50310223R0005-0001.pdf

(x)

50310223R0005 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

WASHINGTON DC 20549

MAIL STOP 4226

SEC-OA - 03

100 F STREET NE

MISSION AND OPERATIONS SUPPORT BRANCH

OFFICE OF ACQUISITIONS

SECURITIES AND EXCHANGE COMMISSION

04/03/20230001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

04/03/2023

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to recognize revisions to the following sections as a result of questions received in response to the RFP.

1. Section C-2.2

2. Section C-2.3

3. Section C-7

4. Section L Instructions

Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

SELINA BANFIELD

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 36

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

50310223R0005/0001

Additionally, Attachment 3 is revised to include timely questions received and Government responses.

All other terms and conditions of the solicitation remain unchanged and in full force and effect.

Period of Performance: 07/01/2023 to 06/30/2024

Attachments:

Attachment 3: Questions and Responses, revised

4/10/2023

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

This page intentionally left blank

This page intentionally left blank

HOTLINE FOR THE ANONYMOUS OR CONFIDENTIAL REPORTING OF

COMPLAINTS

50310223R0005-0001

SECTION B – PRICES FOR SERVICES

PERFORMANCE PERIOD FFP/ Month FFP/ Year Base Period

Option Period 1 Option Period 2 Option Period 3 Option Period 4 Option Period 5 Option Period 6 Option Period 7 Option Period 8 Option Period 9

AGGREGATE PRICE

SECTION C – SCOPE OF WORK (SOW)

C-1 BACKGROUND

The U. S. Securities and Exchange Commission (“SEC”) Office of Inspector General (“OIG”) is responsible for investigating allegations of fraud, waste, and abuse involving agency programs and operations, and misconduct by agency employees or contractors. The SEC OIG requires a Contractor to operate and maintain its “Hotline” for the anonymous or confidential reporting of complaints.

C-2 SPECIFIC TASKS AND SERVICES REQUIRED

C-2.1 The Contractor shall operate and maintain both: (1) a toll-free number that can be called 24 hours a day, 365 days a year, to speak anonymously, or in confidence, with a trained Hotline operator; and, (2) a web-based system through which complaints may be made anonymously, or in confidence. The call operators shall take the caller information and record that information.

The telephone Hotline will use a message to be provided by the OIG to inform the caller of his/her options. The live operators and messages shall be in English, unless requested differently from the SEC OIG. Both the telephone and web-based complaints systems will be designated as the SEC OIG Hotline, through which agency employees and outside individuals may confidentially report fraud, waste, and abuse, as well as complaints of staff and contractor misconduct, to the OIG. Both the telephone operator call format and the web-based complaint form must be customized and tailored to meet the specific needs of the SEC OIG. In addition, incident codes used for the telephone and web-based complaint reports must adhere to the requirements of, and meet the approval of, the SEC OIG. The contractor shall also provide mechanisms by which persons contacting the Hotline can submit follow-up information pertaining to their complaints and by which the SEC OIG may provide responses to complainants.

C-2.2 Although the contractor is required to ensure availability 24/7, in the event the Contractor is handling simultaneous complaints, the Contractor shall be able to respond within four (4) hours to any messages (ie voicemail) and shall also obtain appropriate follow-up information concerning complaints received. Calls shall be answered within 5 rings. The Contractor shall provide timely reports in electronic form (within no more than 24 hours of receipt of a complaint) to the OIG’s Contracting Officer’s Representative (COR) and other designated representatives or e-mail addresses regarding all Hotline complaints (both telephone and web-based) received. The Contractor shall notify the OIG of any complaints categorized as urgent within one (1) hour of receipt of the complaint. Urgent calls may be defined as those inclusive of, but not limited to, threat to life and/or public safety. The Contractor shall provide monthly summaries of statistical data concerning Hotline complaints. The Contractor’s reports of Hotline complaints shall show, at minimum, the report number; date and time of the call or web-based complaint; the nature and subject of the complaint; details of the allegations; questions asked by the call center staff member (for telephone complaints); name, telephone number, mailing address, and e-mail address of the complainant, if provided upon request; the complainant’s preference on maintaining or waiving confidentiality; nature of any response given to the complainant; any follow-up performed, when the follow-up was completed; and other information identified by the SEC OIG. A sample template is required within five (5) days of the contract award date.

