Appendix A.pdf

CFPB LOCAL CLAUSES

Bureau Enhanced Acquisition Management System

Source Selection Sensitive in accordance with FAR 2.101 and FAR 3.104.

Procurement ID: ePRO-2021-13963

In the spirit of transparency and accountability and in accordance with FAR Subpart 33.103, the Contracting Officer (CO) will receive and review all agency protests. Prior to submitting an agency protest, all parties shall use their best efforts to resolve concerns raised by an interested party at the CO level through open and frank discussions. If such concerns are not satisfactorily resolved by this means, an interested party may file a protest with the CO, triggering a formal review process. The CO shall carefully consider all protests to the Bureau, whether submitted before or after award, and seek legal advice prior to issuing a protest decision. An interested party may request an independent review at a level above the CO as an appeal of a CO decision on a protest. The agency official who is to conduct the independent review is the Senior Procurement Executive (SPE), except in the event s/he has a conflict of interest, in which case an alternative independent reviewer will be used.

Using an agency-level protest resolution does not preclude an interested party from using other protest resolution methods available by law. However, if a protest is filed with a forum outside of the Bureau subsequent to an agency-level protest filing or an appeal of an agency-level protest decision but before the agency-level process has concluded, the agency-level protest or appeal will be considered moot and will be dismissed.

The Bureau is committed to independent, impartial, and swift resolution of agency-level protests. The CO shall make best efforts to resolve agency protests within thirty-five (35) days after the protest is filed. If an appeal is filed, the Bureau’s SPE shall make best efforts to resolve the appeal within fifteen (15) days after the appeal is filed. The Bureau encourages open communication with prospective or unsuccessful bidders and encourages the agency-level process as a means to resolve protests.

Protests filed with the Bureau shall be concise and logically presented to facilitate review. Valid protests shall include the information required by FAR Subpart 33.103(d)(2). Failure to substantially comply with any of the requirements may be grounds for dismissal of the protest.

Protests alleging improprieties in a solicitation shall be filed before solicitation opening or the closing date for receipt of proposals if the improprieties were apparent prior to those times. If an alleged impropriety did not exist in the initial solicitation, but was later incorporated into the solicitation by an amendment, a protest based on that impropriety must be filed before the next closing time established for submitting proposals.

In all other cases, protests shall be filed no later than ten (10) days after the basis of protest is known or should have been known, whichever is earlier. If the procurement was conducted on the basis of competitive proposals and the protester has requested a debriefing, the protester must file no later than five (5) days after the date on which the debriefing was held to be considered timely. An appeal of a CO’s decision on a protest, made to the Bureau’s SPE must be filed within three (3) days from receipt of the CO’s protest decision. The Bureau’s appellate review of an agency protest decision does not extend the time for obtaining a stay at the Government Accountability Office (GAO).

When a filing deadline falls on a weekend or Federal holiday, the filing deadline is extended to the next Federal business day. Documents received after close of business are considered filed as of the next day.

Unless otherwise stated, the Bureau close of business is 5:00 p.m., Eastern Time.

AGENCY LEVEL PROTEST (JUNE 2020)

BUREAU DELIVERIES (AUGUST 2020)

Page 1 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

8/26/2021https://sharepoint.cfpb.local/promgt/procure/eProcurement/_layouts/15/Print.FormServer.a...

Deliveries to the Bureau via US Postal Service or nation-wide delivery services, such as Federal Express or United Parcel Service, should be shipped to 1700 G St, NW, Washington, DC 20552. Deliveries to the Bureau via courier or personal delivery should use 1700 G St, NW, Washington, DC 20006 if delivering to 1700 G Street, NW, or use 1990 K Street, NW, Washington, DC 20006 if delivering to 1990 K Street, NW.

The loading dock at 1700 G Street, NW is located on the back side of the building. Access to the loading dock is on F Street. The loading dock is restricted in size and delivery vehicles must be under 13 feet.

Deliveries must take place between the operating hours of 7:30 am and 4:30 pm local, Monday – Friday, unless otherwise approved and coordinated with a member of the Bureau’s Facilities Operations Management staff in advance of the delivery. All deliveries for the Bureau’s Technology & Innovation (T&I) division, consisting of laptops, printers, servers (or other high dollar items), may be received by CFPB personnel in Facilities but the official acceptance e.g. verifying the contents of the shipment must be performed by a Government T&I employee. The loading dock personnel will notify the contact person when the truck arrives. All large deliveries require, at a minimum, one business day prior notification to a member of the Bureau’s Facilities Operations Management Staff. Contact by email, cfpbfacilities@cfpb.gov (preferred) or by phone, 202-435-9390.

