2031JW25Q00111_07.22.25.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

DCOC45 CODE 16. ADMINISTERED BYCODE

X

X

541519

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

07/22/2025

MARLON HOLLAND

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIME

08/01/2025 1700 ET

b. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

2031JW25Q00111

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 63 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20024

400 7TH STREET, SW

DCOC45

15. DELIVER TO

Washington DC 20219

400 7TH STREET SW

Acquisitions Management

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$34

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Comptroller of the Currency

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

0001 Unit 42 Public Sector Expertise on Demand 1 Subscription, 8-hour remote response time. Up to 150 consulting hours.

Palo Alto Networks Public Sector, LLC -

PAN-U42-EOD- 8HR-L5

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED

MARLON HOLLAND

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

63 2 of

2031JW25Q00111

Unit 42 Public Sector Expertise on Demand Subscription

a. PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 GENERAL

The NAICS for this requirement is 541519 represents Other Computer Related Services, with a size standard of $34 million.

2.0 TYPE OF CONTRACT

This is a firm-fixed-price purchase order.

3.0 PRICING

This Purchase Order is Firm Fixed Price (FFP).

Contract Line-Item Number (CLIN)

BASE YEAR: AUGUST 15, 2025, THROUGH SEPTEMBER 14, 2026

CLIN Description QTY Price 0001 Unit 42 Public Sector Expertise on Demand

Subscription, 8-hour remote response time. Up to 150 consulting hours.

Palo Alto Networks Public Sector, LLC -

PAN-U42-EOD- 8HR-L5

Total

Indicator Enhancement and Attribution Evaluation Statement of Work

Background

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. The OCC is an independent bureau of the U.S. Department of the Treasury.

Headquartered in Washington, DC, the OCC is responsible for ensuring that national banks and federal savings associations operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

PART II – STATEMENT OF WORK

Objective

This project involves providing investigative support and analysis to enhance indicators of compromise and assess attribution, leveraging commercial, open-source, and proprietary data sets. The project aims to identify the threat actors involved in a cyber compromise through the analysis of emerging threats and vulnerabilities, and to identify intelligence to help OCC anticipate and mitigate risks associated with the threat actors. The project also aims to provide in-depth research on techniques that integrate threat intelligence with our tools to provide proactive defense of OCC systems.

Scope of Work

1. Investigative Analysis

• Utilize identity and threat hunting methodologies to identify additional indicators of compromise.

• Review and analyze commercial, open source, and proprietary information to determine attribution.

2. Log Analysis

• Analyze logs on OCC's SIEM Platform, Splunk and native application logging, and Microsoft Sentinel if relevant information is required.

3. Identity and Access Management Review

• Examine IDP Tenant Access using the OTKA or EntraID Portal if required.

4. Endpoint Detection and Response (EDR)

• Review IOC events for signs of malicious identity and cyber activity on the application, platform or enterprise.

• Access Trellix EDR or any other EDR or identity platform as required.

Deliverables

• Comprehensive report detailing attribution and additional IOCs.

• Executive report summarizing findings from the performed activities.

• Regular status reports summarizing completed activities, planned activities, issues requiring attention, and budgetary updates

Timeline

• The project is expected to commence on TBD and conclude by TBD. Specific milestones and deadlines will be outlined following the project kick-off meeting.

Roles and Responsibilities

• Unit42 Responsible for executing the above tasks and providing detailed reports and recommendations.

• OCC: Provide necessary access to systems and data, including know IOCs.

Assumptions

• All necessary access and information will be provided promptly.

• The team will have access all required platforms, including Splunk, OTKA, and EDR solutions.

Security and Privacy Requirements:

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law 107-347) (FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of

OCC ITS.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract.

The contractor shall also protect all government data, equipment, etc. by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [insert specific OCC role].

C. Security and Privacy Authorization

Authorization Boundary. The contractor shall provide a diagram specific for the OCC, that clearly demarcates the information system authorization boundary and depicts all of its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. The contractor shall address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls). The diagram must include a predominant border drawn around all system components and services included in the authorization boundary.

If there are OCC-specific components (e.g., components developed or customized for the OCC, OCC-hosted components, etc.) and/or other components supporting this solution that are not in the scope of the contractor's existing security documentation, then identify those components in the diagram as well, as part of a separate OCC-specific boundary since those are unique to OCC and shall be part of the OCC-specific security authorization. The diagram must be easy to read and understand. Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. The contractor shall provide a key for symbols used.

Non-Federal External Service Provider Security Documentation. Non-federal organizations with primarily non-federal customers have limitations with respect to complying with all federal requirements. As a result, the OCC obtains assurance through other industry standard security reviews, including Statement on Standards for Attestation Engagements (SSAE) No. 18.

a. Statement on Standards for Attestation Engagements (SSAE) No. 18 Requirements. The contractor shall provide the OCC with an SSAE 18 System and Organization Controls (SOC) 2 Type 2 Report on an annual basis for services provided.

b. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

c. For any gaps in the fiscal year coverage period (October 1 - September 30), the OCC will work with the contractor to complete the internal controls assessment by relying on the work performed by the contractor's competent and objective internal audit function per Statement on Auditing Standards No.

