Attachment 1 to FDIC-LEGAL-2024-002B_Template Legal Support Services Agreement.pdf

SAMPLE

NONPUBLIC//FDIC BUSINESS

AGREEMENT FOR LEGAL SUPPORT SERVICES

This Agreement is entered into this XX day of XXXXX 2024, between the Federal

Deposit Insurance Corporation ("FDIC") and NAME / ADDRESS

EIN: XXX, or as any other DBA (Service Provider or Contractor, hereafter referred to as

("Contractor”). The purpose of this Agreement is to provide services to the FDIC Legal

Division. The parties (FDIC and Contractor) agree to comply with the following terms and conditions:

SALE AND PURCHASE OF SERVICES

1. Contractor agrees to undertake the following services (and, if applicable, sell and deliver goods consequential to those services): DESCRIBE SERVICES (the "Services"). Contractor agrees to complete the specified Services for the FDIC as set forth in the

Statement of Work, engagement letter or other order for

Services. Thereafter, following inspection and acceptance, the FDIC will pay for the tendered Services.

FDIC agrees to pay Contractor in amounts not to exceed those set forth in the accompanying Rate Schedule or any Amendments thereto. The agreed price includes all taxes, insurance, transportation, and delivery charges.

1.1 Contractor will routinely report, as directed by the

assigned FDIC Oversight Attorney (who will be identified in the written request for Services), the status of the Contractor’s work upon request by FDIC at no cost to the FDIC. Contractor must provide FDIC with such assistance and consultations as the FDIC may require in connection with the Services. Contractor will prepare written reports regarding the provision, status, and cost of Services as may be required by the FDIC.

1.2 Upon direction of the FDIC, Contractor will provide

such data and/or reports as the FDIC may require to monitor Contractor's performance for this engagement, without additional charge. Failure to make progress on the Services, as outlined in advance by the Oversight

Attorney or failure to transmit required reports is a material breach of this Agreement.

1.3 Contractor agrees to furnish the Services

ordered or requested under this Agreement.

ACCEPTANCE OF SERVICES

2. All Services provided are subject to review and acceptance by the FDIC.

2.1 If any Services performed hereunder are not in

substantial conformity with the written requirements of this Agreement, the FDIC has the right to require

Contractor to correct the Services in conformity with the requirements of the Agreement within a reasonable time, at no additional cost. When the Services to be performed are of such a nature that the defect cannot be corrected or re- accomplished, reasonably in the time available to FDIC, the FDIC has the right to: (1) require Contractor immediately to take all necessary steps to ensure future performance of the Services in conformity with the requirements of this Agreement;

and (2) reduce the price for the Services to reflect the reduced value of the Services performed. In the event

Contractor fails promptly to correct the Services, or to take necessary steps to ensure future performance of the Services in conformity with the requirements of this Agreement, the FDIC has the right to re-procure the Services by agreement with a third party or otherwise. The FDIC's re-procurement of the Services in conformity with this Agreement's requirements will result in a charge to Contractor of any excess costs occasioned to the FDIC that are directly related to the performance of such Services. In addition, the FDIC may terminate this Agreement for default as provided in the provision of this Agreement entitled

Termination for Default.

CONTRACTOR'S COMPENSATION

3. Contractor agrees that it will not seek payment and that it will not be paid for any excess time or materials expended in completion of its obligation under this

Agreement beyond those Services requested by the

FDIC and described in the Statement of Work, engagement letter or other order for Services, in conformity with the rates set forth in paragraph 1 herein or the Rate Schedule.

cmccarthy Underline cmccarthy Underline cmccarthy Highlight

NONPUBLIC//FDIC BUSINESS

3.1 Contractor will be compensated for the delivered

Services in conformity with the rates described in paragraph 1.

3.2 Contractor acknowledges that the FDIC will not

pay for any of Contractor's discrete or separately itemized Overhead or General & Administrative (G&A) expenses. In addition, amounts added by Contractor to a product or service's base price and thereafter billed to

FDIC are markups. Markups on any supplies or services procured by Contractor are considered additional non-reimbursable overhead or G&A expenses. Contractor agrees that any markups (as defined above) found in

Contractor's invoices after payment by FDIC, its auditors, or staff, will be returned with interest to the

FDIC on FDIC's demand.

