Synopsis_J&A_Redacted.pdf

Justification and Approval for Sole Source

"Source Selection Information - see FAR 2.101 and 3.104"

1. Identification of the agency and contracting activity.

a. Federal agency and contracting activity.

Department of Health and Human Services National Institutes of Health National Institute on Drug Abuse, Office of Acquisition

b. Sponsoring organization.

Department of Health and Human Services National Institutes of Health National Center for Advancing Translational Sciences

c. Project Officer information.

Sam Michael CIO and Chief, Information Technology Resources Branch (ITRB) National Center for Advancing Translational Sciences 9800 Medical Center Drive Rockville, MD 20850

2. Nature and/or description of the action being approved.

a. Acquisition purpose and objectives.

The National Center for Advancing Translational Sciences (NCA TS) intends to award a contract to the incumbent contractor to continue work on a pilot program while a follow-on contract is negotiated.

b. Contractual background

The NCA TS Collaborative Scientific Platform-as-a-Service (the "Platform") is a specialized cloud-based software platform that can integrate, manage, secure, and analyze any kind of scientific data, and provide secure, controlled access to internal and external collaborators.

NCATS awarded IDIQ contract no. HHSN271201800020I to Palantir Technologies, Inc. on 8/31/2018 to support a pilot effort of the Platform. A single contract was awarded following full and open competition in which multiple proposals were received. The Government used simplified acquisition procedures as allowed by FAR subpart 13.5, and the contract included a $7M maximum and a 3-year ordering period.

The pilot effort of the Platform has been tremendously successful. The contract now supports access to the Platform for NCATS, the National Cancer Institute (NCI), and PEPFAR (the President's Emergency Program for AIDS Relief), a multi-agency effort led by the Department of State, with NIH represented by the National Institute of Allergy and Infectious Diseases (NIAID).

Task orders were issued as follows:

• Task Order 1, Provide Access to NCATS Users, 9/1/18-8/31/19;

• Task Order 2, Provide Access to NCI Users, 9/28/18 -9/27/19;

• Task Order 3, Provide Access to NCATS Users, 9/1 /19 -9/27/19;

• Task Order 4, Provide Access to NCATS, NCI, and PEPFAR users.

Task Orders 1 and 2 provided access to the Platform for NCATS and NCI for the first year of the ordering period. Task Order 3 was issued to align the NCATS period of performance with NCI. Task Order 4 included access for NCATS, NCI, and PEPFAR.

Due to the nature of FY19 funding, the current task order (Task Order 4) has multiple service dates. The task order provides service to NCA TS and PEPFAR through 12/27/19, and to NCI through 9/27/20.

Despite the contract including a three-year ordering period (8/31/2018 - 8/30/2021 ), the current task order (Task Order 4) exhausts the contract's maximum.

Due to the success of the pilot efforts, NCATS has begun acquisition planning to establish a longer-term contract, titled the NCATS Translational Research Computational Platform (NCATS TRCP). In addition to the planning for that contract, NCATS and PEPFAR have a need to continue its pilot efforts that were cut short by the contract maximum. The contract will provide for that continuation of the pilot effort.

3. Description of the supplies or services required to meet the agency's needs (including the estimated value).

a. Project title. NCA TS Collaborative Scientific Platform-as-a-Service Pilot Continuation

b. Project description.

This contract will provide continuation of the pilot program based on the existing statement of work, to include access to the NCA TS Collaborative Scientific Platform for NCATS users, NCI users, and PEPFAR users. The existing contract and SOW are attached as Attachment #1.

The mission of the NCA TS is to transform the translational science process to get more treatments to more patients more rapidly. Critical to this mission is the ability to manage data, generate insights, and foster collaboration across NIH institutes, clinics, and external partners such as research hospitals, academic institutions, and industry stakeholders. NIH researchers and their collaborators are among the world's leading researchers, and they have access to large, cutting-edge data sources.

