OCFO_RFP_IVV_solicitation_final._docx.docx

SBAHQ-16-R-0004

SMALL BUSINESS ADMINISTRATION (SBA)

ON BEHALF OF OFFICE OF FINANCIAL ANALYSIS AND MODELING

PART I – SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 SERVICES

The U.S. Small Business Administration (SBA), Office of the Chief Financial Officer (OCFO), Office of Financial Analysis and Modeling (OFAM) performs financial and statistical analysis of the SBA’s business and disaster loan programs. The OFAM provides formulation estimates for the Office of Management and Budget (OMB) and Congressional budget submissions, performs annual re-estimates for over 150 cohorts for its business and disaster programs and performs cost estimates and analyses as requested by the senior management within SBA, OMB, the House or Senate committees and the Congressional Budget Office. Given the constant evolution of best practices in the credit modeling environment, the OFAM continuously updates its models to ensure the credit subsidy models remain current, relevant, and reflective of industry best practices. Through this solicitation, the OFAM seeks an independent review of select credit subsidy models to ensure that the models remain free from theoretical and mechanical error.

The SBA will obtain Independent Validation and Verification (IV&V) services through this RFQ. The services shall include a review of selected models’ methodology, inputs and outputs, operations, and model documentation, during three different phases of SBA’s annual model development cycle. The culmination of each phase is a written report summarizing the IV&V team’s findings and recommendations.

The Vendor, at the discretion of the OFAM, can be required to provide an IV&V review of models for any of the programs listed below and for new programs that are initiated by the SBA or required by legislation.

· Guaranteed Section 7(a) Small Business Loans (SBL);

· Guaranteed Secondary Market Guarantees (SMG);

· Guaranteed 504 Certified Development Company (CDC) Loans;

· Direct Disaster Loans (DDL);

· Guaranteed Disaster Loan Programs;

· Direct Microloan Program;

· Guaranteed Small Business Investment Companies (SBIC) Debentures;

· Guaranteed SBIC Participating Securities (PS);

· Guaranteed New Market Venture Capital (NMVC) Loans;

· Recovery Act Programs:

· American Recovery and Reinvestment Act (ARRA) Section 503: Establishment of SBA Secondary Market Guarantee Authority.

· ARRA Section 506: Business Stabilization Program (ARC loans).

· Guaranteed 504 Commercial Real Estate (CRE) Refinance Loans.

· Intermediary Lender Pilot (ILP) Program;

· Dealer Floor Plan; and

· Several small guaranteed and direct loan programs.

The Vendor will provide the number of analysts needed to test, validate, and review assigned credit subsidy models during the full fiscal year cycle of the subsidy modeling processes from financial statement reestimates through budget formulation.

2.0 Type of Contract: Firm Fixed Price with a Base of twelve (12) months and four (4), twelve (12) month options. 52.216-1 Type of Contract. (APR 1984). This is a negotiated procurement that is a total small business set-aside. The NAICS code assigned to this procurement is 541219 and has a size standard of $20.5M.

3.0 PERIOD OF PERFORMANCE BASE CONTRACT

The period of performance for this contract is one, one-year base period and four, one-year option periods.

Base period will begin on the date of award and completed twelve months after the date of award.

Option period 1 (1 year) NOTE: DATES WILL BE FILLED IN AT TIME OF AWARD Option period 2 (1 year) Option period 3 (1 year) Option period 4 (1 year)

PART II. Schedule B. / PRICING SCHEDULE -

4.0 PRICE SCHEDULE -*NOTE: FOR PROPOSAL PURPOSES FILL IN THE UNIT RATE FOR THE CONTRACT LINE ITEMS (CLINS) LISTED ON THE SF 1449 (sign), Complete the below chart and provided in your price proposal as detailed in Paragraph (17)

(IV&V) Services in accordance with the below PWS

Independent Validation and Verification (IV&V) Services in accordance with the below PWS

(IV&V) Services in accordance with the below PWS

Independent Validation and Verification (IV&V) Services in accordance with the below PWS

Independent Validation and Verification (IV&V) Services in accordance with the below PWS

As total compensation for all services performed in accordance with the terms, conditions, and specifications stated herein, the contractor will be paid according to the proposal Payments Clause 52.232-1 (page 26) – Note: This needs completed as part of proposal.

