SF 33_2031JW26R00001_RFP OGLI_FAR 15.pdf

2031JW26R00001

SOLICITATION, OFFER AND AWARD

4. TYPE OF SOLICITATION2. CONTRACT NUMBER 3. SOLICITATION NUMBER

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than Item 7)

System (DPAS) - Code of Federal Regulations - at 15 CFR 700.

6. REQUISITION/PURCHASE NUMBER

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

NEGOTIATED (RFP) REQUEST FOR

SEALED BID (IFB) INVITATION FOR BID

5. DATE ISSUED

1. This Contract is a Rated Order under the Defense Priorities and Allocations RATING PAGE OF PAGES

1 54

C. E-MAIL ADDRESS

EXT.NUMBERAREA CODE

B. TELEPHONE (NO COLLECT CALLS)A. NAME

10. FOR

INFORMATION

CALL:

CAUTION: LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

(Date)(Hour) local timeuntildepository located in copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if hand carried, in the

SOLICITATION

9. Sealed offers in original and

PART IV - REPRESENTATIONS AND INSTRUCTIONS

OTHER STATEMENTS OF OFFERORS

EVALUATION FACTORS FOR AWARD

INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

REPRESENTATIONS, CERTIFICATIONS AND

LIST OF ATTACHMENTS

CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

I

J

K

L

M SPECIAL CONTRACT REQUIREMENTS

CONTRACT ADMINISTRATION DATA

DELIVERIES OR PERFORMANCE

INSPECTION AND ACCEPTANCE

PACKAGING AND MARKING

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SUPPLIES OR SERVICES AND PRICES/COSTS

SOLICITATION/CONTRACT FORM

PART II - CONTRACT CLAUSESPART I - THE SCHEDULE

H

G

F

E

D

C

B

A

SEC. DESCRIPTION PAGE(S) (X) DESCRIPTION SEC. (X)

11. TABLE OF CONTENTS

18. OFFER DATE17. SIGNATURE

SUCH ADDRESS IN SCHEDULE.

IS DIFFERENT FROM ABOVE - ENTER

15C. CHECK IF REMITTANCE ADDRESS

EXTENSIONNUMBERAREA CODE

15B. TELEPHONE NUMBER

(Type or print)AND

ADDRESS

OF

OFFEROR

CODE FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER15A. NAME

DATEAMENDMENT NO.DATEAMENDMENT NO.

and related documents numbered and dated):

amendments to the SOLICITATION for offerors

(The offeror acknowledges receipt of

14. ACKNOWLEDGEMENT OF AMENDMENTS

CALENDAR DAYS (%)30 CALENDAR DAYS (%)20 CALENDAR DAYS (%)10 CALENDAR DAYS (%)

(See Section I, Clause No. 52.232.8)

13. DISCOUNT FOR PROMPT PAYMENT

designated point(s), within the time specified in the schedule.

by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

OFFER (Must be fully completed by offeror)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

28. AWARD DATE

(Signature of Contracting Officer)

27. UNITED STATES OF AMERICA

25. PAYMENT WILL BE MADE BY

26. NAME OF CONTRACTING OFFICER (Type or print)

CODE 24. ADMINISTERED BY (If other than Item 7)

ITEM

(4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

41 U.S.C. 3304 (a) ( 10 U.S.C. 3204 (a) (

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION UNDER THE

21. ACCOUNTING AND APPROPRIATION20. AMOUNT19. ACCEPTED AS TO ITEMS NUMBERED

AWARD (To be completed by government)

CODE

10/10/2025 X

OCC

Comptroller of the Currency Acquisitions Management

400 7TH STREET SW

Washington DC 20219

1200 ET 10/27/2025

ANETHRA FACIONE

ANETHRA.FACIONE@OCC.TREAS

.GOV

X

X

X

X

X

X

X

X

X

X

X

X

X

PAGE(S)

ANETHRA FACIONE

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 12/2022)

Prescribed by GSA - FAR (48 CFR) 53.214(c)

1-2

3-22 22-23 23-24 25-27 27-29

29-35

37-44

45-50

51-54

12. In compliance with the above, the undersigned agrees, if this offer is accepted within _____160_________ calendar days (60 calendar days unless a different period is inserted

PROPOSAL

UNITED STATES CODE AT:

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 54

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

2031JW26R00001

(A) (B) (C) (D) (E) (F)

0001 1 LO

1001 1 LO

2001 1 LO

3001 1 LO

4001 1 LO

The Department of Treasury's Office of the Comptroller of the Currency (OCC) Office of Acquisition Management (AQM), on behalf of the Office of Human Capital, hereby seeks the acquisition of an experience and qualified contractor to underwrite and administer its group life insurance program for its active and retired employees and their eligible dependents as well as the active employees and eligible dependents of the Office of Financial Research (OFR).

