CI solicitation CRTI Online Due Diligence System 2022-11-18.pdf

RFP for CI solicitation CRTI Online Due Diligence System FAR 12 and 13.5 Commercial Item - Full and Open Competition

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

REQUEST

FOR

PROPOSAL

PROJECT:

CRTI Online Due Diligence System ** Subject to the Availability of Funding **

TECHNICAL AND PRICE

PROPOSAL

- and -

ORAL PRESENTATION /

PRODUCT DEMONSTRATION

CLOSING

DUE

DATES

and

TIMES:

January 11, 2023 (Tuesday) 5:00pm Eastern Time

January 10 or 11, 2023 (Tue or Wed) See solicitation. Scheduling a requested time MUST be received no later than 1:00pm ET, January 9, 2023.

SUBMIT TO:

Export Import Bank of the United States See 52.212-1 and ADDENDUM to 52.212-1

INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS

SOLICITATION NUMBER: 83310123R0001

SOLICITATION QUESTIONS:

Questions concerning this solicitation are to be submitted to patricia.ludlow@exim.gov no later than December 14, 2022.

mailto:patricia.ludlow@exim.gov

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

Table of Contents Section A – Standard Form (SF) 1449

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

A.2 NAICS CODE and PSC ASSSIGNMENTS

A.3. 52.216-1 Type of Contract

Section B – Continuation of SF 1449

B.1 SUBMISSION OF INVOICES (CONTINUATION OF BLOCK 18b)

B.2 SCHEDULE OF SUPPLIES / SERVICES (CONTINUATION OF BLOCK 19-24)

B.3 GENERAL

B.3.1. LABOR STANDARDS AND WORK HOURS

B.3.2. SAFETY REQUIREMENTS

B.3.3. PERIOD OF PERFORMANCE

B.3.4. PLACE OF PERFORMANCE

B.4 STATEMENT OF REQUIREMENTS (CONTINUATION OF BLOCK 20)

SOR SECTION 1 – BACKGROUND

SOR SECTION 2 – SCOPE

SOR SECTION 3 – REQUIREMENTS CAPABILITIES OF DUE DILIGENCE COMPLIANCE SYSTEM

SOR SECTION 4 – SCHEDULE

SOR SECTION 5 – DELIVERABLES

SOR SECTION 6 – WATCH LISTS

SOR SECTION 7 – SERVICES AGREEMENTS

SOR SECTION 8 – DESIRED FUTURE ENHANCEMENTS

SOR SECTION 9 – Information Security Requirements

B.5 DELIVERABLES SPECIFIC

B.6 COOPERATION

B.7 INFORMATION PROTECTION

B.8 COMPLIANCE WITH IT SECURITY POLICES, PROCEDURES, AND REQUIREMENTS

Section C – Contract Clauses

C.1 PROVISIONS AND CLAUSES INCORPORATED BY REFERENCE (IBR) IAW FAR 52.102

C.2 PROVISIONS AND CLAUSES INCORPORATED BY FULL TEXT

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

52.212-2 Evaluation—Commercial Products and Commercial Services

52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Products and Commercial Services

52.217-8 Option to Extend Services

52.217-9 Option to Extend the Term of the Contract

52.252-4 Alterations in Contract

52.232-18 Availability of Funds

52.252-1 Solicitation Provisions Incorporated by Reference

52.252-2 Clauses Incorporated by Reference

17.204 Contracts

Section D – Contract Exhibits

D.1 PAST PERFORMANCE INFORMATION

Section E – Solicitation Provisions

E.1 52.212-1 Instructions to Offerors—Commercial Products and Commercial Services

E.2 ADDENDUM TO 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS

E.3 52.212-2 Evaluation—Commercial Products and Commercial Services

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

Section A – Standard Form (SF) 1449

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

Definitions and Acronyms for Solicitation NAICS Code North American Industry Classification System (NAICS) Code is a standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the US business economy performed by the US Census Bureau.

PSC Manual Product and Service Code (PSC) Manual provide codes to describe products, services, and research and development (R&D) purchased by the federal government. These codes indicate “WHAT” was bought for each contract action and reported and tracked in the Federal Procurement Data System (FPDS).

SBA US Small Business Administration (SBA) helps Americans start, build, and grow businesses. Through an extensive network of field offices and partnerships, the SBA assists and protects the interests of small business concerns.

SBA sets the SBA Size Standards within the published Table of size standards per the North American Industry Classification System (NAICS) Code.

COR Contracting Officer’s Representative (COR) has specific written delegated authority from the contracting officer to perform approved tasks.

CO Contracting Officer (CO or KO) is a government employee empowered to obligate the US Federal Government.

Metered Usage Costs Metered usage is a technique where customers pay for a product or service based on its usage. For this solicitation requirement, the US Government may favor a Firm-Fixed-Price solution. Reference Section

B.2 SCHEDULE OF SUPPLIES / SERVICES.

