Attachment 3 - Website Satisfaction Survey_ FTC_Clauses.docx

Federal Trade Commission

Website Satisfaction Survey

Attachment 3 - FTC Specific Clauses

1152.201-90 Contracting Officer’s Representative (COR)

The contractor may accept technical direction, during the period of performance from the Contracting Officer’s Representative (COR), providing such direction is within the scope of the contract/order.

A. The COR is not authorized to change the scope of work as stated in the contract/order or obligate the Government (FTC) in any way. The Contracting Officer is the only agent for the FTC who has the authority to obligate the FTC or change the contract/order terms and conditions. Any such revision or obligation shall be authorized in writing only by the Contracting Officers. Any monies incurred beyond the dollar amount specified in this contract/order or its modifications may not be paid and does not warrant interest payments as offered under the Prompt Payment Act.

B. COR Responsibilities: A Contracting Officer’s Representative, (COR) has been named herein. The COR is responsible for:

(1) monitoring the contractor’s technical progress, including the assessment of performance and recommending to the Contracting Officer changes in scope of work, contract/order schedules and/or specifications to meet changes in requirement;

(2) advising on technical matters within the scope of work;

(3) performing technical evaluation as required;

(4) performing technical inspections and acceptances required by this contract/order; and

(5) assisting the contractor in the resolution of technical problems encountered during performance.

1152.203-90 FTC Non-Disclosure

The unauthorized use of Federal Trade Commission files or information contained therein is a violation of the Federal Criminal Code and is punishable by a fine of up to $10,000 imprisonment of up to ten years, or both. The Contractor agrees to have each person who uses the materials relating to this contract/order execute the "NONDISCLOSURE AGREEMENT FOR CONTRACTORS" attached hereto and return these documents to the Contracting Officer.

1152.203-91 Organizational and Individual Conflicts of Interest

(a) Applicability (see Federal Acquisition Regulation 9.502(c)): An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential conflict of interest on a future acquisition. In the latter case, some restrictions on future activities of the contractor may be required. The same considerations apply when the Contractor is an individual, rather than an organization.

(b) The Federal Trade Commission (FTC or Commission) has determined that this Contract could result in an actual, potential, or perceived Organizational or Individual Conflict of Interest. Specifically, work performed under this Contract could cause the Contractor to have to recuse itself, its subcontractor, or its firm from any actual, anticipated, or potential litigation or other matter in which the FTC has an interest, including, but not limited to, any FTC rulemaking, law enforcement investigation, Part 3 adjudicative (administrative) proceeding before the Commission, Federal court litigation, appeal, etc.

(c) The Contractor hereby represents that:

(1) There are no actual, potential, or perceived conflicts of interest; or

(2) There are actual, potential, or perceived conflicts of interest, but the conflict(s) can be avoided, neutralized or mitigated.

(d) If the Contractor represents that there are actual, potential, or perceived conflicts of interest, the Contractor must identify the conflicts and submit a written plan to avoid, neutralize, or mitigated said conflicts of interest prior to beginning work.

(e) The final decision as to the acceptance of the proposed plan to avoid, neutralize or mitigate any conflicts of interest rests with the Contracting Officer, after consulting with relevant FTC staff and officials. If the plan is deemed unacceptable, the FTC, in its sole discretion, may determine to waive the conflict where the public interest so warrants.

(f) If conditions change during contract performance that affect the Contractor’s conflict of interest assertion, the Contractor shall inform the Contracting Officer immediately of the change, and shall comply with the requirements of paragraph (d) above. Failure of the Contractor to comply in a timely manner with the requirement of this paragraph to notify the Contracting Officer, or the requirement of paragraph (d) to submit a proposed plan, shall be grounds for termination of the contract. The Government may deny any claim for payment for all or any portion of work performed by the Contractor, whether under this Contract or any other FTC contract, to the extent that such work, in the FTC’s sole judgment, is rendered unusable or otherwise unfit for the purpose it was required by the FTC, due to a conflict of interest that the Contractor failed to report or mitigate as required by this Contract.