3.3 Compensation is limited to payment of the agreed

price for work performed at the specific written direction of the FDIC and agreed upon in writing by

Contractor. Bills submitted following delivery, inspection, and acceptance must comply with FDIC's prescribed format. See, Legal Support Services

Deskbook ("LSS Deskbook"), found at:

https://www.fdic.gov/about/doing-business/legal-support-services-deskbook/index.html.

3.4 The FDIC agrees to timely process for payment all

undisputed invoices submitted by Contractor.

Contractor, however, agrees to submit its invoices in proper order (i.e., consistent with LSS Deskbook’s direction) and with all required supporting documentation for expenses. Contractor agrees to affirm in its final billing that it has delivered all

Services and work product under this Agreement to the

Oversight Attorney.

3.5 Contractor agrees that its fee bills, the

documentation supporting charges in the fee bills, and all invoices paid under this Agreement by the FDIC are subject to audit by the FDIC Office of Inspector

General, the United States General Accounting Office, or review amounting to audit by the FDIC Legal

Division. Contractor agrees to promptly return disallowed overpayments (such as markups on components of services) to the FDIC Legal Division in the amount demanded.

3.6 In order to ensure that Contractor's work is handled in a cost-effective manner and that it is conducted in a manner consistent with the objectives to be achieved, Contractor must assist the FDIC in good faith and without charge in developing an amended price for additional Services requested in writing.

3.7 This Agreement incorporates by reference the

provision referred to as the Anti-Kickback Act of 1986

(41 U.S.C. §§ 51-58), the enforcement of which survives termination of this Agreement.

INVOICE/PAYMENT BY ELECTRONIC FUNDS

TRANSFER (EFT)

4. Contractor must submit an original invoice upon completion, delivery, and acceptance of the Services to the FDIC or, on a monthly basis, within ten (10) business days after the end of the month. All invoices must be sent to the designated Information Specialist and include Contractor's name, address, telephone number, tax identification number, an Agreement

(Contract) number (if any), an itemized and detailed description of the Services performed, an invoice number, and the signature of

Contractor’s authorized representative. Contractor is required, as a condition to any payment under this

Agreement, to provide the FDIC with the information required to make payment by Electronic Funds Transfer

(“EFT”) as described in the following provision.

4.1 FDIC procedure is to make payments under this

Agreement by EFT. Accordingly, unless Contractor certifies to FDIC's payment office that the Contractor does not have an account with a financial institution or an authorized payment agent, Contractor must provide the information required on the Vendor Information for

Automatic Deposit of Payment Form and Substitute W-9

(see, Schedule B). In the exceptional case in which the

Contractor does not have an account with a financial institution, the FDIC will also forward the associated payment information by EFT. The FDIC may make payment by EFT through either an Automated Clearing

House subject to the banking laws of the United States or the Federal Reserve Wire Transfer System at the FDIC's option. The Contractor must supply this data for this or multiple Agreements. Until the FDIC receives the correct EFT information, any invoice submitted is an improper invoice, and payment may be delayed. FDIC invoice processing time is approximately thirty (30) days after receipt of a correct and proper Invoice Package.

The FDIC generally does not make payments in less than thirty days.

TERMINATION FOR CONVENIENCE OF

THE FDIC

5. In its sole discretion, the FDIC may terminate this

Agreement, in whole or in part, at any time if the

Oversight Attorney determines that termination is in the best interests of the FDIC. The FDIC will terminate this Agreement by delivering to Contractor a notice of termination for the convenience of the FDIC, specifying the extent of termination and the effective date. The notice of termination may also contain a stop work order. After receipt of the notice, Contractor must complete performance of work not terminated and take whatever action is necessary for an orderly and timely discontinuation of the terminated work and cooperate with any follow-on contractors.

Contractor must timely deliver to the FDIC, completed or partially completed, any transcripts, videos, plans, drawings, information, data, materials, or equipment https://www.fdic.gov/about/doing-business/legal-support-services-deskbook/index.html https://www.fdic.gov/about/doing-business/legal-support-services-deskbook/index.html https://www.fdic.gov/about/doing-business/legal-support-services-deskbook/index.html

NONPUBLIC//FDIC BUSINESS

that, if the Agreement had been completed, would have been required to be furnished to the FDIC.