The Contracting Officer for this: Contract Palmer, Catherine (CFPB)

Consumer Financial Protection Bureau Address: 1700 G Street NW, Washington DC 20552 Work Phone:

Email Address:

The Contracting Officer, in accordance with FAR Subpart 1.6, is the only person authorized to make or approve any changes in any of the requirements, and notwithstanding any clauses contained elsewhere, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the terms or price to cover any increase in cost incurred as a result thereof.

COR will be designated at the time of award:

ACOR Designation:

Performance of work must be subject to the technical direction of the COR identified, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

Technical direction must be within scope of the contract. Technical direction may be oral or in writing.

The COR shall confirm oral direction in writing within five (5) workdays. The COR does not have authority to issue technical direction that:

• Constitutes a change of assignment or additional work outside the specification(s);

• Constitutes a change as defined in the clause entitled “Changes”;

• Causes a change to the price or time/period required for performance or delivery;

• Changes any of the terms, conditions, or requirements;

• Interferes with the Contractor’s right to perform under the terms and conditions of the

Contract

• Directs, supervises or otherwise controls the actions of the Contractor’s employees.

CONTRACTING OFFICER`S AUTHORITY (MARCH 2019)

202-435-7447 catherine.palmer@cfpb.gov

CONTRACTING OFFICER`S REPRESENTATIVE (COR) DESIGNATION AND AUTHORITY (JUNE 2019)

Page 2 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR, falls within the limitations noted above, the Contractor shall immediately notify the Contracting Officer.

Failure of the Contractor and the Contracting Officer to agree that technical direction is within the scope shall be subject to the terms of FAR clause 52.233-1, Disputes, hereby incorporated by reference.

The Contractor`s proposal dated is hereby incorporated by reference.

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the equipment or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such equipment or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government may institute all remedies available under applicable law. Further, any violation of this provision may be considered during the evaluation of past performance in future acquisitions.

Solicitation Instructions: If tasks covered in this solicitation are currently being performed or still need to be performed at the end of the resulting contract’s performance period (base plus options, if exercised), the award resulting from this solicitation is anticipated to occur in time to permit at a maximum a -day transition period. As a result, the Offeror/Quoter (“Offeror”) shall submit separate Phase-In and Phase-Out Plans with their proposal/quote (“proposal”). The Phase-In and Phase-Out Plan Contract evaluated as part of the source selection criteria. The purpose of the Plans is to ensure a smooth and orderly transition at the beginning and at the end of the performance periods. The Phase-In and Phase-Out Plans shall contain details that include, but are not limited to, identifying significant milestones essential to a seamless transition; timelines for events; involvement of key personnel; and the Offeror’s approach to interfacing with the Government and/or existing/successor Contractor, and promoting a collaborative work environment. The Phase-In Plan shall cover a period of calendar days following the first day the Contractor begins supporting the contract. It shall also contain details based on an understanding of the tasks described in the SOW, and the Offeror’s approach for taking ownership of tasks covered in the scope of the contract. The Phase-Out Plan shall cover a period of calendar days preceding the final performance period end date and shall address its approach for making recommendations to the COR of instances where the work may need to be transitioned to Government staff. It shall also fully describe how the Offeror will approach the following issues: employee notification regarding transition activities and milestones; retention of key personnel; turnover of work-in-progress; transfer of data and information; and any other actions required to ensure continuity of operations.

Included in its proposal/quote, the successful Offeror developed separate Phase-In and Phase-Out Plans based on instructions provided in the solicitation; therefore, the plan is incorporated into the Contract. The Contractor shall incorporate in its Plan/s any changes identified by the COR within the terms of the after award and submit its final Plan/s within five (5) business days following receipt of the COR’s changes. The COR will inform the Contractor’s Project Manager/Point of Contact after award if changes are needed to one or both Plans or if the Plans are approved.

Contractor Phase-In: During the Phase-In Period, Contractor personnel shall prepare to assume full responsibility for the areas of operation in accordance with the terms and conditions of the contract.

