Attachment 3-Contract Terms-Conditions v3.docx

ATTACHMENT

Contract Terms and Conditions

SEC Agency Clauses

5003.05 SUBMISSION OF INVOICES - DELPHI EINVOICING SYSTEM (JANUARY 2022)

a. The Securities and Exchange Commission (SEC) will only accept electronic invoices submitted through the Delphi eInvoicing system on a monthly (30-day) cycle.

b. Payment system registration. All persons accessing the Delphi eInvoicing web-portal will be required to have their own unique user Delphi eInvoicing ID and password and be credentialed through login.gov.

(1) Electronic authentication. See www.login.gov for instructions. Click on the following link for instructions on establishing a login.gov account: https://login.gov/help/creating-an-account/how-do-i-create-an-account- with-logingov/.

(2) To create a login.gov account, the user will need a valid email address and a working phone number. The user will create a password and then login.gov will reply with an email confirming the email address.

(3) In order to set up a new user account or make changes to existing vendor Delphi eInvoice users who will submit invoices through the eInvoicing web-portal for payment and tracking purposes, notify iSupplier@sec.gov and include the contract/order number, the user's full name, valid email address (group mailboxes are not recommended), and current phone number of all vendor users. Vendor users will be notified via e-mail when the account is created. The vendor user will be provided detailed instructions for logging into their Delphi eInvoicing account.

(4) Training on Delphi. To facilitate use of DELPHI, comprehensive user information is available at http://einvoice.esc.gov

(5) Account Management. Vendors are responsible to contact the Delphi Help Desk when their firm's points of contacts will no longer be submitting invoices so they can be removed from the system. Instructions for contacting the Delphi Help Desk can be found at http://einvoice.esc.gov

c. Contractors are cautioned against submitting an invoice prior to goods and services being received/accepted. Invoices submitted prematurely may be rejected. Software license maintenance and subscriptions may be invoiced at the beginning of the contract period of performance.

d. The SEC's Delphi eInvoicing system is managed by the Enterprise Services Center (ESC). In order to receive payment and in accordance with the Prompt Payment Act, all invoices submitted as attachments in the Delphi eInvoicing web-portal shall contain the following:

(1) Company logo or letterhead

(2) Company name and payment address

(3) Company Point of Contact (POC) for the invoice with phone and e-mail

(4) Invoice number and invoice date

(5) Billing period

(6) SEC Contract number

(7) Task/Delivery Order number (if applicable)

(8) SEC Contracting Officer's Representative (COR name)

(9) Amount billed (by CLIN), current and cumulative

(10) Total amount billed this period

(11) Cumulative total billed to date

(12) Brief Description of Services Performed - General description only

e. If the contract includes allowances for travel, all invoices which include charges pertaining to travel expenses will catalog a breakdown of reimbursable expenses with the appropriate receipts to substantiate the travel expenses.

5004.00 APPOINTMENT OF CONTRACTING OFFICER'S REPRESENTATIVE (COR) (JANUARY 2022)

a. A Securities and Exchange Commission COR has been designated for administration and information relating to this contract. The SEC may also assign one or more Alternate CORs for this contract. The COR may not re-delegate his or her authority; only the CO has this authority. A COR Appointment Letter (and ACOR Appointment Letter if applicable) detailing the designations will be e-mailed to the contractor.

b. The COR will manage the contract in coordination with the CO and within the terms of the contract. The COR's responsibilities include reviewing invoices and charges by the Contractor, informing the CO of areas where exceptions are taken, and accepting or rejecting invoices in the SEC's financial system. The COR shall be the primary point of contact responsible for communicating administrative guidance for on-boarding and off-boarding of Contractor Personnel, mandatory trainings, government closures, and other events as necessary. Unless otherwise specified in this contract, inspection and acceptance of supplies and/or services to be furnished under this contract will be performed by the COR.

c. Only the CO has the authority to change the terms and conditions of this contract. The COR may request a contract modification, but the CO will make the final determination. The COR may not agree to or issue a change to the contract terms and conditions. In the event the Contractor effects changes to the contract at the direction of any person other than the CO, the changes will be considered to have been made without any authority and no adjustments will be made to the contract.