The Contractor shall segregate SEC OIG data entered into the Contractor’s system to ensure the data is isolated from other data contained in the data base. The call data shall be transferred to the SEC OIG using a secure method of communication as approved by the SEC OIG. The Contractor shall participate in virtual meetings, conference calls and/or on-site review meetings with SEC staff as requested during the period of performance.

C-2.3 The Contractor shall maintain a fully operational facility with staff who have executed SEC non-disclosure agreements if they are or will be handling SEC OIG complaints during the entire period of performance. The Contractor must be a U.S. vendor operating and performing all services within the Continental United States (CONUS). No services, at any time, shall be performed by the contractor or its staff outside of the CONUS.

C-2.4 The Contractor may be required to add, delete, or modify existing fields, which are considered minor adjustments, in the web-based complaint request form at no additional charge.

C-3. CONTRACTOR PERSONNEL

The Contractor shall provide qualified personnel in sufficient quantities, including operators, project management and support staff, to meet the requirements of this contract. The Contractor shall ensure confidentiality of data. The Contractor shall provide supervisory/management personnel required for effective project management. The Contractor shall verify United States citizenship for all personnel performing services under this Contract. The Contractor shall ensure that all telephone operators, supervisors, managers, and quality assurance personnel speak, read, and write English fluently.

The Contractor shall provide a running report of personnel assigned to render services against this contract. The report shall include the date the NDA was accomplished, training completion dates, and citizenship. Updates are required to be submitted to the COR(s) as personnel changes are made.

C-4 TRAINING

C-4.1 The Contractor shall provide an ongoing training program for its staff in administering the Hotline telephone and web services for the SEC OIG. The SEC OIG will provide information on SEC OIG specific requirements as necessary. The Contractor shall ensure immediate release from the assignment of any employee who does not successfully complete the training program.

C-4.2 The Contractor, in consultation with the SEC OIG, shall provide an initial briefing to SEC OIG staff on the telephone and web-based Hotline systems, including training on its procedures for notifying the SEC OIG of calls, including any urgent calls.

C-5 EQUIPMENT AND FACILITIES

The Contractor will provide all facilities and workspace for operation of the Hotline. The Contractor will also provide the telephone and computer equipment and services needed for operation of the Hotline, which includes furnishing the toll-free number and website. Any required maintenance of equipment shall not interfere with services. As such, there shall be no interruption of Hotline services via toll-free number or web form.

The contractor shall contact the COR for the purpose of transferring/relinquishing the toll-free number to the SEC within 15 days of contract expiration.

C-6. QUALITY CONTROL AND CUSTOMER SERVICE

C-6.1 The Contractor shall develop internal controls and procedures to identify performance problems and shall promptly resolve any identified problems. The contractor shall immediately notify the Contracting Officer’s Representatives (CORs) in writing of any and all issues that may impede satisfactory and uninterrupted services.

C-6.2 The Contractor shall have a supervisor and/or other qualified person monitor each telephone operator’s performance for quality assurance and appropriate coaching. Industry accepted customer service standards will be followed. The Contractor’s staff who do not meet acceptable customer service standards, as determined by the Contractor, shall be re-trained or released from the contract with the SEC.

C-7. RECORDS

All the records generated under the contract shall be SEC OIG’s property and shall be returned to the SEC OIG upon request or within 24 hours after termination/ expiration of the contract;

whichever comes first. Upon the government’s confirmation of receipt of the requested information, the contractor shall permanently remove/ delete all data from its system of records.

C-8. NON-PERSONAL SERVICES

C-8.1 This is not a personal services contract. The Government and the Contractor understand and agree that the services delivered by the Contractor to the Government are non-personal services. The parties also recognize and agree that no employer-employee or master-servant relationship exists or will exist between the Government and the Contractor. Contractor personnel are not employees of the Federal Government and are not eligible for entitlement and benefits given federal employees.

C-8.2 Contractor personnel under this contract shall not (i) be placed in a position where there is an appearance that they are employed by the Federal government, or are under the supervision, direction (other than the technical direction with respect to the tasks listed in Section C-2.1 – Requirements), or evaluation of a Federal employee, or (ii) be placed in a position of command, supervision, administration or control over Government personnel.

C-9 CONTRACT PRICING

Contract pricing shall be inclusive of all fully burdened costs that include but are not limited to all costs associated with- management, labor (direct and indirect), equipment, supplies, overhead, G&A, and profit.