Contractor personnel shall take actions necessary to ensure a smooth transfer of the contracted tasks. This may include participating in shadowing opportunities, jointly discussing the status of projects, and providing

CONTRACTOR’S PROPOSAL (SEPTEMBER) 2018

CONTRACTOR PUBLICITY (SEPTEMBER 2018)

CONTRACTOR TRANSITION PLANNING/IMPLEMENTATION (MARCH 2019)

Page 3 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963 comments to work products. The Contractor personnel shall fully cooperate with the current Contractor personnel and with Government personnel as not to impede with their work or duties. During the Phase-In Period, the Contractor shall at a minimum:

• develop and submit any required deliverables;

• attend post-award meetings stated in the contract; and

• attend joint meetings as approved by the CO or COR.

Contractor Phase-Out: The COR may revisit the Contractor’s Phase-Out plan during the final performance period and request adjustments within the terms and conditions of the contract. Such changes shall be made within five (5) business days following receipt of the COR’s comments. The purpose of implementing the Plan is to ensure a smooth and orderly transfer of responsibility of tasks being currently performed by Contractor personnel. During the transition period immediately prior to the expiration of the contract, the Contractor personnel shall permit the successor’s Contractor personnel to observe and become familiar with all non-proprietary operations specified in this contract that are also covered in the successor’s contract. Contractor personnel shall fully cooperate with the successor Contractor/s personnel and with Government personnel as not to impede with their work or duties. During the Phase-Out Period, Contractor personnel shall continue to develop and submit the required deliverables.

The Contractor(s) agrees to cooperate with representatives of other contractors, Federal Reserve Banks, Federal agencies, Governmental entities, and other organizations, as may be required by the Bureau, but only to the extent such cooperation does not violate the Contractor’s independence, create a conflict of interest, or materially interfere with the Contractor’s performance of services under this Contract

a. The Consumer Financial Protection Bureau (CFPB) defines terms consistent with those determined by the National Institute of Standards and Technology (NIST, https://csrc.nist.gov/glossary).

1. Per NIST, an information system can be described as the following: “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.”

2. An information system includes any computer that contains Bureau data and performs any of the above tasks, not just systems of records.

b. The Contractor shall adhere to CFPB cybersecurity requirements for all information systems connected to a CFPB network or operated by the Contractor for, or on behalf of, the CFPB, regardless of location. In accordance with Homeland Security Presidential Directive 12 (HSPD-12), Office of the Management and Budget (OMB) Memorandum M-19-17, and the CFPB Information System Security Policy, any Contractor requiring routine physical access to a CFPB facility and/or routine access to a CFPB federally controlled information system will be required to obtain a CFPB issued Personal Identity Verification (PIV) card.

c. This clause applies to all or any part of the contract that includes information technology, information, information resources or services for which the Contractor must have physical or electronic access to CFPB facilities and/or information

d. CFPB information technology and information provided to the Contractors shall remain in the United States. The receipt, transmission, backup, accessing, maintenance, operation, and/or processing of CFPB technology and information must take place, and originate from, within the United States.

COOPERATING WITH OTHER ORGANIZATIONS (SEPTEMBER 2018)

CYBERSECURITY/INFORMATION SECURITY (FEBRUARY 2021)

Page 4 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

e. The Contractor shall maintain a complete and accurate inventory of all CFPB-provided data, along with complete access records. Upon request by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR), the inventory and access records shall be made available for inspection.

f. Contractors serving as an agent of the Bureau or on the Bureau’s behalf, or are receiving, transmitting, storing, or processing intellectual property, records, or Bureau-provided data must use government-furnished equipment (GFE) or Citrix-based virtual desktop interface (VDI) to complete Bureau work. However, if a contractor is creating independent content (training, documentation, etc.) that the Bureau receives, approves, and then executes; the Contracting Officer’s Representative (COR) may elect to exclude specific contractor roles from requiring GFE. The COR may elect to exclude contractor roles from GFE/VDI, if the contractor role:

1. Does not access the Bureau network or data;

1.

