SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

DCOC45 CODE 16. ADMINISTERED BYCODE

X

X

X

541519

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCC

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

08/06/2026

MARLON HOLLAND

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIME

08/21/2026 1700 ET

b. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

2031JW26Q00082

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 110OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20024

400 7TH STREET, SW

DCOC45

15. DELIVER TO

Washington DC 20219

400 7TH STREET SW

Acquisitions Management

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Comptroller of the Currency

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

0001 CLIN 0001: Unit 42 Public Sector Expertise on 1 EA Demand

0002 CLIN 0002: Optional Unit 42 Public Sector 1 EA Expertise on Demand (Option Line Item)

Continued ...

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

0003 CLIN 0003: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0004 CLIN 0004: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0005 CLIN 0005: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0006 CLIN 0006: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0007 CLIN 0007: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0008 CLIN 0008: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

Continued ...

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

110 2 of

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 110

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00082

0009 CLIN 0009: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

0010 CLIN 0010: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1001 CLIN 1001: Unit 42 Public Sector Expertise on 1 EA

Demand

(Option Line Item)

1002 CLIN 1002: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1003 CLIN 1003: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1004 CLIN 1004: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1005 CLIN 1005: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1006 CLIN 1006: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1007 CLIN 1007: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1008 CLIN 1008: Optional Unit 42 Public Sector 1 EA

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

4 110

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00082

Expertise on Demand

(Option Line Item)

1009 CLIN 1009: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

1010 CLIN 1010: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2001 CLIN 2001: Unit 42 Public Sector Expertise on 1 EA

Demand

(Option Line Item)

2002 CLIN 2002: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2003 CLIN 2003: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2004 CLIN 2004: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2005 CLIN 2005: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2006 CLIN 2006: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2007 CLIN 2007: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

5 110

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00082

2008 CLIN 2008: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2009 CLIN 2009: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

2010 CLIN 2010: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3001 CLIN 3001: Unit 42 Public Sector Expertise on 1 EA

Demand

3002 CLIN 3002: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3003 CLIN 3003: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3004 CLIN 3004: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3005 CLIN 3005: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3006 CLIN 3006: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3007 CLIN 3007: Optional Unit 42 Public Sector 1 EA

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

6 110

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00082

Expertise on Demand

(Option Line Item)

3008 CLIN 3008: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3009 CLIN 3009: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

3010 CLIN 3010: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4001 CLIN 4001: Unit 42 Public Sector Expertise on 1 EA

Demand

4002 CLIN 4002: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4003 CLIN 4003: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4004 CLIN 4004: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4005 CLIN 4005: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4006 CLIN 4006: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

7 110

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

2031JW26Q00082

4007 CLIN 4007: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4008 CLIN 4008: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4009 CLIN 4009: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

4010 CLIN 4010: Optional Unit 42 Public Sector 1 EA

Expertise on Demand

(Option Line Item)

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

2031JW26Q00082

Unit 42 Public Sector Expertise on Demand Subscription

a. PART I - SUPPLIES OR SERVICES AND PRICES/COSTS

1.0 GENERAL

The NAICS for this requirement is 541519 represents Other Computer Related Services, with a size standard of $34 million.

2.0 TYPE OF CONTRACT

This is a firm-fixed-price purchase order.

3.0 PRICING

This Purchase Order is Firm Fixed Price (FFP).

Contract Line-Item Number (CLIN)

BASE YEAR: AUGUST XX 2026, THROUGH SEPTEMBER XX, 2027

CLIN Description QTY Price 0001 Unit 42 Public Sector Expertise on Demand

Subscription, PAN-U42-EOD-8HR-L5 1 $

0002 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0003 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0004 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0005 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0006 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0007 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0008 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0009 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

0010 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

Total $

Option Year 1: AUGUST XX15, 2027, THROUGH SEPTEMBER XX14, 2028

CLIN Description QTY Price 1001 Unit 42 Public Sector Expertise on Demand

Subscription, PAN-U42-EOD-8HR-L5 1 $

1002 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1003 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1004 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1005 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1006 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1007 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1008 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1009 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

1010 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

Option Year 2: AUGUST XX, 2028, THROUGH SEPTEMBER XX, 2029

2001 Unit 42 Public Sector Expertise on Demand

Subscription, PAN-U42-EOD-8HR-L5 1 $

2002 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2003 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2004 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2005 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2006 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2007 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2008 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2009 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