This requirement is being solicited unrestricted and evaluated for award via FAR Part 15 procedures.

The resulting contract type will be firm-fixed-price for a period of 5 years, including one 1-year base period, four 1-year option periods, having an ultimate completion date of December 31, 2030 should all option periods be exercised.

(SEE CONTINUATION SHEET FOR ADDITIONAL DETAILS)

Period of Performance: 01/01/2026 to 12/31/2026

Base Period-Group Life Insurance Services (FFUP)

Option Period One (OP1) - Group Life Insurance Services (FFUP)

(Option Line Item)

Period of Performance: 01/02/2027 to 12/31/2027

Option Period Two (OP2) - Group Life Insurance Services (FFUP)

(Option Line Item)

Period of Performance: 01/01/2028 to 12/31/2028

Option Period Three (OP3) - Group Life Insurance Services (FFUP)

(Option Line Item)

Period of Performance: 01/01/2029 to 12/31/2029

Option Period Four (OP4) - Group Life Insurance Services (FFUP)

(Option Line Item)

Period of Performance: 01/01/2030 to 12/31/2030

OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

NSN 7540-01-152-8067

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 3 of 54

PART I – THE SCHEDULE

SECTION B – SUPPLIES OR SERVICES AND PRICES / COSTS

B.1 See Attachment (1) Price Proposal Spreadsheet for the Contract Line-Item Number (CLIN) structure.

SECTION C – DESCRIPTIONS / SPECIFICATIONS / STATEMENT OF WORK

1.0 GENERAL

The Contractor must provide the services specified herein for a 12-month base period and four 12-month option periods (if exercised) at the rates specified in each CLIN.

The Contractor must underwrite and administer the Office of the Comptroller of the Currency’s (OCC) Group

Life Insurance to support the program for its active and retired employees and their eligible dependents.

1.1 CONTRACT TYPE

The Government anticipates award of a firm-fixed-price.

1.2 CLIN DESCRIPTION AND ARRANGEMENT

The Contractor must furnish all materials, labor, equipment, and facilities except as specified herein to be furnished by the Government and must do all that which is necessary or incidental to the satisfactory and timely performance of the requirements.

The Contractor must furnish all the following items required under a resulting contract at a firm-fixed price (FFP) and firm-fixed-unit-price (FFUP) basis:

1.2.1 Base Period (January 1, 2026 – December 31, 2026)

Line Item # Contract Type Description Amount

0001 FFUP Base Year OCC Group Life Insurance $

Total Base Period $

1.2.2 Option Period One (January 1, 2027 – December 31, 2027)

1001 FFUP Option Period 1 OCC Group Life Insurance $

Total Option Period One $

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 4 of 54

1.2.3 Option Period Two (January 1, 2028 – December 31, 2028)

2001 FFUP Option Period 2 OCC Group Life Insurance $

Total Option Period Two $

1.2.4 Option Period Three (January 1, 2029 – December 31, 2029)

3001 FFUP Option Period 3 OCC Group Life Insurance $

Total Option Period Three $

1.2.5 Option Period Four (January 1, 2030 – December 31, 2030)

4001 FFP Option Period 4 OCC Group Life Insurance $

Total Option Period Four $

TOTAL COST FOR BASE PLUS ALL OPTION PERIODS

1.3 INTRODUCTION

The OCC is a non-appropriated federal financial regulatory independent bureau of the Department of the

Treasury. The OCC charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks.

The OCC is headquartered in Washington, DC with primary locations in Chicago, Dallas, Denver and New York.