2. Does not manage Bureau social media or live links;

3. Does not act as a Bureau agent or on the Bureau’s behalf;

4. Contractor role does not generate Bureau data (i.e. records, intellectual property, etc.);

5. Produces the content without the input of Bureau data; and

6. All federal decision-making happens after Bureau receipt of content.

Each exclusion must be documented by the COR, approved in writing by the Bureau Authorizing Official or designee, and revisited annually.

g. The Contractor system or facility hosting CFPB information resources must meet all applicable federal, state, and local zoning, environmental, and building laws and regulations. The system or facility must include protection against unauthorized access at all hours, including alarms and notification systems, should such protection be breached.

h. Detected or suspected security compromises to CFPB information must be reported to the CO or COR and soc@cfpb.gov within 60 minutes of discovery by the Contractor.

i. The Contractor shall grant the Government access to all facilities and information resources used in support of the contract. The CFPB shall conduct annual reviews to ensure that the security requirements in the contract are implemented, enforced, effective, and operating as intended. These reviews include, but are not limited to, comprehensive technical testing of the control environment used to safeguard CFPB information resources.

j. At the expiration of the contract, the Contractor shall return all CFPB information resources provided to, or generated by, the Contractor during the period of the contract. The Contractor shall provide certification that all CFPB information has been sanitized from any non-GFE information system in accordance with CFPB standards and procedures with advanced notification for CFPB surveillance and/or inspection of the sanitization/destruction/disposition. All equipment sanitization procedures must be environmentally sound as outlined by the U.S. Environmental Protection Agency (EPA).

k. The Contractor shall comply with the Bureau’s Asset Management Policy and is responsible for:

Using and protecting its assigned equipment in accordance with the Acceptable Use Policy and Guidance laid out in the Facilities Non-IT Asset Management Directive and IT Asset Management Directive; providing access to their assigned equipment when requested by the responsible Asset Management team; and Immediately reporting the loss or theft of IT hardware or software upon discovery to the COR, the CFPB Security Office at extension 59001 or (202) 435-9001, and to the Service Desk at extension 57777 or (202) 435-7777.

Page 5 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

l. For the purposes of application development, the CFPB encourages and prefers the use of web-based, commercial-off-the-shelf solutions. The Contractor shall use web-based applications configured to work with multiple browser and operating system types and may not favor one browser type over another.

m. The Contractor shall adhere to all CFPB common security configurations and practices. Security configurations and practices include:

1.The provider of information technology shall certify applications are fully functional and operate as intended on systems using the United States Government Configuration Baseline and other operating system and application standards.

2. Final acceptance of the product will be based on the CFPB interpretation of the National Institute of Standards and Technology, National Checklist Program Repository (NIST, NCPR). Checklists are available at the NIST, NCPR website. In situations where security configurations are not available for proposed technologies, the CFPB shall provide instruction.

3. The installation, operation, maintenance, and update of software shall not alter any CFPB-accepted or established security configuration.

4. Applications designed for users shall run in standard user context without elevated system administrator privileges.

n. The Contractor shall notify the CO and the COR within 30 calendar days of any organizational change or impact that may interfere with the full execution of the information security requirements under the contract.

o. Throughout the term of the contract, should the Contractor deliver a product or provide a service that does not meet (and maintain) CFPB’s information security requirements, the Contractor, at their own expense, shall correct non-compliant deliverables within 90 days of notification by the CO or the COR.

p. The Contractor shall maintain a computing environment with federally-sufficient security at all times and in adherence with Bureau policy and standards. This includes, but is not limited to, the description and documentation of the processes and procedures that the Contractor shall follow to ensure the security of IT resources that are developed, processed, transmitted, used, or maintained under this contract and comprehensive technical testing of the Contractor’s computing environment by the CFPB.

q. Prior to the execution of the contract, the CFPB may require validation to ensure adequate security controls in the Contractor environment. When a validation is required, the validation will be conducted by the CFPB as part of an on-site inspection process.

r. Contractors providing services that are Federal Risk and Authorization Management Program (FedRAMP) certified shall ensure their FedRAMP packages remain current throughout the life of the contract.

s. The Contractor shall demonstrate, upon request by the CO or COR, the technical, operational, and management safeguards that protect the confidentiality, integrity, and availability of CFPB information that it develops, processes, transmits, uses, or maintains during the execution of this contract. This demonstration may include the delivery of artifacts within the scope of the FedRAMP package and independent from FedRAMP artifacts.

t. The Contractor shall ensure its computing environment complies with Federal laws that include, but are not limited to, the Federal Information Security Modernization Act of 2014 (FISMA), and with Federal policies and procedures that include, but are not limited to: NIST Special Publication (SP) 800-60, 800-63A, FIPS 200, and CFPB Information Security Standards (CS-S-01). Copies of these documents are maintained by the CFPB Office of Cybersecurity and are available upon request. Failure to maintain compliance with applicable statutes, regulations, and guidance is a breach of the contract. The CO or COR may conduct one or more on-site inspections to ensure compliance.

