Attachment 1 - SOW and Special Requirements (FINAL).pdf

SECTION I- STATEMENT OF WORK (SOW)

1 Purpose: The SEC seeks to retain a highly qualified consulting firm to provide all management, supervision, labor, facilities (if required), and materials necessary to perform Mock Jury/ Jury Consultant Legal support services on an IDIQ basis.

The government anticipates a firm-fixed-priced contract for all services while Other Direct Costs (ODC’s) shall be paid on a reimbursable basis.

2 Discussion/ Background: The U.S. Securities and Exchange Commission’s (SEC) mission is to protect investors, maintain fair, orderly, and efficient markets, and facilitate capital formation.

The SEC’s Division of Enforcement investigates possible violations of securities laws, recommends Commission action when appropriate, either in a federal court or before an administrative law judge, and negotiates settlements. These activities are prescribed by the following Acts:

• Securities Act of 1933

• Securities Exchange Act of 1934

• Trust Indenture Act of 1939

• Investment Company Act of 1940

• Investment Advisers Act of 1940

• Sarbanes-Oxley Act of 2002

• Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010

• Jumpstart Our Business Startups Act of 2012

The Securities and Exchange Commission (SEC) requires contract support for its legal efforts, including investigations, examinations, and litigation. The work of the SEC is managed by SEC

Government employees who define case, investigation, or other legal-related specific requirements and then obtain Contractor-provided support, as needed. The SEC cannot provide internal case numbers or names because it is non-public information, and from such information could be inferred the subject of investigations. Each SEC Division and Office has unique mission-driven needs which define its specific program requirements, and this allows each case or investigation manager to quickly assemble support resources to meet litigation demands.

Additional information about the SEC is available at http://www.SEC.gov.

Contract legal support including MJ/JC at the SEC was initiated in response to dramatic change in the amount and types of cases falling under SEC jurisdiction. The number of full time SEC attorney and support staff is insufficient to handle investigations and litigation with thousands of pages of evidence located nationwide involving hundreds of parties. The size and complexity of these cases dictate the need for additional support services.

3 Objective: The objective of this requirement is to obtain non-personal professional MJ/JC support services and products to support the mission requirements of the SEC. The primary users of these services are expected to be the Division of Enforcement and the Office of Compliance Inspections and Examinations, but other Divisions and Offices of the SEC are authorized to use the services. The SEC is comprised of the Home Office (Washington, DC), and 10 Regional Offices. A list of the SEC offices and their addresses is provided online at https://www.sec.gov/page/sec-regional-offices.

4 Team Composition Requirement: The contractor’s team of consultants, primary to each request, case shall include:

(a) at least one individual consultant who is required to have a Ph.D. degree in psychology or similar behavioral science field, with a minimum of 2 years of experience working as a jury consultant; and

(b) at least one individual consultant who is required to have a J.D. or comparable law degree, with a minimum of 7 years of experience as a trial lawyer, and either (A) experience having conducted, or having presided as judge in, at least 5 jury trials, or (B) experience having conducted at least 100 jury research studies of federal or state cases.

5 The Mock Jury / Jury Consultant services: The contractor shall provide fully burden firm-fixed-prices for Mock Jury/ Jury Consultant services shown below. While services under the contract will consist primarily of Mock Jury Exercises (item 5a), requests may also include Jury Consultant Support, Focus Group Research, and Community Attitude Surveys (items 5b through 5d). Each trial shall include up to 4 hours of consultation services. Consultation beyond 4 hours may be billed, in 15-minute increments, on a labor hour basis.

5a Mock Jury Exercises. Prior to trial, conduct mock jury sessions for the SEC trial lawyers, as designated on the attached Mock Jury / Jury Consultant Support Form. These services include:

1. Prior to the mock jury exercise, learn the case through discussion with the SEC lawyers and by reading the pleadings and other appropriate case filings or other papers designated by the SEC attorneys.

2. Identify and screen a pool of mock jurors from the area where the trial will be held that will serve as our mock jury. Review the candidates and select panels of https://www.sec.gov/page/sec-regional-offices mock jurors. Three panels of 12 mock jurors each is the default, but the SEC attorneys may request fewer or more people or panels on the MJ/JC request form.

A. Screen the mock juror candidates for potential conflicts.

B. Select the mock jurors so as to provide a cross-section reflecting the locality and demographic traits from which real jurors will be selected.

