Attachment_1_-_Statement_of_Work_FINAL.pdf

Statement of Work (SOW)

Back-Up Child and Elder Care Services

US Securities and Exchange Commission (SEC)

INTRODUCTION

The SEC has a requirement for a contractor to provide back-up child and elder care services to be offered by the SEC for its employees nationwide. The SEC has one location in the Washington Metropolitan Area and 11 regional offices. The SEC Headquarters (Station Place) is located in downtown Washington, DC next to Union Station, and the Regional offices are located in the cities of Atlanta GA, Boston MA, Chicago IL, Denver CO, Fort Worth TX, Los Angeles CA, Miami FL, New York NY, Philadelphia PA, Salt Lake City UT, and San Francisco CA. (See Appendix A for specific addresses and employee population at each location).

The services provided by this contract will better enable SEC employees to provide their families with safe, clean and secure environments when regular child and elder care arrangements break down or are otherwise not available.

BACKGROUND

The Society of Human Resource Managers (SHRM) identified the growth in the number of workers with elder care responsibilities and the growth in the number of workers with both elder and child care responsibilities as two significant demographic trends having a major strategic impact on organizations (SHRM Workplace Forecast, 2011). It is a recognized business practice to support employees to better balance work and home life demands in order to achieve agency mission objectives and the SEC endorses this philosophy. The contractor shall provide SEC employees access to a reliable, monitored, and comprehensive national referral and placement network of back-up child and elder care services.

During a 1-year period, the number of slots used per month ranged from 137 to 550, with an overall monthly average of 301. Contractor shall present a reasonable and flexible plan that would ensure recipients can receive back-up care and minimize turnaways.

SCOPE

The Securities and Exchange Commission (SEC) is seeking a contractor to provide SEC employees 24 hour online and telephonic access to a nation-wide, centralized registration, referral, and placement service for child and elder care recipients. Care recipients include dependent child, “mildly-ill child” and elderly (adult) family members. The nation-wide placement service shall allow care recipients access to a comprehensive network of licensed and qualified child care centers and/or in-home providers.

This contract shall provide geographic flexibility, so that employees can choose centers or in-home providers either close to home or close to work as needed. Additionally, SEC employees travel to cities across the country on SEC business. The comprehensive network of licensed and qualified child care centers and in-home providers shall cover cities across the country so that family care will not be a burden when travel for work is necessary.

A comprehensive network shall consist of at least 5 qualified child care centers within a 25 mile radius of SEC offices (See Appendix A). (This includes SEC’s Washington, DC headquarters where there are approximately 2600 employees that would be eligible for back up care).

OBJECTIVES

The SEC will contract with a selected vendor to achieve the following objectives:

• Provide a 24 hour centralized (online and telephonic) registration, referral and placement process for employees to access and utilize services of licensed and qualified child care centers and in-home providers for child, “mildly-ill” child, and elder care.

• Provide SEC employees access to a comprehensive network of licensed and qualified child care centers and/or in-home providers in close proximity to the SEC offices (See Appendix A).

• Minimize employee lost work hours due to scheduled and unscheduled breakdowns in regular family care.

• Minimize the number of turnaways due to backup care monthly capacities being met.

• Produce reports to measure improved employee attendance and performance due to reduced need for taking time off for unexpected family care situations.

SPECIFIC TASKS

• Contractor shall provide a 24 hour centralized (online and telephonic) registration process for employees to register care recipients in advance of requesting back up care services.

• Contractor shall provide SEC employees 24 hour centralized (online and telephonic) process providing reservation and placement within a nation-wide comprehensive network consisting of at least 5 licensed and qualified child care centers within a 25 mile radius of SEC offices (See Appendix A for specific addresses and employee population at each location).

• Contractor shall provide SEC employees access to a nation-wide comprehensive network of licensed and qualified in-home providers for child, “mildly-ill” child, and elder care recipients.

• Contractor shall initiate and conduct marketing efforts and produce materials to inform and educate employees regarding available referral and placement services for back up care recipients.

