att_D_Confidentiality_and_Non-Disclosure_Agreement.pdf

Attachment D

Confidentiality and Non-Disclosure Agreement

Solicitation No. 73350R0011

Contract No. ________________

I. Introduction

This Confidentiality and Non-Disclosure Agreement (Agreement) is executed between the U.S.

Small Business Administration (SBA) and the undersigned Contractor in conjunction with SBA

Solicitation No: 733510R0011 / Contract No. __________ (Contract). SBA’s execution of this

Agreement is accomplished through its signature on the Contract modification incorporating this

Agreement into the Contract.

Federal law provides that only authorized persons or entities may access records which are contained in a system of records maintained by SBA and that are retrieved by an individual’s name or personal identifier. In particular, Personally Identifiable Information (PII), as defined below, is protected from disclosure to the public. These legal restrictions include the Privacy Act of 1974, as amended (5 U.S.C. § 552a) (the Privacy Act); 13 C.F.R. part 102, subpart B; OMB

Circular A-130, Appendix III; and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

Pursuant to 13 C.F.R 102.34, all regulations contained in 13 C.F.R. part 102, subpart B, shall apply to Contractor during their performance of the Contract for purposes of the sanction provisions of the Privacy Act, including without limitation civil remedies such as damages and injunctive relief, 5 U.S.C. § 552a(g), and criminal penalties, 5 U.S.C. § 552a(i), for violations of the Privacy Act.

In addition, other Federal laws obligate SBA to establish controls to limit access to Confidential

Information, as defined below, which is included in SBA records regardless of whether it is contained in a System of Records. Applicable laws include without limitation, the Freedom of

Information Act (FOIA), 5 U.S.C. § 552, and the Trade Secrets Act, 18 U.S.C. § 1905 (Trade

Secrets Act).

II. Definitions

“Confidential Information” means non-public information provided to Contractor by SBA in connection with Contractor’s performance of the Contract, or that Contractor otherwise obtains or develops in connection with its performance under the Contract. Non-public information includes but is not limited to information about SBA’s program participants (SBICs), portfolio companies of SBICs, and SBA’s business, economic, and policy plans, and SBA financial, and

Agency related information that SBA has not made available to the public. Confidential

Information includes: PII, information related to the conduct of a Federal agency procurement;

FOUO; non-public information owned by, generated by or in the possession of SBA; information to which Contractor is given access by SBA or which Contractor may obtain by other means during the course of performing the Contract that is commercially valuable, market sensitive, proprietary, or related to an SBA oversight, examination or enforcement matter; information

Contract No. _____________________ subject to a legal privilege benefitting SBA; and information otherwise deemed sensitive or confidential by an SBA office head, regardless of whether SBA has labeled the information as confidential or sensitive, and is not otherwise available to the public. Confidential Information includes information that contains any element of confidentiality, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of SBA

Confidential. Confidential Information may take any form, including, but not limited to, Data and unrecorded conversations. Additional examples of Confidential Information include SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act. Confidential

Information includes personal and business financial information that is protected from public disclosure by Federal law, including without limitation FOIA, the Trade Secrets Act, and the

Privacy Act.

“Contractor” means the undersigned entity entering this Agreement with the SBA.

“Data” means written, oral, electronic or other recorded information, regardless of form or the media on which it may be recorded. The term includes without limitation technical and statistical data, computer software, computer files, electronic mail, and video recordings.

“For Official Use Only information” or “FOUO” means unclassified information of a sensitive nature, not otherwise categorized by statute or regulation, the unauthorized disclosure of which could adversely impact an individual or entity’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.

“Need-to-know” means the determination made by an authorized holder of information that a prospective recipient requires access to specific information in order to perform or assist in a lawful and authorized governmental function, i.e., access is required for the performance of official duties.

“Personally Identifiable Information” or “PII” means information which can be used to distinguish or trace an individual’s identity, such as their name, address, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. This also includes, but is not limited to, education, financial information (e.g., account number, taxpayer identification number, access or security code, password and personal identification number), medical information, investigation report or database, criminal or employment history or information, or any other personal information which is linked or linkable to an individual.

“SBA Data” means all proprietary Data in SBA’s possession and all Data produced or developed by, or on behalf of, Contractor in connection with the performance of the Contract, and all Data provided by SBA to the Contractor, which is related to the Contractor’s performance of the

Contract.

