2031JW24Q00102 - SAM.gov.pdf

2031JW24Q00102

(1) Action Code. N/A

(2) Date. May 29

(3) Year. 2024

(4) Contracting Office ZIP Code. 20219

(5) Product or Service Code. U009

(6) Contracting Office Address. 400 7th St. SW; Washington, DC

(7) Subject. Combined synopsis/solicitation for capital markets eLearning course library

(8) Proposed Solicitation Number. 2031JW24Q00102

(9) Closing Response Date. June 13, 2024

(10) Contact Point or Contracting Officer. Karen Oettinger

(11) Contract Award and Solicitation Number. N/A; 2031JW24Q00102

(12) Contract Award Dollar Amount. TBD

(13) Line Item Number. See Attachment 1

(14) Contract Award Date. TBD

(15) Contractor. TBD

(16) Description.

(i) This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.

(ii) The solicitation is issued as a request for quote (RFQ) and the solicitation number is

2031JW24Q00102.

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2024-05, effective May 22, 2024.

(iv) There is no set aside. The NAICS code is 611430 (Professional and Management

Development Training) and the small business size standard is $15M.

(v) A list of line item number(s) and items, quantities, and units of measure (including option(s), if applicable) can be found in Attachment 1- pricing workbook.

(vi) Description of requirements for the items to be acquired: The OCC requires unlimited access to the eLearning course library to support examiners, specialists, and team leads in various capital markets critical subject areas. OCC requires a base of 500 licenses, with the option to increase the number of licenses up to 800, and 3 OCC administrators for each year the purchase order is in effect. See the SOW.

(vii) Date(s) and place(s) of delivery and acceptance and FOB point. PoP is a 12-month base year, with four 12 month options.

(viii) A provision similar to 52.212-1, Instructions to Offerors-Commercial

Products and Commercial Services, applies to this acquisition.

(ix) The evaluation procedure is lowest price technically acceptable.

(x) 52.212-3, Offeror Representations and Certifications – Commercial Products and

Commercial Services – Quoters shall complete only paragraph (b) of the provision if the Quoter has completed the annual representations and certification electronically in the System for Award

Management (SAM) accessed through https://www.sam.gov. If the Quoter has not completed the annual representations and certifications electronically, the Quoter shall complete only paragraphs (c) through (u) of this provision.

(xi) Clause 52.212-4, Contract Terms and Conditions-Commercial Products and Commercial

Services, applies to this acquisition. There are no addenda to the clause.

(xii) Clause 52.212-5, Contract Terms and Conditions Required To Implement Statutes or

Executive Orders-Commercial Products and Commercial Services, applies to this acquisition and is included as full text.

(xiii) There are no additional contract requirements or terms and conditions outside of this solicitation.

(xiv) The Defense Priorities and Allocations System (DPAS) and assigned rating, is not applicable.

(xv) Quotations are due via email to Karen.Oettinger@occ.treas.gov, June 13, 2024 at 10am

(Eastern).

(xvi) Point of contact regarding the solicitation: Karen Oettinger -karen.oettinger@occ.treas.gov.

https://www.sam.gov/ mailto:Karen.Oettinger@occ.treas.gov

(17) Place of Contract Performance. Contractor’s site

(18) Set-aside Status. N/A

PART I – Statement of Work

1. BACKGROUND

The Office of the Comptroller of the Currency’s (OCC) mission is to ensure that the institutions that compose the federal banking system operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

The OCC charters, regulates, and supervises national banks and federal savings associations and licenses, regulates, and supervises federal branches and agencies of foreign banking organizations. The OCC oversees the organization and structure of the federal banking system and maintains a supervisory framework that encourages banks to responsibly innovate and adapt to meet the evolving financial needs of consumers, businesses, and communities nationwide. The agency issues regulations to implement federal banking laws. It also uses a risk-based supervision process focused on evaluating banks’ risks, identifying material and emerging concerns, and requiring banks to take corrective action when warranted.

Continuing Education (CE) supports the OCC mission ensuring that appropriate training is provided for examiners to develop the necessary skills and knowledge to effectively supervise assigned financial institutions. CE designs and develops the majority of courses internally, leveraging multiple delivery modalities such as instructor-led, in-person, virtual (using tools such

Adobe Connect), and on-demand eLearning and ensures alignment with the Capital Markets

Competency Models and applicable OCC Handbooks. When internal expertise or resources are not available, or requirement complexity warrants, CE contracts with industry experts to develop and deliver training to examiners. This is the case with the requirements outlined within for online eLearning support.

