Sol_50310226Q0166 Final 06092026.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

SEC-OA - 02

See Schedule

SEC - OCOO CODE 16. ADMINISTERED BYCODE

X

X

518210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORSEC-OA - 02

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

06/17/2026 1000 ED

06/09/2026

202-551-4279FLANICE LEWIS

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

50310226Q0166

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 33 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

See Schedule

15. DELIVER TO

WASHINGTON DC 20549

MAIL STOP 4226

100 F STREET NE

IT SUPPORT BRANCH 02

OFFICE OF ACQUISITIONS

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$40

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

SECURITIES AND EXCHANGE COMMISSION

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

ADMINISTERED BY:

SECURITIES AND EXCHANGE COMMISSION

OFFICE OF ACQUISITIONS

IT SUPPORT BRANCH 02

100 F STREET NE

MAIL STOP 4226

WASHINGTON DC 20549

DELIVER TO:

SECURITIES AND EXCHANGE COMMISSION

OFFICE OF CHIEF OPERATING OFFICER

Continued ...

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

TAKELA MORRIS

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

100 F ST NE

MAILSTOP-

WASHINGTON DC 20549

Period of Performance: 08/01/2026 to 07/31/2027

00001 Web-based interface providing access to parsed blockchain data

Anticipated Award Type: Firm-fixed-price

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33 2 of

SECTION i - Administration

General Information:

This is not a Brand Name procurement.

Submission of Quotes:

Offeror shall follow the guidelines below in preparing its response.

All documents should be submitted electronically in MS Word. .pdf, or compatible format.

Offerors shall submit their quote electronically in its entirety via email to Takela Morris at morrist@sec.gov, Pleshette Brown at brownpl@sc.gov, and Flanice Lewis at lewisf@sec.gov no later than no later than 10:00 AM ET on June 17, 2026. Quotes received after the deadline will be considered late and will not be accepted.

Questions related to this solicitation shall be submitted electronically to Takela Morris at morrist@sec.gov, Pleshette Brown at brownpl@sc.gov, and Flanice Lewis at lewisf@sec.gov no later than 10:00 AM ET on June 11, 2026.

The quote must include:

- Company name, address, UEI, and CAGE Code

- Contact name, title, phone number, and email

- Firm-fixed price for the requested product/service (The pricing shall be inclusive of all fees and the SEC requests all available price discounts.)

- Description of the item(s) or service(s) being quoted that demonstrates compliance with the requirements in the Statement of Work or specifications

- Delivery terms and schedule

- Period of performance as provided on the SF 1449

- Confirmation of active SAM registration

- If applicable, a copy of any commercial supplier agreement, end user license agreement (EULA), terms of use, or similar document that governs the provision of the product or service

Evaluation:

The SEC intends to award an order to the offeror with the lowest priced, technically acceptable quote. Technical acceptability will be determined by comparing quotations with the requirements of this solicitation.

SECTION ii - Provisions

Clause Number Clause Title

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements- Representation. (JAN 2017)

52.204-7 System for Award Management-Registration. (NOV 2024) (Deviation NOV 2025)

52.209-2 Prohibition on Contracting With Inverted Domestic Corporations-Representation. (NOV 2015) (Deviation NOV 2025)

Clause Number Clause Title

52.212-1 Instructions to Offerors-Commercial Products and Commercial Services. (SEP 2023) (Deviation NOV 2025)

52.240-90 Security Prohibitions and Exclusions Representations and Certifications. (Deviation NOV 2025)

SECTION iii - SEC Instructions

5003.05 SUBMISSION OF INVOICES - DELPHI EINVOICING SYSTEM (JANUARY

2022)

a. The Securities and Exchange Commission (SEC) will only accept electronic invoices submitted through the Delphi eInvoicing system on a [].

b. Payment system registration. All persons accessing the Delphi eInvoicing web-portal will be required to have their own unique user Delphi eInvoicing ID and password and be credentialed through login.gov.

(1) Electronic authentication. See www.login.gov for instructions. Click on the following link for instructions on establishing a login.gov account: https://login.gov/help/creating-an-account/how-do-i-create-an-account-with-logingov/.

(2) To create a login.gov account, the user will need a valid email address and a working phone number. The user will create a password and then login.gov will reply with an email confirming the email address.

