Draft_SOW_for_SRP_(4_18_19).pdf

1.0 SCOJ>C

The U.S. Securities and Exchange Commission ("SEC") is searching for a contractor that will provide Trustee and Recordkeeping services for eligible SEC employees in a new defined contribution program that will comply with Section 401 (a) of the Internal Revenue Code (referred to herein as the "Plan" or as the "Supplemental Retirement Plan"). Additional services may include bul are not limited to, loans against existing accounts, compliance by assisting the SEC pertaining to the program, communication and distribution associated with program accounts may be included for eligible employees. Ideally, one contractor will provide a single solution that encompasses these areas aspects of administering the Plan;

however, to the extent administratively feasible (as determined by the SEC), contractors may partner to provide the requested services. Both teaming and subcontracting are permissible under this RFP.

Contractors who choose to subcontract or team must have those arrangements in place prior to responding to this solicitation. If subcontracting is proposed, all labor and materials proposed must be contained within the prime contractor's contract. Furthermore, the prime contractor must disclose to the Government's Contracting Officer (CO) a copy of the subcontract pricing, terms and conditions, or subcontracting agreement. The Government will evaluate the acceptability of any teaming or subcontracting arrangement as part of its evaluation of price. Failure to provide complete supporting documentation may result in no further consideration of the Offeror's offer. In this solicitation, the term "contractor" refers to each separate entity that proposes to pa1tner together to fulfill the SEC's requirements.

The contractor must not be directly regulated by the SEC, but a contractor will not be disqualified solely because it (or one or more pa1tners) is pait of a corporate structure that includes one or more entities that are directly regulated by the SEC. The contractor selected to serve as Custodian must be an entity that is directly regulated by the Office of the Comptroller of the Currency or the National Credit Union Administration. The contractor must be fully insured against any liability it may incur as a result of administering the Plan.

The Plan will hold only employer contributions. Plan patticipants will not be allowed to direct investments; all investment decisions will be made by the SEC. The Plan's objective will be to safeguard the principal and any increases due to interest accumulation. The Plan's objective will not include maximizing return on the principal. The SEC anticipates that the Plan will direct that all assets be invested in a business savings-type account initially, in a manner that will qualify for "pass-through" FDIC insurance as a retirement plan. The SEC may consider moving some of the assets into CDs or Treasury securities or some other secure vehicle at a later date. If the contractor also offers a managed mutual fund solution comprised solely of broad fund classes (not, for example, sector or other limited funds), and employs advisers that are not directly regulated by the SEC who could advise the SEC with regard to its investment options in that product, it should include detailed information of those services (including how and by whom the advisers are regulated) in its response.

lf the contractor has prototype 40l(a) Plan documents, it should provide a copy in its response to this solicitation.

STATEMENT OF WORK

SEC SUPPLEMENTAL RETIREMENT PROGRAM

DRAFT

The contractor will be responsible for:

As Trustee:

• Serve as the Plan Trustee in accordance with the requirements of Section 401(a) of the

Internal Revenue Code.

• Keep the Plan assets in trust (fiduciary responsibility).

• Provide advisory services to the extent necessary for the SEC to appropriately direct the

Trustee to manage the Plan's assets.

• Maintain auditable records of all Plan assets and submit to periodic audits as required by law, including as required to enable the SEC to respond to inquiries by, e.g., Congress, the General Accountability Office, the Internal Revenue Service, etc.

• Receive plan assets hi-weekly via electronic wire transfers from the SEC's payrol I provider ( currently the Department of the lnterior/N ational Business Center

(DOI/NBC)).

• Accept discretionary payments the SEC may choose to make, whether through the SEC's payroll provider or directly from the SEC. Provide reconciliation reports on a monthly basis.

As Recordkeepe1·:

• Separately account for any amounts forfeited by nonvested participants; and

• Notify the SEC any time that balance approaches $250,000 (or the then applicable FDIC insurance limit.)

• Process all relevant paperwork (including associated tax forms) for new and departing participants and (if permitted by the Plan) in-service withdrawals.

• Create and maintain individual pa,ticipant records containing all pe,tinent financial data (e.g., account balance, bi-weekly deposits, withdrawals, allocations of interest or other earnings on the omnibus trust account, vested amounts, non-vested amounts).

This information must be sufficient to meet the FDIC's "pass-through" insurance rules for retirement plans.

• Provide a secure web-based platform for participants to manage and verify all aspects of their individual account, including the ability to enroll, make withdrawal requests

(as permitted by law or by the Plan), view bi-weekly deposits, view amounts credited to their account as share of interest or other earnings on the omnibus trust account, view amounts deducted from their account as share of costs, view amounts vested and amounts not vested, view total individual participant balance, view statements, and submit account inquiries.