• Contractor shall comply with various SEC OIT Policies and Procedures, including Security, Section 508 Compliance, Privacy, and Records Management.

• Contractor shall maintain a website that meets the requirements of SEC’s Office of Information Technology (OIT), as well as Federal Requirements and Industry Standards. This includes compliance with Section 508 requirements for Electronic and Technology Information Accessibility. Please see Appendix B for detailed information regarding technology requirements.

• Contractor website systems shall undergo a Certification and Accreditation (C&A) as required by federal law. C&A results from other agencies can be important inputs to the SEC C&A review, but may not be sufficient to serve as the equivalent of the SEC’s C&A. Contractor systems shall not contain SEC data without obtaining an Authorization to Operate (ATO) from the SEC’s Designated Approval Authority (DAA). ATO requires the DAA’s review of the C&A documentation and an assessment of the risks associated with the system.

• Contractor shall have appropriate safeguards established and in place to protect Personal Identifying Information that is obtained in the regular course of business.

• The contractor shall conduct an annual survey of registered employees to assess satisfaction with services.

• The contractor shall submit a monthly report subject to the Government review and request for adjustments when necessary by SEC.

• The contractor shall prepare monthly utilization reports and assessment of services to ensure quality services and effective use of programming. Monthly reports should include detail of the number of employees unable to receive service due to capacity limits or any particular reason.

• The contractor shall collaborate with other SEC Work/Life and Wellness Programs initiatives in cross-promotional efforts. Work/Life and Wellness Programs include WorkLife4You, a comprehensive employee resource and referral program; an Employee Assistance Program (EAP); The Harbor, SEC’s onsite child development center; fitness programs; and walk-in Health Units.

• The contractor shall ensure sound contractual relationships with subcontracted network providers for the duration of the proposed contract period.

• A 24 hour centralized (online and telephonic) registration process for employees to access and apply for services.

• A 24 hour centralized (online and telephonic) process providing reservation and placement services to licensed and qualified child care centers and/or in-home agencies.

• Trained, professional specialists staffing the telephone call-in center.

• Contractor shall pre-screen care providers and collect any co-pays at time of reservation for care.

• The back up care centers shall be safe, clean and secure environments.

• Back up care centers and in-home care agencies shall maintain proper staff ratios for all age groups cared for in compliance with all Federal, State and local laws and licensing regulations governing their operation.

• Back up care centers and in-home care agencies shall ensure caregivers are well-trained and professional and are appropriately certified, licensed, and registered to professional, State and Federal requirements.

• Contractor shall implement and provide a method of periodic (at least annually) verification of certification and licensure of all back up care and in-home agencies within its network.

• Back up care centers and in-home agencies shall demonstrate hours of operation consistent with typical work schedules of employees, providing services opening no later than 8:00 am and closing no earlier than 6:00 pm.

• Back up care centers shall provide developmentally appropriate programming and recreational activities with planned, yet flexible daily activities that reflect the interests and diversity of the children or adult dependents in care.

• Access to services for SEC employee family members including, but not limited to, well and mildly ill children ages 3 months to 12 years old and adult dependents.

• Provide indemnity to SEC from liability in an amount required by law and of at least $20 million.

• As new care centers and agencies become part of the contractor’s network of services over the course of the contract, where appropriate, these resources will also become available to SEC employees.

QUALITY ASSURANCE

• To help gauge reliability of the backup care program, under a new contract arrangement, the contractor shall work to ensure the number of care recipients unable to receive care due to contract placement capacities being met (“turnaways”) is as close to zero as possible.

• The contractor shall ensure appropriate service standards, oversight and communication with subcontracted providers to ensure quality of care and adherence to state and federal requirements.