(3) In order to set up a new user account or make changes to existing vendor Delphi eInvoice users who will submit invoices through the eInvoicing web-portal for payment and tracking purposes, notify iSupplier@sec.gov and include the contract/order number, the user's full name, valid email address (group mailboxes are not recommended), and current phone number of all vendor users. Vendor users will be notified via e-mail when the account is created. The vendor user will be provided detailed instructions for logging into their Delphi eInvoicing account.

(4) Training on Delphi. To facilitate use of DELPHI, comprehensive user information is available at http://einvoice.esc.gov

(5) Account Management. Vendors are responsible to contact the Delphi Help Desk when their firm's points of contacts will no longer be submitting invoices so they can be removed from the system. Instructions for contacting the Delphi Help Desk can be found at http://einvoice.esc.gov

c. Contractors are cautioned against submitting an invoice prior to goods and services being received/accepted. Invoices submitted prematurely may be rejected. Software license maintenance and subscriptions may be invoiced at the beginning of the contract period of performance.

d. The SEC's Delphi eInvoicing system is managed by the Enterprise Services Center (ESC). In order to receive payment and in accordance with the Prompt Payment Act, all invoices submitted as attachments in the Delphi eInvoicing web-portal shall contain the following:

(1) Company logo or letterhead

(2) Company name and payment address

(3) Company Point of Contact (POC) for the invoice with phone and e-mail

(4) Invoice number and invoice date

(5) Billing period

(6) SEC Contract number

(7) Task/Delivery Order number (if applicable)

(8) SEC Contracting Officer's Representative (COR name)

(9) Amount billed (by CLIN), current and cumulative

(10) Total amount billed this period

(11) Cumulative total billed to date

(12) Brief Description of Services Performed - General description only

e. If the contract includes allowances for travel, all invoices which include charges pertaining to travel expenses will catalog a breakdown of reimbursable expenses with the appropriate receipts to substantiate the travel expenses.

5004.00 APPOINTMENT OF CONTRACTING OFFICER'S REPRESENTATIVE (COR)

(JANUARY 2022)

a. A Securities and Exchange Commission COR has been designated for administration and information relating to this contract. The SEC may also assign one or more Alternate CORs for this contract. The COR may not re-delegate his or her authority; only the CO has this authority.

A COR Appointment Letter (and ACOR Appointment Letter if applicable) detailing the designations will be e-mailed to the contractor.

b. The COR will manage the contract in coordination with the CO and within the terms of the contract. The COR's responsibilities include reviewing invoices and charges by the Contractor, informing the CO of areas where exceptions are taken, and accepting or rejecting invoices in the SEC's financial system. The COR shall be the primary point of contact responsible for communicating administrative guidance for on-boarding and off-boarding of Contractor Personnel, mandatory trainings, government closures, and other events as necessary. Unless otherwise specified in this contract, inspection and acceptance of supplies and/or services to be furnished under this contract will be performed by the COR.

c. Only the CO has the authority to change the terms and conditions of this contract. The COR may request a contract modification, but the CO will make the final determination. The COR may not agree to or issue a change to the contract terms and conditions. In the event the

Contractor effects changes to the contract at the direction of any person other than the CO, the changes will be considered to have been made without any authority and no adjustments will be made to the contract.

6002.00 TYPE OF CONTRACT (NOVEMBER 2024)

This is a [] type contract/agreement.

As appropriate, after award, a contract, order, and/or any contract line-item number(s) (CLINs), or portion thereof, may be converted to a different contract type through mutual agreement between the parties.

6012.02 SEC SECTION 508 REQUIREMENTS (JANUARY 2022)

a. Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all Information and Communication Technology (ICT) products and services developed, acquired, maintained, and/or used under this contract/order must comply with the Information and Communication Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access Board") in FAR 39.203 (a). The complete text of Section 508 Final Provisions can be accessed at Section 508 Law.

b. All ICT products must comply with the following requirements. Descriptions of the requirements are viewable at the link Section 508 Standards.

c. Offerors that fail to demonstrate compliance with the above requirements, may be eliminated from further consideration for award.

d. The offeror shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility requirements at 36 CFR 1194 using a Voluntary Product Accessibility Template (VPAT 2.4). Further, the solicitation response must indicate where full details of compliance can be found (e.g., vendor's website or other exact location).

e. Offerors to this solicitation must provide any additional detailed information necessary for determining applicable Section 508 standards conformance. If an offeror claims its products and/or services, including ICT deliverables such as electronic documents, web content or electronic reports, meet applicable Section 508 standards, and it is later determined by the Government - i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility, remediation of the products and/or services to the level of conformance specified in the contract will be the responsibility of the offeror at its expense.

