50310224R0010 Amendment 0001 - OEC eFeeds SIGNED.pdf

� ������������������������������������� !��"��"�#�������������������������������������������������#��$����������#������������#����!����#��#��!���#���������$��������� ��������!$������#���#��������������!�������������������������$���#�%��&'()*+,�-&�.-*+�'/01-2),34,5,16�6-��,�+,/,(7,3�'6�68,�9)'/,�3,:(41'6,3�&-+�68,�+,/,(96�-&�-&&,+:�9+(-+�6-�68,�8-*+�'13�3'6,�:9,/(&(,3�5'.�+,:*)6�(1�+,;,/6(-1�-&�.-*+�-&&,+%��(�����<�#�$����������������������$�����#���������"���������#��!#������$�������=��$�������"�����������������!����#��#��!���#���������$��������=��#�<����������!����#��#��!���#���������$���������������#���#��������������!����������������������������=��������#����<����#��#��������������"���$#�������������������%

>?@ABCDEFC�GH�

���IJ?BK�@EFL��

M @NHOF?�O��� ���P�@E�NNE�CNJB@@BFC�?CG�FLN�?EBFC@�@QLLF�E�R�?CHAFPPBHN�FP�?HSQB@BEBFC@@NHQ�BEBN@�?CG�NTHA?CDN�HFJJB@@BFC�UV��V

WXY�Z[\]�\Ẑ _�̀abc�deeb\̂]�Z̀ �_̀ f\g\hdZ\̀a�̀g�h̀ aZidhZ]j̀if̂ i]Y��\Z�_̀ f\g\̂]�Z[̂ �h̀ aZidhZj̀if̂ i�à Y�d]�f̂ ]hi\k̂ f�\a�\Ẑ _�WlYmn%�'//-*16(14�'13�'99+-9+('6(-1�3'6'�opq�rstuvrswx ���������������%�����������=�(�����y�����mz=�����#��$#���"-���#���$�������� !��"��#��������������������������#��#����������$#�����������������������������!�����������#�����������=�����������������!!� ��"��������{������������!����"6������<���$���#�����!������������������������������#������(����m|%��6�����$#����������������������#�#����������-���#�WWY�Z[\]�\Ẑ _�̀abc�deeb\̂]�Z̀ �d_̂ af_̂ aZ]�̀g�]̀ b\h\ZdZ\̀a]&'/()(6.�/-3,�/-3,� m}�%�3'6,3�o~���p������xm}'%�5-3(&(/'6(-1�-&�/-16+'/6�-+3,+�1-%��%�3'6,3�o~���p������x�'%�'5,135,16�-&�:-)(/(6'6(-1�1-%

/-3,� y%�1'5,�'13�'33+,::�-&�/-16+'/6-+�o�������rss�����u�����~���s���w��p����wsx

�%�'35(1(:6,+,3��.�opq����sr������p�s���x/-3,��%�(::*,3��. 9'4,���-&��9'4,:|%�+,�*(:(6(-1�9*+/8':,�+,�%�1-%�%�,&&,/6(7,�3'6,n%�'5,135,16�5-3(&(/'6(-1��1-%� z%�9+-;,/6�1-%�opq�����v����sxm%��/-16+'/6�(3�/-3,d_̂ af_̂ aZ�̀g�]̀ b\h\ZdZ\̀aj_̀ f\g\hdZ\̀a�̀g�h̀ aZidhZ

�MV��V

/8,/0�-1, '%�68(:�/8'14,�-+3,+�(:�(::*,3�9*+:*'16�6-{�o~�s�vq���u���rv��x��68,�/8'14,:�:,6�&-+68�(1�(6,5�m|�'+,�5'3,�(1�68,�/-16+'/6�%�68,�'�-7,�1*5�,+,3�/-16+'/6�-+3,+�(:�5-3(&(,3�6-�+,&),/6�68,�'35(1(:6+'6(7,�/8'14,:�o�u�����������s��v�����v����qqv�s��/%�68(:�:*99),5,16')�'4+,,5,16�(:�,16,+,3�(16-�9*+:*'16�6-�'*68-+(6.�-&{3%�-68,+�o~�s�vq�����s��q���wvqv���v�����w��u���rv��x����r��rv��v���w�����s���x��:,6�&-+68�(1�(6,5�m|=�9*+:*'16�6-�68,�'*68-+(6.�-&�&'+�|�%m}����% Ŷ�\_è iZdaZ� /���#����#� ������� ���#��$�#��������"����������$���������#��$#�����������������������������������������$��"�������%�-+3,+�1-%�(1�(6,5�m}'%