2010 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

Option Year 3: AUGUST XX, 2029, THROUGH SEPTEMBER XX, 2030

3001 Unit 42 Public Sector Expertise on Demand

Subscription, PAN-U42-EOD-8HR-L5 1 $

3002 Optional Unit 42 Public Sector Expertise on

L5

3003 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3004 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3005 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3006 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3007 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3008 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3009 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

3010 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

Option year 4: AUGUST XX, 2030, THROUGH SEPTEMBER XX, 2031

4001 Unit 42 Public Sector Expertise on Demand

Subscription, PAN-U42-EOD-8HR-L5 1 $

4002 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4003 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

4004 Optional Unit 42 Public Sector Expertise on

L5

4005 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4006 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4007 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4008 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4009 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR- L5

4010 Optional Unit 42 Public Sector Expertise on Demand Subscription, PAN-U42-EOD-8HR-

Indicator Enhancement and Attribution Evaluation Performance Work Statement

Background

The Office of the Comptroller of the Currency (OCC) charters, regulates, and supervises all national banks and federal savings associations as well as federal branches and agencies of foreign banks. The OCC is an independent bureau of the U.S. Department of the Treasury.

Headquartered in Washington, DC, the OCC is responsible for ensuring that national banks and federal savings associations operate in a safe and sound manner, provide fair access to financial services, treat customers fairly, and comply with applicable laws and regulations.

Objective

PART II – Performance Work Statement

This project involves providing investigative support and analysis to enhance indicators of compromise and assess attribution, leveraging commercial, open-source, and proprietary data sets. The project aims to identify the threat actors involved in a cyber compromise through the analysis of emerging threats and vulnerabilities, and to identify intelligence to help OCC anticipate and mitigate risks associated with the threat actors. The project also aims to provide in-depth research on techniques that integrate threat intelligence with our tools to provide proactive defense of OCC systems.

Scope of Work

1. Investigative Analysis

• Utilize identity and threat hunting methodologies to identify additional indicators of compromise.

• Review and analyze commercial, open source, and proprietary information to determine attribution.

2. Log Analysis

• Analyze logs on OCC's SIEM Platform, Splunk and native application logging, and Microsoft Sentinel if relevant information is required.

3. Identity and Access Management Review

• Examine IDP Tenant Access using the OTKA or EntraID Portal if required.

4. Endpoint Detection and Response (EDR)

• Review IOC events for signs of malicious identity and cyber activity on the application, platform or enterprise.

• Access Trellix EDR or any other EDR or identity platform as required.

Deliverables

• Comprehensive report detailing attribution and additional IOCs.

• Executive report summarizing findings from the performed activities.

• Regular status reports summarizing completed activities, planned activities, issues requiring attention, and budgetary updates

Timeline

• The project is expected to commence on TBD and conclude by TBD. Specific milestones and deadlines will be outlined following the project kick-off meeting.

Roles and Responsibilities

• Unit42 Responsible for executing the above tasks and providing detailed reports and recommendations.

• OCC: Provide necessary access to systems and data, including know IOCs.

Assumptions

• All necessary access and information will be provided promptly.

• The team will have access all required platforms, including Splunk, OTKA, and EDR solutions.

Security and Privacy Requirements:

A. Compliance with Applicable Laws, Regulations, and Standards

Federal Laws. The contractor and all of its respective subcontractors shall follow and remain compliant at all times with the Federal Acquisition Regulation (FAR), Privacy Act of 1974 (5 U.S.C. 552a - the Act), Federal Information Security Modernization Act of 2014 (Public Law

107-347) (FISMA).

FIPS. The contractor and all of its respective subcontractors shall follow Federal Information Processing Standards (FIPS), National Institute of Standards and Technology (NIST) standards and guidelines, and other laws, mandates, or executive orders pertaining to the protection of sensitive information and information systems.

Secure User-to-Cloud Communications Standards. All user-to-cloud service communications (e.g., via internet) must be encrypted with the latest industry standard browser protocol.

OCC Policies and Procedures. The OCC understands that there are limitations in applying agency-specific policies to systems and environments shared with other organizations or customers. The requirements in this OCC Policies and Procedures subsection applies to all activities specifically performed for the OCC by the contractor (e.g., professional services to develop or customize a component for the OCC). The intent of this section is to require contractor compliance with OCC policies and procedures for those activities, tasks, and deliverables specifically and uniquely performed and/or completed for the OCC by the contractor that is not a typical service or component of the existing contractor system/solution. This section also applies to contractors with access and use of OCC information resources (i.e., OCC network, systems, laptops, other IT equipment, and/or OCC information).

