SOW.docx

U.S. Department of the Treasury TALX Enterprise IDIQ Task Order 1: Treasury Bureau Unemployment Compensation Statement of Work April 22, 2020

I.

I. BACKGROUND

Since 1955, Government civilian employees have had unemployment insurance protection under US Code Title 5, Chapter 85. The Omnibus Reconciliation Act of 1980 (P.L. 96-499, December 5, 1980) amended the Unemployment Compensation for Federal Employees (UCFE) law by establishing the requirement for each Government Agency to contribute to State unemployment benefits for former Government employees, effective January 1, 1981. 20 CFR, Part 609 sets forth the Secretary of the Department of Labor (DOL) regulations to implement the UCFE program.

The DOL is responsible for 1) advising State and Government agencies of their responsibilities under the law and 2) developing administrative procedures and forms for State and Government agency use. States pay Unemployment Compensation (UC) to former Government employees in the same amount and under the same laws, terms and conditions that apply to unemployed claimants from the private sector.

Benefits are provided to unemployed Federal civilian workers in the same amount, on the same terms, and subject to the same conditions as the compensation which would be payable under the UC law of the State if their Federal service and Federal wages had been included as employment and wages under that State law. All State laws require that an individual have qualifying earnings during a past period specified by the law; file a claim and report regularly as directed; and be able and available for work.

State UC laws and policies are not uniform and vary significantly with regards to eligibility requirements, payment amounts and period of eligibility. This makes it difficult for Government agency personnel who are not familiar with detailed State requirements: to track unemployment benefit payments; ensure payments have been properly applied; and, verify, review and appeal claims within prescribed time limits (Enclosure 1). Therefore, a contractor is required to support administrative functions of Government agency Civilian Personnel Offices (CPO) and Human Resource Offices (HRO) UCFE requirements in responding to State Employment Security Agency requests for employee data.

II. INTRODUCTION

The U.S. Department of the Treasury and its Bureaus serviced by the National Finance Center (NFC) must make available an efficient system to handle unemployment compensation claims while ensuring that Treasury and its stakeholder Bureaus meet the Federal Employee Unemployment Compensation Laws as provided by the Department of Labor individual states.

III. STATEMENT OF NEED

The Department of the Treasury has identified a need to support its individual bureaus and offices with unemployment compensation support services.

IV. REQUIREMENTS

The Contractor shall provide the following services to support the Treasury Bureaus and Offices

A. Deliverables/ Work Products

All Contractor deliverables or work products shall remain categorized as "Official Use Only.” The release of any portion must be authorized in writing by the Government.

V. PERFORMANCE SUMMARY REQUIREMENTS

A. Performance Level Agreements (PLA)

B. Performance Level Agreements, Standards and Monitoring Methods The Government shall use two (2) Performance Level Agreements (PLA) to monitor and track contractor performance as defined in the table above.

VI. PERFORMANCE DETAILS

A. Period of Performance The contract shall have a one (1) year base period and four (4) 12-month option periods:

B. Place of Performance

The Contractor shall perform all services aligned with the requirements of this SOW at locations approved by the COR C. Type of Contract

This task order shall be a firm-fixed price.

D. Performance at Government Sites If any of this Task Order effort is performed at specified Government facilities, the Contractor shall abide by Department of the Treasury Directive (TD) 71-10 regarding provisions for authorized entrance and exit at these facilities.

E. Government Furnished Equipment The Government may provide Government Furnished Property for use in direct performance of each task order. Typical items include PIV badge, laptop, monitor, and computer accessories.

VII. CONTRACT ADMINISTRATION

A. Administrative Contracting Officer

The Contracting Officer designated for this task order is:

XXXXXXXXXX

Email : XXXXXXX@irs.gov

The Contracting Officer, in accordance with Subpart 1.6 of the Federal Acquisition Regulation, is the only person authorized to make or approve any changes in any of the requirements of this contract, and notwithstanding any clauses contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment shall be made in the contract price to cover any increase in cost incurred as a result thereof.