6001.00 SEC NON-DISCLOSURE REQUIREMENTS AND AGREEMENTS (JANUARY

2022)

a. Required non-disclosure agreements are attached and must be completed and returned to the Contracting Officer before starting work under this contract. Note: Electronic and digital signatures are prohibited.

b. Provisions of the SEC Regulation Concerning Conduct of Members and Employees and Former Members and Employees of the Commission expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. See 17 C.F .R. § 200.7353(b)(1) & (b)(2). The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by the provisions of Sections 200.735- 3(b)(1) and 200.735-3(b)(2) of the SEC's Regulation Concerning Conduct and the terms set forth in the attached non-disclosure agreements (Attachments 1& 2). For purposes of this clause, "confidential or non- public information," is defined as information generated by or in the possession of the SEC that is commercially valuable, trade secret, market sensitive, proprietary, related to an SEC enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed confidential or non-public by an SEC division director or office head, and is not otherwise available to the public.

c. An officer or executive authorized to bind the Contractor shall execute the non-disclosure agreement (Attachment 1) on behalf of the Contractor and return it to the Contracting Officer prior to the Contractor commencing work on the contract. The Contractor shall submit to the Contracting Officer a list of its employees, agents, and subcontractors that will be authorized access to SEC information by virtue of performing the requirements set forth in this contract. Each person identified on the list shall then sign the non-disclosure agreement on behalf of themselves (Attachment 2) and submit it to the Contracting Officer before commencing work on the contract.

d. The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to the terms of the non-disclosure agreement, protecting all confidential or non-public information, and to not divulge to any unauthorized person. Assignment of staff who has not executed the non- disclosure agreement or failure to adhere to this statement shall result in action by the Contracting Officer, as deemed appropriate. Violation of this clause or the attached non-disclosure agreements by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or civil suits and/or criminal prosecution.

6001.01 RESTRICTIONS ON USE, DISCLOSURE, AND DUPLICATION OF CONFIDENTIAL AND NON-PUBLIC INFORMATION (JANUARY 2022) Confidential or non-public information, for purposes of this clause, includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract.

Unless otherwise specified, confidential or non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non- public information, in whole or in part, outside the Securities and Exchange Commission (SEC) for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

6002.00 TYPE OF CONTRACT (JANUARY 2022)

This is a Indefinite Delivery/Indefinite Quantity (IDIQ) contract, which task orders are issued on a firm-fixed price basis type contract/agreement.

6004.00 APPROVAL OF SUBCONTRACTS (JANUARY 2022)

The Contractor shall not enter into a contractual agreement with any party to furnish any of the work or services under this contract/agreement without the written approval of the Contracting Officer. This provision shall not be interpreted as requiring the approval of contracts for employment between the contractor and personnel assigned for services thereunder.

6006.00 CONFLICTS OF INTEREST (JANUARY 2022)

(a) General Subpart 9.5 of the Federal Acquisition Regulation (FAR) 48 C.F.R. 9.5, prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving organization conflicts of interest.

(b) Purpose The purpose of this SEC Instruction (SECI) is to avoid, neutralize, or otherwise mitigate organizational conflicts of interest which might exist related to a Contractor’s performance of work required by this contract. Such conflicts may arise in situations including, but not limited to:

(1) A Contractor’s participation as an offeror, or representative of an offeror, in a procurement in which it has provided assistance in the preparation of the Government’s requirements and specifications;

(2) A Contractor providing advisory assistance to the Government for a procurement in which the Contractor, or a firm which the Contractor represents, is an actual or potential offeror; and

(3) A Contractor’s participation as an offeror, or representative of an offeror, in a procurement where the Contractor has obtained confidential or proprietary information relating to competing offers as a result of the Contractor’s work on prior contracts.

(c) Definition For the purposes of this SECI, the term “Contractor” means: the Contractor; any of the Contractor’s parents, affiliates, or other entities in which the Contractor or such parents or affiliates have a financial interest; successors in interest to the Contractor or any of its parents or affiliates; proposed consultants or subcontractors at any tier; and employees thereof.