TERMINATION FOR DEFAULT

6. Time is of the essence in Contractor’s performance of its duties under this Agreement, and the FDIC may, subject to paragraphs 6.1 and 6.2 below, by written notice of default to Contractor, terminate this Agreement in whole or in part if Contractor fails to:

(a) Deliver the supplies or perform the

Services within the time specified in this

Agreement or any extension, or in any Statement of Work or engagement letter issued in connection with a specific request for Services;

(b) Make sufficient progress to ensure performance of this Agreement (but see subparagraph 6.1 below); or

(c) Perform any of the other provisions of this Agreement (but see subparagraph 6.1 below).

6.1 The FDIC may terminate this Agreement under

subdivisions 6(b) and 6(c) above if Contractor does not cure the default within ten (10) days (or more if authorized in writing by the Oversight Attorney) after receipt of the notice of default.

6.2 If the FDIC terminates this Agreement in whole or

in part as provided in paragraph 6 of this Agreement, the

FDIC may acquire, under the terms and in the manner the Oversight Attorney considers appropriate, supplies or services similar to those terminated, and Contractor will be liable to the FDIC for any excess costs for those supplies or services. However, Contractor must continue the performance of the work under this

Agreement which has not been terminated.

6.3 Except for defaults of subcontractors at any tier, Contractor will not be liable for any excess costs described in paragraph 6.2 above if the failure to perform this Agreement arises from causes beyond the control and without the fault or negligence of

Contractor.

6.4 If the failure to perform is caused by the default of

a subcontractor at any tier, and if the cause of the default is beyond the control of both Contractor and the subcontractor, and without the fault or negligence of either, Contractor will not be liable for any excess costs for failure to perform, unless the subcontracted supplies or services were obtainable from other sources in sufficient time for Contractor to meet the required delivery schedule. At the conclusion or termination of the matter, submit the final Invoice Package within 90 days of the matter’s conclusion or termination (refer to

Chapter 7 and Chapter 8).

1 Under no circumstances is an Ancillary Services Contractor permitted to process or host FDIC information under this

Agreement. The security requirements for processing and hosting of FDIC information are more stringent than those contained herein, and require the FDIC and the Contractor to

NOTICE AND CERTIFICATION OF CLAIMS

7. Contractor agrees that it will provide written notice to the Oversight Attorney of any claim it may have against the FDIC arising under or in connection with this Agreement and that it will refrain from filing suit with respect to any such claim for a period of sixty (60) days following FDIC’s receipt of such notice.

Contractor agrees that it will promptly meet with the

FDIC after providing such notice in a good faith effort to resolve the claim and that the written notice of the claim will be accompanied by a certificate signed by an officer or general partner or senior official of Contractor affirming that: (a) The claim is made in good faith; (b)

Supporting data are accurate and complete to the best of

Contractor’s knowledge and belief; and (c) The amount requested accurately reflects the Agreement adjustment for which Contractor believes the FDIC is liable. This clause survives Agreement termination.

CONFIDENTIALITY

8. Contractor agrees to comply with the regulations set forth at 12 C.F.R. Part 366 https://www.ecfr.gov/current/title-12/chapter-

III/subchapter-B/part-366.

Contractor further certifies that it is in compliance with applicable laws, regulations, and standards relating to the security of electronically stored information that may contain personally identifiable or business sensitive information obtained from third parties. The current

FDIC standard for Legal Support Services is NIST 800-

171.

9.0 SECURITY OF INFORMATION

TECHNOLOGY (IT) SYSTEMS AND

FDIC INFORMATION

9.1 Security and Privacy Compliance for FDIC

Information Accessed by the Contractor. This clause applies to all awards where the Ancillary Services

Contractor is provided with credentials to access

FDIC information (electronic or paper form) that is hosted in an FDIC-controlled facility or by another

FDIC Contractor.1

(a) All products and services provided by the

Contractor must comply with all effective FDIC information security and privacy directives, policies and requirements, such as FDIC Directive 1360.9, Protecting Sensitive Information, and The Privacy Act of 1974 (5 U.S.C. § 552a), as amended.

(b) Protection of Information. The Contractor agrees to implement adequate administrative, enter into a separate agreement. Processing or hosting FDIC information would be a violation of this Agreement and considered a material breach.

http://www.ecfr.gov/current/title-12/chapter-http://www.ecfr.gov/current/title-12/chapter-

NONPUBLIC//FDIC BUSINESS

technical, physical and procedural security controls to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification.

