9531BP18R0004_-_Amd0001.pdf

NSN 7540-01-152-8070 STANDARD FORM 30. (Rev. 10-83) Previous Edition unusable Prescribed by GSA FAR (48 CFR) 53.243

Page of Pages AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. Contract ID Code

2. AMENDMENT MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (if applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than item 6) CODE

(x) 9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

8. NAME AND ADDRESS OF CONTRACTOR (NO., Street, Country, State and ZIP Code)

CODE FACILITY CODE

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of offers is extended, is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning ______ copies of amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OR OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

Check One

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible)

Except as provided herein, all terms and conditions of the document referenced in item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR 16B. UNITED STATES OF AMERICA

(Signature of person authorized to sign)

15C. DATE SIGNED

(Signature of Contracting Officer)

16C. DATE SIGNED

Continuation Page

PAGE 2 OF 45 9531BP18R00040001

Continued from Block 14...

2. The RFP document is provided with changes. All changes have been highlighted in yellow;

AND

3. Provide an extension to the due date for submissions. Responses to this RFP are now due by 5:00pm ET on May 30, 2018.

ALL OTHER TERMS AND CONDITIONS REMAIN UNCHANGED.

Attachment Page

PAGE 3 OF 45 9531BP18R00040001

Federal Election Commission 9531BP18R0004 – Amendment 0001

Next Generation eFiling and Disclosure Platform Modernization

Section B – Supplies or Services

B.1 Supplies or Services and Price/Costs This Firm Fixed Price (FFP) contract proposal will serve to secure a vendor to build a modern, state of the art, web based electronic filing data/reporting application, and a cloud based electronic filing back-end infrastructure (EFI) in which to support it.

Contract Line Item Number 1: Build a modern, state of the art, electronic filing data/reporting application.

Contract Line Item Number 2: Build a cloud based electronic filing back-end infrastructure (EFI).

Contract Line Item Number 3: Transition (operational knowledge and ownership) of both the electronic data/reporting application and the cloud infrastructure (EFI) to the FEC. Transition must include conversion of both existing Oracle backend data and the legacy reporting application data (FECFile) to the new environment.

Base Period Period of Performance: TBD (3 months)

CLIN DESCRIPTION TOTAL PRICE

CLIN 0001 Development of electronic filing data/reporting application

CLIN 0002 Development of cloud based electronic filing back-end infrastructure

(EFI)

Total

Option Period I Period of Performance: TBD (12 months)

CLIN DESCRIPTION TOTAL PRICE

CLIN 1001 Development of electronic

CLIN 1002 Development of cloud

PAGE 4 OF 45 9531BP18R00040001

Federal Election Commission

CLIN 1003 Transition (operational knowledge and ownership) of both the electronic data/reporting application and the cloud infrastructure (EFI) to the FEC. Transition must include conversion of both existing Oracle backend data and the legacy reporting application data (FECFile) to the new environment.

Option Period II Period of Performance: TBD (9 months)

CLIN DESCRIPTION TOTAL PRICE

CLIN 2001 Development of electronic

CLIN 2002 Development of cloud

CLIN 2003 Transition (operational knowledge and ownership) of both the electronic data/reporting application and the cloud infrastructure (EFI) to the FEC. Transition must include conversion of both existing Oracle backend data and the legacy reporting application data (FECFile) to the new environment.

PAGE 5 OF 45 9531BP18R00040001

Federal Election Commission

Section C – Statement of Work

C.1 Introduction The Federal Election Commission (FEC) has been receiving campaign finance reports in electronic form since 1997. Congress has mandated that all committees must regularly file financial and other reports directly with the FEC. Non-Senate Committees that reach certain activity thresholds (in dollars) must file their reports electronically. Committees meeting these criteria have been filing electronically since 2001 either by using the FEC’s free software FECFile, FEC’s Webforms, or by using (for profit) commercially produced filing software.

The FEC has contracted in the past with vendors to develop, operate, and maintain an Electronic Filing & Disclosure System to support this filing requirement, information storage, and public disclosure.

Recently, the near-exponential increases in report size and modern expectations for rapid processing have stressed the current system's capabilities. For example, a recent large report contained ten million rows, and by the next presidential election the FEC expects reports to exceed four times that size.

The system, however stable, is aging and has other limitations - flexibility, scalability, portability, etc. The FEC would like to leverage modern infrastructure and state of the art IT development practices to address these and other issues.

The FEC now seeks a vendor to build a modern, state of the art, cloud-based platform-independent electronic filing system including data applications (analogous to current FECFile and WebForms) and electronic filing back-end infrastructure (EFI) for receiving, processing and storing electronically filed data that not only meets the current load requirements but one that can accommodate quickly growing and varying demands on network and infrastructure resources.