A.2 NAICS CODE and PSC ASSSIGNMENTS 519290 Web Search Portals and All Other Information Services or 519130 Internet Publishing and Broadcasting and Web Search Portals 7A21 - IT AND TELECOM - BUSINESS APPLICATION SOFTWARE (PERPETUAL LICENSE SOFTWARE)

A.3. 52.216-1 Type of Contract.

Per the Federal Acquisition Regulations (FAR) Part 12 Acquisition of Commercial Products and Commercial Services, this acquisition constitutes an acquisition of commercial products or commercial services IAW 12.102. The contract format is generally IAW FAR 12.303, Contract Format for Acquisition of Commercial Products and Commercial Services.

As a Commercial Item/Service Acquisition, conducted as a Full and Open Competition (unrestrictive) per FAR 6.102 and 12, the government contemplates award of a single contract with CLINS for Firm-Fixed- Price (FFP) to cover any resulting tasks from this solicitation.

(End of provision)

IAW FAR 12.214, the resulting contract exempt from 48 CFR § 9903.201-1 - CAS applicability, Cost Accounting Standards (CAS). However, the CAS standards/definitions/procedures for travel expenses are made applicable to this contract and each task order issued thereunder, as a matter of contract administration.

Contractor is to provide commercial best customer firm-fixed pricing to cover all the requirements and tasks per this solicitation.

https://www.census.gov/naics/ https://www.census.gov/naics/ https://www.acquisition.gov/psc-manual https://www.acquisition.gov/psc-manual https://www.sba.gov/federal-contracting/contracting-guide/size-standards https://www.sba.gov/document/support-table-size-standards

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

Section B – Continuation of SF 1449

B.1 SUBMISSION OF INVOICES (CONTINUATION OF BLOCK 18b)

Submission of Invoices to the Invoice Processing Platform (IPP) Offeror / contractor must be registered in the System for Award Management (SAM) https://www.sam.gov.

Invoicing instructions will be provided upon receipt of an award.

Additional Invoice Requirements:

• Contractor invoices must clearly be in in a font size that is greater than a 7-font size.

• Contractor invoices must provide a clear explanation for each expense from a third-party vendor/subcontractor which the contractor is submitting to EXIM in its prime contractor invoice.

• Acronyms must be spelled out or an acronym key provided on the invoice.

• Each invoice must be complete and “proper” before it shall be considered received for the purposes of Prompt Payment Act interest accrual.

• Each invoice submitted by the contractor constitutes an official statement of the contractor seeking a benefit/compensation from the US Government.

B.2 SCHEDULE OF SUPPLIES / SERVICES (CONTINUATION OF BLOCK 19-24)

Proposed pricing shall be in United States Dollars (USD) and rounded to the nearest whole cent. The Schedule of Supplies/Services (Schedule) is to be provided by the vendor to meet all requirements in their entirety as identified in this solicitation.

Product / Services Reference Standard Form (SF) 1449 and complete or submit alternate pricing per industry standard. Multiple offers with alternate pricing will be accepted.

In accordance with (IAW) the principle favoring multiple awards when determined to be in the government’s best interest, as provided in FAR 13.101(b)(1), and applied to commercial acquisition exceeding the SAT using FAR 13.5 procedures, the contracting officer has determined that it shall be in the government’s best interest to reserve the right to make multiple awards under this solicitation.

Each award may be for all or some of the services offered in any one proposal.

As related to pricing, and in keeping with commercial practices in the data services industry (519290 Web Search Portals and All Other Information Services or 519130 Internet Publishing and Broadcasting and Web Search Portals), offerors may submit pricing as a Firm-Fixed-Price (FFP) per period of time, or per unit of usage (i.e., metered) pricing. An offeror may submit one offer using FFP and a separate offer using metered pricing. Offerors shall indicate whether metered rates apply to all usage or to increments of usage per year. Offerors are reminded that this is a best value trade-off competition. As such, the government may determine that expected usage at a metered rate may be determined less advantageous to the government than FFP.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

B.3 GENERAL

B.3.1. LABOR STANDARDS AND WORK HOURS

All work performed by the prime contractor and each of its subcontractors/suppliers shall be performed in accordance with commercial business practices and regulated labor standards prevailing in the jurisdiction where the services are being performed. The contractor is responsible for ensuring that all such practices and labor standards are enforced and followed and agrees to hold harmless and indemnify the US Government for any violation of same.

B.3.2. SAFETY REQUIREMENTS

All work performed by the prime contractor and each of its subcontractors/suppliers shall be performed in accordance with commercial business practices and regulated labor standards prevailing in the jurisdiction where the services are being performed. The contractor is responsible for ensuring that all such practices and labor standards are enforced and followed and agrees to hold harmless and indemnify the US Government for any violation of same.

B.3.3. PERIOD OF PERFORMANCE

The period of performance for this purchase order is schedule to begin as a transition / handoff of 1-month with one (1) year beginning February 1, 2023 with four (4) option periods with the right to extend up to 6-months per clause 52.217-8.

