RFP_9523ZY-18-Q-0209_-_Market_Data_Feed_Services.pdf

9523ZY-18-Q-0209 Page 1

Request for Quote

MARKET DATA PRICING FEED

RFQ #9523ZY-18-Q-0209

9523ZY-18-Q-0209 Page 2

The U.S. Commodity Futures Trading Commission (CFTC) has a requirement for Market Data Pricing Feed.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a separate written solicitation will not be issued.

The solicitation number is 9523ZY-18-Q-0209. This solicitation is issued as a request for quotes (RFQ).

The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-99 / 6-15-2018.

The applicable NAICS code is 523920, and this is an unrestricted full and open competition.

See Section II for a list of contract line item numbers and items, quantities and units of measure, (including options).

See Section II for a description of requirements for the items to be acquired: Market Data Pricing Feed.

Dates and place of performance: The period of performance is a base period of twelve (12) months and four (4) twelve (12) month options. The place of performance is the contractor’s facilities and CFTC offices in Washington, DC.

See Section III for the provision FAR 52.212-1, Instructions to Quoters – Commercial and the associated addenda.

See Section III for the description of the Evaluation in lieu of provision FAR 52.212-2, Evaluation- Commercial Items.

Quoters shall include a completed copy of provision FAR 52.212-3, Quoter’s Representations and Certifications-Commercial Items with the quotation or available for review in SAM in accordance with Section III.

FAR 52.212-4, Contract Terms and Conditions-Commercial Items is applicable to this solicitation. (See Section II.)

FAR 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Items is applicable to this solicitation. (See Section II.)

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P295_49304

9523ZY-18-Q-0209 Page 3

See Section II for all applicable additional terms and conditions for this solicitation.

Period for acceptance of quotations: The quoter agrees to hold the prices in its offer firm for 90 calendar days from the date specified for receipt of quotations.

The date and time quotations are due: 1:00 pm local (Washington, DC), July 23, 2018.

The name and telephone number of the individual to contact for information regarding the amended solicitation: Jerald Neveleff (202.418.5345), jneveleff@cftc.gov. Questions are due in writing to jneveleff@cftc.gov not later than 1:00 pm local (Washington, DC), July 6, 2018.

This request for quotations shall not be construed as a commitment of any kind.

REST OF THIS PAGE INTENTIONALLY LEFT BLANK

mailto:jneveleff@cftc.gov

9523ZY-18-Q-0209 Page 4

PART I

Statement of Work

Access to Data for All Commodities Listed In Existing U.S. Commodity Exchanges

1. BACKGROUND

The Commodity Futures Trading Commission (CFTC) is a federal government agency with offices located in Washington, DC, Chicago, IL, New York, NY and Kansas City, MO. The CFTC’s mission is to protect commodity market users and the public from fraud, manipulation, and abusive practices related to the sale of commodity and financial futures and options, and to foster open, competitive, and financially sound futures and option markets.

The CFTC’s Division of Clearing and Risk (DCR) oversees derivatives clearing organizations (DCO’s) and other market participants in the clearing process, including futures commission merchants (FCMs), swap dealers, major swap participants and large traders. It monitors the clearing of futures, options on futures, and swaps by DCO’s, assesses DCO compliance with Commission regulations, and conducts risk assessment and financial surveillance. DCR also makes recommendations on DCO applications and eligibility, rule submissions, and which types of swaps should be cleared.

The Office of Data and Technology (ODT) provides an enterprise-wide, integrated data and technology strategy to support the effective oversight of the highly electronic futures, options, and swaps marketplaces. ODT works in support of all of the Divisions and Offices of the Commission to ensure that the Divisions have what they need in terms of data and technology to meet their goals.