The contractor and all of its respective subcontractors shall comply with all Office of the Comptroller of the Currency (OCC) security and privacy policies and standards in effect at the time of the award of the contract, as well as those requirements that may be added during the contract.

The contractor/service provider shall conform to OCC administrative regulations, policies, and procedures, as listed in section [cite corresponding location in contracting document], in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The contractor shall work with OCC internal organizations, as needed, to ensure that policies, procedures, configuration control, and product life-cycle requirements are fulfilled to the satisfaction of OCC ITS.

B. General Requirements

Location. Information collected, used, stored, maintained, or otherwise processed by the contractor in the performance of this contract shall be accessed, transferred, stored or processed only within the United States. In addition, the maintenance and support operations of the contractor's technology and information must take place, and originate from, within the United States.

Authorization to Use, Store, or Share Sensitive Information. The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all government data, equipment, etc.

by treating the information as sensitive. All information gathered or created under this contract shall be considered as Controlled but Unclassified (CUI) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets.

Confidentiality. The contractor agrees to assume responsibility for protecting the confidentiality of government records and data associated with this contract, which are not public information.

Non-Disclosure Agreement. Each individual who has access to sensitive OCC data and/or the OCC network, systems, applications, laptops, or other OCC information resources that may process, store or transmit sensitive OCC data under this contract shall execute a Non-Disclosure Agreement before being allowed such access.

Deliverables. The deliverables in this contract will be considered CUI and shall not be shared with any other organization without prior written approval from the [insert specific OCC role].

C. Data Protection

Data Encryption. Where encryption is required, as specified by the OCC, the contractor shall ensure that encryption is established and maintained for data at rest and in transit for the duration of the contract. The encryption employed shall be equivalent to those approved in the latest version of Federal Information Processing Standards (FIPS) Publication 140-2 or 140-3.

Need to Know. Sensitive information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

Such measures include controls listed in the latest version of NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, as amended, in the following areas: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity, and Supply Chain Risk Management.

General Use of Controlled Unclassified Information (CUI). The contractor shall not use any CUI or CUI subcategories, including, Personally Identifiable Information (PII) or low-sensitivity PII (e.g., E-mail Groups and Lists), for any purpose other than those activities necessary to the performance of this contract.

Use of Contractor Equipment. Use of contractor-owned laptops or other equipment (e.g., media storage devices, servers, etc.) to process, transmit, or store OCC information or to access the OCC network or other OCC information resources without OCC's formal approval is prohibited. This restriction does not apply to the use of non-OCC laptops or PCs to use OCC-approved virtual desktop infrastructure to remotely access the OCC network.

D. Incident Response

Notification. The contractor must report all information security incidents that potentially or actually cause the compromise of OCC information, even if the contractor believes the security incident may be limited, small, or insignificant with respect to OCC data or systems. The OCC will determine when the contractor's reported security incident requires additional focus and attention.

Within one hour from the time the contractor validates that an information security incident has occurred, the contractor must report the security incident information to the OCC Cyber Defense Center (CDC): OSOC@occ.treas.gov, (202) 649-7930, regardless of day or time.

The contractor must provide any supplementary information or reports related to a previously reported incident directly to the OCC CDC with the following text in the subject line of the email: “Supplementary Information/Report related to previously reported incident # [insert incident number to be provided by contractor].”

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use the latest version of FIPS 140-2 or FIPS 140-3compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

When notifying the OCC CDC, copy the Contracting Officer if possible or, if reporting by phone or Contracting Officer's email is not immediately available, contact the Contracting Officer immediately after reporting the incident to the OCC CDC.

E. Information Ownership

Government Access. The government will retain unrestricted rights to government data. The OCC retains ownership of any user created/loaded data and deliverables (e.g., documents, applications, custom code, diagrams, workflows, data sets, etc.) hosted on contractor's equipment, systems, infrastructure, etc., as well as maintains the right to request full copies of these at any time.

