Executive Ride Program FTC Clauses April 2026.pdf

Office of the Chief Administrative Services Officer

Executive Ride Program FTC Specific Clauses

Table of Contents

1152.201-90 - Contracting Officer’s Representative (COR)

1152.203-90 - FTC Non-Disclosure

1152.203-91 - Organizational and Individual Conflicts of Interest

1152.204-90 - Contractor Personnel Security Requirements

1152.211-90 - FTC Observance of Legal Holidays - Facility Closures

1152.224-90 - Special Protections for Sensitive Information – Experts and Consultants

1152.224-91 - Safeguarding SPII & Sensitive Health Information

1152.224-92 - Handling of Third-Party Requests for Access to Records

1152.224-93 - Data Breaches

1152.231-90 - FTC Contractor Travel Reimbursement Guidelines

1152.232-91 - Electronic Invoicing and Payment Requirements

1152.232-92 - Limitation of Funds

1152.242-91 - Inspection and Acceptance

1152.201-90 - Contracting Officer’s Representative (COR)

The contractor may accept technical direction, during the period of performance from the Contracting Officer’s Representative (COR), providing such direction is within the scope of the contract/order.

A. The COR is not authorized to change the scope of work as stated in the contract/order or obligate the Government (FTC) in any way. The Contracting Officer is the only agent for the FTC who has the authority to obligate the FTC or change the contract/order terms and conditions. Any such revision or obligation shall be authorized in writing only by the Contracting Officers. Any monies incurred beyond the dollar amount specified in this contract/order or its modifications may not be paid and does not warrant interest payments as offered under the Prompt Payment Act.

B. COR Responsibilities: A Contracting Officer’s Representative, (COR) has been named herein. The COR is responsible for:

(1) monitoring the contractor’s technical progress, including the assessment of performance and recommending to the Contracting Officer changes in scope of work, contract/order schedules and/or specifications to meet changes in requirement;

(2) advising on technical matters within the scope of work;

(3) performing technical evaluation as required;

(4) performing technical inspections and acceptances required by this contract/order; and

(5) assisting the contractor in the resolution of technical problems encountered during performance.

1152.203-90 - FTC Non-Disclosure

The unauthorized use of Federal Trade Commission files or information contained therein is a violation of the Federal Criminal Code and is punishable by a fine of up to $10,000 imprisonment of up to ten years, or both. The Contractor agrees to have each person who uses the materials relating to this contract/order execute the "NONDISCLOSURE AGREEMENT FOR CONTRACTORS" attached hereto and return these documents to the Contracting Officer.

1152.203-91 - Organizational and Individual Conflicts of Interest

(a) Applicability (see Federal Acquisition Regulation 9.502(c)): An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential conflict of interest on a future acquisition. In the latter case, some restrictions on future activities of the contractor may be required. The same considerations apply when the Contractor is an individual, rather than an organization.

(b) The Federal Trade Commission (FTC or Commission) has determined that this Contract could result in an actual, potential, or perceived Organizational or Individual Conflict of Interest.

Specifically, work performed under this Contract could cause the Contractor to have to recuse itself, its subcontractor, or its firm from any actual, anticipated, or potential litigation or other matter in which the FTC has an interest, including, but not limited to, any FTC rulemaking, law enforcement investigation, Part 3 adjudicative (administrative) proceeding before the Commission, Federal court litigation, appeal, etc.

(c) The Contractor hereby represents that:

(1) There are no actual, potential, or perceived conflicts of interest; or

(2) There are actual, potential, or perceived conflicts of interest, but the conflict(s) can be avoided, neutralized or mitigated.

(d) If the Contractor represents that there are actual, potential, or perceived conflicts of interest, the Contractor must identify the conflicts and submit a written plan to avoid, neutralize, or mitigated said conflicts of interest prior to beginning work.

(e) The final decision as to the acceptance of the proposed plan to avoid, neutralize or mitigate any conflicts of interest rests with the Contracting Officer, after consulting with relevant FTC staff and officials. If the plan is deemed unacceptable, the FTC, in its sole discretion, may determine to waive the conflict where the public interest so warrants.