DCR has partnered with ODT to license Global Risk’s Firm Risk software. The Firm Risk software provides DCR with insight into the risk related to futures portfolios of FCM’s and other market participants. Positions of market participants are ingesting into the Firm Risk tool and compared with market pricing to provide a top day view into the current value of the portfolios. To accurately assess the portfolio value against market fluctuations Firm Risk software requires market data pricing throughout the business day. This software was successfully deployed as a Production environment in May of 2016.

This Statement of Work is to secure the services required to provide this data on a real time or near real time basis, as noted with Attachment A – Mandatory Requirements Matrix.

2. GENERAL SCOPE

The Contractor shall provide a market data pricing feed and any necessary services to make this data available to the CFTC for use within the Firm Risk software. The Contractor shall, at a minimum, meet the requirements as listed in Attachment A – Mandatory Requirements Matrix.

9523ZY-18-Q-0209 Page 5

The Contractor shall provide technical support, as required, through its annual maintenance agreement. Throughout the contract, the Contractor shall ensure that the solution maintains compatibility with commercial off-the-shelf software releases such as Windows and SQL Server.

The Contractor shall perform implementation necessary to connect to the Market Data Pricing Feed data set as required for the successful ongoing processing of the Firm Risk system.

CURRENT OPERATING SYSTEM:

The Firm Risk software uses real-time market data for intraday risk analysis and alerting on futures and options positions under the regulatory purview of the CFTC. As market data is sent to the Firm Risk server, the client application updates and displays the valuation, risk, and intraday profit/loss for all firm and client positions that have been loaded. This allows the CFTC to continuously monitor the systemic risks posed by intermediaries including clearinghouses, clearing firms, futures, commission merchants, and large traders

The Firm Risk system sends a series of data request for the required market instruments to the data vendor over a dedicated VPN. The data requests are currently provided real time for all required instruments.

3. IMPLEMENTATION

The contractor shall design, configure, and implement the network connectivity to the CFTC as well as to the Firm Risk software platform within thirty (30) days of award.

The contractor shall provide a Requirements Traceability Matrix that tracks each requirement through the testing, showing that all requirements listed in Attachment A, Mandatory Requirement Matrix are implemented and verified. The contractor shall also provide project and implementation plans, architecture documentation, testing and operational procedures as per the requirements in Section 6 below.

The testing performed by the contractor shall include all pre/post-testing of the system, including maintaining quality control and performing user acceptance testing. The CFTC will use the User Acceptance Testing as part of its acceptance process.

During implementation, and at the discretion of the Contracting Officer’s Representative (COR), the contractor shall participate, in-person or through other means, in project progress meetings with the COR. The frequency of the meetings will vary, and may be daily at times. The purpose of the meetings will be to discuss the project status, as well as to identify and discuss configuration/integration issues, and to coordinate schedules.

9523ZY-18-Q-0209 Page 6

Acceptance of implementation will be made upon installation and configuration of the data feed into the CFTC and Firm Risk system as well as successful completion of an acceptance test of the solution.

Successful completion means that the data feed operates in the CFTC production environment for 14 consecutive days, and otherwise performs in accordance with all contract requirements and as described in the Contractor’s quotation. Acceptance by the CFTC shall be in writing signed by the Contracting Officer. In the event the requirements are not met, the Contractor shall have up to 14 days to make appropriate corrections and commence a second 14 calendar day acceptance test unless otherwise agreed to by the Contractor and Contracting Officer. In the event the second acceptance test is not successfully completed, or any subsequent test agreed to by the Contracting Officer, the Contracting Officer shall have the right to issue a final rejection of the software and terminate the contract without any future financial obligation to the contractor. Any work performed by the contractor prior to acceptance, including work performed as a result of failure to successfully complete a test, shall be at no additional cost to

CFTC.

Note: Maintenance and technical support efforts shall not commence prior to implementation

4. MAINTENANCE SUPPORT

The Contractor shall provide annual maintenance support during CFTC business hours (7:00 am – 6:00 pm (ET)) for any software and connectivity required for the data transmission. The maintenance support shall include, at a minimum, bug fixes and software updates as well as telephone support for issue remediation.