Yet an increasingly complex challenge exists to translate these disparate, ever-evolving data sets into actionable insights that accelerate the pace of science and clinical development. The NCA TS Collaborative Scientific Platform was established in 2018 to meet this need.

The NCA TS Collaborative Scientific Platform currently uses Palantir Technologies, lnc.'s Gotham environment, which provides a secure, cloud-based platform-as-a-service. Over the last 14 months, the Platform has integrated hundreds of live intramural and third-party data sources in support of dozens of ongoing, critical scientific projects that rely on continuous access, data, and analyses within the Platform. The Collaborative Scientific Platform is now the standard means for accessing and collaboratively analyzing NCATS screening data for dozens of investigators at both NCATS and NCI, and for accessing and analyzing RNA sequencing data and several kinds of proteomics data at NCI. The Platform is therefore uniquely suited for tackling complex questions of personalized medicine, such as the identification of genomic correlates of drug response.

With regard to security, NCATS and NCI invested substantial time as the Fed RAMP sponsor for the Platform until the role was eventually taken on by HHS. FedRAMP, the Federal Risk and Authorization Management Program, is a Government-wide program providing a standardized approach to security for cloud services. This work was initiated in February 2019 and the Platform was given a 3-year Authority to Operate (ATO) in late September 2019. Palantir was awarded full FedRAMP certification on December 4, 2019. FedRAMP certification is an incredibly important milestone for any vendor to achieve, and now that an ATO is in place it will allow for more extramural and clinical focused work to take place within the Platform. This benefits not only NCATS and NCI but also every other federal agency which uses Palantir, given that Fed RAMP certification is required for any cloud service providers to provide services to the Government.

Independently, the U.S. President's Emergency Plan for AIDS Relief (PEPFAR) piloted a data innovation effort to create an integrated platform, also using Palantir's Gotham environment. PEPFAR is a multi agency effort led by the Department of State; NIH is represented by NIAID. This integrated platform shows, in real time, (anonymized) patient data, clinic utilization, drug inventories, and financial information, all in a graphical, drillable format. Immediate access to this information allows PEPFAR to monitor the entire range of efforts from individual patient treatment through clinic utilization to country-wide health outcomes. This effort was piloted against one country, Zambia, with the eventual goal of using it to support PEPFAR's efforts in some three dozen countries.

NCATS, NCI, and PEPFAR determined that there is a tremendous commonality among their requirements (patient anonymity, data provenance, security/authorization/availability, etc.). The technical, collaborative, and security components of the Platform make it an ideal choice for NCATS, NCI, and PEPFAR to use for clinical applications that have access to patient data. NCATS will leverage these tools to support the Clinical and Translational Science Awards (CTSA) and the Rare Diseases Clinical Research Network (RDCRN). NCI plans to use these tools to support clinical trials. PEPFAR, as noted, expects to expand the pilot throughout its efforts to combat HIV.

• Requirement type.

□ Research & development (R&D)

□ R & D support services

□ Support services (non-R&D)

□ Supplies/equipment X Information technology (IT)

□ Construction

□ Architect-engineer (A & E) services

□ Design-build

□ Other (specify): ________ _

• Type of action.

□ New requirement

□ Follow-on X Other (specify): continuation of pilot project

• Proposed contract/order type.

□ Firm-fixed-price

□ Other fixed-price (specify, e.g., fixed-price award-fee, fixed-price incentive-fee): ____ _

□ Cost-plus-fixed-fee

□ Other cost reimbursement (specify, e.g., cost-plus-award-fee, cost-plus-incentive-fee): ____ _

□ Time and materials

X Indefinite Delivery/Indefinite Quantity

□ Other (specify): ____ _

□ Completion Form □ Term form

• Acquisition identification number

Solicitation no. 75N95020R00008

c. Total estimated dollar value and performance/delivery period.

This will be an indefinite delivery, indefinite quantity contract with a $7 million maximum.