The Capital Markets Commissioned Curriculum Evaluation working group recommended leveraging vendor-created, just-in-time e-learning modules to support identified gaps in training curricula.

2. OBJECTIVE

The OCC requires unlimited access to the capital markets eLearning course library to support examiners, specialists, and team leads in critical subject areas. OCC requires a base of 500 licenses, with the option to increase the number of licenses up to 800, and 3 OCC administrators for each year the purchase order is in effect. Training programs must be available on-demand, developed and updated to stay abreast with advances in technology, and available both in micro-learning (small, content-specific modules/lessons) and full competency/skill-set learning development. It is critical that the trainings’ focus is from the audit/examiner regulatory perspective.

During the period of performance, the OCC may require a data reporting bridge between the contractor’s learning management system (LMS) and OCC’s LMS. If this is required, a modification would be executed if it is determined the work is within scope.

3. REQUIREMENTS

3.1. Content Proficiency Requirements. Courses shall be available to support examiners in the critical subject areas listed below.

3.1.1. Securitization: Vendor product(s) shall cover the securitization process including origination of various asset types and how they are packaged, underwritten, and sold as asset-backed securities. The product(s) shall cover how to analyze the risks involved with securitization activities and include complex securitization structures.

The product(s) shall cover applicable accounting rules and risk-based capital implications. The product(s) shall also cover credit enhancements and cash flow allocations. Additionally, the product(s) shall cover the risk management of securitization activities from origination through issuance.

3.1.2. Funds Transfer Pricing: Vendor product(s) shall include Funds Transfer Pricing

(FTP) covering the recognition that banks use different methods to incorporate the cost of funding into asset pricing, including FTP models. The product(s) shall cover how banks transfer funding costs across business units and how to analyze these

FTP approaches. Additionally, the product(s) shall cover what impact FTP has on the balance sheet optimization and balance sheet strategy. The product(s) shall cover the impact from FTP decisions on profitability and bank activities.

3.1.3. Counterparty Credit Risk: Vendor product(s) shall cover counterparty credit risk, including the recognition of bank and trade activities that give rise to counterparty credit risk and corresponding risk management practices. The product(s) shall demonstrate how to assess the level of credit exposure from bank trading activities, as well as the drivers of risk. Additionally, the product(s) shall cover how to analyze the strategies banks use to manage counterparty credit risk including standardized agreements, collateralization, limits, and aggregation of exposures. Product(s) shall also cover how to understand and assess counterparty credit risk models and assumptions.

3.1.4. Price Risk: Vendor product(s) shall cover price risk, which is defined as the risk to current or projected financial condition and resilience arising from changes in the value of either trading portfolios or other obligations that are entered into as part of distributing risk. The product(s) shall cover how to analyze price risk from non-trading sources including lending pipelines, Other Real Estate Owned, and mortgage servicing. Additionally, the product(s) shall cover the analysis of more complex sources of price risk such as trading portfolios. The potential risk to earnings and capital from for aforementioned areas of price risk shall be included. The product(s) shall cover how to analyze the effectiveness and adequacy of risk management of price risk for non-complex (non-trading) and complex portfolios (non-trading and trading). The product(s) shall cover price risk management measures and metrics, including how to review and analyze models, model assumptions and valuation techniques.

3.1.5. Balance Sheet: Vendor product(s) shall cover balance sheet composition/structure, balance sheet interrelationships, and inherent risks within the balance sheet that goes beyond a fundamental/basic understanding. The product(s) shall cover the calculation and interpretation of key bank ratios for a complex balance sheet. Additionally, the product(s) shall cover how to analyze the impact to a bank’s risk profile as a result of changes in the balance sheet and income statement. The product(s) shall also cover how a bank’s strategic planning impacts the balance sheet, income statement, and earnings and capital.

3.2. Catalog of courses that describes:

3.2.1. Skill/proficiency levels

3.2.2. Learning objectives

3.2.3. Training duration

3.2.4. How to download content for offline consumption

3.3. Course review and update process:

3.3.1. Courses must be reviewed at least once a year, and if applicable updated.

3.3.2. Course reviews (if available) must consider course evaluations in determining what, if any, updates are needed.

3.4. Quarterly report of changes, including:

3.4.1. Course content updates, including a detailed description of the updates that are made.

3.4.2. Notifications to the OCC of the deployment date and nature (regulatory or maintenance) of course updates, version number and modification date of course updates.