Removal of OCC Data. The contractor acknowledges the OCC's exclusive right of ownership of the information and is required to transfer, return, and/or delete all agency data collected, processed, stored or maintained by the contractor on behalf of OCC upon termination of services, and shall provide written certification and supporting documentation attesting to the transfer, return and/or deletion of agency information or data generated, collected, processed, maintained, or stored by the contractor and any subcontractors, per instructions the "Security and Privacy Vendor Deliverables" section.

Documents and Deliverables. The preliminary and final OCC-specific deliverables and all associated working papers are the property of the U.S. Government. The contractor shall not release any information without the written consent of the Contracting Officer. All work papers, preliminary and final deliverables must be submitted to the COR at the conclusion of the contract in an acceptable and usable format, which may include the original format.

eDiscovery. The contractor must ensure data preservation requirements (i.e., halt destruction and maintain data the contractor may not otherwise have to maintain) related to litigation holds are met. The contractor shall also ensure that metadata associated with litigation holds are preserved.

Metadata is electronically-stored information that describes the history, tracking, or management of an electronic document. It is created automatically when a user creates, modifies, accesses, or takes other actions with respect to an electronic document.

The contractor shall provide immediate access to all government data and government-related data impacting government data for review or scan, or conduct of a forensic evaluation, and physical access to any contractor facility with government data.

F. System Access

Government Right to Terminate Access. The OCC, at its discretion, may suspend or terminate the access to any systems and/or facilities when an information security incident or other electronic access violation, use or misuse issue gives cause for such action. The suspension or termination may last until such time as OCC determines that the situation has been corrected or no longer exists.

The system shall implement multi-factor authentication for remote users.

G. Training Requirements

Security Awareness Training. All contractor personnel with access to OCC data and systems must complete OCC-provided mandatory security and privacy training prior to gaining such access. Non-compliance may result in revocation of system access.

Role-Based Training. The contractor shall ensure that IT personnel supporting this contract complete eight (8) hours of role-based specialized IT security training on an annual basis. The contractor must identify the IT personnel and their respective IT role1 that they serve in support of this contract. The contractor shall provide the list of List of IT Personnel on this Contract and Respective Role and the Completion Report for Role-Based IT Security Training per directions in the "Security and Privacy Vendor Deliverables" section.

1IT Personnel include systems engineers; software developers; systems security engineers;

privacy engineers; system, network, and database administrators; personnel conducting configuration management activities; personnel performing verification and validation activities;

personnel with access to system-level software; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; personnel with access to personally identifiable information; and system security officers.

1. Removal of Data Deliverables Section Deliverable Frequency Due Date

IV. F.

Information Ownership.

Removal of OCC Data

IV. D. Data Protection.

Contractor Equipment

Certification of OCC Data Removal from Contractor’s (including any subcontractors), Possession, Equipment, and/or Environment. Data removal instructions include transfer of information to another party per specific instructions from the CO; return of information, deliverables, etc., to the CO; and deletion of OCC data from contractor equipment (e.g., laptops and other contractor-owned equipment previously approved by the OCC for this use) using the latest version of NIST SP 800-88, Guidelines for Media Sanitization, as amended.

Once

NLT 15 days after termination/ expiration of contract

2. Training Deliverables

IV. H. Training Requirements.

Role-Based Training

List of IT Personnel on this Contract and Respective Role

Initially and as changes occur

Initial: Within 15 Days of

Award

IV. H. Training Requirements.

Role-Based Training

Completion Report for Role-Based IT Security Training Annually Annual NLT

June 5th

3. Non-Disclosure Agreement (NDA) Deliverables

IV. B. General Requirements.

Non-Disclosure Agreement

Non-Disclosure Agreements for each contractor personnel working in support of this contract

Once

Prior to accessing

OCC

information resources

Authorization Boundary

C. Security and Privacy Authorization.

Authorization Boundary

OCC-specific Demarcated Security Authorization Boundary for the solution

Initially, and as changes occur

Initial: [Within x Days of Award]

M21-31 Logging Requirement

E. Continuous Monitoring

Enterprise Logging Proof of Completion for the solution

Initially, and as changes occur

Initial: [Within x Days of

Customer Responsibilities [OCC-Dedicated, Federal IT, & Commercial Services]

C. Security and Privacy Authorization.

Customer Responsibilities

Customer Responsibilities Matrix (CRM) -detailed list of all customer security responsibilities assigned to the OCC, as defined by the vendor. Typically OCC customer responsibilities are minimal and pertain to informing the contractor of new users approved for access, revocations, account reviews, if there are OCC admins – their responsibilities, etc.