6013.01 FEDERAL REQUIREMENTS, SECURITY, AND ACCESSIBILITY FOR

INFORMATION SYSTEMS (SEPT 2025)

a. Information Systems Authorization to Operate (ATO): Information systems containing Securities and Exchange Commission (SEC) data or operated on behalf of the SEC are required to have an authorization to operate, based on National Institutes of Standards and Technology

(NIST) Special Publication (SP) 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. The security assessment entails a review of minimum security controls, documented in NIST SP 800-53, Revision 5 (and subsequent revisions as finalized by NIST); documentation of a system security plan, based on NIST SP 800-18 updated, Rev. 1; and remediation of weaknesses that are documented in a plan of action and milestone (POA&M) document, as required by Office of Management and Budget (OMB) Memorandum 02-01. The ATO will also have to cover any alternate processing facilities or a subcontractor handling SEC information or operating systems on behalf of the SEC.

b. Additional Federal governance includes but is not limited to the following:

1. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements

2. Office of Management and Budget (OMB) Circular A-11, Revised, "Preparation, Submission and Execution of the Budget" (December 2020)

3. OMB Circular A-130, Revised, "Managing Information as a Strategic Resource" (July 2016)

4. OMB Federal Enterprise Architecture Program Management Office (FEAPMO) Reference Models and Circular A-11 Guidance. www.feapmo.gov.

5. Privacy Act of 1974, Public Law 93-579 (5 U.S.C. 552a), as amended

6. The E-Government Act of 2002, Public Law 107-347

7. OMB Memorandum M-15-01, Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices, October 3, 2014 (and subsequent updates by OMB)

8. OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002, September 30, 2003

9. OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies

10. OMB Federal Risk and Authorization Management Program (FedRAMP) Policy Memo, December 8, 2011

11. Federal Information Processing Standard (FIPS) Publication (PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, September 2013

12. FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

13. FIPS PUB 197, Advanced Encryption Standard, November 2001

14. FIPS PUB 140-3, Security Requirements for Cryptographic Modules, March 2019

15. National Institute for Standards and Technology (NIST), Special Publication (SP) 800-122, Guide for Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010

16. NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

17. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment Sept

18. NIST SP 800-100, Information Security Handbook: A Guide for Managers, Oct 2006

19. NIST SP 800-95, Guide to Secure Web Services, Aug 2007

20. NIST SP 800-92, Guide to Computer Security Log Management, Sep 2006

21. NIST SP 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

22. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, August 2012

23. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations, September 2020

24. NIST SP 800-53A, Revision 4, Guide for Assessing the Security Controls in Federal Information Systems, December 2014

25. NIST SP 800-44 Version 2, Guidelines on Securing Public Web Servers, Sep 2007

26. NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012

27. NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

28. NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems, February 2006

29. NIST SP 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018

30. NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011

31. NIST SP 800-137A, Assessing Information Security Continuous Monitoring Programs;

Developing and ISCM Program Assessment, May 2020

32. NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0) January

33. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence July 2024

34. OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025

35. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, April 3, 2025

c. Encryption Specifications:

1. All encryption modules in the requirement must be FIPS 140-3 certified level 2.

2. All built-in encryption modules are subject to verification by technical support provided by the contractor or as otherwise directed by the COR.

3. Unless the Contractor is using SEC provided devices, all contractor provided mobile devices including, but not limited to laptops, mobile phones, and tablets, must be encrypted with a full-disk (or full-system) encryption capability.

4. All data written to removable media must be encrypted using the SEC's enterprise removable media encryption capability.

5. All systems and applications must only support Hypertext Transfer Protocol Secure (HTTPS).

All Internet-facing systems must also implement HTTP Strict Transport Security (HSTS).

