ATCH 03 Special Provisions 3 Dec 2025.pdf

ATCH 03 - Special Provisions Payment Card Industry Data Security Standard Audit Readiness

3 DEC 2025

SPECIAL PROVISIONS

1. CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer is the only person authorized to approve changes in any of the requirements under this contract and not withstanding any provisions contained elsewhere in this contract, authority remains solely in the Contracting Officer. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change will be considered to have been without authority and will not be recognized for payment by the

NAFI.

2. SUPERVISION AND CONTROL

The NAFI will not exercise any supervision or control over the Contractor's employees performing services under this contract. Employees will be accountable solely to the Contractor, who in turn is responsible to the NAFI.

3. TYPE AND TERM OF CONTRACT

The NAFI will award one (1) Firm Fixed Price (if applicable) contract. The contract will be for a one (1) year base period, with four (4), one (1) year options, for a total potential performance period of five (5) years.

4. OPTION TO EXTEND THE TERM OF THE CONTRACT

The NAFI may exercise option periods under this contract by written notice to the Contractor at least 1 day prior to contract expiration; provided that the NAFI gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the NAFI to exercise the option.

5. PRICE ADJUSTMENTS

The contract prices/fees in Supplies, Services and Prices are fixed for the term of this contract unless the Contracting Officer, as provided below, approves adjustments:

An increase in the fixed prices/fees may be requested when the Contractor experiences a substantial and unanticipated increase in prices/fees associated with the performance of this contract. The Contractor must submit a written request to the Contracting Officer. It must contain proposed fixed prices/fees, the proposed effective date (which can be no sooner than thirty days after any approval by the Contracting Officer), and full documentation to justify and substantiate the basis for the requested adjustment. No increase in prices/fees will be applied until the date approved by the Contracting Officer via written modifications. The Contracting Officer must take action on such requests within thirty (30) days after receipt or by the date requested by the Contractor, whichever is later.

3 DEC 2025

6. PRIVACY ACT NOTIFICATION (Apr 1984)

The Contractor will be required to design, develop, and/or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93- 579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

7. PRIVACY ACT (Apr 1984)

The Contractor agrees to:

Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies the systems of records and the design, development, or operation work that the contractor is to perform.

Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act.

Include this clause, including this subparagraph, in all subcontracts awarded under this contract which require the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

“Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

“Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint, voiceprint, or photograph “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

8. PRIVACY OR SECURITY SAFEGUARDS (Aug. 1996)

The Contractor will not publish or disclose in any manner, without the Contracting Officer’s

3 DEC 2025

written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party.

9. SECTION 508

All information and communication technology (ICT) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. Further information on section 508 is available via the Internet at http://www.section508.gov.

10. DATA STEWARDSHIP AND GOVERNANCE

The software, database scheme and documentation must be placed in escrow and updated at each major release. If the vendor is sold or bankrupt, the vendor will pay any fees to convert the data for use on another system.

Should the NAFI elect not to execute option years or at the end of the contract period, whichever is sooner, data must always be promptly accessible until converted to the new system with no additional separation fee.

11. DISCLOSURE OF INFORMATION (OCT 2016)

The Contractor (including Contractor’s employees) will not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless—

The Contracting Officer has given prior written approval.

The information is otherwise in the public domain before the date of release; or

The information results from or arises during the performance of a project that involves no covered defense information (as defined in the clause at DFARS 252.204-7012) and has been scoped and negotiated by the contracting activity with the contractor and research performer and determined in writing by the contracting officer to be fundamental research (which by definition cannot involve any covered defense information), in accordance with National Security Decision Directive 189, National Policy on the Transfer of Scientific, Technical and Engineering Information, in effect on the date of contract award and the Under Secretary of Defense (Acquisition, Technology, and Logistics) memoranda on Fundamental Research, dated May 24, 2010, and on Contracted Fundamental Research, dated June 26, 2008 (available at DFARS PGI

204.4 (DFARS/PGI view)).

http://www.section508.gov/

3 DEC 2025

Requests for approval will identify the specific information to be released, the medium to be used, and the purpose for the release. The Contractor will submit its request to the Contracting Officer at least 10 business days before the proposed date for release.

The Contractor agrees to include a similar requirement, including this paragraph, in each subcontract under this contract. Subcontractors will submit requests for authorization to release through the prime contractor to the Contracting Officer.

12. COMMUNICATION.

The Contracting Officer will be included in all communication unless otherwise notified by the Contracting Officer. This includes, but is not limited to meetings, briefings, teleconferences, and email correspondence.

All issues and/or questions concerning delivery, deliverables, scope or price will be directed to the Contracting Officer ONLY.