(d) Restrictions The Contractor agrees:

(1) To remain ineligible to participate in any capacity (including participating as a prime contractor, subcontractor, or as the representative of another party) in offers, contracts, or subcontracts (whether solicited or unsolicited) that directly relate to the Contractor’s performance of work under this contract.

(2) To execute, prior to beginning work on a contract, such Confidentiality Agreements, Non-Disclosure Agreements, or other documents which the Contracting Officer may, in their sole discretion, require in order to protect the proprietary nature or confidentiality of information provided by the Government or otherwise received by the Contractor in connection with its work under this contract.

(3) As otherwise provided in this contract, not to accept any compensation or any other form of payment from a broker, potential lessor, or any source other than the Government for services rendered under this contract, and to employ aggressive strategies to minimize the Government’s lease costs where the Contractor would be entitled by common business practice to receive a real estate commission or any form of payment from a broker, potential lessor, or other party, for work performed under this contract.

(4) To immediately notify the Contracting Officer of any offer of compensation, other form of payment, or thing of value, made by a broker, potential lessor, or any source other than the Government to the Contractor related to services rendered under this Contract, regardless of whether such offer was made during Contractor’s performance of work under a given contract or subsequent to Contractor’s completion of work under such contract.

(5) Prior to the acceptance of a contract, request to immediately notify the Contracting Officer of any potential conflict of interest which would prevent or limit the Contractor’s ability to perform the work required under the contract.

(6) To immediately notify the Contracting Officer of any conflict of interest discovered during the Contractor’s performance of work pursuant to a Government contract; provided that the Contracting Officer shall have the right to impose such restrictions as they deem appropriate on Contractor’s performance based on the existence of such a conflict or, if the Contracting Officer determines that such restrictions would not adequately address the conflict of interest at issue, to terminate the Contractor’s performance of work under the contract at no cost to the Government.

(7) As otherwise provided in this contract, that if the Contractor declines to accept a task order request and subsequently participates (either directly or as a representative of another party) in a Government procurement action that was the subject of the task order request, then the fee which the Contractor would have been entitled to receive for such task order work or the fee actually paid by the Government for the task order’s performance by another contractor, whichever is greater, shall be applied toward the Contractor’s minimum order guarantee.

(8) That in the event that the Contractor knowingly withholds the existence of a conflict of interest from the Government, that the Contracting Officer may terminate this contract at no cost to the Government and any minimum guarantee(s) otherwise applicable to the Contractor will be forfeited; provided, that the foregoing shall be in addition to all other remedies and causes of action which the Government may have against the Contractor, including the suspension and/or debarment of the Contractor.

(9) To include this Conflict of Interest SEC Instruction, including this subparagraph, in all of the Contractor’s subcontracts at all tiers (appropriately modified to preserve the Government’s rights hereunder) which involve the performance of work by subcontractors in support of this contract.

(10) That, in addition to the remedies enumerated above, the Government may terminate this contract for cause in the event of the Contractor’s breach of any of the above restrictions.

6007.00 COMPLIANCE WITH REGULATIONS (JANUARY 2022)

a. The Contractor shall comply with all statutes, regulations, directives, instructions, and references applicable to the conduct of this acquisition as imposed by the Federal Government and the SEC, including, without limitation, those specified or referred to in this contract.

b. The Contractor and its employees performing work on-site at SEC facilities shall become acquainted with and shall comply with the rules and regulations of the SEC’s facilities, including, but not limited to security, controlled access, personnel clearances, and conduct with respect to health and safety at the site, regardless of whether or not title to the facility is vested in the SEC.

6012.02 SEC SECTION 508 REQUIREMENTS (JANUARY 2022)

a. Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all Information and Communication Technology (ICT) products and services developed, acquired, maintained, and/or used under this contract/order must comply with the Information and Communication Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in FAR 39.203(a). The complete text of Section 508 Final Provisions can be accessed at Section 508 Law.

b. All ICT products must comply with the following requirements. Descriptions of the requirements are viewable at the link Section 508 Standards.

c. Offerors that fail to demonstrate compliance with the above requirements, may be eliminated from further consideration for award.

d. The offeror shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility requirements at 36 CFR 1194 using a Voluntary Product Accessibility Template (VPAT 2.4). Further, the solicitation response must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location).

e. Offerors to this solicitation must provide any additional detailed information necessary for determining applicable Section 508 standards conformance. If an offeror claims its products and/or services, including ICT deliverables such as electronic documents, web content or electronic reports, meet applicable Section 508 standards, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility, remediation of the products and/or services to the level of conformance specified in the contract will be the responsibility of the offeror at its expense.

