2031JW21Q00087 Compliance RFQ v1.pdf

7. FOR SOLICITATION a. NAME b. TELEPHONE NUMBER (No collect calls) 8. OFFER DUE DATE/LOCAL TIME

INFORMATION CALL: MARLON HOLLAND 04/19/2021 1300 ET

9. ISSUED BY CODE OCC 10. THIS ACQUISITION IS X UNRESTRICTED OR SET ASIDE: % FOR:

Comptroller of the Currency SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

Acquisitions Management

400 7TH STREET SW

HUBZONE SMALL

BUSINESS

SMALL BUSINESS PROGRAM

EDWOSB

NAICS:611430

Washington DC 20219 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

SIZE STANDARD: $12.0

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

13b. RATING

14. METHOD OF SOLICITATION

SEE SCHEDULE

15. DELIVER TO CODE

DPAS (15 CFR 700)

16. ADMINISTERED BY

X RFQ IFB

CODE

RFP

17a. CONTRACTOR/

OFFEROR

CODE FACILITY

CODE

18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

IS CHECKED SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Compliance/BSA/AML Online eLearning

The OCC requires an online training

Library tool consisting of a suite of eLearning courses to ensure up-to-date bank supervision training in the specialty areas of consumer compliance, compliance with the Bank Secrecy Act (BSA), and anti-money laundering (AML) and terrorist financing including trade finance fraud.

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA 27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

X ARE

ARE

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE OF

1 51

2. CONTRACT NO. 3. AWARD/

EFFECTIVE DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER

2031JW21Q00087

6.

SOLICITATION

04/12/2021

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

KAREN A. GREEN

31c. DATE SIGNED

1x

4/12/2021

Request for Quote Number 2031JW21Q00087 Compliance/BSA/AML Online eLearning Library

PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 GENERAL

1.1 CONTRACT TYPE

The Government intends to award a Firm Fixed Price (FFP) contract.

1.2 PERIOD OF PERFORMANCE

The base period of performance shall be for a period of one-year and four 12-month option periods.

Base Period: May 01, 2021 through April 30, 2022 Option Year 1: May 01, 2022 through April 30, 2023 Option Year 2: May 01, 2023 through April 30, 2024 Option Year 3: May 01, 2024 through April 30, 2025 Option Year 4: May 01, 2025 through April 30, 2026

1.3 PRICING SCHEDULE

Base Period: May 01, 2021 through April 30, 2022 CLIN Course license Price

Option Year 1: May 01, 2022 through April 30, 2023 CLIN Course license Price

Option Year 2: May 01, 2023 through April 30, 2024

Option Year 3: May 01, 2024 through April 30, 2025

Option Year 4: May 01, 2025 through April 30, 2026

0022 Option to Extend Services up to 6-months

1.4 INVOICING

The Contractor shall invoice in accordance with industry standards for the yearly license subscription. If OCC orders additional licenses (not to exceed 50 per year), OCC shall be invoiced only for the additional quantity ordered. The Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

2.0 PURPOSE

The OCC requires an online training tool consisting of a suite of eLearning courses to ensure up-to-date bank supervision training in the specialty areas of consumer compliance, compliance with the Bank Secrecy Act (BSA), and anti-money laundering (AML) and terrorist financing including trade finance fraud. As bank product offerings and technologies develop that can impact BSA compliance risk and as consumer compliance regulations continue to undergo significant change, regulators charged with examining these areas must be skilled and equipped with the knowledge to do their jobs effectively. An enterprise licensing structure supporting approximately 800 examiners annually, of the online training, ranging from entry level through commissioned examiners, as well as experienced hires. The OCC further seeks to implement single sign on functionality beginning in the first option year of the contract.

PART II – STATEMENT OF WORK

1.0 BACKGROUND

The Office of the Comptroller of the Currency’s (OCC) mission is to ensure that the institutions that compose the federal banking system operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

The OCC charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises federal branches and agencies of foreign banking organizations. The OCC oversees the organization and structure of the federal banking system and maintains a supervisory framework that encourages banks to responsibly innovate and adapt to meet the evolving financial needs of consumers, businesses, and communities nationwide. The agency issues regulations to implement federal banking laws. It also uses a risk-based supervision process focused on evaluating banks’ risks, identifying material and emerging concerns, and requiring banks to take corrective action when warranted.

Continuing Education (CE) supports the OCC mission ensuring that appropriate training is provided for examiners to develop the necessary skills and knowledge to effectively supervise assigned financial institutions. CE designs and develops the majority of our courses internally leveraging multiple delivery modalities such as instructor-led, in-person, virtual (using tools such Adobe Connect), and on-demand eLearning and ensures alignment with the Compliance and BSA Competency Models as outlined in Attachments 1 and 2. When internal expertise or resources are not available, or requirement complexity warrants, CE contracts with industry experts to develop and deliver training to examiners. This is the case with the requirements outlined within for online eLearning support.