The OCC employs approximately 3,650 employees in 70 cities nationwide. The OCC is unique from other federal Government agencies because it offers its employees the opportunity to participate in the federal benefit programs and it has independent authority to provide compensation and benefit programs that are not offered by other agencies. The OCC sponsored benefit programs include, but are not limited to, dental, vision, group life insurance, Accidental Death and Dismemberment (AD&D) benefits, flexible spending accounts (FSA), short and long-term disability and 401(k) programs.

OCC, as a Governmental plan, is specifically exempted from Title I of Employee Retirement Income Security Act

(ERISA). OCC has been offering its own group term life insurance program since the early 1980s, in addition to the federal group term life program known as the Federal Employees Group Life Insurance (FEGLI).

The Office of Financial Research (OFR), which was established within Treasury as a result of Dodd-Frank, has a

Memorandum of Understanding with the OCC for the provision of services related to some of the benefits that the

OFR provides to its employees; therefore, the OFR became a participant in the OCC’s life insurance plan.

Currently, the OFR employs approximately 175 employees, of which 93 are participants of the OCC life insurance program. The OFR employees are located in Washington, DC and New York, NY.

1.4 SCOPE OF WORK

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 5 of 54

1.4.1 General

The OCC is seeking an experienced and qualified contractor (i.e., a qualified insurance company – not insurance brokers/agencies) to underwrite and administer its group life insurance program for its active and retired employees and their eligible dependents as well as the active employees and eligible dependents of the OFR. The retirees of OFR are not eligible to continue this life insurance benefit into retirement. There are approximately

2,577 employees and 2,743 retirees (of which 632 are part of a frozen group, please see Plan Design for more details on this group) enrolled in the OCC Group Life Insurance Program. The current Contractor has delivered, and OCC has accepted Group Policy # 146410-1-G and related Certificates of Insurance (together, the "Policy").

The Contractor will amend the Policy to provide the benefits described in this section “Scope of Work” to include the following provisions:

• Due to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), the addition of the Office of Thrift Supervision (OTS) employees, their eligible dependents and retirees as well as the

OFR employees and eligible dependents have been added to the OCC life insurance program;

• The Supplemental (Optional Employee) maximum coverage will be from $25,000 up to $500,000 or 5 times the employee’s annual salary; and,

• Enrollment or enrollment changes due to a salary increase of Optional employee coverage is up to two multiples of $25,000 ($50,000 maximum). This change can now be made within 60 days of the effective date of the change in salary

In the event the Contractor finds any inconsistencies between the Policy and the Scope of Work section, the

Policy shall govern; however, when necessary, the Contractor must seek guidance from the OCC to ensure a mutually agreeable resolution of the issue.

The OCC Group Life Insurance Program is currently being administered by Metropolitan Life whose current 5-year term contract is scheduled to end on December 31, 2025.

1.4.2 Plan Design

The OCC Group Life Insurance Program must consist of a Basic Life and three additional options. The

Contractor must ensure its plan policy mirrors the OCC’s existing Policy. An employee must elect Basic Life in order to elect any optional coverage. A description of Basic Life and each of the options is as follows:

1.4.2.1 Basic Life for Active Employees

The Contractor must provide Basic Life equal to an employee’s annual pay rounded up to the next higher thousand dollars, plus $2,000. This is the calculation for the Basic Life Amount for all employees except those classified as an “executive.” The Basic Life Amount for OCC executives is a flat $500,000. This is not determined by their actual annual salary but by their OCC grade level.

In addition to an employee’s Basic Life Amount, the coverage includes AD&D benefits, which is computed in the same manner as the Basic Life Amount.

Also, included with Basic Life is an additional Basic Life Benefit which is age-based. The additional Basic Life

Benefit is applicable to employees up to age 45.

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 6 of 54

1.4.2.1.1 Option 1 – Optional Employee Coverage

The Contractor must provide term life coverage, which can be elected in an amount from $25,000 to $500,000 in units of $25,000. The maximum is the lesser of 5 times the employee’s salary or $500,000. Optional Employee

Coverage is life insurance coverage only for employees (not dependents). In addition, the Contractor must provide

Will Preparation and Estate Resolution Services to employees enrolled in the Optional Employee Coverage.