The Contracting Officer has authorized the Lead COR to approve changes to the assignment of Contractor personnel for this modification and to approve all travel requests associated with this contract.

B. Contracting Officer’s Representative (COR) The Contracting Officer’s Representative designated for this task order is:

Ryan Yee Phone: 202-288-0738 Email: ryan.yee@treasury.gov C. Identification/ Badges

The applicable Contractor employees shall not begin working under this Task Order until all security forms have been properly completed and submitted, and clearance to proceed given by the Office of Security Programs (OSP). All Contractor employees shall be required to wear identification badges when working in Government facilities.

D. Personnel Removal and Replacement

The applicable Contractor employees are subject to investigation by the Government. Applicable Contractor employees who undergo Contractor clearances that reveal, but are not limited to, the following, may be unacceptable under this contract: conviction of a felony, a crime of violence or a serious misdemeanor, a record of arrests for continuing offenses, or failure to file or pay federal income tax. The Government reserves the right to determine if a Contractor employee assigned to a task shall continue with the task. The Contractor shall agree to remove the person assigned within one day of official notification by the Government and provide a replacement within five (5) days. New hires or substitutions of personnel are subject to the Contractor clearance requirement.

E. Security Background Investigations:

0. All personnel are required to sign a Treasury Non-Disclosure Agreement as part of the on-boarding process.

0. All personnel must be US citizens.

0. All personnel are required to pass a Treasury Background Investigation (BI)

0. All documentation associated with this engagement shall be returned to the government. In addition, all Government furnished equipment including badges and FOBs shall be returned upon personnel or contract termination.

F. Security Guidelines

The clauses listed below apply to the Prime Contractor and any of its subcontractors employed during the course of this contract. The clauses below also apply to tasks, work requests or other identified method of requesting work be performed that flow from this document. No Contractor personnel may perform any work under this Contract until the Government grants specific permission to do so, regardless of existing clearance or investigation.

This task order requires favorable Tier 4 investigated contractors.

Contractors are required to comply with the Treasury Directive P 15-71, Treasury Security Manual in the handling, protection, and safeguarding of government information in their possession. The TD P 15-71 will be followed as it specifies Treasury-specific personnel, physical, industrial and information security policy, processes and requirements that apply to this contract.

Department of Treasury requires that all Contractor personnel assigned to this project shall have attained a favorable outcome to the designated IT investigative requirement assigned to each labor classification and be available to initiate work immediately upon delivery order award. IT-Level position categories are designated based on access to government networks and IT systems and must not exceed classified access requirements for this contract. At minimum, to perform unclassified work on an unclassified system, all contractors must be at a Tier 4/High Risk Public Trust background investigation. Note that IT-Level position category designations do not imply or convey access to classified information. Those individuals in a Privileged User position may be subject to a higher level investigation at the discretion of the Department; if such an investigation is required, the contractor will be informed in writing of the requirement.

Department of Treasury retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. The reason for removal shall be documented in writing by the Contracting Officer. Additionally, the Contractor must notify the Treasury Security Office of all terminations/resignations within three (3) days of occurrence. When and if such removal occurs, the Contractor shall, within a two to four-week timeframe, assign qualified personnel to vacancy(s) thus created regardless of whether the individual was in a key- or non-key personnel position. The Contractor shall return all Treasury issued identification cards, building passes, keys, and any other Government issued material of those terminated employees to the COR. If identification cards, building passes, keys, and any other Government issued material are not available to be returned, a report must be submitted to the COR referencing the pass, card, key or other equipment number, name of individual to whom it was issued, the last known location, and disposition of the items. If any current or prospective employee is found to be ineligible for access to Government facilities or information by Treasury, the COR will notify the contractor that the employee shall not continue to work or to be assigned to work under the contract. The Treasury may require drug screening for probable cause at any time and/or when the contractor independently identifies circumstances where probable cause exists. All contractors must be vetted and approved by OSP prior to beginning work on any portion of this contract.

