50310223R0019 Amendment 0002 SIGNED.pdf

(x)

50310223R0019 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

WASHINGTON DC 20549

MAIL STOP 4226

SEC-OA - 03

100 F STREET NE

MISSION AND OPERATIONS SUPPORT BRANCH

OFFICE OF ACQUISITIONS

SECURITIES AND EXCHANGE COMMISSION

09/06/20230002

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

07/21/2023

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Services in support of the Lost and Stolen Securities Program (LSSP). The purpose of this

Amendment 0002 is to:

1. Update the Statement of Work Background to change quarterly to semi-annual for the collection of usage fees.

2. Update RFP instructions paragraph C. Volume III - Factor 3 Price Proposal (Fee, Fee Collection Approach/Fee Structure, Fee Schedule) to clarify how billing and invoicing in the Offeror's approach shall be proposed. (Changes are highlighted in turquoise in the document.)

3. Included for the second time, is the prospective Offerors' questions and the Government's answers document. The Government's associated LSSP Q and A attachment was not Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

CONSUELA L. GINN

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 90

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

50310223R0019/0002 changed and was already provided via Amendment

0001. The Questions and Answers document is being provided again because there is one question and answer, highlighted in turquoise in the questions and answers document regarding billing and invoicing that was not answered via

Amendment 0001; therefore, as promised in

Amendment 0001, the answer to that question is being provided via this Amendment.

4. The proposal due date and time remain unchanged as September 22, 2023, 10:00AM ET.

5. All other terms and conditions remain unchanged.

ATTACHMENTS:

*LSSP QUESTIONS AND ANSWERS 50310223R0019

AMENDMENT 0002

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

50310223R0019 AMENDMENT 0002 Page 4 of 89

Lost and Stolen Securities Program (LSSP) 50310223R0019

SECTION B – FEE SCHEDULE (TO BE INCORPORATED AT TIME OF AWARD)

SECTION C – STATEMENT OF WORK (SOW)/SCOPE OF WORK

1. BACKGROUND

The U.S. Securities and Exchange Commission (“SEC”) is an independent federal agency established pursuant to the Securities Exchange Act of 1934. The mission of the SEC is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. The SEC is charged with primary responsibility for enforcing the federal securities laws and regulating the securities industry, the nation’s stock and options exchanges, and other electronic securities markets in the United States. It is headed by a bipartisan, five-member Commission consisting of a Chair and four Commissioners who are appointed by the President and confirmed by the Senate. The agency’s approximately 4,500 staff members are organized into 6 divisions and 25 offices located in the Washington, DC, headquarters office and 11 regional offices throughout the country.

Section 17(f)(1) of the Securities Exchange Act of 1934 was enacted by Congress in 1975 as part of the Securities Exchange Act Amendments. The statute, and Exchange Act Rule 17f-1 thereunder (17 CFR 240.17f-1), established a program to curtail trafficking in lost, stolen, missing, and counterfeit securities, called the Lost and Stolen Securities Program, or “LSSP.” Generally, Section 17(f)(1) and Rule 17f-1 thereunder require reporting institutions, which include banks, clearing agencies, exchanges, broker-dealers, and transfer agents, to report securities certificates that they discover to be missing, lost, stolen, or counterfeit, and, with some exceptions, inquire about securities certificates that come into their possession to determine whether they have been reported as missing, lost, stolen, or counterfeit. The requirements are intended to help reduce trafficking in illicit securities by identifying and tracking missing, lost, stolen, and counterfeit securities certificates and making that information available to the financial institutions and market participants that might come into contact with them.

The statute gave the SEC the option to operate the LSSP itself, or to designate an entity to operate the LSSP on the SEC’s behalf. The SEC made the determination to award a contract to a Contractor to operate the LSSP on its behalf, and that entity and its successors have operated the LSSP since the onset of the program in 1977.

At a high level, the LSSP is a computer-assisted system through which reporting institutions perform the two basic functions required under Rule 17f-1: submitting reports of missing, lost, stolen, or counterfeit securities certificates on SEC Form X-17f-1A (Attachment 3), and inquiring about securities certificates that come into their possession to determine whether they have been reported as missing, lost, stolen, or counterfeit. If an https://www.govinfo.gov/content/pkg/COMPS-1885/pdf/COMPS-1885.pdf

50310223R0019 AMENDMENT 0002 Page 5 of 89 inquiry matches a previously reported certificate, both the inquiring participant and the original reporting participant will receive a confirmation. The LSSP also allows reporting institutions to report when the status of a previously reported certificate changes (e.g., a missing certificate is later found) and to submit certain other permissive reports and inquiries.