3.4.3. Notification if a course is added or deleted from the catalog.

3.5. Availability. User shall be able to access contractor’s course catalog 24 hours a day, 7 days a week except for routine outages for scheduled maintenance. Advance notice of routine outages shall be provided to the OCC Point of Contact (POC). Notice of non-routine outages shall be provided to the POC within two (2) hours of an identified outage.

3.6. Preferred: Pre and post assessments for e-learning products identified in Section

3.1.

3.7. Provide users with the ability to:

3.7.1. Search for courses in the catalog.

3.7.2. Self-assign/register for courses.

3.7.3. Download material for access offline (preferred capability).

3.8. On-demand user management mechanisms for OCC administrators to include:

3.8.1. User tracking

3.8.2. Assignment, deactivation, and reassignment of user licenses, if applicable

3.8.3. Spreadsheet template and import function to add a set of users

3.9. On-demand reporting mechanism for OCC administrators to access usage and assessment data. This includes:

3.9.1. Course completions and incompletions by course name and by user

3.9.2. Course usage rates by course name and by user, including time spent in any given course.

3.9.3. Assessment reports, including item analysis reports by test question and by user.

3.9.4. Export or download function in multiple formats, including .csv and PDF.

3.10. Management of users: Contractor shall assign, deactivate, and reassign user licenses at the request of the government, if applicable.

3.11. Monthly report (such as a .csv file) by the first business day of each month that contains the following:

3.11.1. User email address

3.11.2. Course name

3.11.3. Completion date

3.11.4. Completion time

3.11.5. Course length/duration

3.11.6. Assessment score (if applicable)

3.12. Training and instructions. At the start of the base period of performance and prior to deployment of any major upgrades to the contractor’s LMS, the contractor shall provide:

3.12.1. Administrator training and reference documentation on the LMS and on-demand reporting functions to OCC administrators.

3.12.2. Access instructions and quick reference documentation to support users.

3.13. Technical support and maintenance. The contractor shall provide ongoing technical support and maintenance to OCC administrators and users, as well as a dedicated customer support team, including contact information, to OCC administrators for the life of the purchase order. Technical support shall be available 7:00 am to 5:30 pm Eastern Time, Monday through Friday, excluding Federal holidays.

3.14. Tiered license flexibility. The OCC requires a minimum of 500 licenses each year of the period of performance, with the ability to add additional licenses up to 800 total. The OCC requires license flexibilities, such as the ability to reassign licenses for accounts that are inactive. The OCC will review the number of annual users prior to the start of each option year and may adjust the number for the upcoming option year to meet any emerging training requirements and ensure its examination workforce is equipped with the knowledge and analytical skills to do its job effectively.

PART II – Other Terms and Conditions

1. Information and Communication Technology Accessibility Requirements

a. Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of

1998 (P.L. 105-220) by the Workforce Investment Act of 1998 (P.L. requires that when

Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply:

• Products, platforms and services delivered as part of this work statement that are

IT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.accessboard.gov/guidelines-and-standards/communications-and-it/aboutthe-ict-refresh/final-rule/text-of-the-standards-and-guidelines

• E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

• A completed Accessibility Conformance Report (ACR) found at https://www.itic.org/policy/accessibility/vpat, using Voluntary Product

Accessibility Template (VPAT) Revised Section 508 Edition, Version 2.54, is required to assist the Government in determining that the ICT products or services support Section 508 accessibility standards.

• E202 – No General Exceptions Authorized by OCC

b. The following items are identified as containing ICT:

• Web-based intranet and internet information and applications

• Information, documentation, and support

c. Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508

Standards, or when Chapters 4-6 do not address one or more functions of ICT.

d. Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology https://www.accessboard.gov/guidelines-and-standards/communications-and-it/aboutthe-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.accessboard.gov/guidelines-and-standards/communications-and-it/aboutthe-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/ https://www.itic.org/policy/accessibility/vpat

• E503 – Application

• E501 – Web-based applications, independent of platform services

e. Applicable requirements for electronic documents and/or support services:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

2. Security Requirements

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5

U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law

107-347) (FISMA).

In addition, the contractor is responsible for ensuring individuals supporting the OCC are trained in accordance with FAR clause 24.301, “Privacy Training.” The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the

Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United

States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the

OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure

Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the COR.

