9523ZY24Q0024 - Combined Synopsis-Solicitation.pdf

RFQ 9523ZY24Q0024

Access to Data for All Commodities

PART I

STATEMENT OF WORK

1. BACKGROUND

The U. S. Commodity Futures Trading Commission (CFTC) is an independent federal government agency. The mission of the Commodity Futures Trading Commission is to promote the integrity, resilience, and vibrancy of the U.S. derivatives markets through sound regulation.

The agency has five (5) offices located throughout the U.S. The CFTC headquarters office is in Washington, DC. The regional offices are located in New York, NY; Chicago, IL; Kansas City, MO; and a Continuity of Operations Planning (COOP) site.

2. DESCRIPTION OF WORK/ SYSTEM SURVEILLANCE ELEMENTS &

CONTRACTOR RESPONSIBILITIES

CFTC is seeking a solution that includes all relevant news, price, and other data as specified below for all commodities listed in US commodity exchanges including but not limited to CME (Chicago Mercantile Exchange) Group (includes NYMEX & COMEX), ICE (Intercontinental Exchange) US, NASDAQ Futures, CFE (CBOE Futures Exchange), CBOE (Chicago Board Options Exchange), and CBOT (Chicago Board of Trade).

The solution shall also allow CFTC staff to have access (depending on assigned areas of interest) to the relevant news, prices and other data from foreign boards of trade, including but not limited to real time data for ICE Futures Europe, and LME (London Metal Exchange), using CFTC owned computers. Offering data for additional foreign boards of trade, such as the Shanghai Exchange, may be provided on time-delayed bases.

The solution shall perform the following:

Provide access to real time price and market data;

Provide access to historical price and market data;

Have the ability to export/download data (prices and market statistics);

Have the ability to create alerts based on predetermined price changes;

Have the ability to feed its data into Microsoft Excel through an Excel add-in; and, Provide access to live news feed.

Base Parameters: The contractor’s solution shall support the following elements and/or capabilities:

A. General Surveillance:

(i) Real Time Price Data for Futures, Options, and Spreads (inter and cross-commodity), including, the following elements in customizable quote boards:

Current Price;

Current Bids and Offers (indicate depth of Exchange’s Central Limit Order Book);

New Settlement Price;

Previous Settlement Price;

Change in price and percentage change compared to previous settlement for current price and new settlement price;

Session Open price;

Session High Price;

Session Low Price; and, Cumulative Trading Volume for Session.

(ii) Market Statistics, including:

Open Interest;

Volume;

Deltas for Options;

Contract Month High/Low transacted price;

Market Historical High/Low settlement price;

Market Historical High/Low Open Interest; and, Market Historical High/Low Volume.

(iii) Charts for Futures, Options, Spreads (inter and cross-commodity), with the ability to include, at a minimum, the following elements:

Price;

Bids/Offers;

Volume;

Add Multiple Commodities;

Add secondary y-axis;

Ability to specify and change increments (tick, 1 minute, 5 minutes, 30 minutes, Daily, etc.); and, Ability to specify time period of chart and request real-time updating (30 minutes, 24 hours, 1 month, 6-month, 1 year, 5 year, from/to specific dates, etc.).

(iv) Futures Forward Curves

(v) Time and Sales Data

(vi) Current Spot/Cash or Forward Prices

(vii) Ability to Create Derived Variables or Synthetic Price Symbols (i.e. price ratios, cross-commodity spreads)

(viii) Ability to add Derived Variables or Synthetic Price Symbols to quote boards or charts

(ix) Live News Feed that includes international and domestic:

Commodity specific news, including fundamental information (i.e. supply, demand, exports, imports, etc.); and, Exchange Information, such as warehouse stocks and grading information.

(x) Provides users the ability to set-up and save multiple customized workspaces (filtered news feeds, custom quote boards, custom charts)

B. Financial Surveillance:

In addition to being able to monitor all US exchanges that list financial futures and/or options (currencies (FOREX), single stocks futures, equity indices, and treasuries), the solution shall provide access to data from other US exchanges that trade products related to equity and financial futures.