6012.05 PERSONALLY IDENTIFIABLE INFORMATION (PII) IN CONTRACTS TO DESIGN, DEVELOP, OPERATE, OR MAINTAIN A SYSTEM OF RECORDS (JANUARY 2022) A Contractor that designs, develops, operates or maintains a system of records on behalf of the agency to accomplish an agency function or otherwise maintains Personally Identifiable Information (PII) in the performance of this contract shall, prior to taking such action, comply with the following requirements:

a) The Contractor shall have established policies and procedures in place to safeguard PII. The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding PII and reporting suspected or confirmed compromise of PII.

b) The Contractor shall also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 2 or the latest revision, and SEC policies developed to safeguard the confidentially, integrity and availability of SEC data that may contain PII. In support of these requirements, the Contractor shall have:

· policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

· policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

· policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140-2; and

· policies, procedures, and mechanisms that ensure SEC data transmitted across public networks (i.e., the Internet) by the Contractor, or its employees, agents or subcontractors, are protected using secure communications, including the use of Transport Layer Security (TLS) protocol and the Advanced Encryption Standard (AES) 256 bit encryption algorithm.

c) The Contractor shall make its privacy policies and procedures that describe administrative, physical, and technical safeguards to protect PII available for review by the SEC Office of Information Security within 10 business days of request.

d) The Contractor shall ensure that those individuals adhere to the Contractor’s policies and procedures relating to PII and to SEC-prescribed policies and procedures for the safe handling of SEC PII, including privacy and security training requirements and privacy incident management.

e) The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of PII. Notification must be made to the SEC of a breach as soon as practicable, but no later than twenty-four (24) hours after the Contractor becomes aware of it by contacting the SEC Service Desk at (202)551-4357. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Instruction, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

f) Return or Destruction of PII. At any time during the term of this contract at the SEC’s written request or upon the termination or expiration of this contract for any reason, unless otherwise required by law to be retained, the Contractor shall, and shall instruct all authorized personnel to, promptly return to the SEC all copies, whether in written, electronic or other form or media, of PII in its possession or the possession of such authorized personnel, or securely dispose of all such copies, and certify in writing to the SEC that such PII has been returned to SEC or disposed of securely. The destruction of PII shall be performed according to NIST approved methods.

6013.01 FEDERAL REQUIREMENTS, SECURITY, AND ACCESSIBILITY FOR INFORMATION SYSTEMS (JANUARY 2022)

a. Information Systems Authorization to Operate (ATO): Information systems containing Securities and Exchange Commission (SEC) data or operated on behalf of the SEC are required to have an authorization to operate, based on National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-37, Revision 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. The security assessment entails a review of minimum security controls, documented in NIST SP 800-53, Revision 5 (and subsequent revisions as finalized by NIST); documentation of a system security plan, based on NIST SP 800-18 updated, Rev. 1; and remediation of weaknesses that are documented in a plan of action and milestone (POA&M) document, as required by Office of Management and Budget (OMB) Memorandum 02-01. The ATO will also have to cover any alternate processing facilities or a subcontractor handling SEC information or operating systems on behalf of the SEC.

b. Additional Federal governance includes but is not limited to the following:

1. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d) for system accessibility requirements

2. Office of Management and Budget (OMB) Circular A-11, Revised, “Preparation, Submission and Execution of the Budget” (December 2020)

3. OMB Circular A-130, Revised, “Managing Information as a Strategic Resource” (July 2016)

4. OMB Federal Enterprise Architecture Program Management Office (FEAPMO) Reference Models and Circular A-11 Guidance. www.feapmo.gov.