(f) If conditions change during contract performance that affect the Contractor’s conflict of interest assertion, the Contractor shall inform the Contracting Officer immediately of the change, and shall comply with the requirements of paragraph (d) above. Failure of the Contractor to comply in a timely manner with the requirement of this paragraph to notify the Contracting Officer, or the requirement of paragraph (d) to submit a proposed plan, shall be grounds for termination of the contract. The Government may deny any claim for payment for all or any portion of work performed by the Contractor, whether under this Contract or any other FTC contract, to the extent that such work, in the FTC’s sole judgment, is rendered unusable or otherwise unfit for the purpose it was required by the FTC, due to a conflict of interest that the Contractor failed to report or mitigate as required by this Contract.

(g) The Contractor shall insert the above conditions in each first tier subcontract, which shall be made binding on each such subcontractor.

1152.204-90 - Contractor Personnel Security Requirements

**SPECIAL NOTICE** - Contractor Orientation takes place on Wednesdays only. It is the CORs responsibility to coordinate with the FTC Administrative & Security staff and work with the Contractor to ensure that all contractor personnel are sent through orientation.

A. GENERAL

The Federal Trade Commission (FTC) has determined that because this contract may require access to Federally controlled facilities, access to controlled unclassified information (CUI) and/or logical access to FTC Information Technology (IT) resources, the Contractor shall pre-screen all candidates designated for employment to perform work under this contract prior to their Entry on Duty (EOD) with the FTC to verify their compliance with minimum security fitness requirements.

Pre-screening will include, but not be limited to, the use of Employment Eligibility Verification (E-Verify), the Office of Personnel Management (OPM) Central Verification System (CVS), and validation of the date of birth and the Social Security Number of the person/candidate prior to EOD. See Employment Eligibility section below. For those individuals requiring access, the contractor will forward all of this information to the FTC Personnel Security Unit (PSU), which will make the determination of suitability for such individuals.

B. SUITABILITY (FITNESS) DETERMINATION

The FTC shall have and exercise full control over granting, denying, withholding or terminating access to Federal controlled facilities, access to CUI and/or logical access to FTC IT resources based upon the results of a background investigation. The FTC may, as it deems appropriate, authorize and make a favorable EOD decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full suitability authorization will follow. The granting of a favorable EOD decision or a full suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by the FTC, at any time during the term of the contract. No employee of the Contractor performing work under the contract (Contractor Employee) shall be allowed EOD and/or access to sensitive information or systems without a favorable EOD decision or suitability determination by the PSU. No Contractor Employee shall be allowed unescorted access to an FTC facility without a favorable EOD decision or suitability determination by the PSU. Contractor Employees who do not need access to Federally controlled facilities, access to CUI and or logical access to IT resources will not be subject to suitability screening.

C. BACKGROUND INVESTIGATIONS

The Position Description provided by the Contracting Officer Representative (COR) for Contractor Employees shall undergo a Position Risk Designation (PRD) based on the duties each individual will perform on the contract. The results of the PRD shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the FTC PSU.

Prospective Contractor Employees with prior favorable fitness or suitability determinations and/or security clearances (as appropriate) may be granted reciprocal recognition, to the extent practicable, when in the PSU’s sole discretion, it is determined that the prior determination or clearance meets or exceeds that which is required by the position. All Contractor Employees including any replacements or additions shall submit to fingerprinting and complete and provide the following pre-screening security forms no less than 15 business days before the starting date of the contract or 15 business days prior to the expected EOD:

1. Resume

2. Completed Credit Form – FCRA-gov

3. Completed Authorization for Release of Information – FTC 429

4. Completed Declaration for Federal Employment – OF 306

Required forms will be provided by the FTC at the time of award of the contract or upon identification of new individuals to be added to the Contractor’s workforce. Only complete packages will be accepted by the PSU. Specific instructions on submission of packages will be provided upon award of the contract. Such records shall be maintained in accordance with the Privacy Act of 1974, 5 U.S.C. 552a.

The FTC PSU may not be able to complete a satisfactory background investigation for prospective Contractor Employees who have not resided in the US for three of the past five years or who have not registered with the Selective Service, if required. In such cases, the FTC retains the right to deem a prospective Contractor Employee as ineligible to perform work under this contract due to insufficient background information.

D. CONTINUED ELIGIBILITY

If a prospective Contractor Employee is found to be ineligible for access to Federally controlled facilities, CUI, or FTC IT resources, the COR will advise the Contractor that the person shall not continue to work or to be assigned to perform any work under the contract requiring such access.

The PSU will perform annual fingerprinting and appropriate reinvestigation on all Contractor Employees.