PART III – PERFORMANCE WORK STATEMENT

5.0 Purpose and Objectives

The Small Business Administration (SBA), Office of Financial Analysis and Modeling (OFAM) on behalf of the SBA’s Office of Chief Financial Officer (OCFO) issue this Request for Proposal (RFP) to provide IV&V Services. The IV&V services will be conducted in accordance with the Performance Work Statement (PWS) included herein. The contractor shall provide all qualified personnel, equipment, logistical support, and other materials and/or services necessary to perform the efforts as set forth in the PWS. This document, including the PWS, will be incorporated into the awarded contract.

The SBA currently has numerous active loan programs that require formulation estimates, re-estimates and analyses and several loan programs that are fully disbursed that require annual re-estimates. The SBA has a mixture of credit subsidy models written in Statistical Analysis Software(SAS) and Excel. During the formulation and re-estimate cycles the models for the major programs are distributed for an Independent Verification and Validation (IV&V) review prior to the models being provided to the OMB and the independent financial statement auditor to the Office of Inspector General (OIG).

OFAM updates these models in four main phases, Phase I – Phase IV, with each Phase resulting in a deliverable to either OMB or the financial statement auditors. Prior to sending Phase I, Phase II, and Phase IV model deliverables to financial statement auditors or OMB, SBA receives Independent Validation and Verification (IV&V) services from an external party to perform a review of the estimates that OFAM has created for SBA’s four largest loan programs: 7(a) Small Business Loans (7(a) SBL), 504 Certified Development Company (CDC) loans, Direct Disaster Assistance Loans (DDL), and Secondary Market Guarantee (SMG). The review for each Phase and model consists of a review of the model methodology, the model inputs and outputs, model operations, and the supporting model documentation. The culmination of the review is a written report summarizing findings and recommendations for each of the reviewed models.

The IV&V review is necessary to ensure that the OCFO meets its goals in the following areas:

· Maintaining an unqualified financial statement audit opinion;

· Providing formulation estimates and financial statement re-estimates calculated by theoretically and mechanically accurate credit subsidy models; and

· Ensuring that model enhancements or updates undergo rigorous testing and review by an independent third party.

5.1. Independent Validation and Verification (IV&V) Review

The IV&V review should cover four areas of review:

5.1.1. Model Methodology

SBA’s credit subsidy models forecast the cash flows associated with SBA's direct loan and loan guarantee programs. Forecasts of loan repayments, prepayments, defaults, fees, recoveries, expenses, and related cash flows are developed based on actual historical loan performance data. Model methodology may include historical averages approach as well as econometric estimation.

The purpose of this review is to ensure that the model is consistent with industry standards, federal credit reform guidance, and the most appropriate approach in terms of efficiency and model fit.

5.1.2. Model Input / Output

The purpose of this review is to assess the data quality of model inputs and outputs.

Input Data. The purpose of this review is to confirm that the appropriate inputs exist in the model input files and that they are correctly accepted by the model. The data should be assessed for completeness, the appropriate timeframe, and any outliers.

Output Data. The purpose of this review is to confirm that the model produces the output data fields and datasets that are intended based on model documentation. The model should be independently executed and the output data should be verified to match the results produced by the original version provided to the reviewer.

5.1.3. Model Operations

Models may be based in a number of software platforms including SAS, Excel (with VBA), and STATA. The purpose of this review is to ensure that the model performs as intended based on operational design. This includes the following:

Operational. The model should run without error, all model components should be functional, and the model should produce all intended results. The following validation should also be performed:

Thorough review and validation of all Excel tools and interfaces with the Credit Subsidy Calculator (CSC2). The review and findings must be included in the final report for each model/program.

Part of the IV&V review must be a validation that the correct loan level cash flows are linked or are being properly fed to the cash flows read by the CSC2.

Technical. This review should confirm that the model is free of syntax, coding, and formulaic errors.