2.0 OBJECTIVE

The OCC requires access to an online training eLearning library to support examiners focused on supervising, assessing, and regulating Compliance and BSA/AML aspects, programs, systems, and programs of National Banks and Federal Savings Associations. Training programs must be available on-demand, developed and updated to stay abreast with advances in technology, and available both in micro-learning (small, content-specific modules/lessons) and full competency/skill-set learning development It is critical that the trainings’ focus is from the audit/examiner regulatory perspective.

3.0 SCOPE OF PROGRAM

3.1 Content Proficiency Requirements – training shall be available to support examiners from basic awareness to expert level knowledge

3.2 Critical subject areas:

3.2.1 Currency Transaction Reporting

3.2.2 Customer and Enhanced Due Diligence

3.2.3 Customer Identification Program

3.2.4 Office of Foreign Assets Control

3.2.5 Suspicious Activity Reporting

3.2.6 Introduction to Compliance, Consumer Protection Overview

3.2.7 Introduction to Compliance, Fair Lending/CRA Overview

3.3 Other sample subject areas

3.3.1 Anti-Money Laundering

3.3.2 Bank Secrecy Act

3.3.3 Anti-Terrorism Overview

3.3.4 Automated Clearing House

3.3.5 BSA/AML Trust

3.3.6 Customer Identification Program

3.3.7 Elder Financial Abuse

3.3.8 Electronic Funds Transfer Act – Regulation E

3.3.9 Expedited Funds Availability Act – Regulation CC

3.3.10 Fair Credit Reporting Act

3.3.11 Flood Insurance

3.3.12 Home Mortgage Disclosure Act – Regulation C

3.3.13 Plain and Simple – A Step-By-Step Guide to the New Integrated

Disclosures

3.3.14 Playing by the New Rules: A Guide to ATR/QM and Loan Originator

Compensation

3.3.15 Real Estate Settlement Procedures Act – Regulation X

3.3.16 Red Flags of Identity Theft

3.3.17 Remote Deposit Capture

3.3.18 Right to Financial Privacy

3.3.19 Servicemembers Civil Relief Act

3.3.20 Trade Finance

3.3.21 Truth in Lending Act – Regulation Z

3.3.22 Truth in Savings Act – Regulation DD

4.0 REQUIREMENTS

4.1 Catalog of courses that describes:

4.1.1 Skill/proficiency levels

4.1.2 Learning objectives

4.1.3 Training duration

4.1.4 Related course quizzes and exams to include pre, post, and practice assessments (if applicable), and minimum passing scores

4.1.5 Corresponding industry certifications and availability of Continuing

Professional Education (CPEs), where applicable

4.1.6 Downloadable content for offline consumption

4.2 Course review and update schedules

4.2.1 Frequency of standard reviews and processes for updates

4.2.2 User course evaluations and process for using that feedback to improve content content/quality

4.2.3 Description of process to request new content

4.2.4 Description of any customization services, if applicable

4.3 Additional resources available to learnings

4.3.1 Training for use of tools

4.3.2 External links or references

4.3.3 Subject Matter Expert (SME) contacts

4.3.4 Coaching

4.3.5 Virtual labs

4.4 Administrator access

4.4.1 User tracking

4.4.2 Course assignments

4.4.3 Permission based access to content (ability of administrators to hide courses from users)

4.4.4 Competency attainment or proficiencies

4.4.4.1 By user

4.4.4.2 By content

4.4.5 Ability to annotate courses or upload reference material for user access offline

4.5 Report functionality to allow mapping OCC Compliance-related competencies to courses/modules

4.6 Monthly Reporting

4.6.1 Contractor shall provide monthly reporting capability (such as a .csv file) by the first of each month that includes the following columns:

4.6.1.1 User email address

4.6.1.2 Course name

4.6.1.3 Completion date

4.6.1.4 Completion time

4.6.1.5 Score (if applicable)

4.7 Mobile Training Alternatives – ability to expand training delivery to include examiner mobile devices.

5.0 INFORMATION AND COMMUNICATION TECHNOLOGY ACCESIBILITY

REQUIREMENTS

5.1 Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) by the Workforce Investment Act of 1998 (P.L. requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

5.1.1 Products, platforms and services delivered as part of this work statement that are IT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. . § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

5.1.2 E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

5.1.3 E202 – No General Exceptions Authorized by OCC

5.2 The following items are identified as containing ICT:

5.2.1 Web-based intranet and internet information and applications

5.2.2 Information, documentation, and support

5.3 Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of

ICT.