The collection, use, transmission, and disclosure of

FDIC information must comply with all federal and state privacy laws and FDIC rules and regulations regarding privacy. The Contractor will not use any

FDIC information except to the extent necessary to carry out its obligations under the Agreement.

Contractor will not disclose FDIC information to any third party unless disclosure is authorized in the

Agreement or Contractor obtains the prior written consent of the Oversight Attorney and/or LSG

Project Manager Contractor must provide the necessary information for FDIC to complete privacy impact assessments, security assessments, risk assessments, security plans, contingency plans, and other security and privacy artifacts as required.

Contractors hosting data, however limited, must conform to the requirements set forth in Section

9.1(d) of this Agreement. Contractors not hosting

FDIC data must meet all security requirements set forth in this Agreement with the exception of the requirement to obtain third-party assessment certification, as outlined in Section 9.1(d) below.

(c) Control of Information. All FDIC information remains the property of FDIC. At any time, upon request of the Oversight Attorney or other FDIC delegated authority, Contractor must promptly retrieve and deliver to FDIC all FDIC information, or any portion of information as specified by FDIC, under the Contractor’s control and/or in its possession. Contractor must provide the information in a format and on media as agreed to by both parties. The Contractor must ensure that its personnel and any third parties will only access, transmit, maintain, store, host, use or disclose any

Confidential or Sensitive Information within the

United States. Upon completion or termination of the Agreement, or at any time the Oversight Attorney requests it in writing, Contractor agrees to return, erase, or destroy all FDIC information on any media under its control or in its possession.

(d) Security Plan. The Contractor must implement and maintain the approved IT Security Plan, Physical/Environmental Security Plan, and/or the approved security audit or review, which is hereby incorporated into the Agreement, for the duration of the

Agreement. The Contractor’s proposed Security Plan, must include, but is not limited to, the following provisions and any amendments or replacements to:

(i) Definitions.

“Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” or “FDIC Data” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the

Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(ii) Safeguarding requirements and procedures. The Contractor must apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems must include, at a minimum, the following security controls:

1. Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

2. Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

3. Verify and control/limit connections to and use of external information systems.

4. Control information posted or processed on publicly accessible information systems.

5. Identify information system users, processes acting on behalf of users, or devices.

6. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

7. Sanitize or destroy information system media containing Federal Contract

Information before disposal or release for reuse.

8. Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

9. Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

10. Monitor, control, and protect organizational communications (i.e., information transmitted

NONPUBLIC//FDIC BUSINESS

or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

11. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

12. Identify, report, and correct information and information system flaws in a timely manner.

13. Provide protection from malicious code at appropriate locations within organizational information systems.

14. Update malicious code protection mechanisms when new releases are available.

15. Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(iii) Technical Security Assessment

In addition, a Technical Security Assessment

(“TSA”)(e.g., penetration testing) must be performed by an Independent Verification & Validation (“IV&V”) contractor for any Contractor operating an internet interface or information system on behalf of the FDIC.

The TSA must, at a minimum, include the Open Web

Application Security Project (“OWASP”) top 10 with

Common Vulnerability Scoring System (“CVSS”) scoring2. The Contractor must remediate all critical or high findings, provide and maintain a Plan of Action and

Milestones (POA&M) for all moderate and low findings within 30 days, and remediate moderate findings within

90 days.

(iv) Remediation of Critical or High Findings

If a critical or high finding is discovered during the course of the performance of the Agreement, remediation and closure must take place within 30 days. If a moderate or low finding is discovered during the course of the performance of the Agreement, the

Contractor must provide and maintain a POA&M within thirty (30) days, and data remediation and closure for all medium/moderate risk findings within 90 days.

(v) Must Provide an Updated Security Plan Annually or Earlier

The Contractor must demonstrate, at least annually, its continued compliance with the controls, processes and procedures described in the SSP (or the security audit or review), and any amendments or replacements of

NIST, FIPS, or other security standards as set forth in

Paragraph 9.1(a) of this Legal Services Agreement throughout the term of the Agreement, as FDIC may

2 The OWASP top 10 can be found at:

https://owasp.org/www-project-top-ten/ The CVSS scoring system can be found at: https://www.first.org/cvss/user-guide.

request. The Contractor must provide an updated SSP and a TSA by an IV&V at least annually, however whenever there is a major system upgrade or modification a revised SSP must be provided as set forth above.