1.4.2.1.2 Option 2 – Spouse/Domestic Partner Coverage

The Contractor must provide term life coverage which can be elected as 50 percent or 100 percent of the employee’s Basic Life Amount. This option provides coverage for an employee’s lawful spouse or domestic partner.

1.4.2.1.3 Option 3 – Family Coverage

The Contractor must provide term life coverage which can be elected in five different units of coverage. Each unit is in multiples of $5,000 for a spouse or domestic partner and $2,500 for children. The maximum coverage amount is $25,000 for a spouse or domestic partner and $12,500 for children.

1.4.2.2 Basic Life for Retirees

The Contractor must provide Basic Life for an OCC retiree (OFR Retirees are not eligible to continue this benefit into retirement) in the same amount, as it was when the retiree was an employee, with the exception of AD&D and the additional benefit becoming no longer applicable. The amount of coverage reduces to 25 percent of the

Basic Life Amount once the retiree attains age 65. However, a Retiree can elect to reduce, at any time, their Basic

Life Amount to $50,000 to avoid imputed income. The Retiree may reduce their coverage at any time, but cannot increase their plan coverage. A decrease in coverage is irrevocable. In that event, once the retiree attains age 65, the coverage will be the lesser of 25 percent of the original Basic Life Amount or $50,000.

Due to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), the Office of Thrift

Supervision (OTS) was merged into the OCC in July 2011. Due to this merger and the protection of the OTS benefits for 1 year after the merger to July 2012, there is a frozen group of former OTS Retirees whose Retiree plan design is different from the OCC Retiree plan design. This group of 606 Retirees current plan participant design must remain as follows:

Basic Life Coverage - The Contractor must include a plan for the existing frozen group (i.e., OTS) plan participants whose coverage consisted of two times their annual pay at the time of retirement, rounded up to the next higher thousand dollars to a maximum of $300,000 for all retirees except for prior Executives or Senior Managers. Executives have the same calculation, but to a maximum of $800,000 and Senior

Managers have a maximum of $600,000.

Optional Spousal/Domestic Partner Coverage - Plan (Retiree) participants must be able to choose either the 50% or 100% of the retiree’s Basic Life Benefit. Retiree pays the full cost of this optional retiree coverage.

Age 65 Reduction Levels: Upon retirement, the (OTS) Retiree must elect the age 65 reduction level for their Basic coverage and their Spousal/Domestic partner coverage, if applicable. The reduction level chosen for the Basic coverage will be the same for the Spousal/Domestic partner coverage.

The reduction levels are as follows:

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 7 of 54

a) 75 percent reduction in the amount of Basic Insurance; the OCC will pay for 100 percent of the OCC life benefit cost. The retiree is responsible for 100 percent of the

Spousal/Domestic Partner coverage, if applicable.

b) 50 percent reduction; the OCC will pay for 25 percent of the premium, and the retiree will be responsible for the remainder. The retiree is responsible for 100 percent of the

Spousal/Domestic Partner coverage, if applicable.

c) No reduction in coverage; the OCC will pay for 25 percent of the premium and the retiree will be responsible for the remainder. The retiree is responsible for 100 percent of the Spousal/Domestic Partner coverage, if applicable.

1.4.3 Eligibility

The following types of individuals are eligible to participate in the OCC Group Life Insurance Program.

They are as follows:

• Employee – A person who is employed by the OCC or OFR in a full-time or part-time position on a permanent or temporary basis.

• Retiree – An employee who has retired from the OCC on an immediate or disability retirement. The employee had to be participating in the OCC Group Life Insurance Program for the lesser of five years or the entire period that coverage was available to the employee.

• Spouse/Domestic Partner – A spouse is lawfully married to the employee and not legally separated or divorced from or widowed by the employee. A domestic partner is: 1) a person of the same or opposite sex of the employee; 2) who shares the same residence as the employee and who relies on the employee for financial support; and 3) who executes a signed and notarized OCC or OFR Affidavit of Domestic

Partnership.

• Dependent Child – An unmarried child up to age 22 who relies on the employee for support or under age 25 who is a full-time student at an accredited school, college or university, who is unmarried and not employed on a full-time basis. In addition, a dependent child is also a child who is 22 or more years old and incapable of self-support due to a physical or mental handicap. A dependent child includes a natural born child of the employee, a step, foster or legally adopted child of the employee, or a dependent child of the domestic partner who lives with and is financially dependent upon the employee.