C. Obtain Non-Disclosure Agreements (NDAs) from all mock jurors.

D. Multiple panels will require multiple qualified individual consultants – one consultant per panel. Thus, contractor must provide a separate qualified individual consultant to observe and evaluate each panel during the mock jury exercise.

3. Locate and arrange for an appropriate facility for the mock jury exercise located where the trial will take place, and facilitate audio and video equipment for the lawyers’ presentations during the mock jury exercise. Provide a video/audio recording of the entire session (on DVD) with the written report. The facility should have sufficient space for all three panels together to watch the SEC’s presentations, along with a separate meeting room with one observation room for each panel, and any other special requirements for the mock jury.

4. Schedule the mock jury exercise for a date(s) and time that fits the SEC lawyers’ schedules and the SEC’s trial preparation schedule, including during non-regular business hours (e.g., evenings and weekends.) The SEC attorneys will designate whether the mock jury exercise will take place over one (1) or two (2) days.

5. In preparation for the mock jury exercise, work with the SEC lawyers to prepare introductory descriptions of the case to be read to the mock jury, shortened jury instructions and a verdict form for the mock jurors to use in their deliberations.

6. The mock jury exercise should proceed as follows:

A. Provide a neutral introduction to the mock jurors, after which the SEC attorneys will deliver opening / closing statements to all the mock jurors assembled for the session (together in one group).

B. After the opening/ closing, divide the whole group of mock jurors into (normally) 3 panels of 12. Three panels of 12 mock jurors each is the default, but the SEC attorneys may request fewer or more people or panels on the MJ/JC request form. All of the panels will deliberate simultaneously. Panels should reflect a demographic balance and opinion balance based on the jurors’ written answers from the opening/ closing portion of the exercise. The actual number of mock juries and number of panels may be adjusted to meet the SEC attorney’s requirement as stated on the “Mock Jury and Jury Consultant Support Form.” The SEC attorneys will observe the deliberations from separate rooms (through one-way mirror, or video-audio feed).

C. Anonymously and in writing, poll the mock jurors and solicit written comments after several agreed-upon points in the exercise, including at minimum after a neutral introduction to the case, the SEC opening/ closing, the defense opening/closing, and the SEC rebuttal.

D. After the SEC attorneys’ presentations, provide the mock jurors with brief instructions, and facilitate deliberations for each panel. Each panel should engage in deliberations on its own, generally without significant intervention by contractor’s consultants. The contractor’s consultants (one for each mock jury panel), along with SEC attorneys, shall observe deliberations from an adjoining room. Each panel should be instructed to reach a unanimous verdict if at all possible. Provide each panel with the jury instructions and verdict form (which the contractor shall prepare in consultation with the SEC attorneys).

E. After the deliberations, the contractor’s consultants should question each panel to learn more about their reactions to the SEC and defense arguments.

7. Within fifteen (15) days after the exercise, or within such further time as the

COR may allow, provide the SEC with a detailed, written report on the exercise.

Report deliverables include: the results of the polls taken during the exercise, the demographics of the mock jurors, assessment of the jurors’ reaction to the parties’ facts and arguments, assessment of the jurors’ answers to key questions presented by the case, and the contractor’s or its consultant’s opinions and conclusions. The report is to be written with an eye towards assisting the SEC lawyers in assessing the persuasiveness of relevant facts and arguments, juror types who appear favorably or unfavorably disposed to the SEC case, and juror attitudes to such matters as the SEC, the government, the violations and defenses alleged in the case, the securities industry, or other relevant factors.

5b Jury Consultant Support. The SEC may direct that the contractor provide any of the following:

1. Voir Dire Assistance. Provide assistance to the SEC with preparing voir dire questions, preparing for jury selection, and, if allowed by the Court, developing a juror questionnaire. Contractor will provide the SEC attorneys with appropriate comments, suggestions and feedback as requested.

2. Jury Selection Assistance at Trial. Attend the jury selection portion of the trial and assist the SEC as necessary with the jury selection.

3. Juror research. This includes research on each prospective actual trial juror, if appropriate. Using the court provided completed juror questionnaires, gather appropriate publicly available information about each prospective juror, including:

Personal records (marriage, divorce, voting, bankruptcy, foreclosure)

Business records (liens, licenses, corporation and UCC filings)

Legal records (civil and criminal suits, tax liens, judgments)

Property records (property tax and assessment records)

Academic materials (yearbook and journalism, thesis)

Media mentions (including national and local publications)

Internet appearances (including websites, blogs and online publications) comprehensive report on exploration of social network activity, political activity (including voter history, campaign contributions, and lobbying activity), and military records.