B.3.4. PLACE OF PERFORMANCE

The primary place of performance will be at the contractor’s facilities and the contractor must provide all necessary equipment, tools, materials, or other to successfully complete performance for each task.

B.4 STATEMENT OF REQUIREMENTS (CONTINUATION OF BLOCK 20)

Initiating Offices:

Research and Information Services, the Credit Review and Compliance Division, and the Office of General Counsel

Project Title:

Character, Reputational, and Transaction Integrity (CRTI) Due Diligence Compliance System

Requiring Activity: Library

Statement of Requirements (SOR)

Salient and essential features required for a Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System (up to 2 users) are:

SOR SECTION 1 – BACKGROUND

The Export Import Bank of the United States’ (EXIM) Research and Information Services, the Credit Review and Compliance Division, and the Office of General Counsel has a need for a semi-automated online due diligence compliance system. The system must be able to perform bulk/batch uploads to

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001 screen multiple individuals and business entities names at one time. This system will replace EXIM’s current bulk/batch upload due diligence compliance system.

As the United States (US) Government Export Credit Agency (ECA), EXIM supports US export transactions and is mandated to do business with parties that are presently responsible. EXIM follows the anti-bribery provisions set forth in the Foreign Corrupt Practices Act (FCPA) and has established know your customer practices. EXIM also follows these procedures for its guaranteed and insured lender partners and participants.

SOR SECTION 2 – SCOPE

The US Government follows the Organisation for Economic Co-operation and Development (OECD) anti-bribery recommendations in its export credit practices including the recommendation to conduct enhanced due diligence compliance with regard to any exporter or applicant that has been indicted, convicted, or debarred for bribery. As such, we are required to run individual(s) and business entity(ies) name(s) of transaction participants against a due diligence compliance system including the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) lists, the US Government SAM.gov Exclusions also referred to as suspensions and debarments.

EXIM’s due diligence compliance check process for Character, Reputational and Transaction Integrity (CRTI) involves multiple daily bulk/batch searches carried out by staff in our Research and Information Services Division. All medium- and long-term transaction participants are screened against all required watch lists and, under special circumstances, seven (7) additional lists as determined by EXIM asset management staff. This includes both individual(s) and business entity(ies) name(s). When there is a match that links an exporter, lender, or supplier in a transaction to fraud or corruption, the results are forwarded to EXIM loan officers working on the transactions, the Credit Monitoring and Review Division, and the Office of the General Counsel for remediation. For higher dollar valued transactions, participants that appear on the Politically Exposed Person (PEP) list are flagged.

EXIM staff undertakes, on average, 30,000 checks per year which can vary per month to clear all participants involved with EXIM. We have found that a bulk/batch upload system that accommodates input of multiple individuals and business entities names at one time decreases human intervention and errors and saves many hours of valuable work time. Due diligence compliance system must be able to accept upload from either MS Excel forms filled out by EXIM staff or those that are electronically generated.

SOR SECTION 3 – REQUIREMENTS CAPABILITIES OF DUE DILIGENCE COMPLIANCE SYSTEM

A. To meet EXIM’s requirements, the due diligence compliance system must have the following capabilities:

1) Online access to a due diligence compliance system for two (2) users (system is not to be an enterprise system (due diligence compliance system is not to be connected to EXIM network)).

2) Solution is to be a stand-alone system that does not require EXIM to pay for subscriptions to additional databases.

https://sam.gov/content/exclusions

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

3) Database interface must have a clean and clear design.

4) Manner of input must be allowed by way of MS Excel format.

5) Input system must allow submission of multiple participant individuals and business entities names for screening at one time by way of MS Excel bulk/batch upload.

6) Input system must allow single searching by individual(s) and business entity(ies) name(s).

7) Search criteria must be able to do the following:

a. Recognize stop words (e.g., entities that end with Limited/Ltd, Company/Co, SA, S.A. de C.V., BV, AS, etc.).

b. Advanced name matching, including name transposition capabilities to reduce false positives (e.g., Jose Martinez Rodriguez will return Jose Martinez Rodriguez, Jose Rodriguez, and Jose Martinez).

c. Skips titles (e.g., Mr, Mr., Doctor, Sultan, Admiral, etc.).

d. Searches across both nationality and location for individuals.

e. Searches across country of registration for individual(s) and business entity(ies) name(s) and also displays additional locations.

8) Database content updated in real-time that always reflects the current version of all watch lists that EXIM is required to search.

9) Assurance / confirmation with each screening in-bulk batch that all watch lists have been checked. NOTE: A lack of hits or failure reports is not confirmation that all compliance checks are being completed.

10) An accurate and complete reporting of matches and hits.

11) Profile report format that clearly identifies and delineates matches and hits without superfluous information.

12) Matches and hits supported by comprehensive and reliable research, data, and news.

13) Matches and hits supported by source documents that are available at no extra cost.

14) Centralized collection and management of searches, matches, and hits.