The contract will have an ordering period of one year. Task Order No. 1 will provide Platform access to NCA TS for the period 12/28/2019 - 9/27/2020, with an anticipated price of $1,369,680.75. Task Order No. 2 will provide pilot implementation for PEPFAR for the period 12/28/2019 - 9/27/2020, based on the setup phase work accomplished under the previous contract, with an anticipated price of $4,087,341.54.

The IGCE is based on preliminary estimates of work provided by the incumbent, using the fixed-price line items in the current contract. The price for draft Task Order No. 1 is based on a base platform license fee for a defined number of users; licenses for additional users; and associated cloud hosting. Draft Task Order No. 2 is based on licenses for server core utilization to provide the platform to users in two countries in which PEPFAR operates; core engineering professional services to configure a dynamic object model, provide iterative workflow mapping, and provide training and support; and associated cloud hosting.

4. Identification of the statutory authority permitting other than full and open competition.

X This acquisition is conducted under the authority of 41 United States Code (U.S.C.) 253(c)(1) as set forth in Federal Acquisition Regulation (FAR) 6.302-1.

□ This acquisition is conducted under the authority of section 4202 of the Clinger-Cohen Act of 1996.

□ This acquisition is conducted under the authority of the Services Acquisition Reform Act of 2003 (41 U.S.C. 428a).

5. Demonstration that the proposed contractor(s) unique qualifications or the nature of the acquisition requires use of the authority cited.

a. Name and address of the proposed contractor(s).

Palantir Technologies, Inc., 100 Hamilton Ave, Suite 300, Palo Alto, CA 94301.

b. Nature of the acquisition and proposed unique qualifications of the contractor(s).

This acquisition is a continuation of the pilot efforts described in paragraph 3.b. above. Palantir Technologies is uniquely qualified to provide the services, for the following reasons:

1. Palantir possesses FedRAMP certification and has obtained the ATO authorizing operation of this Platform.

Fed RAMP certification is mandatory for Federal cloud deployments, except for those intended for single organizations and implemented fully within federal facilities. See the guidance at https://www.fedramp.gov/faqs/, and the 0MB Memorandum for Chief Information Officers dated December 8, 2011, https://www.fedramp.gov/assets/resources/documents/Fed RAMP Policy Memo.pdf.

None of the vendors who responded to the Sources Sought request held Fed RAMP certification, nor did any of the vendors who responded to the initial solicitation.

The Platform supports multiple organizations (NCATS, NCI, and PEPFAR), and is hosted on a commercial cloud service (currently, Amazon Web Services (AWS) S3, although NCATS requires the Platform to be cloud-agnostic). Moreover, the Platform now ingests personally identifiable information (PII), protected health information (PHI), and clinical data, all of which entail unique data protection regimes.

The FedRAMP and ATO process typically takes longer than the expected duration of this contract. Obtaining Fed RAMP certification took Palantir 7 months. NCATS cannot afford interruption to the Platform while a prospective vendor obtains FedRAMP certification and an ATO.

2. This is the continuation of a pilot program for which Palantir was the only vendor capable of meeting all NIH requirements.

This requirement was originally solicited in 2018 and subject to a full and open competition, with multiple vendors responding. Palantir Technologies' offer was determined to be the only fully technically acceptable proposal and was determined to be the most advantageous to the Government. The Government determined that each of the other offers would have had to propose a new solution (rather than modify their proposals) in order to satisfy the evaluation criteria found lacking in their proposals. Palantir Technologies is the incumbent to this acquisition.

In executing the pilot, Palantir has provided the Platform to NCATS' specifications and is intimately familiar with the data. The incumbent has worked closely with NCA TS and NCI, the primary users of the Platform.

The incumbent also worked closely with PEPFAR under a separate pilot that is now being rolled into the Platform.

3. The incumbent has developed unique insights into the data challenges of these users that will be difficult to replicate within a reasonable period of time.