• Provide call center services with hours that allow pa11icipants in any continental U.S.

time zone reasonable access to those services, including enrollment support, participants support for inquiries, dispute management, and escalation to SEC-OHR.

• Provide participants with an account statement at least annually, and provide participants the option to receive any such statement(s) electronically or in hard copy.

• Submit to periodic audits of all Plan records and documentation as required by law or upon request by the SEC;

• The contractor must provide all services in a secure web-based environment that is

Section 508 Compliant.

• Ensure compliance with applicable IRS benefit limitations and (as needed) correct plan errors, and ensure corrections are properly recorded with the IRS and other appropriate governing entities.

The contractor will not make any decisions as to employee eligibility, contribution amounts, distributions, or disputes. Authorized Federal employees from the SEC retain all responsibility for making determinations as to eligibility, contribution amounts, distributions, and resolution of disputes.

The SEC estimates that there will be approximately 3300 participants initially, with an annual estimated net increase of 400 participants per year. The SEC estimates that the Plan assets will be approximately

$14 million in 2015, with an estimated annual net increase in holdings of approximately $7 million during the first two years of the Plan. The net increase in holdings after the first two years will depend on whether the Plan allows participants to make in-service withdrawals. The initial plan assets will be I 00% vested, but new investments may be subject to a vesting period. The SEC estimates that the number of withdrawals during the first two years of the Plan will be fewer than 400 per year. The number of withdrawals after the first two years will depend on whether the Plan allows participants to make in service withdrawals. The contractor should identify any limitations on the number of transactions it is able to process per year.

The Plan Description will be drafted by the SEC's outside counsel. A Summary Plan Description (SPD) will be made available, at least electronically, to SEC employees. The contractor will work with SEC

OHR to develop informational materials for electronic and hardcopy distribution to SEC employees, and may use the SPD in that process. The contractor may be required to provide annual updates to informational materials. The contractor will be responsible for ensuring that all such materials are

Section 508-compliant and transmitted to the SEC electronically in a format that is 508-compliant and easily transferrable to the SEC's web environment.

The contractor's recordkeeping solution will go through the SEC information technology security assessment process. A detailed description of the process is in section 4.3.3 Security Assessment.

The contractor's expe1tise must include:

• Understanding contribution and matching principles of the federal government's Thrift Savings

Plan program;

• Understanding governmental or large company payroll operations and transmittal of file data

• Service model that provides a high quality and transparent participant experience; efficient and high-quality plan sponsor experience and consistent plan sponsor reporting mechanisms;

• Reliability and an ongoing commitment to quality and technology;

• High level of data integrity to ensure maximum security of Personally Identifiable Information;

and

• Significant understanding of qualified defined contribution plans, plan features, and provisions of law.

2. Background

The mission of the SEC is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation. The SEC oversees the key pa11icipants in the securities industry, including securities exchanges, securities brokers and dealers, and investment advisors.

As part of the SEC's compensation model, it is establishing a supplemental retirement program in addition to standard federal retirement programs such as Federal Employees Retirement System (FERS), the Civil Service Retirement System (CSRS), and the Thrift Savings Plan (TSP) for eligible employees.

This supplemental retirement plan will have the potential to include all of the SEC's 4000+ employees, who are located in the Washington, DC headquar1ers office as well as all regional offices throughout the

US. Travel to the SEC's headquarters in Washington, DC may be required for familiarization and design of financial reports to support the Agency's repo11ing for the supplemental retirement program.

3. Business Requirements

3.1 - The information specified in the Scope and Business Requirements section of this Scope of Work are general descriptions of the services for which the SEC is requesting to be performed. Any specific details relating to said services and the roles and responsibilities of the parties will be located in the

Wells Fargo services agreements and the provisions of such service agreements shall apply where they are consistent with and do not conflict with the Scope and Business Requirements section of this Scope of Work.

3.1.1 - The contractor will provide trustee and recordkeeping services for SEC's supplemental retirement program. Trust and custodial services should safeguard assets and meet the Plan's accounting, financial reporting, and internal control requirements. The contractor will also provide recordkeeping services, through a system that is configurable and scalable.

The SEC will develop the Supplemental Retirement Plan rules and related requirements. Such mies and requirements will, among other things, provide for strict controls to prevent contractor's discretion to make entitlement determinations, calculate distribution amounts, or resolve disputes. An audit of contractor actions will be within the scope ofresponsibilities of the SEC. The rules and requirements will be provided to the contractor before work begins. The contractor must understand the SEC Supplemental

Retirement Plan design and rules, data elements, accounting, financial, and auditing requirements. Tasks

. identified under each area of responsibility ( e.g., Trustee Record-keeper) below will be performed by the contractor.