Contractor will provide copies of such materials, and such written summaries or compilations of results as requested by the SEC attorneys.

5c Focus Group Research. The SEC may request contractor to conduct focus group research.

1. Focus group research is conducted in an informal and interactive atmosphere in which focus group members are encouraged to converse candidly about case issues with a litigation consultant. Contractor, in consultation with the SEC attorneys, will select a panel of focus group members recruited from the trial venue, arrange for the focus group session, and working with SEC attorneys, will create a focus group script and present SEC case facts and issues to the focus group in order to obtain feedback from the focus group and assess the effectiveness and persuasiveness of various allegations, facts, arguments, exhibits and demonstrative aids in the case, or to assess credibility and effectiveness of witnesses who are presented by video clips from depositions.

2. The contractor will locate and arrange for an appropriate facility for the focus group, in the same locality where the trial will take place. The facility should include a separate room (with one-way mirror, or audio-visual feed) from which SEC attorneys can observe the focus group session. The contractor will arrange for and provide any necessary audio/visual equipment.

3. The contractor will identify and screen a pool of focus group members from the area where the trial will be held. The contractor will review the candidates and select approximately 15 to 20 persons to participate in the focus group (the SEC attorneys may designate the number of focus group members). This process will include:

A. Screening the focus group candidates for potential conflicts.

B. Selecting focus group members to replicate the locality and demographic traits from which jurors will be selected.

C. Obtaining Non-Disclosure Agreements (NDAs) from all focus group members.

4. Prior to the focus group session, the contractor will learn the case from reviewing appropriate filings or other papers and through discussions with the SEC attorneys.

The contractor will work with the SEC attorneys to develop a series of segmented neutral or balanced presentations of case information to explore key case issues, along with questions to be asked or questionnaires to be completed by focus group members.

5. The SEC will specify whether the focus group session will be for a half or full day.

6. The focus group session will proceed as follows:

D. The contractor’s consultants will make the presentations of relevant facts, issues and other materials for the focus group to consider.

E. Focus group members then have an opportunity to provide immediate feedback and ask questions regarding the information presented.

F. The contractor will use appropriate means to gather and document the responses and opinions of focus group members.

G. The SEC attorneys will observe the session from a separate room

(through one-way mirror, or video-audio feed).

7. Within 15 days after the focus group session, the contractor will provide the SEC attorneys with a written report containing the analysis of the focus groups results and recommendations for theme development and case presentation.

5d Community Attitude Surveys. The SEC may direct that the contractor conduct community attitude surveys.

1. A juror opinion poll (aka, a “community attitude survey” or “CAS”) consists of issuing a telephonic or online survey to a large sample of the juror-eligible population in the trial venue to poll particular attitudes and beliefs, and use them to inform case strategy, particularly for trial. Specifically, the CAS will allow the contractor to (a) assess jurors’ impressions of the parties, (b) determine case-relevant attitudes and beliefs, and (c) test a thumbnail version of the case to garner first-impression reactions.

2. The contractor will conduct the poll and provide a written report of the results within the time specified by the SEC attorney.

6. OTHER DIRECT COSTS:

Historically, ODC’s have included facility fees, expenses associated with travel, equipment fees, juror fees, and advertising fees. ODC’s shall be paid to the contractor on a reimbursable basis, with supporting documentation in the form of receipts.

SECTION II

SPECIAL INSTRUCTIONS APPLICABLE TO THIS REQUIREMENT

An exhaustive list of special requirements will be present in the Request for Proposal. The government is providing advanced notice of IT requirements that will apply.