Design. This review ensures that the model is consistent with the technical specifications, which should be consistent with the model methodology.

5.1.4. Model Documentation

Model documentation includes program descriptions, model technical documentation, model user guides, and memos related to each phase of model development and execution. Memos include descriptions of model enhancements and updates, analysis of change, and sensitivity analysis. These documents should be reviewed for completeness and accuracy in description of model functionality, methodology, and assumptions. Documentation should also be confirmed for consistency with federal credit reform and audit guidelines.

5.2. Subsidy Modeling Fiscal Year Cycle

Each fiscal year, SBA executes four modeling phases that cover model enhancements, re-estimates, and budget formulation. IV&V review is required for all models for the following phases:

Phase I – The primary purpose of the Phase I review is to test that any model enhancements were appropriate and implemented correctly. Model enhancements may include changes due to new program structure, new estimation methodology, previous errors, or operational streamlining. The reviews are performed in May and June.

Phase II – The primary purpose of the Phase II review is to validate any corrections made in response to Phase I audit findings, validate the absence of any other unintended changes and to re-run the model in order to validate the cash flows and subsidy rates that result from updating actual performance data through June 30. The reviews are performed in September.

Phase IV – The primary purpose of the Phase IV review is to assess the methodology, operation, and results of the President’s Budget formulation models for the upcoming fiscal year. The reviews are performed in November.

The Phase III President’s Budget re-estimates does not require IV&V review due to limited model change.

5.3. Deliverables and Milestones

The annual IV&V entails a review of selected models for the three identified model update Phases requiring IV&V review. There are four models or programs currently selected for IV&V: 7(a) Small Business Loans (7(a) SBL), 504 Certified Development Company (CDC) loans, Direct Disaster Assistance Loans (DDL), and Secondary Market Guarantee (SMG). However, if in the future additional models are added, therefore requiring additional IV&V, this will be accomplished via a negotiated bilateral modification.

Each phase culminates in a final report deliverable that covers all models reviewed. However, SBA requires accomplishment of several key milestones for each model to ensure the timeliness and completion of the IV&V review. The next two sections detail the deliverables and key milestones.

5.3.1 Deliverables

Table I details the IV&V deliverable schedule. The Contractor must obtain acknowledgement from appropriate SBA personnel (the COR or CO) for a deliverable to be accepted. The COR will review deliverables, including updates, usually within one business day of receipt. Submission dates of these deliverables must be consistent with SBA’s financial statement audit requirements and allow sufficient time to review the recommendations and act upon them in order to meet financial reporting deadlines. For purposes of the delivery schedule, the terms “day” and “days” shall mean calendar days, unless otherwise noted.

Table I. IV&V Deliverables

5.3.1.1 Deliverable: Phase Final Report

Each phase of review must culminate with a report that documents the results of the review, findings, and recommendations for each model or program. At a minimum, the report should include the following:

· General assessment of each type of review documented in Section 5.1;

· Specific description of any deviations from expected results. At a minimum:

· Inconsistencies with model documentation, model methodology, industry standards, credit reform guidance;

· Mechanical and operational errors in code or formulas.

· Recommendations for methodological changes with regard to assumption estimation or operational improvement of models;

· Assessment of any potential risk areas.

5.3.1.2 Deliverable: Internal Controls, Quality Assurance Plan and Measures The Contractor shall develop and implement policies related to information control. The Contractor shall develop and implement a system of internal controls. The contractor shall develop and implement procedures to identify and bring to the attention of the COR and CO in writing, within 24 hours of notice, of any potential or actual conflicts of interest that exist as a result of providing these services.

The contractor shall provide a Draft Quality Control Plan with their proposal.

Within 30 days of the contract Award, the Contractor shall provide a Final Quality Control Plan that will provide for complete quality control. The Plan shall include a defined process and personnel identification by title.

Deliverable: Provide a Draft Quality Control Plan with the proposal and 30 days after Award provide the Final Quality Control Plan as specified above.

5.3.2 Milestones

Each phase review is a fluid and time sensitive schedule. The Vendor is expected to work closely with the COR to establish the schedule of key milestones prior to each phase and to ensure each milestone is met. Each milestone is intended to keep the review of each model on track towards the due date for the IV&V Final Report that covers all four selected models for each phase.