As Trustee:

a. Serve as the Plan Trustee in accordance with the requirements of Section 40 I (a) of the

Internal Revenue Code.

b. Keep the Plan assets in trust (fiduciary responsibility).

c. Provide advisory services to the extent necessary for the SEC to appropriately direct the

Trustee to manage the Plan's assets.

d. Maintain auditable records of all Plan assets and submit to periodic audits as required by law, including as required to enable the SEC to respond to inquiries by, e.g., Congress, the

General Accountability Office, the Internal Revenue Service, etc.

e. Accept bi-weekly census data from SEC's payroll provider, currently the Department of

Interior/National Business Center (DOI/NBC);

f. Receive plan assets bi-weekly via electronic wire transfers from the SECs payroll provider

(currently the Department of the Interior/National Business Center (DO1/NBC)).Accept discretionary payments the SEC may choose to make, whether through the SECs payroll provider or directly from the SEC.

3.2 -The contractor will provide a non-developmental recordkeeping system that is configurable and scalable to meet the needs of the SEC's Supplemental Retirement Plan. Electronic platforms (front end and back end) similar to those used by financial institutions, the Federal Thrift Savings Plan

(www.tsp.gov), and 40I(k) providers are an acceptable solution. The platform will be hosted by the contractor, not the SEC. The deployment date for the system is scheduled for August 2015. The SEC will request a presentation of the solution as pa11 of the evaluation process. Tasks identified below will be performed by the contractor. Deliverables associated with these tasks are identified in the Schedule of

Deliverables, paragraph 8.3.

a. Provide reconciliation reports on a monthly basis.

b. Separately account for any amounts forfeited by nonvested participants.

c. Notify the SEC any time that balance approaches $250,000 (or the then- applicable FDIC insurance limit).

d. In conjunction with SEC-OHR, create informational materials describing the Plan in easy to understand terms, including any options for withdrawals, limitations on participation, vesting requirements, FAQs, etc. for distribution and use by SEC employees;

e. Create standard forms for use by SEC employees (e.g., beneficiary identification or change, requests for withdrawal or rollover, declarations, etc.);

f. Receive and maintain beneficiary forms and other declarations/directives for each participant;

g. Provide management repo,ts, including bi-weekly reconciliations of account balances;

h. Reconcile account activities with the Trustee;

i. Process requests for withdrawals (i.e., confirm withdrawal is allowable under the Plan, send instructions to Trustee for delivery of payment to the withdrawing participant, timely prepare and submit any tax forms necessary to report withdrawal, and any other required recordkeeping or paperwork);

j. Provide the SEC any documentation necessary or helpful to suppo1t DOL and IRS filings and compliance requirements;

k. Monitor combined employer and employee deferral limits and develop safeguards to ensure no pa1ticipant exceeds applicable tax deferral limits, and develop a written plan for resolving any unintentional noncompliance with tax laws, rules, or regulations;

I. Provide termination notices to former employees or those who are no longer eligible to receive agency contributions;

m. Provide call center services with hours that allow pa1ticipants in any continental U.S.

time zone reasonable access to those services, including enrollment suppo,t, support for participants inquiries, case management and escalation; (Reference 8.5 of the SOW)

n. Provide participants with an account statement at least annually, and provide participants the option to receive any such statement(s) electronically or in hard copy;

o. Provide the SEC with a data file, on an annual basis, of all participant records by each individual, reflecting bi-weekly contributions; all disbursements, interest applied, fees assessed and year end account status for the plan year. This file must be provided electronically within 30 days of the end of each plan year; and

p. Provide all services in a secure web-based environment.

3.2.1 - Informational Materials -

• Create informational materials describing the Plan in easy-to-understand terms, including any options for withdrawals, limitations on participation, vesting requirements, FAQs, etc. for distribution and use by SEC employees. These materials will be narrative and include graphics necessary to convey highlights and other pertinent facts and instructions of the Plan. The document length could be up to six double sided 8 1/2 by 11 pages;

• Create standard forms for use by SEC employees (e.g., beneficiary identification or change, requests for withdrawal or rollover, declarations, etc.). Forms should be fillable, replicable from screen to print and to the greatest extent allowable accept electronic signatures; and

• At least annually or more frequently, all forms and informational materials will be reviewed and an assessment as to revisions will be made. All documents should be 508 compliant and be made available electronically.

3.3 - The contractor will not make any decisions as to employee eligibility, contribution amounts, distributions, or disputes. Authorized Federal employees from the SEC retain all responsibility for making determinations as to eligibility, contribution amounts, distributions, and resolution of disputes.

3.4 - The contractor will be responsible for ensuring compliance with applicable IRS maximum elective deferral limits, annual addition limits, and any other applicable laws and regulations governing retirement plans. The contractor will be responsible for correcting plan errors and ensure corrections are properly recorded with the IRS and other appropriate governing entities.