5. Privacy Act of 1974, Public Law 93-579 (5 U.S.C. 552a), as amended

6. The E-Government Act of 2002, Public Law 107-347

7. OMB Memorandum M-15-01, Fiscal Year 2014-2015 Guidance on Improving Federal Information Security and Privacy Management Practices, October 3, 2014 (and subsequent updates by OMB)

8. OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002, September 30, 2003

9. OMB Memorandum M-10-22, Guidance for Online Use of Web Measurement and Customization Technologies

10. OMB Federal Risk and Authorization Management Program (FedRAMP) Policy Memo, December 8, 2011

11. Federal Information Processing Standard (FIPS) Publication (PUB) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, September 2013

12. FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

13. FIPS PUB 197, Advanced Encryption Standard, November 2001

14. FIPS PUB 140-3, Security Requirements for Cryptographic Modules, March 2019

15. National Institute for Standards and Technology (NIST), Special Publication (SP) 800-122, Guide for Protecting the Confidentiality of Personally Identifiable Information (PII), April 2010

16. NIST SP 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

17. NIST SP 800-115, Technical Guide to Information Security Testing and Assessment Sept 2008

18. NIST SP 800-100, Information Security Handbook: A Guide for Managers, Oct 2006

19. NIST SP 800-95, Guide to Secure Web Services, Aug 2007

20. NIST SP 800-92, Guide to Computer Security Log Management, Sep 2006

21. NIST SP 800-88, Revision 1, Guidelines for Media Sanitization, December 2014

22. NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, August 2012

23. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations, September 2020

24. NIST SP 800-53A, Revision 4, Guide for Assessing the Security Controls in Federal Information Systems, December 2014

25. NIST SP 800-44 Version 2, Guidelines on Securing Public Web Servers, Sep 2007

26. NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments, September 2012

27. NIST SP 800-34, Revision 1, Contingency Planning Guide for Federal Information Systems, May 2010

28. NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems, February 2006

29. NIST SP 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018

30. NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations, September 2011

31. NIST SP 800-137A, Assessing Information Security Continuous Monitoring Programs; Developing and ISCM Program Assessment, May 2020

c. Encryption Specifications:

1. All encryption modules in the requirement must be FIPS 140-3 certified level 2.

2. All built-in encryption modules are subject to verification by technical support provided by the contractor or as otherwise directed by the COR.

3. Unless the Contractor is using SEC provided devices, all contractor provided mobile devices including, but not limited to laptops, mobile phones, and tablets, must be encrypted with a full-disk (or full-system) encryption capability.

4. All data written to removable media must be encrypted using the SEC’s enterprise removable media encryption capability.

5. All systems and applications must only support Hypertext Transfer Protocol Secure (HTTPS). All Internet-facing systems must also implement HTTP Strict Transport Security (HSTS). Deprecated encryption methods (such as SSLv2 and SSLv3) and encryption ciphers (such as 3DES and RC4) shall not be supported.

f. Dedicated Security Personnel Specifications: All system development, maintenance, and support contracts must include an appropriate number of qualified information security personnel to be provided by the Contractor as defined below. These individuals will ensure secure development methodologies are followed and assist the SEC Security Operations Center (SOC) in proactive monitoring of exploits against SEC information systems.

g. All applicable contracts must have at least one dedicated security resource, but Contractors may augment the skills and abilities of security personnel with additional Contractor Personnel.

h. Security personnel must:

1. Prepare written documents and communicate with both business and technical stakeholders;

2. Have experience in and understand security architecture for web applications and infrastructure, and have experience and working knowledge of Security Assessment and Authorization (SA&A) activities in accordance with standards from NIST;

3. Have expertise and experience in performing continuous monitoring activities for systems to include monitoring for security threats, performing access reviews, reviewing and developing mitigations for vulnerability assessment reports, and proposing enhancements for systems security;

4. Have experience supporting security operations centers (or similar capabilities) in systems reviews and potential incident investigations; and

5. Obtain and maintain knowledge of the security architecture and the business purpose of systems under his/her purview.

i. Security Assessment: OIT Security Team with the support of the Contractor Security Personnel performs Security Assessment and Authorization (SA&A) for a product to be deployed. This process is designed to allow the SEC to identify any risks associated with the system and either mitigate them or formally accept any residual risk. This requirement is based on the NIST SP 800 series of documents and includes:

1. Enumeration - activity aimed at identifying devices and components and cross-referencing with provided inventory lists;

2. Vulnerability Scanning - performs network-based vulnerability assessment of customer’s servers, workstations, and any other network device or appliance in scope. The assessment will identify vulnerabilities associated with network services, operating systems, and devices that are un-patched or have out-of-date software security patches;

3. Penetration Testing - attempts to exploit weaknesses identified from vulnerability scanning to verify legitimate findings, eliminate false-positives, and determine the extent of the vulnerability and potential remediation steps that may be taken; and

4. Functional Testing - Perform specific tests, examinations, and inspections against NIST SP 800-53 controls not tested by the other activities.

j. The Contractor shall provide the Security Team with: (1) a system demonstration; (2) test user IDs; (3) Access to the system; (4) System Security Plan (SSP); (5) additional documents as required under the NIST SP 800 series to support Security Assessment & Authorization activities including third party assessments for certain projects/requirements as described in the section below. The Contractor shall provide ongoing support to update the required SA&A documentation. The OIT Security Team provides the test reports. Any cloud-based components will have to be assessed in accordance with FedRAMP and must have already received a provisional authorization from either the Joint Authorization Board or another U.S. Federal Executive Branch Agency. Additional Federal requirements for cloud computing are documented in NIST SPs 800-144, 800-145 and 800-146, and in SEC Instruction 6022.00.

k. Contractor-provided SA&A for all system development or solutions development projects for contractor-operated systems and solutions:

1. For all Contractor-operated systems or solutions (including Cloud-based systems), the Contractor must obtain from an organization (3PAO) a third party accredited security assessment compliant with standards from NIST (e.g., SP 800-115 Technical Guide to Information Security Testing and Assessment) to verify that security controls are implemented and operating as intended.

2. The assessment is subject to review and approval by the SEC.

l. Documentation Updates: The Contractor shall maintain and update system specifications and/or documentation, including system inventory, to reflect changes made during maintenance or update. The Contractor shall maintain system documentation to reflect the configuration of software releases and commercial off-the shelf (COTS) products. The Contractor shall maintain documents and specifications in compliance with standards for formatting and content and produce standardized documentation, i.e., User Guides, Requirements Documents, On-line Help, Standard Operating Procedures (SOP), system specifications, audit documentation practices and procedures, and other documentation. The documentation shall be available to the COR for review and inspections throughout the system development life cycle (SDLC); updates shall be submitted to the COR for review and approval.

m. System Development Plan (SDP): The Contractor shall develop, maintain, and execute an SDP which shall include the policies, procedures, standards, instructions, forms, and/or checklists needed to analyze, design, implement, test, and deploy the required application systems. In the SDP, the Contractor shall explain how the Contractor’s corporate system development standards and practices will be applied and discuss its development methodology in detail. The SDP shall also describe the development methodology used by the Contractor. The SDP will be benchmarked against NIST SP800-160 Volume 1 and NIST SP 800-160 Volume 2, Developing Cyber Resilient Systems: A Systems Engineering Approach.

p. Mandatory Common Security Configurations: The Contractor must follow the common security configurations as published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, Revision 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers, February 2018, is located at: https://csrc.nist.gov/publications/detail/sp/800-70/rev-4/final

q. Additional Breach Responsibilities:

1. For cloud-based service contracts, incident reporting procedures included in SECI 6022.00 take precedence over those described here.

2. The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC in writing of any event, including the suspected or confirmed breach , that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST SP 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at SOC@sec.gov as soon as possible and without unreasonable delay. The Contractor shall act in accordance with its policies and procedures in the event of any breach shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this instruction, a “suspected breach” shall be interpreted liberally to mean any situation in which the loss or unapproved access to such information is deemed a reasonable possibility.

3. In addition to the above, the Contractor shall provide immediate written notification to the SEC as indicated above of any breach or loss of control or any other similar incident regarding “federal contract information” as that term is used in FAR 52.204-21. The Contractor’s responsibilities include providing assistance as requested by the SEC to ensure that any breach or loss of control of any such information is contained and assistance sufficient to demonstrate that any possible damages suffered by individuals and/or the agency are sufficiently mitigated.