The review performed during each phase will include the following milestones for each model:

SBA Delivers Model – SBA will deliver each model to the IV&V team, including model documentation, all inputs and programs necessary to execute the model, and model outputs for replication.

Questions to SBA – Upon initial review for each model and prior to the preliminary findings presentation, a list of written questions will be provided to the Director of OFAM to be answered by SBA.

Preliminary Findings Presentation – After submission of questions, a meeting will be held at SBA’s office to review preliminary findings and discuss outstanding questions provided to SBA.

Draft Initial Findings – After each model review and before the final report, a document that describes the initial findings and comments for each model should be provided to the Director of OFAM. The scope of the initial findings should cover the same assessment areas as the Final Report.

SBA will request a staggered review of the models based on SBA’s completion of them. Tables II-IV provide a typical schedule of the milestones for each phase. The dates below are provided for bidding purposes and milestone dates will be finalized post-award and must be confirmed with the COR prior to the beginning of each Phase IV&V. Milestone dates may change as dates for budget submission, providing re-estimates for the SBA’s financial statements, SBA’s model completion schedule, or as analyses deliverable dates are changed. The COR will provide at least five days’ notice of a change in a milestone date.

Table II – Typical FY 16 Phase I IV&V Milestone and Deliverable Schedule

Deliverable: Phase I Final Report Due on or before July 1, 2016

Table III – Typical FY 16 Phase II IV&V Milestone and Deliverable Schedule

Deliverable: Phase II Final Report Due on or before October 1, 2016

Table IV – Typical FY 16 Phase IV IV&V Milestone and Deliverable Schedule

Deliverable: Phase IV Final Report Due on or before December 1, 2016

5.4. Key Personnel

The Contractor shall provide key staff in a sufficient quantity to accomplish the tasks outlined in this document.

The Vendor shall be required to provide trained analysts in sufficient quantity to participate in the credit reform modeling arena. Knowledge of SAS and Excel, including Visual Basic, to test and validate credit reform cash flow models, and an ability to work with large data bases (for some programs well in excess of one million loans and hundreds of millions financial transactions) are also required.

The Vendor shall be capable of providing professional personnel in the skill categories described below in order to accomplish the anticipated requirements.

The minimum qualifications are:

5.4.1. PROJECT MANAGER / EXPERT FINANCIAL ANALYST

The Project Manager shall be the Main Point of Contact for this contract and shall serve as the direct liaison to SBA OFAM. This senior staff member is responsible for the supervision and management of Contractor’s personnel, as well as interfacing and compliance with instructions from SBA’s Contracting Officer Technical Representative (COR). The manager is also expected to be a Working Project Manager with the technical experience to advise on modeling tasks, to review the technical work of other contracting staff, and to advise SBA staff on best practices for modeling credit risk and ensuring compliance with the Federal Credit Reform Act (FCRA). The Project Manager should have a minimum of three years of experience, with five years preferred, building and evaluating credit models of similar complexity compliant with FCRA.

As a technical authority in the area of financial and econometric analysis and modeling, the Contractor exercises broad responsibilities to solve extremely complex problems pertaining to financial, accounting, budget and credit modeling issues. The Contractor is responsible for providing expert analysis and advice regarding credit subsidy modeling and financial issues. In this capacity, the incumbent:

1. Leads in the testing and review of credit subsidy models, analyses, loan performance statistics and cash flows by developing parallel validation tools.

2. Plans, designs, and conducts comprehensive test plans of significant scope and complexity relative to the Agency’s credit subsidy models; applies industry best practices for financial model validation.

3. Leads in identifying problem areas; determines appropriate action required to improve model effectiveness; and maintains the integrity of the Agency’s credit modeling process and financial information.

4. Reviews and constructively criticizes existing model methodologies and procedures and proposes new and/or revised methodologies and procedural issuances based on acquired experience and knowledge of the applications and interpretation of program instructions.

5. Provides information and documentation of the independent validation and verification review in support of the Agency budget and financial statement re-estimate submissions.