Deprecated encryption methods (such as SSLv2 and SSLv3) and encryption ciphers (such as 3DES and RC4) shall not be supported.

d. Cloud-Based Assessment: Any cloud-based components that are not otherwise exempt pursuant to SEC Cloud Service and FedRAMP policy shall be assessed in accordance with FedRAMP requirements and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146, and in SEC Instruction 6022.00.

e. Security Issue Review: The Contractor shall remediate problems identified during any security testing activities. All significant issues (typically those rated as HIGH and often those rated as MEDIUM) should be resolved before the system is allowed to go into production and handle SEC information. The Contractor shall resolve security audit-related Plan of Action and Milestones (POA&M) items within a reasonable timeframe, based on risk guidance from the designated authorizing official. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the Contracting Officer's Representative (COR), Office of Information Technology (OIT) Security Group staff, and relevant SEC staff to review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review along with supporting evidence. SEC's OIT Security Group may choose to perform additional technical testing to validate resolution.

f. Dedicated Security Personnel Specifications: All system development, maintenance, and support contracts must include an appropriate number of qualified information security personnel to be provided by the Contractor as defined below. These individuals will ensure secure development methodologies are followed and assist the SEC Security Operations Center (SOC) in proactive monitoring of exploits against SEC information systems.

g. All applicable contracts must have at least one dedicated security resource, but Contractors may augment the skills and abilities of security personnel with additional Contractor Personnel.

h. Security personnel must:

1. Prepare written documents and communicate with both business and technical stakeholders;

2. Have experience in and understand security architecture for web applications and infrastructure, and have experience and working knowledge of Security Assessment and Authorization (SA&A) activities in accordance with standards from NIST;

3. Have expertise and experience in performing continuous monitoring activities for systems to include monitoring for security threats, performing access reviews, reviewing and developing mitigations for vulnerability assessment reports, and proposing enhancements for systems security;

4. Have experience supporting security operations centers (or similar capabilities) in systems reviews and potential incident investigations; and

5. Obtain and maintain knowledge of the security architecture and the business purpose of systems under his/her purview.

i. Security Assessment: OIT Security Team with the support of the Contractor Security Personnel performs Security Assessment and Authorization (SA&A) for a product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST SP 800 series of documents and includes:

1. Enumeration - activity aimed at identifying devices and components and cross-referencing with provided inventory lists;

2. Vulnerability Scanning - performs network-based vulnerability assessment of customer's servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un-patched or have out-of-date software security patches;

3. Penetration Testing - attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false-positives, and determine the extent of the vulnerability and potential remediation steps that may be taken; and

4. Functional Testing - Perform specific tests, examinations, and inspections against NIST SP 800-53 controls not tested by the other activities.

j. The Contractor shall provide the Security Team with: (1) a system demonstration; (2) test user IDs; (3) Access to the system; (4) System Security Plan (SSP); (5) additional documents as required under the NIST SP 800 series to support Security Assessment & Authorization activities including third party assessments for certain projects/requirements as described in the section below. The Contractor shall provide ongoing support to update the required SA&A documentation. The OIT Security Team provides the test reports. Any cloud-based components will have to be assessed in accordance with FedRAMP and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146, and in SEC Instruction 6022.00.

k. Contractor-provided SA&A for all system development or solutions development projects for contractor-operated systems and solutions:

1. For all Contractor-operated systems or solutions (including Cloud-based systems), the Contractor must obtain from an organization (3PAO) a third party accredited security assessment compliant with standards from NIST (e.g., SP 800-115 Technical Guide to Information Security Testing and Assessment) to verify that security controls are implemented and operating as intended.

2. The assessment is subject to review and approval by the SEC.

l. Documentation Updates: The Contractor shall maintain and update system specifications and/or documentation, including system inventory, to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and commercial off-the shelf (COTS) products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On-line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation. The documentation shall be available to the COR for review and inspections throughout the system development life cycle (SDLC); updates shall be submitted to the COR for review and approval.

m. System Development Plan (SDP): The Contractor shall develop, maintain, and execute an SDP which shall include the policies, procedures, standards, instructions, forms, and/or checklists needed to analyze, design, implement, test, and deploy the required application systems. In the SDP, the Contractor shall explain how the Contractor's corporate system development standards and practices will be applied and discuss its development methodology in detail. The SDP shall also describe the development methodology used by the Contractor. The SDP will be benchmarked against NIST SP800-160 Volume 1 and NIST SP 800-160 Volume 2, Developing Cyber Resilient Systems: A Systems Engineering Approach.

