SS-FSA-27-005.pdf

SOURCES SOUGHT NOTICE: SS-FSA-27-005

AUTHENTICATION SERVICES FOR FISMA SUPPORT

BUREAU OF THE FISCAL SERVICE

INTRODUCTION AND BACKGROUND

This is a Sources Sought Notice (SSN) issued by the Treasury Common Services Center (TCSC), Acquisition Services, on behalf of the Bureau of the Fiscal Service (Fiscal Service), Identity, Credentialing & Access Management (ICAM) Division. The purpose of this notice is to obtain industry information and identify 8(a) sources that are both capable of and interested in providing commercial Engineer and Project Management Services for the execution of Authentication Services for Federal Information Security Modernization Action (FISMA) Support as described herein. This information is being sought for acquisition planning purposes only.

SCOPE AND OBJECTIVES

Fiscal Services is seeking to identify Contractors who can provide highly skilled and technical contractual support for Information System Security Officer (ISSO) duties and audit liaison for the Authentication Services General Support System (AS GSS). Subject Matter Expert (SME) Contractor support shall include assistance in the development, maintenance, and oversight of the Authentication Services FISMA system, including Security Controls, Continuity of Operations, plans, and related exercises surrounding access to Fiscal Service IT resources.

Contractor resources also support the management and response to user access issues and problems within the ICAM Division for the AS GSS system and its sub-components. The Contractor shall perform all Authentication Services; FISMA related tasks generally assigned to an Information System Security Officer and all related Identity, Credentialing, and Access Management Security audit tasks include:

• Provide, monitor, and manage the AS GSS as an Information System Security Officer (ISSO).

This includes the creation, management, and maintenance of all FISMA lifecycle tasks, deliverables, and continuous monitoring indicator tasks within the Government, Risk, and Compliance (GRC) tool.

• Review, develop and maintain documentation of ICAM processes, procedures, and operations pertaining to providing and managing user access to Fiscal Service IT Resources via the AS

GSS.

• Provide expert guidance, training, and assistance with the closure of issues discovered during Vulnerability Scanning.

• Perform Audit Liaison activities for the various Audits and Assessments that are conducted against Authentication Services and Central Authentication and Identity Assurance (CAIA) fronted applications. This includes the Schedule of the Federal Debt, Consolidated Financial Statement, Office of Inspector General (OIG) and Government Accountability Office (GAO) audits.

• Support and Maintain ICAM Organization and Identity Administration functions:

o ICAM Operations and Help Desk o Respond to ICAM program and daily operational needs o Maintain and monitor the PKI, LDAP, SSO, Splunk, Vault and CAIA service for ICAM o Liaison with the AS application and service users o Liaison with other FS and FRB ISSO’s and System Owners

• Authentication Services Business Continuity and Disaster Recovery Support

• User Provisioning Administration, reconciliation and reporting:

o Create and maintain Authentication Services in-boundary and service user Policies, Standards and Procedures.

o Review and act upon issues seen on the Authentication Services transaction Logs via

Enterprise Log Management (Splunk).

o Manage and review access reconciliation and recertification policies, standards and procedures for all aspects of the AS GSS.

• The Contractor shall participate with ongoing cloud migration initiatives, assisting with all access and security controls to ensure optimal security posture and compliance with National Institute of

• Standards and Technology (NIST), Treasury and Fiscal Service IT Security Standards and Business Line Security Requirements (BLSRs).

• The Contractor shall provide training for personnel on IT related subjects centering on NIST regulatory requirements.

• Conduct the ICAM Technical Support (DTS) Contract Status Meeting

• Develop ICAM Technical Support (DTS) Contract Status Report

• Perform Fiscal Service Authentication Services FISMA ISSO Duties and Reporting

• Inventory Record of Government Furnished Property

Interested Contractors shall be able to provide all products and services described in Appendix A and Appendix B of this notice.

SUBMISSION GUIDELINES

Submissions shall include a Contractor’s capability to satisfy the technical requirements outlined herein.

Responding Contractors shall provide a high-level capabilities statement that includes a description of their standard line(s) of business, information outlining their experience, and technical narrative addressing each of the specific products and services described herein.

In addition to the general capabilities statement and specific technical information, Contractors shall provide the following information with their submissions:

1. Name and address of company, contact information, Unique Entity Identifier (UEI), business size (small or other- than-small) along with specific socioeconomic classification(s) such as HUBZone small business, small, disadvantaged business (SDB), woman-owned small business (WOSB), veteran-owned small business (VOSB), and service-disabled veteran-owned small business (SDVOSB), including participation in the SBA’s 8(a) Business Development Program. We are specifically looking for 8(a) certified contractors.

2. Whether or not the Contractor’s products/services are available through an existing Government-wide contracting vehicle or solely in the open market. If the Contractor’s products/services are available through one or more existing Government-wide contracting vehicles, a complete list of those contracting vehicles (including contract number).

3. Published price list(s) for these products/services (i.e. GSA MAS contract, NITAAC, NASA SEWP, in-house, and so forth) that addresses labor categories that they would utilize to execute these services.