5.5. The Key Personnel under this Contract are:

Name Title

(Complete / provide with proposal)

a) Acceptance of Key Personnel Substitutions/Replacements - Performance of a key personnel position by any individual other than the one listed in the evaluated offer must be presented in writing to the COR and CO prior to any actual substitution. Additionally, the COR and CO must provide prior approval of any key personnel substitution in writing. In evaluating the justification and proposed substitution(s) of key personnel throughout the period of performance of this contract, the Contracting Officer reserves the right to make an assessment on the technical and/or professional qualifications of the proposed substituting individual(s). The Contracting Officer further reserves the right to disallow the utilization of the proposed substituting individual(s) for performance on the subject contract, when the technical and/or professional qualifications of the proposed individuals are determined, by the Contracting Officer, (1) not to be substantially equivalent to the technical and/or professional qualifications of the key personnel they are to substitute, or (2) not sufficient to reasonably insure successful performance or otherwise endanger project performance, progression, or completion.

5.6. Order Administration

The Vendor will handle all documents in connection with this requirement as follows:

· The Vendor will not release or disclose any information or documents created in the performance of this contract outside the Government or within its own entity, aside from sharing the information or documents with any of its own employees or contractors working directly on this contract award.

· The Vendor will not use the documents or information for any reason other than to perform services for SBA in connection with this requirement.

5.7. Travel

No Travel required

5.8. Data Delivered

All analyses, reports, documentation, briefings, in whatever medium or format, developed and conducted under this task order are Government property. The Government, and not the Contractor or its employees, or contractors, will retain exclusive and unlimited rights to use, distribute, disclose, and/or publish these data. Any data developed in the performance of this contract shall not be released or disclosed outside of SBA to any third party without the permission of the COR.

5.9. Other Direct Costs

IAW SOP 90 47 3 Information System Security Program; http://collab.sba.gov/sops/Documents/9047/90%2047%203.pdf.

(See all references to Sensitive Data through-out the PWS).

1.Sponsor contractor in USAccess for PIV cards 2.Submit clearance package for new contractor (see below) Packages should contain:

eQIP initiation form SBA Form 1228 Position Description or Statement of Work Position Designation Form (signed and dated by the COR) https://www.opm.gov/investigations/background-investigations/position-designation-tool/ SBA Form 1939 filled out as guided by the OPM tool Resume with all dates of employment in month/year-month/year format All forms should be typed or very neatly printed; illegible forms will be returned.

If an investigation is required, CORs will then need to provide:

eQIP Signature Pages OPM Form OF-306 SBA Form 2044 (only if position is moderate risk or higher) SBA Form 2 for cost of the Investigation The 1228 will not be signed until the contractor completes enrollment for the PIV card and has a positive background check.

Local Clause - ** AS APPLICABLE TO THIS REQUIREMENT **Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each contractor and subcontractor must comply with Agency Personal Identity Verification (PIV) procedures when the contractor and subcontractor will have unescorted physical access to a federally-controlled facility and/or access to a federally-controlled information system (including, but not limited to, computer systems, networks, or information technology infrastructure).

**In addition, data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, and statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C. § 552a). The contractor and its subcontractors will be held accountable for adherence to these statutes, regulations and guidance, as well as following SBA requirements described in this clause. Thus, anytime the term contractor is used, it shall be meant to include the contractor and all of its subcontractors working on this contract that have access to a federally-controlled facility and/or routine access to a federally-controlled information system (including, but not limited to, computer systems, networks, or IT infrastructure).

**In addition, various Federal requirements obligate SBA to establish controls to limit access to PII and sensitive information, as defined below, to authorized personnel. These include OMB Circular A-130, Appendix III, and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

a. General. The contractor, within 30 days of contract award, must develop a final Systems Security Plan (SSP), which shall be updated at least annually. The SSP will be reviewed by the COTR or designated technical point of contact. The SSP must establish administrative, technical, and physical security measures at the contractor’s computer facility to protect sensitive and personally identifiable information (PII) from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA. Sensitive information includes: Sensitive but Unclassified (SBU) information; procurement sensitive information; For Official Use Only (FOUO) information; information generated by or in the possession of SBA that is commercially valuable, trade secret, market sensitive, proprietary, related to an SBA enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed sensitive, confidential or non-public by an SBA office head, and is not otherwise available to the public. This definition applies to sensitive information in any form, including documents, electronic mail, computer files, conversations, and audio or video recordings. Examples of sensitive information include corporate financial data provided to SBA that has not been made public; SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act, 5 U.S.C. § 552a.