4. The Contractor’s duties under the above two paragraphs include providing unredacted forensic reports documenting the breach, loss of control or similar event sufficient to satisfy the SEC in its sole discretion. The Contractor’s duties under the above two paragraphs survive the termination or conclusion of the contract and remain in place for so long as the contractor continues to retain or have access to PII and other SEC Nonpublic Information or federal contract information related to this contract that has not independently been authorized for release.

r. Security Requirements for Transmitting SEC Non-Public Information, Including PII and Controlled Unclassified Information (CUI) with the Use of Electronic Mail

s. Additionally, contractors shall ensure that all processes, procedures and equipment associated with storing or transmitting SEC Nonpublic Information, including PII or IIF, comply with all laws, regulations, and security mandates as defined by NIST Special Publication (SP) 800-61 Revision 2 as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of data that may contain SEC Nonpublic Information, including PII or IIF. In support of these requirements, the Contractor shall have:

1. Policies, procedures, and mechanisms designed to restrict access to SEC data on Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

2. Policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

3. Policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140-3 (validated); and

4. Policies, procedures, and mechanisms that ensure SEC data transmitted between the Contractor and the SEC are protected using encryption compliant with Federal Information Processing Standard 140-3 (validated).

t. At least annually or more frequently upon request by the COR, the Contractor shall provide assessments to the SEC demonstrating that these policies, procedures, and mechanisms continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective. SEC reserves the right to verify stated compliance.

u. Analysis and Evaluation: The Contractor shall fully cooperate with any risk analysis or other evaluation of the Contract conducted by the SEC or its representatives, including any evaluation of the Contract under the SEC’s SA&A Program, including Privacy. Such cooperation shall include, but is not limited to, undergoing an independent audit or risk analysis by the SEC or by a third-party organization approved by the SEC, with such audits to occur not less than once every three (3) years or when there is a significant change to the system. Such evaluations, risk analyses, or audits shall include security tests on the Contractor’s devices and the review of the Contractor’s own policies, procedures, security scans, tests, or reviews, which the Contractor agrees to provide to the SEC or its representatives upon request. The Contractor will make good faith efforts to remediate any vulnerabilities, issues, or negative findings as a result of any such audit, review, or risk analysis.

v. Transportation and Storage: Non-digitized data (such as paper documents) containing SEC data must be transported and stored in a manner designed to prevent the unauthorized loss of a document or disclosure of the information in a document. At a minimum this will require written procedures and policies, evidence that these procedures and policies are being followed, records that contractors are being trained on those policies and procedures, along with a physical assessment by the SEC’s OIT Security of any area where the documents are stored or used.

w. Unauthorized Access Protection: Devices that may contain digitized copies of SEC data – such as photocopy machines, scanners, and faxes – must be protected against unauthorized access both physical or via computer network or wireless connection and the devices may not be returned, sold, or otherwise disposed of until they have first been scrubbed of SEC data in a manner approved by SEC’s OIT Security or physically destroyed. Duplication of SEC data that is not directly related to SEC assignments through the use of photocopies, scanning, photography, or Web-cameras, is prohibited.

x. Destruction: Material or devices containing SEC data can only be destroyed using an SEC-approved process, which may require the provision of certificates of destruction to the SEC.

y. System Patching and Maintenance: Any information system components must be kept up to date with vendor versions, patches and security updates. No end-of-life or unsupported components may be used on systems that process or store SEC data, regardless of their location.

z. System Authentication: Any information system that utilizes authentication for access must conform to SEC policies on system access. For systems categorized as FIPS 199 MODERATE, this includes supporting multi-factor authentication using PIV credentials.