5. DOCUMENTATION REQUIREMENTS

The required documents are listed below and are due in accordance with Section 10

DELIVERABLES.

• Architecture and Design Document – The contractor shall provide architecture and design documentation that is in compliance with the CFTC’s architecture principles and development best practices.

• Project Schedule - The contractor shall provide a project schedule which will outline the milestones, deliverables, interdependencies, staff responsible for tasks, and start to finish dates.

• Implementation Plan – The contractor shall provide an implementation plan that describes the steps the quoter will take to install the proposed system (i.e., testing, production installation and configuration of the system) and includes dates (elapsed time from date of award) for major milestones.

9523ZY-18-Q-0209 Page 7

• Requirements Traceability Matrix – The contractor shall provide a traceability matrix of the requirements from the statement of work all the way through the design, development and implementation process. The Traceability Matrix shall include information that all customer requirements have been included in the solution and links the requirements throughout the validation process.

• Operations and Maintenance (O&M) Procedures – The Contractor shall provide

O&M information required to support and maintain the system after its deployment in the CFTC production environment.

• Test Document - The Contractor shall provide test documentation that defines their approach for implementation testing.

6. INTEGRATION – APPLICATION PROGRAMMING INTERFACE (API)

The Contractor shall provide a fully documented Application Programming Interface (API) using a non-proprietary communication language that exposes all essential functions and works with Microsoft technologies such as .NET. The API shall already be reviewed and approved by Global Risk.

7. SUPPORT REQUIREMENT

The contractor shall provide all required implementation, documentation, user training for up to five (5) IT Administrators, and software maintenance and technical support for the life of the contract.

8. DELIVERABLES

The contractor shall prepare deliverables using Microsoft Office Suite 2010, or compatible formats, as approved by the COR. The COR will review all deliverables and provide comments and/or approvals/disapprovals within ten (10) calendar days of receipt.

The CFTC may request bi-weekly interim reviews of deliverables to ensure deliverables are on schedule to meet the intended need. All uses of “days” in the following table refer to business days. The Contractor shall produce the following deliverables.

Deliverables Due Date Interconnection Security Agreement To be submitted with the Quote

Architecture and Design Document Within 10 calendar days of contract award

Project Schedule Within 10 calendar days of contract award

Implementation Plan To be submitted with the quotation

9523ZY-18-Q-0209 Page 8

Requirements Traceability Matrix Within 20 calendar days of contract award

Operations and Maintenance Procedures Within 30 calendar days after implementation is completed

Test Document Within 5 calendar days prior to the start of implementation of the solution

9. SYSTEMS REQUIREMENTS

The contractor’s solution shall meet the following Information technology (IT) technical requirements:

• The solution shall not require local administrator permissions to function completely.

• The solution shall be compatible with Internet Explorer 11 or greater.

• The solution shall be compatible with Windows 7 SP1 or greater

• The solution shall be compatible with Microsoft Office 2010 SP2 or greater.

• The solution shall support silent installation.

(End of Statement of Work)

9523ZY-18-Q-0209 Page 9

PART II

ADDITIONAL TERMS AND CONDITIONS

1. CONTRACT PRICING

This is a firm-fixed-priced contract. The total firm-fixed-price is $ ,

2. DESCRIPTION OF SUPPLIES/SERVICES

CLIN Product

Description Period of

Performance Quantity Monthly

Rate Total

Annual Price

Amount Funded

Base Period 0001 Market Data

Pricing Feed September 26, 2018 through August 25, 2019

11 months $ $ $

0002 Implementation and Integration

Award – September 25, Option 1 1001 Market Data

Pricing Feed August 26, 2019 through August 25, 2020

12 months $ $ $

Option 2 2001 Market Data

Pricing Feed August 26, 2020 through August 25, 2021

Option 3 3001 Market Data

Pricing Feed August 26, 2021 through August 25, 2022

Option 4 4001 Market Data

Pricing Feed August 26, 2022 through August 25, 2023

TOTALS $ $

9523ZY-18-Q-0209 Page 10

3. CONTRACTING OFFICER

For the purpose of this contract, the Contracting Officer is:

Jerald (Jerry) Neveleff Commodity Futures Trading Commission Financial Management Branch 1155 21st Street, NW Washington, DC 20581 Phone: (202)418-5345 E-Mail: jneveleff@cftc.gov

4. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The Contracting Officer’s Representative (COR) assigned to this contract is:

To be Provided at Award

5. PAYMENT TO CONTRACTOR (iSUPPLIER)

For purposes of the Prompt Payment Act, P.L. 97-177, payments under this contract will be due on the 30th calendar day after the latter of: (1) the date of actual receipt of a proper invoice in the office designated to receive, or (2) the date the supplies or services are accepted by the Government. For purposes of determining the due date for payment and for no other purpose, acceptance will be deemed to occur on the seventh calendar day after the delivery of the supplies or services in accordance with the terms of the contract.

An invoice for the implementation and integration shall be submitted within thirty (30) days after Government acceptance of the implementation and integration portion of the effort. A single invoice for the annual subscription shall be prepared and submitted in arrears to the designated billing office specified herein. A proper invoice must include the information listed in items 1-8 below. If the invoice does not comply with these requirements, the contractor will be notified of the defect within seven days after receipt of the invoice in the billing office.

1. Name and address of the contractor.

2. Invoice date and invoice number. (The contractor should date invoices as close as possible to the date of the mailing or transmission.)

3. CFTC order number.

4. Description, quantity, unit of measure, unit price, and extended price of supplies delivered or services performed.

5. Shipping and payment terms (e.g., shipment number and date of shipment, discount for prompt payment terms). Bill of lading number and weight of shipment will be shown for shipments on Government bills of lading.

6. Name and address of Contractor official to whom payment is to be sent (must be the same as that in the contract or in a proper notice of assignment).

9523ZY-18-Q-0209 Page 11

7. Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice.

8. Taxpayer Identification Number (TIN).

Payment will be in accordance with the clause at FAR 52.232-33 “Payment by Electronic Funds Transfer-System for Award Management (JUL 2013)”.

The CFTC will only accept electronic invoices submitted through the Delphi eInvoicing system on a monthly basis for processing and payment. The CFTC’s Delphi eInvoicing system is managed by the Department of Transportation’s Enterprise Services Center (ESC).

Vendors shall access and register for the eInvoicing System using the following link:

http://einvoice.esc.gov/

The registration form and instructions are found under the “Forms” link.

Vendors requiring assistance with the eInvoicing system may contact the ESC help desk:

ESC Help Desk for the Delphi eInvoicing System

• Business Hours: 8:00am to 7:00pm

• 1-866-641-3500

6. PERIOD OF PERFORMANCE

CLIN 0001 - September 26, 2018 through August 25, 2019.

CLIN 0002 – Award through September 25, 2018.

7. 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days prior to contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five (5) years.

http://einvoice.esc.gov/

9523ZY-18-Q-0209 Page 12

The period of performance of the Options, if exercised, are as follows:

Option CLIN 1001 - August 26, 2019 through August 25, 2020.

Option CLIN 2001 - August 26, 2020 through August 25, 2021.

Option CLIN 3001 - August 26, 2021 through August 25, 2022.

Option CLIN 4001 - August 26, 2022 through August 25, 2023.

8. TECHNICAL DIRECTION AND SURVEILLANCE

(a) Performance of work under this contract shall be subject to the surveillance and written technical direction of the COR. The term “technical direction” is defined to include:

(1) Inspection and acceptance of deliverables completed by the contractor under this contract.