The FTC reserves the right and prerogative to deny and/ or restrict access to Government facilities, access to CUI and/or logical access to IT resources for any Contract Employee whose actions are inconsistent with or conflict with the standards of conduct that apply to Government employees, 5 CFR 2635 and 5 CFR 5701 Subpart 5.2, or whom the FTC determines to present a risk of compromising CUI to which he or she would have access under this contract.

The loss of any FTC-issued identification card or building pass must be immediately reported to the COR. The report must include the pass or card number, name of the individual to whom issued, and the last known location and disposition of the card or pass. Likewise, the loss of any FTC materials or information, and any lost device or equipment, including any device or equipment containing any personally identifiable information (PII), must be immediately reported to the COR and to the FTC Help Desk at (202) 326-3500 (24 hours, 7 days a week). Failure to comply with these requirements may result in revocation of the Contractor Employee’s continued eligibility to perform work under this contract.

The Contractor will formally report immediately to the PSU through the COR any adverse information coming to their attention concerning Contractor Employees. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of a Contractor Employee does not obviate the requirement to submit this report. The report shall include the employee’s name and Social Security number, along with the adverse information being reported.

The PSU must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return all FTC-issued identification cards, equipment and building passes, for Contractor Employees, as well as all FTC materials and information that terminated employees may have in their possession, to the COR. The COR will return the identification cards and building passes to the responsible PSU.

E. EMPLOYMENT ELIGIBILITY

The Contractor agrees that each Contractor Employee shall have successfully passed the FTC E- Verify program operated by United States Citizenship and Immigration Services (USCIS) to establish work authorization.

The Contractor must record and retain the case verification number (obtained after closing a case upon completion of the search/verification) written on or attached to the I-9, which must be made available for inspection if requested by an authorized FTC or other authorized U.S. Government official.

The Contractor agrees that each Contractor Employee working on this contract shall have a Social Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to the Government for the acts and omissions of its own employees and those of its Subcontractor(s) and their employees.

Subject to existing law, regulations and/ or other provisions of this contract, illegal or undocumented aliens shall not be employed by the Contractor, or under this contract. The Contractor shall ensure that this provision is expressly incorporated into any and all Subcontracts or subordinate agreements issued in support of this contract.

F. SECURITY MANAGEMENT

The Contractor shall provide a point of contact (individual) to work with the FTC PSU. This individual will interface with the PSU on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and the PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract; the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

G. INFORMATION TECHNOLOGY

When CUI is processed using any telecommunications or automated information systems under this contract, the Contractor agrees to provide for the administrative, technical, and physical control of such data and to adhere to the IT security, privacy and confidentiality procedures governing such data including, but not limited to, those outlined in the FTC Non- Disclosure Agreement for Contractors (FTC Form X-033).

Contractors who fail to comply with FTC IT security policy are subject to having their access to FTC IT systems and facilities terminated, whether or not the failure results in criminal prosecution.

Any person who improperly uses, handles, or discloses protected information may be subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act of 1974, FTC Act).

H. INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All Contract Employees using FTC automated systems will be required to complete the annual basic FTC Security and Privacy Awareness Training, regarding security and privacy risks and vulnerabilities, accepted security practices, and system rules of behaviors. This training will be provided by the appropriate component of the FTC prior to the contractor entry date. Contractors using non-FTC systems to process FTC data under this contract must also provide security awareness training to their employees working on this contract.

Contractors involved in supporting the management, use, or operation of FTC IT systems, or, with any other significant security responsibilities, shall receive additional specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access FTC information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures shall be reported immediately to the PSU and the Information Assurance Manager

(IAM).

I. APPLICABILITY TO SUBCONTRACTORS

The foregoing Contractor Employee Security Requirements shall also apply to all Subcontractors and their respective employees retained by the Contractor to perform work under this contract. The Contractor shall incorporate these provisions into their contracts with, or shall otherwise ensure that these provisions are made legally binding on, such Subcontractors. Failure of the Contractor to ensure compliance with these requirements by its Subcontractor(s) shall constitute grounds for contract termination.

J. ADDITIONAL CONTRACT REQUIREMENTS

Contractor information systems subject to the Federal Information Security Management Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests. See also FTC Clause 1152.224-92 Handling of Third-Party Requests for Access to Records.

Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to to prevent and remedy data breaches and to provide the FTC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the FTC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 17-12, particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the FTC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

Use of FTC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract. Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an FTC computer, may be grounds for initiating disbarment procedures. See also FTC Clause 1152.224-93 Data Incidents and Breaches

1152.211-90 - FTC Observance of Legal Holidays - Facility Closures

The Federal Trade Commission observes the following days as holidays: New Year’s Day, Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day, and any other day designated by Federal law, Executive Order, or Presidential Proclamation.

When any such day falls on a Saturday or Sunday, the preceding Friday or the following Monday is observed, respectively.

1152.224-90 - Special Protections for Sensitive Information – Experts and Consultants

(a) Definitions. For purposes of these requirements, the following definitions apply:

(1) “Information” includes any records, data, or other information that is: provided or made available to the Contractor by the FTC; provided or made available on the FTC’s behalf to the Contractor by a non-FTC party; created, compiled, generated, collected, or maintained for the FTC to the extent it is first produced in the performance of this contract; or delivered to the FTC under this contract, other than limited rights data or restricted computer software, see Federal Acquisition Regulation (FAR) 27.402-2.

(2) “Personally Identifiable Information” (PII). The term PII, as defined by the Office of Management and Budget in Memorandum 07-16 issued May 22, 2007, refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

(3) “Sensitive Personally Identifiable Information” (Sensitive PII) refers to the following information, whether in paper, in electronic form, or communicated orally:

(i) An individual’s Social Security Number (SSN), Sensitive Health Information, or a Biometric Identifier; or

(ii) An individual’s name or address or phone number in combination with one or more of the following: date of birth; driver’s license number or other state identification number, or foreign country equivalent; military identification number; passport number;

financial account number; or credit or debit card number.

(4) “Sensitive Health Information” (SHI) includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally.

SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

(5) “Biometric Identifier” Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints; palm prints; iris and retina scans; facial characteristics; and signature and voice dynamics. All Biometric Identifiers are treated as Sensitive Information, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone.

However, a database of photographs and corresponding analyses by facial recognition software are Sensitive Information. Likewise, voice recordings and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive Information.

(6) “Other Sensitive Information” means information filed with the FTC or the Department of Justice pursuant to the premerger notification provisions of the Hart-Scott-Rodino Act, 18 U.S.C.

7A(h), information subject to any in camera or protective order issued in any administrative or judicial proceeding, and any other confidential or sensitive information provided or made available to the Contractor by the FTC directly, or from a non-FTC party on behalf of the FTC, as identified and designated in writing to the Contractor by the Contracting Office Technical Representative (COTR).

(7) “Sensitive Information” shall refer collectively to the categories of information defined in paragraphs (a)(3), (4), (5) and (6) of this provision.

(b) Protecting Sensitive Information: General Provisions.

Contractor is required to follow the FTC policies and procedures incorporated by reference in this provision or attached to this contract for the protection of Sensitive Information, and any superseding or supplemental policies and procedures that may be subsequently incorporated into the contract or attached hereto. These requirements shall govern the Contractor’s handling of such information when performing work for the FTC on-site and off-site (i.e., storage, transfer and shipping, traveling, sharing, disposal, and breach reporting). Contractor shall further ensure that its own data shall not be commingled with, and shall remain logically and physically separate from, Sensitive Information provided by or specifically compiled, created, stored, or processed for the FTC, except as needed on a temporary basis to carry out the analysis required by the contract and such commingled data shall not be stored or saved. Further, such Sensitive Information shall not be used for any purpose other than to carry out the Contractor’s obligations under the contract. All policies and procedures for safeguarding Sensitive PII or SHI incorporated into this contract or any modifications thereto shall apply to all Sensitive Information as defined by paragraph (a)(7) of this provision.

(c) Ensuring the Secure Use of Non-FTC Electronic IT Equipment. To provide further protection for Sensitive Information, the following conditions shall apply to the Contractor’s use of non- FTC electronic IT equipment.

(1) Prohibition on connecting unauthorized non-FTC portable electronic storage devices (PESDs), Mobile Wireless Devices (MWDs), or other non-FTC equipment to FTC networks or computers. To protect FTC systems from the introduction of unauthorized software, viruses, and other threats, the Contractor shall not connect any non-FTC PESD or MWD (e.g., thumb or key chain drives, external hard drives, or other equipment with electronic storage or communications capability, such as digital cameras, personal digital assistants, portable digital music players, mobile phones, BlackBerrys), any laptop, or any other non-FTC equipment, to any FTC network or computer, except where expressly authorized by the terms of the contract, or by the COTR, after obtaining approval from the FTC’s Chief Information Security Officer (CISO).