Page 6 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

1. If a Contractor is an Agent of the Bureau, or acting as on the Bureau’s behalf, all Contractors and systems shall adhere to the most current OMB Circular A-130 and NIST SP 800-53 requirements in alignment with the Bureau-established FIPS Publication 199 determination for that authorized system, data extract, or derived data.

a). Information system(s) shall have the ability to transfer audit logs to the Bureau’s centralized log collection and analysis system, Splunk by using an application programming interface (API) or a secure system log file (syslog).

b). Information system(s) shall support Security Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) for federated login to any web console provided by the tool, if providing a log-in capability.

c). Information system(s) shall provide a user management application programming interface or web services capability that allows for the creation, updating, disabling and deletion of accounts and permissions, if the application requires accounts.

d). The project technical team shall submit an information system security baseline in alignment with Bureau common information security standards (ISS) and the system sensitivity classifications per the Federal Information Processing Standard (FIPS) 199/200 assessments, if appropriate.

2. In addition to any and all applicable Federal laws, regulations, and directives, the Contractor shall adhere to the most current NIST Special Publication (SP) 800-171 requirements for non-federal contractor information systems that receive, transmit, process, store, or collect any form of Controlled Unclassified Information (CUI) collected for or provided by the Bureau. This is applicable to Contractors and Vendors who do not serve in any capacity as Bureau agents and do not have the authority to act on the Bureau’s behalf.

3. The Contractor shall adhere to Bureau-defined requirements regarding all Bureau system development life cycle (SDLC) policies, procedures, and activities. This includes the removal and disposal of all Bureau data from Contractor-owned and operated information systems. The Contractor shall provide any and all requested artifacts required to verify and attest that all Bureau data has been permanently removed once the information system is no longer required to process, store, or transmit Bureau data. These artifacts include, but are not limited to:

a). Signed letter or document from the Contractor showing/attesting that all bureau level data has been properly and correctly removed.

b). Screen captures, or equivalent, showing each step taken within the information system and final result when permanently removing Bureau data.

c). On-site inspection or remote surveillance of the sanitization/disposal/disposition process.

u. The Contractor shall maintain an active information security program with detective, preventative, and responsive elements to ensure administrative, managerial, technical, and physical controls per section s, above. The program shall specifically address methods regarding handling and protecting CFPB information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems, to include end-user systems.

v. The Contractor, as deemed necessary, may use additional safeguards other than as provided for by the Contract to prevent use or disclosure of CFPB information.

w. The Contractor shall, at its own expense, take action to mitigate any harmful effect that is known to the Contractor of a use or disclosure of CFPB information by the Contractor in violation of the requirements of this clause.

Page 7 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

x. The Contractor shall not use meta-data about CFPB’s use of the service for any purpose except for troubleshooting, technical performance monitoring, or ensuring security and functionality of the service.

y. The CFPB Office of Cybersecurity maintains current information security requirements and standards and will provide details to the Contractor as needed after contract award. The CO or COR will notify the Contractor of any substantive changes to information security requirements that have a significant impact on the Contractor’s information security obligations under the Contract.

z. The Contractor shall include the substance of this clause in all subcontracts under this Contract.

a. Definition. As used in this clause, “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), "Payment documentation and process" and the applicable Payment clause included in this contract.

b. Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP is available on the Internet at https://ipp.for.fiscal.treasury.gov/. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email ippgroup@bos.frb.org or phone (866) 973-3131.

c. The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing.

d. If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

e. Each payment request submitted shall be supported by appropriate documentation necessary to substantiate the request.

For commercial firm-fixed-price/fixed-price contracts/CLINs, payment requests shall be submitted in accordance with this local clause and FAR 52.212-4(g).

