SSN 2031JW24N00005-Life Ins_final2.pdf

P a g e 1 |18 SSN # 2031JW24N00005

Sources Sought Notice

Office of the Comptroller of the Currency (OCC) Group Life Insurance

Sources Sought Notice (SSN) only - it does not constitute an Invitation for Bids (IFB), Request for Proposals (RFP), or Request for Quotation (RFQ). This SSN is issued solely for information on potential sources available and does not commit the OCC to issue a solicitation (RFP/RFQ) or award a contract for any supply or service.

The OCC will not pay for any information or administrative costs incurred in response to this SSN. All costs associated with responding to this SSN will be solely at the Respondent’s expense. Respondents responding to this SSN should not anticipate feedback concerning its submission other than acknowledgement of receipt if the Submitter requests an electronic notification.

The primary North American Industry Classification System (NAICS) code to be used for this effort is 524113 – Direct Life Insurance Carriers; however, this does not preclude Respondents from proposing other relevant NAICS as well as an associated Product Service Code (PSC). The Government is seeking to gain knowledge of interested sources having the capabilities and qualifications to underwrite and administer its group life insurance benefits.

1.0 INTRODUCTION

The Office of the Comptroller of the Currency (OCC) is a non-appropriated federal financial regulatory independent bureau of the Department of the Treasury. The OCC charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks.

The OCC is headquartered in Washington, DC with primary locations in Chicago, Dallas, Denver and New York. The OCC employs approximately 3,650 employees in 70 cities nationwide.

The OCC is unique from other federal Government agencies because it offers its employees the opportunity to participate in the federal benefit programs and it has independent authority to provide compensation and benefit programs that are not offered by other agencies. The OCC sponsored benefit programs include, but are not limited to, dental, vision, group life insurance, Accidental Death and Dismemberment (AD&D) benefits, flexible spending accounts (FSA), short and long-term disability, and 401(k) programs.

The OCC’s Governmental benefits plan is exempt from Title I of Employee Retirement Income Security Act (ERISA).

The Office of Financial Research (OFR), which was established within Treasury as a result of Dodd- Frank, has a Memorandum of Understanding with the OCC for the provision of services related to some of the benefits that the OFR provides to its employees; therefore, the OFR became a participant in the OCC’s life insurance plan. Currently, the OFR employs approximately 175 employees, of which 93 are participants of the OCC life insurance program. The OFR employees are located in Washington, DC and New York, NY.

2.0 SCOPE OF WORK

2.1. General

The OCC is seeking an experienced and qualified Contractor to underwrite and administer its group life insurance program for its active and retired employees and their eligible dependents as well as the active employees and eligible dependents of the OFR. The retirees of OFR are not eligible to continue this life

P a g e 2 |18 SSN # 2031JW24N00005 insurance benefit into retirement. OCC has been offering its own group term life insurance program since the early 1980s, in addition to the federal group term life program known as the Federal Employees Group Life Insurance (FEGLI). There are approximately 2,577 employees and 2,743 retirees (of which 632 are part of a frozen group, please see Plan Design for more details on this group) enrolled in the OCC Group Life Insurance Program.

The current Contractor, Met Life, has delivered, and OCC has accepted Group Policy # 146410-1-G, and related Certificates of Insurance (together, the "Policy"). The Contractor must amend the Policy to provide the benefits described in this Section (2.0, Scope of Work) to include the following provisions:

• Due to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), the addition of the Office of Thrift Supervision (OTS) employees, their eligible dependents and retirees as well as the OFR employees and eligible dependents have been added to the OCC life insurance program;

• The Supplemental (Optional Employee) maximum coverage will be from $25,000 up to $500,000 or 5 times the employee’s annual salary; and,

• Enrollment or enrollment changes due to a salary increase of Optional employee coverage is up to two multiples of $25,000 ($50,000 maximum). This change can now be made within 60 days of the effective date of the change in salary.

In the event the Contractor finds any inconsistencies between the Policy and Section 2.0 (Scope of Work) of this SSN, the Policy shall govern; however, when necessary, the Contractor shall seek guidance from the OCC to ensure a mutually agreeable resolution of the issue.