DEADLINE FOR RESPONSES

Contractors shall submit responses to this notice by e-mail to: TCSCAcquisitionOps@treasury.gov no later than November 16, 2026, at 3:00pm EST. Responses shall reference “SS-FSA-27-005, ATTN:

CCobb/TAshcroft” in the subject line of the e-mail message.

All electronic materials and attachments submitted shall be formatted in accordance with the Bureau of the Fiscal Service’s Security Requirements. The following file extensions are not allowable, and application materials/data submitted with these extensions cannot be opened:

.bat, .cmd, .com, .exe, .pif, .rar, .scr, .vbs, .hta, .cpl, html, mhtml, and .zip files.

mailto:TCSCAcquisitionOps@treasury.gov

The Government does not allow 3rd party messaging systems/secure mail.

Microsoft Office non-macro-enabled compatible documents are acceptable. If the interested Contractor determines that other formats are necessary, the interested Contractor shall verify with TCSC that those formats are acceptable.

DISCLAIMERS

This notice is in accordance with FAR Part 10. This notice is not a request for proposal/request for quotation (RFP/RFQ) for any products and/or services, and it does not constitute a promise or imply an obligation on the part of the Government to issue an RFP/RFQ for any products and/or services or to purchase any products and/or services in the future. No technical approach is being requested or will be considered at this time. This request is only a source sought notice to gather market research information about the availability of commercial sources in the industry.

Contractors responding to this notice are hereby advised that the Government will not pay for any information or administrative costs incurred by the responding Contractors; all costs associated with responding to this RFI shall be borne solely by the responding Contractors. Responding Contractors are solely responsible for properly marking and clearly identifying any proprietary information or trade secrets contained within their response; the Government will not be liable for, or will not suffer, any consequential damages for any proprietary information not properly marked and clearly identified. Proprietary information received in response to this RFI will be safeguarded and handled in accordance with the Trade Secrets Act (18 U.S.C. 1905).

NO DETERMINATION AS TO THE VIABILITY OF THIS POTENTIAL REQUIREMENT HAS BEEN MADE, AND NO SOLICITATION IS AVAILABLE. Requests for additional information and/or a copy of the solicitation WILL NOT be considered an affirmative response to this posting. Telephone responses or inquiries to this request WILL NOT be accepted.

All responding Contractors are advised that responses to this notice will NOT be considered for contract award. If a solicitation does result from this notice, interested Contractors shall respond separately and formally to be considered for contract award.

This notice does not restrict the Government to an ultimate acquisition approach, should an acquisition result from this notice.

Interested Contractors may register at https://sam.gov/content/opportunities to receive notifications when information is posted related to this requirement, such as when amendments are available for viewing and/or downloading. Please note that SAM.gov provides the notification service as a convenience and does not guarantee that all people on the mailing list will receive notifications; therefore, TCSC recommends that Contractors monitor the SAM.gov site for all information relevant to desired acquisitions.

https://sam.gov/content/opportunities

Appendix A

PERFORMANCE WORK STATEMENT

OFFICE OF INFORMATION SECURITY SERVICES

IDENTITY CREDENTIALING & ACCESS MANAGEMENT DIVISION

U.S. DEPARTMENT OF THE TREASURY, BUREAU OF THE FISCAL SERVICE

1.0 OVERVIEW & BACKGROUND

This requirement is being managed by Fiscal Service, Identity, Credentialing & Access Management Division (ICAM)’s Parkersburg, WV 26101 location.

Fiscal Service provides nationwide financial management and operational services for the Treasury Department, Civilian Departments and Agencies of the Government and for other selected federal organizations. The major business functions include payment of civilian salaries, payments to retirees under various programs such as the Railroad Retirement Board, the Social Security Administration, and the Veteran's Administration; payments to vendors; collection of funds owed the Government; and maintaining records on Agency funding status and the U.S. Treasury's cash balances. This work is performed using a collection of hardware, software and telecommunications lines collectively referred to as the Fiscal Service Enterprise Platform. Fiscal Service uses Information Technology (IT) security administration products to provide a secure electronic processing environment for the entire Fiscal Service Enterprise Platform.

Fiscal Service requires a level of continued resident Access Management subject matter expertise, with a comprehensive understanding of the Authentication Services General Support System (AS GSS), which is comprised of the following sub-components: Certificate Authorities, Lightweight Directory Access Protocol (LDAP), Single Sign-On, Ansible Automation, Splunk, Vault, and GitLab.

Federal Identity Credentialing and Access Management (FICAM) Roadmap initiatives, including cloud-based relocations that are ongoing within Fiscal Service and have not yet transitioned to government employee resources.

Authentication Services (AS) is a General Support System (GSS) that provides Identity Credential and Access Management (ICAM) services to Fiscal Service, the Department of the Treasury, and other Federal agencies. The AS GSS is comprised of several components to include: several Public key infrastructures (PKI) including an Only Locally Trusted (OLT) Certificate Authority (CA); multiple Lightweight Directory Access Protocol (LDAP) directory services (which contain the PKI related objects, authentication credentials, personally identifiable information about accounts, and authorization objects associated with various Treasury applications) and the Common Approach to Identity Assurance (CAIA), which leverage Identity management and Directory Services Single Sign On technologies to provide a system that facilitates access to applications via authentication, federation and entitlement management.