For instance, NCATS uses a quantitative high-throughput screening client that was iteratively developed over the course of 14 years by NCATS and its predecessors. This client provides integrating assay scheduling information with control layouts coupled with the actual assay run and resultant data file, leading to almost real time instant data analysis.

NCATS replicated the functionality in the Platform and now relies heavily on it. It is not realistic to replicate this functionality within the short time frame to make this award; NCATS would be severely hampered if it had to replicate it again in an environment where it had no continuing access to its functionality.

4. Palantir provides the unique capability to provide the Platform as an integrated service

NCATS' market research identified other vendors that may be able to provide parts of these functions piecemeal, but Palantir provides them natively within its platform and as a complete package, without the need for custom programming. These functions include:

• anonymization of data;

• chemical reaction curation dashboards;

• data visualizations;

• ability to maintain data and scientific provenance and reproducibilityof all integrated data sources;

• ability to perform advanced analytics and informatics in the user's preferred coding language;

• granular security controls that provide authentication, authorization, access control, encryption, and audit logging at the data level, not just at the platform level. While much of NCATS work is collaborative, not all collaborators share all their data in any particular collaboration.

6. Description of the efforts made to ensure that offers are solicited from as many potential sources as practicable. Indicate whether a FedBizOpps notice was or will be publicized as required by FAR Subpart 5.2 and, if not, which exception under FAR 5.202 applies.

The existing contract was awarded recently (8/31/18) using full-and-open competition, in which multiple proposals were received and evaluated.

This continuation of the pilot will use short-term task orders (6-9 months) to extend services provided under the existing contract until a follow-on contract can be awarded.

A sources sought notice was published in FedBizOpps (now Beta.SAM.Gov) on 10/24/19, as discussed in Section 8, below.

A combined synopsis/solicitation for commercial items in accordance with FAR Part 13.5 and 12 will be published on Beta.SAM.Gov Contract Opportunities.

This is a sole-source, non-competitive acquisition; however, the combined synopsis/solicitation will provide that all responses will be considered in order to determine whether to convert the acquisition to a competitive acquisition.

7. Determination by the Contracting Officer that the anticipated cost/price to the Government will be fair and reasonable.

This requirement was originally competed using full and open competition in 2018, at which time multiple responses were received and evaluated. The prices negotiated for that work were determined to be reasonable, and will be used to evaluate the prices under the proposed contract.

8. Description of the market research conducted (see FAR Part 10) and the results, or a statement of the reasons market research was not conducted.

The following market research was conducted:

• A sources sought notice was published on FedBizOpps on 10/24/19. See attachment #2. The Government received .esponses. The statements were reviewed by Sam Michael, NCATS CIO and Chief, NCATS Information Technology Resources Branch. NCATS determined that only the incumbent meets the requirements. The assessment of the capability statements and the capability statements themselves are attached as attachment #3.

• This continuation of the pilot extends the work of the current contract, which was awarded after full and open competition that resulted in multiple proposals.

• Market research to support the existing contract, including evaluation of the proposals submitted for that action, is still current, accurate, and relevant.

See FAR Part 10. None of the unsuccessful vendors from that action submitted a capability statement in response to this sources sought, but some of the vendors responding to the current sources sought notice proposed the use of approaches and solutions that were determined to be unsatisfactory for the previous award. None of the current capability statements indicate that the competitive marketplace has evolved in 13 months in a way that would more effectively satisfy NCATS' requirements.

• This contract is expected to have a period of performance of one year or less, and is narrowly tailored to continue ongoing work by the incumbent contractor while a long-term contract is solicited and awarded.

9. Any other facts supporting the use of other than full and open competition.

This is a short-term contract, and the cost and delay of switching contractors for this requirement far outweighs any benefit to competition. As noted above, the Government has invested nearly $7 million on this pilot project since its inception in September 2018. Recompetition would require the duplication of software licensing and engineering support already performed, and the entire period would be consumed by the transition to a new contractor, without beneficial work performed to support NCATS or PEPFAR.