For commercial Time and Materials/Labor-Hour contracts, payment requests shall be submitted in accordance with FAR 52.212-4, Contract Terms and Conditions - Commercial Items and Alternate 1.

Payment requests shall be submitted by the calendar day of each month following the month of performance and shall meet the approval of the Contracting Officer Representative (COR).

For payment and invoice questions, go to https://ipp.for.fiscal.treasury.gov/ or contact the Accounting Services Division at (304) 480-8000 or via email at AccountsPayable@fiscal.treasury.gov

The Consumer Financial Protection Bureau (CFPB or Bureau) promotes and is committed to the participation of Historically Black Colleges and Universities (HBCUs) and Minority Institutions (MIs) in its procurements.

I. Definitions – For the purposes of this clause:

a. Historically black college or university means an institution determined by the Secretary of Education to meet the requirements of 34 CFR 608.2.

b. Minority institution means an institution of higher education meeting the requirements of Section 365(3) of the Higher Education Act of 1965 (20 U.S.C.1067k), including a Hispanic-serving institution of higher education, as defined in Section502(a) of the Act (20 U.S.C.1101a).

II. Contractor Obligation:

ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (INVOICE REQUIREMENTS) (JANUARY 2021)

HISTORICALLY BLACK COLLEGES AND UNIVERSITIES AND MINORITY INSTITUTIONS (SEPTEMBER 2020)

Page 8 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

a. The Contractor has made and shall continue to make, or shall make, during this contract, a good faith effort to promote and to ensure, to the maximum extent possible, HBCU/MI inclusion in its subcontracts.

b. Subcontractors – The Contractor shall insert the substance of this clause in all subcontracts under this contract.

The Contractor is responsible for conducting business between the hours of Monday through Friday, except Federal holidays (listed on the Office of Personnel Management’s (OPM) website at www.opm.gov) or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. However, certain contracts do require a 24/7 on-site operation schedule. The hours of operation are specifically stated in these contracts.

For other than firm-fixed-price contracts, the Contractor will not be reimbursed when the Government facility is closed for the above reasons. The Contractor must maintain an adequate workforce for the uninterrupted performance of all tasks defined within the Statement of Work when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. Under special circumstances in order to meet tight deadlines or deliverable schedules, contractors supporting other than firm-fixed-price contracts may be required to provide services outside the stated schedule, including weekends, Government observed holidays or Government directed closings. The Contracting Officer’s Representative (COR) must approve, in advance, any exceptions to services performed outside of the stated schedule.

The Contractor agrees that the Consumer Financial Protection Bureau (CFPB) (including its authorized representative and/or its Office of Inspector General) (collectively, "CFPB") shall, until expiration of three (3) years after final payment under this contract, have access to and the right to examine any directly pertinent books, documents, papers, and records of the Contractor involving transactions related to this Contract. The Contractor further agrees to include in all its subcontracts hereunder a provision to the effect that the subcontractor agrees that the CFPB shall have the same rights to the subcontractor books, documents, papers and records as specified above.

The periods of access and examination described above, for records which relate to (1) litigation or the settlement of claims arising out of the performance of this contract, or (2) costs and expenses of this contract as to which exception has been taken by the CFPB, shall continue until such litigation, claims, or exceptions have been disposed of, and CFPB has specified in writing that exception is no longer being taken.

The payment Schedule shall be as follows:

Contractor Personnel assigned to perform tasks under the Contract must be able to fluently read, write, speak and understand the English Language.

The Contractor recognizes that, in providing services under this contract, the Contractor may obtain access to or may become aware of non-public information that is confidential in nature pursuant to the Bureau’s regulations at 12 CFR Part 1070, et seq,.(including but not limited to information that may be privileged or

HOURS OF OPERATION AND COVERAGE (SEPTEMBER 2018)

INSPECTION OF BOOKS & RECORDS (MARCH 2019)

INVOICE SCHEDULE (SEPTEMBER 2018)

Payment will be made upon delivry of licenses to CFPB, with COR approval.

LANGUAGE REQUIREMENTS (SEPTEMBER 2018)

NON DISCLOSURE (MARCH 2019)

Page 9 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963 proprietary in nature or contain Personally Identifiable Information (PII) and/or qualifies as Controlled Unclassified Information (CUI), as that term is defined under Executive Order 13556 (November 4, 2010) .