Fiscal Service operates a nationwide secure network with several different server platforms to support the numerous underlying financial management applications. The entire infrastructure is collectively referred to in this document as the Enterprise Infrastructure. Server platforms include Enterprise Server Systems (ESS), Enterprise Storage Systems (ESS) and LAN/WAN platforms, a variety of platforms currently provides services across the country, primarily to Fiscal Service offices in Kansas City, MO, Birmingham, AL, Philadelphia, PA, Austin, TX, Parkersburg, WV, and two locations in Washington DC (Liberty Center and Hyattsville). Fiscal Service has dedicated network connections to many Federal Agencies at multiple locations across the country. Fiscal Service also provides remote access and Web-enabled services.

Security administration remains a core function in managing the Fiscal Service Enterprise Platform. The current process for granting and administering access to IT Fiscal Service resources uses an integrated solution encompassing the AS GSS, Governance and Risk Compliance (GRC), and Enterprise Service Manager (ESM).

2.0 OBJECTIVE/SCOPE OF WORK

The objective of this Performance Work Statement (PWS) is to outline Fiscal Service’s requirement for highly skilled and technical contractual support for Information System Security Officer (ISSO) duties and audit liaison for the Authentication Services General Support System. In addition, SME Contractor support includes assistance in the development, maintenance and oversight of the Authentication Services FISMA system, including Security Controls, Continuity of Operations plans and related exercises surrounding access to Fiscal Service IT resources.

Contractor resources also support the management and response to user access issues and problems within the ICAM’s area of responsibility for the AS GSS system and its sub-components. In addition, Contractor support is required to assist with Fiscal Service Continuity of Operations plans and exercises on an as-needed basis.

The Contractor shall support ICAM security program functions, including policy, oversight and compliance and audit remediation activities.

During this contract performance period, additional Enterprise User Access (EUA) software products may be used in conjunction with an integration effort with another component of the ESM, CAIA / SailPoint Identity IQ or other access management systems the Contractors primarily use to perform the contract tasks specified within this PWS.

3.0 TASKS AND DELIVERABLES

The Contractor shall perform all Authentication Services FISMA related tasks generally assigned to an Information System Security Officer and all related Identity, Credentialing and Access Management Security audit tasks:

3.1 Contract Scope of Work includes:

A. The Contractor shall provide ISSO support for the Authentication Services General Support System (AS GSS). This includes creating, managing, maintaining, and monitoring all Federal Information Security Modernization Act (FISMA) lifecycle tasks, deliverables, and continuous monitoring indicators within the Governance, Risk, and Compliance (GRC) tool.

B. Review, develop and maintain documentation of ICAM processes, procedures and operations pertaining to providing and managing user access to Fiscal Service IT Resources via the Authentication Service GSS.

C. Provide expert guidance, training and assistance with the closure of issues discovered during Vulnerability Scanning.

i. Develop and maintain Issue (POAM) documentation, milestones, cost estimates, scheduling.

ii. Manage VM issues across the Authentication Services GSS and liaison with the various ICAM branches for root cause analysis and remediation activities.

iii. Collect and organize closure evidence for attachment in GRC.

D. The Contractor shall perform audit liaison activities for audits and assessments conducted against Authentication Services and Common Approach to Identity

Assurance (CAIA) – fronted applications. These activities include supporting audits related to the Schedule of the Federal Debt, Consolidated Financial Statements, Office of Inspector General (OIG), and Government Accountability Office (GAO).

E. Support ICAM Organization and Identity Administration functions:

i. Respond to ICAM program and daily operational needs

ii. Maintain and monitor the PKI, LDAP, SSO, Splunk, Vault and CAIA service for

ICAM

iii. Liaison with the AS application and service users

iv. Liaison with other FS and FRB ISSO’s and System Owners

F. Authentication Services Business Continuity and Disaster Recovery Support.

G. User Provisioning Administration, reconciliation and reporting:

i. Create and maintain Authentication Services in-boundary and service user Policies, Standards and Procedures.

ii. Review and act upon issues seen on the Authentication Services transaction logs via Enterprise Log Management (Splunk).

iii. Manage and review access reconciliation and recertification policies, standards and procedures for all aspects of the AS GSS.

The Contractor shall conduct a review of all current ICAM Authentication Services policies and procedures to ensure that the procedures are current, applicable and operating as intended. The Contractor recommends the creation of new policies or procedures for any gaps observed.

H. The Contractor shall participate in ongoing cloud migration initiatives by assisting with the implementation, management, and assessment of access and security controls to maintain an optimal security posture and ensure compliance with applicable National Institute of Standards and Technology (NIST), Department of the Treasury, and Fiscal Service IT security standards and Baseline Security Requirements (BLSRs).

