ATTACHMENT_5_Non-Disclosure_Language_conflict_of_interest.pdf

ATTACHMENT 5

Confidentiality and Non-Disclosure Agreement Solicitation 73351019R0002

I. Introduction

This Confidentiality and Non-Disclosure Agreement (“Agreement”) is executed _____________ (the “Effective Date”) by and between the U.S. Small Business Administration (“SBA”) and the undersigned contractor (“Offeror/Contractor”), as subsequently defined in this Agreement, in conjunction with SBA Solicitation 73351019R0002 / Contract NO:___________(the “Contract”).

Federal law provides that only authorized persons or entities may access records which are contained in a system of records maintained by SBA and that are retrieved by an individual’s name or personal identifier. In particular, Personally Identifiable Information (PII), as defined below, is protected from disclosure to the public. These legal restrictions include the Privacy Act of 1974, as amended (5 U.S.C. § 552a) (the Privacy Act); 13 C.F.R. part 102, subpart B; OMB Circular A-130, Appendix III; and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

Pursuant to 13 C.F.R 102.34, all regulations contained in 13 C.F.R. part 102, subpart B, shall apply to Contractor during their performance of the Contract for purposes of the sanction provisions of the Privacy Act, including without limitation civil remedies such as damages and injunctive relief, 5 U.S.C. § 552a(g), and criminal penalties, 5 U.S.C. § 552a(i), for violations of the Privacy Act.

In addition, other Federal laws obligate SBA to establish controls to limit access to Confidential Information, as defined below, which is included in SBA records regardless of whether it is contained in a System of Records. Applicable laws include without limitation, the Freedom of Information Act (FOIA), 5 U.S.C. § 552, and the Trade Secrets Act, 18 U.S.C. § 1905 (Trade Secrets Act).

II. Definitions

“Confidential Information” means non-public information provided to Contractor by SBA in connection with Contractor’s performance of the Contract, or that Contractor otherwise develops in its performance under the Contract. Non-public information includes but is not limited to information about: SBA’s program participants, including, but not limited to SBICs, lenders, loan recipients, and participants in any SBA government contracting or business development program; portfolio companies of SBICs; SBA’s business, economic, and policy plans; and SBA financial, and Agency related information that SBA has not made available to the public.

Confidential Information includes: Personally Identifiable Information (“PII”) as subsequently defined in this Agreement, information related to the conduct of a Federal agency procurement disclosed under the Contract and not available to the public; For Official Use Only (“FOUO”) as subsequently defined in this Agreement; non-public information owned by, generated by or in

Contract No. SBAHQ-17-D-0005 the possession of SBA; information to which Contractor is given access by SBA or which Contractor may obtain by other means during the course of performing the Contract that is directly related to this Contract and is commercially valuable, market sensitive, proprietary, or related to an SBA oversight, examination or enforcement matter; information subject to a legal privilege benefitting SBA to which Contractor knew was subject to such privilege; and information otherwise deemed sensitive or confidential by an SBA office head, regardless of whether SBA has labeled the information as confidential or sensitive, which a reasonably prudent person would know is sensitive or confidential and is not otherwise available to the public. Confidential Information includes information that contains any element of confidentiality, which a reasonably prudent person would know contains an element of confidentiality. Further, Confidential Information includes information a reasonably prudent person would know would adversely impact the interests of SBA, or any SBIC or portfolio company thereof in the event of the loss, misuse, or unauthorized access to or modification of such Confidential Information. Confidential Information includes, but is not limited to, information contained in or from: the SBIC-Web application (unless expressly indicated as public-facing information), Capital Certificates (SBA Form 2183, Exhibit K), SBIC investor lists, Annual and Quarterly Financial Reports (SBA Form 468) or other financial information of an SBIC or any portfolio company thereof, portfolio financing statements (SBA Form 1031), any Management Assessment Questionnaire or SBIC license application (SBA Forms 2181, 2182 and 2183), an SBA examination report or SBA enforcement information. Confidential Information may take any form, including, but not limited to, Data and unrecorded conversations. Additional examples of Confidential Information include SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act. Confidential Information includes personal and business financial information that is protected from public disclosure by Federal law, including without limitation FOIA, the Trade Secrets Act, and the Privacy Act.