Without prior written approval by the Contracting Officer Representative (COR) or unless otherwise permitted by law, information acquired or prepared by the Contractor pursuant to providing services under this contract shall not be:

1. used by the Contractor for any purpose other than to perform work under the contract or

2. disclosed by the Contractor to others outside

i. the approved Contractor personnel whether that personnel is providing services under this contract or another Bureau contract or

ii. the Government personnel serving in an oversight role or participating on a “need to know” basis.

The Contractor shall secure acquired or prepared information in a location with access limited to only the personnel groups previously stated or in a location that is determined by the COR to be acceptable. In accordance with the Contract Disputes Act, any unauthorized disclosure of non-public sensitive, confidential, or proprietary information, or Personally Identifiable Information (PII) is considered a violation of a material term of this contract. Classified information will NOT be made available to the Contractor.

Prior to any Contractor personnel (i.e., individual personnel working for the Contractor as an employee or under a subcontract) performing services under this contract, or prior to the Contractor personnel participating in any discussions or receiving any information specific to this contract, each such individual Contractor personnel shall sign a Non-Disclosure Agreement (NDA) [See NON-DISCLOSURE AGREEMENT]. A signed NDA is required for each individual Contractor personnel meeting the criteria stated directly above.

Signed NDAs are provided to the COR. If any individual Contractor personnel does not sign an NDA, the individual is not permitted to perform services, participate in discussions or receive information affiliated with this contract. The NDA covers all information relative to this contract that the Contractor may obtain access to or be made aware of, including, but not limited to, all deliverables, documents, or records.

Base Period (Months) Total Length Of All Option Periods (Months)

On-boarding: In accordance with Homeland Security Presidential Directive 12 (HSPD-12), Office of the Management and Budget (OMB) Memorandum M-19-17, and the CFPB Information System Security Policy, any Contractor requiring routine physical access to a CFPB facility and/or routine access to a CFPB federally controlled information system will be required to obtain a CFPB issued PIV card. The Contractor’s Project Manager (PM)/Point of Contact (POC) shall ensure that each of their Contractor personnel supporting the contract provides the required documentation and/or performs the required action, as applicable in accordance with requests by CO or COR, stated in the table below . If a form is required, the COR will provide it to the Contractor’s PM/POC following award. Timeframes apply after the award date.

On-boarding Instance Documentation/Action Timeframe Contractor Personnel’s Initial Security Check prior to performing work

Contractor Security Processing Packet (CSPP): one per Contractor personnel, provided to COR

No later than two (2) business days after Contractor identifies non-key personnel to support contract or after a replacement for a key personnel is decided

Contractor Personnel’s Initial Security Check prior to performing work

Fingerprints, specific to an individual Contractor personnel, provided to Bureau

No later than two (2) business days after Contractor personnel is notified to provide fingerprints, an appointment is scheduled and

PERIOD OF PERFORMANCE/DELIVERY REQUIRED (SEPTEMBER 2018)

12 48

PROCESSING OF CONTRACTOR PERSONNEL (FEBRUARY 2021)

Page 10 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963 fingerprints are provided within (3) business days

Contract Kick-off Meeting or Contractor Personnel’s Start Date (whichever occurs first)

An individually signed Non-Disclosure Agreement for each Contractor personnel supporting the contract, provided to COR

At beginning of Kick-off Meeting or prior to work being performed

Contractor Personnel’s Start Date

Site badge application provided to the

COR

No later than start date when reoccurring building access is required

As the Bureau processes each Contractor personnel’s initial security check, the Contractor’s PM/POC shall keep the COR abreast of any changes to its employee’s availability. Upon notice to the Contractor’s PM/POC by the COR that a Contractor personnel’s initial security check is successfully completed, the Contractor’s PM/POC shall coordinate with the COR to determine a start date for each individual. If notice of an unfavorable suitability determination is provided for a Contractor personnel or if a Contractor personnel’s availability changes during the on-boarding process, the Contractor’s PM/POC shall identify a suitable replacement within five (5) business days.