In 2016 the FEC conducted a study of the current system. The objective of the study was to understand how the FEC can modernize the e-filing system to get better quality data, be responsive to user needs, and handle increasing volumes of data. The study is the basis for the FEC’s path forward. Those recommendations in the study that the FEC found of value have been integrated into this RFP as objectives, scope, or minimum requirement. The study can be found as an attachment to the RFP.

C.2 Objectives To deliver to the FEC, a modern, state of the art, cloud-based, secure, platform-independent electronic filing data application and electronic filing back-end infrastructure (EFI). To provide optimal service, without issue, to filing committees regardless of which mobile or fixed device, operating system or browser, time of the day, the day of the week, data file size, or data file

PAGE 6 OF 45 9531BP18R00040001

Federal Election Commission transaction count.

C.3 Scope The FEC’s business goals include, but are not limited to:

• Improved Data Quality (Electronic Filing software) -Create a web/cloud based electronic filing data application and a cloud based electronic filing back-end infrastructure (EFI) to accommodate, ease of access, scalability, and eliminate OS dependencies -Improve electronic filing data application usability -Help electronic filers complete forms and schedules correctly -Provide better labels, suggestions, and hints -Add links to help/glossary -Add status indicator when filers s in the process of completing and filing a report -Validation enhancement/improvement/add real-time validation -Improve duplicate entry consolidation -Provide data export function and improved import function

• Improve vendor community integration -Build better, easier to integrate, tools for the vendor community -Develop with open source tools -Use plain language/variables as words, not abbreviations

• Improve Electronic Filing reliability and processes/anticipate & accommodate for future demand -Create cloud based platform to receive and process electronic filing data -Improve system overall reliability/uptime -Increase testing and automation for pre-prod release -Predict/support/manage increasing volume for web traffic and database size -Incorporate, in printed forms, data capture technology (ex. QRcodes) -Improve amendment processing -Improve child transaction processing -Employ TDD (test driven development)

C.4 Requirements

4.1 Contract Line Item Number 1: build a modern, state of the art, electronic filing data/reporting application.

4.2 Contract Line Item Number 2: build a cloud based electronic filing back-end infrastructure

(EFI).

4.3 Contract Line Item Number 3: transition (operational knowledge and ownership) of filing

PAGE 7 OF 45 9531BP18R00040001

Federal Election Commission application (FECFile On-line!) and cloud infrastructure (EFI) to the FEC. Transition of legacy (filer) data from old system to new.

4.4 Other Requirements

4.4.1 Project Methodology

* Agile development methodology must be employed throughout the project life cycle

* Must employ User Centered Design, incorporating feedback from users throughout design process

* Must employ frequent user testing during system design by filers and power users

* Must employ Minimum Viable Product (MVP) model with iterative development

* Sprint length not to exceed 3 weeks

Proposals must address the offerors knowledge of the Agile development methodology

4.5 Technologies

* Open source and application programming interface (API) technologies must be employed *Python/JavaScript strongly suggested (the FEC has competent knowledge and staffing in this area) *PostgreSQL database strongly suggested (the FEC has competent knowledge and staffing in these area)

4.6 Cloud based electronic filing back-end infrastructure (EFI).

*99.995% Tier 4 availability *Cloud agnostic *Quickly scalable (due to the nature of the FEC’s business, traffic is heavily cyclical) *Secure method to export filing data from the EFI PostgreSQL database to the FEC’s legacy electronic filing system’s Oracle database

4.7 Electronic filing data/reporting application

* Analogous to current FECFile and WebForms *99.995% Tier 4 availability

* Independent of mobile or fixed device, operating system or browser, time of the day, the day of the week, data file size, or data file transaction size.

* Must employ an import and export transaction level data function which preserves all required compliance data inclusive of linked parent/child records (from Excel format and from FECFile .DCF format), quality of data must not deteriorate as a result of the import and export function.

* Must integrate with the API Data Receiver, API Data Validator, and the API Data Report Image Generator

4.8 API Data Receiver requirements

*Secure data transfer *Progress bar or real-time status indicator of transfer of data, results or confirmation (Accepted/Failed reason why, etc.)

PAGE 8 OF 45 9531BP18R00040001

Federal Election Commission

*Emailed filing confirmation receipt

* Must be accessible for use by software vendors

4.9 API Data Validator requirements

* Must perform on-demand data field validation

* Must communicate to filer pass/fail real-time results

* Must be accessible for use by software vendors

4.10 API Data Report Image Generator

* Must generate paginated sequential page by page PDF of report

* Must employ data capture such as QR page codes

* Must be accessible for use by software vendors

4.11Transition Requirements

* Contractor must plan to work closely with FEC technical and program management staff throughout the lifecycle of the project, the end goal being a transference of working and operational knowledge of the cloud based electronic filing back-end infrastructure (EFI) and the electronic filing data/reporting application to the FEC.