C. Agricultural/Softs Surveillance:

News/Reports regarding USDA data;

Data for Related Markets from Foreign Boards of Trade, including real time data for ICE

Europe; and, International and Domestic Spot/Cash or Forward Price data for softs, livestock, lumber, and grains, including daily grain elevator bids/offers.

D. Metals Surveillance:

International and Domestic Metals Exchange Warehouse Data;

Data for Related Markets from Foreign Boards of Trade, including real time data for

LME; and, International and Domestic Spot/Cash or Forward Price data for base and precious metals.

E. Energy Surveillance:

In addition to natural gas, crude oil, gasoline, and distillates, the solution shall include all price, news, and market data available for additional energy markets with listed US futures and/or options, specifically power, but also other markets such as liquefied natural gas, and renewable fuels, including RINs;

Spot/Cash Price data for domestic petroleum and natural gas markets;

News/Reports regarding the Energy Information Administration (EIA), American

Petroleum Institute (API), and International Energy Agency (IEA); and, Data for Related Markets from Foreign Boards of Trade, including real time data for ICE

Europe.

F. Cryptocurrency Surveillance:

In addition to being able to monitor all US exchanges that list cryptocurrency futures and/or options, the solution shall provide access to related cryptocurrency indices, as well as data from other exchanges, and domestic and Foreign Boards of Trade that offer products related to listed virtual currency futures.

G. User Training and Support:

Throughout the term of the contract, the contractor shall:

Provide, as needed, training for existing and new users on the operations of the solution as well as work station set-up assistance at the users’ location (CFTC headquarters and the Regional Offices located in Chicago, IL and New York, NY). The training may be provided in one or a combination of the following methods: in-person, telephone, or virtually (e.g. WebEx, Zoom, Teams, etc.);

Provide User Support between the hours of 8:00am and 5:00pm ET, Monday through Friday; and, If the solution requires installation onto the CFTC network, provide technical support to the CFTC Division of Administration Information Technology Branch (DA-IT) regarding installation and contractor access needs.

H. System Support:

The contractor shall provide:

Implementation, installation, training and operational (go-live) capability prior to the usage start date;

Hours for technical and system support, which should be consistent with hours during which real-time commodity exchange data are transmitted; and, System Maintenance during non-working hours (after 7:00pm (ET) and before 7:00am

(ET)).

3. TECHNICAL REQUIREMENTS

The contractor’s solution shall meet the following Information Technology (IT) technical requirements:

The solution shall not require local administrator permissions to function completely;

The solution shall be compatible with Microsoft Edge Version 123.02420.97 or greater;

The solution shall be compatible with Windows 11 Enterprise (OS Build 22631.3296)

23H2 or greater;

The solution shall be compatible with Microsoft Office Professional Plus 2019, Microsoft

365 or greater;

The solution shall support silent installation; and, 508 Compliance with the following standards:

o 36 CFR 1194.21 o 36 CFR 1194.22

4. DESKTOP PACKAGES & LICENSES REQUIRED:

A total of fifty-two (52) users will require access to the solution at any given time as follows:

Complete Access to All Commodity & Financial Information: 30 Users

Including:

o All Financial Information o All Agricultural/Softs Information o All Metals Information o All Energy Information o LME- Real-time Access o ICE Futures Europe Real-time Access

Access to Basic Commodity & Financial Information plus one or more of the areas listed below: 22 Users1 o All Financial Information: 1 User o All Agricultural/Softs Information: 14 Users o All Metals Information: 6 Users o All Energy Information: 8 Users o LME- Real-time Access: 5 Users o ICE Futures Europe Real-time Access: 16 Users

As Division needs and headcount can fluctuate, the CFTC requires discretion to switch users as needed.

(REST OF PAGE INTENTIONALLY LEFT BLANK)

1 For example, of the 16 users with access to ICE Futures Europe Real-time Access, a person may also require access to All Metals Information and All Energy Information. This person would have access to three areas.