I. Contractor shall conduct document reviews, template creation and management.

J. Contractor shall provide training for personnel on IT related subjects centering on NIST regulatory requirements.

K. The Contractor shall provide transitional and knowledge transfer support of this Task

Order to establish ongoing program and project management support, by developing, implementing and managing a formal Knowledge Transfer and Transition Plan.

3.2 Task 3 - Perform Fiscal Service Authentication Services FISMA ISSO Duties and Reporting

The Contractor’s staff shall perform the following:

i. Authentication Services ISSO duties and reporting within GRC

ii. Issues (POAMs)

iii. Policy Exceptions

iv. Vulnerability Management

v. Implementation Statements

vi. Indicator Tasks

vii. Continuous Monitoring Activities

viii. Disaster Recovery Activities

ix. Security Impact Analysis

x. Configuration Management

xi. Customer Responsibility Matrix

xii. Respond to ICAM daily operational needs

xiii. Liaison to Fiscal Service FISMA System ISSO and SO communities

xiv. Disaster Recovery and Business Continuity Operations

xv. Internal External Reporting and Related Functions

xvi. ICAM Audit Remediation Projects, PO A&M Support and Response & Reporting

3.3 Task 4 - Support Continuity of Operations

Contractors shall assist in the development of Continuity of Operations plans and reviews of Continuity of Operations exercises or other similar results for activities related to ICAM and Authentication Services resources.

3.4 Task 5 - Support Disaster Recovery and Business Continuity Operations

The Contractor shall provide audit and assessment oversight support of ICAM operations related to ensuring that authorized access to Fiscal Service IT resources are maintained, controlled and managed during Disaster Recovery or similar unplanned events and Business Continuity operations.

3.5 Task 6 - Develop and Maintain ICAM Operations Documentation

The Contractor shall perform the following tasks:

The Contractor shall review and assess the existence, completeness, accuracy, and currency of security-related policies, standards, procedures, and supporting documentation associated with the Authentication Services General Support System (AS GSS) and its component services.

The Contractor shall evaluate documentation for compliance with applicable Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST), Department of the Treasury, and Fiscal Service security requirements, including requirements supporting security controls, risk management, and audit readiness.

The Contractor shall coordinate with ICAM branches and technical teams to identify documentation gaps, recommend improvements, and assist in drafting or revising policies, standards, procedures, and related documentation as needed. Responsibility for technical implementation, operational procedures, and final approval of policies and standards shall remain with the appropriate Government personnel and operational teams.

3.6 Task 7 - Inventory Record of Government Furnished Property

In accordance with FAR part 45, the Contractor shall maintain current and complete inventory / property control records for all equipment provided by the Government identified in PWS Section 5.0. The inventory records shall identify each item’s location (room cubicle, building, and floor), serial number, make and model.

The Contractor’s senior representative shall provide a complete up-to-date copy of these inventory records to the COR within 15 days after the end of each calendar quarter and on termination of this task order. Under no circumstances shall the Contractor remove any Government equipment from the Fiscal Service premises without prior written approval from the Contracting Officer.

3.7 Task 8 - Develop, implement and manage a formal Knowledge Transfer and Transition Plan

A. Provide project management, guidance and training on all tasks and core functions performed under this contract, transferring explicit and tacit knowledge of processes and procedures followed in performance of same.

B. Transfer data and files compiled in performance of task orders within the subject contract, regardless of media type.

C. The Contractor team will work closely with the ICAM team to advise staff on daily tasks, access requests, procedures, trouble-shooting methodology, etc.

3.8 DELIVERABLES

All deliverables, work products, software, hard-copy and electronic documents including everything developed by the Contractor while working on this contract are the sole property of the United States Government. The Contractor shall have no rights of ownership.

A. Deliverables Table

The following is a list that includes the deliverables/end-products and services to be provided by the Contractor under this DTS contract.

Task

Section Deliverable Due Date

3 3.2 Performance of Authentication Services FISMA ISSO Duties and Reporting

Provisioning target goals and due dates as specified by Fiscal Service during contract execution

4 3.3 Support Continuity of Operations

As specified by Fiscal Service during contract execution

5 3.4 Support Disaster Recovery As specified by Fiscal Service during contract execution

6 3.5 Develop and maintain ICAM Operations Documentation

- Remediation Status Reports and Meetings as required.

BUREAU OF THE FISCAL SERVICE

7 3.6 Inventory Record of Government Furnished Property within 15 days after the end of each calendar quarter and on termination of this task order.

8 3.7 Knowledge Transfer and Transition Plan

Contractor team will advise on daily activities (in-progress tasks and responsibilities) to the ICAM team (Fiscal Service staff) on a routine basis and prior to the contract expiration.

B. Safeguarding Requirements for contractor developed and Fiscal Service Provided Deliverable/Work Products/Information

All sensitive Deliverables/Work Products developed by the Contractor shall be clearly marked “Controlled Unclassified Information (CUI)” (also referred to as Sensitive but Unclassified” on the top and bottom of each page and handled appropriately. Sensitive information is defined as; “anything and everything that applies to any private/personal information about users of Fiscal Service systems and/or architecture”. The written or verbal release or disclosure of any deliverable, work product, or information related to this contract to other than authorized IAM. Contractor and Fiscal Service personnel who have a need to know such information is strictly prohibited. The ICAM Director must authorize exceptions to this policy.