*Legacy Oracle data to Progress (FEC data and images PDF)

The production-ready system shall be completed and functioning in production by the end of the contract but a subset of the complete system – Forms 3, 3X, 3P, 3L, 3Z, 24 AND 6, must be completed and functioning in the development, staging and production environments by the end of October, 2019, to support the 2020 presidential elections.

The deliverable must support all current requirements with respect to functionality and capabilities (see Section J Attachments, “Electronic Filing Specifications Requirements, and “Electronic Filing and Disclosure Systems Managed Services Infrastructure”).

The recommendations from the electronic filing study should be implemented, and the FEC objectives for this project must be met or exceeded (See Section C.3).

Proposals must address the requirements discussed in this Statement of Work. Proposals must specifically address approaches for fulfilling each of the requirements. Offeror responses must be in sufficient detail to demonstrate that each requirement is clearly met or that a functionally equivalent solution is available with a detailed rationale which demonstrates the applicability of that alternate solution. Proposals that fail to address and to meet all of the requirements will be considered non-responsive to this solicitation and will not be considered for selection.

The offeror must provide a plan in the event of an outage or catastrophe. The proposal must address the offeror’s knowledge of disaster recovery and assure the FEC that they can, to the best of their ability, maintain full operational status of the systems in the event of an outage or catastrophe.

PAGE 9 OF 45 9531BP18R00040001

Federal Election Commission

The contractor will be required to use commercial, innovative, and/or state–of- the-art practices and techniques that best meet the Government’s requirements. The Contractor shall provide the necessary management, supervision, labor, and administrative support, for the accomplishment of services. The contactor shall plan, schedule, coordinate and ensure the full, effective, efficient, and economical performance of all services ordered under this contract. Contractor must designate a project manager as key personnel to attend all scheduled meetings.

C.5 Deliverables The contactor will submit deliverables in accordance with predetermined timeframes identified for each task. Status on deliverables will be discussed/adjusted at sprint planning depending upon priority.

C.6 Delay of Deliverables In events such as an FEC shutdown due to severe weather, security issues, or other unforeseen circumstances, the Contractor is expected to complete and send deliverables on time. If the Contractor believes the FEC caused the potential or actual delay in completing the tasks and deliverables stated herein, the CO and COR are to be notified immediately verbally and in writing (via e-mail). All delays that the Contractor believes are caused by the FEC shall be sufficiently documented so as to provide adequate proof of the cause of delay (e.g., dates, subjects). See section F Deliverables/Period of Performance.

C.7 Notice Regarding Late Delivery As soon as the Contractor knows that a deliverable won’t be submitted on time, but always in advance of a deadline, the Contractor shall notify the CO in writing and request a revision to the schedule. This notification shall include:

• Rationale for late delivery.

• Proposed date for the delivery.

• Projected impact of the late delivery on related tasks and the overall project.

A request for a revised schedule must be reviewed and approved by the CO before placed in effect. The CO will review the new schedule and provide guidance to the Contractor. Such notification in no way limits any Government contractual rights or remedies, including but not limited, to termination.

Note: Any request to modify the award’s terms and conditions (including the schedule) must not be discussed with the COR, but instead submitted to the CO in writing.

C.8 Government Review Periods The FEC will have a maximum of 5 business days of each sprint's conclusion to review deliverables and submissions, and provide comments to the Contractor for incorporation into the next deliverable or submission. Once the Government has reviewed and approved the deliverable, and the plan has been implemented, the deliverable is considered “Accepted.”

Section D – Packaging and Marking Not applicable.

PAGE 10 OF 45 9531BP18R00040001

Federal Election Commission

Section E – Inspection and Acceptance

The FFP contract COR, as a duly authorized representative of the CO, shall assume the responsibilities for monitoring the Contractor’s performance, evaluating the quality of services provided by the Contractor, and performing inspection and acceptance of all deliverables. In the event of rejection of any deliverable, the Contractor will be notified in writing by the COR of the specific reasons why the deliverable was rejected. If no comments are provided within 5 calendar days of deliverable receipt, the deliverable will be deemed to have been accepted by the Agency.