PART II

ADDITIONAL TERMS AND CONDITIONS

1. CONTRACT PRICING – FIRM FIXED PRICE CONTRACT

The total Firm-Fixed-Price is $____________.

2. DESCRIPTION OF SUPPLIES/SERVICES

CLIN Description Qty Unit Unit Price

Total Price

Funded Amount

00001 Access to Data for All Commodities (Base)

12 Month GOV USE

10001 Access to Data for All Commodities (Option 1)

12 Month GOV USE

20001 Access to Data for All Commodities (Option 2)

12 Month GOV USE

30001 Access to Data for All Commodities (Option 3)

12 Month GOV USE

40001 Access to Data for All Commodities (Option 4)

12 Month GOV USE

TOTAL FFP GOV USE

3. PERIOD OF PERFORMANCE

The Period of Performance for CLIN 00001 (Base) is December 1, 2024 through November 30, 2025.

4. OPTION TO EXTEND THE TERM OF THE CONTRACT

(a) The Government may extend the term of this contract by written notice to the contractor within 30 days prior to contract expiration; provided that the Government gives the contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five (5) years.

5. CONTRACTING OFFICER

For the purpose of this contract, the Contracting Officer is:

Tamara Jones Commodity Futures Trading Commission Business Operations Branch 1155 21st Street, NW Washington, DC 20581 Phone: (202) 418-5341 E-Mail: T_Jones@cftc.gov

6. CONTRACTING OFFICER’S REPRESENTATIVE

The Contracting Officer’s Representative (COR) will be identified at the time of contract award.

7. TECHNICAL DIRECTION AND SURVELLIANCE

(a) Performance of work under this contract shall be subject to the surveillance and written technical direction of the COR. The term “technical direction” is defined to include:

(1) Directions to the contractor that provide clarification of the requirements described in the Statement of Work.

(2) Inspection and acceptance of deliverables completed by the contractor under this contract.

(b) The COR does not have authority to, and may not, issue any technical direction which:

(1) Assigns additional work outside the scope of work for the contract;

(2) Constitutes a change as defined in the contract clause(s) that address “changes”;

(3) In any manner causes an increase or decrease in the order price or the time required for performance;

(4) Changes any of the expressed terms, conditions or specifications of the contract;

or

(5) Interferes with the contractor’s right to perform the terms and conditions of the

(c) All technical direction shall be issued in writing by the COR. The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed in this clause and within their authority under the provisions of this clause. If, in the opinion of the contractor, any instruction or direction by the COR would increase or decrease the cost of the contract or result in work outside the scope of this contract, the contractor shall not proceed but shall immediately notify the Contracting Officer in writing. It is anticipated that within 30 days of receiving the notification from the contractor, the Contracting Officer will either issue an appropriate contract modification or advise the contractor in writing that:

(1) The technical direction is rescinded in its entirety;

(2) The technical direction is within the scope of the contract, does not constitute a change as defined in the contract clause(s) that address “changes” and that the contractor should continue with the performance of the technical direction.

(d) A failure of the contractor and Contracting Officer to agree that the technical direction is within scope of the contract, or a failure to agree upon the contract action to be taken with respect thereto, shall be subject to the provisions of the “Disputes” clause of the contract.

(e) Any action(s) taken by the contractor in response to any direction given by any person other than the Contracting Officer or the COR whom the Contracting Officer shall appoint shall be at the contractor’s risk.

8. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS

The requirements of the Prompt Payment Act, P.L. 97-177, as reflected in the clauses incorporated into the contract (e.g., FAR clauses 52.232-25, Prompt Payment, and 52.212-4, Contract Terms and Conditions--Commercial Products and Commercial Services) apply to this contract.

Payment requests (i.e., invoices) shall be submitted electronically through the Delphi eInvoicing system via Login.gov on a monthly basis for processing and payment. (For foreign contractors see Note at end of clause.) The CFTC’s Delphi eInvoicing system is managed by the Department of Transportation’s Enterprise Services Center (ESC).