The combination of (1) a proven commercial collaborative scientific platform as a service that has integrated data of all types at the NIH, and (2) the unique need to ensure that scientific collaboration occurs within a comprehensive and single platform to ensure that scientific advances are shared seamlessly and across workflows, along with (3) the technical, security, and legal needs that must be met, demonstrate that Palantir Technologies is uniquely positioned to serve as the scientific collaboration as a service platform that the NIH requires to continue making scientific progress from the highly scalable collaboration and sharing of data among NIH scientists and its partner agencies.

10. Listing of sources, if any, that expressed, in writing, an interest in the acquisition.

In response to a sources sought notice published on FedBizOpps on 10/24/19, -apability statements were received. The statements were reviewed by Sam Michael, NCATS CIO and Chief, NCATS Information Technology Resources Branch. NCATS determined that only the incumbent meets the requirements.

The assessment of the capability statements is attached as attachment #3.

Statements were received from:

11. Statement of the actions, if any, the agency may take to remove or overcome any barriers to competition before any subsequent acquisition for the required supplies or services.

NCATS has begun the acquisition planning for full implementation of the pilot, titled the NCA TS Translational Research Computational Platform (NCATS

TRCP). The TRCP will be a longer-term contract negotiated using FAR Part 15 procedures. Award of this contract is expected in FY20. Additional market research will include additional notices in Contract Opportunities (beta.sam.gov), review of capability statements, and surveys of the open market (to include academic and research institution efforts).

In addition, NCATS has taken measures throughout this engagement to prevent contractor technical lock-in, including:

• The project must use an open data architecture, where data always remains under the full control of NCATS and can be easily exported in open, non proprietary data formats via well-documented application programming interfaces (APls) that are open to NCATS programmers. The contractor is required to be able to export all existing data in non-proprietary raw format and in the format best usable for destination systems.

• NCATS requires proven interoperability with NCATS' current IT investment landscape, with omnipresent APls and plugin points that allow the system to keep up with the changing needs of NCATS and support both third-party software and other analytic applications.

• NCATS requires the ability to independently develop new configurations, plugins, integrations, and extensions to meet new and unforeseen needs and interface with external systems.

• NCATS requires the ability to maintain data and scientific provenance and reproducibility of all integrated data sources. Every resource (dataset, analysis, code, plot, report) contains provenance metadata, and can be traced back to the exact version of all upstream dependencies. The dependency tree can be easily replayed given new data or updated analysis logic, while still retaining prior versions and branches.

• The contract maintains intellectual property boundaries. The base Palantir platform is a commercial product governed by a commercial software license.

Programming performed by NCATS remains the property of NCATS.

12. Program office certification.

This is to certify that the portions of this justification that have been developed by the undersigned program office personnel, including supporting information and/or data verifying the Government's minimum needs, schedule requirements and other rationale for other than full and open competition, are accurate and complete.

Official Name & Title Signature Date

Project Officer Samuel G. Micha ll I -S Digitally signed by Sam �el G. Michael -S

Date: 2019.12.13 16:11: 1-05'00'

Project Officer's v - Digitally signed by Anton� .

Immediate Anton M.Simeona

Simeonov-S Supervisor s Date: 2019.12.15 19:24:00 PS'00'

Official Name & Title Signature Date

Head of the Samuel G. Sponsoring Digitally signed by �amuel G.

Program Michael -S Office Michael -S Date: 2019.12.13 lE :11:40 -05'00'

13. Contracting Officer certification.

This is to certify that the justification for the proposed acquisition has been reviewed and that to the best of my knowledge and belief the information and/or data provided to support the rationale and recommendation for approval is accurate and complete.

Official Name & Title Signature Date

Contracting u1g1ta11y s1gnea oy Ueffrey R.