When reporting institutions register for access to the LSSP, they choose between two types of access: direct and indirect. Reporting institutions that register for direct access are called Direct Inquirers; those that register for indirect access are called Indirect Inquirers.

All reporting institutions, including both Direct Inquirers and Indirect Inquirers, must submit their own reports of missing, lost, stolen or counterfeit securities. However, only Direct Inquirers submit inquiries to the LSSP. Indirect Inquirers do not submit their own inquiries but rather enter into an agreement with a Direct Inquirer to submit inquiries on their behalf (which agreement would be separate from and outside the scope of the LSSP).

Since its inception, the SEC’s Contractor has operated the LSSP at no-cost to the SEC. The Contractor shall fund the operations of the LSSP through the collection of usage fees from Direct Inquirers, which are assessed on a semi-annual (twice a year) basis based on total usage of the LSSP during the relevant period and the type and size of reporting institution.

Exchange Act Release No. 34-15289 (Attachment 4) defines the specifics of the billing structure for the program and the different categories of direct inquirers and their relative sizes. Indirect Inquirers do not pay usage fees directly to the SEC’s Contractor but may be obligated to compensate the Direct Inquirer pursuant to its agreement with a Direct Inquirer to submit inquiries on its behalf.

As of May 05, 2023, the LSSP includes the following metrics:

• Storage of approximately 37 million certificates reported as lost, stolen, missing, or counterfeit.

• Approximately 331 direct inquirers registered (note: ~9,500 indirect inquirers).

• 231,039 certificates reported as lost, stolen, missing, or counterfeit each year.

2. OBJECTIVES

The SEC is soliciting a Contractor to transition/transfer, build, obtain authorization to operate, implement, operate, and ensure the continuous operation of the LSSP, in compliance with Section 17(f)(1) and Exchange Act Rule 17f-1. The LSSP shall be implemented and operated as a No-Cost contract funded by usage fees collected from reporting institutions. Sections 3 and 4 below outline a non-exhaustive list of requirements that the Offeror must meet. See Attachment 5 for additional requirements.

3. SCOPE

The following subsections describe the requirements for the design, development, testing, implementation, operation, maintenance, and improvement of the LSSP.

50310223R0019 AMENDMENT 0002 Page 6 of 89

3.1. HIGH LEVEL REQUIREMENTS

The Contractor shall design, develop, test, implement, operate, and maintain and/or improve the software for a computerized database of missing, lost, stolen, and counterfeit securities.

The Contractor shall process inquiries from reporting institutions concerning the data captured and stored in the database.

The system shall accommodate all reporting institutions pursuant to Securities Exchange Act Rule 17f-1 [17 CFR 240.17f-1], and related releases, regardless of their size, geographic location, and frequency of contact with the system.

The contractor shall make sure that there is continuity in service including the transition of the currently established listing of lost and stolen securities, and associated reporters and inquirers, as applicable.

3.2. Establish Participant Registration

This Statement of Work includes work to establish LSSP Participant registration processes.

If a new contractor is selected, in addition to transitioning Participant registration information from the Incumbent, the new contractor will need to establish and communicate processes for Participant registration on the public facing LSSP website.

Instructions need to inform institutions, first to obtain a Financial Industry Numbering Standard (FINS) number by going to the Depository Trust and Clearing Corporation (DTCC) website and following the instructions for requesting a FINS number. Second, instructions also need to guide Participants and prospective Participants to the “Registration Form [for the] Lost and Stolen Securities Program” (OMB Number 3235-0032) and shall describe the differences between Direct and Indirect Inquirers. Finally, instructions need to explain how Participants may submit completed Registration Forms to LSSP.

The Contractor will assist Participants with the registration process, collect and process registrations, and store Participant registration information. In addition, the Contractor will use Participant registration information in determining twice-annual billing by tracking aggregate usage metrics by direct inquirers and using them to determine the fees that participants pay, consistent with Exchange Act Release No. 34-15289 (Lost and Stolen Securities Program, Extension of the Pilot Period; Redesignation of Securities Information Center, Inc.; Reregistration of Certain Institutions, Release No. 34-15289, 43 Fed. Reg.

52418 (1978)). The LSSP website shall be available/provided, at minimum, during regular US market hours (ideally 24/7, except for short periods of downtime for maintenance or upgrades). LSSP website shall go through continuous, incremental improvement as a guard against cybersecurity threats and technological obsolescence, among other factors. The website shall make it easy to find the following information: an LSSP email address, a LSSP contract phone number, fax number, contact list, and Frequently Asked Questions section.