Initial, and as changes occur

Initial: [Within x Days of

Security Assessment & Authorization Package

[OCC-Dedicated, Federal IT] Section Deliverable Frequency Due

Date C. Security and Privacy Authorization.

Customer Responsibilities;

Security Assessment & Authorization (SA&A) Package, Ongoing Authorization E. Continuous Monitoring: Annual Security Assessment Report and Package Review

Security Assessment & Authorization (SA&A) Package, including:

− Current ATO memo, if authorized by another Federal Agency − Security and Privacy Assessment Report

(SAR)

− Security and Privacy Assessment Plan

(SAP)

− Plan of Action & Milestones − System Security Plan (SSP), including

FIPS 199 Security Categorization − Documents Supporting SSP* (listed below for clarification) − Customer Responsibility Matrix (CRM)

Initially, Annually, and as Significant Changes Occur

Please note that the SSP Supporting Documents (annotated with *) are all initially due with the SA&A package and thus have the same Initial Due date.

However, the SSP supporting documents have varying submission frequencies post-award as specified lower in this table.

Initial:

[Within x Days of Award] Annual:

NLT May

Non-Federal ESP Security Documentation [Commercial ESP or Public Cloud ESP w/Nonfederal Customer Base and No FedRAMP ATO]

H. Mandatory Staffing Plan and Monthly Contractor Workforce Reporting Deliverables

C. Security and Privacy Authorization.

SSAE 18

Requirements.

E. Continuous Monitoring.

Annual SOC 2 Type 2 Reviews

Statement on Standards for Attestation Engagements (SSAE) 18 SOC Type II report.

The preferred coverage period for the report is July 1 through June 30 with a bridge letter covering the from the end of the SOC II Type II report to the current date.

Initially and annually

Within 30 Days after Award

Annual: NLT May 1

• The Monthly Workforce Report (Attachment 3) must be submitted in PDF format, digitally signed, marked “CUI//SP-PRVCY.” and uploaded to IPP as an attachment to the monthly invoice. The monthly report is limited to the fields specified in the template; do not include Social Security Numbers, dates of birth, home addresses, or other unnecessary PII. This deliverable is only required if the staffing plan includes contractor support. If you submit N/A in your Initial Staffing Plan, then you are not required to submit the Monthly Workforce Report.

Deliverables Tables Description Format Frequency Due Date

Monthly Workforce Report Required Template (Attachment 3)

Adobe

PDF

1 Final, Monthly, If Applicable

Monthly submitted in IPP with invoice

PART III - OTHER CONTRACTUAL TERMS AND CONDITIONS

3.1.0 FEDERAL ACQUISITION REGULATION CLAUSES

3.1.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available. The full text of a clause may be accessed electronically at the following address:

https://www.acquisition.gov/far

FAR

Title Date 52.202-1 Definitions JUN 2020 52.203-3 Gratuities APR 1984 52.203-11 Certification and Disclosure Regarding Payments to Influence

SEP 2024

25.203-12 Limitation on Payments to Influence Certain Federal Transactions

JUN 2020

https://www.acquisition.gov/far

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements

JAN 2017

52.204-7 System for Award Management

NOV 2024

52.204-18 Commercial and Government Entity Code Maintenance AUG 2020

52.204-19 Incorporation by Reference of Representations and Certifications Dec 2014

52.212-4 CONTRACT TERMS AND CONDITIONS-COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

NOV 2023

52.213-2 Invoices Apr 1984

52.222-40 Notification of Employee Rights Under the National Labor Relations Act

DEC 2010

52.233-1 Disputes May 2014

52.233-4 Applicable Law for Breach of Contract Claim Oct 2004

52.242-13 Bankruptcy July 1995

52.242-15 Stop-Work Order

Aug 1989

(End of Table)

2.203-6 Restrictions on Subcontractor Sales to the Government. (JUN 2020)

(a) Except as provided in (b) of this clause, the Contractor shall not enter into any agreement with an actual or prospective subcontractor, nor otherwise act in any manner, which has or may have the effect of restricting sales by such subcontractors directly to the Government of any item or process (including computer software) made or furnished by the subcontractor under this contract or under any follow-on production contract.

(b) The prohibition in (a) of this clause does not preclude the Contractor from asserting rights that are otherwise authorized by law or regulation.