Officer Jeffrey R. Schmi jt -S Schmidt -S

Date: 2019.12.160c :13:32 -05'00'

14. Chief of the Contracting Office and Head of the Contracting Activity signature(s).

Official Name & Title

Chief of the Contracting

Christopher J. Be Office

Head of the !Diane J. Frasier Contracting [Head of the Contracting

Activity !Activity, NIH !Director, Office of

FOR !Acquisition and Logistics Management

15. Competition Advocate Signature.

Official Name & Title

Competition OC)r. Richard G. Wyatt, M.D.

Advocate [)eputy Director, Office of

[ntramural Research

Attachments:

Signature

Digitally signed by

It -S Belt -S Date: 2019.12.16 1(

Nancy M Digit.

• Nanc

Date

�hristopher J.

:28:39 -05'00'

�lly signed by y M. Norton -S

N rt S Date 2019.12.17 o on - 13:3():01 -05•00·

Signature

Richard G D!gitc

• Riche

Wyatt-S Date:

08:37

Date lly signed by rd G. Wyatt -S 2019.12.20 :25 -05'00'

1. Existing contract HHSN271201800020I (including the SOW, Technical Requirements, and Palantir license)

2. Sources Sought Notice, 10/24/2019

3. Assessment of Capability Statements

1. Background and Objective

J&A Attachment no. 1 - Existing Contract

Statement of Work

NCATS Collaborative Scientific Platform

Contract No. HHSN271201800020I

The NCATS Collaborative Scientific Platform (NCSP) is an NCATS-sponsored cloud-based system that provides a collaborative platform-as-a-service for NIH collaborators to manage and work with large amounts of complex, cutting-edge data. Collaborators include institutes and centers at NIH as well as external partners such as research hospitals, academic institutions, and industry stakeholders. The NCSP is established through an indefinite delivery, indefinite quantity contract, with task orders issued to support the requirements of individual groups.

2. Requirements

Upon issuance of a task order, Palantir Technologies Inc. (Contractor) shall provide its commercial software for enterprise data integration and management, the Palantir Gotham Platform for Enterprise

Data Management ("Palantir"), to meet the following requirements:

a. A commercial software solution deployable on day one of the project and that can be configured within expedited timelines.

b. An open data architecture, where data always remains under the full control of NCATS and can be easily exported in open, non-proprietary data formats via open APls. The software should be built on an open, distributed microservices architecture with open, well documented REST APls that are designed to seamlessly interface with other systems, adapt to meet evolving needs, and avoid system lock-in.

c. Proven data integration capabilities, including the ability to rapidly ingest unprocessed high-throughput drug screening (HTS) outputs, genomic data (including DNA sequencing, RNA-Seq, miRNA, etc.), mass spectrometry, flow cytometry, and other data types used in basic and translational biosciences research.

d. The ability to maintain data and scientific provenance and reproducibility of all integrated data sources where every resource (dataset, analysis, code, plot, report) contains provenance, metadata, and can be both traced back to the exact version of all upstream dependencies, and where the dependency tree can be easily replayed given new data or updated analysis logic, while still retaining prior versions and branches.

e. Dynamic data model, object-based search/discoverability and analysis workflows, allowing easy definition of objects, properties, and links that propagate from a source table, and provide natural ways to move between tabular and object-oriented interfaces and data analyses.

f. Intuitive, highly configurable user interfaces that have been effectively utilized by technical bioinformaticians, cheminformaticians, and data scientists, as well as less technical biologists, chemists, and other scientists.

Contract No. HHSN2712018000201

Services (AWS) Cloud hosting infrastructure and/or hardware for the specified configuration. ODCs will be priced at the order level dependent upon the configuration and needs.

Items 0006, 0007, and 0008: Professional Services. These items for professional services provide additional flexibility to meet potential needs/requirements under specific orders as they may arise over the life of the vehicle.

For the purposes of the pricing contained herein, a "user" is defined as one named authorized user account, which may not be transferred, assigned to, or used by any other user who is not the named user. Use of Palantir Technologies, Inc. software is subject to the Palantir License and Service

Agreement, attached.