Invoices shall include sufficient detail to identify the contract CLIN(s) for which the request for payment is being made. The contractor shall also complete the “Period of Performance Begin” and “Period of Performance End” fields when submitting an invoice through the eInvoicing system, corresponding to the period of performance of the submitted invoice.

Upon contract award, the contractor shall provide an invoicing point of contact to the Contracting Officer as follows:

First and Last Name Email Address (not a centralized email address) Phone Number

The contractor shall notify the Contracting Officer of changes to the above information within ten (10) days after the change.

The contractor shall access the eInvoicing System using the following link:

https://einvoice.esc.gov

If the contractor requires assistance with the eInvoicing system, they may contact the ESC help desk:

ESC Help Desk for the Delphi eInvoicing System

Business Hours: 8:00am to 7:00pm 1-866-641-3500

In the event a refund is due the government, the contractor shall remit payment via the secured electronic government collections system, www.pay.gov.

Note: All requirements in this clause for submitting invoices through the Delphi eInvoicing system (i.e. “iSupplier”) apply only to domestic contractors. Foreign contractors shall only submit invoices via email to 9-amc-amz-cftc@faa.gov. For purposes of this clause, “foreign contractor” means a contractor organized or existing under the laws of a country other than the United States. All other requirements in this clause apply to both domestic and foreign contractors.

9. LIABILITY

The contractor shall be responsible for all liabilities which result from willful misconduct, gross negligence, or lack of good faith on the part of any of its officers and employees. Such liability is not restricted by any dollar limitations.

10. PRIVACY ACT COMPLIANCE

The contractor and contractor personnel shall store, use, maintain, share and dispose of personally identifying information it receives under this contract in accordance with the Privacy Act of 1974 (5 USC §552a) and its implementing Federal regulations.

11. COMMERCIAL SUPPLIER AGREEMENTS – UNENFORCEABLE CLAUSES

a. “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” set forth in FAR 2.101 and intended to create a binding legal obligation on the end user.

Commercial supplier agreements are particularly common in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data, but they may apply to any supply or service. The following terms apply–

1. Regardless of the format or style of the document. For example, a commercial supplier agreement may be styled as standard terms of sale or lease, Terms of Service (TOS), End User License Agreement (EULA), Subscription Agreement, governing terms or another similar legal instrument or agreement, and may be presented as part of a proposal or quotation responding to a solicitation for a contract or order;

2. Regardless of the media or delivery mechanism used. For example, a commercial supplier agreement may be presented as one or more paper documents or may appear on a computer or other electronic device screen during a purchase, software installation, other product delivery, registration for a service, or another transaction.

b. When any supply or service acquired under this contract is subject to a commercial supplier agreement, the following language shall be deemed incorporated into the commercial supplier agreement. As used herein, “this agreement” means the commercial supplier agreement:

1. Notwithstanding any other provision of this agreement, the following shall apply:

i. Applicability. This agreement is a part of a contract between the commercial supplier and the CFTC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including, but not limited to, all contracts, task orders, and delivery orders under FAR Part 12).

ii. End user. This agreement shall bind the CFTC as end user but shall not operate to bind a CFTC employee or person acting on behalf of the CFTC in their personal capacity.

iii. Law and disputes. This agreement is governed by Federal law.

A. Any language purporting to subject the CFTC to the laws of a U.S.

state, U.S. territory, district, or municipality, or a foreign nation, except where Federal law expressly provides for the application of such laws, is hereby deleted.

B. Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

C. Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

iv. Continued performance. The supplier or licensor shall not unilaterally revoke, terminate or suspend any rights granted to the CFTC except as allowed by this contract. If the supplier or licensor believes the CFTC to be in breach of the agreement, it shall pursue its rights under the Contract Disputes Act or other applicable Federal statute while continuing performance.

v. Disputes. This contract is subject 41 U.S.C. chapter 71, Contract Disputes.

Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

vi. Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, a binding arbitration shall not be used, and equitable or injunctive relief, including the award of attorney fees, costs or interest, may be awarded against the CFTC only when explicitly provided by statute (e.g., Prompt Payment Act or Equal Access to Justice Act).

vii. Updating terms.