6001.01 RESTRICTIONS ON USE, DISCLOSURE, AND DUPLICATION OF

CONFIDENTIAL AND NON-PUBLIC INFORMATION (JANUARY 2022)

Confidential or non-public information, for purposes of this clause, includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential or non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non-public information, in whole or in part, outside the Securities and Exchange Commission (SEC) for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

6012.02 SEC SECTION 508 REQUIREMENTS (JANUARY 2022)

a. Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all Information and Communication Technology (ICT) products and services developed, acquired, maintained, and/or used under this contract/order must comply with the Information and Communication Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in FAR 39.203(a). The complete text of Section 508 Final Provisions can be accessed at Section 508 Law.

b. All ICT products must comply with the following requirements. Descriptions of the requirements are viewable at the link Section 508 Standards.

c. Offerors that fail to demonstrate compliance with the above requirements, may be eliminated from further consideration for award.

d. The offeror shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility requirements at 36 CFR 1194 using a Voluntary Product Accessibility Template (VPAT 2.4). Further, the solicitation response must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location).

https://www.govinfo.gov/content/pkg/USCODE-2011-title29/html/USCODE-2011-title29-chap16-subchapV-sec794d.htm https://www.access-board.gov/ https://www.access-board.gov/ https://www.acquisition.gov/content/39203-applicability https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/corrections-to-the-ict-final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.itic.org/policy/accessibility/vpat

Offerors to this solicitation must provide any additional detailed information necessary for determining applicable Section 508 standards conformance. If an offeror claims its products and/or services, including ICT deliverables such as electronic documents, web content or electronic reports, meet applicable Section 508 standards, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility, remediation of the products and/or services to the level of conformance specified in the contract will be the responsibility of the offeror at its expense.

6012.05 PERSONALLY IDENTIFIABLE INFORMATION (PII) IN CONTRACTS TO

DESIGN, DEVELOP, OPERATE, OR MAINTAIN A SYSTEM OF RECORDS (JANUARY

2022)

A Contractor that designs, develops, operates or maintains a system of records on behalf of the agency to accomplish an agency function or otherwise maintains Personally Identifiable Information (PII) in the performance of this contract shall, prior to taking such action, comply with the following requirements:

a) The Contractor shall have established policies and procedures in place to safeguard PII.

The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding PII and reporting suspected or confirmed compromise of PII.

b) The Contractor shall also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 2 or the latest revision, and SEC policies developed to safeguard the confidentially, integrity and availability of SEC data that may contain PII. In support of these requirements, the Contractor shall have:

• policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

• policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

• policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140- 2; and

• policies, procedures, and mechanisms that ensure SEC data transmitted across public networks (i.e., the Internet) by the Contractor, or its employees, agents or subcontractors, are protected using secure communications, including the use of Transport Layer Security (TLS) protocol and the Advanced Encryption Standard (AES) 256 bit encryption algorithm.

c) The Contractor shall make its privacy policies and procedures that describe administrative, physical, and technical safeguards to protect PII available for review by the SEC Office of Information Security within 10 business days of request.

d) The Contractor shall ensure that those individuals adhere to the Contractor’s policies and procedures relating to PII and to SEC-prescribed policies and procedures for the safe handling of SEC PII, including privacy and security training requirements and privacy incident management.

e) The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of PII. Notification must be made to the SEC of a breach as soon as practicable, but no later than twenty-four (24) hours after the Contractor becomes aware of it by contacting the SEC Service Desk at (202)551-4357.

The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Instruction, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

f) Return or Destruction of PII. At any time during the term of this contract at the SEC’s written request or upon the termination or expiration of this contract for any reason, unless otherwise required by law to be retained, the Contractor shall, and shall instruct all authorized personnel to, promptly return to the SEC all copies, whether in written, electronic or other form or media, of PII in its possession or the possession of such authorized personnel, or securely dispose of all such copies, and certify in writing to the SEC that such PII has been returned to SEC or disposed of securely. The destruction of PII shall be performed according to NIST approved methods.

6013.01 FEDERAL REQUIREMENTS, SECURITY, AND ACCESSIBILITY FOR

INFORMATION SYSTEMS (JANUARY 2022)

a. Information Systems Authorization to Operate (ATO): Information systems containing Securities and Exchange Commission (SEC) data or operated on behalf of the SEC are required to have an authorization to operate, based on National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. The security assessment entails a review of minimum security controls, documented in NIST SP 800-53, Revision 5 (and subsequent revisions as finalized by NIST); documentation of a system security plan, based on NIST SP 800-18 updated, Rev.