III. Terms of Agreement

1. Agreement to Maintain Confidentiality. Contractor agrees that any and all SBA Data and

Confidential Information is and will remain the property of SBA; is privileged and confidential; and any release or disclosure of SBA Data or Confidential Information is subject to SBA prior written approval. Contractor shall abide by Federal government and

SBA requirements in this Agreement, Contract, and in policy guidance, regulations, and statute, for protecting PII and Confidential Information as it exists on the date of this

Agreement and including any changes to such guidance after the date of signature. Such requirements include but are not limited to, the Privacy Act, 13 C.F.R. part 102, subpart B, and SBA SOP 90 47 4, Information Technology Security Policy, SBA’s Information

Technology Rules of Behavior, and the Trade Secrets Act.

2. Use of SBA Data and Confidential Information. Contractor will review and use SBA Data and Confidential Information only as authorized by SBA in writing and solely for the purpose of performing its duties under the Contract and not for any other purpose, including but not limited to any commercial, personal or other purpose not contemplated by this

Agreement. Contractor understands that SBA may conduct inspections of any of the

Contractor’s documents or files (electronic or hard-copy) related to its performance of this

Contract , at any time or place, for the purpose of ensuring compliance with any terms or conditions under this Agreement. SBA Data and Confidential Information containing PII is prohibited from being used as test data or stored in a non-production processing environment for development/testing.

3. Clearance Form. The Contractor shall complete a Form 1228 “Computer Access/Clearance

Form” and submit it to the COR to begin the mandatory clearance process at the beginning of

Contractor’s assignment to the Contract.

4. Physical Safeguards. Physical access to the Contractor’s office areas that contain

Confidential Information or SBA Data (including SBIC or portfolio company information and any other data subsequently identified by SBA as confidential, sensitive or PII), shall be controlled to prevent unauthorized personnel from acquiring access to such data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. The Contractor shall change any passwords associated with access to

Confidential Information or SBA Data every 90 days.

5. Protection of SBA Data and Confidential Information. Contractor will take all actions reasonably necessary to preserve and protect any privilege or claim of confidentiality related to the SBA Data and Confidential Information as well as any information derived therefrom, including but not limited to, maintaining such safeguards and internal controls as are necessary and appropriate. Confidential Information and SBA Data received by the

Contractor must be protected by Contractor against unauthorized use, release, disclosure and modification. The Contractor shall immediately notify the COR upon discovery of any unauthorized use, theft, loss, misplacement, unauthorized release or disclosure of SBA Data or Confidential Information whether or not the Contractor is personally involved. The

Contractor must refer all requests for access to SBA Data or Confidential Information to the

SBA COR.

6. Disclosure Prohibition. Contractor shall not release or disclose SBA Data or Confidential

Information, either orally, or in written, electronic or any other form, to any person or entity, without the express written consent of the Contracting Officer’s Representative (COR), as named by the Contract. Confidential Information and SBA Data may only be disclosed to personnel employed by Contractor or one of its subcontractors with a Need-to-know, as defined in this Agreement, and only after the Contractor receives express, written consent from the COR.

7. Employees and Entities with a Need to Know. A list of: (1) personnel employed by the

Contractor or subcontractors with a Need to Know; and (2) entities with a Need to Know, shall be provided by the Contractor to the COR within 5 business days of signing this

Agreement and prior to any release or disclosure of SBA Data or Confidential Information.

The list shall contain a description of each individual’s employer, title, and assigned tasks under this Contract. No such release or disclosure of SBA Data or Confidential Information is permitted under this Agreement without the express, written consent of the COR. If there are any proposed changes to this list, the Contractor shall update the list and provide it to the

COR prior to any disclosure or release of SBA Data or Confidential Information, and no such release is permitted without the COR’s express, written consent.

8. Return of Property. At the conclusion of Contractor’s or subcontractor’s performance of the Contract (whether due to termination or the end of the period of performance), the

Contractor shall return to the COR all issued identification and any Federal government property to which it or its subcontractors have access or is in its or its subcontractors’ possession, no later than the last day of their work on the Contract. Contractor shall return to the COR within 5 days prior to the end of its performance on the Contract, all SBA Data and

Confidential Information to which it or its subcontractors have access or which is in its or its subcontractors’ possession. In addition, if any Contractor or subcontractor employee stops work under this Contract prior to the end of Contract performance, the employee shall return to its employer all issued identification and any Federal government property no later than the last day of their work on the Contract.

9. Rights Remain with SBA. Contractor will not, by virtue of any right to review the SBA

Data or Confidential Information, acquire any rights with respect thereto, all of which rights shall remain exclusively with SBA. Contractor acknowledges and agrees that any intellectual property derived from the Contract will be solely and exclusively owned by SBA.