(2) Limitations on using non-FTC PESDs or other non-FTC equipment to store, ship or transfer Sensitive Information. The Contractor shall not use any non-FTC PESD, MWD, or other non- FTC equipment (e.g., non-FTC laptops or desktop computers) to store, ship or transfer Sensitive Information, except where expressly authorized by the terms of this contract or by the COTR, with approval of the CISO. The FTC, in its discretion, may instead make FTC-approved equipment available to the Contractor for this purpose. In addition, Contractor shall not use any (FTC or non-FTC) PESD, MWD, or other non-FTC equipment to store, ship or transfer Sensitive Information in unencrypted form, except as expressly authorized by the terms of this contract, including any applicable policies or procedures that have been incorporated into or attached to this contract. Such policies and procedures permit the COTR, in certain circumstances, to grant exceptions to encryption requirements for Sensitive PII; those requirements and the COTR’s authority to grant exceptions shall extend to all Sensitive Information as defined by this provision. The COTR shall consult, as necessary and appropriate, with the FTC’s Chief Privacy Officer (CPO), the CISO, and other relevant FTC officials or staff in determining whether to grant exceptions. Where encryption is required, the Contractor shall comply with technical standards designated by the FTC in paragraph (c)(4).

(3) Additional limitations on the use of non-FTC stand-alone computers and laptops.

(i) When a non-FTC stand-alone computer or laptop is connected to or otherwise made part of a non-FTC network or facility, including a stand-alone computer or laptop networked (over the Internet or otherwise) with other stand-alone computers, laptops, or other devices, its use shall be permitted only in accordance with and subject to the terms and conditions for the use of such a network and facility as set forth in paragraph (d) of this provision.

(ii) Use of non-FTC stand-alone computers or laptops to access the FTC network remotely. Contractor may use non-FTC stand-alone computers or laptops to access the FTC network remotely (whether the information to be accessed from the network is Sensitive Information or not) only in accordance with applicable FTC security standards and procedures for secure remote access to such network, including an FTC-issued token, appropriate and active firewalls and antivirus software installed on the user’s equipment, and other technical requirements. Where the Contractor’s equipment does not satisfy such requirements, the FTC may, in its discretion, make available to the Contractor an FTC-encrypted computer or laptop for such remote access. Contractor shall be required to execute a rules of behavior form (FTC Form 734 or other designated form) before the Contractor may be granted such remote FTC network access.

(iii) Technical security standards and requirements for non-FTC stand-alone computers and laptops. Contractor must comply with the technical security standards and requirements set forth in this paragraph whenever using a non-FTC stand-alone computer or laptop to process, store, or transmit Sensitive Information. (Sensitive Information shall not be stored on such equipment except as provided under paragraph (2) above.) Access Controls: use unique user ID; use strong passphrase (minimum of 12 characters) and change it every 60 days; use session lock (i.e., lock initiates after 15 minutes or less of inactivity); apply appropriate user rights to disallow access by unauthorized users.

Physical and Environmental Protections: restrict physical access to the computer from unauthorized users (e.g., store the equipment in a locked room); use a cable lock to secure the equipment; configure the basic input/output system (BIOS) so that equipment boots from the hard drive only; remove or disable the Network Interface Card (NIC); disable wireless capabilities. Computer Security Controls: use a FIPS 140-2 validated whole-disk encryption module, as provided in paragraph (c)(4) below; use anti-virus software.

(4) Encryption. Where encryption is required by this contract, the Contractor shall comply with National Institute of Standards and Technology (NIST) Federal Information Processing Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. The publication can be found here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf NIST-approved FIPS 140-2 validated vendors can be found here:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. The Contractor must use PGP whole-disk encryption with AES 256-bit encryption.

(5) Peer-to-Peer File-Sharing Software (P2P). The Contractor shall consult with the FTC before processing or transmitting any Sensitive Information on any stand-alone computer, laptop, or other device or network on which P2P software, programs, or applications have been installed or configured for open network use. P2P software generally refers to any software, program, application or system allowing individual users of the Internet to connect to each other and trade, share, or copy files such as music, video, photographs, and other files.

(d) Ensuring the Secure Use of Other Non-FTC Electronic IT Networks and Facilities.