APPENDIX A – SEC LOCATIONS

Location:

Approximate Employees:

SEC HEADQUARTERS 2600

Station Place 100 F Street, NE Washington, D.C. 20549-2000

Atlanta Regional Office 90

950 East Paces Ferry Road, NE, Suite 900 Atlanta, GA 30326-1382

Boston Regional Office 130

33 Arch Street 23rd Floor Boston, MA 02110

Chicago Regional Office 240

175 W. Jackson Boulevard Suite 900 Chicago, IL 60604

Denver Regional Office 100

1801 California Street Suite 1500 Denver, Colorado 80202-2656

Fort Worth Regional Office 100

Burnett Plaza, Suite 1900 801 Cherry Street, Unit 18 Fort Worth, Texas, 76102

Miami Regional Office 100

801 Brickell Avenue Suite 1800 Miami, Florida 33131

Los Angeles Regional Office 150

5670 Wilshire Boulevard, 11th Floor Los Angeles, CA 90036-3648

New York Regional Office 430 3 World Financial Center Room 437 New York, NY 10281-102

Philadelphia Regional Office The Mellon Independence Center 701 Market Street Philadelphia, PA 19106-1532

Salt Lake Regional Office 15 W. South Temple Street Suite 1800 Salt Lake City, UT 84101

San Francisco Regional Office 44 Montgomery Street, Suite 2600 San Francisco, CA 94104

Approximate Total SEC Employees 4500

APPENDIX B - Technology Background and Requirements

• Technologies must meet the requirements for data protection as defined by the Federal Information Security Management Act (FISMA) of 2002. At the present time, the SEC expects that the assessment of the contractor’s system(s) will be at a moderate level according to FIPS 199.

• Systems and personnel are expected to comply with specific SEC policies relating to security requirements, including but not limited to: Password complexity, password history, password longevity, background investigations, database hardening, general system configuration, and system disposition.

• The SEC C&A is part of an overall OIT Software Development Life Cycle (SDLC) process to ensure compatibility with the SEC technology infrastructure, as well as adequate protection of Personally Identifiable Information (PII), adherence to the FISMA requirements, National Institute of Standards and Technology (NIST) Standards, and 508-compliance. The entire life-cycle may take 4-6 months, and will require the contractor to assist with and/or develop elements of the SDLC documentation; including but not limited to: Standard Operating Procedures, System Security Plan, Disaster Recovery Plan, Privacy Awareness Worksheet and a Privacy Impact Assessment.

• SEC requires timely notification (at least six months) of a significant change to the vendor’s information system or its environment of operation. A significant change is defined as a change that is likely to affect the security state of an information system.

• In the event of significant change, SEC will conduct a preliminary assessment to determine the magnitude of the significant change, whether a new C&A would be warranted and the scope of the C&A.

COMPLIANCE WITH REGULATIONS

The Contractor shall comply with all statutes, regulations, directives, instructions, and references applicable to the conduct of this acquisition as imposed by the Federal Government and the SEC, including, without limitation, those specified or referred to in this contract.

The Contractor and its employees shall become acquainted with and shall comply with the rules and regulations of the SEC’s facilities, including, but not limited to security, controlled access, personnel clearances, and conduct with respect to health and safety at the site, regardless of whether or not title to the facility is vested in the SEC.

SECURITY AND PRIVACY ACT MATTERS

The security classification for work performed under this contract is Public Trust. The documents that shall be reviewed and produced are non-public and sensitive in nature and shall be protected from unauthorized disclosure.

Work on this project request that personnel have access to Privacy Act Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

NON-DISCLOSURE REQUIREMENTS AND AGREEMENTS (Jan 2012)

Required non-disclosure agreements are attached and must be completed and returned to the Contracting Officer before starting work under this contract.

Provisions of the SEC Regulation Concerning Conduct of Members and Employees and Former Members and Employees of the Commission expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. See 17 C.F .R. § 200.7353(b)(1) & (b)(2). The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by the provisions of Sections 200.735-3(b)(1) and 200.735-3(b)(2) of the SEC's Regulation Concerning Conduct and the terms set forth in the attached non-disclosure agreements (Attachments1& 2).