(b) The COR does not have authority to, and may not, issue any technical direction which:

(1) Assigns additional work outside the scope of work for the contract;

(2) Constitutes a change as defined in the contract clause(s) that address “changes”;

(3) In any manner causes an increase or decrease in the contract price or the time required for performance;

(4) Changes any of the expressed terms, conditions or specifications of the contract; or

(5) Interferes with the contractor’s right to perform the terms and conditions of the contract.

(c) All technical direction shall be issued in writing by the COR. The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed in this clause and within his/her authority under the provisions of this clause. If, in the opinion of the contractor, any instruction or direction by the COR would increase or decrease the cost of the contract or result in work outside the scope of this contract, the contractor shall not proceed but shall immediately notify the Contracting Officer in writing. It is anticipated that within 30 days of receiving the notification from the contractor, the Contracting Officer will either issue an appropriate contract modification or advise the contractor in writing that:

(1) The technical direction is rescinded in its entirety;

(2) The technical direction is within the scope of the contract, does not constitute a change as defined in the contract clause(s) that address “changes” and that the contractor should continue with the performance of the technical direction.

9523ZY-18-Q-0209 Page 13

(d) A failure of the contractor and Contracting Officer to agree that the technical direction is within scope of the contract, or a failure to agree upon the contract action to be taken with respect thereto, shall be subject to the provisions of the “Disputes” clause of the contract.

(e) Any action(s) taken by the contractor in response to any direction given by any person other than the Contracting Officer or the COR whom the Contracting Officer shall appoint shall be at the contractor’s risk.

9. LIABILITY

The Contractor shall be responsible for all liabilities which result from willful misconduct, gross negligence, or lack of good faith on the part of any of its officers and employees. Such liability is not restricted by any dollar limitations.

10. GOVERNMENT RIGHTS IN SOFTWARE AND DATA

The Government shall have unrestricted rights in all computer software, documentation, and other data developed and created by the Contractor under this contract specifically for CFTC, as described in FAR Clause 52.227-17, Rights in Data – Special Works (DEC 2007), which is incorporated herein by reference.

11. CFTC IT SYSTEMS AND SUPPORT SERVICES CONTRACT REQUIREMENTS

General

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and CFTC policies as CFTC, and CFTC personnel, regarding information and information systems security. Contractors must follow policies and procedures outlined in CFTC IT Security Program to ensure appropriate security controls are in place.

Access to CFTC Information and CFTC Information Systems

A contractor shall request logical (technical) and/or physical access to CFTC information and CFTC information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract, and (3) individuals must satisfy the same conditions, requirements and restrictions comparable to CFTC employees in order to access the same type of CFTC information.

All contractors and subcontractors working with CFTC information are subject to the same investigative requirements as those of regular CFTC appointees or employees who have access to the same types of information. Contractors are responsible for screening their employees. Furthermore, contract personnel who require access to national security programs

9523ZY-18-Q-0209 Page 14 must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry safeguards the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. Defense Security Service (DSS) administers the NISP on behalf of the Department of Defense and 23 other federal agencies within the Executive Branch. CFTC will verify clearance through DSS.

CFTC Information Custodial Requirements

Information made available to the contractor by CFTC for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer.

CFTC information will not be co-mingled with any other data on the contractor’s/subcontractor’s information systems/media storage systems in order to ensure CFTC requirements related to data protection and media sanitization can be met. CFTC also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization or disposal procedures to ensure they are in compliance with CFTC policy requirements.

Prior to termination or completion of this contract, the contractor will not destroy information received from CFTC or gathered or created by the contractor in the course of performing this contract without prior written approval by the CFTC Contracting Officer. Any data destruction done on behalf of CFTC by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements.

The contractor will receive, gather, store, back-up, maintain, use, disclose and dispose of CFTC information only in compliance with the terms of the contract and applicable Federal and CFTC information confidentiality and security laws, regulations and policies. Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST). If Federal or CFTC information confidentiality and security laws, regulations and policies become applicable to the CFTC information or information systems after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in the contract.