6017.01 COMMUNICATING BY EMAIL AND/OR FILE SHARING NONPUBLIC INFORMATION, CUI, SBU, AND PII FOR CP WITHOUT NETWORK ACCESS (JANUARY 2022)

a. This Instruction encompasses Contractors’ duties regarding communications involving all of the follow types of information: Nonpublic Information, Controlled Unclassified Information (CUI), Sensitive But Unclassified (SBU) information, and Personally Identifiable Information (PII). Definitions of these types of information are provided at SECR 23-2 and in other applicable federal guidance and are subject to change as needed to conform to changes in federal law. PII is defined in the E-Government Act of 2002 and related Office of Management and Budget (OMB) memoranda as information that could be used to distinguish or trace an individual’s identity, such as a person’s name, Social Security number, date and place of birth, mother’s maiden name and biometric records.

b. When communicating the above types of information via email, during the period of this contract, the Contractor shall submit all such communications using Zixmail. This is an SEC-approved external, secure service that encrypts outgoing messages, decrypts and validates incoming messages, and authenticates both the sender's and recipient's e-mail identities. The Contractor shall use the following instructions for using Zixmail:*

a. Login at U.S. Securities and Exchange Commission Secure Email Password Authorization

b. View message under the “Inbox” tab or create and send new messages from the “Compose” tab.

c. Messages are created and sent similarly to a typical e-mail messaging system and include: Recipients, CC, subject line, body and attachments.

d. *Notes: The Contractor must register a new account first at U.S. Securities and Exchange Commission Secure Email Password Authorization prior to reading or sending encrypted messages. The Contractor will be provided with a link to create an account the first time you send them an encrypted message. This link will also be used by the Contractor subsequently to read and compose messages. The Contractor can only send encrypted e-mail messages from the ZixMail portal to SEC employees. All e-mail contents, including attachments, are encrypted when sent using this method.

c. For larger transmissions of information, Contractors shall use Accellion secure filing sharing programs as permitted by the Office of Information Technology.

6018.00 CONTRACTOR PERFORMANCE EVALUATION (JANUARY 2022)

a. In accordance with FAR 42.1502, the SEC will submit an electronic record of the Contractor’s performance to the Contractor Performance Assessment Reporting System (CPARS) for processing at least annually and at the time the work under a contract or order is completed.

b. The Contractor’s information for CPARS is pulled from the Contractor’s entry in SAM under the Past Performance Point of Contact for the company.

c. The Contractor’s designated representative will have the ability to review, comment, and state whether or not the Contractor agrees with the evaluation and return the evaluation to the Contracting Officer (CO) per FAR 42.1503. The SEC’s evaluation will be available to search in CPARS after 14 calendar days for Government use in evaluating the Contractor’s past performance as part of a source selection action.

d. If the Contractor desires a meeting to discuss the evaluation, it must be requested, in writing to the CO, no later than seven calendar days from the receipt of the evaluation.

e. It shall be the sole responsibility of the Contractor to inform the CO or COR in writing of any changes to the Contractor’s designated representative. Any such changes do not require a modification to the terms and conditions of the contract/order.

6019.00 MANDATORY TRAINING FOR CONTRACTOR PERSONNEL (JANUARY 2022)

a) Contractor employees, agents, and subcontractor personnel (collectively, “Contractor Personnel”) must complete initial mandatory training, including the following:

1) Privacy and Information Security Awareness (PISA) & Rules of the Road (RotR)

2) Protecting Nonpublic Information at the SEC for Contractor Personnel

3) Records Management

4) Continuity of Operations (COOP)

5) Physical Security and Safety Awareness Training (PSSAT)

6) Any other required training listed in LEAP for each individual contractor personnel

b) Prior to onboard, PISA/RotR will need to be completed through SEC’s external learning management system LEAP Extended. Thereafter, all other mandatory training, for Contractor Personnel with network access, will be available through SEC’s online learning management system, LEAP. All mandatory trainings must be completed as soon as practicable, but not later than the deadline shown on the individual Contractor Personnel’s LEAP “To Do List”.

1) Contractor Personnel with no network access will be assigned all other mandatory trainings in LEAP Extended along with PISA/RotR.

2) Contractor Personnel must complete annual refresher mandatory trainings in accordance with the SEC-wide mandatory training schedule established each year.

c) Additional IT Security Training may be required whenever there is a significant change in the SEC information system environment or procedures or when Contractor Personnel enter a new position that requires additional role-specific training in accordance with 5 CFR 930.301(5)(d).

d) Contract Personnel designated by the government as having “significant IT security responsibilities” may be required to take security training related to their role as directed by the Contracting Officer’s Representative (COR).

e) The Contractor shall ensure that all Contractor Personnel…