C. Security and Privacy Authorization – N/A

D. Configuration Management – N/A

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

F. Data Protection

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII

(e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of PII Specific to this Contract's Scope of Work. The scope of work for this contract has specific business driven and functional requirements that involve PII. The contractor, contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

PII is no longer needed or required to be retained under applicable government records retention policies, it must be destroyed through means that will make the sensitive PII irretrievable. The contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all sensitive PII obtained under the contract that is in its possession to the government.

In accordance with OMB M-17-12 Preparing for and Responding to a Breach of Personally

Identifiable Information, the contractor and subcontractor(s) shall:

1. Properly encrypt PII in accordance with OMB Circular A-130 and standards per the

"Data Encryption" subsection above.

2. Complete regular training on how to identify and report a breach;

3. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

4. Allow for an inspection, investigation, forensic analysis, and any other action necessary to assist with responding to a breach;

5. Adhere to notification and reporting requirements specified in Section G. "Incident

Response" to effectively report and manage a suspected or confirmed breach as soon as possible (within 1 hour) and without unreasonable delay, consistent with the OCC's

Incident Response Plan and US-CERT notification guidelines. Please note that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor failed to provide adequate safeguards for PII.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the

OCC network or other OCC information resources without OCC's formal approval is prohibited.

This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

Contractor Equipment Approval. In order to obtain OCC's approval to process, store, or transmit

OCC CUI on contractor equipment, the contractor shall provide written assurance of compliance with NIST SP 800-171 (as amended), Protecting Controlled Unclassified Information in

Nonfederal Systems and Organizations, requirements for all contractor system and organization components that will process, store or transmit OCC CUI.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense

Center (CDC): CDC@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit

Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive

Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with

NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the

OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The

OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy

Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and

Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

IT Personnel include systems engineers; software developers; systems security engineers;

privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities;

personnel with access to system-level software; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

K. Supply Chain Risk Management - N/A

L. Security and Privacy Vendor Deliverables

Non-Disclosure Agreement (NDA) Deliverables

Section Deliverable Frequency Due Date

IV. B. General

Requirements.

Non-Disclosure

Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract

Once

Prior to accessing

OCC

information resources

Removal of Data Deliverables

IV. F.

Information

Ownership.

Removal of

OCC Data

IV. D. Data

Protection.

Contractor

Equipment

Certification of OCC Data Removal from

Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of

OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

Training Deliverables

IV. H. Training

Requirements.

Role-Based

Training

List of IT Personnel on this Contract and

Respective Role

Initially and as changes occur

Initial: Within

15 Days of

Award

IV. H. Training

Requirements.

Role-Based

Training

Completion Report for Role-Based IT

Security Training Annually

Annual NLT

June 5th

3. Type of Purchase Order

This is a Firm-Fixed-Priced purchase order.

4. Invoicing

The Contractor shall invoice in accordance with industry standards for the yearly license subscription. If OCC orders additional licenses (not to exceed 50 per year), OCC shall be invoiced only for the additional quantity ordered. The Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

PART III – Clauses

A. Federal Acquisition Regulation (FAR) Clauses

Incorporated by reference:

Clause Number Description Date

52.202-1 Definitions JUN 2020

52.212-4 Contract Terms and Conditions – Commercial Products and

Commercial Services

NOV 2023

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive

Orders—Commercial Products and Commercial Services. (FEB 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or

Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or

Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L.

115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV

2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR

2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws

108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

_X_(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN

2020), with Alternate I (NOV 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

__(2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) ( 41 U.S.C. 3509)).

__(3) 52.203-15, Whistleblower Protections under the American Recovery and

Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

https://www.acquisition.gov/far/part-52#FAR_52_203_19 https://www.acquisition.gov/far/part-52#FAR_52_204_23 https://www.acquisition.gov/far/part-52#FAR_52_204_25 https://www.acquisition.gov/far/part-52#FAR_52_209_10 https://www.acquisition.gov/far/part-52#FAR_52_232_40 https://www.govinfo.gov/link/uscode/31/3903 https://www.govinfo.gov/link/uscode/10/3801 https://www.acquisition.gov/far/part-52#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/4655 https://www.acquisition.gov/far/part-52#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_203_15

__(4) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) ( 41 U.S.C.

4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

__(5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract

Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__(6) [Reserved].