3.5 -The Plan will cover only Federal government employees and as such the Plan is not subject to ERISA. However, the contractor shall be capable of delivering financial disclosures similar to those required when a plan is subject to ERISA as required by the Department of Labor, IRS or other regulatory concerns. These deliverables should be provided at the intervals prescribed by applicable law.

3.6 -The contractor must respond to telephone and e-mail inquiries by SEC employees (pa1ticipants) and representatives (SEC plan administrators) and return calls/messages within one (I) business day.

3.7 - Travel to the SEC's headquarters in Washin!,'10n, DC may be required, for familiarization and design of financial repo1ts to support the Agency's repo1ting for the supplemental retirement program. Once the

Plan is operational, periodic travel may be required to SEC's headqua1ters to confer on matters pertaining to governance.

3.8- The contractor must ensure privacy and security of all data, maintaining the Commission's standards for the handling of sensitive data.

Safeguarding of Information/Maintain Privacy and Security Note the following:

Incident Reporting: Jf Contractor knows of any actual unauthorized access, use, corruption, loss or disclosure of SEC pa1ticipant data, then Contractor shall promptly report such incident and immediately, so as to contain the incident, establish countermeasures to mitigate the impact of the incident, and recover from it. The party discovering the incident in accordance with its procedures will report security incidents.

4.0 Fede1·al Requirements & SEC Regulations

Security Requirements. Contractor shall and shall cause implement, maintain and enforce administrative, physical, logical, and other security measures to prevent the unauthorized access, use, corruption, loss or disclosure of confidential information. Contractor shall utilize security parameters that are consistent with the more stringent of the following: (a) industry best practices; (b) Supplier's information security policies and (c) Laws and Regulatory Requirements applicable to the protection and use of Company Data and Confidential Information. Supplier shall and shall cause the Supplier Agents to encrypt all Company Data during transmission and shall provide proper, secure and lawful storage, transmission and disposal of the Company Data and Confidential Information.

Contract shall comply with applicable federal requirements and SEC regulation pertaining to information protection.

4.1 Requirements Management. The Contractor will provide all necessary personnel, administrative, financial, and managerial resources necessary to perform all tasks described in this Statement of Work (SOW).

4.1.1 Security Issue Review. Contractor shall conduct regular self-testing and independent audits to ensure that Contractor is in compliance with all applicable Laws and Regulatory Requirements, including all confidentiality, non-disclosure, security, disaster recovery, contingency planning, and obligations applicable to Contractor. The Contractor must remediate problems identified during these regular self testing and independent audits.

4.2 Project Management

4.2.1 Project Coordination. The Contractor shall coordinate with the COR and/or existing SEC Program/Project Managers shall provide regular project plan and schedule updates. It is expected that the Contractor Technical Specialist - Client Relationship Specialist will drive the day-to-day aspects of the project for the Contractor and provide regular and appropriate updates to the COR and/or existing Program/Project Managers.

4.2.2 Project Status Reports. The Contractor must prepare and deliver to the COR periodic formal Project Status Repo11s and more frequent informal written status updates.

4.3 Project Meetings

4.3.1 Kick-Off Meeting. Within one ( 1) week after the award, the Contractor will pa1ticipate in a kick-off meeting attended by Key Contractor personnel, the SEC Contracting Officer (CO), the Contracting Officers Representative (COR), and other key SEC personnel to introduce project members and their roles and responsibilities, introduce the SEC "Rules of the Road", and discuss the requirements of the systems, the project schedule, security requirements, connections and restrictions, at a minimum.

4.3.2 Status Meetings. The Contractor must participate in periodic project status meetings attended by key Contractor personnel, the COR and other key SEC personnel.

4.3.3 Meeting Minutes. The Contractor must provide kick-off and status meeting minutes to the COR for review. The Contractor must work with the COR to resolve any disagreements that may arise and provide the COR with final meeting minutes for review and approval.

4.3.4 Briefings. The Contractor must prepare and deliver quarterly briefings that cover key project accomplishments including milestones met and deliverables. The briefing must address matters that are essential to ensure overall success of the task including funding status, project schedule, and an analysis of the risks that may affect successful task completion. The Contractor must provide the COR with briefing materials for review prior to the presentation. The Contractor must incorporate feedback from COR and must provide the COR with final briefing materials for review and approval.

4.4 Project Plans. The Contractor must develop and document a plan for implementation plan the project that addresses considerations including, but not limited to:

• Possible business process and associated standards/procedures redesign and definition;

• Business process/system integration;

• Coding, configuration, and customization;

• Coordinated documentation, testing, and schedule;

• Production deployment which includes a back-out plan;

• Training;

• Communications/change management; Transition from manual and paper-based system of records; and

• Methodology for transitioning participant's records and data (electronic and paper) to SEC at prescribed intervals and upon conclusion of the contract. To include a description of processes used to transition services to a successor provider; and procedures for data disposal and certification of data disposal.