(c) The Contractor agrees to incorporate the substance of this clause, including this paragraph (c), in all subcontracts under this contract which exceed the simplified acquisition threshold, as defined in Federal Acquisition Regulation 2.101 on the date of subcontract award.

(End of clause)

52.203-17 Contractor Employee Whistleblower Rights. (NOV 2023)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 41 U.S.C. 4712 and Federal Acquisition Regulation (FAR)

3.900 through 3.905.

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in FAR 3.900 through 3.905.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts.

(End of clause)

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements. (JAN 2017)

(a) Definitions. As used in this clause-

Internal confidentiality agreement or statement means a confidentiality agreement or any other written statement that the contractor requires any of its employees or subcontractors to sign regarding nondisclosure of contractor information, except that it does not include confidentiality agreements arising out of civil litigation or confidentiality agreements that contractor employees or subcontractors sign at the behest of a Federal agency.

Subcontract means any contract as defined in subpart 2.1 entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and changes and modifications to purchase orders.

Subcontractor means any supplier, distributor, vendor, or firm (including a consultant) that furnishes supplies or services to or for a prime contractor or another subcontractor.

(b) The Contractor shall not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section4712&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section4712&num=0&edition=prelim

(c) The Contractor shall notify current employees and subcontractors that prohibitions and restrictions of any preexisting internal confidentiality agreements or statements covered by this clause, to the extent that such prohibitions and restrictions are inconsistent with the prohibitions of this clause, are no longer in effect.

(d) The prohibition in paragraph (b) of this clause does not contravene requirements applicable to Standard Form 312 (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(e) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015, (Pub. L. 113-235), and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions) use of funds appropriated (or otherwise made available) is prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.

(f) The Contractor shall include the substance of this clause, including this paragraph (f), in subcontracts under such contracts.

(End of clause)

52.204-9 Personal Identity Verification of Contractor Personnel. (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause)

52.204-13 System for Award Management—Maintenance. (NOV 2025)

(a) Definitions. As used in this clause—

Commercial and Government Entity code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location (referred to as “CAGE code”); or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency to entities located outside the United States and its outlying areas that the DLA CAGE Branch records and maintains in the CAGE master file (referred to as “NCAGE code”).

Unique Entity Identifier (UEI) means an identifier used to identify a specific commercial, nonprofit, or Government entity.

(b) Active registration.

(1) The Contractor shall maintain an active Federal Government contracts registration in the System for Award Management (SAM) at https://www.sam.gov during contract performance and through final payment under this contract. To maintain an active registration in SAM, the Contractor shall review at least annually its registration in SAM and validate that the information is current, accurate, and complete.

https://www.sam.gov/

(2) The Contractor is responsible for the currency, accuracy, and completeness of the information provided within SAM, and for any liability resulting from the Government’s reliance on inaccurate or incomplete information. Updating SAM does not alter the terms and conditions of this contract and is not a substitute for a properly executed contractual document.

(c) Novation and change-of-name agreements.

(1) If the Contractor has legally changed its business name or “doing business as” name (whichever is shown on the contract), or has transferred the assets used to perform the contract, but has not completed the necessary requirements regarding novation and change-of-name agreements in part 42 of the Federal Acquisition Regulation (FAR), the Contractor shall provide the responsible Contracting Officer a minimum of one business day’s written notification of its intention to —

(i) Change the legal business name in SAM;

(ii) Comply with the requirements of FAR part 42; and

(iii) Agree in writing to the timeline and procedures specified by the responsible Contracting Officer. The Contractor shall provide with its written notification sufficient documentation to support the legally changed name.

(2) If the Contractor fails to comply with the requirements of paragraph (c)(1) of this clause, or fails to perform the agreement at paragraph (c)(1)(iii) of this clause, and, in the absence of a properly executed novation or change-of-name agreement, the SAM information that shows the Contractor to be other than the Contractor indicated in the contract will be considered to be incorrect information within the meaning of the “Suspension of Payment” paragraph of the electronic funds transfer (EFT) clause of this contract.

(d) Assignees.

(1) The Contractor shall not change the legal business name or address for EFT payments or manual payments, as appropriate, in the SAM record to reflect an assignee for the purpose of assignment of claims (see FAR part 32). Assignees shall be separately registered in SAM.

(2) Information provided to the Contractor’s SAM record that indicates payments, including those made by EFT, to an ultimate recipient other than that Contractor will be incorrect information within the meaning of the “Suspension of Payment” paragraph of the EFT clause of this contract.