1; and remediation of weaknesses that are documented in a plan of action and milestone (POA&M) document, as required by Office of Management and Budget (OMB) Memorandum 02-01. The ATO will also have to cover any alternate processing facilities or a subcontractor handling SEC information or operating systems on behalf of the SEC.

b. Additional Federal governance includes but is not limited to the following:

• Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements

• Office of Management and Budget (OMB) Circular A-11, Revised, “Preparation, Submission and Execution of the Budget” (December 2020)

• OMB Circular A-130, Revised, “Managing Information as a Strategic Resource” (July 2016)

• OMB Federal Enterprise Architecture Program Management Office (FEAPMO) Reference Models and Circular A-11 Guidance. www.feapmo.gov.

• Privacy Act of 1974, Public Law 93-579 (5 U.S.C. 552a), as amended

• The E-Government Act of 2002, Public Law 107-347

• OMB Memorandum M-15-01, Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices, October 3, 2014 (and subsequent updates by OMB)

• OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002, September 30, 2003

• OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies

• OMB Federal Risk and Authorization Management Program (FedRAMP) Policy Memo, December 8, 2011

• Federal Information Processing Standard (FIPS) Publication (PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, September 2013

• FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• FIPS PUB 197, Advanced Encryption Standard, November 2001

• FIPS PUB 140-3, Security Requirements for Cryptographic Modules, March 2019

• National Institute for Standards and Technology (NIST), Special Publication (SP) 800- 122, Guide for Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010

• NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December

• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment Sept 2008

• NIST SP 800-100, Information Security Handbook: A Guide for Managers, Oct 2006

• NIST SP 800-95, Guide to Secure Web Services, Aug 2007

• NIST SP 800-92, Guide to Computer Security Log Management, Sep 2006

• NIST SP 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, August 2012

• NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations, September 2020

• NIST SP 800-53A, Revision 4, Guide for Assessing the Security Controls in Federal Information Systems, December 2014

• NIST SP 800-44 Version 2, Guidelines on Securing Public Web Servers, Sep 2007

• NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012

• NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

• NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems, February 2006

• NIST SP 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018

• NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011

• NIST SP 800-137A, Assessing Information Security Continuous Monitoring Programs;

Developing and ISCM Program Assessment, May 2020

c. Encryption Specifications:

1. All encryption modules in the requirement must be FIPS 140-3 certified level 2.

2. All built-in encryption modules are subject to verification by technical support provided by the contractor or as otherwise directed by the COR.

3. Unless the Contractor is using SEC provided devices, all contractor provided mobile devices including, but not limited to laptops, mobile phones, and tablets, must be encrypted with a full-disk (or full-system) encryption capability.

4. All data written to removable media must be encrypted using the SEC’s enterprise removable media encryption capability.

5. All systems and applications must only support Hypertext Transfer Protocol Secure (HTTPS). All Internet-facing systems must also implement HTTP Strict Transport Security (HSTS). Deprecated encryption methods (such as SSLv2 and SSLv3) and encryption ciphers (such as 3DES and RC4) shall not be supported.

d. Cloud-Based Assessment: Any cloud-based components that are not otherwise exempt pursuant to SEC Cloud Service and FedRAMP policy shall be assessed in accordance with FedRAMP requirements and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency.

Additional Federal requirements for cloud computing are documented in NIST SPs 800- 144, 800-145 and 800-146, and in SEC Instruction 6022.00.

e. Security Issue Review: The Contractor shall remediate problems identified during any security testing activities. All significant issues (typically those rated as HIGH and often those rated as MEDIUM) should be resolved before the system is allowed to go into production and handle SEC information. The Contractor shall resolve security audit-related Plan of Action and Milestones (POA&M) items within a reasonable timeframe, based on risk guidance from the designated authorizing official. The Contractor shall document the resolution and provide supporting evidence of changes. The Contractor shall schedule a conference meeting with the Contracting Officer’s Representative (COR), Office of Information Technology (OIT) Security Group staff, and relevant SEC staff to review the state of the POA&M resolutions. The Contractor shall provide the SEC with the number and description of resolved POA&M items identified in the security review along with supporting evidence. SEC’s OIT Security Group may choose to perform additional technical testing to validate resolution.

f. Dedicated Security Personnel Specifications: All system development, maintenance, and support contracts must include an appropriate number of qualified information security personnel to be provided by the Contractor as defined below. These individuals will ensure secure development methodologies are followed and assist the SEC Security Operations Center (SOC) in proactive monitoring of exploits against SEC information systems.

g. All applicable contracts must have at least one dedicated security resource, but Contractors may augment the skills and abilities of security personnel with additional Contractor Personnel.

h. Security personnel must:

1. Prepare written documents and communicate with both business and technical stakeholders;

2. Have experience in and understand security architecture for web applications and infrastructure, and have experience and working knowledge of Security Assessment and Authorization (SA&A) activities in accordance with standards from NIST;

3. Have expertise and experience in performing continuous monitoring activities for systems to include monitoring for security threats, performing access reviews, reviewing and developing mitigations for vulnerability assessment reports, and proposing enhancements for systems security;

4. Have experience supporting security operations centers (or similar capabilities) in systems reviews and potential incident investigations; and

5. Obtain and maintain knowledge of the security architecture and the business purpose of systems under his/her purview.

i. Security Assessment: OIT Security Team with the support of the Contractor

Security Personnel performs Security Assessment and Authorization (SA&A) for a product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST SP 800 series of documents and includes:

• Enumeration - activity aimed at identifying devices and components and cross-referencing with provided inventory lists;

• Vulnerability Scanning - performs network-based vulnerability assessment of customer’s servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un-patched or have out-of-date software security patches;

• Penetration Testing - attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false-positives, and determine the extent of the vulnerability and potential remediation steps that may be taken; and

• Functional Testing - Perform specific tests, examinations, and inspections against NIST SP 800-53 controls not tested by the other activities.

j. The Contractor shall provide the Security Team with: (1) a system demonstration;

(2) test user IDs; (3) Access to the system; (4) System Security Plan (SSP); (5) additional documents as required under the NIST SP 800 series to support Security Assessment & Authorization activities including third party assessments for certain projects/requirements as described in the section below. The Contractor shall provide ongoing support to update the required SA&A documentation. The OIT Security Team provides the test reports. Any cloud-based components will have to be assessed in accordance with FedRAMP and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146, and in SEC Instruction 6022.00.

k. Contractor-provided SA&A for all system development or solutions development projects for contractor-operated systems and solutions:

1. For all Contractor-operated systems or solutions (including Cloud-based systems), the Contractor must obtain from an organization (3PAO) a third party accredited security assessment compliant with standards from NIST (e.g., SP 800-115 Technical Guide to Information Security Testing and Assessment) to verify that security controls are implemented and operating as intended.

2. The assessment is subject to review and approval by the SEC.

l. Documentation Updates: The Contractor shall maintain and update system specifications and/or documentation, including system inventory, to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and commercial off-the shelf (COTS) products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On-line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation.

The documentation shall be available to the COR for review and inspections throughout the system development life cycle (SDLC); updates shall be submitted to the COR for review and approval.

m. System Development Plan (SDP): The Contractor shall develop, maintain, and execute an

SDP which shall include the policies, procedures, standards, instructions, forms, and/or checklists needed to analyze, design, implement, test, and deploy the required application systems. In the SDP, the Contractor shall explain how the Contractor’s corporate system development standards and practices will be applied and discuss its development methodology in detail. The SDP shall also describe the development methodology used by the Contractor. The SDP will be benchmarked against NIST SP800-160 Volume 1 and NIST SP 800-160 Volume 2, Developing Cyber Resilient Systems: A Systems Engineering Approach.

n. Disaster Recovery: The Contractor shall create and implement policies, processes and procedures to address the information system security requirements needed for disaster recovery in the event of a disruption of the information service(s) provided. This includes regular review and test of a disaster recovery plan(s) related to recover recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned and plan updates will be made available to SEC for review within ten (10) working days of a request by SEC. Furthermore, SEC will be provided a point of contact for disaster recovery planning and exercise for the information service(s) provided. The Contractor shall invite participation from the SEC during tests to ensure SEC is able to access the system(s) and service(s) provided.

o. Subcontractors: Subcontractors approved by the SEC under SECI 6004.00 that handle or have access to SEC data in the performance of this contract shall be bound by the same information protection requirements as the Contractor. Like the Contractor, the Subcontractor’s environment will have to undergo security assessment and authorization, including a facility only used for disaster recovery or alternate processing.

p. Mandatory Common Security Configurations: The Contractor must follow the common security configurations as published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, Revision 4, National Checklist Program for IT Products:

Guidelines for Checklist Users and Developers, February 2018, is located at:

https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final

q. Additional Breach Responsibilities:

1. For cloud-based service contracts, incident reporting procedures included in SECI

6022.00 take precedence over those described here.