��±̄� Ä��©²�N±̄ «̈³�̄°²̈ÀN®®̈ ¶̄°¹̈�°²²̈ °́±̄ µ̈Â�±�¬®�̄§°�±²̈ ³́ ²̈ ³̄ �̄¬�̄ §̈�¬µ°¶°̄ ±̄°¬³Ä À�?̄ ±̄¶§²̈ ³̄�U�O�@̈ µ̈ ¶̄ ΅�R«¬¾̈«±¿̈�N ±²©µ̈�°�°³¶µª́ ΅�°³�̄ §̈�¬µ°¶°̄ ±̄°¬³À À�E§̈�D¬¹̈«³²̈ ³̄Å�±³º̈«�̄¬�̄ §̈�»ª̈ ̄°¬³�«̈ ¶̈°¹̈ �́¬³�̄§°�¬µ°¶°̄ ±̄°¬³�±«̈�©«¬¹°́ ΅�±±³�±̄ ±̄¶§²̈ ³̄ �̄¬�̄§°�±²̈ ³́ ²̈ ³̄ÀH¬³̄°³ª̈ �́ÀÀÀ m�'%�1'5,��'13�6(6),�-&�/-16+'/6(14�-&&(/,+�o���s��r��rv��xmz'%�1'5,�'13�6(6),�-&�:(41,+�o���s��r��rv��x mz/%�3'6,�:(41,3 m��%�*1(6,3�:6'6,:�-&�'5,+(/'�mz�%�/-16+'/6-+�-&&,+-+ m�/%�3'6,�:(41,3o~v����urs��q��sr�����u���rv¡sw�����v��x o~v����urs��q�����r���v��� qqv�srxHFC@QNK?�KÀ�DBCC :6'13'+3�&-+5��}��+,7%�mm�n}m��9#���#��������4:'�&'+��|y�/&+��z�%n|�9#�<��$����������$�$���!� ,����������#�<�������#���=��!!���#����������������������������$�����#���#���������(�����'��#�m}'=������#�����#������"��=�#�������$�����"�����������$!!���#�������������%

7/5/2024

� ��"� ��#$% #&% #'% #(% #)% #*%+,-.,��/0,,.,1,,,.��������-2�$33�45678�5789:�;<=�>4<=?5?4<:�879;?<��������@<>6;<A7=�;<=�?<�B@33�B48>7�;<=�7BB7>52��������$CC$'D)(E��������$CC$'DF)GC�H�I�J737>57=�&84K78;A7�)L;9M37:��������N@7:5?4<:�;<=�$<:O78:�4<�0*N�+,-.,��/0,,.,�P)'��������7*77=:�*QG$R��������S78?4=�4B�S78B489;<>7E�,T1-,1�,�/�54�,T1�T1�,�+

� ��UVWXYXZYZV[Y\X]U ��������������̂̂ ]�_WY\]̀ abcdbefg�hi�" �����_W\����̀�V̂�ZZX

Brokerage Fidelity Brokerage Services LLC Charles Schwab Vanguard ETrade T Rowe Price Computershare TD Ameritrade Inc TD Waterhouse Inc Morgan Stanley Merrill Lynch

TIAA

Coinbase Bank of America Merrill Lynch Robinhood Financial Empower Retirement JPMorgan Chase Wells Fargo Advisors, LLC Principal Financial Group Voya Financial American Funds John Hancock

UBS

Edward Jones Equiniti Group Janus Ameriprise Financial Services Inc Victory Funds TransAmerica LPL Fin Corp.