128, Using the Work of Internal Auditors.

d. The submission of the results of the SSAE 18 SOC 2 Type 2 Report shall be as instructed per the "Security and Privacy Vendor Deliverables" section.

e. If SOC 2 Type 2 reports are not available within the last three years, the contractor shall inform the OCC to determine if there is a suitable alternative with similar level of information and detail.

f. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditors testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

OCC Security Authorization to Use. The determination of whether to issue an OCC security authorization will be made by the OCC based on the identified risks to the OCC's data and operations.

These risks include: (1) deficiencies noted in the contractor's most recent SOC 2 Type 2 Report, (2) the gaps identified in the IT security and privacy control assessments performed specific to OCC customer responsibility implementations as designated in the CRM.

D. Configuration Management

E. Continuous Monitoring

Compliance Reviews and Audits. The contractor shall permit and support compliance reviews and audits under applicable laws to allow the OCC to meet legal and compliance obligations and shall implement processes that allow visibility into the privacy and security controls employed and their effectiveness. The contractor shall provide the OCC or authorized designated officials with information requested by auditors in a timely manner, consistent with the respective auditor's deadline, in support of security compliance reviews and various annual audits, e.g., FISMA, Financial Statement Audit, A-123, etc.

In addition, the contractor shall provide the OCC or authorized designated officials logical and physical access to the contractor's facilities, installations, technical capabilities, operations, records, and databases pertinent to this contract within seven (7) calendar days upon request for these purposes.

Annual SOC 2 Type 2 Reviews. As mentioned in Section C. "Security and Privacy Authorization," under SSAE 18 requirements, the contractor shall provide the annual SSAE 18 SOC 2 Type 2 report to the OCC for review in support of continuous monitoring activities. If any portion of standard security objectives (e.g., contingency planning controls, etc.) were not in the scope of the independent auditor's testing, then the contractor shall provide a bridge letter to identify the type of test, date of test, and third party who performed the testing of those security objectives not covered by the SOC 2 Type 2 report. The contractor shall also summarize any deficiencies identified by the auditor in the bridge letter.

F. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract.

The encryption employed shall be equivalent to those approved in Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

G. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): Computer.Security@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert number].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

Information, System and Tool Availability. The contractor shall make available any information, systems and tools necessary for the OCC to respond to incidents in a manner consistent with NIST SP 800-61, as amended. In the case of a reported security incident, the contractor shall provide the OCC with access to the contractor's system and/or facilities within 72 hours of the OCC's request.

H. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met.

The contractor shall also ensure that metadata associated with litigation holds are preserved. Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

I. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

J. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

1IT Personnel include systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; personnel with contingency planning and incident response duties;

personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

1. Removal of Data Deliverables Section Deliverable Frequency Due Date

IV. F. Information Ownership.

Removal of OCC Data

IV. D. Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment.

Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

2. Training Deliverables

IV. H. Training Requirements.

Role-Based Training

List of IT Personnel on this Contract and Respective Role

Initially and as changes occur

Initial: Within 15 Days of

Award

IV. H. Training Requirements.

Role-Based Training

Completion Report for Role-Based IT Security Training Annually Annual NLT

June 5th

3. Non-Disclosure Agreement (NDA) Deliverables

IV. B. General Requirements.

Non-Disclosure Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract

Once

Prior to accessing OCC information resources

Authorization Boundary

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial: [Within x Days of Award]

M21-31 Logging Requirement

E. Continuous Monitoring

Enterprise Logging Proof of Completion for the solution

Initially, and as changes occur

Customer Responsibilities [OCC-Dedicated, Federal IT, & Commercial Services]

C. Security and Privacy Authorization.

Customer Responsibilities

Customer Responsibilities Matrix (CRM) - detailed list of all customer security responsibilities assigned to the OCC, as defined by the vendor. Typically OCC customer responsibilities are minimal and pertain to informing the contractor of new users approved for access, revocations, account reviews, if there are OCC admins – their responsibilities, etc.

Initial, and as changes occur

Security Assessment & Authorization Package

[OCC-Dedicated, Federal IT] Section Deliverable Frequency Due Date

C. Security and Privacy Authorization.

Customer Responsibilities;

Security Assessment & Authorization (SA&A) Package, Ongoing Authorization

E. Continuous Monitoring: Annual Security Assessment Report and Package Review

Security Assessment & Authorization (SA&A) Package, including:

− Current ATO memo, if authorized by another

Federal Agency − Security and Privacy Assessment Report (SAR) − Security and Privacy Assessment Plan (SAP) − Plan of Action & Milestones − System Security Plan (SSP), including FIPS 199

Security Categorization − Documents Supporting SSP* (listed below for clarification) − Customer Responsibility Matrix (CRM)

Initially, Annually, and as Significant Changes Occur

Please note that the SSP Supporting Documents (annotated with *) are all initially due with the SA&A package and thus have the same Initial Due date.