The contractor must limit the number of individuals requested to undergo any level of investigation/adjudication (“pools” of investigated employees are not permitted).

Any employee assigned to support the Treasury shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal Identity Verification Standards for Federal Employees and Contractors,” dated August 2013. The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position. Contractor personnel will have limited access to Treasury facilities, information and equipment.

The Contractor shall provide the CO the name of all firms to be used as subcontractors for each type of work to be performed prior to performing any work under this contract in the proposal submission in accordance with the FAR. The Government reserves the right to accept or reject any subcontractors proposed.

The Contractor is responsible for obtaining the approval of the CO prior to release of any information received or generated under the contract per 48 CFR 252.204-7000. The CO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should serve as focal point for their subcontractors’ public release requests and refer them to the CO. SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71). For Official Use Only must be protected in accordance with the providing Agency’s directives. Data contained within all Department computer systems are governed by Agency Security Regulations as well as the Federal Privacy Act of 1974. Contractor personnel assigned to this project will be held accountable for adherence to these regulations. If the security classification or security requirements are changed by the Government subsequent to the date of this Contract, and if the changes cause an increase or decrease in security costs or otherwise affects any other term or condition of this Contract, any resulting financial burden will be the sole responsibility of the Contractor.

Contractors and their subcontractors must perform all initial, annual, contemporaneous, specialized and termination training required per Department guidance and TD P 15-71 as appropriate for their position.

Per the TD P 15-71, the Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this contract, to include loss or suspension of favorable adjudication, or security issues involving the scope being completed for the contract. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information. The Contractor shall also report within 24 hours any event the Contractor becomes aware of that would be deemed a potential security incident, violation or any compromise involving Treasury systems, material, or data or systems with Treasury material or data on them. The Contractor shall comply with all Federal laws and regulations regarding computer security, information security and privacy.

While the Contractor’s personnel are at the government facility, the Contractor is responsible for compliance with all laws, rules, and regulations governing conduct with respect to security – not only as they relate to its employees and agents, but also to other personnel who are government employees or agents of the government and to property at the site regardless of ownership. While on government premises and in possession of government property, the Contractor is responsible for such property and any damages or compromise thereto by Contractor’s employees. The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions, and in the safeguarding of pre-decisional or sensitive information (privacy, etc.) from inadvertent release. At the completion of the contract vehicle, the Contractor shall send a written notice from the authorized principle of the company to the CO and COR attesting that all file records pertaining to this contract in possession of the Contractor was destroyed.

The contractor will avoid any improprieties located in FAR Part 3 and 52.203-16 regarding gratuities, kickbacks, conflicts of interest and other ethics issues.

Work on this contract may require personnel to have access to private information covered by the Privacy Act, Title 5 of the U.S. Code, Section 552a (in addition to other types of non-public information). All Contractor personnel shall adhere to the requirements of the Privacy Act as well as any applicable Department or Federal rule/regulation regarding private information or other types of non-public information.

As a condition for access for Government‐Owned Systems and data, all Contractor personnel must pass background investigations in accordance with OMB Circular A‐130 which requires screening of all individuals involved with sensitive applications or data in Federal automated information systems.

Contractor will abide by requirements set forth in the applicable guidance for the protection of unclassified information. If Contractor fails to follow requirements above, this may result in revocation of favorable public trust adjudication for offending employees and potential negative actions against the contract vehicle itself.

The contractor agrees and understands that the latest version (if superseded) of the U.S.C., CFRs, Executive Orders, Treasury policies and all other government issued documents that are referenced above will be followed.

Ref: SA-4_T.190 For contractors operating a Departmental system at a contractor facility, bureaus shall: (1) include specific language in contracts to ensure applicability of Treasury IT security program policies to all personnel (requiring logical access to Departmental systems); (2) ensure compliance with Treasury IT security policies through the conduct of self-assessments; (3) ensure that contracts provide for the performance of unannounced, on-site inspections of contractor facilities to ensure that an adequate level of security is being maintained.