(vi) Testing and Remediation

The IV&V vendor must retest any remedial changes implemented to cure the IV&V’s findings to confirm that the remediations have, in fact, eliminated the original finding. No finding is resolved until closed by the IV&V.

All testing, retesting, and/or remediation is at the

Contractor’s sole expense.

(e) Inspections/Assessments. The Contractor agrees to allow and cooperate with both scheduled and unannounced inspections and assessments of its facilities, Employees, hardware, software, and its security and privacy practices by the FDIC information technology or Legal staff, the FDIC Inspector General, or the U.S. Government Accountability Office (GAO).

These inspections may be conducted either by phone, electronically or in-person, on both a pre-award basis and throughout the term of the Agreement or Task Order, to ensure and verify compliance with FDIC IT security and privacy requirements.

(f) Monitoring and Incident Response. The Contractor must monitor its facility and premises for security and privacy incidents, and provide the capability to respond to and resolve them effectively and in a timely manner.

Contractor must immediately report all security and privacy incidents that involve FDIC information to

FDIC’s Computer Security Incident Response Team

(“CSIRT”) and the Oversight Attorney.

(g) Contact Information. The Contractor agrees to provide a point of contact (name, telephone number, e-mail address) with whom the Oversight Attorney, other

FDIC delegated authority or FDIC Information Security

/Privacy Staff, may communicate throughout the duration of the Agreement about information security and privacy issues. This point of contact must be at the

CTO/CIO level, or another level of similar technical qualification.

(h) Subcontracts. Contractor must include Section 9.1 of this Agreement in all its subcontracts to which the conditions and requirements described in Section 9.1 would apply. Contractor also must require its subcontractors (first-tier) to include Section 9.1 in any of their subcontracts (second-tier) to which the conditions and requirements of Section 9.1 would apply.

9.2 Prohibition on Use of Certain Hardware, Software, and Services

Contact your oversight attorney if the links in this footnote are no longer active.

https://owasp.org/www-project-top-ten/ https://www.first.org/cvss/user-guide

NONPUBLIC//FDIC BUSINESS

9.2.1 Kaspersky Lab and other covered entities:

(a) Definitions. As used in this clause—

“Covered article” means any hardware, software, or service that–

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity. “Covered entity” means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky

Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the

National Defense Authorization Act for Fiscal Year

2018 (Pub. L. 115-91) prohibits Government use of any covered article. Contractor is prohibited from—

(1) Providing any covered article that the FDIC will use; and

(2) Using any covered article in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event Contractor identifies a covered article provided to the FDIC during contract performance, or Contractor is notified of such by a subcontractor at any tier or any other source, Contractor must report, in writing, to the FDIC Contact identified in Clause 16 below. For Basic Legal Support Service

Agreements, Ordering Agreements (BOAs), Receivership BOAs (RBOAs) and Blanket Purchase

Agreements (BPAs), Contractor also must report to the

Contracting Officer for the BOA/RBOA/BPA, and the

Contracting Officer(s) for any affected order.

(2) Contractor must report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: the contract number;

the order number(s), if applicable; supplier name;

brand; model number (Original Equipment

Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, Contractor agrees to describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts to prevent future use or submission of covered articles.

(d) Subcontracts. Contractor must insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

9.2.2 Certain Telecommunications and Video

Surveillance Services or Equipment

(a) Definitions. As used in this clause—

“Backhaul” means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network).

Backhaul can be wireless (e.g., microwave) or wired

(e.g., fiber optic, coaxial cable, Ethernet).

“Covered foreign country” means The People's

Republic of China.

“Covered telecommunications equipment or services” means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE

Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of

Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications

Corporation, Hangzhou Hikvision Digital Technology

Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the

Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

“Critical technology” means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the

International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal

Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the

Export Administration Regulations under subchapter

C of chapter VII of title 15, Code of Federal

Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of

Federal Regulations (relating to assistance to foreign

NONPUBLIC//FDIC BUSINESS

atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of

Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title

9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export

Control Reform Act of 2018 (50 U.S.C. 4817).

“Interconnection arrangements” means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

“Reasonable inquiry” means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third- party audit.

“Roaming” means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

“Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain

National Defense Authorization Act for Fiscal Year

2019 (Pub. L. 115-232) prohibits the head of an executive agency from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to FDIC any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FDIC Procedures, Guidance, and Information (PGI) 1.214(b)(iv).