**b. Protection of Sensitive and PII Data. Physical access to the contractor’s office areas that contain sensitive and PII SBA data, including SBA loan and any other data subsequently identified by SBA as sensitive or PII, must be controlled to prevent unauthorized personnel from acquiring access to this data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. Contractor personnel must comply as follows:

(1) The 1228 “Computer Access/Clearance Form” (available from the YES page) must be read and signed.

(2) Passwords must be changed every 90 days.

(3) The contractor shall notify the COTR as soon as it is known that a contractor will no longer be working on the contract. The contractor’s project manager must ensure that all personnel leaving this contract return all issued identification and any government property no later than the last day of their employment on the contract. Such identification and property must then be provided to the COTR within 24 hours.

(4) The contractor must not release SBA data outside of its facility, either orally or in written form, without the express written consent of the SBA COTR. The contractor must refer all requests for SBA data to the assigned SBA COTR for action.

(5) SBA reserves the right to inspect the contractor’s security measures, data handling procedures and other security safeguards to determine the security posture of the contractor facility. The contractor shall provide SBA access to the contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of this contract, with no additional cost to SBA. Authorized SBA personnel include the Chief Information Security Officer (CISO), the Contracting Officer (CO), the COTR, the Office of Inspector General (OIG) and other personnel designated by the Chief Information Officer (CIO).

(6) Weaknesses in physical, personnel, or computer security noted by SBA during the accreditation process must be corrected as specified by the CISO. Quarterly updates of the status of the corrective actions must be in writing and forwarded through the COTR to the information system owner.

(7) Contingency plans must be implemented and tested annually, at a minimum, to avoid loss of SBA data and to minimize, within the provisions of the contract, the impact of contingencies (environmental failures, fire, severe weather, natural disasters, etc.) on services provided to SBA. Contractors must develop and provide plans for responding to security incidents, as that term is used in OMB Circular A-130, Appendix III, involving sensitive data and PII, and procedures for making any changes to the data processing environment. Documentation must be provided to the COTR within 30 days from the date of contract award. (See NIST 800 53, as revised.)

**c. Information Handling and Disposition.

(1) Sensitive data and PII when distributed electronically must be protected against unauthorized disclosure and modification. At a minimum, draft and final documents must be encrypted.

(2) The CO’s approval is required prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of sensitive information received under, generated under, or relating to this contract. The contractor support team will be required to abide by government and Agency guidance for protecting sensitive data and PII. Any such information made available in any format will be used only for the purpose of carrying out the provisions of this agreement. Such information will not be divulged or made known in any manner to anyone outside the Agency or removed from approved work sites without approval from the COTR or other authorized SBA personnel. The contractor support team will immediately notify the COTR upon discovery of any inadvertent disclosures of information. The contractor will not disclose sensitive or proprietary information of, or in the possession of, SBA or any of its operating units, contractors, or business partners to unauthorized persons. The contractor will be subjected to any and all penalties imposed by law for unlawful disclosure of SBA information which may include termination of the contract.

(3) Sensitive data and PII, and/or equipment will only be disclosed to authorized personnel with “a need-to-know” as described in the contract or order. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established prior to storing SBA data to ensure the security and confidentiality of this information. Data containing PII information is prohibited from being used as test data or stored in a non production-processing environment for development/testing.

(4) All contracts supporting SBA’s Information Systems shall require Internet Protocol Version 6 (IPv6) compliant products to be included in all new IT acquisitions using Internet protocol.