“Contractor” means the undersigned entity entering this Agreement with the SBA.

“Data” means written, oral, electronic or other recorded information, regardless of form or the media on which it may be recorded. The term includes without limitation technical and statistical data, computer software, computer files, electronic mail, and video recordings.

“For Official Use Only information” or “FOUO” means unclassified information of a reasonably sensitive nature that a reasonably prudent person would know is of a sensitive nature, not otherwise categorized by statute or regulation, the unauthorized disclosure of which could adversely impact an individual or entity’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.

“Need-to-know” means the determination made by an authorized holder of information that a prospective recipient requires access to specific information in order to perform or assist in a lawful and authorized governmental function, i.e., access is required for the performance of official duties.

“Personally Identifiable Information” or “PII” means information which can be used to distinguish or trace an individual’s identity, such as their name, address, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. This also includes, but is not limited to, education, financial information (e.g., account number, taxpayer identification number, access or security code, password and personal identification number), medical information, investigation report or database, criminal or employment history or information, or any other personal information which is linked or linkable to an individual.

“SBA Data” means all proprietary Data in SBA’s possession and all Data produced or developed by, or on behalf of, Contractor in connection with the performance of the Contract, and all Data provided by SBA to the Contractor, which is related to the Contractor’s performance of the Contract.

CONFLICT OF INTEREST

• During the term of this contract, Contractor shall not provide SBA Portfolio Consulting services as an agent or contractor to any 504 CDC Regulated or SBA Supervised Institution. No employee, contractor,sub-contractor or affiliate of Contractor, and no employee of any such contractor, sub-contractor or affiliate, that provides or has provided services under this contract shall provide SBA Portfolio Consulting services as an employee, agent, or contractor to any 504 CDC Regulated or SBA Supervised Institution while serving as such employee, contractor or affiliate.

• Contractor and any of its employees, contractors, sub-contractors or affiliates, and any employees of such contractors, sub-contractors or affiliates, must provide SBA with notice to the Contracting Officer and the Contracting Officer’s Representative in writing, within 48 hours of becoming aware of any potential or actual conflict of interest that has occurred or may occur during the period of performance of this contract.

• Contractor, and any of its employees, contractors, sub-contractors or affiliates, and any employees of such contractors, sub-contractors or affiliates, who provide services to a 7(a) Regulated or SBA Supervised Institution after providing services under this contract, are prohibited from voluntarily advising, consulting with or testifying on behalf of a 504 CDC Regulated or SBA Supervised Institution in any legal action taken by SBA against such 504 CDC Regulated or SBA Supervised Institution.

III. Terms of Agreement

1. Agreement to Maintain Confidentiality. Contractor agrees that any and all SBA Data and

Confidential Information is and will remain the property of SBA; is privileged and confidential; and any release or disclosure of SBA Data or Confidential Information is subject to SBA prior written approval, which shall not be unreasonably withheld. Contractor shall abide by Federal government and SBA requirements in this Agreement, the Contract, and in applicable policy guidance, regulations, and statutes, for protecting PII and Confidential Information as it exists on the date of this Agreement and including any changes to such guidance after the date of signature which were provided to Contractor or which the Contractor should reasonably know. Such requirements include but are not limited to, the Privacy Act, 13 C.F.R. part 102, subpart B, and SBA SOP 90 47 4, Information Technology

Security Policy, SBA’s Information Technology Rules of Behavior, and the Trade Secrets Act.

2. Use of SBA Data and Confidential Information. Contractor will review and use SBA Data and Confidential Information only as authorized in writing by SBA and solely for the purpose of performing its duties under the Contract and not for any other purpose, including but not limited to any commercial, personal or other purpose not contemplated by this Agreement. Contractor understands that SBA may conduct inspections of any of the Contractor’s documents or files (electronic or hard-copy) directly related to its performance of this Contract at any reasonable time or place, for the purpose of ensuring compliance with any material terms or conditions under this Agreement. SBA Data and Confidential Information containing PII is prohibited from being used as test data or stored in a non-production processing environment for development/testing.