n. Disaster Recovery: The Contractor shall create and implement policies, processes and procedures to address the information system security requirements needed for disaster recovery in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recover recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned and plan updates will be made available to SEC for review within ten (10) working days of a request by SEC. Furthermore, SEC will be provided a point of contact for disaster recovery planning and exercise for the information service(s) provided. The Contractor shall invite participation from the SEC during tests to ensure SEC is able to access the system(s) and service(s) provided.

o. Subcontractors: Subcontractors approved by the SEC under SECI 6004.00 that handle or have access to SEC data in the performance of this contract shall be bound by the same information protection requirements as the Contractor. Like the Contractor, the Subcontractor's environment will have to undergo security assessment and authorization, including a facility only used for disaster recovery or alternate processing.

p. Mandatory Common Security Configurations: The Contractor must follow the common security configurations as published on NIST's web site http://checklists.nist.gov. NIST's Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018, is located at:

https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final

q. Additional Breach Responsibilities:

1. For cloud-based service contracts, incident reporting procedures included in SECI 6022.00 take precedence over those described here.

2. The Contractor's employees, agents, and subcontractors shall immediately alert the SEC in writing of any event, including the suspected or confirmed breach , that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST SP 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at SOC@sec.gov as soon as possible and without unreasonable delay. The Contractor shall act in accordance with its policies and procedures in the event of any breach shall support the SEC's investigation and resolution of reported incidents as requested by the SEC. For purposes of this instruction, a "suspected breach" shall be interpreted liberally to mean any situation in which the loss or unapproved access to such information is deemed a reasonable possibility.

3. In addition to the above, the Contractor shall provide immediate written notification to the SEC as indicated above of any breach or loss of control or any other similar incident regarding "federal contract information" as that term is used in FAR 52.204-21. The Contractor's responsibilities include providing assistance as requested by the SEC to ensure that any breach or loss of control of any such information is contained and assistance sufficient to demonstrate that any possible damages suffered by individuals and/or the agency are sufficiently mitigated.

4. The Contractor's duties under the above two paragraphs include providing unredacted forensic reports documenting the breach, loss of control or similar event sufficient to satisfy the SEC in its sole discretion. The Contractor's duties under the above two paragraphs survive the termination or conclusion of the contract and remain in place for so long as the contractor continues to retain or have access to PII and other SEC Nonpublic Information or federal contract information related to this contract that has not independently been authorized for release.

r. Security Requirements for Transmitting SEC Non-Public Information, Including PII and Controlled Unclassified Information (CUI) with the Use of Electronic Mail

1. Contractors, subcontractors, and SEC inter/intra agency partners handling electronic SEC Nonpublic Information as defined in SECR 23-2, including personally identifiable information (PII) information in identifiable form (IIF), or CUI, are required to meet the following defined federal requirements when transmitting such data across public networks (i.e., the Internet), storing such data on portable media, or transporting data for backup and recovery purposes.

2. With respect to using electronic mail in the course of their duties under the contract, the contractor shall follow instructions for encryption in accordance with SECI 6017.00.

s. Additionally, contractors shall ensure that all processes, procedures and equipment associated with storing or transmitting SEC Nonpublic Information, including PII or IIF, comply with all laws, regulations, and security mandates as defined by NIST Special Publication (SP) 800-61 Revision 2 as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of data that may contain SEC Nonpublic Information, including PII or IIF. In support of these requirements, the Contractor shall have:

1. Policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

2. Policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

3. Policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140-3 (validated); and

4. Policies, procedures, and mechanisms that ensure SEC data transmitted between the Contractor and the SEC are protected using encryption compliant with Federal Information Processing Standard 140-3 (validated).

t. At least annually or more frequently upon request by the COR, the Contractor shall provide assessments to the SEC demonstrating that these policies, procedures, and mechanisms continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective. SEC reserves the right to verify stated compliance.