An officer or executive authorized to bind the Contractor shall execute the non-disclosure agreement (Attachment

1) on behalf of the Contractor and return it to the Contracting Officer prior to the Contractor commencing work on the contract. The Contractor shall submit to the Contracting Officer a list of its employees, agents, and subcontractors that will be authorized access to SEC information by virtue of performing the requirements set forth in this contract. Each person identified on the list shall then sign the non-disclosure agreement on behalf of themselves (Attachment 2) and submit it to the Contracting Officer before commencing work on the contract.

The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to the terms of the non-disclosure agreement, protecting all confidential or non-public information, and to not divulge to any unauthorized person. Assignment of staff who has not executed the non-disclosure agreement or failure to adhere to this statement shall result in action by the Contracting Officer, as deemed appropriate. Violation of this clause or the attached non-disclosure agreements by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or civil suits and/or criminal prosecution.

PERSONALLY IDENTIFIABLE INFORMATION (PII) (JAN 2012)

The Contractor shall have established policies and procedures in place to safeguard SEC Personally Identifiable Information (PII) and other confidential or non-public information. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding SEC PII and other confidential or non-public information and incident management of suspected or confirmed loss of SEC PII or other confidential or non-public information. The Contractor shall provide a copy of its privacy policies to the Contracting Officer. For any systems containing SEC PII or other confidential or non-public information, the contractor shall provide its processes for identifying, assessing and mitigating privacy risks associated with data in the system.

The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to SEC-prescribed policies and procedures for the safe handling of SEC PII and other non-public information, including privacy and security training requirements and privacy incident management.

The Contractor shall establish policies and procedures that implement federal laws related to incident management, in accordance with OMB’s Recommendations for Identity Theft Related Data Breach Notification, September 20, 2006, and OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of SEC PII or other confidential or non-public data, that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at cops@sec.gov. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of SEC PII and other non-public information and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Clause, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

INFORMATION CONFIDENTIALITY

(a) To the extent that the work under this contract/task order(s) requires that the contractor be given access to confidential or proprietary business, technical, financial information belonging to the government or other companies, including pre-decisional budget and acquisition sensitive information, the contractor shall, after receipt thereof, treat such information as confidential and agree not to appropriate such information to its own use or to disclose such information to third parties unless specifically authorized by the contracting officer in writing. The foregoing obligations, however, shall not apply to:

1. Information that, at the time of receipt by the contractor, is in the public domain;

2. Information, that is published after receipt thereof by the contractor or otherwise, becomes part of the public mailto:cops@sec.gov domain through no fault of the contractor;

3. Information that the contractor can demonstrate was in his possession at the time of receipt thereof and was not acquired directly or indirectly from the government or other companies; and

4. Information that the contractor can demonstrate was received by it from a third party that did not require the contractor to hold it in confidence.

(b) The contractor shall obtain the written agreement, in a form satisfactory to the contracting officer, of each employee permitted access, whereby the employee agrees that he will not discuss, divulge or disclose any such information or data to any person or entity except those persons within the contractor's organization directly concerned with the performance of the contract.

(c) The contractor agrees, if requested by the government, to sign an agreement identical, in all material respects, to the provisions of this clause, with each company supplying information to the contractor under this contract, and to supply a copy of such agreement to the contracting officer. From time to time upon request of the contracting officer, the contractor shall supply the government with reports itemizing information received as confidential, proprietary, pre-decisional budget information, or acquisition sensitive information, and setting forth the company or companies from which the contractor received such information.

(d) The contractor agrees that upon request by the contracting officer it will execute a contracting officer approved agreement with any party whose facilities or proprietary data it is given access to or is furnished, restricting use and disclosure of the data or the information obtained from the facilities. Upon request by the contracting officer, contractor personnel shall also sign such an agreement.

(e) This clause shall flow down to all subcontracts and teaming agreements.

6012.04 Electronic and Information Technology Accessibility (Mar 2011) Each Electronic and Information Technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194 ). If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

The right to Termination of the contract, delivery or task order, purchase or line item without termination liabilities pursuant to the contract termination clauses; or In the case of custom Electronic and Information Technology (EIT) being developed for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm and the contractor shall reimburse the Government for any expenses incurred thereby.