Ref: SA-4_T.192 Bureaus shall ensure that their security requirements, including FIPS 199 system and data sensitivity, are provided to other agency service providers and documented in the formal shared service arrangement (Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), Data Exchange Agreement, or other vehicle), and that the security provide meets the appropriate level.

Ref: SA-4_T.193 Except for systems principally supporting overseas Federal/Treasury personnel and/or activities, Treasury systems shall be located and operated within the U.S.

INFORMATIVE: This includes Treasury contractor systems.

INFORMATIVE: For brevity, "U.S." is used here to refer to the United States, its possessions, and territories. “Non-U.S. Support” is used here to mean use of contractors or other non-Federal service providers located outside the U.S., its possessions, and territories. (This informative also applies to SA-4_T.194,195)

Ref: SA-4_T.194 Bureaus shall ensure that operations and maintenance of systems located in the U.S. are conducted by personnel physically located within the U.S. or its territories.

INFORMATIVE: This prohibits, for example, foreign remote maintenance, systems monitoring, foreign “call service centers,” “help desks,” and the like.

Ref: SA-4_T.195 Bureaus shall ensure (including through contract requirements, when a contract developer is used) that Treasury systems (i.e., beyond commercial products used as components) that will be located within the U.S. must be developed physically within the U.S. by U.S. citizens or those with lawful permanent resident status.

INFORMATIVE: Detailed personnel security requirements, including requirements for U.S. citizenship, waivers, and employee/contractor screening are promulgated by the Office of Security Programs and are not reproduced here.

Ref: SA-4_T.197 When forming agreements with extra-Bureau entities for operation and maintenance of Bureau-owned IT systems, Bureaus shall include in the agreement language addressing responsibility for Risk Management Framework activities and access to SA&A documentation.

Ref: SA-4_T.198 In acquiring information technology, Bureaus shall ensure the use of common security configurations, when applicable, by (a) requiring vendors to configure IT with common security configurations (when available and applicable, e.g., USGCB) prior to delivery or (b) configuring acquired IT to meet bureau-tailored, secure parameters (e.g., USGCB with approved deviations) after delivery but prior to deployment.

INFORMATIVE: In the latter case, Bureaus do not need to require that vendors securely configure IT for delivery.

SA-5 INFORMATION SYSTEM DOCUMENTATION

The organization:

a. Obtains administrator documentation for the information system, system component, or information system service that describes:

1. Secure configuration, installation, and operation of the system, component, or service;

2. Effective use and maintenance of security functions/mechanisms; and

3. Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;

b. Obtains user documentation for the information system, system component, or information system service that describes:

1. User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;

2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and

3. User responsibilities in maintaining the security of the system, component, or service;

c. Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and take action as appropriate in response;

d. Protects documentation as required, in accordance with the risk management strategy; and

e. Distributes documentation to at a minimum, the ISSO (or similar role within the organization)]..

Ref: SA-11_T.196 Custom Software Security. All software custom developed for Treasury shall be scanned with software code vulnerability detection software before the custom software is accepted by Treasury.

Applicable to MODERATE and HIGH systems:

SA-4(1) SYSTEM AND SERVICES ACQUISITION | FUNCTIONAL PROPERTIES OF SECURITY CONTROLS The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.

SA-4(2) DESIGN / IMPLEMENTATION INFORMATION FOR SECURITY CONTROLS

The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; system-designed design/implementation information at system-defined level of detail].

SA-4(8) CONTINUOUS MONITORING PLAN

The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [at least the minimum requirement as defined in control CA-7].

Note: Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.

SA-4(9) FUNCTIONS / PORTS / PROTOCOLS / SERVICES IN USE

The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.

SA-4(10) USE OF APPROVED PIV PRODUCTS

The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.