SF 1449 2031JW26Q00074 Tri-Merge CRS_RFQ.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

OCC

Washington DC 20219

400 7TH STREET SW

Acquisitions Management Comptroller of the Currency

OCC-DCOC45 CODE 16. ADMINISTERED BYCODE

X

X

561450

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

07/17/2026 1200 ET

06/29/2026

ANETHRA FACIONE

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

2031JW26Q00074

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 36 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20024

400 7TH STREET, SW

HEADQUARTERS BUILDING #4

15. DELIVER TO

Washington DC 20219

400 7TH STREET SW

Acquisitions Management

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$41

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Comptroller of the Currency

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

The Department of Treasury's Office of the Comptroller of the Currency (OCC), Office of the Chief National Bank Examiner (CNBE) seeks to procure tri-merge credit reporting services to deliver consolidated credit reports sourced from the three major credit bureaus (Equifax, Experian, and TransUnion) via competition for commercially available items. Attachment A is provided as a template for properly pricing out all items needed. The resulting delivery order

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

DATED

ANETHRA FACIONE

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

type will be firm-fixed-unit-price (FFUP).

Completion of the Standard Form (SF) 1449: The

NASA SEWP contract holder should, at a minimum, fill-in block 24 ("AMOUNT") with its subtotal pricing for each contract line item (CLIN) and total price for the order, then data, sign and print or type the name and title of the signer in blocks 30a-c.

Acceptance of the Government's proposal, provisions and clauses are required via return signature of this SF 1449 and Attachment

B-Solicitation Provisions Attestations.

(SEE CONTINUATION SHEETS FOR DETAILS)

Period of Performance: 09/14/2026 to 09/13/2027

0001 0001 - Tri-Merge (Transunion, Experian, and 1 LO

Equifax) Credit Reporting Services

Inclusive of surcharge and regulatory recovery fees; NTE 420 Reports

Anticipated Award Type: Firm-fixed-price

1001 1001 - Tri-Merge (Transunion, Experian, and 1 LO

Equifax) Credit Reporting Services

Inclusive of surcharge and regulatory recovery

Continued ...

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

36 2 of

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 36

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00074

fees; NTE 420 Reports

Anticipated Award Type: Firm-fixed-price

(Option Line Item)

Period of Performance: 09/14/2027 to 09/13/2028

2001 2001 - Tri-Merge (Transunion, Experian, and 1 LO

Equifax) Credit Reporting Services

Inclusive of surcharge and regulatory recovery fees; NTE 420 Reports

Anticipated Award Type: Firm-fixed-price

(Option Line Item)

Period of Performance: 09/14/2028 to 09/13/2029

3001 3001 - Tri-Merge (Transunion, Experian, and 1 LO

Equifax) Credit Reporting Services

Inclusive of surcharge and regulatory recovery fees; NTE 375 Reports

Anticipated Award Type: Firm-fixed-price

(Option Line Item)

Period of Performance: 09/14/2029 to 09/13/2030

4001 4001 - Tri-Merge (Transunion, Experian, and 1 LO

Equifax) Credit Reporting Services

Inclusive of surcharge and regulatory recovery fees; NTE 300 Reports

Anticipated Award Type: Firm-fixed-price

(Option Line Item)

Period of Performance: 09/14/2030 to 09/13/2031

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 4 | 36

Table of Contents

SECTION A – STANDARD FORM (SF) 1449

SECTION B – CONTINUATION FROM SF-1449 (SCHEDULE OF

SUPPLIES/SERVICES)

1.0 GENERAL

2.0 LINE ITEM NUMBERS (LINs)

3.0 BACKGROUND

4.0 DESCRIPTION OF SERVICES AND SUPPLIES

5.0 TRI-MERGE CREDIT REPORTING SERVICES DELIVERABLES

6.0 TRAVEL

7.0 SECTION 508 ELECTRONIC AND INFORMATION TECHNOLOGY

STANDARDS

8.0 OCC SECURITY AND PRIVACY REQUIREMENTS

SECTION C – CLAUSES AND OTHER TERMS AND CONDITIONS

1.0 APPLICABLE CLAUSES

2.0 OTHER TERMS AND CONDITIONS

3.0 TYPE OF CONTRACT

4.0 ADMINISTRATIVE MATTERS

5.0 INVOICING PROCEDURES

SECTION D – CONTRACT DOCUMENTS, EXHIBITS AND/OR ATTACHMENTS

1.0 LIST OF ATTACHMENTS

SECTION E – SOLICITATION PROVISIONS, INSTRUCTIONS, AND EVALUATIONS

1.0 APPLICABLE PROVISIONS

2.0 INSTRUCTIONS TO QUOTERS OF COMMERCIAL BUYS

3.0 EVALUATIONS AND BASIS OF AWARD

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 5 | 36

See the cover and continuation sheet of the standard form (SF) 1449 for details.