The Contractor must review the implementation plan with the COR and relevant stakeholders. The Contractor must deliver the document to the COR for review; the Contractor must incorporate feedback from the COR and must provide the COR with a final document for review and approval. The approved Project Schedule will become the baseline for the contract. The Contractor shall notify the COR of any deviations or changes to the plan, the reasons for changes, and shall provide the COR with written draft of updates to the plan for review and approval.

5.0 Risk Management - The Contractor shall coordinate and assist the COR to develop and maintain a Risk Registry throughout the lifecycle of the project. The Contractor shall immediately notify the COR of any major risk to the project and provide recommendation on the mitigation of the risk.

6.0 PACKAGING AND MARKING

6.1 Packaging and Marking. Preservation, packaging, packing and marking of all deliverable contract line items must conform to normal commercial packing standards to assure safe delivery at destination.

6.2 Marking. All information submitted to the Contracting Officer or the COR, or their designated point of contact, must clearly indicate the number of the contract for which the information is being submitted.

7.0 INSPECTION AND ACCEPTANCE

7.1 Inspection and Acceptance. Inspection and acceptance of the supplies and/or services to be furnished under this contract will be performed by the COR. The COR will assess performance of Contractor personnel on an ongoing basis, and communicate the results to the Contractor. The COR will not discuss pe1formance concerns with Contractor personnel. Should a problem arise regarding performance or the overall level of service, the contactor shall have no more than three

(3) business days in which to correct the problem. This may result in the SEC's requesting that the Contractor remove Contractor personnel from performing under the contract.

8.0 DELIVERIES OF PERFORMANCE

8.1 Period of Performance. The period of performance is two (2) years from date of award, with three (3) one-year option periods to follow the base year.

8.1.1 Option Pet·iods. This contract has three (3) one-year option periods. If all options are exercised, the period of performance will not exceed a total of five (5) years six (6) months (the contract may be extended up to six months). If exercised, the period of performance for each successive option will begin the day after the expiration of the previous year and continue for one year.

Exercise of any option requires a modification signed by an SEC Contracting Officer.

8.1.2 Award of an initial contract will not obligate the Government to exercise any contractual option.

Prior to exercising any option, the Government will make a determination that (I) funds are available, (2) the requirement covered by the option fulfills an existing need of the Government, and (3) the exercise of the option is the most advantageous method of fulfilling the Government's need, price and other factors considered.

8.1.3 Failure to exercise an option will not obligate the Government to pay any charges other than the contract price including exercised options.

8.2 PJace of Performance. Services will be performed electronically in a vi11ual environment, therefore, the contractor must be able to perform services to all SEC employees, who are located throughout the continental US.

8.3 Schedule of Deliverables. The Contractor must prepare and provide deliverables in electronic format to the COR. The COR will review all deliverables and provide comments and/or approvals/disapprovals in a timely manner so as not to adversely impact the project schedule.

Deliverable schedules may include, but will not be limited to, the following:

? �'r-l-·

Ii Schedule

Section ' ,Delive11able

3 Business Requirements Per approved project schedule

3.2.1 Informational Materials ;

Per approved project schedule

4.2.2 Project Status Reports

Per approved project schedule

4.3.3 Security Assessment Per approved project

schedule

4.3.4 Briefings Per approved project

schedule

I

4.5 Project Meetings Per approved prqject

schedule '

4.6 Project Plans

Per approved project schedule

5 Risk Management Per approved project schedule

Contractor Per approved project

9.12 Performance

Evaluation schedule

9.17 508 Compliance Per approved prqject schedule

8.3.1 Documenting, Inspecting, and Accepting Contract Deliverables. The Contractor must submit all deliverables requiring a transmittal sheet with either the attached Deliverable Transmittal sheet or an alternative transmittal sheet that contains substantially the same information.

8.4

8.5

Place of Delivery. The deliverables to be furnished under this contract must be delivered to the following addresses:

U.S. Securities and Exchange Commission Station Place 100 F Street NE Washington, D.C. 20549 Attn: TBD

Hours of Per·formance. The Contractor must be available during normal business hours on all Federal Government business days during the term of the contract. This support must occur during normal business hours between 7:00 AM to 7:00 PM. EST, Monday through Friday, excluding Federal holidays and official Federal Government closures in the Metropolitan DC area. However, the SEC may require services outside of regular business hours. Exceptions may be made on a case-by-case basis and must be pre-approved by the Government COR.

9. SPECIAL CONTRACT REQUIREMENTS

9.1 Type of Contract. It is anticipated that this agreement will be a hybrid contract awarded in patt on a Firm Fixed Price (FFP) basis and in part on a Time & Materials (TM) basis.