3. Clearance Form. The Contractor shall complete a Form 1228 “Computer Access/Clearance

Form” and submit it to the COR to begin the mandatory clearance process at the beginning of Contractor’s assignment to the Contract.

4. Physical Safeguards. Physical access to the Contractor’s office areas that contain

Confidential Information or SBA Data (including SBIC or portfolio company information and any other data subsequently identified by SBA as confidential, sensitive or PII), shall be controlled to prevent unauthorized personnel from acquiring access to such data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. The Contractor shall change any passwords associated with access to Confidential Information or SBA Data every 90 days.

5. Protection of SBA Data and Confidential Information. Contractor will take all actions reasonably necessary to preserve and protect any privilege or claim of confidentiality, of which Contractor knows or of which a reasonably prudent person would know, related to the SBA Data and Confidential Information as well as any information derived therefrom, including but not limited to, maintaining such safeguards and internal controls as are necessary and appropriate. Confidential Information and SBA Data received by the Contractor must be protected by Contractor against unauthorized use, release, disclosure and modification. The Contractor shall immediately notify the COR upon discovery of any unauthorized use, theft, loss, misplacement, unauthorized release or disclosure of SBA Data or Confidential Information whether or not the Contractor is personally involved. The Contractor must refer all requests for access to SBA Data or Confidential Information to the

SBA COR.

6. Disclosure Prohibition. Contractor shall not release or disclose SBA Data or Confidential

Information, either orally, or in written, electronic or any other form, to any person or entity, without the express written consent of the Contracting Officer’s Representative (COR), which shall not be unreasonably withheld, as named by the Contract. Confidential Information and SBA Data may only be disclosed to those individuals employed by Contractor’s employer with a Need-to-Know, as defined in this Agreement, personnel employed by Contractor or one of its subcontractors with a Need-to-Know, as defined in this

Agreement, and only after the Contractor receives express, written consent from the COR, which shall not be unreasonably withheld.

7. Employees and Entities with a Need to Know. A list of: (1) personnel employed by the

Contractor or subcontractors with a Need to Know; and (2) entities with a Need to Know, shall be provided by the Contractor to the COR within 10 business days of signing this Agreement and prior to any release or disclosure of SBA Data or Confidential Information.

The list shall contain, where applicable, a description of each individual’s employer, title, and assigned tasks under this Contract. No such release or disclosure of SBA Data or Confidential Information is permitted under this Agreement without the express, written consent of the COR, which shall not be unreasonably withheld. If there are any proposed changes to this list, the Contractor shall update the list and provide it to the COR prior to any disclosure or release of SBA Data or Confidential Information, and no such release is permitted without the COR’s express, written consent, which shall not be unreasonably withheld.

8. Return of Property. At the conclusion of Contractor’s or subcontractor’s performance of the Contract (whether due to termination or the end of the period of performance), the Contractor shall return to the COR all issued identification and any Federal government property to which it or its subcontractors have access or is in its or its subcontractors’ possession, no later than the last day of their work on the Contract. Contractor shall return to the COR within 5 days prior to the end of its performance on the Contract, all SBA Data and Confidential Information to which it or its subcontractors have access or which is in its or its subcontractors’ possession. In addition, if any Contractor or subcontractor employee stops work under this Contract prior to the end of Contract performance, the employee shall return to its employer all issued identification and any Federal government property no later than the last day of their work on the Contract.

9. Rights Remain with SBA. Contractor will not, by virtue of any right to review the SBA

Data or Confidential Information, acquire any rights with respect thereto, all of which rights shall remain exclusively with SBA. Contractor acknowledges and agrees that any intellectual property derived from the Contract will be solely and exclusively owned by SBA.

10. Privileges. SBA expressly reserves all privileges, and immunities and protections applicable to the SBA Data and Confidential Information provided to Contractor under this Agreement.