NOTE: Communication with other officials may compromise the integrity and competitiveness of this acquisition, which could result in the cancellation of the solicitation and/or exclusion of your quotation. Therefore, limit your communications accordingly.

SECTION B – CONTINUATION FROM SF-1449 (SCHEDULE OF SUPPLIES/SERVICES)

1.0 GENERAL

The Department of Treasury’s Office of the Comptroller of the Currency (OCC), Office of Acquisition Management on behalf of the OCC’s Office of the Chief National Bank Examiner (CNBE) is seeking tri-merge credit reporting services to deliver consolidated credit reports sourced from the three major credit bureaus (Equifax, Experian, and TransUnion). The solicitation is issued in accordance with Revolutionary FAR Overhaul (RFO) 12 for Acquisition of Commercial Products and Commercial Services under RFO 12.201-1 Simplified procedures for establishing a single-award contract. The Government will NOT be restricting this procurement to any specific business size or class. The Contractor shall, however, be registered in the System for Award Management (SAM) with the assertion of the North American Industry Classification System (NAICS) code 561450 —Credit Bureaus, noting a size standard of $41M. The coordinating Product Service Code (PSC) is R611—Support- Administrative:

Credit Reporting. The resulting contract shall be for a period not to exceed 5 years (60 months).

2.0 LINE ITEM NUMBERS (LINs)

The Contractor must furnish all supplies/services as specified herein to be furnished to the Government, including deliverables and must do all that which is necessary or incidental to the satisfactory and timely to satisfactorily meet performance of the requirements. The Contractor must furnish the tri-merge services via the line items required under a resulting contract at a firm-fixed-unit-price (FFUP) basis per the Price Schedule table below:

2.1 September 14, 2026 through September 13, 2031)

LIN Task Description Qty Unit/ Amount Unit Price Extended Price

Tri-Merge (Transunion, Experian, and Equifax) Credit Reporting Services Inclusive of surcharge and regulatory recovery fees;

NTE 420 Reports

1 LOT

Tri-Merge (Transunion, Experian, and Equifax) Credit Reporting Services Inclusive of surcharge and regulatory recovery fees;

NTE 420 Reports

1 LOT

Tri-Merge (Transunion, Experian, and Equifax) Credit Reporting Services Inclusive of surcharge and regulatory recovery fees;

NTE 420 Reports

1 LOT

Tri-Merge (Transunion, Experian, and Equifax) Credit Reporting Services Inclusive of surcharge and regulatory recovery fees;

NTE 375 Reports

1 LOT

SECTION A – STANDARD FORM (SF) 1449

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 6 | 36

LIN Task Description Qty Unit/ Amount Unit Price Extended Price

Tri-Merge (Transunion, Experian, and Equifax) Credit Reporting Services Inclusive of surcharge and regulatory recovery fees;

NTE 300 Reports

1 LOT

TOTAL COST FOR BASE + OPTIONS

3.0 BACKGROUND

The Office of the Comptroller of the Currency (OCC) is an independent bureau of the United States Department of Treasury. The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises federal branches and agencies of foreign banking organizations. Headquartered in Washington, D.C., the OCC has offices in approximately 50 cities nationwide, with teams of examiners that work from more than 70 operating locations. Additional information on the OCC may be found here: About | OCC (treas.gov).

The OCC’s mission is to ensure the institutions (which comprise the federal banking system) operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations. To do so, the OCC has an established Chartering, Organization and Structure (CO&S) Department is responsible for ensuring that the corporate structure of national banks and Federal savings associations is established and maintained in accordance with applicable laws, regulations, and the principles of a safe and sound U.S. banking system. The CO&S Department reviews, analyzes, and renders decisions on filings related to the establishment of new institutions, structural changes, and modifications to the activities of national banks, federal savings associations, and federal branches and agencies of foreign banks. As part of this process, CO&S conducts background investigations, including credit checks, to assess the character, competence, experience, and integrity of individuals, and when applicable, national security eligibility of individuals associated with these entities.