u. Analysis and Evaluation: The Contractor shall fully cooperate with any risk analysis or other evaluation of the Contract conducted by the SEC or its representatives, including any evaluation of the Contract under the SEC's SA&A Program, including Privacy. Such cooperation shall include, but is not limited to, undergoing an independent audit or risk analysis by the SEC or by a third-party organization approved by the SEC, with such audits to occur not less than once every three (3) years or when there is a significant change to the system. Such evaluations, risk analyses, or audits shall include security tests on the Contractor's devices and the review of the

Contractor's own policies, procedures, security scans, tests, or reviews, which the Contractor agrees to provide to the SEC or its representatives upon request. The Contractor will make good faith efforts to remediate any vulnerabilities, issues, or negative findings as a result of any such audit, review, or risk analysis.

v. Transportation and Storage: Non-digitized data (such as paper documents) containing SEC data must be transported and stored in a manner designed to prevent the unauthorized loss of a document or disclosure of the information in a document. At a minimum this will require written procedures and policies, evidence that these procedures and policies are being followed, records that contractors are being trained on those policies and procedures, along with a physical assessment by the SEC's OIT Security of any area where the documents are stored or used.

w. Unauthorized Access Protection: Devices that may contain digitized copies of SEC data -such as photocopy machines, scanners, and faxes - must be protected against unauthorized access both physical or via computer network or wireless connection and the devices may not be returned, sold, or otherwise disposed of until they have first been scrubbed of SEC data in a manner approved by SEC's OIT Security or physically destroyed. Duplication of SEC data that is not directly related to SEC assignments through the use of photocopies, scanning, photography, or Web-cameras, is prohibited.

x. Destruction: Material or devices containing SEC data can only be destroyed using an SEC-approved process, which may require the provision of certificates of destruction to the SEC.

y. System Patching and Maintenance: Any information system components must be kept up to date with vendor versions, patches and security updates. No end-of-life or unsupported components may be used on systems that process or store SEC data, regardless of their location.

z. System Authentication: Any information system that utilizes authentication for access must conform to SEC policies on system access. For systems categorized as FIPS 199 MODERATE, this includes supporting multi-factor authentication using PIV credentials.

6014.00 USE OF CONTRACTOR DATA AND/OR MATERIALS (JANUARY 2022)

The Contractor acknowledges and agrees to the following: The SEC anticipates using the data and/or materials to conduct analyses for use in reports, studies, memoranda, and presentations.

The SEC anticipates the following types of situation where analyses based on underlying data may be made public: by the SEC itself (E.g., SEC rulemaking and/or analysis done as part of an inspection or enforcement action), by SEC staff where the SEC is directing or facilitating the publication (e.g., a staff study in response to a Congressional request), by SEC staff facilitating their own private publication where the Commission has not taken a position regarding the publication of the analysis(e.g., a research report to be submitted by the individual staff to an academic conference or journal), and a former employee of the SEC who has substantially completed the analysis while on staff and is facilitating his/her own private publication( e.g., a research report to be submitted to an academic conference or journal). In all of these situations, only "insubstantial amounts" of the licensed data and/or material would be made public and no raw data would be made public, the authors would agree to abide by all contractual terms and conditions, and as the owner/licensor of the data the Contractor would receive attribution and be cited as the data source. "Insubstantial amounts" means an amount that has no independent commercial value and could not be used as a substitute for the service or product or any part of it.

6022.00 FEDRAMP REQUIREMENTS FOR CLOUD-BASED SERVICES (SEPT 2025)

FedRAMP Information Technology Systems Security & Continuous Monitoring Requirements:

a. In accordance with the FedRAMP Program, agencies may leverage cloud services that have been assessed and granted an authorization-to-operate (ATO) by the Joint Authorization Board (JAB) or by another Federal agency. Regardless of the authorization path, the cloud services provided to Securities and Exchange Commission (SEC) through this contract must adhere to FedRAMP requirements.

b. Contractor shall refer to cloud service providers, or the contracted entity providing cloud computing services to the Federal Government through this contract. If the Contractor is using third-party cloud services to fulfill the Government requirements established by the contract, the Contractor is responsible for ensuring that any third-party cloud services have a valid authorization-to-operate (ATO) that was granted by the Joint Authorization Board (JAB) or by another Federal agency.

c. In accordance with Federal Information Processing Standard (FIPS) 199 guidelines, the SEC will determine the security impact level for cloud services with consideration for how such systems are used to store, transmit, and process information for the SEC.