ADP

Ascensus Capital Group Ally Invest Citigroup Northwestern Mutual Life Insurance Co Franklin Templeton Alight Financial Solutions Invesco Nationwide Raymond James and Associates Inc Lincoln Financial Interactive Brokers Corp American Century Brokerage Inc Broadridge Financial Solutions Inc Prudential Securities Inc MetLife RBC Capital Markets Corp National Financial Services LLC OneAmerica Securities Inc Pershing LLC USAA Inv Mgmt Co USAA Fin Adv Inc

ATTACHMENT 7 - Selected Brokerage Examples

SEC Nonpublic Information

# RFP

Reference

Question Government Answer

1 We’ve started initial review of the RFP documents and I was curious if the currently executed NDA would suffice for the Contractor version?

Offerors must submit the Contractor Entity NDA, Attachment 1 to the RFP. The previous NDA executed will not suffice.

2 Also, it was noted that only US Citizens are allowed to work on the project and we do have an offshore partner and a dual HQ in UK and I know one of the other firm’s has a significant support presence in Ireland, so is that a non-starter if those resources are utilized?

1. Dual HQ in US and other countries.

All companies providing services to the US Federal Government must be headquartered in the United States. If the company is dual headquartered in another county, the solution must be FedRAMP authorized, and the company must demonstrate that the solution is hosted in the US data center and is administered by US based HQ operations. A firewall is setup between US operations and the foreign HQ for this project.

2. Support personnel in foreign countries and are not US citizens.

All contractors, sub-contractors, and support personnel working on this project must be US citizens. If Contractors employ non-US citizens, they must provide a plan to ensure that only US citizens are allowed to work on this project and provide support going forward.

3. SEC data must reside on US soil.

All data related to this project must reside in data centers in the United States. This information includes, but it is not limited to, data sent to the contractor from the SEC, data sent to the contractor from brokerage houses, and information sent from the contractor to the SEC. Contractors with data centers outside of the United States must provide a plan to ensure data resides only in US data centers.

3 What defines “key personnel” please? Key personnel are contractor personnel that are considered to be essential to the work being performed under this contract. Key personnel for this requirement are not required by the Government. If a contractor deems any of its personnel as key personnel, they can propose key personnel; however, the Offeror will have to provide all key personnel resumes per the RFP instrictions and cannot remove or replace the key personnel during contract performance without providing a replacement and their resume for the Government's consideration. For more information on key personnel requirements in the RFP, see SEC 6010.01 KEY PERSONNEL (JANUARY 2022). Again, the proposing of key personnel is not required for this action, it is strictly optional, and key personnel is not an evaluation factor.

4 Can the SEC provide more details about your desired roll out plan?

Depending on the overall configuration schedule and implementation plan, we may want to look at releasing certain functionality ahead of others. This of course depends on the FedRAMP and overall ATO process. We are also looking at which users would first be able to use the application. It will not be a big bang go-live for all 4,500+ SEC employees.

4a a. Will it be a big bang go-live of all users/features or a phased approach?

See #4.

4b b. If phased, are there features or groups of employees that should be prioritized over others?

See #4.

5 What is the desired rollout date for the project?

Desired start date?

We do not have a desired start date, but rather starting as soon as we can once the application achieves FedRAMP authorization.

6a 3. Could you provide more details regarding integrations as below: a. Microsoft Entra ID is referenced in documentation. Is Microsoft Entra ID used for all employees or will you need multiple providers configured?

Microsoft Entra ID is SEC's standard Identity and Access management solution that complies with Federal Zero Trust Architecture.

The contractor solution is required to integrate with SEC Entra ID via OpenID Connect (OIDC) or SAML for authentication and Single Signal-On.

6b b. What are your API requirements? What systems do you want to integrate with and what data are you looking to push or pull?

The contractor solution should use SAML or OpenID Connect (OIDC) to authenticate against the SEC's Entra instance.

7 The SOO mentions that the OEC is responsible for the following: personal trading, gifts, seeking and negotiating other employment, outside activities, and financial disclosure. It does not specifically mention any other preclearance activity outside of personal trading in your user story requirements, problems to resolve, and deliverables. Other than personal trading, are any other preclearance requirements in scope for this project?