The provision of the SBA Data and any Confidential Information to Contractor pursuant to this Agreement will not constitute public disclosure nor will it be deemed a waiver of any privilege or claim of confidentiality to which the SBA Data or any Confidential Information is subject. SBA has not waived, and shall not be deemed to waive, any rights or remedies available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, forms, or written agreements.

11. Legal Proceedings. If Contractor is requested or required in any legal proceeding to disclose SBA Data or Confidential Information, Contractor will provide SBA with prompt written notice, unless such notice is prohibited by law. Contractor will not disclose Confidential Information or SBA Data without SBA’s prior written consent, which shall not be unreasonably withheld or without a legally binding, valid and enforceable order from a court or adjudicatory or legislative body with jurisdiction over the subject matter and the parties.

12. Remedies. It is agreed that in the event of a material breach or threatened breach of this

Agreement by Contractor irreparable damages may occur to SBA with the amount of damages being impossible to ascertain. In such event, in addition to pursuing any remedies provided by law and without prejudice to any rights to judicial relief it may otherwise have, Contractor acknowledges that SBA may be entitled to seek equitable relief, including an injunction, against Contractor restraining any such material breach or threatened breach of this Agreement or an order of specific performance of this Agreement without proof of actual damage. . In the event that Contractor shall have knowledge of any breach of this Agreement, Contractor shall promptly give written notice thereof to SBA. SBA has not waived, does not waive, and shall not be deemed to have waived, any rights or remedies otherwise available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, or written agreements.

13. Penalties. Contractor may be subject to all penalties imposed by law for unlawful disclosure of SBA Data or Confidential Information by the Contractor, which may include termination of the Contract. Contractor has read and shall comply with the policy and guidelines described in SBA Standard Operating Procedures (SOP) 90 47 4 Information Technology Security Policy as well as SBA’s Information Technology Rules of Behavior. Contractor acknowledges that any criminal misappropriation of SBA Data or Confidential Information by Contractor and/or any use of the SBA Data or the Confidential Information for a criminal purpose not in accordance with its duties under the Contract may constitute a violation of 18 U.S.C. 641 and may be subject to criminal penalties as set forth in the statute.

14. Employee Rights. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

15. Applicable Law. This Agreement shall be governed by the Small Business Investment Act of 1958, as amended, 15 U.S.C. § 661 et seq., 13 CFR Part 107, and Federal law.

16. Entire Agreement. This Agreement supplements any current language in the Contract regarding IT security, and supersedes any conflicting language and prior agreements regarding the non-disclosure or confidentiality of Confidential Information and SBA Data.

This Agreement does not contain the exclusive agreement on data rights provisions, which are also included in the Contract elsewhere.

17. Amendment. This Agreement may be amended only upon written agreement of the parties.

Contractor may not assign its rights, duties or obligations under this Agreement without SBA’s prior written consent, which shall not be unreasonably withheld.

18. Time Period. Unless and until released in writing by an authorized representative of SBA, Contractor understands that all conditions and obligations imposed upon Contractor by this Agreement apply during the time that Contractor is granted access to Confidential Information or SBA Data for performance under the Contract.

19. Notices. Notices to SBA required by this Agreement shall be sent by first class mail to the

Contracting Officer, as designated in the Contract, at U.S. Small Business Administration, Denver Finance Center, Acquisitions Division, 721 19th Street, Suite 301, Denver, CO 80202. Any notice required to be provided to the COR shall be delivered by email or another method as agreed upon by the COR.

20. Application. This Agreement must be signed by the Contractor, any subcontractor thereof, and any employee of either of the foregoing performing work in connection with the Contract. When this Agreement is signed by an individual or entity other than the Contractor, the term “Contractor,” wherever it appears in this Agreement, other than in paragraphs 7, 8 and 19, shall be deemed to mean “employee,” in the case of an individual, or “subcontractor,” in the case of an entity.

I have read this Agreement carefully and my questions, if any, have been answered. I represent and warrant that I have authority to enter into this Agreement.

Name:

Title:

Employer:

Date:

Signature: ______________________________________

SMALL BUSINESS ADMINISTRATION

Name:

Title at Entity:

Date:

Signature: ______________________________________