15) Responsive to content, research, and technical specialists’ questions from users and provides satisfactory answers within two (2) business days with a specific Point of Contact(s) (POC(s)).

16) Access to background details of any findings from reports which may require explanation.

17) Due diligence compliance check lists and beneficial ownership research that meets the following:

a. Searches and reports on all required EXIM CRTI lists including all sanctions, PEP, and watch lists maintained by the US government and certain foreign governments and multilateral organizations (See SECTION 6 – REQUIRED WATCH LISTS).

b. Provides information on relationships with companies doing business with Iran beyond sanctions and watch lists.

c. Searches updated daily for SAM.gov Exclusions. SAM.gov | Data Services

d. Searches and reports on federal and state regulatory and law enforcement convictions, settlements, and deferred prosecution agreements.

e. International coverage of ultimate beneficial ownership that meets OFAC and Financial

Crimes Enforcement Network (FinCEN) requirements.

f. Searches and reports on individual(s) and business entity(ies) name(s) in accordance with

FinCEN's beneficial ownership rule*.

g. Searches and reports on individual(s) and business entity(ies) name(s) in accordance with

OFAC’s 50 Percent Rule**.

https://sam.gov/data-services/Exclusions?privacy=Public

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

* Securities Industry and Financial Markets Association (SIFMA) memorandum, May 7, 2018 - FinCEN beneficial ownership definition includes two parts:

1. the control prong, covering a single individual with significant responsibility to control, manage, or direct a legal entity customer, including an executive officer, a senior manager or any other individual who regularly performs similar functions; and

2. the ownership prong, covering each individual (if any) who directly or indirectly owns 25% or more of the equity interests of a legal entity customer. “...some financial institutions may collect information about owners of 10% or more of the equity interests. They may do so as a matter of practice, based on their own assessments of risk, or pursuant to other regulatory requirements."

**Treasury.gov, "Entities Owned by Persons Whose Property and Interest in Property are Blocked (50% Rule)" https://home.treasury.gov/policy-issues/financial-sanctions/faqs/401

SOR SECTION 4 – SCHEDULE

Annual subscription with online access (two (2) users) to the due diligence compliance system throughout the year to meet EXIM’s ongoing needs.

5.1 PERIOD OF PERFORMANCE: TBD

The period of performance is inclusive of a base period with four (4) option periods.

5.2 PLACE OF PERFORMANCE: Work will be listed as the awardee’s address as the end-user product is Internet / cloud-based.

SOR SECTION 5 – DELIVERABLES

No. Deliverable EXIM Deliverable

Awardee Deliverable

I. List of all sanctions and watch lists currently searched by the due diligence compliance system is a stand-alone, non-customized database, unassociated with any added subscription databases.

Not an EXIM deliverable.

Affirmation and Verification @ time of proposal and oral presentation / product demonstration

II. Profile report sample(s) for at least two (2) companies and two (2) individuals. Of the profile report samples, one for the company and one for the individual must not have met at least one compliance check.

Not an EXIM deliverable.

@ time of proposal

III. Copy of actual input form in MS Excel file or CSV file format (not a screen caption or screenshot).

Not an EXIM deliverable.

@ time of proposal

IV. Description of the process for carrying out a due diligence compliance multiple individual(s) and business entity(ies) name(s) search from beginning to end, e.g., user manual.

Include assistance when help is required.

Not an EXIM deliverable.

@ time of proposal https://home.treasury.gov/policy-issues/financial-sanctions/faqs/401

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

V. Data Confidentiality, Privacy Act, and Data Rights.

EXIM business is confidential. The contractor must secure all data and computers and must keep EXIM queries and interests private. EXIM will ensure that the prospective vendor follows due diligence technological best practices for the handling of confidential information in a cloud-based system. GOVERNMENT-FURNISHED EQUIPMENT:

None

Not an EXIM deliverable.

Affirmation @ time of proposal

VI. Description of the stand-alone due diligence compliance system and its cloud-based environment.

Information Security Requirements

Meet Information Technology (IT) Security controls and requirements set out within the SOR of this solicitation.

Reference SOR Section 9 of Section

B.4 SOR

below.

@ time of proposal

VII. Description of the stand-alone due diligence compliance system and its cloud-based environment.

ATO REQUIREMENT

If applicable, willingness to work with EXIM's IT Security team to complete a full or partial ATO (Authority To Operate) package fulfilling FISMA and EXIM security controls.

Informational only.

An ATO solution is not desired at time of initial award.

VIII. Description of the stand-alone due diligence compliance system and its cloud-based environment.

No PII *** System of Record Notice (SORN) to the Federal Register (FR) wait period of ## days (can run parallel to ATO process to be determined based on Privacy Assessment)

Informational only.

SORN not required at time of solicitation.