A. After award, the contractor may unilaterally revise commercial supplier agreement terms if they are not material. A material change is defined as:

I. Terms that change CFTC rights or obligations;

II. Terms that increase CFTC prices;

III. Terms that decrease overall level of service; or

IV. Terms that limit any other CFTC right addressed elsewhere in this

B. For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be incorporated into the contract using a bilateral modification.

C. Any agreement terms or conditions unilaterally revised subsequent to award that are inconsistent with any material term or provision of this contract shall not be enforceable against the CFTC, and the CFTC shall not be deemed to have consented to them.

viii. No automatic renewals. If any license or service tied to periodic payment is provided under this agreement (e.g., annual software maintenance or annual lease term), such license or service shall not renew automatically upon expiration of its current term without prior express consent by an authorized CFTC representative.

ix. Indemnification and Unauthorized Obligations.

A. When any supply or service acquired under this contract is subject to any commercial supplier agreement that includes any language, provision, or clause requiring the Government to directly or indirectly indemnify the contractor or any person or entity for damages, costs, fees, or any other loss or liability or similar that would or reasonably could create an Anti-Deficiency Act violation (31 U.S.C. 1341), any such language, provision, or clause is unenforceable against the Government, and will be treated as if those terms were deleted and do not otherwise exist.

B. Any clause of this agreement requiring the commercial supplier or licensor to defend or indemnify the end user is hereby amended to provide that the CFTC and/or the U.S. Department of Justice has the sole right to represent the United States in any such action, in accordance with 28 U.S.C. 516.

x. Audits. Any clause of this agreement permitting the commercial supplier or licensor to audit the end user’s compliance with this agreement is hereby amended as follows:

A. Discrepancies found in an audit may result in a charge by the commercial supplier or licensor to the CFTC. Any resulting invoice must comply with the proper invoicing requirements specified in the underlying CFTC contract or order.

B. This charge, if disputed by the CFTC, will be resolved in accordance with subparagraph (v) (Disputes); no payment obligation shall arise on the part of the CFTC until the conclusion of the dispute process.

C. Any audit requested by the contractor will be performed at the contractor's expense, without reimbursement by the CFTC.

D. Any contractor requesting a right to audit CFTC’s end user compliance must provide CFTC 30 days prior written notice before being permitted to conduct any on-site audit.

xi. Taxes or surcharges. Any taxes or surcharges which the commercial supplier or licensor seeks to pass along to the CFTC as end user will be governed by the terms of the underlying CFTC contract or order and, in any event, must be submitted to the Contracting Officer for a determination of applicability prior to invoicing unless specifically agreed to otherwise in the CFTC contract.

xii. Non-assignment. This agreement may not be assigned, nor may any rights or obligations thereunder be delegated, without the CFTC’s prior approval, except as expressly permitted under the clause at FAR 52.212-4, Contract Terms and Conditions—Commercial Products and Commercial Services, which is incorporated herein by reference.

xiii. Confidential information. If this agreement includes a confidentiality clause, such clause is hereby removed. Issues regarding release of “unit pricing” will be resolved consistent with the Freedom of Information Act.

12. COMPLIANCE WITH THE REHABILITATION ACT OF 1973

All electronic and information technology (“EIT”) developed under this contract must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists (reference 36 CFR 1194 implements Section 508 of The Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

13. INFORMATION SECURITY – CITIZENSHIP / GREEN CARD REQUIREMENT

All employees of the contractor and those of any subcontractor who will handle CFTC data, including operating and managing information systems containing CFTC data, shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card, USCIS I-551 (“Green Card”), authorizing them to live and work in the US on a permanent basis. Any requests for exceptions must be made to the Contracting Officer and approved by CFTC’s Chief Information Security Officer.

14. ORGANIZATIONAL CONFLICTS OF INTEREST (OCI)

Federal Acquisition Regulation (FAR) Subpart 9.5 prescribes responsibilities, general rules, and procedures for identifying, evaluating and resolving organizational conflicts of interest.