The OCC Group Life Insurance Program is currently being administered by Metropolitan Life whose current 5-year term contract is scheduled to end on December 31, 2025.

2.2. Plan Design

The OCC Group Life Insurance Program consists of a Basic Life and three additional options. An employee must elect Basic Life in order to elect any optional coverage. A description of Basic Life and each of the options is as follows:

2.2.1. Basic Life for Active Employees

The Contractor shall provide Basic Life equal to an employee’s annual pay rounded up to the next higher thousand dollars, plus $2,000. This is the calculation for the Basic Life Amount for all employees except those classified as an “executive.” The Basic Life Amount for OCC executives is a flat $500,000. This is not determined by their actual annual salary but by their OCC grade level.

In addition to an employee’s Basic Life Amount, the coverage includes AD&D benefits, which is computed in the same manner as the Basic Life Amount.

Also, included with Basic Life is an additional Basic Life Benefit which is age-based. The additional Basic Life Benefit is applicable to employees up to age 45.

P a g e 3 |18 SSN # 2031JW24N00005

2.2.2. Basic Life for Retirees

The Contractor shall provide Basic Life for an OCC retiree (OFR retirees are not eligible to continue this benefit into retirement) in the same amount, as it was when the retiree was an employee, with the exception of AD&D and the additional benefit becoming no longer applicable. The amount of coverage reduces to 25 percent of the Basic Life Amount once the retiree attains age 65. However, a retiree can elect to reduce, at any time, their Basic Life Amount to $50,000 to avoid imputed income. In that event, once the retiree attains age 65, the coverage will be the lesser of 25 percent of the original Basic Life Amount or $50,000.

Due to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), the Office of Thrift Supervision (OTS) was merged into the OCC in July 2011. Due to this merger and the protection of the OTS benefits for one year after the merger to July 2012, there is a frozen group of former OTS retirees whose retiree plan design is different from the OCC retiree plan design. This group of 612 retirees has a plan design as follows:

Basic Life Coverage: Two times annual pay at the time of retirement rounded up to the next higher thousand dollars to a maximum of $300,000 for all retirees except for those that were Executives or Senior Managers. Executives have the same calculation but to a maximum of $800,000 and Senior Managers have a maximum of $600,000.

2.2.2.1 Optional Spousal/Domestic Partner Coverage:

50% or 100% of the retiree’s Basic Life Benefit. Retiree pays the full cost of this optional retiree coverage.

Age 65 Reduction Levels: Upon retirement, the retiree must elect the age 65 reduction level for their Basic coverage and their Spousal/Domestic partner coverage, if applicable. The reduction level chosen for the Basic coverage will be the same for the Spousal/Domestic partner coverage.

The reduction levels are as follows:

a) 75 percent reduction in the amount of Basic Insurance; the OCC will pay for 100 percent of the OCC life benefit cost. The retiree is responsible for 100 percent of the Spousal/Domestic Partner coverage, if applicable.

b) 50 percent reduction; the OCC will pay for 25 percent of the premium, and the retiree will be responsible for the remainder. The retiree is responsible for 100 percent of the Spousal/Domestic Partner coverage, if applicable.

c) No reduction in coverage; the OCC will pay for 25 percent of the premium and the retiree will be responsible for the remainder. The retiree is responsible for 100 percent of the Spousal/Domestic Partner coverage, if applicable.

The retiree may reduce their coverage at any time but cannot increase the coverage. A decrease in coverage is irrevocable.

2.2.3. Option 1 – Optional Employee Coverage

The Contractor shall provide term life coverage, which can be elected in an amount from $25,000 to $500,000 in units of $25,000. The maximum is the lesser of 5 times the employee’s salary or $500,000.

P a g e 4 |18 SSN # 2031JW24N00005

Optional Employee Coverage is life insurance coverage only for employees (not dependents). In addition, the Contractor shall provide Will Preparation and Estate Resolution Services to employees enrolled in the Optional Employee Coverage.