Section F – Deliverables/Period of Performance

F.1 Period of Performance

a. The Period of Performance (POP) includes a base period of 3 months, with 2 additional option periods. Option Period I, a duration of 12 months, followed by Option Period II, a duration of 9 months. The total POP is 2 years. The POP is expected to begin within 10 calendar days after award.

b. If the Government exercises its option(s) pursuant to the OPTION PROVISION of this contract/order, the period of performance will be increased as listed below:

Option No Option Period Option Period I: TBD (12 months) Option Period II: TBD (9 months)

Note: The definitive dates will be determined at the time of award.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

F.2 Place of Performance Unless directed otherwise by the CO/COR, the Contractor must be onsite at FEC, located at 1050 First Street, NE Washington, DC 20002. The FEC provides all necessary facilities such as office space and support for the duration of the contract. Alternate Place of Performance - Contingency Only. Contractor employees may be required to work at home, another approved activity within the local travel area or at the contractor's facility in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, etc.). Any equipment such as laptops or phones provided to Contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to both parties. Contracting Officer Representative (COR) approval is required. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the SOW/PWS. In the event the services are

PAGE 11 OF 45 9531BP18R00040001

Federal Election Commission impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment.

F.3 Deliverables Deliverables are required in accordance with the following schedule and should be accurate, free from errors and submitted in a timely fashion.

No Report Type No of Copies

Delivery Schedule

Submit to FEC Deliverable

1 Status reports

1 business day after each sprint COR Electronic

2 Code repository 1 Continuous COR/dev team

Open source

4 Development prototype 1 At each sprint

COR/dev team

Sprint release

User Research Findings / Usability testing results 1

At each relevant sprint

COR/dev team Electronic

6 Design Deliverables 1

At each relevant sprint

COR/dev team Electronic

7 Project Contact Directory 3 2 days after award COR Electronic

8 Contractor development plan 1 First sprint COR Electronic

9 Incident reports 1

24 Hours after request COR Electronic

Project acceptance documentation (mutual agreement that the work has been completed and meets specifications) 1

As requested COR Electronic

11 Change control documentation 1 As requested COR

Open source

Scheduled sprint meetings to be held with the FEC, including the FEC COTR, FEC staff, contractor’s project manager, and any contractor’s technical representation necessary. 1

As required for sprint completion

COR/dev team

White papers/user manuals/procedures incorporated in code repository. 1

As requested COR

Sprint release

PAGE 12 OF 45 9531BP18R00040001

Federal Election Commission

Security Compliance (See attachment, FEC Information Security Contract Clause) 1

As required

COR/Security Officer Electronic

Any other miscellaneous reports (as requested). 1

As requested COR Electronic

16 Transition new system to FEC 1 TBD COR Electronic

Transition from current system to new system 1 TBD COR Electronic

Transition plan to migrate from current eFiling system and software to the eFiling system and software developed during this effort 1 TBD COR Electronic

Complete working system electronic filing data/reporting application and Development of cloud based electronic filing back-end infrastructure (EFI) encompassing forms 3, 3X, 3P, 3l, 3z, 6 and 24 and all associated schedules (refer to electronic filing format documentation) 1 Oct, 2019 COR

Production Working System

Complete working electronic filing data/reporting application and Development of cloud based electronic filing back-end infrastructure (EFI) encompassing all remaining forms and schedules 1

End of Contract COR

Complete Production Working System

Conversion of the legacy reporting application data (FECFile) to the new environment. Oct, 2019 COR All data

Section G – Contract Administration Data

G.1 Contracting Officer (CO) Responsibility for contracting activities rests solely with the Agency’s CO. No conversation, recommendations, or direction, whether given directly by, or implied by Agency personnel, that will affect the scope, schedule, or price of the program, shall be acted upon by the Contractor unless specifically approved by the Agency CO. In the event that the Contractor implements changes to the contract at the direction of any person other than the CO, the Contractor will not receive reimbursement for the work performed pursuant to those unauthorized changes.

Contractual interpretation and assistance may be obtained by contacting the CO.

Contracting Officer Point of Contact Name: Pamela K. Jones Address: 1050 First Street, NE Washington, DC 20002

PAGE 13 OF 45 9531BP18R00040001

Federal Election Commission

Phone: 202 694-1225 Email: pjones@fec.gov

G.2 Contracting Officer’s Representative (COR) The CO shall designate a COR who is responsible for administering the performance under the contract by:

a. Monitoring the Contractor’s performance

b. Assessing performance

c. Recommending changes to the CO

d. Interpreting the scope of work

Contracting Officer Representative Points of Contact

Name: Jeff Chumley Address: 1050 First Street, NE Washington, DC 20002 Phone: 202 694-1321 Email: jchumley@fec.gov

Name: Ken Lally Address: 1050 First Street, NE Washington, DC 20002 Phone: 202 694-1667 Email: klally@fec.gov

G.3 Invoices

1) Invoicing and payment for services rendered through this contract shall be made electronically in accordance with FAR 52.232-33. Invoices shall be submitted monthly by the fifth business day of the following month to fecinvoices@fec.gov, the CO and the COR identified above in this section.