50310223R0019 AMENDMENT 0002 Page 7 of 89

3.3. Establish and Support User-centric Functions

LSSP system shall provide the following high level user centric functionality for participants reporting of SEC Form X-17f-1A:

Reporting: The Contractor shall provide Reporting functionality so All Participants (aka reporting institutions, including registered transfer agents, brokers, dealers, federally insured banks, and, among others) who are required by rule to Report missing, lost, stolen, counterfeit, and recovered securities in a standardized format to the Program can comply with SEC X-17-F. The information from each report shall be stored in a database that is searchable and can be queried.

Inquiring: The Contractor shall provide functionality for the Participants to “Inquire and determine if certain securities certificates being presented to them have been reported as missing, lost, stolen or counterfeited. When Participant Inquiries match any report on the database, the Program (i) Shall provide the inquirer with information about the Participant that submitted the reported security and (ii) notify the Participant that reported it. The system shall have mechanism to let the inquirer and participant know if there was a match up to 30 days after initial inquiry.

SEC Access: Specific roles in SEC shall have read-only access to the LSSP system and its related data.

CUSIP and FINS Changes: Corporate events may result in CUSIP number changes for securities that are already part of the reported securities. Transfer agent successions may result in FINS changes for reported securities. The LSSP Program shall support CUSIP number changes and/or FINS changes associated with the reported securities. The Contractor shall ingest related data feeds from DTC or other relevant sources.

3.4. Reporting to the SEC

3.4.1. Programmatic Reporting

The Contractor shall provide the Commission with a Monthly Activity Report, which shall be provided on a monthly basis no later than the 15th day of the month, and shall include the number of Reports, Inquiries, and CUSIP Changes for the immediately preceding month. The Contractor shall also provide on an annual basis, no later than April 30, an annual financial report for the preceding year that specifies the fees received from Reporting Institutions (Annual Financial Report).

3.4.2. System Security Reporting

50310223R0019 AMENDMENT 0002 Page 8 of 89

The Contractor shall fully cooperate with any risk analysis or other evaluation of the system conducted by the SEC or its representatives, including any evaluation of the Program under the SEC’s Security Assessment & Compliance Branch, which includes undergoing an independent audit or risk analysis by the SEC or by a third-party organization approved by the SEC, with such audits occurring no less than once every three years (with corresponding artifacts such as the Plan of Actions and Milestones (POA&M), Security Control Report, System Security Plan). Such evaluations, risk analyses, or audits include security tests on the Contractor’s devices and the review of the Contractor’s own policies, procedures, security scans, tests, or reviews, which the Contractor shall provide to the SEC. The Contractor shall make good faith efforts to remediate any vulnerabilities, issues, or negative findings as a result of any such audit, review, or risk analysis (Vulnerability Scanning and Penetration).

4. SPECIFIC TASKS

4.1. Productionized System

This Statement of Work includes work associated with the delivery of LSSP solution areas as defined in Section 3.1, including registration, tracking, and inquiry of all lost, stolen, or misplaced securities. The task requirement is to establish system requirements (or user stories), design, build, and go-live with the system, in compliance with Rule 17f-1, this contract, and established software delivery life cycles. Further, to conduct operations and maintenance activities on the LSSP system. Finally, to have a roadmap that guides future improvements that enable user-centric implementation and mitigate systematic risks such as from cybersecurity or technological obsolescence.

4.2. Core Architectural Components

Implementing user-centric design, the following shall be key architectural aspects (and two optional items) made available to the inquirers, to the reporters, and to SEC (as defined in this contract).

Secure Web Portal: A secure, browser-based, responsive, intuitive, and user-centric interface for participants. An interface that allows participants to submit new reports and updates to existing reports to the LSSP. An interface that also allows Direct Inquirers to submit inquiries into reported securities and view inquiry results.

Secure Admin Web Portal: A secure, browser-based interface for LSSP staff to support participants.

General Services: LSSP system services that support reports in compliance with Form X- 17f-1A, inquiries, and participant billing, and associated tracking of each service.

Program Website: A publicly available browser-based website, with a registered DNS, 50310223R0019 AMENDMENT 0002 Page 9 of 89 with information about the LSSP. Content of the site needs to include, at a minimum, details about the LSSP program, general LSSP use instructions, information for contracting your LSSP program staff, and participant registration instructions.

Database: The LSSP database must store participant filing and other transaction data, include hardware encryption, and encryption for data at rest and in transit. Tables shall store details to reports, recoveries, inquiry transactions and results, participant registration, direct user participant usage, and objects.