2.2.4. Option 2 – Spouse/Domestic Partner Coverage

The Contractor shall provide term life coverage which can be elected as 50 percent or 100 percent of the employee’s Basic Life Amount. This option provides coverage for an employee’s lawful spouse or domestic partner.

2.2.5. Option 3 – Family Coverage

The Contractor shall provide term life coverage which can be elected in five different units of coverage.

Each unit is in multiples of $5,000 for a spouse or domestic partner and $2,500 for children. The maximum coverage amount is $25,000 for a spouse or domestic partner and $12,500 for children.

2.3. Eligibility

The following types of individuals are eligible to participate in the OCC Group Life Insurance Program:

• Employee – A person who is employed by the OCC or OFR in a full-time or part-time position on a permanent or temporary basis.

• Retiree – An employee who has retired from the OCC on an immediate or disability retirement.

The employee had to be participating in the OCC Group Life Insurance Program for the lesser of five years or the entire period that coverage was available to the employee.

• Spouse/Domestic Partner – A spouse is lawfully married to the employee and not legally separated or divorced from or widowed by the employee. A domestic partner is: 1) a person of the same or opposite sex of the employee; 2) who shares the same residence as the employee and who relies on the employee for financial support; and 3) who executes a signed and notarized OCC or OFR Affidavit of Domestic Partnership.

• Dependent Child – An unmarried child up to age 22 who relies on the employee for support or under age 25 who is a full-time student at an accredited school, college or university, who is unmarried and not employed on a full-time basis. In addition, a dependent child is also a child who is 22 or more years old and incapable of self-support due to a physical or mental handicap. A dependent child includes a natural born child of the employee, a step, foster or legally adopted child of the employee, or a dependent child of the domestic partner who lives with and is financially dependent upon the employee.

2.4. Enrollments and Effective Dates

2.4.1. New Hire Enrollments

A newly hired employee may elect to participate in the OCC Group Life Insurance Program, except for a newly hired OCC/OFR executive who is automatically enrolled in Basic Life. A new hire has 60 days from their date of hire to elect to participate in the program. New hire enrollments become effective on the first day of the pay period (biweekly) on or after receipt of the enrollment form by Human Capital.

P a g e 5 |18 SSN # 2031JW24N00005

2.4.2. Late Enrollments

Employees who fail to enroll during their new hire enrollment period can only enroll during an open enrollment period or by providing evidence of insurability (EOI). Open enrollment elections become effective the first full pay period in January following the open enrollment period. EOI elections become effective the first day of the pay period following notification of approval from the Contractor.

OCC will hold a one-time open enrollment in the spring of 2026 when employees may elect to add OCC Life Coverage without EOI. This open enrollment will be without restriction. The effective date of this open enrollment will be January 10, 2027.

2.4.3. Enrollment Changes

If an employee is currently participating in the OCC Group Life Insurance Program, that employee can increase coverage as a result of a qualifying life event, i.e., marriage or acquisition of a domestic partner or a child. Employees are limited on the increase to their coverage by two units.

An employee has 60 days from the date of the qualifying life event to initiate an enrollment change. The change in enrollment will become effective the first day of the pay period following receipt of the enrollment change form by Human Capital.

An employee can decrease their coverage or cancel their participation in the OCC Group Life Insurance Program at any time. The effective date of an enrollment change or cancellation is the first day of the pay period following receipt of the form by Human Capital.

In addition to permitting a change in coverage to be made due to a qualifying life event change, OCC permits an enrollment change to Option 1 – Optional Employee Coverage, at any time, due to an increase in the employee’s salary. Employees, regardless of age, may enroll in or increase their coverage in Option 1 – Optional Employee Coverage by two units due to an increase in salary. This change can be made within 60 days of the effective date of the change in salary and will become effective on the first day of the pay period following receipt of the form by Human Capital.

2.5. Workload Requirements

The Contractor shall provide services in accordance with this SOW regardless of the actual amount of services or fluctuation in services. There is no guaranteed minimum amount of services to be provided.