9.2 Security and Privacy Act Matters. The security classification for work performed under this contract is Public Trust. The documents that must be reviewed and produced are non-public and sensitive in nature and must be protected from unauthorized disclosure. Work on this project requires that personnel have access to information cover under the Privacy Act. Personnel must adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

9.2.1 Conflicts of Interest.

(a) General. Subpart 9.5 of the Federal Acquisition Regulation 48 C.F.R. 9.5, prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving organization conflicts of interest.

(b) Purpose. The purpose of this clause is to avoid, neutralize, or otherwise mitigate organizational conflicts of interest which might exist related to a Contractor's performance of work required by this contract. Such conflicts may arise in situations including, but not limited to: a Contractor's participation, as an Offerer or representative of an Offerer, in a procurement in which it has provided assistance in the preparation of the Government's requirements and specifications; a Contractor's providing advisory assistance to the Government in a procurement in which the Contractor's firm or one which the Contractor represents is an actual or potential Offerer; and a Contractor's participation, as an Offeror or representative of an Offeror, in a procurement where the Contractor has obtained confidential or proprietary information relating to competing Offerors as a result of the Contractor's work on prior task orders.

(c) Definition. For purposes of this clause, the term "Contractor" means: The Contractor; any of the Contractor's parents, affiliates or other entities in which the Contractor or such parents or affiliates have a financial interest; successors in interest to the Contractor or any of its parents or affiliates; proposed consultants or subcontractors at any tier; and employees thereof.

(d) Restrictions. The Contractor agrees:

1. To remain ineligible to pa1ticipate in any capacity (including participating as a prime

Contractor, subcontractor, or as the representative of another party) in contracts, subcontracts, or Proposal (whether solicited or unsolicited) that directly relate to the Contractor's performance of work under this Contract.

2. Prior to beginning work on a task order, to execute such Confidentiality Agreements, Statements of Non-Disclosure or other documents which the Contracting Officer may, in his/her sole discretion, require in order to protect the proprietary nature or confidentiality of information provided by the Government or otherwise received by the Contractor in connection with its work under this Contract.

3. Within the appropriate regulatory timeframe notify the Contracting Officer of any offer of compensation, other form of payment, or thing of value, made by a broker, potential lessor, or any source other than the Government to the Contractor related to services rendered under this Contract, regardless of whether such offer was made during Contractor's performance of work under a given task order or subsequent to Contractor's completion of work under such task order.

4. Prior to the acceptance of a task order request, to immediately notify the Contracting Officer of any potential conflict of interest which would prevent or limit the Contractor's ability to perform the work requested?

5. To immediately notify the Contracting Officer of any conflict of interest discovered during Contractor's performance of work pursuant to a Government issued task order;

provided that the Contracting Officer shall have the right to impose such restrictions as he/she deems appropriate on Contractor's performance based on the existence of such a conflict or, if the Contracting Officer determines that such restrictions would not adequately address the conflict of interest at issue, to terminate the Contractor's performance of work under the task order at no cost to the Government.

6. As otherwise provided in this Contract, that if the Contractor declines to accept a task order request and subsequently participates (either directly or as a representative of another patiy) in a Government contracting action that was the subject of the task order request, then the fee which the Contractor would have been entitled to receive for su.ch task order work or the fee actually paid by the Government for the task order's performance by another Contractor, whichever is greater, shall be applied toward the Contractor's minimum ordering guarantee.

7. That in the event that Contractor knowingly withholds the existence of a conflict of interest from the Government, that the Contracting Officer may terminate this Contract at no cost to the Government and any minimum guarantee(s) otherwise applicable to the Contractor will be forfeited; provided, that the foregoing shall be in addition to all other remedies and causes of action which the Government may have against the Contractor, including the suspension and/or debarment of the Contractor.

8. To ensure that conflicts are appropriately identified with respect to any subcontractors and those measures are taken to alleviate and/or eliminate conflicts where they are identified with respect to a particular subcontractor.

9. That, in addition to the remedies enumerated above, the Government may terminate this Contract for cause in the event of the Contractor's breach of any of the above restrictions.

9.3

9.3.1

Compliance with Regulations. The Contractor must comply with all statutes, regulations, directives, instructions, and references applicable to the conduct of this acquisition as imposed by the Federal Government and the SEC, including, without limitation, those specified or referred to in this contract.