Secure File Transfer (Optional) – Supplemental to Exchange Act Rule 17f-1, the Commission suggests to the Contractor considerations for LSSP system solutions that further facilitate the reporting and inquiring needs of participants. One such area the Contractor may consider is the hosting of a Secure File Transfer solution that allow participants to submit reports and inquiries via CSV file uploads.

Secure Web Services (Optional) – Another supplemental solution, suggested by the Commission to the Contractor, is to facilitate the reporting and inquiring needs of participants through secure web services. If Secure Web Services are used the Contractor shall follow federal governance of NIST SP 800-95, Guide to Secure Web Services, Aug 2007.

4.3. Information Technology Compliance Activities

4.3.1. Information Technology Requirements

4.3.1.1. System Security, Backup, and Recovery Procedures

In support of system security and backup and recovery procedures the Contractor shall:

4.3.1.1.1. Provide for real-time intrusion detection, prevention, and mitigation

4.3.1.1.1.1. Notify the SEC COR immediately in the event of a significant system failure and provide details on the nature of the failure, restorative options, and likely period for restoration. The Contractor shall use reasonable efforts to restore the LSSP system within 48 hours of detection of a system failure.

4.3.1.1.1.2. Protect all communications between all users and LSSP system that are conducted over the Internet or other public network. The system controls a secured session in response to a remote user’s successful login and shall maintain a secure interface until the session ends.

4.3.1.1.1.3. Assure that security procedures are in place to prevent unauthorized additions, modifications, or deletions of any LSSP system data. The Contractor shall employ system access controls to prevent unauthorized use of the system. As part of the system access controls, the Contractor shall require individual users to identify themselves uniquely to the system. Users shall be assigned access only to the data and computer system as required to

50310223R0019 AMENDMENT 0002 Page 10 of 89 perform their job and shall not be allowed to modify or delete any information. Update and delete privileges shall be restricted to the Contractor's designated database administrator.

4.3.1.1.1.4. Conform to the SEC’s security controls and protocols.

Authorization to operate (ATO):

The Contractor shall obtain an authorization to operate (ATO), based on National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. The security assessment entails a review of minimum security controls, documented in NIST SP 800-53, Revision 5 (and subsequent revisions as finalized by NIST); documentation of a system security plan (SSP), based on NIST SP 800- 18 updated, Rev. 1; and remediation of weaknesses that are documented in a plan of action and milestone (POA&M) document, as required by Office of Management and Budget (OMB) Memorandum 02-01. The ATO will also have to cover any alternate processing facilities or a subcontractor handling SEC information or operating systems on behalf of the SEC.

Encryption Specifications:

The Contractor shall adhere to the following Encryption Specifications:

1. All encryption modules in the requirement must be FIPS 140-3 certified level 2.

2. All built-in encryption modules are subject to verification by technical support provided by the contractor or as otherwise directed by the COR.

3. Unless the Contractor is using SEC provided devices, all contractor provided mobile devices including, but not limited to laptops, mobile phones, and tablets, must be encrypted with a full-disk (or full-system) encryption capability.

4. All data written to removable media must be encrypted using the SEC’s enterprise removable media encryption capability.

5. All systems and applications must only support Hypertext Transfer Protocol Secure (HTTPS). All Internet-facing systems must also implement HTTP Strict Transport Security (HSTS). Deprecated encryption methods (such as SSLv2 and SSLv3) and encryption ciphers (such as 3DES and RC4) shall not be supported.

Cloud-Based Assessment:

Any cloud-based components of the Contractor, that are not otherwise exempt pursuant to SEC Cloud Service and FedRAMP policy, shall be assessed in accordance with FedRAMP requirements and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146, and in SEC Instruction 6022.00. The Contractor shall remediate problems identified during any security testing activities. All significant issues (typically those rated as HIGH and often those rated as MEDIUM) shall be resolved before the system is allowed to go into production and handle SEC information. The Contractor shall resolve security audit-related Plan of Action and Milestones (POA&M) items within a reasonable timeframe, based on risk guidance from the designated authorizing official. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the Contracting Officer’s Representative (COR), Office of Information Technology (OIT) Security Group staff, and relevant SEC staff to

50310223R0019 AMENDMENT 0002 Page 11 of 89 review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review along with supporting evidence. SEC’s OIT Security Group may choose to perform additional technical testing to validate resolution.

Security Issue Review:

The Contractor shall remediate problems identified during any security testing activities.