_X_(7) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-

117, section 743 of Div. C).

__(8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_(9) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section

102 of Division R of Pub. L. 117-328).

__(10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal

Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (DEC

2023) ( Pub. L. 115–390, title II).

__(11)

(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders—

Prohibition. (DEC 2023) ( Pub. L. 115–390, title II).

__(ii) Alternate I (DEC 2023) of 52.204–30.

X__(12) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment. (NOV

2021) ( 31 U.S.C. 6101 note).

_X_(13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility

Matters (OCT 2018) ( 41 U.S.C. 2313).

__(14) [Reserved].

__(15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (OCT 2022)

( 15 U.S.C. 657a).

__(16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business

Concerns (OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer)

( 15 U.S.C. 657a).

__(17) [Reserved]

__(18)

(i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) ( 15 U.S.C. 644).

__(ii) Alternate I (MAR 2020) of 52.219-6.

__(19)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV

2020) ( 15 U.S.C. 644).

__(ii) Alternate I (MAR 2020) of 52.219-7.

__(20) 52.219-8, Utilization of Small Business Concerns (FEB 2024)

( 15 U.S.C. 637(d)(2) and (3)).

__(21)

(i) 52.219-9, Small Business Subcontracting Plan (SEP 2023) ( 15 U.S.C. 637(d)(4)).

__(ii) Alternate I (NOV 2016) of 52.219-9.

__(iii) Alternate II (NOV 2016) of 52.219-9.

__(iv) Alternate III (JUN 2020) of 52.219-9.

__(v) Alternate IV (SEP 2023) of 52.219-9.

https://www.acquisition.gov/far/part-52#FAR_52_203_17 https://www.govinfo.gov/link/uscode/41/4712 https://www.govinfo.gov/link/uscode/41/4712 https://www.acquisition.gov/far/part-3#FAR_3_900 https://www.acquisition.gov/far/part-52#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_204_14 https://www.acquisition.gov/far/part-52#FAR_52_204_15 https://www.acquisition.gov/far/part-52#FAR_52_204_27 https://www.acquisition.gov/far/part-52#FAR_52_204_28 https://www.govinfo.gov/link/plaw/115/public/390 https://www.acquisition.gov/far/part-52#FAR_52_204_30 https://www.govinfo.gov/link/plaw/115/public/390 https://www.acquisition.gov/far/part-52#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_219_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_6 https://www.acquisition.gov/far/part-52#FAR_52_219_7 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_7 https://www.acquisition.gov/far/part-52#FAR_52_219_8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9 https://www.acquisition.gov/far/part-52#FAR_52_219_9

__(22)

(i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) ( 15 U.S.C. 644(r)).

__(ii) Alternate I (MAR 2020) of 52.219-13.

__(23) 52.219-14, Limitations on Subcontracting (OCT 2022) ( 15 U.S.C. 637s).

__(24) 52.219-16, Liquidated Damages—Subcontracting Plan (SEP

2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

__(25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled

Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program

(FEB 2024) ( 15 U.S.C. 657f).

__(26)

(i) 52.219-28, Post Award Small Business Program Rerepresentation (FEB 2024)

( 15 U.S.C. 632(a)(2)).

__(ii) Alternate I (MAR 2020) of 52.219-28.

__(27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically

Disadvantaged Women-Owned Small Business Concerns (OCT 2022) ( 15 U.S.C. 637(m)).

__(28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned

Small Business Concerns Eligible Under the Women-Owned Small Business Program (OCT

2022) ( 15 U.S.C. 637(m)).

__(29) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR

2020) ( 15 U.S.C. 644(r)).

__(30) 52.219-33, Nonmanufacturer Rule (SEP 2021) ( 15U.S.C. 637(a)(17)).

_X_(31) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

__(32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (FEB 2024).

_X_(33) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

_X_(34)

(i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

__(ii) Alternate I (FEB 1999) of 52.222-26.

_X_(35)

(i) 52.222-35, Equal Opportunity for Veterans (JUN 2020) ( 38 U.S.C. 4212).

__(ii) Alternate I (JUL 2014) of 52.222-35.

__(36)

(i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN

2020) ( 29 U.S.C. 793).

__(ii) Alternate I (JUL 2014) of 52.222-36.

_X_(37) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

_X_(38) 52.222-40, Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010) (E.O. 13496).

_X_(39)

(i) 52.222-50, Combating Trafficking in Persons (NOV

2021) ( 22 U.S.C. chapter 78 and E.O. 13627).