SOR SECTION 6 – WATCH LISTS

# Required Watch Lists 1 Blocked government relevant lists 2 All entries sanctioned under U.S. State Dept - Bureau of International Security and

Nonproliferation sanctions 3 U.S. Bureau of Industry and Security - Denied Persons Lists 4 U.S. Bureau of Industry and Security - Entity List 5 U.S. Bureau of Industry and Security - Military End-User List 6 U.S. Bureau of Industry and Security - Unverified List 7 U.S. Dept. of Treasury Office of Foreign Assets Control (OFAC) Civil Penalties 8 List deleted.

9 European Union sanctions: Cons, list of persons, groups, and entities subject to EU financial sanctions 10 FBI List of Most Wanted and Other press releases 11 Financial Crimes Enforcement Network (FinCEN) 12 Immigration and Customs Enforcement 13 Inter-American Development Bank List of Sanctioned Firms and Individuals

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

14 List deleted.

15 Interpol Wanted List 16 Iran Economic Interest 17 Iran Sanctions Act 18 Special Designated Nationals (SDN) List and OFAC list of entities not included in the SDN

(NONSDN)

19 List deleted.

20 List deleted.

21 PEP (Politically Exposed Person) keyword: only for SOE (State Owned Entity) and SIE (State

Invested Entity) sub-keywords 22 Subsidiary owned 50% or more by an OFAC listed Russian Sectoral Sanctioned company 23 U.S. Department of State Terrorist Exclusion List (TEL) 24 U.S. Securities and Exchange Commission 25 List deleted.

26 UK Sanctions List (UK sanctions made under the Sanctions and Anti-Money Laundering Act

2018) 27 U.S. Department of Justice 28 U.S. Dir. of Defense Trade Controls List of Statutorily and Administratively Debarred Parties 29 Chinese Military Companies - Entities subject to the Executive Order 13959 in relation to

Communist Chinese 30 Entities subject to prohibitions pursuant to Directive 1 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

31 Entities subject to prohibitions pursuant to Directive 2 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

32 Entities subject to prohibitions pursuant to Directive 3 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

33 Entities subject to prohibitions pursuant to Directive 4 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

34 U.S. State Attorneys General 35 U.S. System for Award Management 36 World Bank Listing of Ineligible Firms # Extended List for Special Circumstances 1 U.S. Federal Deposit Insurance Corp - Failed Banks 2 U.S. Federal Deposit Insurance Corp 3 U.S. Federal Reserve Board 4 U.S. National Credit Union Administration 5 U.S. OCC Enforcement Actions 6 U.S. OCC National Banks 7 U.S. Office of Thrift Supervision

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

SOR SECTION 7 – SERVICES AGREEMENTS

EXIM as agency of the Federal Government, does not sign services agreements as a means of entering into contract with commercial entities. EXIM may incorporate such service agreements into government contracts with an appropriate caveat that conflicts arising between the terms of the contract and the incorporated service agreement shall be resolved in favor of the former as some terms in a private sector service agreement are inappropriate for incorporation into a Federal Government contract.

SOR SECTION 8 – DESIRED FUTURE ENHANCEMENTS

Below are additional due diligence compliance system desired enhancements EXIM would like to potentially have if available now or in the future.

1. Continuous on-going monitoring feature with an alerting and notification function that is available with

a. Ongoing monitoring and notification features,

b. Continual tracking with whack-a-mole insight and mapping, and

2. Provision of an Application Programming Interface (API) which would allow,

a. EXIM’s disparate transaction systems to speak to each other,

b. API customer programming applications,

c. A centralized process, and

d. Existing duplicative activities eliminated.

SOR SECTION 9 – Information Security Requirements

Cybersecurity Protection (Required FAR Clauses)

The following FAR clauses are included by reference below, in all IT service and/or IT service-related solicitations and contracts.

52.224-1, Privacy Act Notification 52.224-2, Privacy Act 52.224-3, Privacy Training 52.239-1, Privacy or Security Safeguards 52.204-21, Basic Safeguarding of Covered Vendor/Contractor Information Systems 52.227-14, Rights in Data – General and Alternate V 36 C.F.R. § 1194.1 and Appendices A, C and D to Part 1194, Revised 508 Standards

Laws, Standards, Policy, and Guidance The activities as required by this SOW necessitate the Vendor/Contractor’s access to Government Information, which may include Controlled Unclassified Information (CUI) and personally identifiable information (PII). The Vendor/Contractor shall meet and comply with all EXIM’s Information Technology (IT) security policy requirements, NIST standards and OMB guidelines, and other applicable Government-wide laws and regulations that apply to the protection and security of IT systems.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

The Vendor/Contractor is required to comply with current IT security and privacy requirements as outlined in EXIM policies and Federal statutes, regulations, policies and guidance, as applicable. These requirements include but are not limited to:

Federal Information Security Modernization Act of 2014 (FISMA) (Public Law 113-283) (PDF, December 2014), as amended

Privacy Act of 1974, (5 U.S.C. § 552a) E-Government Act of 2002, Section 207 and 208 Digital Government Strategy (May 2012) Cybersecurity Executive Order 13800 (May 11, 2017) Clinger-Cohen Act of 1996 also known as the “Information Technology Management