In addition, the following is required and shall be followed by the Contractor working on this contract. The Contractor shall:

1. Read, understand and follow all requirements for properly safeguarding, handling, storing, disseminating, and removing CUI information and equipment;

2. Read, understand, remain cognizant of additions and changes to and follow all requirements specified in the Fiscal Service Manual of Administration, Part 8 (Personnel, Physical and Document Security Guidelines), Sections 300 through 306 obtainable from the Fiscal Service Intranet Homepage;

3. Ensure CUI information is properly marked “Controlled Unclassified Information”;

4. Ensure only people with a need to know have access to CUI information;

5. Ensure CUI information is secured in a locked file cabinet, locked desk drawer, locked overhead storage;

6. Ensure reproduction of CUI information is at a minimum, and permission is obtained by respective

Assistant Commissioner;

7. Not record CUI data on laptops or other mobile devices unless authorized by AC responsible for the information and the Fiscal Service Chief Information Officer;

8. CUI information or equipment (laptops and other electronic devices) shall not be removed from

Fiscal Service without the knowledge and consent of AC responsible for the information and the Fiscal Service Chief Information Officer;

9. Requests for the removal of CUI information and equipment from Fiscal Service facilities will be accurately and completely documented on the required form(s) and signed by all parties before removal can occur;

10. All incidents of missing, lost, stolen, unauthorized disclosures or improperly accessed or used CUI information and/or equipment shall be reported immediately to the COR and the ICAM Director or his designee.

C. Delivery Instructions

Unless otherwise directed, all deliverables shall be submitted to the COR and ICAM.

The Contractor shall provide deliverables/documents in draft and final form as directed by the COR and Fiscal Service Manager. All deliverables/documents shall be marked as draft and dated on each page until final acceptance by the Fiscal Service COR. The purpose of the draft is to allow Fiscal Service to observe the progress and direction of a deliverable enabling redirection when necessary.

The Fiscal Service will review each draft deliverable/report and provide written comments/requests for change, or acceptance of the deliverable/documents as written within 10 business days. Fiscal Service subject-matter experts will determine if deliverable reports require revisions. All requests for revisions will be made to the Contractor’s designated point of contact by the COR.

The Contractor shall make the Fiscal Service requested changes within 5 business days of receipt of a request for revision from the COR and resubmit the deliverable/report to the Fiscal Service COR for further review. Several drafts/review cycles may be required until deliverables are accepted by Fiscal Service.

Each draft deliverable/document (except the initial draft) shall include a cumulative “change page” that clearly and briefly specifies the sections of the document that were changed. Within the body of the document, all deleted text will be displayed in red with single strike-through. All new/changed text shall be displayed in blue. Subsequent drafts, in the body of the document, will only designate changes to the previous draft. When the last draft is accepted by Fiscal Service, the Contractor shall have 3 business days to submit the deliverable/report in final form (eliminating change page and colored/strikethrough text).

Unless requested otherwise by the COR, drafts shall be submitted in electronic form.

Final deliverables/reports shall be submitted in both hardcopy (number of copies will be specified by the COR) and electronic form. Electronic documents shall be created using Microsoft Word, Microsoft Project, and Microsoft VISIO as appropriate to the information submitted. All electronic form deliverables/reports shall be editable by Fiscal Service. All electronic form deliverables/documents more than 10 pages in length shall include a table of contents. At the direction of the COR, deliverables/documents may require an Executive Summary that clearly and concisely summarizes the deliverable/document.

D. Deliverable Inspection and Acceptance

The Contractor shall deliver all deliverables/end-products to the Fiscal Service COR or appropriate ICAM point of contact. All items delivered by the Contractor will be reviewed and inspected by Fiscal Service and written notice of the acceptability or unacceptability of the deliverables will be provided to the Contractor’s designated point of contact by the COR.

Specific acceptance criteria are as follows:

1. Clarity - Deliverables shall be clear, concise, unambiguous, relevant, meaningful and understandable by the intended audience; engineering terms shall be used as appropriate and shall be written at the level of the intended audience. Diagrams shall be used when graphical portrayal of complex concepts can best be understood through their use and shall be easy to understand, relevant to the supporting narrative and effective.

2. Format - Deliverables shall be submitted in electronic media appropriate to the contents of the deliverable and in hard copy if requested by Fiscal Service. PDF versions of deliverables shall also be provided if requested by the Fiscal Service. All deliverable documents shall be developed using MS Office or other software approved by Fiscal Service.

E. Notice Regarding Late Delivery

In the event the Contractor anticipates difficulty in complying with any delivery due dates, the Contractor shall, within three (3) business days prior to the scheduled delivery date, notify the Contracting Officer (CO) and the COR in writing giving pertinent details, including a description of the circumstances that prevented the Contractor from completing the deliverable on the scheduled due-date and the proposed date by which the Contractor expects to complete the deliverable. The Contractor shall specify the measures they will take to prevent any further missed due dates.