__(ii) Alternate I (MAR 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

__(40) 52.222-54, Employment Eligibility Verification (MAY 2022) (Executive Order

12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in

FAR 22.1803.)

__(41) https://www.acquisition.gov/far/part-52#FAR_52_219_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_13 https://www.acquisition.gov/far/part-52#FAR_52_219_14 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_16 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_27 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_28 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_28 https://www.acquisition.gov/far/part-52#FAR_52_219_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_219_32 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.acquisition.gov/far/part-52#FAR_52_219_33 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec637.htm https://www.acquisition.gov/far/part-52#FAR_52_222_3 https://www.acquisition.gov/far/part-52#FAR_52_222_19 https://www.acquisition.gov/far/part-52#FAR_52_222_21 https://www.acquisition.gov/far/part-52#FAR_52_222_26 https://www.acquisition.gov/far/part-52#FAR_52_222_26 https://www.acquisition.gov/far/part-52#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_35 https://www.acquisition.gov/far/part-52#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_36 https://www.acquisition.gov/far/part-52#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/part-52#FAR_52_222_40 https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_222_54 https://www.acquisition.gov/far/part-22#FAR_22_1803

(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–

Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__(ii) Alternate I (MAY 2008) of 52.223-9 ( 42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__(42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential

Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__(43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (JUN 2016) (E.O. 13693).

__(44)

(i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (JUN

2014) (E.O.s 13423 and 13514).

__(ii) Alternate I (OCT 2015) of 52.223-13.

__(45)

(i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (JUN 2014) (E.O.s

13423 and 13514).

__(ii) Alternate I (Jun2014) of 52.223-14.

__(46) 52.223-15, Energy Efficiency in Energy-

Consuming Products (MAY 2020) ( 42 U.S.C. 8259b).

__(47)

(i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (OCT

2015) (E.O.s 13423 and 13514).

__(ii) Alternate I (JUN 2014) of 52.223-16.

_X_(48) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While

Driving (JUN 2020) (E.O. 13513).

__(49) 52.223-20, Aerosols (JUN 2016) (E.O. 13693).

__(50) 52.223-21, Foams (Jun2016) (E.O. 13693).

_X_(51)

(i) 52.224-3 Privacy Training (JAN 2017) (5 U.S.C. 552 a).

__(ii) Alternate I (JAN 2017) of 52.224-3.

__(52)

(i) 52.225-1, Buy American-Supplies (OCT 2022) ( 41 U.S.C. chapter 83).

__(ii) Alternate I (OCT 2022) of 52.225-1.

__(53)

(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV

2023) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19

U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-

302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__(ii) Alternate I [Reserved].

__(iii) Alternate II (DEC 2022) of 52.225-3.

__(iv) Alternate III (FEB 2024) of 52.225-3.

__(v) Alternate IV (Oct 2022) of 52.225-3.

__(54) 52.225-5, Trade Agreements (NOV 2023) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

https://www.acquisition.gov/far/part-52#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_11 https://www.acquisition.gov/far/part-52#FAR_52_223_12 https://www.acquisition.gov/far/part-52#FAR_52_223_13 https://www.acquisition.gov/far/part-52#FAR_52_223_13 https://www.acquisition.gov/far/part-52#FAR_52_223_14 https://www.acquisition.gov/far/part-52#FAR_52_223_14 https://www.acquisition.gov/far/part-52#FAR_52_223_15 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_223_16 https://www.acquisition.gov/far/part-52#FAR_52_223_16 https://www.acquisition.gov/far/part-52#FAR_52_223_18 https://www.acquisition.gov/far/part-52#FAR_52_223_20 https://www.acquisition.gov/far/part-52#FAR_52_223_21 https://www.acquisition.gov/far/part-52#FAR_52_224_3 https://www.acquisition.gov/far/part-52#FAR_52_224_3 https://www.acquisition.gov/far/part-52#FAR_52_225_1 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/part-52#FAR_52_225_1 https://www.acquisition.gov/far/part-52#FAR_52_225_3 https://www.govinfo.gov/link/uscode/19/3301 https://www.govinfo.gov/link/uscode/19/2112 https://www.govinfo.gov/link/uscode/19/3805 https://www.govinfo.gov/link/uscode/19/4001 https://www.acquisition.gov/far/part-52#FAR_52_225_3…