2) The Contractor shall submit the final invoice within ninety calendar days after the expiration of the contract unless the Contractor requests and is granted an extension by the CO in writing.

3) For billing purposes, the invoice shall contain the following:

a. Contract Number/Purchase Order (PO)

b. CLIN Task Number (if applicable) as shown on the actual FEC Order/Price

Schedule

c. A unique identifying Contractor invoice number

d. Contractor Bank Account Number

e. Contractor Bank Routing Number

f. Contractor EIN

g. Contractor DUNS numbers

h. Time period the invoice covers

i. Any information or documentation required by provision of the contact/order

PAGE 14 OF 45 9531BP18R00040001

Federal Election Commission

G.4 Work Day and Legal Holidays

G.4.1 Work Day The Contractor may have access to FEC offices during normal business hours on ALL Government business days during the period of performance. Normal business hours are 8:00 AM to 5:00 PM Eastern Standard Time, Monday through Friday, excluding Federal holidays and official Federal Government closures in the Metropolitan DC area.

No overtime and after normal working hours activities are anticipated for this contract. If required, the COR must provide prior approval. The Contractor must notify the COR, in writing, at least 48 hours in advance of performing the activity.

G.4.2 Legal Holidays The following Federal holidays are observed by the Agency:

Table Legal Holidays Holiday Date

New Year's Day January 1, as observed Martin Luther King's Birthday Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Independence Day July 4, as observed Labor Day First Monday in September Columbus Day Second Monday in October Veteran's Day November 11, as observed Thanksgiving Day Fourth Thursday in November Christmas Day December 25, as observed

G.6 Authority to Obligate the Government The CO is the only individual who can legally commit or obligate the Government to the expenditure of public funds. No cost chargeable to the purchase order can be incurred before receipt of a fully-executed purchase order or specific authorization from the CO

G.7 Travel Travel will be reimbursed in accordance with FAR 32.205-46 Travel Costs and in accordance with the Federal Travel Regulations 41 CFR Part 301.

G.8 Government Furnished Equipment /Information/Access Upon contract award, the government will provide the following for the contractor:

a. Laptops

b. Office space on an as needed basis.

The Contractor is responsible for providing all necessary labor, supplies and equipment for this effort.

PAGE 15 OF 45 9531BP18R00040001

Federal Election Commission

Section H – Security

See attachment, FEC Information Security Contract Clause for policies, deliverables, and other requirements, under this contract.

H.1 Personnel Security Requirements

Background Investigations All Contractor staff assigned to work under the contract resulting from this RFQ must be legally eligible to work in the U.S.

Contractors must complete the Optional Form-306, Declaration for Federal Employment* which is used to assess fitness for federal contract employment.

https://www.opm.gov/forms/pdf_fill/OF0306.pdf Contractors must meet the standards of Homeland Security Presidential Directive 12 (HSPD 12), Policy for a Common Identification Standard for Federal Employees and Contractors and the U.S. Office of Personnel Management (OPM), National Background Investigations Bureau formerly known as the Federal Investigative Services Division (FISD) requirements for electronic fingerprint submission of employees and contractors for background investigations.

The Office of Human Resources will ensure that Personnel Security (Badging, Background Investigations, Fingerprinting) functions are conducted within OPM, DHS, and FEC policies, guidelines, and timeframes.

If contract personnel requires unescorted physical access to FEC information systems or FEC facilities, then a U.S. Government background investigation will be required. The background investigation may be the equivalent of an Office of Personnel Management National Agency Check Inquiry (NACI).

H.2 Accountability and Physical Security

Accountability

Safeguarding Information Requirements The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the CO. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of FEC.

Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media

PAGE 16 OF 45 9531BP18R00040001

Federal Election Commission without the prior written authorization of the CO. These obligations do not cease upon the expiration or termination of this contract. The Contractor shall include the substance of this provision in all contracts of employment and in all subcontracts hereunder.

Physical Security The Contractor shall be responsible for safeguarding all Government property and information housed at all of its facilities in connection with this contract. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to Government property and information must comply with its published procedures to protect the privacy and confidentiality of such information, and physical security of property, as required by FEC. Contractor shall provide security procedures to FEC upon request.

When property and information is housed on site at the Government’s facilities, the contactor shall abide by FEC security policies and procedures.

H.3 Key Personnel

(a) Definition: Certain skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. Such individuals are identified by the Contractor as "Key Personnel." No substitutions shall be made of accepted Key Personnel except for sudden illness or death, or termination of employment.

Substitutions shall only be accepted if in compliance with the “Substitution of Key Personnel" provision identified below.