All significant issues (typically those rated as HIGH and often those rated as MEDIUM) shall be resolved before the system is allowed to go into production and handle SEC information. The Contractor shall resolve security audit-related Plan of Action and Milestones (POA&M) items within a reasonable timeframe, based on risk guidance from the designated authorizing official. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the Contracting Officer’s Representative (COR), Office of Information Technology (OIT) Security Group staff, and relevant SEC staff to review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review along with supporting evidence. SEC’s OIT Security Group may choose to perform additional technical testing to validate resolution.

Dedicated Security Personnel:

The Contractor shall provide an appropriate number of qualified information security personnel to ensure secure development methodologies are followed and assist the SEC Security Operations Center (SOC) in proactive monitoring of exploits against SEC information systems.

Security Assessment:

The Contractor will cooperate with the SEC Security Team in support of the Security Assessment and Authorization (SA&A) for the product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST SP 800 series of documents and includes:

1. Enumeration - activity aimed at identifying devices and components and cross-referencing with provided inventory lists,

2. Vulnerability Scanning - performs network-based vulnerability assessment of customer’s servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un-patched or have out-of-date software security patches,

3. Penetration Testing - attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false-positives, and determine the extent of the vulnerability and potential remediation steps that may be taken, and

4. Functional Testing - Perform specific tests, examinations, and inspections against NIST SP 800-53 controls not tested by the other activities.

Contractor-provided SA&A for all system development or solutions development

50310223R0019 AMENDMENT 0002 Page 12 of 89 projects for contractor-operated systems and solutions:

For all Contractor-operated systems or solutions, (including Cloud-based systems), the Contractor will obtain from a third-party organization (3PAO) an accredited security assessment, subject to review and approval by the SEC, compliant with standards from NIST (e.g., SP 800-115 Technical Guide to Information Security Testing and Assessment) to verify that security controls are implemented and operating as intended.

Documentation Updates:

The Contractor shall maintain and update system specifications and/or documentation, including system inventory, to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and commercial off-the shelf (COTS) products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On-line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation. The documentation shall be available to the COR for review and inspections throughout the system development life cycle (SDLC); updates shall be submitted to the COR for review and approval.

System Development Plan (SDP):

The Contractor shall develop, maintain, and execute an SDP which shall include the policies, procedures, standards, instructions, forms, and/or checklists needed to analyze, design, implement, test, and deploy the required application systems. In the SDP, the Contractor shall explain how the Contractor’s corporate system development standards and practices will be applied and discuss its development methodology in detail. The SDP shall also describe the development methodology used by the Contractor. The SDP will be benchmarked against NIST SP800-160 Volume 1 and NIST SP 800-160 Volume 2, Developing Cyber Resilient Systems: A Systems Engineering Approach.

Subcontractors:

Subcontractors approved by the SEC under SECI 6004.00 that handle or have access to SEC data in the performance of this contract shall be bound by the same information protection requirements as the Contractor. Like the Contractor, the Sub-Contractor’s environment will have to undergo security assessment and authorization, including a facility only used for disaster recovery or alternate processing.

Mandatory Common Security Configurations:

The Contractor must follow the common security configurations as published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018, is located at: https://csrc.nist.gov/publications/detail/sp/800- 70/rev-4/final.

4.3.1.1.1.5. Provide for backup and recovery procedures of any LSSP data to protect http://checklists.nist.gov/ http://csrc.nist.gov/ http://nvd.nist.gov/scap.cfm https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final

50310223R0019 AMENDMENT 0002 Page 13 of 89 against information loss. The system shall conform to the Contractor’s internal backup and recovery procedures. Actively maintain a backup and recovery plan, tested at least annually. The Contractor shall create and implement policies, processes and procedures to address the information system security requirements needed for disaster recovery in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned, and plan updates will be made available to SEC for review within ten (10) working days of a request by SEC.

Furthermore, SEC will be provided a point of contact for disaster recovery planning and exercise for the information service(s) provided. The Contractor shall invite participation from the SEC during tests to ensure SEC is able to access the system(s) and service(s) provided.

4.3.1.1.1.6.

4.3.1.1.2. Security Logs and Access Audits

Security logs and access audits for the Contractor LSSP system shall be available to the SEC for the most current 12 months and a copy provided to the SEC upon contract termination. SEC retains the right to include access audits of the Contractor LSSP system as part of the assessments conducted in accordance with Section 4.3.1.3 – FISMA Certification to ensure that appropriate entitlements are maintained, and potential security threats are minimized.