Not at this time. We are open to looking at other functionality for future deployments.

8a Data scope clarification: a. What is the scope for data that needs to be migrated/loaded into the vendor/offeror’s solution?

The legacy system stores information covering a 6 year period for both pre-trade request and certification of holdings data.

8b b. Documentation references 6 years of data, what types of data should be scoped into this project?

Pre-trade request and certification of holdings data.

9a In the Draft RFP and RFP you indicated that the SEC will 'sponsor' FedRAMP authorization. a. What does that entail?

The SEC will be listed as the agency that will be using the application that is looking to be authorized by FedRAMP. There are no financial items contained within the sponsorship. For additional information about FedRAMP and Agency Authorization, please go to https://www.fedramp.gov/agency-authorization/#:~:text=There%20are%20two%20approaches%20to,for%20authorization%20at%20any%20time.

9b b. Is the SEC willing to cover costs and/or reimbursement of obtaining Moderate Impact Level FedRAMP authorization for the winning vendor?

See #9a.

10 Is this non-negotiable: SEC 6023.00 U.S. CITIZENSHIP FOR IT SERVICES (APRIL 2024) Only U.S.

citizens, who do not hold dual citizenship with another country, may perform work under this contract or agreement. The contractor shall include this language in all subcontracts at any tier.

Yes. U.S Citizenship is required.

11 Moderate Level FedRAMP authorization needed within 12 months of contract execution or is the window 12 to 18 months as is noted elsewhere?

The window is 12-18 months.

12 What work is defined by this statement in SEC 6010.02: Work outside of the continental United States is not permitted, in accordance with SECR 24-12 Requirements for Securing SEC Information Technology Resources in Connection with International Travel.

See #2 above.

OEC eFeeds RFQ 50310224R0010 Questions and Answers

SEC Nonpublic Information

# RFP

Reference

Question Government Answer

OEC eFeeds RFQ 50310224R0010 Questions and Answers

13a “If the Contractor is using third-party cloud services to fulfil the Government requirements established by the contract, the Contractor is responsible for ensuring that any third-party cloud services have a valid authorization-to-operate (ATO) that was granted by the Joint Authorization Board (JAB) or by another Federal agency” – Is this a non-negotiable term?

Yes.

13b Do all subcontractors, regardless of the services they provide, need an ATO?

Any personnel working on the OEC E-Feeds project must be cleared through our Personncel Security and given clearance to work with SEC data. All services provided by subcontractors are subject to ATO as a part of SEC E-Feeds system.

14 Do we have to complete and submit a VPAT template with the RFP response? This is mentioned in attachment 3 but not explicitly called out in the list of deliverables.

If a VPAT is avaliable, please provide it as it will assist us with determining the accessibility readiness of the application.

15 How do we indicate compliance with Section 508? See #14.

16 Do we have to indicate compliance with the terms outlined in Attachment 4 as part of our submission?

Yes, via your technical proposal, and you must follow the instructions provided in Attachment 4, specifically those in Section 11- Instructions to Offerors.

17 “As a user, I want the system to use a single tenant architecture, so that the SEC can ensure control, reliability, security, and backup capability of their data” – is single tenancy a hard requirement for all application components, or does the SEC allow any multi-tenant components?

Single tenant is a hard requirement.

18 Does the SEC require in-line answers for Appendix A and Appendix B of Attachment 3, or should compliance with these requirements be indicated in the Technical Proposal instead?

The compliance with the requirements can be indicated in the technical proposal.

19 Attachment

How will the SEC be evaluating vendors and what format should we submit responses in?

The SEC will be evaluating proposals in accordance with the evaluation criteria identified in Attachment 4, Section 12 - Evaluations.

Offerors are to use Attachment 3, the SOO, to develop their technical proposal and to develop their Performance Work Statement.

The format Offerors use for their proposal is at their own discretion; however, at a minumum it needs to comply with Attachment 4, Section 11 - Instructions to Offerors.