The Contractor shall keep OCC abreast of any life insurance industry changes in accordance with applicable rules and regulations. The Contractor shall notify OCC immediately of any changes.

2.6. Special Plan Provisions

2.6.1. Dual Enrollment

An employee who is legally married to another OCC employee or in a domestic partnership with another OCC employee may not elect Option 2 – Spouse/Domestic Partner Coverage if the spouse or domestic partner is already insured under the OCC Group Life Insurance Program as an employee.

2.6.2. Terminally Ill Benefit Option

Employees or retirees can apply for an Accelerated Benefit Option (ABO), which allows them to receive a portion of their Basic Life Amount if they become terminally ill, having a documented medical

P a g e 6 |18 SSN # 2031JW24N00005 prognosis of a life expectancy of 12 months or less. The medical prognosis must be certified by a doctor and accepted by the Contractor.

2.6.3. Conversion/ Portability

When an employee’s Basic Life or optional coverage terminates, the employee has the right to convert that coverage to an individual, direct-pay policy within 60 days of termination. EOI would not be applicable. AD&D coverage may be ported in lieu of conversion.

3.0 ACCOUNT MANAGER

The Contractor shall provide a single point of contact for an Account Manager that shall serve as a liaison to the OCC to address day-to-day matters. The Contract shall an alternate point of contact in case of absence.

4.0 HEALTH FAIR ATTENDANCE

In support of the OCC’s efforts to educate employees on healthy living and their benefit options, the Contractor shall attend an onsite health benefits fair that is generally held annually in November at the OCC’s headquarters location at 400 7th Street, SW, Washington, DC 20024. The Contractor is to supply handouts and giveaways and be prepared to answer employee questions concerning the OCC life insurance program.

5.0 CLAIMS EXPERIENCE

The Contractor shall process all claims timely and accurately in accordance with the criteria listed in Claims Requirement Summary below:

SOW

Section

SOW

Claims Requirement

Objectives and Timeline

2.2 Adjudicate claims, process claim

payments, provide financial reports reflecting loss claim data.

Ensure that benefit claims are processed within 10 business days from date of receipt of a completed claim.

2.4.3 Process Evidence of Insurability

(EOI) forms and notify OCC of the determination

Ensure that EOI forms are reviewed and that a determination is made within 15 business days from date of receipt. The determination can be either of the following: 1) approved; 2) denied; or 3) pending for additional information.

3.0 Respond to COR and CO emails, telephone calls

Ensure that information provided is accurate, detailed, clear and concise and sent within 48 hours of request

3.0 Send a representative to attend

OCC’s annual health benefits fair held in Washington, DC in November annually

Ensure availability at least 30 days in advance of a Contractor Representative to coordinate attendance and be present at the OCC’s annual health benefits fair

P a g e 7 |18 SSN # 2031JW24N00005

The Contractor shall provide OCC employees with written notification of its claims appeals process. The Contractor shall also ensure that employees have access to an online system where they can view the status of a claim and print copies of the explanation of benefit statements for previous filed and adjudicated claims. The Contractor shall protect all claims information which includes OCC employee Personally Identifiable Information (PII).

6.0 FINANCIAL REPORTING

The Contractor shall provide to the COR an annual accounting record which details the finances for the OCC Group Life Insurance for each plan year (January 1, through December 31).

7.0 PLACE OF PERFORMANCE

The Contractor shall perform all its duties relating to this contract at the Contractor’s work location. The OCC will inspect the Contractor’s place of performance prior to the award of this contract and annually at the OCC’s discretion.

8.0 REPORT COVER SHEET

Each report submitted by the Contractor shall have a cover sheet containing the following information:

1. Title of report

2. Report number or type

3. Period covered by the report

4. Contract number

5. Name and address of the Contractor

6. Name of the COR

7. Date of Submission

9.0 ACCEPTANCE CRITERIA

The COR will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with the guidelines/ requirements. The contractor shall ensure the accuracy and completeness of all deliverables. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and/or “padding”, shall be considered deficiencies and shall be subject to correction by the contractor, at no additional cost to the Government. Unless otherwise indicated, the Government will require ten business days to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will return it for correction.