The purpose of this clause is to avoid, neutralize, or otherwise mitigate conflicts of interest that might exist related to a contractor’s performance of work under this contract. If the contractor is aware, or becomes aware during the term of this contract, of any facts that might create an actual or potential conflict of interest, the contractor shall immediately provide a detailed disclosure of such facts to the Contracting Officer. At the request of the Contracting Officer, the contractor shall provide a conflict of interest avoidance or mitigation plan to CFTC. If such a plan is requested, continued performance under the contract may be conditional upon the Contracting Officer’s approval of the plan.

If approved by the Contracting Officer, the conflict of interest avoidance or mitigation plan shall be deemed incorporated into this contract, pursuant to this provision. This clause shall be included in any teaming or subcontract agreements with respect to work performed under this contract.

15. CFTC IT SYSTEMS AND SUPPORT SERVICES CONTRACT REQUIREMENTS

General

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and CFTC policies as CFTC, and CFTC personnel, regarding information and information systems security. Contractors must follow policies and procedures outlined in CFTC IT Security Program to ensure appropriate security controls are in place.

Access to CFTC Information and CFTC Information Systems

A contractor shall request logical (technical) and/or physical access to CFTC information and CFTC information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract, and (3) individuals must satisfy the same conditions, requirements and restrictions comparable to CFTC employees in order to access the same type of CFTC information.

All contractors and subcontractors working with CFTC information are subject to the same investigative requirements as those of regular CFTC appointees or employees who have access to the same types of information. Contractors are responsible for screening their employees. Furthermore, contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry safeguards the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. Defense Security Service (DSS) administers the NISP on behalf of the Department of Defense and 23 other federal agencies within the Executive Branch. CFTC will verify clearance through DSS.

CFTC Information Custodial Requirements

Information made available to the contractor by CFTC for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer.

CFTC information will not be co-mingled with any other data on the contractor’s/subcontractor’s information systems/media storage systems in order to ensure CFTC requirements related to data protection and media sanitization can be met. CFTC also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization or disposal procedures to ensure they are in compliance with CFTC policy requirements.

Prior to termination or completion of this contract, the contractor will not destroy information received from CFTC or gathered or created by the contractor in the course of performing this contract without prior written approval by the CFTC Contracting Officer. Any data destruction done on behalf of CFTC by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements.

The contractor will receive, gather, store, back-up, maintain, use, disclose and dispose of CFTC information only in compliance with the terms of the contract and applicable Federal And CFTC information confidentiality and security laws, regulations, and policies.

Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST). If Federal or CFTC information confidentiality and security laws, regulations and policies become applicable to the CFTC information or information systems after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in the contract.

Contractors collecting, storing, or disseminating personally identifiable information (PII) data must conform to all pertinent regulations, laws, and CFTC directives related to privacy.

The contractor shall not make copies of CFTC information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

If CFTC determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for CFTC to terminate the contract for default or terminate for cause under Federal Acquisition Regulation (“FAR”) part 12.

The contractor will store, transport or transmit CFTC sensitive information in an encrypted form, using a CFTC-approved encryption application that meets the requirements of NIST’s FIPS 140-2 standard.

Information System Design and Development

Information systems that are designed or developed for or on behalf of CFTC at non-CFTC facilities shall comply with all CFTC policies developed in accordance with Federal Information Security Modernization Act (FISMA), NIST, and related CFTC security and privacy control requirements for Federal information systems. This includes information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization.

The security controls must be designed, developed, approved by CFTC, and implemented in accordance with the provisions of CFTC security system development life cycle as outlined in NIST Special Publication 800-37.

The contractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies --

i. The systems of records; and

ii. The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and,

(3) Include this Privacy Act clause, including this subparagraph in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

Information System Hosting, Operation, Maintenance or Use

For information systems that are hosted, operated, maintained, or used on behalf of CFTC at non-CFTC facilities, contractors are fully responsible and accountable for ensuring compliance with all Privacy Act, FISMA, NIST, FIPS, and CFTC security and privacy directives and handbooks. The contractor security control procedures must be identical, not equivalent, to those procedures used to secure CFTC systems. A privacy impact assessment (PIA) must also be provided to the COR and approved by the CFTC Privacy Office prior to operational approval. All external Internet connections involving CFTC information must be reviewed and approved by CFTC prior to implementation.