The Contractor shall provide the SEC access to the following information for review:

o Documentation that supports a risk assessment based on standards established by the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37. The documentation shall include results of 3rd party assessments, security controls test results, system security plans (SSP), weakness remediation plans of action and milestone (POA&M), incident reports, and evidence of ongoing information security risk management activities.

o Documentation related to compliance with Office of Management and Budget (OMB) Memorandum 03-22 and OMB Circular A-130 requirements for privacy assessments. This documentation shall include results of third party privacy assessments, privacy impact assessments, system privacy plans (SPP), and privacy control assessments (PCA).

o Cybersecurity and privacy policies and procedures, including policies and procedures for cybersecurity and privacy incident/breach response.

9.4.1 Restrictions on Use, Disclosure, and Duplication of Confidential and Non-Public

Information. Confidential and non-public information, for purposes of this clause includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential and non-public information must not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor, and its employees, agents, subcontractors, and subcontractor personnel are restricted f r om duplicating or disclosing confidential or non-public information, in whole or in part, outside the SEC for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived f r om confidential or non-public information will be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

9.5 Non-Disclosure Agreement for Confidential and Non-Public Information. Rules 3(b)(I) and 3(b)(7) of the SEC's conduct regulation (17 C.F.R. 200.735-3(b)(I) and (7)) expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by the provisions of rules 3(b )( 1) and 3(b )(7) of the SEC's conduct regulation and the terms set fo11h in the attached non-disclosure agreements (Attachment F). The Contractor and all personnel assigned to the contract agree not to divulge to any unauthorized person non-public or confidential information obtained from the SEC in performance of their duties under the contract.

The Contractor must submit to the Contracting Officer the names of key personnel assigned to the contract. Each employee, agent, and subcontractor that will be authorized access to SEC information by virtue of performing the requirements set fo11h in this contract must be made aware of the obligation to not divulge non-public or confidential information as per the terms of the Non-Disclosure Agreement signed by a Contractor representative. Violation of this clause by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or civil suits and/or criminal prosecution.

9.6.5 Personnel. The Contractor must provide skilled personnel required for the effective and efficient performance of this contract. The SEC reserves the right to review all resumes of all key personnel assigned to this contract. The SEC has the right to request that the Contractor remove Contractor personnel from working under this contract, at any time, for any reason.

9.6.6 Key Personnel. The Contractor must designate specific key personnel who are essential to the successful performance of this contract.

9.6.7 Contractor Substitution of Key Personnel. Following award, and throughout the life of this contract, the Contractor will permit no substitution of key personnel without the written consent which shall not be unreasonably withheld of the Contracting Officer, unless such substitutions are necessitated by an individual's sudden illness, death or termination of employment. In the event that substitution of personnel is desired, the Contractor must notify the Contracting Officer in writing at least thirty (30) calendar days before any key personnel substitution is made, if possible. The Contractor must submit a justification in sufficient detail to permit evaluation of the impact on the contract or its performance, with the resume of the proposed replacement

Non-Disclosure Requirements . Required non-disclosure forms are attached and must be completed and returned to the Contracting Officer before starting work under this contract.

9.4

9.3.2 SEC employee, contractor, or agent who will have access to this information for review shall comply with the obligation to not divulge any confidential information as per 17 C.F.R. § 200.735-3(b)(2)(i), unless where required by law to disclose such information.

personnel. The Contractor must obtain the Contracting Officer's written approval prior to any changes in the contract pai1icipation of the personnel named as key personnel. Proposed substitute personnel must have experience and education at least substantially equal to those of the personnel being replaced. Requests for substitutions must provide a detailed explanation of the circumstances necessitating such changes, a resume for each proposed substitute, and any other information as requested by the Contracting Officer. The Contracting Officer will evaluate such requests and promptly notify the Contractor of approval or disapproval thereof.

9,6,8 Contractor Responsibilities/Standards of Conduct (Nov 2012). The Contractor will furnish all managerial, supervisory, and personnel to successfully, effectively, and efficiently accomplish all work required by this contract. Contractor personnel are employees of the Contractor and under its administrative control and supervision. Contractor personnel are not employees of the Government.

The Contractor will select, supervise and exercise control and direction over its employees under this contract. The SEC will not exercise any supervision over the Contractor's employees, but may, in coordination with Contractor management, provide sufficient direction to contractor personnel to ensure that the purposes of the contract are met and the government's interests are protected.

Contractor will be responsible for:

• Approving time cards of its employees;

• Approving leave requests of its employees;

• Performing perf<;mnance evaluations of its employees;

• Making hiring and firing decisions for its employees;

• Informing its employees that they are not employees of the SEC and have not received an appointment in the federal service;

• Informing its employees that they are not to accept direction from employees of the SEC beyond that required to accomplish the purposes of the Contract;

• lnforming its employees that the Contractor is responsible for approval of their time cards, leave requests, performance evaluations, and for hiring and firing decisions;

The Contractor is accountable to the SEC for the actions of its personnel. The Contractor's employees, when on-site at SEC facilities under this contract, will only engage in duties specified in the statement of work, task order, or other work statement, and not in other business, or political, charitable, or other duties. The Contractor will not recruit on SEC premises or otherwise act to disrupt official SEC business. The Contractor will be responsible when its employees are on-site at the SEC for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity, and will be responsible for taking such disciplinary action with respect to its employees as may be necessary. Contractor employees are expected to adhere to standards of conduct that reflect credit on themselves, their employer, the SEC, and the Federal Government.