10.0 REJECTION PROCEDURES

If the COR rejects any deliverable, that rejected document will be handled in the following manner:

10.1 After notification that the deliverable did not meet the acceptance criteria, the Contractor shall re-submit an updated/corrected version within 5 business days after receipt of Government comments.

10.2 Upon re-submission by the Contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time, the Government may consider the Contractor as having deficient performance with respect to the deliverable.

P a g e 8 |18 SSN # 2031JW24N00005

11.0 SECURITY AND PRIVACY REQUIREMENTS

11.1 Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

11.2 General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [insert specific OCC role].

11.3 Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live

P a g e 9 |18 SSN # 2031JW24N00005 configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements.

The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and

P a g e 10 |18 SSN # 2031JW24N00005 operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

11.4 Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the [insert acquisition/solution name].

Security Updates and Patches. The contractor shall ensure that the [insert acquisition/solution name] is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the [insert acquisition/solution name].

11.5 Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

11.6 Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

P a g e 11 |18 SSN # 2031JW24N00005

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas:

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

11.7 Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email:

“Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

P a g e 12 |18 SSN # 2031JW24N00005

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

11.8 Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

11.9 System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

P a g e 13 |18 SSN # 2031JW24N00005

The system shall implement multi-factor authentication for remote users.

11.10 Training Requirements

11.11 Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections 13.3 Security and Privacy Authorization, 13.6 Data Protection, and 13.9 System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S. Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

P a g e 14 |18 SSN # 2031JW24N00005

L. Security and Privacy Vendor Deliverables

Removal of Data Deliverables

Section Deliverable Frequency Due Date

11.8 Information

Ownership.

Removal of OCC Data

11.6 Data

Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

Training Deliverables

Section Deliverable Frequency Due Date

11.10 Training

Requirements.

Role-Based Training

List of IT Personnel on this Contract and Respective Role

Initially and as changes occur

Initial: Within 15 Days of

Award

11.10 Training

Requirements.

Role-Based Training

Completion Report for Role-Based IT Security Training

Annually Annual NLT

June 5th

Non-Disclosure Agreement (NDA) Deliverables

11.2 General

Requirements.

Non-Disclosure Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract

Once

Prior to accessing OCC information resources

Authorization Boundary

11.3 Security and

Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial: [Within x Days of Award]

P a g e 15 |18 SSN # 2031JW24N00005

M21-31 Logging Requirement

11.5 Continuous

Monitoring

Enterprise Logging Proof of Completion for the solution

Initially, and as changes occur

Initial: [Within x Days of

Customer Responsibilities [OCC-Dedicated, Federal IT, & Commercial Services]

11.3 Security and

Privacy Authorization.

Customer Responsibilities

Customer Responsibilities Matrix (CRM) -detailed list of all customer security responsibilities assigned to the OCC, as defined by the vendor. Typically OCC customer responsibilities are minimal and pertain to informing the contractor of new users approved for access, revocations, account reviews, if there are OCC admins – their responsibilities, etc.

Initial, and as changes occur

Initial:

[Within x Days of

P a g e 16 |18 SSN # 2031JW24N00005

Security Assessment & Authorization Package [OCC-Dedicated, Federal IT]

Section Deliverable Frequency Due Date

11.3 Security and

Privacy Authorization.

Customer Responsibilities;

Security Assessment & Authorization (SA&A) Package, Ongoing Authorization

11.5 Continuous

Monitoring:

Annual Security Assessment Report and Package Review

Security Assessment & Authorization (SA&A) Package, including:

Current ATO memo, if authorized by another Federal Agency Security and Privacy Assessment Report

(SAR)

Security and Privacy Assessment Plan

(SAP)

Plan of Action & Milestones System Security Plan (SSP), including FIPS

199 Security Categorization Documents Supporting SSP* (listed below for clarification) Customer Responsibility Matrix (CRM)

Initially, Annually, and as Significant Changes Occur

Please note that the SSP Supporting Documents (annotated with *) are all initially due with the

SA&A

package and thus have the same Initial Due date.