d. The Contractor is responsible for meeting FedRAMP cloud computing baseline security controls and FedRAMP continuous monitoring requirements at either the low or moderate impact level as defined by FIPS 199. These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems.

e. Following the security categorization determination by SEC, the Contractor shall apply the appropriate security controls baseline, as required by FedRAMP to ensure compliance to security standards. The FedRAMP baseline controls are based on National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, Recommended Security Controls for Federal Information Systems and Organizations (as amended), and also includes a set of additional controls for use within systems providing cloud services to the federal government. If the Contractor is using a third-party cloud provider it will ensure the cloud provider is FedRAMP compliant and has an agency ATO or JAB ATO.

f. The Contractor and the SEC share responsibility to ensure compliance with security requirements.

g. Non-FedRAMP approved cloud services (IaaS, PaaS, and SaaS) which are planned to provide solutions to the Federal Government must undergo the FedRAMP Assessment and Authorization process, which has established guidelines for performing security assessments for low, moderate, and high impact systems. Based on SEC mission needs, the agency may opt to perform a tailored security assessment to evaluate the risk of select cloud services. The SEC will provide a tailored assessment on a case by case basis and will provide written authorization if it chooses to go down that path.

h. FedRAMP requires cloud service providers to utilize a Third-Party Assessment Organization (3PAO) to perform an assessment compliant with standards from NIST of the cloud service provider's security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements. (Note: The FedRAMP JAB will not review authorization packages assembled by non-accredited third-party assessors. Contractors can find the list of FedRAMP-accredited 3PAOs at https://www.fedramp.gov/.) If a contractor is utilizing a third-party cloud service provider and delivering a solution specifically designed for the SEC, then the SEC will work with the contractor to perform an assessment and issue an ATO. The underlying third-party infrastructure or platform must still be evaluated by a 3PAO and have an agency ATO or JAB

ATO.

i. The FedRAMP PMO security staff will be available for consultation during the process. Both the FedRAMP PMO staff and JAB will review the results before issuing a Provisional Authorization decision. The Government reserves the right to verify the infrastructure and security test results before issuing an Authorization decision.

j. The Contractor shall maintain a security management continuous monitoring environment that meets or exceeds the requirements in the Reporting and Continuous Monitoring section of this contract based upon the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements.

k. The Contractor shall substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

l. The SEC may choose to cancel the Contract award and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than the SEC's risk tolerance thresholds.

m. The Contractor is advised to review the FedRAMP guidance documents to determine the level of effort that will be necessary to complete the requirements. All FedRAMP documents and templates are available at http://FedRAMP.gov.

FedRAMP Privacy Requirements:

a. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1 Privacy or Security Safeguards, the Contractor shall be responsible for the following privacy and security safeguards:

1. The Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of Assessment and Authorization (A&A) verification.

2. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases.

3. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include, but is not limited to:

▪ Authenticated and unauthenticated operating system/network vulnerability scans

▪ Authenticated and unauthenticated web application vulnerability scans

▪ Authenticated and unauthenticated database application vulnerability scans

▪ Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

4. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

5. If the Contractor chooses to run its own automated scans or audits, results from these scans may, at the Government's discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of contractor-conducted scans shall be provided, in full, to the Government.

6. The Contractor shall also comply with any additional FedRAMP privacy requirements.

7. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the contractor's IT environment being used to provide or facilitate services for the Government.

Nonpublic Information Storage Requirements:

a. Nonpublic information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. Additional specifications are found in SECR 23-2. The Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

b. The disposition of all data will be at the written direction of the COR, this may include documents returned to Government control; destroyed; or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the

COR.

Protection of Information Responsibilities:

a. The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as Nonpublic information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

b. The Government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor's infrastructure, as well as maintains the right to request full copies of these at any time.

c. The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The Contractor shall ensure that the facilities that house the network infrastructure are physically secure.

d. The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The Contractor shall provide requested data at no additional cost to the government.

e. No data shall be released by the Contractor without the consent of the Government in writing.

All requests for release must be submitted in writing to the COR/CO.

Security Classification:

a. The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level unless otherwise specified.

Disclosure of Information:

a. Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor's responsible employees.