4.0 DESCRIPTION OF SERVICES AND SUPPLIES

4.1 Scope

On July 18, 2025, the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act was signed into law, governing a unified national regulatory standard for dollar-pegged stablecoin issuers and payment stablecoins in the United States. The GENIUS Act establishes a comprehensive Federal regulatory framework for payment stablecoins and their issuers. It is designed to close regulatory gaps, address financial stability risks, and maintain the dominance of the U.S. economy in a digital age. The OCC is a central player in the regulatory scheme developed by the GENIUS Act as the OCC will be the primary regulator for the issuance of federal licenses and approval for foreign registrations under sections 5(12 USC 5904) and 18(a) (12 USC 5916(a)) of the GENIUS Act. Within the OCC, CO&S will be responsible for receiving, reviewing and deciding all applications for licenses or registrations under the GENIUS Act.

To accommodate all eligible filers under the GENIUS Act, which includes national banks, federal savings associations, federal branches, non-bank entities, and foreign entities, CO&S must conduct background investigations, including credit checks, on the proposed management staff. Failure to approve will negatively impact the OCC’s ability to meet the statutory requirements under the GENIUS Act, possibly introducing financial instability to the U.S. economy. The GENIUS Act is effective the earlier of: 1) 18 https://www.occ.treas.gov/about/index-about.html

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 7 | 36 months after the enactment date of July 18, 2025, or 2) 120 days after the OCC issues the final regulations implementing the GENIUS Act. (GENIUS Act Regulations: Notice of Proposed Rulemaking | OCC).

The Contractor must provide uninterrupted, enterprise-wide access to a secure, contractor-hosted, web-based solution (FedRAMP authorization, or equivalent federal security authorization, is preferable). The solution must enable OCC-authorized employees to request and obtain credit reports on individuals in accordance with the requirements set forth in Section 4.2, Tri-Merge Credit Reporting Services and Specifications listed below.

With an anticipated increase in application activity as a result of the GENIUS Act, CO&S expects to process approximately 840 background credit checks requests for the first 2 years. The Contractor must generate tri-merge credit reports to deliver consolidated credit reports sourced from the three major credit bureaus (Equifax, Experian, and TransUnion).

4.2 Tri-Merge Credit Reporting Services and Specifications

4.2.1 The Contractor’s system must be available 24 hours per day, 7 days per week, and allow OCC-authorized users to order, generate, and print reports in an easy-to-read format

4.2.2 Customer service and technical support, with options for telephone, online help, and website support, provided 24 hours per day, 7 days per week, at no additional cost

4.2.3 The Contractor must deliver comprehensive pre-employment credit data, merged into one file from the three major credit bureaus, including:

4.2.3.1 Fraud alerts and fraud shield summaries;

4.2.3.2 Seven (7) years, if applicable, of credit history;

4.2.3.3 Credit and related data for individuals residing in all 50 states and the U.S.

territories; and

4.2.3.4 Credit reports that include the following information:

4.2.3.4.1 Name and address of the individual – including full names, aliases, and current and prior addresses for all time periods during with the individual held credit accounts;

4.2.3.4.2 All available employment history; and

4.2.3.4.3 Credit history that identifies—

4.2.3.4.3.1 Collection items

4.2.3.4.3.2 Creditors

4.2.3.4.3.3 Opening date

4.2.3.4.3.4 High credit

4.2.3.4.3.5 Debt payment performance – current and past due

4.2.3.4.3.6 Charge offs

4.2.3.4.3.7 Balances and past due amounts

4.2.3.4.3.8 Account status

4.2.3.4.3.9 Credit utilization percentage

4.2.3.4.3.10 Identifies individual’s accounts as joint, individual, co-signor, co-maker, or authorized user

4.2.3.4.4 Duplicate tradelines removed

4.2.3.5 Credit reports are “soft” inquiries on the individual’s credit report and do not affect the individual’s credit scores.

https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-9.html

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 8 | 36

4.3 Period of Performance

This requirement consists of a 12-month base period, with four (4) 12-month option periods.