(g) The Contractor shall insert the above conditions in each first tier subcontract, which shall be made binding on each such subcontractor.

1152.204-90 Contractor Personnel Security Requirements

CONTRACTOR EMPLOYEE SECURITY REQUIREMENTS (DEC 2015)

**SPECIAL NOTICE** - Contractor Orientation takes place on Wednesdays only. It is the CORs responsibility to coordinate with the FTC Administrative & Security staff and work with the Contractor to ensure that all contractor personnel are sent through orientation.

A. GENERAL

(h) The Federal Trade Commission (FTC) has determined that because this contract may require access to Federally controlled facilities, access to controlled unclassified information (CUI) and/or logical access to FTC Information Technology (IT) resources, the Contractor shall pre-screen all candidates designated for employment to perform work under this contract prior to their Entry on Duty (EOD) with the FTC to verify their compliance with minimum security fitness requirements.

(i) Pre-screening will include, but not be limited to, the use of Employment Eligibility Verification (E-Verify), the Office of Personnel Management (OPM) Central Verification System (CVS), and validation of the date of birth and the Social Security Number of the person/candidate prior to EOD. See Employment Eligibility section below. For those individuals requiring access, the contractor will forward all of this information to the FTC Personnel Security Unit (PSU), which will make the determination of suitability for such individuals.

B. SUITABILITY (FITNESS) DETERMINATION

The FTC shall have and exercise full control over granting, denying, withholding or terminating access to Federal controlled facilities, access to CUI and/or logical access to FTC IT resources based upon the results of a background investigation. The FTC may, as it deems appropriate, authorize and make a favorable EOD decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full suitability authorization will follow. The granting of a favorable EOD decision or a full suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by the FTC, at any time during the term of the contract. No employee of the Contractor performing work under the contract (Contractor Employee) shall be allowed EOD and/or access to sensitive information or systems without a favorable EOD decision or suitability determination by the PSU. No Contractor Employee shall be allowed unescorted access to an FTC facility without a favorable EOD decision or suitability determination by the PSU. Contractor Employees who do not need access to Federally controlled facilities, access to CUI and or logical access to IT resources will not be subject to suitability screening.

C. BACKGROUND INVESTIGATIONS

The Position Description provided by the Contracting Officer Representative (COR) for Contractor Employees shall undergo a Position Risk Designation (PRD) based on the duties each individual will perform on the contract. The results of the PRD shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the FTC PSU.

Prospective Contractor Employees with prior favorable fitness or suitability determinations and/or security clearances (as appropriate) may be granted reciprocal recognition, to the extent practicable, when in the PSU’s sole discretion, it is determined that the prior determination or clearance meets or exceeds that which is required by the position. All Contractor Employees including any replacements or additions shall submit to fingerprinting and complete and provide the following pre-screening security forms no less than 15 business days before the starting date of the contract or 15 business days prior to the expected EOD:

0. Resume

0. Completed Credit Form – FCRA-gov

0. Completed Authorization for Release of Information – FTC 429

0. Completed Declaration for Federal Employment – OF 306

Required forms will be provided by the FTC at the time of award of the contract or upon identification of new individuals to be added to the Contractor’s workforce. Only complete packages will be accepted by the PSU. Specific instructions on submission of packages will be provided upon award of the contract. Such records shall be maintained in accordance with the Privacy Act of 1974, 5 U.S.C. 552a.

The FTC PSU may not be able to complete a satisfactory background investigation for prospective Contractor Employees who have not resided in the US for three of the past five years or who have not registered with the Selective Service, if required. In such cases, the FTC retains the right to deem a prospective Contractor Employee as ineligible to perform work under this contract due to insufficient background information.

D. CONTINUED ELIGIBILITY

If a prospective Contractor Employee is found to be ineligible for access to Federally controlled facilities, CUI, or FTC IT resources, the COR will advise the Contractor that the person shall not continue to work or to be assigned to perform any work under the contract requiring such access.