Adequate security controls for collecting, processing, transmitting, and storing of personally identifiable information, as determined by the CFTC Privacy Office, must be in place, tested, and approved by CFTC prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of CFTC. These security controls need to be stated within the PIA and supported by a risk assessment. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

Outsourcing (contractor facility/contractor equipment/contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (C&A) of the contractor’s systems in accordance with NIST Special Publication 800-37 and privacy impact assessment of the contractor’s systems prior to operation of the systems. Government-owned (government facility/government equipment) contractor operated systems, third party or business partner networks require a system interconnection agreement and a memorandum of understanding (MOU) which detail what data types will be shared, who will have access, and the appropriate level of security controls for all systems connected to CFTC networks.

The contractor must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the CFTC Contracting Officer and the Information Security Officer (ISO) for entry into CFTC’s Plan of Action and Milestone (POA&M) management process. The contractor will use CFTC’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the Government.

Contractor procedures will be subject to periodic, unannounced assessments by CFTC officials. The physical security aspects associated with contractor activities will also be subject to such assessments. As updates to the system occur, an updated PIA must be submitted to the CFTC Privacy Office through the COR for approval.

All electronic storage media used on non-CFTC leased or owned IT equipment that is used to store, process, or access CFTC sensitive information must have all CFTC sensitive information removed, cleared, sanitized, or destroyed in accordance with CFTC policies and procedures upon: (1) completion or termination of the contract or (2) disposal or return of the IT equipment by the contractor or any person acting on behalf of the contractor, whichever is earlier.

Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to CFTC assets, or sensitive information, or an action that breaches CFTC security procedures. The contractor shall immediately notify the COR and simultaneously, the designated ISO/Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in systems(s) to which the contractor has access.

To the extent known by the contractor, the contractor’s notice to CFTC will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the CFTC information/assets were placed at risk or compromised), and any other information that the contractor considers relevant. To the extent practicable, the contractor shall mitigate any harmful effects on individuals whose CFTC information was accessed or disclosed in a security incident.

Security Controls Compliance Testing

On a periodic basis, CFTC reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by CFTC in the event of a security incident or at any other time.

Training

All contractor employees and subcontractor employees requiring access to CFTC information and CFTC information systems shall complete the following before being granted access to CFTC networks:

(1) Sign and acknowledge understanding of and responsibilities for compliance with the CFTC Rules of Behavior relating to access to CFTC information and information systems;

(2) Successfully complete CFTC Cyber Security Awareness Training (CSAT) and annual refresher training as required;

(3) Successfully complete CFTC General Privacy training and annual refresher training as required; and

(4) Successfully complete any additional cyber security or privacy training, as required for CFTC personnel with equivalent information system access – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirement.

The contractor shall provide to the Contracting Officer a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

16. NOTICE LISTING CONTRACT CLAUSES INCORPORATED BY REFERENCE

The following FAR clauses are incorporated by reference (by Citation Number, Title, and Date), with the same force and effect as if given in full text. Upon request, the Contracting Officer will make the full text available. Also, the full text of clauses incorporated by reference may be accessed electronically at this Internet address:

http://www.acquisition.gov/far

Clause Number Title Date

52.203-3 Gratuities Apr 1984

52.204-18 Commercial and Government Entity Code Maintenance Aug 2020

52.212-4 Contract Terms and Conditions – Commercial Products and Commercial Services

Nov 2023

52.224-1 Privacy Act Notification Apr 1984

52.224-2 Privacy Act Apr 1984

52.232-18 Availability of Funds Apr 1984

17. 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (MAY 2024)

a) The contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV

2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

_X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN

2020), with Alternate I (NOV 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) ( 41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) ( 41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

_X_ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (6) [Reserved].