This contract is subject to the Service Contract Act (SCA). As such, Offerors shall base pricing on the Wage Determination that is applicable to their locale. Since this the locale of the awardee is unknown, the applicable Wage Determination will be added to the contract prior to contract award.

SECTION D – SHIPPING

All contract deliverables shall be furnished in softcopy (electronic media) transmitted via e-mail to the COR and other designated representatives or e-mail addresses.

SECTION E – INSPECTION AND ACCEPTANCE

E-1 Clauses by Reference

FAR Reference Description Effective Date 52.246-4 Inspection of Services – Fixed-Price August 1996

Inspection of all services will be performed by the Contracting Officer’s Representative (COR) in accordance with FAR 52.246-4(e).

E-2 ACCEPTANCE CRITERIA

The COR shall review all deliverables for accuracy and completeness. The Contractor shall make those corrections required by the COR. The deliverables require acceptance by the COR.

General quality measures, as set forth below shall be applied to each deliverable product received from the Contractor under this SOW.

E-2.1 Accuracy: Deliverable products shall be accurate in presentation, technical content and adherence to accepted elements of style.

E-2.2 Clarity: Deliverable products shall be clear and concise; financial terms shall be used, as appropriate. All diagrams shall be easy to understand and be relevant to the supporting narrative.

E-2.3 File Editing: All text and diagrammatic files shall be editable by the SEC.

E-2.4 Format: Deliverable products shall be submitted in media defined by COR. Hard copy formats shall be in contractor format, unless otherwise specified by the COR.

E-2.5 Timeliness: Deliverable products shall be submitted on or before the due date specified in Section I.10.

E-2.6 Correction of Nonconformities.

If a deliverable fails to meet the relevant acceptance criteria (each such failure or deficiency is referred to as “nonconformity”), the SEC will provide written notification to the Contractor of such failure. Upon receiving such notice, the Contractor will take appropriate corrective action.

The corrected nonconformity will be redelivered to the SEC, which will then confirm in writing whether the redelivered deliverable conforms to and satisfies the applicable acceptance criteria.

The process described in this section may be repeated as necessary until all nonconformities are corrected and the deliverable conforms to and satisfies its acceptance criteria to meet the delivery dates specified in the task order.

SECTION F – PERFORMANCE AND DELIVERABLES

F-1 Clauses by Reference

52.242-17 Stop-Work Order April 1984

F-2 Period of Performance

Period Performance Dates Base Period July 1, 2023 – June 30, 2024 Option Period 1, if exercised July 1, 2024 – June 30, 2025 Option Period 2, if exercised July 1, 2025 – June 30, 2026 Option Period 3, if exercised July 1, 2026 – June 30, 2027 Option Period 4, if exercised July 1, 2027 – June 30, 2028 Option Period 5, if exercised July 1, 2028 – June 30, 2029 Option Period 6, if exercised July 1, 2029 – June 30, 2030 Option Period 7, if exercised July 1, 2030 – June 30, 2031 Option Period 8, if exercised July 1, 2031 – June 30, 2032 Option Period 9, if exercised July 1, 2032 – June 30, 2033

F-3 Schedule of Deliverables

SECTION Deliverable Schedule C-2.2 Contractor’s Fully Operational Call

Center and web-based complaint system By no later than 12 a.m.

June 1, 2023.

C-2.2 Individual Complaint Reports Transmitted within 24 hours or less of receipt by the Hotline (via telephone or the web site).

C-2.2 Individual Complaint Reports Categorized as Urgent

Transmitted within one (1) hour of receipt by the Hotline (via telephone or the web site).

C-2.2 Monthly Summary Reports Five days after end of the previous month.

C-2.2 Monthly Summary Report Template Five days after contract award.

C.3 Personnel List Within 5 days of contract’s start date and along with monthly summary reports

C-4 NDAs and training certificates As required C-4.2 Briefing of contractor’s telephone and web-based Hotline systems, including procedures for notifying SEC OIG of calls, including urgent calls

Five days after contract award.