4.3.1.1.3. NIST Compliance, System Security Architecture, Scans and Penetration Testing, and Authority to Operate

To establish initial compliance status, the following steps will occur:

4.3.1.1.3.1. The Contractor shall adhere to the Revised Standard 6013.01 FEDERAL

REQUIREMENTS, SECURITY, AND ACCESSIBILITY FOR INFORMATION

SYSTEMS (JANUARY 2022) - Information systems containing Securities and Exchange Commission (SEC) data or operated on behalf of the SEC.

4.3.1.1.3.2. The Commission will perform an initial Security Assessment and Authorization (SA&A) audit based on the SSP.

4.3.1.1.3.3. SEC will develop the list of POA&Ms in conjunction with the Contractor (POA&M List). The Commission will identify the POA&M items that SEC desires that the Contractor resolve.

4.3.1.1.3.4. The Contractor will respond with the following: Target resolution dates for POA&M items it can resolve at no cost; cost estimates and target resolution dates for POA&M items that would entail additional cost; and POA&M items that it cannot feasibly address. The Commission and Contractor will act in accordance with the terms of this contract in determining what changes, enhancements or modifications will be made to the LSSP system.

50310223R0019 AMENDMENT 0002 Page 14 of 89

4.3.1.1.3.5. The Commission will use an established change control process to direct the Contractor to resolve POA&M items for which Commission has decided not to accept the risk.

The aforementioned Commission security assessment may require the following support from the Contractor:

4.3.1.1.3.6. Upon request from the Commission, the Contractor will make available to the Commission, at Contractor’s location, current versions of existing documentation that contain test results for and descriptions of Contractor’s management, operational, and technical security controls applicable to the LSSP system (Security Control Report). This includes Contingency/Disaster Recovery Plans, results of contingency tests/exercises from the previous 24 months, results of risk assessments, penetration tests, and vulnerability scans performed in the previous 24 months, corporate security policy documents/handbooks, and other existing material relevant to understanding how security has been implemented by the Contractor.

4.3.1.1.3.7. The aforementioned document reviews will be arranged and held at Contractor’s site or other Contractor locations, depending upon the scope of the review and the location of the documents.

4.3.1.1.3.8. Regarding the Commission’s intent to perform or to have the Contractor’s third party Contractor perform independent security testing on the LSSP system, upon a mutually agreed upon timeframe by the Contractor and Commission, the Contractor and Commission will schedule a mutually agreeable set of dates and times (to commence no more than 60-days after the initial notification and to be completed upon mutual written agreement by the Commission and Contractor for the testing to occur. Upon a mutually agreed upon timeframe, and before the scheduled test dates, the Contractor will meet with Commission to discuss the rules of engagement and scope of the vulnerability scanning and penetration testing to be performed.

4.3.1.1.3.9. During the aforementioned negotiated test dates, the Commission, its consultants, or Contractor’s third-party Contractor will be granted appropriate access to perform the previously discussed and planned vulnerability scanning and penetration testing of the LSSP system and its supporting network infrastructure. The Contractor will ensure that it has appropriate personnel on site during any Commission testing to monitor the tests and assist with obtaining appropriate physical and logical access.

4.3.1.1.3.10. If the Contractor’s third-party Contractor performs the vulnerability scanning and penetration testing, all results of such testing as applies to protection of the LSSP system shall be made available to the Commission and its consultants for review within 30 days of scan and penetration test completion (Vulnerability Scanning and Penetration).

During the aforementioned scan and penetration test review period, the Commission and its consultants will also perform activities to help verify those NIST security controls (from NIST SP 800-53) that cannot be determined from the scan and penetration test results. This review will include observation of security-related processes and procedures, a physical tour of the Contractor’s facility and data center housing the LSSP system, interview of the LSSP system administrators, security personnel, and other employees involved with

50310223R0019 AMENDMENT 0002 Page 15 of 89 application of NIST controls, and review of existing security-related documentation, including policies, standard operating procedures, and contingency plans. Once the Commission has reviewed the scan and penetration test results, any shortcomings will be provided to the Contractor and discussions will be held to determine a remediation plan.

4.3.1.1.3.11. For the initial release of the LSSP system, a third-party Contractor prior to the Commission issuing an Authority to Operate must complete a penetration test. Upon completion of the penetration test, the results must be provided to the Commission (Initial Release Penetration Test).

4.3.2. Section 508 Compliance (also refer to SECI 6012.02 in H.5 below)

The Contractor shall comply with Section 508 of the Rehabilitation Act of 1973 and as amended by the Workforce Investment Act of 1998. The complete text of Section 508 is available at https://www.access-board.gov/index.php. All products and documentation shall be 508 compliant. Any mobile solution provided by the Contractor shall be 508 compliant.