(b) Key personnel must include, but are not limited to, a project manager, a content lead, a UX lead, a visual designer, full stack developers, frontend developers, backend developers and any other skilled persons as determined as necessary, as the project advances. Key personnel must be certified Scrum/Agile professionals.

(c) The following individuals are considered to be essential to the work being performed under this contract:

To Be Completed at Time of Award

Name Position

Substitution of Key Personnel

(a) The Contractor agrees to assign those persons identified above and who are necessary to fulfill the requirements of the contract as Key Personnel. No substitutions shall be made except in accordance with this clause. The Contractor shall demonstrate that the qualifications of any proposed successor personnel are equal to or better than the qualifications of the personnel being replaced, and shall discuss the impact on contract performance of the timing and estimated cost of the proposed change. In justifying the qualifications of successors to the above-named

PAGE 17 OF 45 9531BP18R00040001

Federal Election Commission personnel, the Contractor must address the relevant experience and skills that led to the person’s original selection for the position.

(b) Personnel considered essential (Key Personnel) to the work performed under the contract shall be mutually agreed-upon by the Contractor and the Government and will be specified in the contract. During the first 90 calendar days of the contract, the Contractor shall make no substitutions of Key Personnel unless the substitution is necessitated by illness, death or termination of employment. Prior to removing, replacing or diverting any of the specified individuals, the Contractor shall promptly notify the Contracting Officer (CO) and provide the information required below:

(c) All proposed substitutions shall be submitted to the CO for approval at least 15 calendar days in advance of the proposed effective date (unless substitution is necessitated by sudden illness, death, or termination of employment in which case notice shall be within five (5) calendar days of the effective date) and must provide the information as described in subparts (d) and (e), below.

(d) All requests for substitutions shall be in writing unless otherwise agreed to by the CO and shall include a complete resume for the proposed substitute and any other information required by the CO to permit effective evaluation of the proposed substitution’s qualifications.

(e) Requests for substitution of key personnel above must also provide a detailed explanation of the circumstances necessitating it and sufficient information for the CO to evaluate the impact of the substitution on contract performance.

H.4 Compliance with Section 508 of the Rehabilitation Act of 1973 Contractor must provide a comprehensive list of all offered specific electronic and information technology (EIT) products that fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 CFR Part 1194.

Any task or delivery order issued for noncompliant items must meet an applicable exception as indicated in FAR Part 39.204, Exceptions.

For every EIT product accepted under this contract by the Government that does not comply with 36 CFR Part 1194, the Contractor shall at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product, if commercially available and cost neutral, on either the planned refresh cycle of the product or service, or on the contract renewal date whichever shall occur first.

Section I – Contract Clauses

Option to Extend the Term of the Contract-52.217-9 (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 60

PAGE 18 OF 45 9531BP18R00040001

Federal Election Commission days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years.

Clauses Incorporated By Reference-52.252-2 (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the CO will make the full text of the clauses available. The full text of the clause may be accessed electronically at www.acquisition.gov.

52.202-1 Definitions NOV 2013

52.203-13 Contractor Code of Business Ethics and Conduct ETHICS OCT 2015

52.204-19

Incorporation by Reference of Representations and Certifications

DEC 2014

52.212-1 Instructions to Offerors—Commercial Items OCT 2015

52.212-3

Offeror Representation and Certifications— Commercial Items

JUL 2016

52.212-4 Contract Terms and Conditions -- Commercial Items MAY 2015 52.215-8 Order of Precedence -- Uniform Contract Format OCT 1997 52.227-14 Rights in Data – General MAY 2014 52.232-23 Assignment of Claims MAY 2014 52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

DEC 2013

52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.237-1 Site Visit APR 1984 52.243-1 Changes—Fixed-Price AUG 1987 52.243-4 Changes JUN 2007 52.246-4 Inspection of Services—Fixed-Price AUG 1996

52.249-2 Termination for Convenience of Government (Fixed-Price) MAY 2004

52.249-8 Termination for Default (Fixed-Price Supply/Service) APR 1984 52.249-14 Excusable Delays APR 1984 52.253-1 Computer Generated Forms JAN 1991 52.239-1 Privacy or Security Safeguards AUG 1996 52.224-1 Privacy Act Notification APR 1984 52.224-2 Privacy Act APR 1984

PAGE 19 OF 45 9531BP18R00040001

Federal Election Commission

FEC Information Security Contract Clause

FEC Information Security Contract Clause

The FEC is generally exempt from the E-Government Act and the Federal Information Security Modernization Act of 2014 (FISMA) by virtue of its exemption from the Paperwork Reduction Act (PRA), from which the E-Government Act borrows its definition of the term “agency.” However, FEC uses FISMA metrics and the National Institute of Standards and Technology (NIST) controls as best practice and as applicable to the Commission. FEC applies FISMA and NIST security controls to three in-scope systems: General Support System, E-Filling System and the FEC Website.