The PSU will perform annual fingerprinting and appropriate reinvestigation on all Contractor Employees.

The FTC reserves the right and prerogative to deny and/ or restrict access to Government facilities, access to CUI and/or logical access to IT resources for any Contract Employee whose actions are inconsistent with or conflict with the standards of conduct that apply to Government employees, 5 CFR 2635 and 5 CFR 5701 Subpart 5.2, or whom the FTC determines to present a risk of compromising CUI to which he or she would have access under this contract.

The loss of any FTC-issued identification card or building pass must be immediately reported to the COR. The report must include the pass or card number, name of the individual to whom issued, and the last known location and disposition of the card or pass. Likewise, the loss of any FTC materials or information, and any lost device or equipment, including any device or equipment containing any personally identifiable information (PII), must be immediately reported to the COR and to the FTC Help Desk at (202) 326-3500 (24 hours, 7 days a week). Failure to comply with these requirements may result in revocation of the Contractor Employee’s continued eligibility to perform work under this contract.

The Contractor will formally report immediately to the PSU through the COR any adverse information coming to their attention concerning Contractor Employees. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of a Contractor Employee does not obviate the requirement to submit this report. The report shall include the employee’s name and Social Security number, along with the adverse information being reported.

The PSU must be notified of all terminations/ resignations within five days of occurrence. The Contractor will return all FTC-issued identification cards, equipment and building passes, for Contractor Employees, as well as all FTC materials and information that terminated employees may have in their possession, to the COR. The COR will return the identification cards and building passes to the responsible PSU.

E. EMPLOYMENT ELIGIBILITY

The Contractor agrees that each Contractor Employee shall have successfully passed the FTC E-Verify program operated by United States Citizenship and Immigration Services (USCIS) to establish work authorization.

The Contractor must record and retain the case verification number (obtained after closing a case upon completion of the search/verification) written on or attached to the I-9, which must be made available for inspection if requested by an authorized FTC or other authorized U.S. Government official.

The Contractor agrees that each Contractor Employee working on this contract shall have a Social Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to the Government for the acts and omissions of its own employees and those of its Subcontractor(s) and their employees.

Subject to existing law, regulations and/ or other provisions of this contract, illegal or undocumented aliens shall not be employed by the Contractor, or under this contract. The Contractor shall ensure that this provision is expressly incorporated into any and all Subcontracts or subordinate agreements issued in support of this contract.

F. SECURITY MANAGEMENT

The Contractor shall provide a point of contact (individual) to work with the FTC PSU. This individual will interface with the PSU on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and the PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract; the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

G. INFORMATION TECHNOLOGY

When CUI is processed using any telecommunications or automated information systems under this contract, the Contractor agrees to provide for the administrative, technical, and physical control of such data and to adhere to the IT security, privacy and confidentiality procedures governing such data including, but not limited to, those outlined in the FTC Non-Disclosure Agreement for Contractors (FTC Form X-033).

Contractors who fail to comply with FTC IT security policy are subject to having their access to FTC IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly uses, handles, or discloses protected information may be subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act of 1974, FTC Act).

H. INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All Contract Employees using FTC automated systems will be required to complete the annual basic FTC Security and Privacy Awareness Training, regarding security and privacy risks and vulnerabilities, accepted security practices, and system rules of behaviors. This training will be provided by the appropriate component of the FTC prior to the contractor entry date. Contractors using non-FTC systems to process FTC data under this contract must also provide security awareness training to their employees working on this contract.

Contractors involved in supporting the management, use, or operation of FTC IT systems, or, with any other significant security responsibilities, shall receive additional specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access FTC information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures shall be reported immediately to the PSU and the Information Assurance Manager (IAM).

I. APPLICABILITY TO SUBCONTRACTORS

The foregoing Contractor Employee Security Requirements shall also apply to all Subcontractors and their respective employees retained by the Contractor to perform work under this contract. The Contractor shall incorporate these provisions into their contracts with, or shall otherwise ensure that these provisions are made legally binding on, such Subcontractors. Failure of the Contractor to ensure compliance with these requirements by its Subcontractor(s) shall constitute grounds for contract termination.