However, the

SSP

supporting documents have varying submission frequencies post-award as specified lower in this table.

Initial:

[Within x Days of Award] Annual:

NLT May 1

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

11.3 Security and

Privacy Authorization.

SSAE 18

Requirements.

11.5 Continuous

Monitoring.

Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report.

The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and annually

Within 30 Days after

Award Annual: NLT

May 1

P a g e 17 |18 SSN # 2031JW24N00005

13.0 DELIVERABLES TABLE

Reports/Letters/Deliverables Submission Date

Implementation Project Plan 5 business following the contract kick-off meeting

Insurance Policies or Certificates 6 weeks after date of contract award

Forms and Brochures March 15, 2026

Administration Manual (4 copies) March 15, 2026

Detailed Claims Report Bi-annually

Evidence of Insurability Report 10th of each month

Annual Summary Premium/Claims Loss Ratio Report March 1st following the end of each calendar year

Open Enrollment Materials/Communication April 1, 2026

LIST OF ATTACHMENTS

The following attachments are for review and compliance:

Attachment Title

1 Blank OCC Group Life Pricing Structure

2 Technical Exhibit Active Employee Census Data

3 Technical Exhibit Retiree Census – 02292024

4 Technical Exhibit Affidavit of Domestic Partnership

5 Technical Exhibit OCC Life Claims September through December 2023

6 Technical Exhibit OFR Clause

SSN Submission Responses

Interested parties are requested to respond to this SSN electronically, that identifies the following:

1) Company Background - Provide summary information including company name, Unique Entity

Identification number, CAGE code, Government-wide Acquisition Contracts (e.g., GSA Multiple Award Schedules, National Institutes of Health Information (NIH) Technology Acquisition and Assessment Center), schedule number(s) (if applicable), and designated point of contact's name, title, email address and phone number;

2) Company Classifications – Asserted North American Industry Classification System (NAICS) Code, and Product Service Code (PSC), as identified, business size, socioeconomic status;

3) Solution and Service Overview – Describe the Group Life Insurance available through your company and provide a statement of capability demonstrating your ability to meet the desired requirements;

4) Schedule Estimate/Delivery – Delineate factors which would affect the time it would take to complete the project successfully, if applicable;

P a g e 18 |18 SSN # 2031JW24N00005

5) Other Information (e.g., commercial practices, market information, capabilities for planning purposes, subcontracting) – Provide information in terms of:

a. Commercial tool assurance (e.g., life-span, warranty, support, limitation of liability) for the duration of a resulting contract

b. Applicable qualifications certifications requirements of the company and its resources.

Identify a potential labor mix, including key and non-key personnel and opportunity for subcontracting services to Small Businesses or reason(s) that subcontracting is not available;

c. Green products or services where applicable, promoting biobased product and/or energy efficient solutions; and

6) Security/Confidentiality Requirements – Provide details of making information available in meeting security requirements in terms of FedRAMP Authorization number, SSAE 18 SOC II Type 2 report (or Bridge Letter), or third-party National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as applicable.

Responses shall be in single-spaced, Times New Roman or Arial, no less than 12-point font format, with one-inch margins all around, compatible with MS Office Word or Adobe Acrobat sent via email as courier delivery will not be accepted. Responses to the SSN shall: not exceed 5 pages, not exceed 5 MB, and be printable on 8 ½” x 11” paper. Respondents shall avoid the use of excessive marketing language, submission of fancy brochures, and other unnecessary sales literature.

The email shall include the following subject heading, “Response to SSN OCC’s Group Life Insurance.”

As noted above, this SSN is issued solely for planning purposes only, and therefore, documents received in response to this notice will not be returned, and any proprietary information contained within responses shall be clearly marked as ‘Proprietary’. All submissions in response to this SSN shall become the property of the Government. Any response submitted by Respondents to this request constitutes consent for its submission to be reviewed by OCC and its employees.

Please email your response to: Erika.Eam@occ.treas.gov by 12:00 PM (noon) Eastern Time, Monday, July 15, 2024.