FISMA requires each agency to develop, document, and implement an agency-wide Information Security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, (including Subcontractors) or other source on behalf of an agency. That is, agency information security programs apply to all organizations (sources) which have physical or electronic access to a Federal agency’s computer systems, networks, or IT infrastructure; or use information systems to generate, store, process, or exchange data with a Federal agency, or on behalf of a Federal agency, regardless of whether the data resides on a Federal Agency or a Contractor’s information system. This includes services that are either fully or partially provided;

including other agency hosted, outsourced, and cloud computing solutions.

The Contractor and all of its respective Subcontractors shall follow and remain compliant at all times with all FEC and Federal Information Technology (IT) Security standards, policies, and reporting requirements, as well as all National Institute of Standards and Technology (NIST) standards and guidelines, other Government-wide laws and regulations for the protection and security of Government Information.

All FEC Contractors shall comply with FEC policies and other requirements below, as well as documents referenced within those policies:

• FEC Directive 58 Electronic Records, Software and Computer Usage

• Policy 58A: FEC Information System Security Program

• Policy 58-1.1 Personnel Security

• Policy 58-1.2 Security Training and Awareness

• Policy 58-1.3 Information Classification

• Policy 58-1.4 Hardware and Software Acquisition Security

• Policy 58-1.5 Third Party Services

• Policy 58-2.1 Risk Management

• Policy 58-2.2 Account Management

• Policy 58-2.3 Change Management

PAGE 20 OF 45 9531BP18R00040001

Federal Election Commission

• Policy 58-2.4 Certification and Accreditation

• Policy 58-2.6 User Security Support

• Policy 58-2.7 Segregation of Duties

• Policy 58-2.8 Backup and Recovery

• Policy 58-2.9 Continuity of Operations and Disaster Recovery

• Policy 58-3.1 Logical Access

• Policy 58-3.2 Application and Operating System

• Policy 58-3.3 Auditing and Monitoring

• Policy 58-3.5 Electronic Mail and Internet Security

• Policy 58-3.6 Malicious Code

• Policy 58-3.7 Wireless Security

• Policy 58-4.1 Physical Access Security

• Policy 58-4.2 Media Management Security

• Policy 58-4.3 Mobile Computing Security

• Policy 58-4.4 personal Communication Devices Security

• Policy 58-4.5 Virtual Private Network Policy

• Policy 58-4.6 System Integrity

• Policy 58-4.7 Physical & Environmental Security

• Policy 58-4.8 Maintenance Security

• Policy 58-4.9 Systems & Communications Protection Security

1.1 GENERAL INFORMATION SECURITY RESPONSIBILITIES

The Contractor and all of its respective Subcontractors shall:

A. Establish senior management level responsibility for information security;

B. Define key information security roles and responsibilities within their organization;

C. Comply with a minimum set of controls established for protecting all Federal information;

D. Comply with FEC policies and procedures for information security, as well as reporting requirements.

1.1.1 SYSTEM SECURITY OFFICER

The Contractor shall appoint a Systems Security Officer (SSO) to oversee its compliance with the FEC information security requirements. The SSO responsibilities shall include implementation and oversight of all information security requirements and implementations.

1.1.2 SYSTEM SECURITY LEVEL

The Contractor shall develop and apply appropriate security controls to meet FEC information security requirements, as defined in the applicable appendix (as amended), and in accordance with the below-listed parameters, for any/all tasks requiring the Contractor to (1) process, (2) store, (3) facilitate transport of, or (4) host/maintain Federal information (including software and/or infrastructure developer/maintainers), either at the Contractor site, or at a Federally-controlled facility (as defined in

PAGE 21 OF 45 9531BP18R00040001

Federal Election Commission

FAR Subpart 2.1):

A. Systems Security Level: Low, Moderate, or High as categorized by the FEC Authorizing Official.

B. Information Type is used to determine the information system security level. However, additional security control requirements may be required based on the specific type of data available within the system. For information identified as PII, and/or sensitive, the additional security and privacy requirements listed in the NIST 800-53 current revision publication, as applicable to PII, and/or sensitive data, shall be applied.

C. E-Authentication Level 1, 2, 3, 4, or N/A, as defined by FEC shall be applied to proof, identify and authenticate authorized users.

The contractor shall coordinate with the FEC Chief Information Security Officer (CISO) to assess and establish/update each of the above listed criteria within 30 days of contract award or when a Significant Change has been made to its system, as defined by the FEC CISO.

1.1.3 STANDARD FOR ENCRYPTION

The Government has determined that FEC Information Technology Architecture and IS controls under this contract is considered ― “sensitive’’ in accordance with Federal Information Processing Standard (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004.