2. The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC in writing of any event, including the suspected or confirmed breach , that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST SP 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at SOC@sec.gov as soon as possible and without unreasonable delay. The Contractor shall act in accordance with its policies and procedures in the event of any breach shall support the SEC’s investigation and resolution of reported incidents as mailto:SOC@sec.gov requested by the SEC. For purposes of this instruction, a “suspected breach” shall be interpreted liberally to mean any situation in which the loss or unapproved access to such information is deemed a reasonable possibility.

3. In addition to the above, the Contractor shall provide immediate written notification to the SEC as indicated above of any breach or loss of control or any other similar incident regarding “federal contract information” as that term is used in FAR 52.204-

21. The Contractor’s responsibilities include providing assistance as requested by the SEC to ensure that any breach or loss of control of any such information is contained and assistance sufficient to demonstrate that any possible damages suffered by individuals and/or the agency are sufficiently mitigated.

4. The Contractor’s duties under the above two paragraphs include providing unredacted forensic reports documenting the breach, loss of control or similar event sufficient to satisfy the SEC in its sole discretion. The Contractor’s duties under the above two paragraphs survive the termination or conclusion of the contract and remain in place for so long as the contractor continues to retain or have access to PII and other SEC Nonpublic Information or federal contract information related to this contract that has not independently been authorized for release.

r. Security Requirements for Transmitting SEC Non-Public Information, Including PII and Controlled Unclassified Information (CUI) with the Use of Electronic Mail

1. Contractors, subcontractors, and SEC inter/intra agency partners handling electronic SEC Nonpublic Information as defined in SECR 23-2, including personally identifiable information (PII) information in identifiable form (IIF), or CUI, are required to meet the following defined federal requirements when transmitting such data across public networks (i.e., the Internet), storing such data on portable media, or transporting data for backup and recovery purposes.

2. With respect to using electronic mail in the course of their duties under the contract, the contractor shall follow instructions for encryption in accordance with SECI 6017.00.

s. Additionally, contractors shall ensure that all processes, procedures and equipment associated with storing or transmitting SEC Nonpublic Information, including PII or IIF, comply with all laws, regulations, and security mandates as defined by NIST Special Publication (SP) 800-61 Revision 2 as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of data that may contain SEC Nonpublic Information, including PII or IIF. In support of these requirements, the Contractor shall have:

1. Policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

2. Policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

3. Policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140- 3 (validated); and

4. Policies, procedures, and mechanisms that ensure SEC data transmitted between the Contractor and the SEC are protected using encryption compliant with Federal Information Processing Standard 140-3 (validated).

t. At least annually or more frequently upon request by the COR, the Contractor shall provide assessments to the SEC demonstrating that these policies, procedures, and mechanisms continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective. SEC reserves the right to verify stated compliance.

u. Analysis and Evaluation: The Contractor shall fully cooperate with any risk analysis or other evaluation of the Contract conducted by the SEC or its representatives, including any evaluation of the Contract under the SEC’s SA&A Program, including Privacy. Such cooperation shall include, but is not limited to, undergoing an independent audit or risk analysis by the SEC or by a third-party organization approved by the SEC, with such audits to occur not less than once every three (3) years or when there is a significant change to the system. Such evaluations, risk analyses, or audits shall include security tests on the Contractor’s devices and the review of the Contractor’s own policies, procedures, security scans, tests, or reviews, which the Contractor agrees to provide to the SEC or its representatives upon request. The Contractor will make good faith efforts to remediate any vulnerabilities, issues, or negative findings as a result of any such audit, review, or risk analysis.

v. Transportation and Storage: Non-digitized data (such as paper documents) containing SEC data must be transported and stored in a manner designed to prevent the unauthorized loss of a document or disclosure of the information in a document. At a minimum this will require written procedures and policies, evidence that these procedures and policies are being followed, records that contractors are being trained on those policies and procedures, along with a physical assessment by the SEC’s OIT Security of any area where the documents are stored or used.

w. Unauthorized Access Protection: Devices that may contain digitized copies of SEC data

– such as photocopy machines, scanners, and faxes – must be protected against unauthorized access both physical or via computer network or wireless connection and the devices may not be returned, sold, or otherwise disposed of until they have first been scrubbed of SEC data in a manner approved by SEC’s OIT Security or physically destroyed. Duplication of SEC data that is not directly related to SEC assignments through the use of photocopies, scanning, photography, or Web-cameras, is prohibited.

x. Destruction: Material or devices containing SEC data can only be destroyed using an SEC-approved process, which may require the provision of certificates of destruction to the SEC.

y. System Patching and Maintenance: Any information system components must be kept up to date with vendor versions, patches and security updates. No end-of-life or unsupported components may be used on systems that process or store SEC data, regardless of their location.

z. System Authentication: Any information system that utilizes authentication for access must conform to SEC policies on system access. For systems categorized as FIPS 199 MODERATE, this includes supporting multi-factor authentication using PIV credentials.