(1) Limitation on use. Contractor warrants and agrees that it shall not use any non-FTC network or facility (e.g., commercial, corporate, university) to store or process Sensitive Information on behalf of the FTC, unless such network or facility is an information system currently certified and accredited under the Federal Information Security Management Act (FISMA), or such network or facility otherwise has reasonable administrative, technical, physical and procedural controls, including a program of continuous monitoring to ensure such controls remain in place and fully operational, to ensure the security (i.e., confidentiality, integrity and availability) of Sensitive Information stored or processed for the FTC using such network or facility.

(2) Supporting documentation; inspection. The FTC reserves the right to require at any time that the Contractor, without undue delay and at its own cost, produce documentation, including, for example, an IT system security plan, an independent audit or review, or other records or information sufficient to demonstrate to the FTC’s satisfaction the adequacy of the safeguards applicable to the network or facility. The COTR, at the direction of the Contracting Officer (CO) or as requested by the FTC’s CISO or CPO, shall exercise this right on behalf of the FTC by written notice to the Contractor, describing the nature and scope of documentation to be produced and setting forth the time period within which such documentation must be produced. The Contractor may also be required to make the relevant network or facilities reasonably available for physical inspection or audit by the FTC or other authorized Government or non-Government representatives. The COTR may extend the time period for compliance as the COTR deems appropriate.

(3) Remedies. In the event the Contractor fails to produce the documentation and/or reasonably permit the inspection, if any, required by the FTC under paragraph (d)(2) within the specified time period, or if the FTC at any time is notified or otherwise believes that the applicable safeguards are no longer operational or sufficient to protect Sensitive Information, the FTC, by written notice to the Contractor, may take any and all steps that it deems reasonable and necessary to protect such Sensitive Information, including, but not limited to:

(i) requiring that the Contractor no longer use the network or facility to perform work required by the contract;

(ii) requiring that the Contractor, at no additional cost to the FTC, ensure and certify that certain additional security controls approved or specified by the FTC have been implemented before the Contractor may continue to use such network or facilities;

(iii) requiring that the Contractor, at no additional cost to the FTC, use alternate networks or facilities approved by the FTC;

(iv) requiring that the Contractor use networks, facilities, or equipment furnished by the FTC; and/or

(v) suspending the Contractor’s performance or terminating the contract.

(e) Additional Requirements to Protect Sensitive Information.

(1) Photocopying, Facsimile Transmissions. The FTC has contractual arrangements with approved off-site photocopying and facsimile (fax) facilities. In the event the Contractor is required to photocopy or fax Sensitive Information off-site, the Contractor shall use photocopying or fax facilities designated by the COTR, or notify and seek the COTR’s express approval for the use of alternative facilities.

(2) Check-in Check-Out Moves (CICOM). If the Contractor is assigned any Government-furnished property (e.g., laptops, thumb drives, BlackBerrys, cell phones, identification badges or other official credentials), office space, or network system access (e.g., FTC email accounts, access rights to FTC or commercial subscription databases), the Contractor agrees to participate in the FTC’s CICOM process to ensure that all such property (e.g., records, equipment) is returned and that all logical and physical access rights are properly discontinued or revoked.

(3) Redaction. In the event the Contractor is required to redact documents electronically for delivery to or on behalf of the FTC, the Contractor shall use electronic redaction software or other equipment and technology as directed by the COTR to ensure that such redaction is done securely, completely and otherwise properly.

(4) Training. If the Contractor or its personnel have been granted FTC network access, the Contractor agrees that all such persons shall take FTC-mandated privacy and data security training and/or such other additional training as the COTR may specify.

(5) Web sites. Unless expressly authorized by this contract, the Contractor shall not operate any Web site or page (e.g., to collect, process, or disseminate information) on behalf of the FTC without prior written approval of the COTR, in order to ensure that such Web site complies with all requirements under applicable law, regulation, and policy (e.g., OMB Memoranda 10-22 and 10¬23).

(6) Subcontracting. Unless expressly authorized by this contract, Contractor may not subcontract performance of any work required under this contract without the express written approval of the FTC Contracting Officer. The Contractor shall, by separate contract or other separate binding agreement, require that all subcontractors who may handle or have access to Sensitive Information for the FTC comply with all requirements set forth in this provision.