9. 7 Personally Identifiable Information (PH). A Contractor that designs, develops, or operates a system of records on individuals, or otherwise collects or has access to personally identifiable information (PII) in the performance of this contract must, prior to taking such action, comply with the following requirements:

(a) The Contractor must have established policies and procedures in place to safeguard SEC PJI.

The policies and procedures must provide the Contractor's processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures must also cover training of employees on their roles and responsibilities for safeguarding SEC PII and incident management of suspected or confirmed loss of SEC PII.

(b) The Contractor must also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and are consistent with industry accepted information security standards, such as those recommended by the National Institute of Standards and Technology (N 1ST) and International Standard ISO/IEC 2700 I ("ISO 27001 ") or its successor provisions, including ISO 27002. In support of these requirements, the Contractor must have:

• policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized patty;

• policies, procedures, and mechanisms that ensure SEC data on portable devices are protected using encryption that is consistent with industry accepted information security standards and

• policies, procedures, and mechanisms that ensure SEC data transmitted across public networks (i.e., the Internet) by the Contractor, or its employees, agents or subcontractors, are protected using encryption that is consistent with industry accepted information security standards.

(e) The Contractor will ensure that those individ�als adhere to the Contractor's policies and procedures relating to PII.

(f) The Contractor's must promptly ale1t the SEC of any confirmed loss of SEC Pll, that will affect the privacy rights of individuals or which violates any federal law, regulation, mandate by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at soc@sec.gov. The Contractor must act in accordance with its policies and procedures in the event of any loss of SEC Pll and must start an investigation of the incident and take all appropriate actions to remediate the effects of the incident and mitigate any risk that may arise from the incident. The Contractor shall preserve all records and other evidence relating to the incident and provide the SEC with a written report on outcome of its investigation including any risk to SEC PII, the corrective action Contractor will take, or has taken to respond to the incident and such other information as the SEC may reasonable request.

9.8 Disaster Recovery. Contractor must create and implement policies, processes and procedures to address the information system security requirements needed for disaster recove1y in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recovering the information service(s) provided.

9.9 App1·oval of Subcontracts. The Government reserves the right to request that the Contractor not allow any subcontractor selected by the Contractor to perform work under this contract due to work performance, conflicts, and/or other issues of concern to the SEC. Therefore, the Contractor must provide the SEC the names of the subcontractors performing any work required by this contract and a description of services being performed.

9.10 Travel. There will be no reimbursement for travel expenses incurred within the Washington, DC metropolitan area. In the event that a requirement for travel outside of the Washinbrton DC metropolitan area arises, travel must be pre-approved by the COR by submitting travel plans with names, dates, locations and estimated expenses at least two business weeks in advance of the planned travel. If the place of performance is other than the SEC Headquarters, travel may be allowable and reimbursable subject to the following limitations:

I. Any subsistence allowance (i.e., meals and lodging) is limited by a per diem allowance prescribed by the Federal per diem schedule -http:/ /www.gsa.gov/Po1tal/gsa/ep/content View .do?contentld= I 7943&contentType=G SA

_BASIC;

2. Expenses incurred as a result of travel using a personal automobile are reimbursed as prescribed on the link above;

3. Reimbursement of air and train travel is limited to the most economical rate and reasonably traveled route; and

4. Each out-of-pocket travel and allowable miscellaneous administrative expense exceeding $75 requires a receipt that is to be attached to the invoice. The Contractor will submit the required documentation to the COR no later than five (5) business days after completion of each trip. In most cases travel may be one trip per month for 1-2 days; in some circumstances it may be two day trips. If travel is allowable the SEC follows the Federal Travel Regulation regarding use of government rates for travel.

9.11 Government-Furnished Equipment. With the exception of incidental items associated with on site performance (furniture, desktop computers, copiers, etc ... ), the Contractor must furnish all personnel, management, equipment, supplies, and services necessary for performance of all aspects of the contract. Unless explicitly stated otherwise, the Contractor is responsible for all costs associated with and incurred as part of providing the services outlined in this contract.

NOTE: Items such as handheld devices and laptops will not to be provided.

9.12 Contractor Performance Evaluation. Prior to the exercise of an option under the contract/order or at the end of the conclusion of work under the contract/order, the SEC will submit an electronic record of the Contractor's performance to the…