Additionally, an option to extend the term of the contract for up to 6 months may be required during or after the 5-year contract period (see FAR Clause 52.217-8 for details).

4.4 Place of Performance

The place of performance will be at the Contractor’s facility. The Contractor must attend/participate in a postaward orientation virtually within 5 days of contract award.

OCC’s Observed Federal Holidays

Federal Holidays Designated Dates

New Year’s Day January 1 Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth Independence Day June 19 Independence Day July 4 Labor Day First Monday in September Indigenous Peoples’ / Columbus Day Second Monday in October Veterans’ Day November 11 Thanksgiving Day Fourth Thursday in November Christmas Day December 25

4.4.1 Applicable Wage Determination

Due to there not being a local area set-aside for this requirement, no one wage determination can be referenced for this solicitation, and Quoters must retrieve and abide by any applicable wage rate determinations. FAR Clause 52.222-41 “Service Contract Labor Standards” is applicable to this solicitation. Therefore, Quoters are encouraged to utilize the following link to determine the wage rate of applicable laborers, by state and county, for local areas used to support the resulting contract:

https://sam.gov/content/wage-determinations

5.0 TRI-MERGE CREDIT REPORTING SERVICES DELIVERABLES

Timely submission of deliverables is essential to successfully completing this requirement. Schedules for deliverables are specified within the table below. All deliverables must be prepared and submitted by the Contractor to the Point of Contact (POC) or Designated Official according to the OCC’s Best Practices Guide for Crafting 508-Compliant Word/PDF Documents (see Attachment B) to produce all electronic documents or reports for use by OCC users format, content, and schedule described in the chart below.

https://sam.gov/content/wage-determinations

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 9 | 36

Ref. Sect.# Deliverable Title Frequency Qty Medium/ Format

Part B, Subsection 4.4

Postaward Orientation

Confirmation

No later than 5 days after contract award NTE Emailed Confirmation/

Acceptance

Part B, Sect. 4.0 Tri-Merge Credit

Reporting Services and Specifications

No later than 5 days after requested NTE Emailed in PDF (per Attachment B)

6.0 TRAVEL

Travel is not anticipated under the contract. Therefore, reimbursement of Contractor travel is not authorized.

7.0 SECTION 508 ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS

The Contractor must comply with Section 508 of the Rehabilitation Act (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). See OCC Clause 1052.239-8000 Information and Communication Technology (ICT) Accessibility (JAN 2023) for details.

The Contractor must provide Section 508-compliant Information and Communication Technology (ICT), as well as adhere to the OCC’s Accessibility Best Practices Guide for Crafting 508-Compliant Word/PDF Documents (Attachment B) when producing all electronic documents or reports for use by OCC users.

The Contractor must ensure all ICT and electronic documents, charts, tables, spreadsheets, presentation slides, diagrams, graphics, and/or videos that will be generated to be accessible to OCC’s assistive technology tools for users and/or employees with visual, hearing, or motor manipulation accommodation needs. The OCC currently provides Job Access With Speech (JAWS) Versions 2025/2024/2023, ZoomText Versions 2025/2024/2023, and Dragon Professional Version 16 as approved assistive technology tools.

8.0 OCC SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 10 | 36

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive.

All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [OCC’s Point of Contact].

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific to the OCC, that clearly demarcates the information system authorization boundary and depicts all its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity.

Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1 NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle approach for Security and Privacy.

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 11 | 36

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements.

As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No.

128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations.

These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the [Tri-Merge Credit Report External Service].

Security Updates and Patches. The contractor shall ensure that the [Tri-Merge Credit Report External Service] is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in Vision Insurance.

E. Continuous Monitoring

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 12 | 36

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

For systems/services that are primarily sold to the Federal Government, such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 13 | 36

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintaining the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the POC at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 14 | 36 created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements

Not applicable.

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S.

Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 15 | 36

Authorization Boundary Deliverables

Non-Federal External Service Provider (ESP) Security Documentation Deliverables

Removal of Data Deliverables

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

M21-31 Logging Requirement Section Deliverable Frequency Due Date

E. Continuous Monitoring

Enterprise Logging Proof of Connection and testing for the solution. Coordinate with Cyber Security

Engineering.