(2) Section 889(a)(1)(B) of the John S. McCain

National Defense Authorization Act for Fiscal Year

2019 (Pub. L. 115-232) prohibits the head of an executive agency from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FDIC PGI 1.214(b)(iv).

This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a

FDIC contract.

(c) Exceptions. This clause does not prohibit contractors from providing—

(1) A service that connects to the facilities of a third- party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement:

(1) In the event Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor must report the information in paragraph (d)(2) of this clause to the FDIC Contact identified in Clause 16 below.

(2) Contractor must report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within one business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known);

supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause:

Any further available information about mitigation actions undertaken or recommended. In addition, the

Contractor must describe in writing the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. Contractor agrees to insert the substance of this clause, including this paragraph (e), and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

9.3 Background Investigations.

9.3.1 At the discretion of the FDIC, any Contractor

Employees or subcontractor Employees with access to

FDIC information under this Agreement may be requested to undergo a background investigation, in accordance with FDIC Circular 1610.2 (Personnel Security Policy

NONPUBLIC//FDIC BUSINESS

and Procedures for FDIC Contractors) located here. The extent of the background investigation conducted will be in direct relation to the risk level assigned in 9.3.1.1.

below.

9.3.1.1 The risk level designations for functional areas

under this Agreement are as follows: Employees with system administration responsibilities are designated as

HIGH risk. All other functional categories are designated as MODERATE. Employees performing functional responsibilities designated as HIGH must be

United States Citizens. Employees performing functional responsibilities designated at the MODERATE or LOW risk levels must be either United States Citizens or

Lawful Permanent Residents of the United States.

9.3.2 Where an FDIC identification/access badge is

required to perform the work and prior to commencing work, the FDIC requires Contractor Employees and subcontractor Employees to undergo both a fingerprint and a credit check. In addition, Contractor Employees and subcontractor Employees may be subject to an

Office of Personnel Management (“OPM”) background investigation, based on the risk level assigned to the functional responsibilities or to the labor categories. No

Contractor Employees or subcontractor Employees, including any new Employees added at any time during the term of the Agreement, may begin work until the fingerprint and the credit check processes are complete and FDIC has rendered a favorable determination, and the paperwork for any further OPM background investigations has been submitted.

9.3.3 Contractor must provide the Oversight Attorney

and/or LSG Project Manager with the following documents for all Contractor Employees and subcontractor Employees subject to the background investigation requirement:

1) An executed Background

Investigation Questionnaire for Contractor

Personnel and Subcontractors (FDIC

1600/04);

2) An executed Notice and Authorization

Pertaining to Consumer Reports (FDIC 1600/10);

3) A Fingerprint Card (the Contractor must submit FD Form 258 Fingerprint Card or coordinate with the Oversight Attorney to schedule fingerprinting by the Security and Emergency Preparedness Section of FDIC.); and

4) FDIC Forms 1600/04 and 1600/10 are available here.

9.3.4 In addition, where the assigned risk level of the

functional responsibilities or labor categories mandates background investigations by the OPM, the

Contractor must provide the Oversight Attorney with the completed paperwork for Contractor Employees and subcontractor Employees needed to initiate an

OPM background investigation. The Oversight

Attorney will notify the Contractor of the method by which to submit the paperwork - either manually, using Standard Form 85P Questionnaire for Public

Trust Positions, or via e-QIP (the OPM Electronic-

Questionnaires-for-Investigations-Processing system).

If any Contractor Employees or subcontractor

Employees have received a background investigation-clearance from another federal agency within the last 5 years, at the same or a higher risk level as that assigned, the Contractor may also provide the following to the OPM: A Certificate of Investigation or a Letter of Consent or other documentation from a government agency, verifying the date of the investigation, the investigating agency, the type of investigation completed, and the clearance given.

9.3.5 Any Contractor Employees or subcontractor

Employees, whose background investigation reveals an adverse finding, may be excluded from working on the Agreement at the discretion of the Legal Division.

Contractor is obligated to replace any Employees so excluded with Employees acceptable to FDIC.

Replacement of Employees must be made at no additional cost to the FDIC and without relieving

Contractor of performance and delivery requirements of the Agreement.