Contractors collecting, storing, or disseminating personally identifiable information (PII) data must conform to all pertinent regulations, laws, and CFTC directives related to privacy.

The contractor shall not make copies of CFTC information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

9523ZY-18-Q-0209 Page 15

If CFTC determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for CFTC to terminate the contract for default or terminate for cause under Federal Acquisition Regulation (“FAR”) part 12.

The contractor will store, transport or transmit CFTC sensitive information in an encrypted form, using a CFTC-approved encryption application that meets the requirements of NIST’s FIPS 140- 2 standard.

Information System Design and Development

Information systems that are designed or developed for or on behalf of CFTC at non-CFTC facilities shall comply with all CFTC policies developed in accordance with Federal Information Security Management Act (FISMA), NIST, and related CFTC security and privacy control requirements for Federal information systems. This includes information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization.

The security controls must be designed, developed, approved by CFTC, and implemented in accordance with the provisions of CFTC security system development life cycle as outlined in NIST Special Publication 800-37.

The contractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies --

i. The systems of records; and

ii. The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and,

(3) Include this Privacy Act clause, including this subparagraph in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

Information System Hosting, Operation, Maintenance or Use

For information systems that are hosted, operated, maintained, or used on behalf of CFTC at non-CFTC facilities, contractors are fully responsible and accountable for ensuring compliance with all Privacy Act, FISMA, NIST, FIPS, and CFTC security and privacy directives and handbooks. The contractor security control procedures must be identical, not equivalent, to those procedures used to secure CFTC systems. A privacy impact assessment (PIA) must also be provided to the COR and approved by the CFTC Privacy Office prior to operational

9523ZY-18-Q-0209 Page 16 approval. All external Internet connections involving CFTC information must be reviewed and approved by CFTC prior to implementation.

Adequate security controls for collecting, processing, transmitting, and storing of personally identifiable information, as determined by the CFTC Privacy Office, must be in place, tested, and approved by CFTC prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of CFTC. These security controls need to be stated within the PIA and supported by a risk assessment. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

Outsourcing (contractor facility/contractor equipment/contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (C&A) of the contractor’s systems in accordance with NIST Special Publication 800-37 and privacy impact assessment of the contractor’s systems prior to operation of the systems. Government-owned (government facility/government equipment) contractor operated systems, third party or business partner networks require a system interconnection agreement and a memorandum of understanding (MOU) which detail what data types will be shared, who will have access, and the appropriate level of security controls for all systems connected to CFTC networks.

The contractor must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the CFTC Contracting Officer and the Information Security Officer (ISO) for entry into CFTC’s Plan of Action and Milestone (POA&M) management process. The contractor will use CFTC’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the Government. Contractor procedures will be subject to periodic, unannounced assessments by CFTC officials. The physical security aspects associated with contractor activities will also be subject to such assessments. As updates to the system occur, an updated PIA must be submitted to the CFTC Privacy Office through the COR for approval.

All electronic storage media used on non-CFTC leased or owned IT equipment that is used to store, process, or access CFTC sensitive information must have all CFTC sensitive information removed, cleared, sanitized, or destroyed in accordance with CFTC policies and procedures upon: (1) completion or termination of the contract or (2) disposal or return of the IT equipment by the contractor or any person acting on behalf of the contractor, whichever is earlier.

Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to CFTC assets, or sensitive information, or an action that breaches CFTC security procedures. The contractor shall immediately notify the COR and simultaneously, the designated ISO/Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that

9523ZY-18-Q-0209 Page 17 contained in systems(s) to which the contractor has access.

To the extent known by the contractor, the contractor’s notice to CFTC will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the CFTC information/assets were placed at risk or compromised), and any other information that the contractor considers relevant.

To the extent practicable, the contractor shall mitigate any harmful effects on individuals whose CFTC information was accessed or disclosed in a security incident. In the event of a data breach with respect to any CFTC sensitive information processed or maintained by the contractor or subcontractor under the contract, the contractor is responsible for liquidated damages to be paid to CFTC.