For every EIT product or service accepted under this contract by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either the planned refresh cycle of the product or service, or on the contract renewal date, whichever shall occur first.

In the event of a modification(s) to this contract/order, which adds new EIT products and services or revises the type of, or specifications for, products and services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the contractor provide an update of information provided in the solicitation to identify EIT compliance. Under any maintenance agreement, Contractor agrees to maintain compliance with Section 508 of the Rehabilitation Act of 1973 for all EIT.

In order to comply with 36 CFR 1194 Section 41, the Contractor shall submit all soft copies (e.g., user manuals, product documentation, etc.) in a format that will be readable using assistive technology, (e.g., screen reader). All imbedded charts, graphs, pictures, etc., must be accessible and understandable using a screen reader.

http://www.access-board.gov/sec508/standards.htm#Subpart_b

6012.05 Personally Identifiable Information (PII) (Jun 2013)

A Contractor that designs, develops, or operates a system of records on individuals, or otherwise collects or has access to personally identifiable information (PII) in the performance of this contract shall, prior to taking such action, comply with the following requirements:

(a) The Contractor shall have established policies and procedures in place to safeguard SEC PII. The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding SEC PII and incident management of suspected or confirmed loss of SEC PII in accordance with OMB’s Recommendations for Identity Theft Related Data Breach Notification, September 20, 2006, and OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

(b) The Contractor shall also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 1 and are aligned with the incident categories and timelines referenced in Table J-1 of NIST SP 800-61, as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of SEC data that may contain PII. In support of these requirements, the Contractor shall have:

• policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

• policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

• policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Information Processing Standard 140-2; and

• policies, procedures, and mechanisms that ensure SEC data transmitted across public networks (i.e., the

Internet) by the Contractor, or its employees, agents or subcontractors, are protected using encryption compliant with Federal Information Processing Standard 140-2.

(c) The Contractor shall provide quarterly assessments to the SEC demonstrating that the policies, procedures, and mechanisms required by (b) continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective.

(d) The Contractor shall provide a copy of its privacy policies to the Contracting Officer. The Contractor shall also provide a copy of the policies and procedures (or otherwise make such policies and procedures available) to all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract.

(e) The Contractor shall ensure that those individuals adhere to the Contractor’s policies and procedures relating to PII and to SEC-prescribed policies and procedures for the safe handling of SEC PII, including privacy and security training requirements and privacy incident management.

(f) The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of SEC PII, that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at cops@sec.gov. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of SEC PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Clause, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

(g) The Contractor’s employees, agents, and subcontractors shall utilize the following matrix in regard to incident responses:

Event/Incident Response Time to Notify the SEC Procedure (Who to Notify)

Security Violation

1-3 business days Make initial contact (via a phone call) with one of the SEC Representatives, and no later than the 3rd business day, provide an official letter of notification:

• TO: OIT Security – COPS@sec.gov

• CC:

o SEC Assistant Director o Contracting Officer [CO] o Program/Project Manager o (primary and alternate) Contracting Officer’s

Representative [COR] Quality of Service (i.e. hardware, software, and operations)

Priority An Event/Incident has occurred and is categorized as:

Response Time & Procedure to notify the SEC

Follow-up/Resolution

URGENT –85% or more of the services, systems and/or operations supporting the SEC are impacted, resulting in a major loss of production capacity and/or business interruption to the SEC (E.g. a critical component is down;

operations have been halted; etc.)

30min – 1 hour - via a phone call to the COR, System Owner and Program/Project Manager

As required and/or identified by the COR

HIGH –50-85% of the services, systems and/or operations supporting the SEC are impacted, resulting in a significant loss of production capacity, thus increasing thus increasing the possibility of a business interruption. (E.g. critical components are functioning in a reduced capacity)

1– 2 hours - via a phone call to the COR, System Owner and Program/Project Manager

As required and/or identified by the COR

CONTRACTOR PERSONNEL

6010. 04 Contractor Responsibilities/Standards Of Conduct (Jul 2013)

The Contractor shall furnish all managerial, supervisory, and personnel to successfully, effectively, and efficiently accomplish all work required by this contract. Contractor personnel are employees of the Contractor and under its administrative control and supervision. Contractor personnel are not employees of the Government.