1152.224-91 - Safeguarding SPII & Sensitive Health Information

Safeguarding Sensitive Personally Identifiable Information & Sensitive Health Information

1. Purpose

2. Authority

3. Applicability and Compliance

4. Definitions

5. Storage of Sensitive PII

6. Transfer or Shipment of Sensitive PII

7. Safeguarding Sensitive PII When Away From the FTC

8. Sharing Sensitive PII

9. Disposal of Sensitive PII

10. Reporting Requirements

1. Purpose

The internal policies and procedures set forth in this section are intended to help safeguard the privacy and security of Sensitive Personally Identifiable Information at the FTC.

2. Authority

This section is issued by the Chairman pursuant to Reorganization Plan No. 8 of 1950, sec. 1(a).

Additional guidance and interpretation are provided in "Privacy and Information Security Frequently Asked Questions," originally issued September 5, 2006, revised periodically, and available on the FTC Intranet.

3. Applicability and Compliance

These policies and procedures are mandatory and binding on all FTC officials, employees (including special Government employees), volunteers, interns, fellows, contractors (to the extent the policies and procedures are incorporated into their contracts) and others with FTC network access or official duties that give such individuals access to Sensitive Personally Identifiable Information (as defined in Part 4 below). Section 5-225 of the FTC Administrative Manual contains special policies and procedures for the HRMO and shall be followed by individuals when they are working in or for that Office.

All individuals to whom these policies and procedures apply shall be required to sign an annual compliance form, or other designated compliance form, certifying that they have reviewed, understand, and agree to comply with all policies and procedures set forth in this section. Failure to sign the required form(s) or to otherwise comply with the policies and procedures in this section may result in denial of access to agency information, the FTC network, or other IT resources. Failure to comply also may result in more serious disciplinary or other adverse action, including dismissal, where appropriate. Compliance with this section does not relieve any individual of the duty to comply with all other laws, rules, policies, procedures, and guidance governing information privacy and security, where applicable, including, but not limited to, the Privacy Act of 1974, and implementing FTC guidance for systems of records subject to that Act

(see 5 USC 552a; FTC Operating Manual, Chapter 15.10). Likewise, the policies and procedures in this section do not override or supersede any additional custodial procedures or notice requirements imposed by the FTC Act, where applicable (see section 21 of the FTC Act, 15 USC 57b-2; 16 CFR 4.10; FTC Operating Manual, Chapter 15.12).

4. Definitions

A. Sensitive Personally Identifiable Information (Sensitive PII). "Sensitive PII" is a specific subset of personally identifiable information (PII), as defined in Administrative Manual, Chapter 5, Section 200, Privacy Steering Committee, Part 3. For the purposes of this section, Sensitive PII refers to the following information, whether in paper, in electronic form, or communicated orally:

(1) An individual's Social Security Number (SSN);

(2) Sensitive Health Information;

(3) A Biometric Identifier; OR

(4) An individual's name or address or phone number in combination with one or more of the following: date of birth; driver's license number or other state identification number, or foreign country equivalent; military identification number; passport number; financial account number; or credit or debit card number.

B. Sensitive Health Information. Sensitive Health Information, for purposes of this section, includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. Sensitive Health Information relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present or future payment for the provision of health care to an individual.

C. Biometric Identifier. Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints, palm prints, iris and retina scans, facial characteristics and signature and voice dynamics. All Biometric Identifiers are treated as Sensitive PII, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone, which are not subject to the procedures for handling Sensitive PII. A database of photographs and corresponding analyses by facial recognition software, however, are Sensitive PII. Likewise, voice recording and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive PII.

D. Nonpublic Information. Generally, all documents collected, generated or maintained by the FTC are treated as "nonpublic" until and unless they have become available on the FTC's official public record, i.e., the FTC public reading room (H-140) or an FTC Web site (e.g., www.ftc.gov) (see 16 CFR 4.9 (public record), 4.10 (nonpublic material)). Thus, the term "nonpublic" will normally cover many or most of the documents that FTC officials, employees, contractors and others covered by these policies and procedures may work with internally on a day-to-day basis.

Broad categories of nonpublic information include internal personnel information, competitively sensitive material, intra-agency and interagency reports, memoranda, letters, correspondence, work papers, staff papers prepared for use within the agency, consumer complaints, most records or information compiled for law enforcement proceedings, as well as information that is intended to become public but has not yet been released.