4.0 RESPONSIBILITIES FOR ON-SITE PERFORMANCE

Contractor Responsibility - The Contractor’s designated point of contact shall ensure that he/she and all Contractor employees fully cooperate with and participate in training, meetings, briefings and other gatherings requested by the ICAM Director and complete any requested certification documents to provide evidence of attendance and promptly provide it to the COR. The Contractor’s designated point of contact shall also ensure that he/she and all Contractor employees promptly read, understand and follow all directives, policies, standards or other such documents provided by or made available by Fiscal Service and that requested written acknowledgment of compliance per the instructions accompanying such directives, policies, standards and other documents shall be followed. The Contractor shall also be required to remain cognizant of all existing, new and updated Fiscal Service policies, standards, directives, and other such documents provided by or made available by Fiscal Service and shall fully comply with and furnish documented acknowledgment of agreement to fully comply with such directives, policies, standards and other such documents promptly to the COR as requested.

Government Responsibility- The Government will provide advanced notice, whenever practicable, of any and all training/meetings/gatherings/announcements called or made by Fiscal Service management and determined to be of relevance to all on-site personnel, including but not limited to matters concerning public health, emergency preparedness, IT security, and the Privacy Act. The Government will make available to on-site Contractor employees the same resources (educational materials in electronic and hardcopy format, speakers/trainers, and meeting space) offered to federal employees in furtherance of informing/educating all on-site personnel of matters deemed by Fiscal Service senior management to be of such significance and applicability to on-site Contractor employees.

5.0 GOVERNMENT FURNISHED PROPERTY

Government provided material will include policies, standards, guidelines, technical data, specifications, and other documents required for the Contractor to complete the requirements described within this PWS.

Fiscal Service will provide the necessary telecommunications capabilities, User Ids, security authorizations and PIV credentials (or passwords) to perform the required tasks. The Government will provide appropriate office space, and desks as needed for all full-time Contractor staff, unless they are remote workers. The Government will also supply the Contractor with PCs connected to the Fiscal Service LAN, and access to LAN printers.

6.0 PLACE OF PERFORMANCE

Services under this PWS shall be performed primarily through telework from an approved remote work location, consistent with applicable Government security requirements and contractual provisions.

When an on-site presence is required to support operational activities, meetings, security requirements, or other mission needs, Contractor personnel shall provide support at a Bureau of the Fiscal Service facility designated by the Government.

On-site performance is not restricted to specific facilities or addresses and may be required at different Fiscal Service locations throughout the period of performance. The Government will provide reasonable advance notice of on-site requirements whenever practicable.

7.0 PERIOD OF PERFORMANCE

The contract period of performance will be three years, inclusive of one (1) 9-month base period and four

(4) 12-month option periods.

8.0 ACQUISITION TYPE

This requirement will result in a firm fixed priced delivery order.

9.0 KEY PERSONNEL CONTACT(S) AND QUALIFICATIONS

All personnel assigned to this contract are deemed key personnel.

Key personnel shall not be reassigned or removed from this contract without the written consent of the Fiscal Service Contracting Officer. If any of these individuals become unavailable, the Contractor shall promptly notify the Fiscal Service COR and Contracting Officer in writing at least two weeks (calendar weeks) prior to the employee’s planned departure date (when possible) but a 48-hour minimum notification. Proposed replacement personnel shall possess equal or greater relevant qualifications and experience as the person(s) being replaced. All Contractors proposed replacement personnel shall be approved by the Contracting Officer in writing prior to their beginning work on this contract. The Contractor shall ensure that not more than one key personnel shall be replaced within any 90-day time period.

If any key personnel will be leaving this contract, the Contractor shall provide, at no additional cost to Fiscal Service, the replacement personnel to work alongside the departing personnel for a minimum of four weeks so that the departing personnel may properly brief his/her replacement on the in-progress work the departing personnel has been performing. This “overlap” is required to enable a smooth transition to the replacement personnel to preclude any interruption, slow-down or loss of continuity of Contractor provided services.

Replacement of key personnel shall create no change in either the delivery schedule or contract cost.

9.1 REQUIRED KNOWLEDGE, SKILLS AND EXPERIENCE

IT Technical Professionals Because of the vital services Fiscal Service provides for the Financial Operations of the Federal Government, the Nation-wide Banking Systems and private concerns both nationally and internationally, secure, reliable and timely access to Fiscal Service IT resources and therefore the financial information contained therein is of paramount importance.