_X_ (7) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L.

111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (9) 52.204-27, Prohibition on a ByteDance Covered Application (JUN

2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (DEC 2023) ( Pub. L. 115–390, title II).

_X_ (11) (i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders— Prohibition. (DEC 2023) ( Pub. L. 115–390, title II).

__ (ii) Alternate I (DEC 2023) of 52.204-30.

_X_ (12) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (NOV

2021) ( 31 U.S.C. 6101 note).

_X_ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) ( 41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (OCT 2022) ( 15 U.S.C. 657a).

_X_ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) ( 15 U.S.C. 657a).

__ (17) [Reserved]

__ (18) (i) 52.219-6, Notice of Total Small Business Set-Aside (NOV

2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (19) (i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV

2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-7.

_X_ (20) 52.219-8, Utilization of Small Business Concerns (FEB 2024) ( 15 U.S.C. 637(d)(2) and (3)).

__ (21) (i) 52.219-9, Small Business Subcontracting Plan (SEP 2023) ( 15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (NOV 2016) of 52.219-9.

__ (iii) Alternate II (NOV 2016) of 52.219-9.

__ (iv) Alternate III (JUN 2020) of 52.219-9.

__ (v) Alternate IV (SEP 2023) of 52.219-9.

__ (22) (i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) ( 15 U.S.C. 644(r)).

__ (ii) Alternate I (MAR 2020) of 52.219-13.

__ (23) 52.219-14, Limitations on Subcontracting (OCT 2022) ( 15 U.S.C. 637s).

__ (24) 52.219-16, Liquidated Damages—Subcontracting Plan (SEP

2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service- Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (FEB 2024) ( 15 U.S.C. 657f).

_X_ (26) (i) 52.219-28, Post Award Small Business Program Rerepresentation (FEB

2024) ( 15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (MAR 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (OCT 2022) ( 15 U.S.C. 637(m)).

__ (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (OCT

2022) ( 15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR

2020) ( 15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (SEP 2021) ( 15U.S.C. 637(a)(17)).

_X_ (31) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

__ (32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (FEB

2024).

_X_ (33) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

_X_ (34) (i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

__ (ii) Alternate I (FEB 1999) of 52.222-26.

_X_ (35) (i) 52.222-35, Equal Opportunity for Veterans (JUN

2020) ( 38 U.S.C. 4212).

__ (ii) Alternate I (JUL 2014) of 52.222-35.

_X_ (36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN

2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (JUL 2014) of 52.222-36.

_X_ (37) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

_X_ (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

_X_ (39) (i) 52.222-50, Combating Trafficking in Persons (NOV

2021) ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (MAR 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O.

13627).

__ (40) 52.222-54, Employment Eligibility Verification (MAY 2022) (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in

FAR 22.1803.)

__ (41) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA– Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (MAY 2008) of 52.223-9 ( 42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (44) 52.223-20, Aerosols (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (46) 52.223-23, Sustainable Products and Services (MAY 2024) ( E.O. 14057, 7 U.S.C. 8102, 42 U.S.C. 6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47) (i) 52.224-3 Privacy Training (JAN 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (JAN 2017) of 52.224-3.

__ (48) (i) 52.225-1, Buy American-Supplies (OCT 2022) ( 41 U.S.C. chapter 83).

__ (ii) Alternate I (OCT 2022) of 52.225-1.

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV

2023) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108- 286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (DEC 2022) of 52.225-3.

__ (iv) Alternate III (FEB 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (NOV 2023) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X_ (51) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) ( 42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (NOV 2007) ( 42 U.S.C. 5150).

_X_ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (MAY 2024) ( E.O. 13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (FEB 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

_X_ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT2018) ( 31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) ( 31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (MAY 2014) ( 31 U.S.C. 3332).

_X_ (62) 52.239-1, Privacy or Security Safeguards (AUG 1996) ( 5 U.S.C. 552a).

__ (63) 52.242-5, Payments to Small Business Subcontractors (JAN

2017) ( 15 U.S.C. 637(d)(13)).

__ (64) (i) 52.