractor shall provide training materials to staff to familiarize them with DOC programs and operations.

2. Identification. The Contractor shall, at their expense, complete all required paperwork and travel to an OIG designated badging office to obtain a Government issued Personal Identity Verification (PIV) card for each person working on this contract. The Government shall not pay travel expenses for travel related to obtaining, replacing, or returning PIV cards. The Contractor shall return any PIV card of an employee who leaves the Contractor’s employment within 30 calendar days at the Contractor’s expense.

10.0 Travel

The government will reimburse contractors for any agreed upon and pre-approved travel expenses related to required onsite visits (e.g., training) in compliance with federal travel regulations.

11.0 Continuity of Services

Continuity of Services (Jan 1991) https://www.acquisition.gov/far/52.237-3

(a) The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to-

(1) Furnish phase-in training; and

(2) Exercise its best efforts and cooperation to affect an orderly and efficient transition to a successor.

(b) The Contractor shall, upon the Contracting Officer’s written notice, (1) furnish phase-in, phase-out services for up to 90 days after this contract expires and (2) negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the Contracting Officer’s approval. The Contractor shall provide sufficiently experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

(c) The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this contract. The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

(d) The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e., costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations) and a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract.

12.0 Records Management

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes the OIG’s Agency records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their Agency contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

5. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

6. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

7. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

8. The OIG and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of the OIG or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the OIG. The agency must report promptly to NARA in accordance with 36 CFR 1230.

9. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DOC OIG control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

10. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and the OIG guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

11. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with the OIG policy.

12. The Contractor shall not create or maintain any records containing any non-public OIG information that is not specifically tied to or authorized by the contract.

13. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

14. The OIG owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which the OIG shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

15. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take the OIG-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.] D. Flow down of requirements to subcontractors.

16. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

17. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

image1.jpeg image2.png