An example of potentially suitable solution may include one or more COTS products and/or custom application of other robust technology available in the market, but are not limited to, solutions with complex search and query functionalities as needed by SEC rule definition. If any POA&M findings are relation to Section 508 compliance, submit a remediation plan to the SEC (Section 508 Remediation Plan).

4.4. Implementation Management

Upon contract award, the Contractor shall coordinate with the COR and other stakeholders the project Kick-off meeting. The Contractor shall produce the list of deliverables as per the operational model for the system they are recommending. Irrespective of the operational model, the Contractor needs to support the following:

1. Project Management.

2. Capability Verification.

3. Transition / Migration.

4. Security Support.

5. System Maintenance, Technical Support, and Business Support.

4.4.1. Project Management

The Contractor shall choose the most appropriate project management methodologies, tailored to the situation. This can be waterfall, agile, or a hybrid approach. Deliverables shall be aligned to the selected methodology and the COR can request specific artifacts to comply with SEC policies and procedures. The Contractor shall maintain a Detailed Architecture Document (or something similar) that addresses in detail the various parts of the system, how they work, and its associated network and security topologies, respectively. The Contractor shall maintain a Project Management Plan that addresses the core knowledge areas for successful project. Together with the SSP, the Project https://www.access-board.gov/index.php

50310223R0019 AMENDMENT 0002 Page 16 of 89

Management Plan shall be treated as a living artifact. The Contractor shall provide effective management and oversight, including but not limited to, the following areas:

4.4.1.1. Scope Management

The Contractor shall establish the scope for any Development, Modernization, and/or Enhancement (DME) that focuses on traceability of requirements or user stories. This effort shall specify which actions are in scope and which are out of scope for any such effort.

4.4.1.2. Schedule Management

The Contractor shall establish and update a project schedule that is resource loaded, with a depth of at least Level 3 of the Work Breakdown Structure, or a Product Backlog. This detail shall comprehensively capture all work related to DME of the LSSP application. The Contractor shall account for SEC’s Service Delivery Framework for all planning efforts and satisfy its Product Tailoring Plan.

4.4.1.3. Cost Management

The Contractor shall develop and maintain a Spend Plan that allows for forecasting costs related to planned future events, and analysis on the Return on Investment. Shall the Contractor acquire the intellectual property of the incumbent Contractor, then the current no-cost posture shall be sustained.

4.4.1.4. Requirements Management

The Contractor shall provide the COR with requirements, or user stories, for development, modernization, and enhancement efforts, to ensure that such work is in compliance with Exchange Act Rule 17f-1.

4.4.1.5. Risk Management

The Contractor shall develop and maintain a Risk Log, an Issue Log, and an Action Items List throughout the life of the contract. The Contractor shall record plans to resolve issues to include preventative measures for the issue reoccurring. The Contractor shall itemize risks and issues to include codifying them, and tracking with them useful attributes (e.g., level of impact, likelihood of occurrence, date open, date closed, status, etc.).

4.4.1.6. Configuration Management

The Contractor Contractor shall provide configuration management for deliverables and work products. The Contractor shall develop and deliver a Configuration Management Plan to describe how various user scripts, queries, and applications, or any information system developed for the SEC, will be version controlled and managed.

50310223R0019 AMENDMENT 0002 Page 17 of 89

4.4.1.7. Quality Assurance and Quality Control Management

The Contractor shall develop, implement, and maintain an effective Quality Control Program (QCP), with associated artifacts, to ensure services are performed in accordance with requirements in this SOW, commonly accepted commercial practices, and SEC standards for quality. The SEC reserves the right to perform inspections on services provided to the extent the SEC deems such inspections necessary to protect the SEC’s interest.

4.4.1.8. Data Security Management

The Contractor shall support security assessment processes that will result in an Authority to Operate (ATO), in accordance with Section 4.3 above. Further, the Contractor will provide to the SEC prior to the operation of the solution: (1) a written description of the data protections showing that they are compliant with all applicable federal guidance and consistent with industry standards including appropriate data monitoring and breach/loss of control notification standards; and (2) a written, detailed plan of action for the Contractor, including anticipated outreach efforts to the SEC, in the event of any data breach or Contractor loss of control over SEC-owned data. Such plan will explicitly include anticipated remediation efforts and assistance to be given to the SEC in the event of a data breach or other Contractor loss of control over SEC data.