9.3.6 Contractor must comply with Homeland

Security Presidential Directive-12 (HSPD-12) and

Federal Information Processing Standard Publication

201 (FIPS 201) entitled “Personal Identification

Verification for Federal Employees and Contractors.”

Contractor Employees and subcontractor Employees must present two forms of identification in original form prior to badge issuance; at least one document must be a valid State or federal government-issued picture ID. Acceptable forms of identification are listed in Form I-9, OMB No. 1615-0047, “Employment

Eligibility Verification.” In addition, Contractor

Employees and subcontractor Employees must appear in person at least once before an FDIC official who is responsible for checking the identification documents.

FDIC will not issue identification/access badges to

Contractor Employees and subcontractor personnel until they establish proof-of-identity satisfactory to the

FDIC.

9.3.7 Subcontracts. Contractor must include Section

9.2 in all its subcontracts to which the conditions and requirements described in this clause would apply.

Contractor also must require its subcontractors (first-tier) to include Section 9.2 in any of their subcontracts

(second- tier) to which the conditions and requirements of this clause would apply.

9.4 Protecting Sensitive Information

(a) FDIC Circular 1360.9 defines Sensitive

Information as any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the interests of FDIC in carrying out its programs or the privacy to which individuals are https://www.fdic.gov/buying/goods/formsdocuments/1610-2.pdf http://www.fdic.gov/buying/goods/acquisition/index.html

NONPUBLIC//FDIC BUSINESS

entitled. It includes, but not exclusively, the following:

(1) Information that is exempt from disclosure under the Freedom of Information Act, such as trade secrets and commercial or financial information, information compiled for law enforcement purposes, Employees and medical files, and information contained in bank examination reports;

(2) Information under the control of FDIC contained in a Privacy Act system of records that is retrieved using an individual’s name or by other criteria that identifies an individual;

(3) Personally Identifiable Information (“PII”) about individuals maintained by FDIC that if released for unauthorized use may result in financial or personal damage to the individual to whom such information relates. Sensitive PII, a subset of PII, may be comprised of a single item of information (e.g., Social Security

Number, or “SSN”) or a combination of two or more items (e.g., full name along with, financial, medical, criminal, or employment information). Sensitive PII presents the highest risk of being misused for identity theft or fraud;

(4) Information about insurance assessments, resolution and receivership activities, as well as enforcement, legal, and contracting activities; and

(5) Information related to information technology specific to the FDIC that could be misused by malicious entities (e.g., internal IP addresses, server names, firewall rules, encryption and authentication mechanisms, and network architecture pertaining to

FDIC).

(b) Protecting Sensitive Information. Information furnished to the Contractor may contain Sensitive

Information, and Contractor, all Contractor Employees, subcontractors and subcontractor Employees must protect all Information in accordance with the standards for Sensitive Information set forth in FDIC Circular

1360.9, unless otherwise authorized by the Oversight

Attorney or LSG Project Manager. All Sensitive

Information, whether in electronic or paper form, remains the property of FDIC.

(c) Confidentiality Agreement. As noted in Paragraphs

8.1 & 8.2 above, Contractor acknowledges that it will have access to Confidential Information and that it will take the necessary steps to protect and maintain

Confidential Information. Accordingly, an authorized representative of the Contractor, its subcontractors and consultants, and all Employees (key personnel and non-key personnel) who will have access to FDIC facilities, networks and/or information systems, or sensitive information (whether in hardcopy or electronic form) must execute confidentiality agreements. FDIC Form

3700/46, Confidentiality Agreement (for

Contractors/Subcontractors/Consultants) and FDIC

Form 3700/46A, Confidentiality Agreement (for

Contractor/Subcontractor/Consultant Personnel) are included as Attachments D to E to this Agreement.

The 3700/46 forms must be signed by the Contractor, and each subcontractor or consultant, and submitted at the time of award to the Oversight Attorney with the signed Agreement. Post-award, Contractor must also execute these forms for any new Employees employed to work on this Agreement. For Basic Ordering

Agreements (BOAs), it is acceptable for the 3700/46 forms to be executed by the Contractor, subcontractors and consultants at the BOA level, thereby being applicable to all Task Orders issued thereunder.

Contractor must submit the 3700/46A forms executed by Employees to FDIC no later than five (5) business days after starting performance and prior to receiving any Sensitive Information. The Contractor must submit the 3700/46A forms to the Oversight Attorney. The

FDIC will not permit key personnel or non-key personnel who are required to sign a confidentiality agreement, and do not sign, to perform work on any

Task Orders issued under the Agreement.