Initially, and as changes occur

5 Days After Request

SECTION C – CLAUSES AND OTHER TERMS AND CONDITIONS

1.0 APPLICABLE CLAUSES

FAR 52.252-2 Clauses Incorporated by Reference (FEB 1998) The solicitation and resulting contract will incorporate one or more clauses by reference and the full text of a referenced clause may be accessed electronically at the FAR website: http://www.acquisition.gov/far/

Department of Treasury Acquisition Regulation (DTAR) Clauses Incorporated by Reference may be accessed electronically at the DTAR website: https://www.acquisition.gov/dtar

CLAUSE NO. CLAUSE TITLE CLAUSE DATE

FAR 52.202-1 Definitions JUN 2020

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution.

Initially, and as changes occur

At time of Solicitation

Close; Within 5 Days Upon

Changes Occur

Section Deliverable Frequency Due Date

C. Security and Privacy Authorization. SSAE 18 Requirements.

E. Continuous Monitoring. Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC 2 Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering months the Type II report is delayed.

Initially and annually

At time of Solicitation

Close;

Annual: NLT September 30 http://www.acquisition.gov/far/ https://www.acquisition.gov/dtar

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 16 | 36

CLAUSE NO. CLAUSE TITLE CLAUSE DATE

FAR 52.203-3 Gratuities APR1984

FAR 52.203-6 Restrictions on Subcontractor Sales to the Government, Alternate I APR 2026

FAR 52.203-12 Limitation on Payments to Influence Certain Federal Transactions JUN 2020

FAR 52.203-13 Contractor Code of Business Ethics and Conduct NOV 2021

FAR 52.203-14 Display of Hotline (Poster(s) NOV 2021

FAR 52.203-17 Contractor Employee Whistleblower Rights NOV 2023

FAR 52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements JAN 2017

FAR 52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards RFO DEVIATION

FAR 52.204-13 System for Award Management Maintenance RFO DEVIATION

FAR 52.204-14 Service Contract Reporting Requirements RFO DEVIATION

FAR 52.204-19 Incorporation by Reference of Representations and Certifications DEC 2014

FAR 52.209-6

Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment

RFO DEVIATION

FAR 52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters RFO DEVIATION

FAR 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations RFO DEVIATION

FAR 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services RFO DEVIATION

FAR 52.219-8 Utilization of Small Business Concerns RFO DEVIATION

FAR 52.219-28 Post-Award Small Business Program Rerepresentation RFO DEVIATION

FAR 52.222-3 Convict Labor RFO DEVIATION

FAR 52.222-35 Equal Opportunity for Veterans RFO DEVIATION

FAR 52.222-36 Equal Opportunity for Workers with Disabilities RFO DEVIATION

FAR 52.222-37 Employment Reports on Veterans RFO DEVIATION

FAR 52.222-40 Notification of Employee Rights Under the National Labor Relations Act RFO DEVIATION

FAR 52.222-41 Service Contract Labor Standards RFO DEVIATION

FAR 52.222-42 Statement of Equivalent Rates for Federal Hires Fill-ins for this clause available on request MAY 2014

FAR 52.222-43

Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts)

RFO DEVIATION

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 17 | 36

FAR 52.222-50 Combating Trafficking in Persons RFO DEVIATION

FAR 52.222-54 Employment Eligibility Verification RFO DEVIATION

FAR 52.222-55 Minimum Wages for Contractor Workers Under Executive Order 14026 RFO DEVIATION

FAR 52.222-62 Paid Sick Leave Under Executive Order 13706 RFO DEVIATION

FAR 52.223-23 Sustainable Products and Services RFO DEVIATION

FAR 52.224-1 Privacy Act Notification APR 1984

FAR 52.224-2 Privacy Act APR 1984

FAR 52.224-3 Privacy Training JAN 2017

FAR 52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving MAY 2024

FAR 52.227-17 Rights in Data-Special Works DEC 2007

FAR 52.229-3 Federal, State, and Local Taxes RFO DEVIATION

FAR 52.229-12 Tax on Certain Foreign Procurements (if Identified as Foreign Person Under FAR 52.229-11) FEB 2021