Security Controls Compliance Testing

On a periodic basis, CFTC reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by CFTC in the event of a security incident or at any other time.

Training

All contractor employees and subcontractor employees requiring access to CFTC information and CFTC information systems shall complete the following before being granted access to CFTC networks:

(1) Sign and acknowledge understanding of and responsibilities for compliance with the CFTC Rules of Behavior relating to access to CFTC information and information systems;

(2) Successfully complete CFTC Cyber Security Awareness Training (CSAT) and annual refresher training as required;

(3) Successfully complete CFTC General Privacy training and annual refresher training as required; and

(4) Successfully complete any additional cyber security or privacy training, as required for CFTC personnel with equivalent information system access – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirement.

The contractor shall provide to the Contracting Officer a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

9523ZY-18-Q-0209 Page 18

12. TERMS OF SERVICE AGREEMENTS

There are no End User License Agreements (EULAs), Terms of Service, or other similar legal instruments or agreements incorporated or applicable to this order. In the event that such a legal instrument or agreement is later required by the contractor or any third-party service provider, the terms and conditions shall first be negotiated and approved by the CFTC Contracting Officer before they may apply to CFTC and its users of the services of the contractor or any third-party service provider.

The contractor agrees that if any such legal instrument or agreement contains a provision (a) allowing for the contractor or its third-parties’ termination of services; (b) allowing for the automatic renewal of services and/or fees; (c) requiring the governing law to be anything other than Federal law; and/or (d) specifying the jurisdiction and venue of any action, then such terms shall not apply with respect to the U.S. Government. In the event the contractor’s terms and conditions or those of any third-party service provider contain an indemnification provision, such provision shall not apply as to the U.S. Government indemnifying any party unless expressly authorized by statute and specifically authorized under CFTC regulations and procedures.

Changes to any terms and conditions shall be made pursuant to the Changes provisions of this contract [see FAR 52.212-4 “Contract Terms and Conditions – Commercial Items (JAN 2017)”]. Only a warranted Contracting Officer of CFTC may agree to changes on CFTC’s behalf. The contractor and/or its third parties shall not attempt to unilaterally change the terms and conditions of this order including through the release of software updates. Any requirement from the contractor or its third-parties to accept different terms and conditions than those approved by the CFTC Contracting Officer by means of use, download, or click-through agreements shall be unenforceable.

13. F.O.B. POINT

Delivery of any and all items under this contract shall be shipped F.O.B. destination to the Contracting Officer’s Representative identified under Part II, Additional Terms and Conditions, Section 4 of this contract.

14. ORGANIZATIONAL CONFLICTS OF INTEREST (OCI)

Federal Acquisition Regulation (FAR) Subpart 9.5 prescribes responsibilities, general rules, and procedures for identifying, evaluating and resolving organizational conflicts of interest. The purpose of this clause is to avoid, neutralize, or otherwise mitigate conflicts of interest that might exist related to a contractor’s performance of work under this contract. If the contractor is aware, or becomes aware during the term of this contract, of any facts that might create an actual or

9523ZY-18-Q-0209 Page 19 potential conflict of interest, the contractor shall immediately provide a detailed disclosure of such facts to the Contracting Officer. At the request of the Contracting Officer, the contractor shall provide a conflict of interest avoidance or mitigation plan to CFTC. If such a plan is requested, continued performance under the contract may be conditional upon the Contracting Officer’s approval of the plan.

If approved by the Contracting Officer, the conflict of interest avoidance or mitigation plan shall be deemed incorporated into this contract, pursuant to this provision. This clause shall be included in any teaming or subcontract agreements with respect to work performed under this contract.