**d. Contractor Background Investigations. The following guidelines apply to contractor background investigations:

(1) Office of Management and Budget (OMB) Circular A-130 requires that as a condition for access to Government Automated Information System (AIS) (including data), SBA must screen contractor personnel commensurate with the level of risk presented by their access to sensitive SBA systems. Not all SBA automated information systems (AIS) and data are considered sensitive. SBA policy is to perform background investigations on personnel accessing sensitive data and PII to perform their primary job functions. (See SOP 90 47 2a.)

(2) SBA designates all contractor positions requiring access to AIS and physical access to a federally-controlled facility as Moderate Risk and requires a minimum background investigation (MBI) or higher level, if required by SBA, for all such contractor employees. An adjudicated background investigation is required for all contractor personnel who cannot show positive results of a recent MBI (one that was successfully adjudicated within the last five years or the contractor has not had a break as a contractor from the Federal Government exceeding two years) or higher level investigation, such as a Limited Background Investigation or other background investigation. The COTR or designated staff may assign each contract labor category a higher security sensitivity rating, which will determine the type of background investigation to be performed for that labor position.

(3) The Office of Security Operations (OSO) in the Office of Inspector General, Office of Investigations, will coordinate with the Office of Personnel Management (OPM) which will perform all required investigations. Any background investigation received by a contractor prior to employment on an SBA contract must have been conducted by OPM (or contracting firm approved by Defense Security Service (DSS) and/or OPM.) In order to be accepted by SBA, a contractor’s background investigation must be reviewed and approved by OSO to determine if it meets OPM’s standards.

The background investigation must also meet the requirements applicable to all other SBA contractor personnel. DEVIATION: SBA will pay OPM directly the total cost for each investigation (cost is subject to an increase by OPM each fiscal year). The FY 2010 cost is $591.00. Background investigations are not required if the contractor is not working in an SBA facility, not accessing an SBA information system, and working with non-sensitive, non-personally identifiable data.

(4) Investigation results will be reviewed by OSO for adjudication. The COTR will be informed of any issues requiring additional action by the contractor.

(5) The COTR will request the contractor to complete the 1228 “Computer Access/Clearance Form” and provide additional information (e.g., social security number, date and place of birth, position description). This information will be submitted to OSO to initiate the clearance process.

e. Designation of a System Security Officer (SSO). The contractor shall designate a management official responsible for fulfilling the responsibilities of an SSO who is knowledgeable in Automated Data Processing technology and computer security methodology. The SSO shall:

(1) Ensure that an appropriate level of physical, operational, and technical security is maintained to protect the computing environment(s) and facility that process SBA information, and the information is processed in accordance with SBA policy. This must include implementing controls described in an SBA approved System Security Plan and ensuring vulnerability scanning is routinely conducted for all devices supporting Agency operations. Scanning should also be conducted by the contractor’s external auditors as a part of the scope of the SAS 70 Type II evaluation.

(2) Assist SBA’s CISO in the investigation of information technology security breaches that affect processing at the contractor’s facility.

(3) Implement, at the direction of SBA’s CISO, SBA AIS security policies, procedures, and standards that affect systems that process SBA information at the contractor’s facility.

(4) Support SBA’s CISO in maintaining the system security plan and in conducting periodic information security audits and internal control reviews. Reviews will be scheduled and conducted at least every three years, and additionally, as required by changes in the system, data, and operating environment.

(5) Recommend security enhancements and improvements where appropriate.

(6) Ensure the timely correction or remediation of discrepancies found during the periodic information security audits and internal control reviews.

(7) Ensure that an accurate inventory list of all networking devices and licensed software products is maintained.

(8) Ensure that security patches and updates are applied to SBA-owned, contractor operated computing devices in a timely fashion.

(9) Notify information system owner of all security incidents immediately after they are discovered. Detailed follow-up reports must be submitted to the CISO describing the incidents, successful/unsuccessful network penetrations, root or user account compromises, denial of service attacks, website defacing attacks, malicious code, viruses, probes and scans, etc.

(10) Ensure that all contractors with access to SBA’s IT systems and/or sensitive data and PII, complete the annual Computer Security Awareness Training (CSAT) and report status of completion to SBA for tracking. New contractors must complete the CSAT within 45 days from starting to work as an SBA contractor.