6020.00 CONTRACTOR WORKFORCE INCLUSION (JANUARY 2022)

a. The Contractor confirms its commitment to equal opportunity in employment and contracting, and that it shall ensure, to the maximum extent possible and consistent with applicable law, the fair inclusion of minorities and women in its workforce.

b. The Contractor shall insert the substance of this contract standard in each subcontract for services awarded for performance of this contract with a dollar value of $100,000 or more.

c. Within ten (10) business days of a written request from the Director of the Commission’s

Office of Minority and Women Inclusion (OMWI Director) or designee, or such longer time as the OMWI Director or designee determines, and without any additional consideration, action or authorization required from the OMWI Director, the Contractor shall provide documentation, satisfactory to the OMWI Director, of the actions it has undertaken (and as applicable, the actions each covered subcontractor under the contract has undertaken) to demonstrate its good faith efforts to comply with the aforementioned provisions.

d. For purposes of this contract, “good faith efforts” shall include actions by the Contractor

(and as applicable, actions by each covered subcontractor under the Service Contract) to identify and, if present, remove barriers to minority and women employment or expansion of employment opportunities for minorities and women within its workforce. Efforts to remove such barriers may include, but are not limited to, recruiting to ensure that applicant pools include minorities and women, providing job-related training, or other activity that could lead to removing such barriers.

e. The documentation requested by the OMWI Director or designee to demonstrate good faith efforts may include, but is not limited to, one or more of the following:

a. The total number of Contractor’s employees, and the number of employees by race, ethnicity, gender, and job title or EEO-1 Report job category (e.g., EEO-1 Report(s));

b. A list of covered subcontract awards for services under the contract, and for each covered subcontract award, the dollar amount, date of award, and the subcontractor’s race, ethnicity, and/or gender ownership status;

c. The contractor’s plan for ensuring the fair inclusion of minorities and women in its workforce, including outreach efforts; and

d. For each covered subcontractor, the documentation specified in paragraphs 1. and 3.

above.

f. Consistent with Section 342(c)(3) of the Dodd-Frank Wall Street Reform and Consumer

Protection Act (the “Dodd-Frank Act”), 12 U.S.C. 5452(c)(3), a Contractor’s failure to demonstrate to the OMWI Director that it has made good faith efforts to include minorities and women in its workforce (and as applicable, failure to demonstrate that its subcontractor(s) has made such good faith efforts) may result in termination of the contract for default after the contractor is provided written notice and an opportunity to cure the failure in accordance with the procedures set forth in FAR Subpart 49.402-3(d), other contractual remedies, referral to the Office of Federal Contract Compliance Programs (OFCCP), or other appropriate action.

g. Compliance with this standard does not necessarily satisfy the requirements of EO 11246, as amended, nor does it preclude OFCCP compliance evaluations and/or enforcement actions undertaken pursuant to that Executive Order, or demonstrate compliance with other FAR clauses that may be included in this contract.

6021.01 RECORDS MANAGEMENT INFORMATION TECHNOLOGY

REQUIREMENTS (JANUARY 2022)

a. All information technology solutions deployed at the SEC must manage electronic records throughout their lifecycle from creation through disposition per statutory and regulatory requirements. To accomplish this requirement, SEC systems and applications must incorporate records management requirements into the design and development as outlined in the National Archives and Records Administration’s (NARA) Universal Electronic Records Management Requirements.

b. Statutory and regulatory requirements for electronic records management in the Federal Government include, but are not limited to:

1. 44 U.S.C. Chapter 31: Records Management by Federal Agencies

2. 36 CFR Chapter XII, Subchapter B

3. NARA Bulletin 2015-04: Metadata Guidance for the Transfer of Permanent

Electronic Records

4. OMB Circular A-130

5. OMB/NARA Memorandum (M-19-21), Transition to…