Reform Act of 1996” Office of Management and Budget (OMB) memorandums and circulars specifically including, but not limited to:

Office of Management and Budget (OMB) Circular A-130, “Managing Strategic

Information as a Resource” o OMB M-17-06, Policies for Federal Agency Public Websites and Digital Services (PDF, 1.2 MB, 18 pages, November 2016) o OMB Circular A-130, Managing Information as a Strategic Resource (July 28, 2016) o OMB M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (PDF, 258 KB, 5 pages, June 2015) o OMB M-04-15 Reporting Instructions for the Federal Information Security Management Act (PDF, 269 KB, 28 pages, August 2004)

Title V - Confidential Information Protection and Statistical Efficiency Act of 2002 of the E- Government Act of 2002 (CIPSEA)

Director Order 14028 for Improving the Nation’s Cybersecurity Executive Order 13556 for Controlled Unclassified Information (CUI) NIST guidelines and publications specifically including, but not limited to: o NIST Special

Publication (SP) 800-18 (as amended), “Guide for Developing Security Plans for Federal Information Systems o NIST Guidelines on Securing Public Web Servers (PDF, 960 KB, 142 pages, September 2007) o NIST SP 800-30, “Risk Management Guide for Information Technology Security Risk Assessment Procedures for Information Technology Systems” o NIST SP 800-34, “Contingency Planning Guide for Information Technology Systems” o NIST SP 800-37, (as amended), “Guide for the Security Certification and Accreditation of Federal Information Systems” o NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems” o NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations o NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations

FIPS Publications specifically including, but not limited to: o FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems o FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001 o FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

The Vendor/Contractor and any sub-Contractor must not publish or disclose in any manner without prior written consent, the data/information to which the Vendor/Contractor will have access because of this contract, as this is the sole property of EXIM. Information received in the course of performing this contract will only be used for the purpose of performing this contract, and may not be used for general corporate purposes or otherwise disclosed outside of the team performing this contract. The use of any information for the preparation of other proposals or defense of any action against the government outside of this contract is expressly prohibited. If there is a future potential conflict with this contract (e.g., submitting a new proposal to the government), the Vendor/Contractor must have an approved plan to use any staff assigned to this contract participate in any way in the preparation of work outside of this proposal. Vendor/Contractor /sub-Contractors may be held responsible for any violations of confidentiality.

Information System Security Requirements

Information System

The Vendor/Contractor shall comply with implementation of required security and privacy controls for protection of the EXIM information based on the sensitivity of the data as outlined by Federal, statutory and regulatory requirements and guidance, and EXIM policies and rules of behavior. The Vendor/Contractor facilities and IT systems shall meet the security requirements for the same Impact Level or greater as defined by the FIPS PUB 199 as required for the protection of Government Information.

The Vendor/Contractor shall implement and maintain an Information Security program that includes privacy and is consistent with EXIM’s approach to cybersecurity risk management and that is compliant with EXIM policies, FISMA, and applicable NIST Special Publications, OMB guidelines, and other applicable laws, throughout the performance of this contract.

The Vendor/Contractor shall meet or exceed the continuous monitoring requirements identified in the EXIM Information Security Continuous Monitoring (ISCM) Strategy and Federal statutory and regulatory requirements and other applicable OMB and EXIM policies. All systems provided for EXIM use must obtain and maintain an Authority to Operate (ATO) Authorization from EXIM. The ATO must include how the system meets continuous monitoring of security controls of the Vendor/Contractor’s system, and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. The Vendor/Contractor shall also store monthly continuous monitoring data at its location or a location identified by EXIM for a period not less than one year from the creation date.

a) Information System Security Officer (ISSO) - The Vendor/Contractor is responsible for appointing a designated person as the Vendor/Contractor ISSO for an information system as defined in this paragraph. The ISSO must have experience in system security, continuous monitoring, and security assessments of at least two years.

b) The Vendor/Contractor must be willing to work with EXIM in order to complete all of the requirements of an ATO after acquisition using the ISSO as the main point of contact (POC) to work with the EXIM cybersecurity team. Cloud-based solutions must be FedRAMP Authorized, Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001 or committed to work with EXIM to become FedRAMP Authorized if directed. ATO and FedRAMP documentation and inspections must be provided in a timely manner one (1) business day for items up to one (1) page or one (1) hour of time, five (5) business days for items up to ten (10) pages for four (4) hours of time, ten (10) business days for up to twenty

(20) pages or eight (8) hours of time, negotiable with the government if in excess of these limits. Once obtained, the solution must maintain EXIM ATO and FedRAMP Authorization through the life of the contract.

c) Supply Chain Risk Management (SCRM) - The Federal Information Security Modernization Act of 2014 (Public Law 113-283) and associated NIST guidance requires Federal agencies to manage supply chain risks for Federal information systems and to ensure the effectiveness of information security controls and risks. The Contractor shall have in-place a program or capability to identify threats to its supply chain, and coordinate with the EXIM CISO the timely identification and mitigation of supply chain risk in the provision of supplies and services to