(d) System or Data Breach and/or Loss of, or Loss of

Access to, Data. Whether on system servers/network switches, in the cloud (hosted on the Contractor’s system or by another vendor or agent on the

Contractor’s behalf), on tablets/laptops/desktops, and/or removable media of any kind, if the Contractor has an IT system or data breach, and/or loses agency data, or loses access to agency data, related to or arising out of a cybersecurity incident or ransomware attack, Contractor must immediately report the incident to the Oversight Attorney. Such an event constitutes a material default of the Agreement.

(e) Subcontracts. Contractor must include Section 9.3 in all its subcontracts to which the conditions and requirements described in Section 9.3 would apply.

Contractor also must require its subcontractors (first-tier) to include Section 9.3 in any of their subcontracts

(second- tier) to which the conditions and requirements of Section

9.3 would apply.

TERMS AND CONDITIONS INCORPORATED

BY REFERENCE

10. Contractor agrees to follow all policies, requirements, practices, and procedures set forth in the LSS Deskbook previously referred to in paragraph

3. The terms and conditions in those documents, as from time to time amended, modified or changed, are incorporated herein by reference. The provisions of this Agreement, however, have priority in interpretation over contrary provisions asserted in the

LSS Deskbook or in any incorporated materials supplied by Contractor. In case of a conflict, the provisions of this Agreement are controlling.

NONPUBLIC//FDIC BUSINESS

10.1 This Agreement and all agreements and

documents contemplated or stated to be incorporated herein constitute one Agreement and are interdependent upon each other in all respects.

10.2 All exhibits and schedules attached hereto are

incorporated by reference and are made part of this

Agreement for all purposes as if fully set forth herein.

WHISTLEBLOWER PROTECTIONS

11.1 This contract and Contractor employees working

on this contract, as well as all subcontractors are subject to the whistleblower rights and remedies established at

41 U.S.C. 4712.

11.2 Within 30 days of receipt of the legal referral or

contract, Outside Counsel and its subcontractors must distribute the informational document, “Whistleblower

Information for Employees of FDIC Contractors, Subcontractors, or Personal Services Contractors” to their employees performing work in support of the goods and services delivered under the contract

(https://www.fdic.gov/about/doing-business/acquisition/whistleblower-information.pdf). By agreeing to the terms and conditions of the legal referral or contract, Outside Counsel acknowledges receipt of this requirement, in accord with 41 U.S.C. § 4712, and commits to its distribution.

11.3 Contractor must insert this subsection 11, including this paragraph 11.3, in all contracts over

$250,000.

WARRANTIES, REPRESENTATIONS,

AND CERTIFICATIONS

12. Contractor warrants that it currently possesses all necessary licenses, permits, and approvals required in the applicable jurisdictions to perform this Agreement and has the authority to execute this Agreement.

12.1 Contractor represents, warrants, and covenants that:

(i) Contractor has no conflict with the interests of the

FDIC that has not been disclosed in writing to the FDIC;

(ii) Contractor will advise the Oversight Attorney immediately of all conflicts that develop in the future;

(iii) each person who provides services to the FDIC under this Agreement has reviewed, understands, and agrees to act strictly in compliance with all provisions, requirements, and policies (including statutory and regulatory provisions) identified in the LSS Deskbook.

12.2 Contractor agrees that the FDIC may require

Contractor to execute additional warranties, representations, and certifications. When Contractor executes additional warranties, representations, and certifications, the executed document will be incorporated by reference into this Agreement.

BYRD AMENDMENT

13. Contractor agrees to comply with the provisions of

31 U.S.C. §1352 (Byrd Amendment) and the implementing regulations at 24 C.F.R. Part 87.

Contractor agrees that it will complete either the attached

Certification or the Disclosure Form, if applicable.

INSURANCE AND BONDS

14. Contractor agrees to maintain at all times during the period of performance of this Agreement, at its own expense, insurance, such as comprehensive, liability, and worker's compensation, as may be necessary to protect the interests of the FDIC and Contractor. If this Agreement requires Contractor or its agent(s) to handle FDIC funds, Contractor agrees to undertake and maintain reasonable coverage under a fidelity bond to cover potential losses to the FDIC.