Off-boarding: When Contractor personnel depart during a performance period, voluntarily or involuntarily, the Contractor’s PM/POC shall notify the COR as outlined below. In addition, prior to the contract’s performance period expiring, the Contractor’s PM/POC shall work with the COR to ensure the smooth departure of each Contractor personnel. Such notification is required in accordance with the Bureau’s “Off-boarding Policy” and “Off-boarding of Contractor Personnel Standard Operating Procedure.” The timing and the means of notifications are outlined below:

Off-boarding Instance Documentation/Action Timeframe During contract’s performance period or when contract is expiring

Individual – Contractor Personnel Off-Boarding Checklist, one per Contractor personnel, provided to COR

Initial submission: No later than two (2) weeks prior to the Contractor personnel’s departure date (i.e., last day supporting the contract).

Final submission: No later than the Contractor personnel’s departure date.

When contract is expiring

Close-out - Contractor Off-Boarding Checklist, one per contract, provided to COR

Initial submission: No later than two (2) weeks prior to contract’s final performance period end date.

Final submission: No later than the contract’s final performance period end date.

The Contractor’s PM/POC shall coordinate with the COR to ensure that the completed Off-Boarding checklists are provided to the COR and that Government-issued items/hard copy documentation are returned prior to the contract’s final performance period end date. Any electronic documentation generated by Contractor personnel while supporting the contract shall be saved to a shared location for access by the COR. Depending on the situation causing a Contractor personnel departure, if the Contractor’s PM/POC is unable to meet the timing requirements above, they shall notify the COR and submit the required documentation/actions as soon as possible.

Accounts Receivable Conversion of Check Payments to electronic funds transfer (EFT): If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the Government, it will be converted into an EFT. This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within twenty-four hours and will be shown on the regular account statement.

PROCESSING OVERPAYMENTS (SEPTEMBER 2018)

Page 11 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

Credit Memos: Contractors are allowed, with the Contracting Officer’s written permission, to issue a credit memo when an overpayment is paid by the Bureau. The full overpayment will be credited in full to the Bureau on the next payment request (invoice/voucher). If the credit memo exceeds the payment request, it will be applied to the next payment request.

Contracts are not to be awarded to Government employees or a business concern or other organization owned or substantially owned or controlled by one (1) or more Government employees. For the purposes of the Contract ,the Contractor is prohibited from using Government employees in any work performed by the Contractor(s) or any of its employees, subcontractors, or consultants.

Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chapters 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

The Consumer Financial Protection Bureau (CFPB) owns the rights to all recorded information, regardless of form or characteristics, produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which CFPB shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

In accordance with 36 CFR 1222.32, the Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

PROHIBITION AGAINST THE USE OF FEDERAL EMPLOYEES (SEPTEMBER 2018)

RECORDS AND INFORMATION MANAGEMENT (MARCH 2019)

Page 12 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

CFPB and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of CFPB or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to Contracting Officer and the Records Management Office. The Bureau must report promptly to NARA in accordance with

36 CFR 1230.

The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the Contract .The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity.

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

The Contractor shall continue to abide by FAR subpart 4.7 and the appropriate Data Rights provisions at FAR subpart 27.4.

Page 13 of 26Bureau Enhanced Acquisition Management System - ePRO-2021-13963

Personnel Security To determine whether an individual is suitable to support the Bureau as a contractor personnel or subcontractor personnel, the contractor’s Project Manager (PM)/Point of Contact (POC), shall ensure that contractor personnel (includes subcontractor personnel) working under the contract meet the requirements defined within this clause.

a. Prior to performing any services under the contract, contractor personnel are required to pass an initial security check performed by the Bureau’s Personnel Security Office (PSO).

1. The steps required by contractor personnel for an initial security check are as follows:

a) Submits to the Contracting Officer Representative (COR) a completed Bureau provided Contractor Security Processing Packet (CSPP) which includes a Contractor Consumer/Credit Report Release form.

b) Provides fingerprints to the Bureau.

c) Complete an e-QIP application. (Upon receipt of the CSPP, PSO will provide the contractor instructions for completing the required questionnaire e.g., SF-85, SF-85P, OF-306 in the e-QIP system).

b. If the PSO determines a contractor personnel successfully completed the initial security check and a full background investigation has been scheduled appropriate to the position sensitivity risk level (i.e., high, moderate or low) assigned by the Bureau, the COR will notify the contractor’s PM/POC of an approved Entry on Duty (EOD) date specific for each contractor personnel and specific to the base contract number.

Contractor personnel shall not perform any work under the contract until receiving notice of an EOD date.

c. Following completion of the…