(e) Unique entity identifier (UEI). The Contractor shall ensure that its UEI is maintained throughout the life of the contract.

(f) Commercial and Government Entity (CAGE) code. The Contractor shall ensure that the CAGE code is maintained throughout the life of the contract. To update a CAGE code, the Contractor shall initiate the change by updating its SAM registration.

(g) Communicating changes. The Contractor shall communicate any change to its UEI or CAGE code to the Contracting Officer within 30 days after the change, so a modification can be issued to update the UEI or CAGE code on this contract. A change in the UEI does not necessarily require a novation.

(End of clause)

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. (NOV 2025)

(a) Definition. As used in this clause—

Commercially available off-the-shelf (COTS) item

(1) Means any item of supply (including construction material) that is–

(i) A commercial product (as defined in paragraph (1) of the definition of “commercial product” in Federal Acquisition Regulation (FAR) 2.101);

(ii) Sold in substantial quantities in the commercial marketplace; and

(iii) Offered to the Government, under a contract or subcontract at any tier, without modification, in the same form in which it is sold in the commercial marketplace; and

(2) Does not include bulk cargo, as defined in 46 U.S.C. 40102(4), such as agricultural products and petroleum products.

(b) The Government suspends or debars Contractors to protect the Government's interests. Other than a subcontract for a commercially available off-the-shelf item, the Contractor shall not enter into any subcontract, in excess of the threshold specified in FAR 9.405-2(b) on the date of subcontract award, with a Contractor that is debarred, suspended, or proposed for debarment by any executive agency unless a compelling reason exists to do so.

http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title46-section40102(4)&num=0&edition=prelim

(c) The Contractor shall require each proposed subcontractor whose subcontract will exceed the threshold specified in FAR 9.405-2(b) on the date of subcontract award, other than a subcontractor providing a commercially available off-the-shelf item, to disclose to the Contractor, in writing, whether as of the time of award of the subcontract, the subcontractor, or its principals, is or is not debarred, suspended, proposed for debarment, or voluntarily excluded by the Federal Government.

(d) A corporate officer or a designee of the Contractor shall notify the Contracting Officer, in writing, before entering into a subcontract with a party (other than a subcontractor providing a commercially available off-the-shelf item) that is debarred, suspended, proposed for debarment, or voluntarily excluded (see FAR 9.404 for information on the System for Award Management (SAM) Exclusions). The notice must include the following:

(1) The name of the subcontractor.

(2) The Contractor’s knowledge of the reasons for the subcontractor being listed with an exclusion in SAM.

(3) The compelling reason(s) for doing business with the subcontractor notwithstanding its being listed with an exclusion in SAM.

(4) The systems and procedures the Contractor has established to ensure that it is fully protecting the Government's interests when dealing with such subcontractor in view of the specific basis for the party's debarment, suspension, proposed debarment, or voluntary exclusion.

(e) Subcontracts. Unless this is a contract for the acquisition of commercial products or commercial services, the Contractor shall include the requirements of this clause, including this paragraph (e) (appropriately modified for the identification of the parties), in each subcontract that—

(1) Exceeds the threshold specified in FAR 9.405-2(b) on the date of subcontract award; and

(2) Is not a subcontract for commercially available off-the-shelf items.

(End of clause)

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters.

(NOV 2025)

(a) The Contractor shall update the information in the Federal Awardee Performance and Integrity Information System (FAPIIS) on a semi-annual basis, throughout the life of the contract, by posting the required information in the System for Award Management via https://www.sam.gov.

(b) All information posted in FAPIIS on or after April 15, 2011, except past performance reviews, will be publicly available. FAPIIS consists of two segments—

(1) The non-public segment, into which Government officials and the Contractor post information, which can only be viewed by-

(i) Government personnel and authorized users performing business on behalf of the Government; or

(ii) The Contractor, when viewing data on itself; and

(2) The publicly-available segment, to which all data in the non-public segment of FAPIIS is automatically transferred after a waiting period of 14 calendar days, except for-

(i) Past performance reviews required by part 42.

(ii) Information that was entered prior to April 15, 2011; or

(iii) Information that is withdrawn during the 14-calendar-day waiting period by the Government official who posted it in accordance with paragraph (c)(1) of this clause.

(c) The Contractor will receive notification when the Government posts new information to the Contractor’s record.

(1) If the Contractor…