1.4.4 Enrollments and Effective Dates

Life Event Description Time Frame Effective Date

New Hire Employee becomes employed by the OCC

60 days from date of hire

Beginning of the pay period following receipt of enrollment form

Change in

Employment Status from Non-Benefits

Eligible to Benefits

Eligible

Employee is converted from a non-benefits eligible position to a benefits eligible position

60 days from date of conversion from a non-benefits eligible position to a benefits eligible position

Beginning of the pay period following receipt of enrollment form

Qualifying Life

Event: Gaining a

New Dependent*

Marriage or establishment of a domestic partner

60 days from date of the event

Beginning of the pay period following receipt of enrollment form

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 8 of 54

Must be enrolled in

Basic for QLE changes relationship; birth, adoption, placement of a foster child or stepchild

Medical

Underwriting

(Late Enrollments)

Request to enroll in coverage outside of new hire enrollment or

Open Season

Requires completion of Statement of

Health. Request can be made at any time.

Beginning of the pay period after the approval of the Statement of

Health

Open Season OCC Group Life specific Open Season, Beginning of new contract

March 1, 2026, to

April 1, 2026

Coverage is effective

10/04/2026

1.4.4.1. New Hire Enrollments

A newly hired employee may elect to participate in the OCC Group Life Insurance Program, except for a newly hired OCC/OFR executive who is automatically enrolled in Basic Life. A new hire has 60 days from their date of hire to elect to participate in the program. New hire enrollments become effective on the first day of the pay period (biweekly) on or after receipt of the enrollment form by Human Capital.

1.4.4.2 Late Enrollments

Employees who fail to enroll during their new hire enrollment period can only enroll during an open enrollment period or by providing evidence of insurability (EOI). Open enrollment elections become effective the first full pay period in October following the open enrollment period. EOI elections become effective the first day of the pay period following notification of approval from the Contractor.

OCC will hold a one-time open enrollment in the spring of March 1, 2026, through April 1, 2026, when employees may elect to add OCC Life Coverage without EOI. This open enrollment will be without restriction.

The effective date of this open enrollment will be October 4, 2026.

1.4.4.3 Enrollment Changes

If an employee is currently participating in the OCC Group Life Insurance Program, that employee can increase coverage as a result of a qualifying life event, i.e., marriage or acquisition of a domestic partner or a child.

Employees are limited on the increase to their coverage by two units.

An employee has 60 days from the date of the qualifying life event to initiate an enrollment change. The change in enrollment will become effective the first day of the pay period following receipt of the enrollment change form by Human Capital.

An employee can decrease their coverage or cancel their participation in the OCC Group Life Insurance Program at any time. The effective date of an enrollment change or cancellation is the first day of the pay period following receipt of the form by Human Capital.

In addition to permitting a change in coverage to be made due to a qualifying life event change, OCC permits an enrollment change to Option 1 – Optional Employee Coverage, at any time, due to an increase in the employee’s salary. Employees, regardless of age, may enroll in or increase their coverage in Option 1 – Optional Employee

Coverage by two units due to an increase in salary. This change can be made within 60 days of the effective date of the change in salary and will become effective on the first day of the pay period following receipt of the form by Human Capital.

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 9 of 54

1.4.5 Workload Requirements

The Contractor must provide services in accordance with this Statement of Work (SOW) regardless of the actual amount of services or fluctuation in services. There is no guaranteed minimum amount of services to be provided.

The Contractor must keep OCC abreast of any life insurance industry changes in accordance with applicable rules and regulations. The Contractor must notify OCC immediately of any changes.

The OCC maintains all employee enrollment information (name, SSN, DOB, coverage election and beneficiary forms). Employee enrollment information is provided to the Contractor only at the time of a claim.

1.4.6 Special Plan Provisions

1.4.7 Dual Enrollment

An employee who is legally married to another OCC employee or in a domestic partnership with another OCC employee may not elect Option 2 – Spouse/Domestic Partner Coverage if the spouse or domestic partner is already insured under the OCC Group Life Insurance Program as an employee.