However, the SSP supporting documents have varying submission frequencies post-award as specified lower in this table.

Initial:

[Within x Days of Award] Annual:

NLT May 1

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

PART III - OTHER CONTRACTUAL TERMS AND CONDITIONS

C. Security and Privacy Authorization. SSAE 18 Requirements.

E. Continuous Monitoring. Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report. The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the three months to September 30.

Initially and annually

Within 30 Days after Award

Annual: NLT May

3.1.0 FEDERAL ACQUISITION REGULATION CLAUSES

3.1.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available. The full text of a clause may be accessed electronically at the following address:

https://www.acquisition.gov/far

FAR

Title Date 52.202-1 Definitions JUN 2020 52.203-3 Gratuities APR 1984 52.203-17 Contractor Employee Whistleblower Rights Nov 2023 52.203-19 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

JAN 2017

52.204-18 Commercial and Government Entity Code Maintenance AUG 2020

52.204-19 Incorporation by Reference of Representations and Certifications Dec 2014

52.212-4 CONTRACT TERMS AND CONDITIONS-COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

NOV 2023

52.213-2 Invoices Apr 1984

52.222-40 Notification of Employee Rights Under the National Labor Relations Act

DEC 2010

52.233-1 Disputes May 2014

52.233-4 Applicable Law for Breach of Contract Claim Oct 2004

52.242-13 Bankruptcy July 1995

52.242-15 Stop-Work Order

Aug 1989 https://www.acquisition.gov/far

(End of Table)

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Products and Commercial Services (Jan 2025)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

_X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509)).

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.232-40#FAR_52_232_40 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3903&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-section3801&num=0&edition=prelim https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-section4655&num=0&edition=prelim https://www.acquisition.gov/far/52.203-13#FAR_52_203_13

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) ( 41 U.S.C. 4712);

this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

_X_ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (6) [Reserved].

__ (7) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (9) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Dec 2023) ( Pub. L. 115–390, title II).

__ (11) (i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Dec 2023) ( Pub. L. 115–390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204-30.

_X_ (12) 52.209-6, Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. (Jan 2025) ( 31 U.S.C. 6101 note).

_X_ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) ( 41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Oct 2022) ( 15 U.S.C. 657a).

__ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved] https://www.acquisition.gov/far/52.203-15#FAR_52_203_15 https://www.acquisition.gov/far/52.203-17#FAR_52_203_17 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section4712&num=0&edition=prelim https://www.acquisition.gov/far/3.900#FAR_3_900 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.204-15#FAR_52_204_15 https://www.acquisition.gov/far/52.204-27#FAR_52_204_27 https://www.acquisition.gov/far/52.204-28#FAR_52_204_28 https://www.govinfo.gov/link/plaw/115/public/390 https://www.acquisition.gov/far/52.204-30#FAR_52_204_30 https://www.govinfo.gov/link/plaw/115/public/390 https://www.acquisition.gov/far/52.204-30#FAR_52_204_30 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 https://www.govinfo.gov/link/uscode/31/6101 https://www.acquisition.gov/far/52.209-9#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://www.acquisition.gov/far/52.219-3#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/52.219-4#FAR_52_219_4

__ (18) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (19) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (20) 52.219-8, Utilization of Small Business Concerns (Jan 2025)( 15 U.S.C. 637(d)(2) and (3)).

__ (21) (i) 52.219-9, Small Business Subcontracting Plan (Jan 2025) ( 15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Jan 2025) of 52.219-9.

__ (22) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (23) 52.219-14, Limitations on Subcontracting (Oct 2022) (15 U.S.C. 657s).

__ (24) 52.219-16, Liquidated Damages—Subcontracting Plan (Sep 2021) (15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran- Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (Feb 2024) (15 U.S.C. 657f).

__ (26) (i) 52.219-28, Postaward Small Business Program Rerepresentation (Jan 2025) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Oct 2022) (15 U.S.C. 637(m)).

__ (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) ( 15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (Sep 2021) ( 15 U.S.C. 637(a)(17)).

https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7 https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637&num=0&edition=prelim https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637&num=0&edition=prelim https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 https://www.acquisition.gov/far/52.219-14#FAR_52_219_14 https://www.acquisition.gov/far/52.219-16#FAR_52_219_16 https://www.acquisition.gov/far/52.219-27#FAR_52_219_27 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 https://www.acquisition.gov/far/52.219-29#FAR_52_219_29 https://www.acquisition.gov/far/52.219-30#FAR_52_219_30 https://www.acquisition.gov/far/52.219-32#FAR_52_219_32 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section644&num=0&edition=prelim https://www.acquisition.gov/far/52.219-33#FAR_52_219_33 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637&num=0&edition=prelim

_X_ (31) 52.222-3, Convict Labor (Jun 2003) (E.O. 11755).