C-5 Contact COR for instructions on transferring the toll-free number

Within 15 days of contract expiration

I Notice of Request for Equitable Adjustment (REA) (see FAR 52.222-43)

Annually, NLT 30 days after new Wage

Determinations are incorporated, as needed

F-4 DELIVERABLES FORMAT

All deliverables shall be compatible using the Microsoft Office Suite including MS-Word, MS- Excel, MS-Project and MS-PowerPoint. Flow charts and other diagrams included in the deliverables should be developed using Visio Professional 2000 software.

F-5 MAINTENANCE OF DELIVERABLES

(1) Personnel list, NDAs, and training certificates are to be maintained by the COR within eFile.

(2) If and when applicable, any notices of REAs are to be maintained by the CO along with the respective modification in eFile.

(3) All other deliverables are to be maintained by the COR, as needed, outside of the contract files.

SECTION G – CONTRACT ADMINISTRATIVE DATA

G-1 Contract Management: This Order will be administered by the following Contracting Officer. Please note that only telephonic and electric correspondence is being accepted.

U.S. Securities and Exchange Commission Office of Acquisitions Attn: Selina Banfield, Contracting Officer Phone: 202-551-3734 E-mail: BanfieldS@sec.gov

G-2 (5003.05) SUBMISSION OF INVOICES - DELPHI EINVOICING SYSTEM

(JANUARY 2022)

a. The Securities and Exchange Commission (SEC) will only accept electronic invoices submitted through the Delphi eInvoicing system on a MONTHLY BASIS.

b. Payment system registration. All persons accessing the Delphi eInvoicing web-portal will be required to have their own unique user Delphi eInvoicing ID and password and be credentialed through login.gov.

(1) Electronic authentication. See www.login.gov for instructions. Click on the following link for instructions on establishing a login.gov account: https://login.gov/help/creating-an-account/how-do-i-create-an-account-with-logingov/.

http://www.login.gov/ https://login.gov/help/creating-an-account/how-do-i-create-an-account-with-logingov/ https://login.gov/help/creating-an-account/how-do-i-create-an-account-with-logingov/

(2) To create a login.gov account, the user will need a valid email address and a working phone number. The user will create a password and then login.gov will reply with an email confirming the email address.

(3) In order to set up a new user account or make changes to existing vendor Delphi eInvoice users who will submit invoices through the eInvoicing web-portal for payment and tracking purposes, notify iSupplier@sec.gov and include the contract/order number, the user's full name, valid email address (group mailboxes are not recommended), and current phone number of all vendor users. Vendor users will be notified via e-mail when the account is created. The vendor user will be provided detailed instructions for logging into their Delphi eInvoicing account.

(4) Training on Delphi. To facilitate use of DELPHI, comprehensive user information is available at http://einvoice.esc.gov

(5) Account Management. Vendors are responsible to contact the Delphi Help Desk when their firm's points of contacts will no longer be submitting invoices so they can be removed from the system. Instructions for contacting the Delphi Help Desk can be found at http://einvoice.esc.gov

c. Contractors are cautioned against submitting an invoice prior to goods and services being received/accepted. Invoices submitted prematurely may be rejected. Software license maintenance and subscriptions may be invoiced at the beginning of the contract period of performance.

d. The SEC's Delphi eInvoicing system is managed by the Enterprise Services Center (ESC). In order to receive payment and in accordance with the Prompt Payment Act, all invoices submitted as attachments in the Delphi eInvoicing web-portal shall contain the following:

(1) Company logo or letterhead

(2) Company name and payment address

(3) Company Point of Contact (POC) for the invoice with phone and e-mail

(4) Invoice number and invoice date

(5) Billing period

(6) SEC Contract number

(7) Task/Delivery Order number (if applicable)

(8) SEC Contracting Officer's Representative (COR name)

(9) Amount billed (by CLIN), current and cumulative

(10) Total amount billed this period

(11) Cumulative total billed to date

(12) Brief Description of Services Performed - General description only

e. If the contract includes allowances for travel, all invoices which include charges pertaining to travel expenses will catalog a breakdown of reimbursable expenses with the appropriate receipts to substantiate the travel expenses.

mailto:iSupplier@sec.gov http://einvoice.esc.gov/ http://einvoice.esc.gov/

G-3 (SEC 5004.00) APPOINTMENT OF CONTRACTING OFFICER’S

REPRESENTATIVE (COR) (JANUARY 2022)

a. A Securities and Exchange Commission COR has been designated for administration and information relating to this contract. The SEC may also assign one or more Alternate CORs for this contract. The COR may not re-delegate his or her authority; only the CO has this authority. A COR Appointment Letter (and ACOR Appointment Letter if applicable) detailing the designations will be e-mailed to the contractor.