1.4.8 Terminally Ill Benefit Option

Employees or retirees can apply for an Accelerated Benefit Option (ABO), which allows them to receive a portion of their Basic Life Amount if they become terminally ill, having a documented medical prognosis of a life expectancy of 12 months or less. The medical prognosis must be certified by a doctor and accepted by the

Contractor.

1.4.9 Conversion/ Portability

When an employee’s Basic Life or optional coverage terminates, the employee has the right to convert that coverage to an individual, direct-pay policy within 60 days of termination. EOI would not be applicable. AD&D coverage may be ported in lieu of conversion.

1.5 ACCOUNT MANAGER

The Contractor must provide a Primary Account Manager as a single point of contact that shall serve as a liaison to the OCC to address day-to-day matters. The Contractor must also appoint an Alternate Account Manager as a point of contact in case of absence of the Primary Account Manager per Section G.2 – Key Personnel.

1.6 HEALTH FAIR ATTENDANCE

In support of the OCC’s efforts to educate employees on healthy living and their benefit options, the Contractor must attend an onsite health benefits fair that is generally held annually in November at the OCC’s headquarters location at 400 7th Street, SW, Washington, DC 20024. The Contractor is to supply handouts and giveaways and be prepared to answer employee questions concerning the OCC life insurance program.

1.7 CLAIMS EXPERIENCE

The Contractor must process all claims accurately and in accordance with the timeframe listed in Appendix A, Performance Requirement Summary. The Contractor must provide OCC employees with written notification of its claims appeals process. The Contractor must also ensure that employees have access to an online system where they can view the status of a claim and print copies of the explanation of benefit statements for previous filed and

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 10 of 54 adjudicated claims. The Contractor must protect and appropriately mark all claims information which includes

OCC employee Personally Identifiable Information (PII) as Controlled Unclassified Information (CUI).

1.8 FINANCIAL REPORTING

The Contractor must provide to the Contracting Officer’s Representative (COR) an annual accounting record which details the finances for the OCC Group Life Insurance for each plan year (January 1, through December

31).

1.9 PLACE OF PERFORMANCE

The Contractor must perform all its duties relating to this contract at the Contractor’s work location. The OCC will inspect the Contractor’s place of performance prior to the award of this contract and annually at the OCC’s discretion.

1.10 MARKING

All information submitted to the Contracting Officer (CO), or the COR must be clearly marked to show the following:

1. Name of the Contractor

2. Contract Number

3. Consignee’s name and address

4. Date of Submission

1.11 REPORT COVER SHEET

Each report submitted by the Contractor must have a cover sheet containing the following information:

1. Title of report

2. Report number or type

3. Period covered by the report

4. Contract number

5. Name and address of the Contractor

6. Name of the COR

7. Date of Submission

1.12 ACCEPTANCE CRITERIA

The COR will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/ requirements. The Contractor must ensure the accuracy and completeness of all deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or “padding”, shall be considered deficiencies and shall be subject to correction by the contractor, at no additional cost to the Government. Unless otherwise indicated, the Government will require ten business days to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will return it for correction.

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 11 of 54

1.12 ACCEPTANCE CRITERIA

The COR will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/ requirements. The Contractor must ensure the accuracy and completeness of all deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or “padding”, shall be considered deficiencies and shall be subject to correction by the contractor, at no additional cost to the Government. Unless otherwise indicated, the Government will require ten business days to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will return it for correction.

1.13 REJECTION PROCEDURES

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

1.13.1 After notification that the deliverable did not meet the acceptance criteria, the Contractor must re-submit an updated/corrected version within 5 business days after receipt of Government comments.

1.13.2 Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, the Government may consider the Contractor as having deficient performance with respect to the deliverable.

1.14 ICT ACCESSIBILITY REQUIREMENTS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines.

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/.

3) A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product Accessibility Template (VPAT)

Revised Section 508 Edition, Version 2.4, is required to assist the Government in determining that the

ICT products or services support Section 508 accessibility standards.

E202 – No General Exceptions Authorized by OCC.

The following items are identified as containing ICT:

• Information, Documentation, and Support

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/ https://www.itic.org/policy/accessibility/vpat

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 12 of 54 individuals with disabilities than would be provided by conformance to one or more of the requirements in

Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

1.15 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, viewed, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States.