FAR 52.232-1 Payments APR 1984

FAR 52.232-8 Discounts for Prompt Payment FEB 2002

FAR 52.232-11 Extras APR 1984

FAR 52.232-17 Interest MAY 2014

FAR 52.232-23 Assignment of Claims MAY 2014

FAR 52.232-33 Payment by Electronic Funds Transfer-System for Award Management OCT 2018

FAR 52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

FAR 52.232-40 Providing Accelerated Payments to Small Business Subcontractors MAR 2023

FAR 52.233-1 Disputes RFO DEVIATION

FAR 52.233-3 Protest After Award RFO DEVIATION

FAR 52.233-4 Applicable Law for Breach of Contract Claim RFO DEVIATION

FAR 52.240-91 Security Prohibitions and Exclusions RFO DEVIATION

FAR 52.240-93 Basic Safeguarding of Covered Contractor Information Systems RFO DEVIATION

FAR 52.242-13 Bankruptcy JUL 1995

FAR 52.246-4 Inspection of Services-Fixed-Price AUG 1996

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 18 | 36

FAR 52.246-25 Limitation of Liability–Services FEB 1997

FAR 52.249-8 Default (Fixed-Price Supply and Service) APR 1984

FAR 52.252-6 Authorized Deviations in Clauses [(Clause fill-in as follows:

DTAR and OCC Clauses, Where Applicable) RFO DEVIATION

FAR 52.253-1 Computer Generated Forms RFO DEVIATION

DTAR 1052.232-

7003 Electronic submission of payment requests APR 2015

DTAR 1052.210-70 Contractor Publicity APR 2015

Class Deviation No. 2025-00020 — Implementing the Class Deviation from the Federal Acquisition Regulation (FAR) Part 12, Acquisition of Commercial Products and Commercial Services, in accordance with Executive Order (EO) 14275, “Restoring Common Sense to Federal Procurement,” effective November 3, 2025. [The following clause is not included in this solicitation: FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders – Commercial Products and Commercial Services].

AUTHORITY—This class deviation is issued under the authority of EO 14275, OMB Memo M-25-26, 48 CFR 1.4, and RFO FAR 1.304.

FAR CLAUSES INCORPORATED IN FULL TEXT

FAR 52.217-7 Option for Increased Quantity-Separately Priced Line Item (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 1 business day before the contract expiration date. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of Clause)

FAR 52.217-8 Option to Extend Services (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 1 business day before the contract expiration date.

(End of Clause)

FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 1 day prior to the current operating period end date; provided that the Government gives the

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 19 | 36

Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires.

The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months (5 years).

(End of Clause)

OCC CLAUSES INCORPORATED IN FULL TEXT

OCC 1052.204-8000 PROPER IDENTIFICATION OF CONTRACTOR PERSONNEL

(AUG 2020)

(a) All contractor personnel shall provide proper identification in both oral and written communications.

Oral communications include, but are not limited to, in-person, Skype video and audio communications, and teleconference communications. Additionally, when calling into meetings contractor personnel shall identify that they are a contractor by stating their name followed by stating contractor support for their respective OCC business unit.

(b) For written communications, all contractor personnel shall use a signature block that includes identification as a contractor, the name of the contractor personnel’s company, office telephone number, alternate contact (mobile) number (if applicable), and identification of the current assigned Contacting Officer Representative (COR) as stated in the contract.

Name: [Insert Name] Job Title: [Insert Title] (Contractor) Company Name: [Insert Name of Company] COR’s Name: [Insert Name of the current COR] Telephone: Office: (XXX) XXX-XXXX Work Cell: Mobile: (XXX) XXX-XXXX POC’s Name: TBD

(End of Clause)

OCC 1052.232-8002 AVAILABILITY OF FUNDS (APR 2014)

Funds are not presently available for this contract. The Government’s obligation under this contract is contingent upon the availability of non-appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise until funds are made available to the Contracting Officer for this contract and until the Contractor receives notice of such availability, to be confirmed in writing by the Contracting Officer.

(End of Clause)

OCC Tri-Merge Credit Reporting Services for CO&S RFQ #2031JW26Q00074 P a g e 20 | 36

OCC 1052.239-8000 INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

ACCESSIBILITY (JAN 2023)

(a) Pursuant to Section 508 of the Rehabilitation Act of…