5. Storage of Sensitive PII

A. All individuals covered by these policies and procedures are responsible for knowing what Sensitive PII is in their offices or otherwise under their control and for properly securing such information. Individuals should periodically assess (on at least an annual basis) whether the Sensitive PII under their control should continue to be retained.

B. Subject to the exceptions below, electronic documents (including emails), containing Sensitive PII may be stored only on individually assigned FTC network storage space or on a shared FTC network drive in a file folder to which access has been restricted to authorized individuals who need the information to do their work. Sensitive PII may not be stored on local computer drives. Thumb drives and other removable USB storage devices shall not be used to store Sensitive PII unless the information or the device is encrypted, and the device must be issued to the user or otherwise approved by ITMO.

(1) Exception: Sensitive PII may be stored temporarily on the local drive of an FTC-issued encrypted laptop for business travel, provided a supervisor's written permission is obtained, the transfer of Sensitive PII is logged as described below in section 6B, and the Sensitive PII is removed from the laptop upon return to the office as described below in section 9B.

(2) Exception: Contractors may store electronic documents (including emails) containing Sensitive PII on non-FTC equipment, networks, or facilities under certain circumstances, as permitted by their contracts.

C. Portable electronic storage devices or media (e.g., compact discs, floppy disks, zip disks, or thumb drives) that contain Sensitive PII must be stored in a locked file cabinet.

D. Paper files that contain Sensitive PII must be stored in a locked file cabinet or in a locked file room.

(1) Exception: Paper files with which the individual is currently working may be kept in a locked office.

(2) Exception: If it is not possible to lock the door (e.g., when an "office" is a cubicle), individuals may leave paper files containing Sensitive PII covered on their desks for a short period of time. When leaving for an extended period of time, such as for the day, individuals must place the files in a locked cabinet or stored in a locked file room.

E. Documents containing Sensitive PII must not be left unattended in an unlocked copy room.

6. Transfer or Shipment of Sensitive PII

This section describes when individuals must encrypt, log, and obtain supervisory approval to transfer or ship Sensitive PII (see 6A-6C), and appropriate methods for transfers and shipments (see 6D-6G).

A. Encryption. Electronic files containing Sensitive PII, including attachments to email messages, must be encrypted before they are removed, transferred or shipped from the FTC's offices or network. (Encryption of Sensitive PII obtained off-site is discussed in section 6F below). If circumstances require the transfer or shipment of unencrypted electronic files with Sensitive PII, from the FTC's offices or network, and no exception below applies, supervisory approval (or COTR approval, in the case of a contractor) must be obtained, in writing, before such transfer or shipment may occur.

(1) Exception: In the context of ongoing law enforcement investigations and cases, a limited amount of unencrypted Sensitive PII may be sent outside the FTC to a third party electronically in the following instances when it is not possible or practical to encrypt the information or to send it on paper:

(a) Request to Department of Motor Vehicles for target's photo ID and asset information.

(b) Request to U.S. Postal Service for information about a P.O. Box or mail drop.

(c) Request for a credit report pursuant to a court order.

(d) Distribution of financial information to financial institutions pursuant to a court order (e.g., to impose an asset freeze).

(e) Information provided to process servers.

(f) Request to the Financial Crimes Enforcement Network (FinCEN).

(g) Civil Investigative Demand (CID).

(h) Subpoena.

(i) Providing Sensitive PII about the target(s) of an investigation to another law enforcement agency.

(2) Exception: Unencrypted Sensitive PII can be moved between the FTC Headquarters Building, the 601 New Jersey Avenue Building, and the 1800 M Street Building (Washington, DC), e.g., on CD-ROM or DVD. In addition, it is not necessary to encrypt files that are being sent as email attachments between FTC locations (headquarters-region, region-region).

(3) Exception: Encryption is not necessary when providing Sensitive PII about oneself or one's colleagues to another Federal agency to gain access to a building, or when Sensitive PII is included in documents submitted to the State Department for international travel.

See 6B(1) and (2) below.

B. Logging Requirements. Except as required below, each FTC Division or Office must maintain a log of all Sensitive PII (in electronic or non-electronic form) that is removed, shipped or transferred from an FTC office or network, and each time an FTC employee, contractor or other individual covered by these policies and procedures removes, ships, or transfers sensitive PII to a new location not already recorded in the log. Logs should be maintained on an organizational level, not just an individual level and be retained for a period of five years.

(1) Exception:…