b. The COR will manage the contract in coordination with the CO and within the terms of the contract. The COR’s responsibilities include reviewing invoices and charges by the Contractor, informing the CO of areas where exceptions are taken, and accepting or rejecting invoices in the SEC’s financial system. The COR shall be the primary point of contact responsible for communicating administrative guidance for on-boarding and off-boarding of Contractor Personnel, mandatory trainings, government closures, and other events as necessary. Unless otherwise specified in this contract, inspection and acceptance of supplies and/or services to be furnished under this contract will be performed by the COR.

b. Only the CO has the authority to change the terms and conditions of this contract. The COR may request a contract modification, but the CO will make the final determination. The COR may not agree to or issue a change to the contract terms and conditions. In the event the Contractor effects changes to the contract at the direction of any person other than the CO, the changes will be considered to have been made without any authority and no adjustments will be made to the contract.

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H-1 (SEC 6001.00) SEC NON-DISCLOSURE REQUIREMENTS AND AGREEMENTS

(AUGUST 2022)

a. Required non-disclosure agreements are attached and must be completed and returned to the Contracting Officer before starting work under this contract.

b. Provisions of the SEC Regulation Concerning Conduct of Members and Employees and Former Members and Employees of the Commission expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. See 17 C.F .R. § 200.7353(b)(1) & (b)(2). The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by the provisions of Sections 200.735-3(b)(1) and 200.735-3(b)(2) of the SEC's Regulation Concerning Conduct and the terms set forth in the attached non-disclosure agreements (Attachments 1& 2). For purposes of this clause, “confidential or non-public information,” is defined as information generated by or in the possession of the SEC that is commercially valuable, trade secret, market sensitive, proprietary, related to an SEC enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed confidential or non-public by an SEC division director or office head, and is not otherwise available to the public.

c. An officer or executive authorized to bind the Contractor shall execute the non-disclosure agreement (Attachment 1) on behalf of the Contractor and return it to the Contracting Officer prior to the Contractor commencing work on the contract. The Contractor shall submit to the Contracting Officer a list of its employees, agents, and subcontractors that will be authorized access to SEC information by virtue of performing the requirements set forth in this contract. Each person identified on the list shall then sign the non-disclosure agreement on behalf of themselves (Attachment 2) and submit it to the Contracting Officer before commencing work on the contract.

d. The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to the terms of the non-disclosure agreement, protecting all confidential or non-public information, and to not divulge to any unauthorized person. Assignment of staff who has not executed the non-disclosure agreement or failure to adhere to this statement shall result in action by the Contracting Officer, as deemed appropriate. Violation of this clause or the attached non-disclosure agreements by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or civil suits and/or criminal prosecution.

H-2 (SEC 6001.01) RESTRICTIONS ON USE, DISCLOSURE, AND DUPLICATION OF

CONFIDENTIAL AND NON-PUBLIC INFORMATION (JANUARY 2022)

Confidential or non-public information, for purposes of this clause, includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential or non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non-public information, in whole or in part, outside the Securities and Exchange Commission (SEC) for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

H-3 (SEC 6002.00) TYPE OF CONTRACT (JANUARY 2022)

This is a firm-fixed-price (FFP) type contract.

H-4 (SEC 6004.00) APPROVAL OF SUBCONTRACTS (JANUARY 2022)

The Contractor shall not enter into a contractual agreement with any party to furnish any of the work or services under this contract/agreement without the written approval of the Contracting Officer. This provision shall not be interpreted as requiring the approval of contracts for employment between the contractor and personnel assigned for services thereunder.

H-5 (SEC 6012.02) SEC SECTION 508 REQUIREMENTS (JANUARY 2022)

a. Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all Information and Communication Technology (ICT) products and services developed, acquired, maintained, and/or used under this contract/order must comply with the Information and Communication Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in FAR 39.203(a). The complete text of Section 508 Final Provisions can be accessed at Section 508 Law.

b. All ICT products must comply with the following requirements. Descriptions of the requirements are viewable at the link Section 508 Standards.

c. Offerors that fail to demonstrate compliance with the above requirements, may be eliminated from further consideration for award.

d. The offeror shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility requirements at 36 CFR 1194 using a Voluntary Product Accessibility Template (VPAT 2.4). Further, the solicitation response must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location).

e. Offerors to this solicitation must provide any additional detailed information necessary for determining applicable Section 508 standards conformance. If an offeror claims its products and/or services, including ICT deliverables such as electronic documents, web content or electronic reports, meet applicable Section 508 standards, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility, remediation of the products and/or services to the level of conformance specified in the contract will be the responsibility of the offeror at its expense.