5.4 Applicable requirements for software and Web products:

5.4.1 E207 – WCAG Level A & AA Success Criteria

5.4.2 E302 – Functional Performance Criteria

5.4.3 E502 – Interoperability with Assistive Technology

5.4.4 E503 – Application

5.4.5 E501 – Web-based applications, independent of platform services

5.5 Applicable requirements for electronic documents and/or support services:

5.5.1 E205 – WCAG Level A & AA Success Criteria

5.5.2 E302 – Functional Performance Criteria

5.5.3 E602 – Support Documentation

5.5.4 E603 – Support Services

6.0 HOURS OF AVAILABILITY

User shall be able to access contractor’s course catalog 24 hours a day, 7 days a week except for routine outages for scheduled maintenance. Advance notice of routine outages shall be provided to the OCC Point of Contact (POC). Notice of non-routine outages shall be provided to the POC within two (2) hours of an identified outage.

7.0 PERFORMANCE REQUIREMENT SUMMARY

The following performance standards specify the minimum acceptable quality levels (AQL). In accordance with FAR 52.212-4(a), the Government reserves the right to inspect services that have been tendered for acceptance.

https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.access-board.gov%2Fguidelines-and-standards%2Fcommunications-and-it%2Fabout-the-ict-refresh%2Ffinal-rule%2Ftext-of-the-standards-and-guidelines&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354836254&sdata=7JnwLP%2B6fbjpueFFj8jBQftTv5w3dE9NXJ2AwTTNC8Q%3D&reserved=0 https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.w3.org%2FTR%2FWCAG20%2F&data=02%7C01%7CSusan.OBrien%40occ.treas.gov%7C57ec31d2d17c479fdbf808d76d258caa%7Cfd30c7091bb849f19c7edd8840c989d0%7C0%7C0%7C637097880354846251&sdata=F90EWonF%2FMda%2Bkzn8LLuXgoeQPPwO3o9D2lmn5ZNAmA%3D&reserved=0

Required Services Performance Standards

Acceptable Quality Levels*

Methods of

Surveillance

24/7 access to online content through contractor online course catalog

Technical or system downtime issues shall be resolved within 12 hours of notification

95% Review of system outage notices, random inspection, and participant feedback

Updates and revisions of content

Significant regulatory changes incorporated into content within the quarter identified

95% Content reviews, periodic inspections, random observations, and customer complaints

*AQL will not be applied if excusable delay accepted by the government (i.e.: reasons outside the Contractor’s control/influence, etc).

8.0 SECURITY AND PRIVACY REQUIREMENTS

A. Compliance with Applicable Laws, Regulations, and Standards

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

The contractor shall not host any portion of the information, information system, infrastructure, or environment in facilities outside the contiguous United States, Alaska, Hawaii, and other U.S.

Territories.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Deliverables. The deliverables in this contract will be considered sensitive and shall not be shared with any other organization without prior approval from the OCC CO.

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

External Service Provider Compliance & Monitoring Background. The FISMA and OMB policies require that federal agencies using external service providers to process, store, or transmit federal information or operate information systems on behalf of the federal government, assure that such systems meet the information security protections commensurate with the information and system sensitivity. Federal agencies are responsible and accountable for the information security risk incurred by the use of information system services provided by external providers.

Such risk is addressed by incorporating the Risk Management Framework (RMF)1 and security requirements for external information systems and services as part of the terms and conditions of the contracts with external providers. Federal agencies can also require external providers to provide appropriate evidence to demonstrate that they have complied with protecting federal information. Prior to the implementation of the contractor's system or services, the OCC ensures compliance with the RMF by issuing an Authorization to Operate (ATO) or Authorization to Use (ATU), based on its review and analysis of the external provider's security documentation (described in detail in the next section) and assessment of customer (OCC's) security responsibilities.

1NIST Special Publication 800-37, as amended, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No. 128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations. These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

Security Configuration Settings. The contractor shall establish and enforce security configuration settings for information technology products employed in the Compliance/BSA/AML online eLearning library.

Security Updates and Patches. The contractor shall ensure that the Compliance/BSA/AML online eLearning library is properly maintained and monitored, to include immediate response to critical security patches, routine maintenance windows to allow for system updates, and compliance with the defined configuration management and change control processes. All patches and system updates shall be properly tested in a development environment before being implemented in the production environment.

Least Functionality. The contractor shall restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services for information technology products employed in the Compliance/BSA/AML online eLearning library.

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Data Separation. Unless otherwise directed by the OCC and/or controls are implemented to ensure adequate separation, any storage of data shall be contained within the resources allocated by the contractor to support the OCC and may not be on systems that are shared with other commercial or government clients.

General Use of Personally Identifiable Information (PII). The contractor shall not use any PII, including low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal authorization is prohibited.