In addition, the maintenance and support operations of the Offeror’s technology and information must take place, and originate from, within the United States.

US Persons. Federal employees, Contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories and possessions and who require access to sensitive Controlled but Unclassified Information (CUI), like Personal Identifiable Information (PII), IT systems or security items or products, shall either be U.S. citizens or have lawful permanent resident alien status (green card holders).

The Contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S. Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as Controlled but Unclassified

(CUI) information. All information gathered or created under this contract shall be considered as (CUI). It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The Contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the Information System Security Officer (ISSO).

C. Security and Privacy Authorization

Authorization Boundary. The Contractor shall provide a security architecture diagram(s) specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections, ports, protocols, functions, services, and components, including the means for monitoring and controlling

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 13 of 54 communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components, connections, ports, protocols, security controls, and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. If there are

OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the Offeror’s existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used. This diagram shall be delivered to the OCC Group Life Insurance COR, Enterprise Architect, and Information System Security

Officer.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the Offeror’s system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or

Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation

(described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1. NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for

Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE No. 18 System and Organization Controls (SOC) 2 Type II Report on an annual basis for services provided.

b. The SOC 2 Type II report must contain all five main sections: Independent Auditor’s Report, Management Assertion, System Description, Trust Service Criteria and Test Results, and Other

Information.

c. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering from the end of the SOC 2 Report to the date of submission.

d. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the Offeror’s competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the

Work of Internal Auditors.

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 14 of 54

e. The submission of the results of the SSAE No. 18 SOC 2 Type II Report shall be as instructed per the

"Security and Privacy Vendor/Contractor Deliverables" section.

f. If SOC 2 Type II reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

g. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type II report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

2. OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the Offeror’s most recent SOC 2 Type II Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Life Insurance IT system.

Security Updates and Patches. The contractor shall ensure that the Life Insurance IT system is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Life Insurance IT system.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the Offeror’s facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type II Reviews. As mentioned in this SOW. "Security and Privacy Authorization," under SSAE

No. 18 requirements, the contractor shall provide the annual SSAE No. 18 SOC II Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 15 of 54 those security objectives not covered by the SOC 2 Type II report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

Logging (as feasible). The service provider must provide OCC audit access to any FIPS 199 Moderate, or higher data encrypted at rest and in motion in the commercial cloud at an Event Logging (EL) maturity level of EL3. An example of EL2 requirements, which is required to be satisfied for EL3, can be found in the Copy of CISA

Enterprise Logging Data Convention Link. Detailed EL3 requirements are listed in OMB Memorandum M-21-

31. For a solution that is FedRAMP authorized, then EL3 logging is met.

The service provider shall forward all required logging data, in near real-time and on an automated basis, to centralized systems responsible for security, information, and event monitoring Security Event and Incident

Management (SEIM) e.g., SPLUNK; bulk storage; and other analytical workflows or services as requested. Data must be encrypted in transit between its source and destination.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS)

Publication 140-3.

Need to Know. CUI/Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, electronic, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171r3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in all areas, including: Access Control, Awareness and

Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident

Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security

Assessment, System and Communications Protection, System and Information Integrity, and Supply Chain Risk

Management.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the

OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and

Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 16 of 54 insignificant with respect to OCC data or systems. The OCC will determine when the Offeror’s reported security incident requires additional focus and attention.

Within 1 hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC):

OSOC@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary

Information/Report related to previously reported incident # [Insert Incident Number to be provided by

Vendor/Contractor].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive

Information, use FIPS 140-3 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer’s Representative (COR). If reporting by phone or

Contracting Officer's Representative email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems, and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61r3 Incident

Response Recommendations and Considerations for Cybersecurity Risk Management, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the Offeror’s system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on Offeror’s equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and

Privacy Vendor/Contractor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format. [Data File Exchanges—The Contractor shall have the capability to exchange data files with the OCC via encrypted email (ex. MS Outlook) having confidential information (PII and CUI).] eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically stored information mailto:OSOC@occ.treas.gov

R F P 2 0 3 1 J W 2 6 R 0 0 0 0 1 P a g e | 17 of 54 that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may…