Proposed Contractor personnel shall have extensive knowledge, skills and experience performing comparable work specified in this PWS using a highly capable and robust Enterprise Security Administration software/system with workflow functionality to establish, support, maintain and administer user accounts needed for gaining access to the following IT Hardware and Software systems currently in use at Fiscal Service:

Required:

Minimum Technical Resource Qualifications:

Degree in Cybersecurity or equivalent discipline Hold or have held CISA, CRISC, CISSP or equivalent in last 5 years

5+ years performing ISSO duties 10+ years audit experience Previous ESM / GRC experience Expert in FISMA lifecycle management Preferred: Direct Fiscal Service IT management and delivery experience

Proposed IT Technical Professionals shall have successfully performed comparable work as specified in this PWS. Their specialized knowledge, skills, experience and education that will enable proposed IT Technical Professionals to perform the work specified in this PWS must be clearly documented. This documentation shall include for each proposed Contractor: (1) when this experience was acquired (to/from dates), (2) the number of months/years of experience possessed; (3) the depth and breadth of experience/knowledge possessed.

10.0 KEY PERSONNEL REPLACEMENT PROCESS

Key personnel may, with the consent of the contracting parties, be amended from time to time during the course of the contract to add or remove key personnel. A formal modification is only required when the key personnel are specifically named in the contract. This process only applies to the extent that the contract does not otherwise specify notice or personnel replacement obligations.

Government Request

The Government may require replacement of key personnel in the instance of non-performance, misconduct, or alleged misconduct whose continued use under a contract is contrary to the best interests of the Government. Circumstances that support a request for replacement include but are not limited to performance that is inconsistent with the contract PWS, terms and conditions, or violations of Federal laws, regulations, or agency conduct standards. The Contracting Officer’s Representative (COR) will give written notice to the Contractor of the need for substitution, including the circumstances surrounding the request for replacement. In accordance with FAR Part 1.602-2(b), the Contracting Officer (CO) will ensure the Contractor receives impartial, fair, and equitable treatment; however, the CO is not required to investigate or validate allegations or wait until a final resolution of the circumstances surrounding the request for replacement before requiring substitution of key personnel.

Within twenty-four (24) hours of receiving notice, the Contractor shall respond to the Government’s request to replace key personnel and provide key personnel replacement resume(s) to the COR(s). The resume(s) shall demonstrate that the qualifications of proposed replacement key personnel meet the qualifications stated in the PWS. The COR will notify the Contractor, in writing, within forty-eight (48) hours of receiving key personnel replacement resume(s) if the Contractor provided replacement personnel is acceptable. The Government reserves the right to disapprove of the proposed substitute(s) and negotiate with the Contractor for other key personnel replacement(s). Any Contractor replacement of key personnel must be done in consultation with the COR. The process for replacing key personnel as described above does not suspend the Contractor’s obligation to continue performance under the contract.

Contractor Request

If the Contractor must substitute key personnel, the Contractor shall provide written notice to the COR and the CO two (2) calendar weeks before the proposed replacement date, whenever possible. At a minimum, the Contractor shall provide the Government with notice forty-eight (48) hours before replacement. The only exception to the forty-eight (48) hour notice is death, incapacitation, abrupt termination, or resignation from employment of key personnel where the Contractor’s notice was less than forty-eight (48) hours. If the deadline for providing notice falls on Friday after 5:00 pm, a weekend, or on a Federal Holiday, the Contractor shall provide notice the next business day if more than forty-eight

(48) hours. The notice shall state the circumstances necessitating the proposed substitution of the key personnel and shall provide resume(s) of proposed replacement key personnel for review and consultation. The Contractor shall demonstrate that the qualifications of the proposed substitute(s) meet the qualifications stated in the PWS. The Government reserves the right to disapprove of the proposed substitute(s) and negotiate with the Contractor for other key personnel replacement(s). Assignment of key personnel must be done in consultation with the COR.

11.0 OTHER REQUIREMENTS

Prohibition Against Disclosure of Official Information

Any Treasury Department information made available to the Contractor or accessed by the Contractor that is marked or should be marked “Official Use Only”, “Sensitive But Unclassified”, or “Controlled Unclassified Information” shall be used only for the purpose of carrying out the provisions of this task order and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the task order. Disclosure to anyone other than an officer or employee of the Contractor or Sub-Contractor at any tier shall require prior written approval of Fiscal Service. Requests to make such disclosure should be addressed to the COR and the Contracting Officer.

Building Access and Suitability Clearance

Upon award of the contract, and prior to the Contractor or subcontractor personnel performing any services for the first time at Fiscal Service premises as listed in Section 6.0 – Place of Performance, the Contractor shall present those personnel to the COR and follow the COR’s instructions regarding building access and security requirements.

Compliance with Government Laws, Rules, and Regulations

While the Contractor’s personnel are at the Government facility, the Contractor is responsible for compliance with all laws, rules, and regulations governing conduct with respect to health and safety – not only as they relate to its employees and agents, but also to other personnel who are government employees or agents of the government and to property at the site regardless of ownership. While on government premises and in possession of government property, the Contractor is responsible for such property and any damages thereto.