4. Attachments

Attachment 1, Detailed Technical Specifications

Attachment 2, Palantir License and Service Agreement

Detailed Technical Specifications

Collaborative Scientific Platform as a Service

National Center for Advancing Translational Sciences

(NCATS)

National Institutes of Health

June 19, 2018

Table of Contents

Technical Solution Requirements

1. Solution Architecture, Data Integration, and Data Management

1.1 Unified, Commercial Software Data Management Architecture

1.3 Flexible Data Integration Engine & Bioscience Data Experience

1.4 Data Storage, Access, and Catalog

1.5 Full Data Provenance and Schema

1.6 Data Transformation Management

1.7 Data deposition back to established repositories

1.8 Cohesive User Interfaces for Data Management

2. Data Analysis, Discovery, and Bioscience Workflows

2.1 Analytic Tool Suite

2.2 Search and Exploration

2.3 Web Application Builder

3. Security and Administration

3.1 Security and Access Controls

3.2 Platform Management and Administration

3.3 End - nothing follows

c. Each widget can be synchronized to live data with straightforward SQL queries, and complex workflows can be built by defining JavaScript functions that determine interaction between widgets and reaction to user triggered events.

d. Is natively compatible with reading from a SQL connection, via REST API, or anything that provides a JSON response, offering the ability to tie in external systems or APls.

2. As all other solution components, applications built in this web interface should fully respect the propagated dynamic access controls of the data dependencies.

3. Security and Administration

3.1 Security and Access Controls

1. The solution shall have a security and auditing subsystem to enforce security in the solution. The solution must provide authorization of resource access to users who have been authenticated.

2. Security and access controls that include:

a. Multi-source authentication (enterprise LDAP, PKI, Active Directory, etc.) as well as Single Sign-On (SSO) capabilities.

b. Access controls to secure each piece of information individually in addition to traditional blanket permissions across entire data sources.

c. Ability to assign individual users granular permissions to data access (including ownership, read, write, access denied, etc.).

d. Role-based access controls (RBAC) are assignable to individual users or group of users.

e. Allow for conditional policies based upon defined criteria. For example, applications and individual actions (termed "resources") can each be given a policy, taking the form of statements that express a (Condition, Verb, Operation) tuple, such as "if User Xis a member of Group Y (condition) they are Allowed

(verb) to Edit (operation) resource Z."

f. Access and role-based access controls that can be:

1. assigned by administrators and/or

2. inherited from source systems and updated at any time.

3. Role-based access control based on least privilege and privileged access for access administration.

g. Propagation and inheritance of access controls to all data and analyses derived directly or indirectly from the originating data, whether those data transformation or analyses are performed:

1. In a standard coding language (Java, SQL, Scala, Python, etc.)

2. As technical scripting language (R, SAS, etc.), or

3. A point-and-click analytical environment

h. Data is encrypted at rest via compliant mechanisms (e.g., full disk encryption, LUKS, TrueCrypt).

d. These containers allow only a limited number of gateways into the host environment, greatly limiting the potential vectors that could compromise one or more hosts.

3.3 End - nothing follows.

mutual agreement and shall be effective only if made in writing and signed by each party. No waiver of any breach shall be deemed a waiver of any subsequent breach. Unless otherwise specified by Palantir, the Products, Documentation, and Support Services provided hereunder are subject to U.S. trade controls and sanctions and may only be further exported or transferred in accordance with applicable export and sanctions requirements, including consultation of the U.S. Consolidated Screening List. It is

Customer's responsibility to provide Palantir with the necessary information for Palantir to comply with applicable requirements, and to ensure that all end-uses and end-users relating to Customer's reexports and retransfers of the Products, Documentation, and Support Services comply with applicable controls. Palantir is in no way affiliated with, or endorsed or sponsored by, The Saul Zaentz Company d.b.a. Tolkien Enterprises or the Estate of J.R.R. Tolkien.

Page6