All web sites and applications have to be compliant with Section 508.

H-6 (SEC 6017.01) COMMUNICATING BY EMAIL AND/OR FILE SHARING

NONPUBLIC INFORMATION, CUI, SBU, AND PII FOR CP WITHOUT NETWORK

ACCESS (JANUARY 2022)

a. This Instruction encompasses Contractors’ duties regarding communications involving all of the follow types of information: Nonpublic Information, Controlled Unclassified Information (CUI), Sensitive But Unclassified (SBU) information, and Personally Identifiable Information (PII). Definitions of these types of information are provided at https://www.govinfo.gov/content/pkg/USCODE-2011-title29/html/USCODE-2011-title29-chap16-subchapV-sec794d.htm https://www.access-board.gov/ https://www.access-board.gov/ https://www.acquisition.gov/content/39203-applicability https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/corrections-to-the-ict-final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.itic.org/policy/accessibility/vpat

SECR 23-2 and in other applicable federal guidance and are subject to change as needed to conform to changes in federal law. PII is defined in the E-Government Act of 2002 and related Office of Management and Budget (OMB) memoranda as information that could be used to distinguish or trace an individual’s identity, such as a person’s name, Social Security number, date and place of birth, mother’s maiden name and biometric records.

b. When communicating the above types of information via email, during the period of this contract, the Contractor shall submit all such communications using Zixmail. This is an SEC-approved external, secure service that encrypts outgoing messages, decrypts and validates incoming messages, and authenticates both the sender's and recipient's e-mail identities. The Contractor shall use the following instructions for using Zixmail:*

a. Login at U.S. Securities and Exchange Commission Secure Email Password Authorization

b. View message under the “Inbox” tab or create and send new messages from the “Compose” tab.

c. Messages are created and sent similarly to a typical e-mail messaging system and include: Recipients, CC, subject line, body and attachments.

d. *Notes: The Contractor must register a new account first at U.S. Securities and Exchange Commission Secure Email Password Authorization prior to reading or sending encrypted messages. The Contractor will be provided with a link to create an account the first time you send them an encrypted message. This link will also be used by the Contractor subsequently to read and compose messages. The Contractor can only send encrypted e-mail messages from the ZixMail portal to SEC employees. All e-mail contents, including attachments, are encrypted when sent using this method.

c. For larger transmissions of information, Contractors shall use Accellion secure filing sharing programs as permitted by the Office of Information Technology.

H-7 (SEC 6018.00) CONTRACTOR PERFORMANCE EVALUATION (JANUARY 2022)

a. In accordance with FAR 42.1502, the SEC will submit an electronic record of the Contractor’s performance to the Contractor Performance Assessment Reporting System (CPARS) for processing at least annually and at the time the work under a contract or order is completed.

b. The Contractor’s information for CPARS is pulled from the Contractor’s entry in SAM under the Past Performance Point of Contact for the company.

c. The Contractor’s designated representative will have the ability to review, comment, and state whether or not the Contractor agrees with the evaluation and return the evaluation to the Contracting Officer (CO) per FAR 42.1503. The SEC’s evaluation will be available to search in CPARS after 14 calendar days for Government use in evaluating the Contractor’s past performance as part of a source selection action.

https://web1.zixmail.net/s/login?b=sec https://web1.zixmail.net/s/login?b=sec https://web1.zixmail.net/s/login?b=sec https://web1.zixmail.net/s/login?b=sec

d. If the Contractor desires a meeting to discuss the evaluation, it must be requested, in writing to the CO, no later than seven calendar days from the receipt of the evaluation.

It shall be the sole responsibility of the Contractor to inform the CO or COR in writing of any changes to the Contractor’s designated representative. Any such changes do not require a modification to the terms and conditions of the contract/order.