EXIM.

d) Pass-through or minimum two-factor-authentication is required (examples are Personal Identity Verification (PIV) card – preferred, phone via text or voice, registered computer, etc.).

e) Configuration Baselines/Security Configurations - The Vendor/Contractor must configure its systems that contain EXIM information in accordance with configuration requirements that are defined in EXIM policies and procedures. The Vendor/Contractor shall not publish or disclose in any manner, without written consent, the details of any safeguards either designed or developed by the Vendor/Contractor under this contract or otherwise provided by the Government. Any exceptions must be approved in writing from the CIO or CISO.

f) Reporting Requirements - The Vendor/Contractor shall immediately report and handle, as tasked, any threats, incidents, potential incidents/events, and any other hazards to the integrity, availability, and confidentiality of EXIM data and/or information systems and in compliance with requirements and procedures defined in the EXIM Incident Response Policies and Procedures and any other relevant system documentation.

g) Access – After appropriate notice, the Vendor/Contractor must provide EXIM, including EXIM’s Office of Inspector General, with access to the Vendor/Contractor’s and Subcontractors’ facilities, installations, operations, documentation, databases, and personnel used in the performance of the contract.

h) Employee Termination - The Vendor/Contractor shall immediately notify the COR when a direct support employee plans to terminate employment or an employee is removed from the contract.

i) Contract Termination - Failure on the part of the Vendor/Contractor to comply with the terms of this clause may result in termination of this contract.

j) Statutory and Regulatory Requirements - The Vendor/Contractor must comply with all requirements in the paragraphs above including the EXIM Cybersecurity and Privacy Policies, which lists in detail the requirements for Federal information systems.

Privacy Impact Assessment

The Vendor/Contractor must assist EXIM in the completion of a Privacy Impact Assessment (PIA) in accordance to the E-Government Act of 2002, sec. 208, and the Privacy Act of 1974, for Vendor/Contractor systems or new technologies that collect, maintains, or disseminates PII from ten

(10) or more members of the public.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

In order to ensure the physical and information systems security of the confidential information, agencies shall conduct inspections of any off-site facility that harbors confidential information protected under CIPSEA.

Use of EXIM Information

Vendor/Contractor shall:

The vendor will not remove any government furnished information from EXIM facilities or systems unless expressly authorized.

Use the EXIM CUI, PII, or sensitive information (EXIM data) only for the purposes described herein;

Not reproduce the EXIM data, and will hold in confidence and protect the information from dissemination to, and use by, any third party;

Except as required in performance obligations under the contract, it will not create any derivative work from EXIM data;

Restrict access to the EXIM data to its personnel, agents, or consultants, if any, who have a need to have access and who have been advised of and have agreed in writing or are otherwise bound to treat such information in accordance with the terms of the contract;

As part of the contract closeout, return or destroy (as directed by EXIM) all EXIM data in its possession upon termination or expiration of the contract or as otherwise requested by the

EXIM;

Submit evidence of compliance with the close-out requirements in this provision, in a manner described by EXIM, at its discretion;

Not commingle EXIM data with Vendor/Contractor- specific records or data;

Contractors engaging in cross-device tracking at all phases should truthfully disclose their tracking activities, accurately identify the categories of data collected involved, and provide meaningful information about whether and how cross-device tracking occurs; and

Follow the agency’s Records Control Schedule and/or the General Records Schedules for EXIM data.

Privacy or EXIM’s Data Breach Notification (if any)

In the event that the Vendor/Contractor suspects or confirms a privacy or EXIM data breach (if any), the Vendor/Contractor is required to do the following:

Notify the CORs and EXIM Helpdesk at 202-565-3990 (helpdesk@exim.gov), within one hour of a suspected or confirmed breach, in any medium or form, including paper, oral, and electronic.

Vendor/Contractor shall provide at a minimum, the following information (and be responsive to further questions on details from the Helpdesk and/or the Cybersecurity team):

Date and time the breach was discovered;

The type of information potentially compromised by the suspected or confirmed breach;

Number of individuals affected by the suspected or confirmed breach;

Steps taken to notify the individuals affected by the suspected or confirmed breach;

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

Identification of the breakdown in safeguards that led to the suspected or confirmed breach;

and

Any additional information relevant to the breach.

Understand that reporting a privacy breach shall not, by itself, be interpreted as evidence that the Vendor/Contractor or its subcontractor (at any tier) failed to provide adequate safeguards for EXIM data.

All determinations related to EXIM information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Vendor/Contractor in consultation with the EXIM COR and/or Chief Privacy Officer (CPO).

The Vendor/Contractor shall provide full access and cooperation for all activities determined by EXIM to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

Incident response activities determined to be required by EXIM may include, but are not limited to, the following:

Inspections;

Investigations;

Forensic reviews; and Data analyses and processing.

EXIM, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

Recordkeeping

The Vendor/Contractor’s operating information systems on behalf of the Government or operating systems containing sensitive information shall cooperate and comply with Federal reporting requirements.