The Contractor shall select, supervise, and exercise control and direction over its employees under this contract. The SEC will not exercise any supervision over the Contractor’s employees, but may, in coordination with Contractor management, provide sufficient direction to contractor personnel to ensure that the purposes of the contract are met and the government’s interests are protected.

Contractor shall be responsible for:

• Approving time cards of its employees.

• Approving leave requests of its employees.

• Performing performance evaluations of its employees.

• Making hiring and firing decisions for its employees.

• Informing its employees that they are not employees of the SEC and have not received an appointment in the federal service.

mailto:COPS@sec.gov

• Informing its employees that they are not to accept direction from employees of the SEC beyond that required to accomplish the purposes of the Contract.

• Informing its employees that deliverables must be marked with employer’s logo or other marking legend (as appropriate to the deliverable) and it must be removable if the SEC elects to use the deliverable as SEC materials. This applies to reports, slides, and other documents called out in the contract as deliverables.

• Informing its employees that the Contractor is responsible for approval of their time cards, leave requests and performance evaluations, and for hiring and firing decisions.

• Directing their employees to identify themselves in their communications (and in their work product as appropriate) as contractors rather than SEC or Federal employees, and ensuring that they in fact do so.

• Directing their employees to display their distinguishing badges or other visible identification of their status as contractors at meetings with government or outside personnel.

• Considering during their performance of the contract whether any actions they are taking would limit the ability of an SEC employee to exercise discretion on an inherently governmental function and bring such actions to the attention of the COR.

The Contractor is accountable to the SEC for the actions of its personnel. The Contractor’s employees, when on-site at SEC facilities under this contract, shall only engage in duties specified in the statement of work, task order or other work statement, and not in other business, or political, charitable, or other duties. The Contractor shall not recruit on SEC premises or otherwise act to disrupt official SEC business. The Contractor shall be responsible when its employees are on site at the SEC for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity, and shall be responsible for taking such disciplinary action with respect to its employees as may be necessary. Contractor employees are expected to adhere to standards of conduct that reflect credit on themselves, their employer, the SEC and the Federal Government.

SECTION 508 REQUIREMENTS

All electronic and information technology (EIT) procured through this award must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www//access-board.gov.

The Contractor shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility standards at 36 CFR 1194. Further, the offer must indicate where full details of compliance can be found (e.g., vendor’s website or other exact locations).

For contracts issued on or after June 25, 2001, Subsection 508(a)(30) of the Rehabilitation Act of 1973 requires that:

When federal departments or agencies develop, procure, maintain or use Electronic and Information Technology (EIT) they must ensure that the EIT allows Federal employees with disabilities to have access to and use of information and that data is comparable to the access to and use of information and data by other Federal employees;

and, that individuals with disabilities who are members of the public seeking information or services from a Federal Department or agency, have access to and use of information and data that is comparable to that provided to the public without disabilities. The Contractor agrees to abide by this law and to ensure that all information created or used under this contract conforms to the above requirements.

1194.31, Functional Performance Criteria, and 1194-41, Information Documentation, and Support - - in order to comply with this Section of 508, the Contractor shall submit all soft copies in a format that will be readable by SEC’s standard screen reader. All imbedded charts, graphs, pictures, etc., must be accessible and understandable through a screen reader. To view the entire text on 36 CFR Part 1194, go to www.section 508.gov or www.access-board.gov and for 48 CFR Subpart 39.2, go to www.arnet.gov/far.

All web sites and applications have to be compliant with Section 508.

6013.00 Common Security Configurations (Mar 2009)

http://www/access-board.gov http://www.section/ http://www.access-board.gov/ http://www.access-board.gov/ http://www.arnet.gov/far

Common security configurations are published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, ‘Security Configuration Checklist Program for IT Products,’ is located at http://csrc.nist.gov/checklists/SP800-70-DRAFT.pdf.