10. Privileges. SBA expressly reserves all privileges, and immunities and protections applicable to the SBA Data and Confidential Information provided to Contractor under this Agreement.

The provision of the SBA Data and any Confidential Information to Contractor pursuant to this Agreement will not constitute public disclosure nor will it be deemed a waiver of any privilege or claim of confidentiality to which the SBA Data or any Confidential Information is subject. SBA has not waived, and shall not be deemed to waive, any rights or remedies available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, forms, or written agreements.

11. Legal Proceedings. If Contractor is requested or required in any legal proceeding to disclose SBA Data or Confidential Information, Contractor will provide SBA with prompt written notice, unless such notice is prohibited by law. Contractor will not disclose

Confidential Information or SBA Data without SBA’s prior written consent or without a legally binding, valid and enforceable order from a court or adjudicatory or legislative body with jurisdiction over the subject matter and the parties.

12. Remedies. It is agreed that in the event of a breach or threatened breach of this Agreement by Contractor irreparable damages may occur to SBA with the amount of damages being impossible to ascertain. In such event, in addition to pursuing any remedies provided by law and without prejudice to any rights to judicial relief it may otherwise have, Contractor acknowledges that SBA may be entitled to seek equitable relief, including an injunction, against Contractor restraining any such breach or threatened breach of this Agreement or an order of specific performance of this Agreement without proof of actual damage. Contractor agrees that Contractor will not, directly or indirectly, oppose the granting of such relief on the basis that SBA has an adequate remedy at law. In the event that Contractor shall have knowledge of any breach of this Agreement, Contractor shall promptly give written notice thereof to SBA. SBA has not waived, does not waive, and shall not be deemed to have waived, any rights or remedies otherwise available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, or written agreements.

13. Penalties. Contractor may be subject to all penalties imposed by law for unlawful disclosure of SBA Data or Confidential Information by the Contractor, which may include termination of the Contract. Contractor has read and shall comply with the policy and guidelines described in SBA Standard Operating Procedures (SOP) 90 47 4 Information Technology

Security Policy as well as SBA’s Information Technology Rules of Behavior. Contractor acknowledges that any misappropriation of SBA Data or Confidential Information by

Contractor and/or any use of the SBA Data or the Confidential Information for any purpose other than in accordance with and to perform its duties under the Contract shall constitute a violation of 18 U.S.C. 641 and shall be subject to criminal penalties as set forth in the statute.

14. Applicable Law. This Agreement is incorporated into the Contract upon execution. This

Agreement shall be governed by the Small Business Investment Act of 1958, as amended, 15

U.S.C. § 661 et seq., 13 CFR Part 107, and Federal law.

15. Entire Agreement. This Agreement supplements any current language in the Contract regarding IT security, and supersedes any conflicting language and prior agreements regarding the non-disclosure or confidentiality of Confidential Information and SBA Data.

This Agreement does not contain the exclusive agreement on data rights provisions, which are also included in the Contract elsewhere.

16. Amendment. This Agreement may be amended only upon written agreement of the parties.

Contractor may not assign its rights, duties or obligations under this Agreement without

SBA’s prior written consent.

17. Time Period. Unless and until released in writing by an authorized representative of SBA, Contractor understands that all conditions and obligations imposed upon Contractor by this

Agreement apply during the time that Contractor is granted access to Confidential

Information or SBA Data, and at all times thereafter.

18. Notices. Notices to SBA required by this Agreement shall be sent by first class mail to the

Contracting Officer, as designated in the Contract, at U.S. Small Business Administration, Denver Finance Center, Acquisitions Division, 721 19th Street, Suite 301, Denver, CO

80202. Any notice required to be provided to the COR shall be delivered by email or another method as agreed upon by the COR.

19. Application. This Agreement must be signed by the Contractor, any subcontractor thereof, and any employee of either of the foregoing performing work in connection with the

Contract. When this Agreement is signed by an individual or entity other than the

Contractor, the term “Contractor,” wherever it appears in this Agreement, other than in paragraphs 7, 8 and 19, shall be deemed to mean “employee,” in the case of an individual, or

“subcontractor,” in the case of an entity.

I have read this Agreement carefully and my questions, if any, have been answered. I represent and warrant that I have authority to enter into this Agreement.

Name:

Title:

Employer:

Date:

Signature: ______________________________________

I have read this Agreement carefully and my questions, if any, have been answered. If signing on behalf of Contractor or a subcontractor, I represent and warrant that I have authority to enter into this Agreement on the entity’s behalf.

Name:

Title at Entity:

Entity Name:

Date:

Signature: ______________________________________