Confidentiality

The Contractor recognizes that, in performing under this order, the Contractor may obtain access to nonpublic information that is confidential or proprietary in nature. Except as permitted by the order, the Contractor agrees that it, its employees, its subcontractors, and its subcontract employees shall not disclose to any third party, or otherwise use, any information it obtains or prepares in the course of performance of this agreement for any purpose other than to perform work under the order without first receiving written permission from the contracting officer (CO). The Contractor shall secure information received from or prepared or gathered for the Treasury Department under this order in a secure location with access limited to only those personnel with a “need to know.” If disclosure of information is required by law or legal process, the Contractor shall contact the COR and the CO immediately to receive approval prior to release of any information. Notwithstanding any other language contained herein, the Contractor shall comply with 31 CFR § 31.217 (Regarding 31 CFR § 31.217, this is not a TARP covered project;

however, FAS requires that nonpublic information be secured as stated in 31 CFR § 31.217. The only difference is that if information is inadvertently released, the Contractor shall contact the COR and

CO listed in the order and not contact TARP personnel). The Contractor personnel performing services under this order shall comply and complete the security requirements listed in Attachment A – Security Requirements at least two weeks before start date of the order performance or performing work under this order.

Non-Personal Services Statement

Contractor employees performing services shall be controlled, always directed and supervised by management personnel of the Contractor. Contractor employees shall perform independent of and without the supervision of any Government official with the exception of when they are on site at the government’s facility. Actions of Contractor employees may not be interpreted or implemented in any manner that results in any Contractor employee creating or modifying Federal policy, obligating the appropriated funds of the U.S. Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee or otherwise violating the prohibitions set forth in Parts 7.5 and

37.1 of the Federal Acquisition Regulation (FAR).

Conduct

The Contractor, although in fact not a Government employee, shall comply with Executive Order 11222, May 8, 1965, "Prescribing Standards of Ethical Conduct for Government Officers and Employees," and shall also comply with Fiscal Service regulations implementing this Executive Order. Additionally, the Contractor shall comply with all safety practices, vehicle registration, speed limits and any other Fiscal Service regulations and policy applicable to conduct standard. Contractor personnel driving a motor vehicle on Fiscal Service property cannot use a cell phone unless the vehicle is safely parked or the driver is using a hands-free device. Additionally:

1. The Contractor shall maintain satisfactory standards of the employee competency, conduct, appearance, and integrity.

2. The Contractor shall take appropriate disciplinary action against his/her employees when necessary.

3. Each Contractor employee is expected to adhere to standards of conduct that reflects credit on themselves, their employer and the Government.

4. The Government reserves the right to direct the Contractor to remove an employee from the work site for failure to comply with the standards of conduct.

5. The Contractor shall initiate immediate action within 48 hours to replace a removed employee to maintain continuity of services at no additional cost to the Government.

12.0 CONTRACTING OFFICER AUTHORITY

In no event shall any understanding or agreement between the Contractor and any Government employee other than the CO on any order modifications change orders, letter or verbal direction to the Contractor be effective or binding upon the Government. All such actions shall be formalized by the proper contractual document executed by the appointed CO. The Contractor is hereby put on notice that if a Government employee other than the CO directs a change in the work to be performed or increases the scope of work to be performed, it is the Contractor’s responsibility to make inquiry of the CO before making the deviation.

Payments will not be made without being authorized by the appointed CO with the legal authority to bind the Government.

13.0 FEDERAL HOLIDAYS

Fiscal Service observes the Federal holidays that are listed below and on the Office of Personnel Management website, which can be found at https://www.opm.gov/policy-data-oversight/pay leave/pay-administration/fact-sheets/holidays-work-schedules-and-pay/. Except as specified by the CO, services shall not be required on the following Federal holidays:

New Year’s Day, January 1 Inauguration Day (Washington, DC only), January 20 Martin Luther King’s Birthday, third Monday in January President’s Day, third Monday in February Memorial Day, last Monday in May Independence Day, July 4 Labor Day, first Monday in September Columbus Day, second Monday in October Veterans’ Day, November 11 Thanksgiving Day, fourth Thursday in November Christmas Day, December 25

Holidays falling on Saturdays are observed the Friday preceding the holiday, while those falling on Sundays are observed on the Monday following the holiday. Holidays shall also include any additional day(s) granted by executive order.

14.0 QUALITY CONTROL PLAN

The Contractor shall establish a complete quality control plan, or QCP, for this contract. The QCP shall be maintained by the Contractor to ensure that the requirements of the contract are met as specified in the Quality Assurance Surveillance Plan described below.

15.0 QUALITY ASSURANCE SURVEILLANCE PLAN

The purpose of the quality assurance surveillance plan, or QASP, is to ensure that reliable, uninterrupted services are provided in accordance with the PWS. This plan will also ensure acceptable performance and assist in avoiding unnecessary mistakes and/or delays.

During contract performance, the COR will summarize and document the Contractor’s service and delivery performance utilizing the following performance categories and standards:

Completeness - Tasks and deliverables described in Section 3.0 were 100% completed by the Contractor.

Effectiveness - Tasks and deliverables provided by the Contractor were 100% effective in contributing to the overall success of the project.

Timeliness - Tasks and deliverables were 100% completed within the agreed-upon schedule and specified periods of performance.

Communication - Communication with the Government was 100% professional.

Surveillance method: random evaluation.