This does not include the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email:

“Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers and other material deemed relevant by the agency that have been generated in the performance of this contract, are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer.

All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements. Intentionally left blank.

K. Supply Chain Risk Management

Background. In accordance with Federal requirements, the OCC requires supply chain entities to implement necessary security safeguards to: (i) reduce the likelihood of unauthorized modifications at each stage in the supply chain; and (ii) protect information systems and information system components, prior to taking delivery of such systems/components. This control also applies to information system services.

Supply Chain Safeguards. The contractor will:

a. Implement security and privacy controls for systems, facilities, and external connections to systems as necessary to ensure compliance with the laws, regulations, standards, and requirements specified in Sections C. Security and Privacy Authorization, F. Data Protection, and I. System Access.

b. Implement personnel screening processes to ensure suitability in accordance with relevant standards and requirements.

c. Use of tamper-evident packaging during shipping/warehousing.

d. Avoid the purchase of custom configurations to reduce the risk of acquiring information systems, components, or products that have been corrupted via supply chain actions targeted at specific organizations.

e. Vet the processes and security practices of subordinate suppliers, critical information system components, and services.

f. Employ a diverse set of suppliers to limit the potential harm from any given supplier in the supply chain.

g. Implement contract language regarding the prohibition of tainted or counterfeit components.

h. Restrict purchases from specific suppliers or countries per requirements issued by the U.S.

Department of Homeland Security (DHS) and/or Federal Acquisition Security Council, as these requirements pertain to the management of supply chain risk for Federal Agencies.

i. Use trusted/controlled distribution, delivery and warehousing options to reduce supply chain risk.

L. Security and Privacy Vendor Deliverables

Authorization Boundary Deliverables

Non-Federal External Service Provider (ESP) Security Documentation Deliverables

Removal of Data Deliverables

9.0. SECURITY AND PRIVACY VENDOR DELIVERABLES OF SOW

The specific contents and template for each deliverable will be agreed upon with the COR after contract award.

Authorization Boundary Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial:

[Within 30 Days of Award]

Non-Federal ESP Security Documentation Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

SSAE 18

Requirements;

E. Continuous Monitoring.

Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and Annually

Initial: [Within 30 Days of Award] Annual: NLT May 1

Removal of Data Section Deliverable Frequency Due Date

H.

Information Ownership.

Removal of OCC Data F. Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO;

and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once NLT 15 days after termination/expiration of contract

PART III - OTHER CONTRACTUAL TERMS AND CONDITIONS

Federal Acquisition Regulation Clauses

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items (JAN 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115- 91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.] __ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (June 2020), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Jun 2020) (31 U.S.C. 6101 note).

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-15#FAR_52_203_15 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.204-15#FAR_52_204_15 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Mar 2020) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Mar 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-4.

__ (13) [Reserved] __ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Jun 2020) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Jun 2020) of 52.219-9 __ (18) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (19) 52.219-14, Limitations on Subcontracting (Mar 2020) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Mar 2020) (15 U.S.C. 657f).

_X_ (22) (i) 52.219-28, Post Award Small Business Program Representation (Nov 2020) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (MAR 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Mar 2020) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Mar2020) (15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (Mar 2020) (15U.S.C. 637(a)(17)).

_X_ (27) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

__ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan2020) (E.O.13126).

_X_ (29) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (30) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

https://www.acquisition.gov/far/52.209-9#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://www.acquisition.gov/far/52.219-3#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/52.219-3#FAR_52_219_3 https://www.acquisition.gov/far/52.219-4#FAR_52_219_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-4#FAR_52_219_4 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7 https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 https://www.acquisition.gov/far/52.219-14#FAR_52_219_14 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-16#FAR_52_219_16 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-27#FAR_52_219_27 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 https://www.acquisition.gov/far/52.219-29#FAR_52_219_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-30#FAR_52_219_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-32#FAR_52_219_32 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.acquisition.gov/far/52.219-33#FAR_52_219_33 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec637.htm https://www.acquisition.gov/far/52.222-3#FAR_52_222_3 https://www.acquisition.gov/far/52.222-19#FAR_52_222_19 https://www.acquisition.gov/far/52.222-21#FAR_52_222_21 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26

__ (31) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

__ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

__ (33) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

__ (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (35) (i) 52.222-50, Combating Trafficking in Persons (Oct 2020) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (36) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) (42 U.S.C. 8259b).

__ (43) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

_X_ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

__ (47) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48) 52.225-1, Buy American-Supplies (Jan2021) (41 U.S.C. chapter 83).

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Jan 2021)(41 U.S.C.chapter83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109- 283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (Jan 2021) of 52.225-3.

https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 https://www.acquisition.gov/far/52.222-37#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-54#FAR_52_222_54…