_X_ (32) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2025)( E.O.

13126).

_X_ (33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (34) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

_X_ (35) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) ( 38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

_X_ (36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

_X_ (37) 52.222-37, Employment Reports on Veterans (Jun 2020) ( 38 U.S.C. 4212).

_X_ (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (39) (i) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (40) 52.222-54, Employment Eligibility Verification (Jan 2025) ( Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (41) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (May 2024) ( 42 U.S.C. 7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (May 2024) ( 42 U.S.C. 7671, et seq.).

__ (44) 52.223-20, Aerosols (May 2024) ( 42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (May 2024) ( 42 U.S.C. 7671, et seq.).

https://www.acquisition.gov/far/52.222-3#FAR_52_222_3 https://www.acquisition.gov/far/52.222-19#FAR_52_222_19 https://www.federalregister.gov/executive-order/13126 https://www.federalregister.gov/executive-order/13126 https://www.acquisition.gov/far/52.222-21#FAR_52_222_21 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 https://www.acquisition.gov/far/52.222-37#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 https://www.acquisition.gov/far/52.222-54#FAR_52_222_54 https://www.federalregister.gov/executive-order/12989 https://www.acquisition.gov/far/22.1803#FAR_22_1803 https://www.acquisition.gov/far/52.223-9#FAR_52_223_9 https://www.acquisition.gov/far/52.223-9#FAR_52_223_9 https://www.acquisition.gov/far/52.223-11#FAR_52_223_11 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section7671&num=0&edition=prelim https://www.acquisition.gov/far/52.223-12#FAR_52_223_12 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section7671&num=0&edition=prelim https://www.acquisition.gov/far/52.223-20#FAR_52_223_20 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section7671&num=0&edition=prelim https://www.acquisition.gov/far/52.223-21#FAR_52_223_21 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section7671&num=0&edition=prelim

__ (46) 52.223-23, Sustainable Products and Services (May 2024) ( E.O. 14057, 7 U.S.C.

8102, 42 U.S.C. 6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47) (i) 52.224-3 Privacy Training (Jan 2017) ( 5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48) (i) 52.225-1, Buy American-Supplies (Oct 2022) (41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV 2023) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C.

chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109- 53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Jan 2025) of 52.225-3.

__ (iv) Alternate III (Feb 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (NOV 2023) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X_ (51) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

__ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (May 2024) ( E.O. 13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

https://www.acquisition.gov/far/52.223-23#FAR_52_223_23 https://www.federalregister.gov/executive-order/14057 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title7-section8102&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title7-section8102&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section6962&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section8259&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section7671&num=0&edition=prelim https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552&num=0&edition=prelim https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.225-1#FAR_52_225_1 https://www.acquisition.gov/far/52.225-1#FAR_52_225_1 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3301&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3301&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section2112&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3805&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section4001&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title19-chapter29&saved=%7CZ3JhbnVsZWlkOlVTQy1wcmVsaW0tdGl0bGU0MC1jaGFwdGVyMzctZnJvbnQ%3D%7C%7C%7C0%7Cfalse%7Cprelim&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title19-chapter29&saved=%7CZ3JhbnVsZWlkOlVTQy1wcmVsaW0tdGl0bGU0MC1jaGFwdGVyMzctZnJvbnQ%3D%7C%7C%7C0%7Cfalse%7Cprelim&edition=prelim https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.acquisition.gov/far/52.225-5#FAR_52_225_5 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section2501&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3301&num=0&edition=prelim https://www.acquisition.gov/far/52.225-13#FAR_52_225_13 https://www.acquisition.gov/far/52.225-26#FAR_52_225_26 https://www.acquisition.gov/far/52.226-4#FAR_52_226_4 https://www.acquisition.gov/far/52.226-5#FAR_52_226_5 https://www.acquisition.gov/far/52.226-8#FAR_52_226_8 https://www.federalregister.gov/executive-order/13513 https://www.acquisition.gov/far/52.229-12#FAR_52_229_12 https://www.acquisition.gov/far/52.232-29#FAR_52_232_29 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-section3805&num=0&edition=prelim

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

_X_ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) ( 31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

_X_ (62) 52.239-1, Privacy or Security Safeguards (Aug 1996) ( 5 U.S.C. 552a).

__ (63) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (Nov 2024) (Sections 1821-1826, Pub.

L. 118-31, 41 U.S.C. 3901 note prec.).

__ (64) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

__ (65) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter67).

__…