H-8 (SEC 6019.02) MANDATORY TRAINING REQUIREMENTS FOR CERTAIN

OFFSITE CONTRACTORS (JANUARY 2022)

(a) Contractor employees, agents, subcontractor personnel and sole proprietors (collectively, "Contractor Personnel") shall complete the following initial mandatory training before starting work on an SEC contract: Protecting SEC Nonpublic Information Training for Certain Offsite Contractors

(b) Contractor Personnel shall complete initial mandatory training before starting work on the contract and annual refresher mandatory training. For contracts awarded prior to the effective date of this clause, contractor personnel shall comply with the requirements herein within 45 days of incorporating into the contract.

(c) All Contractor Personnel who have met the mandatory training requirement within the past 12 months are not required to retake the training, but must forward the LEAP training certificate to the Contracting Officer (CO) and Contracting Officer’s Representative (COR) before starting work on a new SEC contract.

(d) IT Security Training may be required whenever there is a significant change in the SEC information system environment or procedures or when Contractor Personnel requires additional role-specific training in accordance with 5 CFR 930.301(5)(d).

(e) The Contractor shall ensure that all Contractor Personnel assigned to perform the requirements set forth in this contract, timely complete all mandatory training requirements and comply with the provisions in those trainings. A reference copy of Protecting SEC Nonpublic Information Training for Certain Offsite Contractors is provided via contract attachment.

(f) Contractors are entitled to invoice for the actual time spent by Contractor Personnel completing required training after award, not to exceed .5 hours per training per Contractor Personnel.

(g) Online Access to Mandatory Training - Expert Services Personnel Before starting work on the SEC contract, Contractor Personnel performing expert services will access the Protecting SEC Nonpublic Information Training for Offsite Contractors online training course through SEC’s LEAP Extended Portal, an online learning management system.

(h) You will not be permitted to start work until you complete the training course.

(1) If you have worked on other SEC contract(s) and completed the Protecting SEC Nonpublic Information Training for Offsite Contractors within the past 12 months, you may be current on the mandatory training requirement. Forward the LEAP training certificate to the CO and COR before following the instructions in the next paragraph.

(2) To access the Protecting SEC Nonpublic Information Training for Offsite Contractors, you must first self-register for an account in the SEC’s LEAP Extended portal. The COR will provide instructions on how to self- register. In certain circumstances, the COR may direct you to follow a manual process to complete the training instead.

(i) Manual Access to Mandatory Training – Other Contractor Personnel

(1) For all other Contractor Personnel without access to the SEC’s LEAP Extended Portal, or if the required content is otherwise unavailable through LEAP Extended Portal, or otherwise at the direction of the COR, Contractor Personnel shall complete the Protecting SEC Nonpublic Information Training for Offsite Contractors provided in this contract.

Sign and return the attestation page through your company to the COR prior to starting work on the contract.

(2) Contractor Personnel must take Protecting SEC Nonpublic Information refresher training annually in order to continue working on the contract.

H-9 (SEC 6020.00) CONTRACTOR WORKFORCE INCLUSION (JANUARY 2022)

a. The Contractor confirms its commitment to equal opportunity in employment and contracting, and that it shall ensure, to the maximum extent possible and consistent with applicable law, the fair inclusion of minorities and women in its workforce.

b. The Contractor shall insert the substance of this contract standard in each subcontract for services awarded for performance of this contract with a dollar value of $100,000 or more.

c. Within ten (10) business days of a written request from the Director of the Commission’s Office of Minority and Women Inclusion (OMWI Director) or designee, or such longer time as the OMWI Director or designee determines, and without any additional consideration, action or authorization required from the OMWI Director, the Contractor shall provide documentation, satisfactory to the OMWI Director, of the actions it has undertaken (and as applicable, the actions each covered subcontractor under the contract has undertaken) to demonstrate its good faith efforts to comply with the aforementioned provisions.

d. For purposes of this contract, “good faith efforts” shall include actions by the Contractor (and as applicable, actions by each covered subcontractor under the Service Contract) to identify and, if present, remove barriers to minority and women employment or expansion of employment opportunities for minorities and women within its workforce. Efforts to remove such barriers may include, but are not limited to, recruiting to ensure that applicant pools include minorities and women, providing job-related training, or other activity that could lead to removing such barriers.