20 Attachment

Do you need suppliers to respond inline or confirm we can comply with the Performance Objectives?

Do not respond inline on Attachment 3, the SOO. The ability to execute and comply with the SOO/Performance Objectives should be addressed/confirmed within the Offeros technical proposal which includes in part, the Offerors developed Performance Work Statement (PWS) and proposed technical approach/technical capability.

21 Operating Constraints

Is FedRamp Certification an absolute must have for the vendors submitting proposals for this project?

The vendors must be able to achieve FedRAMP authorization within 12-18 months from the time of award. FedRAMP authorization is not required at the time of submitting proposals.

22 General Can you please list which broker/e-feed providers the SEC will need?

The SEC can provide a list of examples of broker/e-feed providers used by SEC employees. Please note SEC employees will not be restricted to investing with specific firms. Thus, the list is fluid and subject to change.

23 General Is there a target go-live or implementation on-live date on the project?

See #5 above.

24 Appendix Is there a requirement for the vendor to provide a single tenant env or would a multi-tenant SaaS environment also be acceptable?

See #17 above.

25 Scope With 4500 employees + spouses + family, how many total accounts would the SEC expect to be covered under the scope of the e-feed project?

10,000+ with the caveat that an employee may currently include multiple accounts in a single upload.

26 Pricing What is the budget allocated to this project for e-feeds?

The SEC is not sharing its budget at this time.

27 General Is there scope to add more than the 11 broker feeds?

If so, is there list of which ones are planned in the future?

Yes. We will provide a list of all brokers to the be included. The initial 11 brokers covers the vast majority of SEC employee accounts.

28 Performance Objectives

How much data will the SEC need to migrate from legacy system? In what format will this data be presented for migration?

The legacy system stores information covering a 6 year period for both pre-trade request and certification of holdings data.

Data will most likely be repesented in .csv format with the exception of brokerage statements, which will remain in an original file format.

29 Performance Objectives

Is there a target End-Of-Life for the current e-feeds system? When will all the data need to be migrated by?

There is not a target End-Of-Life for our current system.

30 Performance Objectives

What specific "data analytics capabilities" will the SEC require from their choice vendor?

Functionality to catch possible violations, data discrepancies, and possible trend-spotting or metrics to identify areas of opportunity for outreach and education.

31 Scope How many accounts will need manually uploading or scanning into the choice vendor?

Since this will be a first time capability that will be rolled out to staff in a phased approach (see #4), the SEC does not yet have a firm gauge on what percentage would require a manual upload option.

32 Scope How often must employees provide and attest to their Certificate of Holdings? Is this an annual process? Or a more frequent process?

For the vast majority of employees, this is an annual process. However, there may be some exceptions to this rule as determined by

OEC.

33 Scope How often is restricted list updated? Is this based on the security level or the issuer? Do you do sector based regristrictions? GICS codes?

Monthly. Registrant: Financial firms and their subsidaries such as IAs/BDs/Transfer Agents/Securities Information Processors, Credit Ratings Agencies, and Exchanges. Sector Financial Services funds.

34 FedRAMP What does the SEC sponsorship for FedRAMP certification look like? How long does this process historically take to complete?

The timeline for FedRAMP authorization depends on the vendor. In general the process takes between 12-18 months if the vendor can implement and demonstrate all required security controls in a timely manner.

35 Objectives What is considered a "Close Match" to a security on the watch-list? How is this currently defined by SEC policy?

Fuzzy logic at 70- 75% or greater accounting for noise words and puncuation when a ticker symbol is not available, which can send the pre-trade request to compliance staff for manual processing if necessary via the configurable rules engine. Our current system applies a 100% match between pre-trade request ticker and “watch list” ticker. However, if the entity does not have a ticker, we rely on the system’s “fuzzy logic” capabilities to “close match” the pre-trade request name to the entity names in the watch list. Due to variations in punctuation and abbreviations, a 100% match is not feasible. For example, if an employee enters a pre-trade request for “Private Company John Smith Associates” and the Watch List has an entry for “Private Co. John Smith Associates Inc.” we would expect the system to recognize the close match and send the request to manual review.