The following encryption requirements apply to laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive FEC information (at rest and/or in transit.)

Device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

The Contractor shall:

Use encryption that complies with FIPS 140-2, Security Requirements for Cryptographic Module, (as amended) to protect all instances of FEC sensitive information during storage and transmission.

Verify that the selected encryption product has been validated under the Cryptographic Module Validation Program (see http://csrc.nist.gov/cryptval/) to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the FEC CISO.

Use the Key Management Key (see Chapter 4 of FIPS 201) on the FEC Personal Identity Verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure

PAGE 22 OF 45 9531BP18R00040001

Federal Election Commission the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption- guidance.pdf). The Contractor shall notify the Contracting Officer’s Representative (COR) of personnel authorized to decrypt and recover all encrypted information.

Securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2. Ensure this encryption standard (all of section 1.1.3) is incorporated into the Contractor’s property management/control system in order to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive FEC information.

1.1.4 POSITION SENSITIVITY DESIGNATIONS

Contractor personnel shall be required to undergo a background investigation commensurate with the Homeland Security Presidential Directive (HSPD) 12 position-sensitivity levels for the Personal Identity Verification card required to access, develop, or host and/or maintain a Federal information system(s).

The Contractor shall submit a roster that includes the name, position, email address, phone number, and area of responsibility/job functions of all staff (including Subcontractor staff) working on the contract where the Contractor shall access, develop, or host and/or maintain a Federal information system(s). The roster shall be submitted to the COR within 14 calendar days of the effective date of any contract. Any revisions to the roster (for any reason) shall be submitted within 15 calendar days of the change.

The Contractor shall be notified by the government of the appropriate level of investigation required for each staff member. Suitability investigations are required for contractors who will need access to FEC information systems and/or FEC physical space. All Contractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract. Upon beginning work, contractors must be issued a temporary badge and submit to fingerprinting.

1.1.5 INFORMATION SECURITY AWARENESS TRAINING

All Contractor employees having access to (1) Federal information or a Federal information system, (2) PII or, (3) physical or logical access to FEC IT resources, shall complete Information Security and Privacy Awareness training courses prior to performing any work under this contract. Thereafter, Contractor employees having the above access shall complete an annual FEC-specified refresher course during the period of performance of a contract.

The Contractor shall record completion of Information Security and Privacy Awareness training and

PAGE 23 OF 45 9531BP18R00040001

Federal Election Commission

Role-Based Security Training (as applicable) and retain the results in accordance with FEC procedures.

Training shall be consistent with the requirements contained in the Code of Federal Regulations (C.F.R.)

Part 5 Subpart C (5 C.F.R. 930.301) and conducted at least annually. The Contractor shall maintain a listing by name and title of each contractor employee working under contract with FEC that has completed the FEC mandatory training. The list shall be provided to the contract specific COR upon request to satisfy FISMA requirements.

1.1.6 RULES OF BEHAVIOR

The Contractor shall ensure that all employees, including Subcontractor employees, comply with the FEC Rules of Behavior (RoB) (For Use of Technology Resources and Information. All users of FEC IT resources must read these rules and sign the accompanying acknowledgement form (within the above document) before accessing Commission data/information, systems and/or networks. This acknowledgement must be signed annually to reaffirm knowledge of, and agreement to adhere to the FEC RoB. The FEC RoB may be presented to the user in writing or electronically, and the user’s acknowledgement may be obtained by written or electronic signature. These affirmations shall be provided to a contract specific COR upon request.

Contractor personnel with access to specific FEC systems may be required to sign additional Rules of Behaviors specific to those systems.

1.1.7 PRIVACY DOCUMENTATION

Contractors shall be responsible for coordinating with the FEC Privacy Officer to ensure all applicable Federal privacy requirements are being met to include, but not limited to, Privacy Act System of Records Notification (SORN), Privacy Impact Assessments (PIAs), and Data Use Agreements (DUAs).

2. COMMITMENT TO PROTECT NON-PUBLIC INFORMATION CONTRACTOR AGREEMENT

The Contractor shall guarantee strict confidentiality of the information/data that is provided by the Government during the performance of a FEC contract.

3. SYSTEMS SECURITY REQUIREMENTS

3.1 COMMON SECURITY CONFIGURATIONS

The Contractor shall apply approved security configurations to IT that are used to process information on behalf of FEC.

PAGE 24 OF 45 9531BP18R00040001

Federal Election Commission

1. The Contractor shall configure its computing systems that contain FEC data, and using Windows-related operating systems, including desktops and laptops—regardless of function—but not including servers, using the applicable United States Government Configuration Baseline (USGCB) baselines (see http://usgcb.nist.gov/index.html) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software…