e. The documentation requested by the OMWI Director or designee to demonstrate good faith efforts may include, but is not limited to, one or more of the following:

1. The total number of Contractor’s employees, and the number of employees by race, ethnicity, gender, and job title or EEO-1 Report job category (e.g., EEO-1 Report(s));

2. A list of covered subcontract awards for services under the contract, and for each covered subcontract award, the dollar amount, date of award, and the subcontractor’s race, ethnicity, and/or gender ownership status;

3. The contractor’s plan for ensuring the fair inclusion of minorities and women in its workforce, including outreach efforts; and

4. For each covered subcontractor, the documentation specified in paragraphs 1. and 3.

above.

f. Consistent with Section 342(c)(3) of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), 12 U.S.C. 5452(c)(3), a Contractor’s failure to demonstrate to the OMWI Director that it has made good faith efforts to include minorities and women in its workforce (and as applicable, failure to demonstrate that its subcontractor(s) has made such good faith efforts) may result in termination of the contract for default after the contractor is provided written notice and an opportunity to cure the failure in accordance with the procedures set forth in FAR Subpart 49.402-3(d), other contractual remedies, referral to the Office of Federal Contract Compliance Programs (OFCCP), or other appropriate action.

g. Compliance with this standard does not necessarily satisfy the requirements of EO 11246, as amended, nor does it preclude OFCCP compliance evaluations and/or enforcement actions undertaken pursuant to that Executive Order, or demonstrate compliance with other FAR clauses that may be included in this contract.

H-10 (SEC 6023.01) U.S. CITIZENSHIP FOR NON-IT SERVICES (JANUARY 2022)

Only U.S. citizens may perform work under this contract or agreement. The contractor shall include this language in all subcontracts at any tier.

SECTION I – CONTRACT CLAUSES

Provisions and Clauses by Reference http://www.gpo.gov/fdsys/granule/USCODE-2011-title12/USCODE-2011-title12-chap53-subchapIII-partC-sec5452 https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2049_4.html#wp1083185 http://www.dol.gov/ofccp/ http://www.dol.gov/ofccp/ http://www.dol.gov/compliance/laws/comp-eeo.htm

The solicitation contains the following provisions (P) and clauses, by reference. Provisions will be removed prior to contract award.

FAR Reference Description Effective Date 52.202-1 Definitions June 2020 52.203-3 Gratuities April 1984 52.203-6 Restrictions on Subcontractor Sales to the Government June 2020

52.203-6 Alt 1 Nov 2021 52.203-12 Limitations on Payments to Influence

Certain Federal Transactions June 2020

52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights

June 2020

52.204-4 Printed or Copied Double-Sided on Post Consumer Fiber Content Paper

May 2011

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements

January 2017

52.204-10 Executive Compensation and First-Tier Subcontract Awards

June 2020

52.204-13 System for Award Management Maintenance

October 2018

52.204-14 Service Contract Reporting Requirements

October 2016

(P)52.204-16 Commercial and Government Entity Code Reporting.

August 2020

(P)52.204-18 Commercial and Government Entity Code Maintenance

August 2020

52.204-19 Incorporation by Reference of Representations and Certifications

December 2014

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities

November 2021

52.204-25 Telecommunications and Video Surveillance Services or Equipment

November 2021

52.209-6 Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment

November 2021

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters

October 2018

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations

November 2015 https://www.acquisition.gov/node/31797 https://www.acquisition.gov/node/31797 https://www.acquisition.gov/node/31798

(P) 52.212-1 Instructions March 2023 52.212-4 Contract Terms and Conditions

Commercial Products and Commercial Services

December 2022

52.217-8 Option to Extend Services November 1999 52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns October 2022

52.222-41 Service Contract Labor Standards August 2018 52.222-43 Fair Labor Standards Act and Service

Contract Labor Standards- Price Adjustment (Multiple Year and Option Contracts)

August 2018

52.232-1 Payments April 1984 52.233-1 Disputes May 2014 52.233-3 Protest after Award August 1996 52.233-4 Applicable Law for Breach of Contract

Claim October 2004

Provisions and Clauses by Full Text

The solicitation contains the following provisions (P) and clauses, by full text. Provisions will be removed prior to contract award.

52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Nov 2021)

(a) Definitions. As used in this clause—

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information ( 44 U.S.C.

3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders – Commercial Products and commercial…