15. COMMON SECURITY CONFIGURATIONS

(a) The data access system must fully comply with CFTC’s existing Windows based Directory Services (Lightweight Directory Access Protocol, Active Directory) to support user access. Other government standards that apply include OMB Circular A-130, Federal Information Security Management Act (FISMA), NIST Special Publication 800 Series, including NIST SP 800-53 rev. 4, the Privacy Act of 1974 as amended, and the Freedom of Information Act as amended. The software must contain security controls based on industry best practices.

(b) The contractor will certify that the system is fully functional and operates correctly as intended on systems using the United States Government Configuration Baseline (USGCB) for Windows 7. For the Windows 7 settings see:

http://www.microsoft.com/industry/government/solutions/usgcb/default.aspx

(c) The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to install and uninstall.

(d) The Commodity Futures Trading Commission reserves the right to test all delivered information technology to verify the contractor’s certification required in paragraph (a) above.

In the event the information technology does not meet the requirements of this clause, and the defect is brought to the Contractor’s attention no later than one year after the date of final payment under this contract, the Contractor shall correct the defect at no cost to the Government.

16. PRIVACY ACT COMPLIANCE

The contractor and contractor personnel shall store, use, maintain, share and dispose of personally identifying information it receives under this contract in accordance with the Privacy Act of 1974 (5 USC §552a) and it’s implementing Federal regulations.

http://www.microsoft.com/industry/government/solutions/usgcb/default.aspx

9523ZY-18-Q-0209 Page 20

17. NOTICE LISTING CONTRACT CLAUSE INCORPORATED BY REFERENCE

The following contract clauses pertinent to this Part are hereby incorporated by reference (by Citation Number, Title, and Date), with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of clauses incorporated by reference may be accessed electronically at this Internet address:

http://www.acquisition.gov/far

NUMBER TITLE DATE

52.203-3 GRATUITIES APR 1984

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER APR 2014

RIGHTS AND REQUIREMENT TO INFORM

EMPLOYEES OF WHISTLEBLOWER RIGHTS

52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON MAY 2011

RECYCLED PAPER

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY JUL 2016

CODE MAINTENANCE

52.212-4 CONTRACT TERMS AND CONDITIONS-- JAN 2017

COMMERCIAL ITEMS

52.232-40 PROVIDING ACCELERATED PAYMENTS TO DEC 2013

SMALL BUSINESS SUBCONTRACTORS

17. 52.212-5 - - CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS -- COMMERCIAL ITEMS (JAN

2018)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(3) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(4) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004)(Public Laws 108-

77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the

Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1158787 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1146366 https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html#wp1113329 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html#wp1113344 http://uscode.house.gov/

9523ZY-18-Q-0209 Page 21

[Contracting Officer check as appropriate.]

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

X (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

X (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15

U.S.C. 657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (JAN 2011) of 52.219-4.

__ (13) [Reserved] __ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644).

__ (ii) Alternate I (Nov 2011).

__ (iii) Alternate II (Nov 2011).

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C.

644).

__ (ii) Alternate I (Oct 1995) of 52.219-7.

__ (iii) Alternate II (Mar 2004) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)).

https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1137622 http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1141983 http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1144881 https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1141649 http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1151163 https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1151299 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1140926 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1145644 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135955 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135955 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135970 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135970 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136004 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136032 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20

9523ZY-18-Q-0209 Page 22

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Jan 2017) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Nov 2016) of 52.219-9.

__ (v) Alternate IV (Nov 2016) of 52.219-9.

__ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

__ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages—Subcon-tracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside

(Nov 2011) (15 U.S.C. 657 f).

__ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15

U.S.C. 632(a)(2)).

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically

Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small

Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

X (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2018)

(E.O. 13126).

X (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

X (28) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

X (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015)(38 U.S.C. 4212).

X (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.

793).

X (31) 52.222-37, Employment Reports on Veterans (FEB 2016) (38 U.S.C. 4212).

X (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations

Act (Dec 2010) (E.O. 13496).

X (33)(i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

X (34) 52.222-54, Employment Eligibility Verification (OCT 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in…