(11) Provide SBA with a copy of the facility’s Statement of Auditing Standard 70 (SAS-70) in accordance with Federal guidelines over hosted applications as outlined in NIST 800-53, Recommended Security Controls for Federal Information Systems and Organizations and provisions of OMB Bulletin 07-04, Audit Requirements for Federal Financial Statements. The SAS-70 is a “Report on the Processing of Transactions by Service Organizations” where professional standards are set up to audit and assess internal controls of that specific service organization. In this instance, the specific organization would be the outsourcing facility that hosts and/or processes data belonging to SBA. The SAS-70 serves as SBA’s verification that the facility has satisfactory controls and safeguards in place to protect Agency data housed at a third party service provider.

(12) SBA system owners will ensure that all contractors that have been granted access to one or more of SBA’s information systems are provided with a copy of the system’s “Rules of Behavior” which is a group of standards detailing permissible actions while using the system.

f. Service Level for Reporting, Review and Resolution. SBA system owners and contractors hosting SBA systems off-site, must ensure the system is capable of logging and the logging feature is enabled. Logs should capture account, name, normal and exceptional activities time, data and source of occurrence. Logs for privileged accounts (e.g., administrator, auditor, database administrator) must be set up to capture all activities carried out with these accounts with controls that cannot be altered by an individual. The contractor shall include in their proposal an established process and designated resources for the review and monitoring of such logs.

(1) Frequency of review of system and audit logs

a. Logs must be reviewed daily.

b. Critical and High alerts must be addressed within one hour.

(2) Log Retention

a. Logs must be kept for at least 90 days before deleting. After 90 days, logs must be archived offline.

b. Archived logs must be kept for at least one year.

(3) Turn-around time for reporting of events such as security incidents and violations.

a. Security incidents and violations need to be reported to SBA within one hour.

(4) Turn-around time for resolution of reported security problems

a. Reported security problems must be resolved within three business days of initial report.

(5) Turn-around time for applying approved security patches, updates and changes

a. Security patches, updates and changes need to be applied within one week from release date. However, quality assurance testing must be done on all patches, updates and changes before they are applied.

(6) Submission of reports such as periodic problems, audit and system reports

a. Weekly report submission is required.

g. SBA Information Technology Security Program Requirements. The following Federal laws, OMB/NIST/SBA Policies and Guidelines are applicable to operating or hosting all SBA systems. See documents and links below:

SBA’s IT Security Policies Please access the website to review and comply with the following SOPs pertaining to SBA’s Information Security Program:

• SBA Standard Operating Procedure (SOP) 90 47 2, Automated Information Systems Security Program

Upon request, the contracting officer or the COTR will provide you with copies of the following documents:

Patches (October 22, 2000)

Public Law and Statutes http://www.whitehouse.gov/omb

Office of Management and Budget (OMB) Circulars and Bulletins:

http://www.whitehouse.gov/omb

E-Government Act of 2002;

Federal Information Processing Standards Publications (FIPS PUBs):

http://www.nist.gov/index.html

5.11. Place of Delivery

All deliverables shall be delivered to the COR located at SBA Headquarters location, Washington, D.C. or as otherwise identified.

5.12. Post Award Meeting with SBA

The post award meeting will be held either in person or by conference call after awarded. Post award will be arranged by the Contracting Officer approximately 10 days after award. Contractor's representatives and SBA IV & V Team members (Contracting Officer, Contracting Officer Representative, and other SBA team members as deemed appropriate) will cover the scope of the requirement.

The COR will monitor customer satisfaction with the Contractor’s performance through review of overall performance. SBA reserves all rights and remedies under the provisions and clauses of the contract when performance of any contract requirement is unacceptable.

5.14. Final Evaluation

A separate evaluation will also be accomplished, as required for all contracts exceeding $100,000, will reflect the Contractor’s overall performance and it will be included in the Contractor Performance Assessment Reporting System (CPARS) database.

Nothing in this clause shall abridge the Government’s right to pursue contractual remedies under other terms or conditions of this contract.