6015.00 SEC On-Site Contractors (Feb 2012)

Space, desk, phone and computer will be made available to on-site contractor personnel at the SEC for use in the performance of their task and will be returned when they are no longer on-site.

6016.00 Supplies (May 2013)

The Contractor shall provide all supplies to support the requirements of this award. The SEC will not provide supplies used in the normal daily performance of work such as note paper, pens, calendars, staplers, etc. If there is a need for specific supplies required by the performance of the work, the Contractor’s Program Manager shall notify the Contracting Officer’s Representative (COR).

6017.00 Communicating Non-public or Sensitive Information (May 2013) When communicating “Non-public or Sensitive information” via email, during the period of this contract, the Contractor shall submit all such communications using Zixmail. ZixMail encrypts outgoing messages, decrypts and validates incoming messages, and authenticates both the sender's and recipient's e-mail identities. The Contractor shall use the following instructions for using Zixmail:*

Login at U.S. Securities and Exchange Commission Secure Email Password Authorization. View message under the “Inbox” tab or create and send new messages from the “Compose” tab. Messages are created and sent similar to a typical e-mail messaging system and include: recipients, CC, subject line, body and attachments.

*Notes: The Contractor shall register a new account first at U.S. Securities and Exchange Commission Secure Email Password Authorization prior to reading or sending encrypted messages. The Contractor will be provided with a link to create an account the first time you send them an encrypted message. This link will also be used by the Contractor subsequently to read and compose messages. The Contractor can only send encrypted e-mail messages from the ZixMail portal to SEC employees. All e-mail contents, including attachments, are encrypted when sent using this method.”

Disaster Recovery Contractor shall create and implement policies, processes and procedures to address the information system security requirements needed for disaster recovery in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned and plan updates will be made available to SEC for review within ten (10) working days of a request by SEC. Furthermore, SEC will be provided a point of contact for disaster recovery planning and exercise for the information service(s) provided.

Information Confidentiality

(a) To the extent that the work under this contract/task order(s) requires that the Contractor be given access to confidential or proprietary business, technical, financial information belonging to the government or other companies, including pre-decisional budget and acquisition sensitive information, the Contractor shall, after receipt thereof, treat such information as confidential and agree not to appropriate such information to its own use or to disclose such information to third parties unless specifically authorized by the contracting officer in writing. The foregoing obligations, however, shall not apply to:

1. Information that, at the time of receipt by the Contractor, is in the public domain;

2. Information, that is published after receipt thereof by the Contractor or otherwise, becomes part of the public domain through no fault of the Contractor;

3. Information that the Contractor can demonstrate was in his possession at the time of receipt thereof and was not acquired directly or indirectly from the government or other companies; and http://csrc.nist.gov/checklists/SP800-70-DRAFT.pdf

4. Information that the Contractor can demonstrate was received by it from a third party that did not require the Contractor to hold it in confidence.

(b) The Contractor shall obtain the written agreement, in a form satisfactory to the contracting officer, of each employee permitted access, whereby the employee agrees that he will not discuss, divulge or disclose any such information or data to any person or entity except those persons within the Contractor's organization directly concerned with the performance of the contract.

(c) The Contractor agrees, if requested by the government, to sign an agreement identical, in all material respects, to the provisions of this clause, with each company supplying information to the Contractor under this contract, and to supply a copy of such agreement to the contracting officer. From time to time upon request of the contracting officer, the Contractor shall supply the government with reports itemizing information received as confidential, proprietary, pre-decisional budget information, or acquisition sensitive information, and setting forth the company or companies from which the Contractor received such information.

(d) The Contractor agrees that upon request by the contracting officer it will execute a contracting officer approved agreement with any party whose facilities or proprietary data it is given access to or is furnished, restricting use and disclosure of the data or the information obtained from the facilities. Upon request by the contracting officer, Contractor personnel shall also sign such an agreement.

(e) This clause shall flow down to all subcontracts and teaming agreements.