Service Level Agreement (SLA)

EXIM as an agency of the Federal Government, does not sign services agreements as a means of entering into contract with commercial entities. EXIM may incorporate such service agreements into government contracts with an appropriate caveat that conflicts arising between the terms of the contract and the incorporated service agreement shall be resolved in favor of the former as some terms in a private sector service agreement are inappropriate for incorporation into a Federal Government contract.

B.5 DELIVERABLES SPECIFIC

Reference Statement of Requirements (SOR) above.

B.6 COOPERATION

The contractor will be required to cooperate with any other firms or individuals as directed by EXIM.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

B.7 INFORMATION PROTECTION

Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of this contract. Contractor shall implement procedures that ensure appropriate administrative, technical, and physical safeguards are established for the security and confidentiality of US Government information, data, and/or equipment.

The contractor’s procedures with respect to access to / safeguarding / use of government information / records / data shall be consistent with then current US Government law and regulation in general, and the OMB Circular A-130 Management of Federal Information Resources in particular.

In addition, during all activities and operations on government premises, the contractor shall comply with the policies, rules, procedures, and regulations governing the conduct of personnel upon or within government facilities, and or the protection of government information / records / data as are in general effect and or promulgated locally by EXIM, written or oral. All documents and information in contractor’s possession pertaining to government network vulnerabilities, security policy, operational procedures or related functions shall be maintained by the contractor under absolute accountability and relinquished to the COR upon completion of the contract.

B.8 COMPLIANCE WITH IT SECURITY POLICES, PROCEDURES, AND REQUIREMENTS

IAW FAR 4.1903 and 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, the contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the Federal Information Security Management Act of 2014 (“FISMA”), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology (“NIST”) Special Publications (“SP”), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards (“FIPS”) Publications 140-2, 199, and 200, OMB Memoranda, Federal Risk and Authorization Management Program (“FedRAMP”).

a) Section 508 – Accessibility of Electronic and Information Technology This requirement is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220).

URL: https://www.congress.gov/bill/105th-congress/house-bill/1385 full text: https://www.congress.gov/105/plaws/publ220/PLAW-105publ220.pdf

Section C – Contract Clauses

C.1 PROVISIONS AND CLAUSES INCORPORATED BY REFERENCE (IBR) IAW FAR 52.102

The following provisions and clauses were pulled from the Federal Acquisition Regulations FAR Smart Matrix and are incorporated by reference per the Subpart 52.3 - Provision and Clause Matrix Key in addition to the clauses 51.212-4 and 52.212-5.

Provisions and Clauses Incorporated by Reference Prescribed In FAR Provision (P) or Clause (C)

52.214-34 Submission of Offers in the English Language 14.201-6(w) P 52.215-19 Notification of Ownership Changes 15.408(k) C 52.217-4 Evaluation of Options Exercised at Time of Contract Award. 17.208(b) P 52.217-5 Evaluation of Options. 17.208(c) P 52.225-14 Inconsistency between English Version and Translation of Contract. 25.1103(b) C 52.227-19 Commercial Computer Software License 27.409(g) C 52.227-23 Rights to Proposal Data (Technical) 27.409(l) C 52.232-23 Assignment of Claims 32.806(a)(1) C 52.232-40 Providing Accelerated Payments to Small Business Subcontractors. 32.009-2 C https://www.congress.gov/bill/105th-congress/house-bill/1385 https://www.congress.gov/105/plaws/publ220/PLAW-105publ220.pdf https://www.acquisition.gov/far-smart-matrix https://www.acquisition.gov/far-smart-matrix https://www.acquisition.gov/far-smart-matrix https://acquisition-uat.gsa.gov/far/part-52#FAR_Subpart_52_3

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 – Re-Open Solicitation Amendment A0001

Provisions and Clauses Incorporated by Reference Prescribed In FAR Provision (P) or Clause (C)

52.233-2 Service of Protest 33.106 P

52.233.3 Protest After Award 33.106(b) C

52.237-3 Continuity of Services 37.110(c) C 52.242-5 Payments to Small Business Subcontractors. 42.1504 C 52.242-13 Bankruptcy 42.903 C 52.242-15 Stop-Work Order 42.1305(b) C

C.2 PROVISIONS AND CLAUSES INCORPORATED BY FULL TEXT

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services.

Referenced below in Section E.

52.212-2 Evaluation—Commercial Products and Commercial Services Referenced below in Section E.

52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services.

SAM.gov prime contractor information shall be used for 52.212-3.

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services.

Referenced in Section C. To be included in full text with award document.

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Products and Commercial Services.

Referenced in Section C. To be included in full text with award document.

52.217-8 Option to Extend Services.

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within fifteen (15) days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

b) The Government may extend the term of this contract by written notice to the Contractor within fifteen (15) days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least fifteen (15) days before the contract expires. The preliminary notice does not commit the Government to an extension.

c) If the Government exercises this…