4.4.1.9. Service Delivery Framework

The Commission’s SDF provides guidance and oversight on all lifecycle phases, which include Planning, Requirements Analysis, Design, Development, Test, and Implementation (waterfall) or its agile SDF counterpart. It employs a risk-based approach to applying lifecycle requirements. The Contractor shall include a Release Log for each change to the system, regardless of major or minor enhancement. The log shall be submitted to SEC, as needed.

* The high-level Service delivery Framework artifacts will be provided as needed and are not attached to the solicitation.

4.4.1.10. Disaster Recovery Management

The LSSP system backups shall be encrypted and stored off-site from the hosted solution facility, as annotated in their Disaster Recovery Plan. The Contractor shall conduct a functional disaster recovery exercise annually. The Contractor shall provide the results of the exercise for systems directly affecting the SEC. The Contractor shall provide the results of annual validations of physical access authorizations to the facilities supporting the SEC.

4.4.1.11. Testing and Training Management

The Contractor shall establish requisite testing plans for DME efforts. This plan, at

50310223R0019 AMENDMENT 0002 Page 18 of 89 minimum shall include the logistics, a timeline, and test scripts/acceptance criteria. Further, testing shall include regression and UAT, based on impacted users.

The Contractor shall establish a Training Plan that is targeted to specific user groups. It shall be adjusted to synchronize with the Testing Plan. Feedback from both shall be gathered for iterative, incremental improvement with user engagement.

4.4.1.12. DME Closeout Activities

Successful closure of DME shall include, regardless of project management methodology, Lessons Learned or Retrospectives that shall infuse improvements to future efforts.

4.4.2. Capability Verification

The Contractor must deliver the Solution for delivering the requirements of this SOW. The Contractor shall deliver system documentation (user guide, and Detailed Architecture Design document that includes technical architecture guide, installation guide, technical developer guide) on digital medium. The Contractor shall perform system configuration, development, debugging, and unit testing to meet the SOW requirements. The Contractor shall configure the application solution security features to prevent any unauthorized person from accessing the system or data. The Contractor shall provide documentation to prove to SEC that all the capabilities as defined in this SOW are implemented within the solution. Depending on the Operational model suggested by the Contractor for the solution, the documentation required by SEC to validate the solution will be different.

4.4.3. Transition / Data Migration

The Contracting Officer shall convene a transition meeting with the Incumbent Contractor and Successor Contractor to finalize outstanding technical and logistical issues involved in the transitioning of the operation of the LSSP in a timely manner without disruption to current LSSP Participants. During the transition meeting, the parties shall work out an effective and efficient method for data transfer to enable the Successor Contractor to initially build a test database and subsequently evolve to an acceptable data transfer mode to enable creating of a database that can simulate active live processes.

Transition activities will consist of the Incumbent Contractor providing the Successor Contractor with all required documentation, transferring LSSP related data to the Successor Contractor, and providing post data transitions support. Baselined transition schedule shall be formed via consensus.

The Contractor must migrate all legacy data from the Incumbent Contractor into the new system database. The Commission will facilitate communications between all parties to ensure the extracts of the legacy data in a digital format are transferred into the new system.

The Contractor shall provide data migration and data feed design documents, schedules and implementation plans to COR for approval. The Contractor shall develop test scripts, test

50310223R0019 AMENDMENT 0002 Page 19 of 89 procedures and test plan and provide them to the COR for review. The Contractor shall execute formal dry runs of the migration process, which shall include tuning the process for performance and resolving issues with mapping or transformation following each formal dry run. Data migration shall be planned, coordinated, and implemented in a structured manner that identifies impacted users. The Contractor shall establish User Acceptance Tests and provide the results to SEC as evidence of successful migration. The Contractor shall create and maintain test results documentation to confirm that all data is completely and correctly migrated to the new system.

The Contractor shall archive and return all SEC-owned data within the service period to the SEC. After confirmation of file return from the SEC, the Contractor shall dispose of all SEC files at the hosted site in a secure manner.

4.4.4. Security Support

The Contractor shall provide documentation and support needed that is specific to the application architecture, configuration, security design etc., needed to deliver all the Security related tasks on the project. The Contractor shall support, as needed, the SEC Security Assessment and Authorization (SA&A) process based on NIST SP 800-53 using Security Controls at the Low-impact level. Support shall include attending meetings, answering clarifications, providing system overviews etc., in relation to security configurations.

4.4.5. System Maintenance, Technical Support, and Business Support

The Contractor shall perform the following as per instructions from the COR:

• Investigate reported incidents, develop solutions, and deploy fixes.

• Support requests to investigate reported incidents, which could come in through multiple…