J. ADDITIONAL CONTRACT REQUIREMENTS

Contractor information systems subject to the Federal Information Security Management Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to to prevent and remedy data breaches and to provide the FTC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the FTC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the FTC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

Use of FTC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract. Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an FTC computer, may be grounds for initiating disbarment procedures.

1152.211-90 FTC Observance of Legal Holidays - Facility Closures

The Federal Trade Commission observes the following days as holidays: New Year’s Day, Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas Day, and any other day designated by Federal law, Executive Order, or Presidential Proclamation.

When any such day falls on a Saturday or Sunday, the preceding Friday or the following Monday is observed, respectively.

1152.224-90 Special Protections for Sensitive Information – Experts and Consultants

(a) Definitions. For purposes of these requirements, the following definitions apply:

(1) “Information” includes any records, data, or other information that is: provided or made available to the Contractor by the FTC; provided or made available on the FTC’s behalf to the Contractor by a non-FTC party; created, compiled, generated, collected, or maintained for the FTC to the extent it is first produced in the performance of this contract; or delivered to the FTC under this contract, other than limited rights data or restricted computer software, see Federal Acquisition Regulation (FAR) 27.402-2.

(2) “Personally Identifiable Information” (PII). The term PII, as defined by the Office of Management and Budget in Memorandum 07-16 issued May 22, 2007, refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

(3) “Sensitive Personally Identifiable Information” (Sensitive PII) refers to the following information, whether in paper, in electronic form, or communicated orally:

(i) An individual’s Social Security Number (SSN), Sensitive Health Information, or a Biometric Identifier; or

(ii) An individual’s name or address or phone number in combination with one or more of the following: date of birth; driver’s license number or other state identification number, or foreign country equivalent; military identification number; passport number; financial account number; or credit or debit card number.

(4) “Sensitive Health Information” (SHI) includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

(5) “Biometric Identifier” Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints; palm prints; iris and retina scans; facial characteristics; and signature and voice dynamics. All Biometric Identifiers are treated as Sensitive Information, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone. However, a database of photographs and corresponding analyses by facial recognition software are Sensitive Information. Likewise, voice recordings and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive Information.

(6) “Other Sensitive Information” means information filed with the FTC or the Department of Justice pursuant to the premerger notification provisions of the Hart-Scott-Rodino Act, 18 U.S.C. 7A(h), information subject to any in camera or protective order issued in any administrative or judicial proceeding, and any other confidential or sensitive information provided or made available to the Contractor by the FTC directly, or from a non-FTC party on behalf of the FTC, as identified and designated in writing to the Contractor by the Contracting Office Technical Representative (COTR).

(7) “Sensitive Information” shall refer collectively to the categories of information defined in paragraphs (a)(3), (4), (5) and (6) of this provision.

(b) Protecting Sensitive Information: General Provisions.

Contractor is required to follow the FTC policies and procedures incorporated by reference in this provision or attached to this contract for the protection of Sensitive Information, and any superseding or supplemental policies and procedures that may be subsequently incorporated into the contract or attached hereto. These requirements shall govern the Contractor’s handling of such information when performing work for the FTC on-site and off-site (i.e., storage, transfer and shipping, traveling, sharing, disposal, and breach reporting). Contractor shall further ensure that its own data shall not be commingled with, and shall remain logically and physically separate from, Sensitive Information provided by or specifically compiled, created, stored, or processed for the FTC, except as needed on a temporary basis to carry out the analysis required by the contract and such commingled data shall not be stored or saved. Further, such Sensitive Information shall not be used for any purpose other than to carry out the Contractor’s obligations under the contract. All policies and procedures for safeguarding Sensitive PII or SHI incorporated into this contract or any modifications thereto shall apply to all Sensitive Information as defined by paragraph (a)(7) of this provision.

(c) Ensuring the Secure Use of Non-FTC Electronic IT Equipment. To provide further protection for Sensitive Information, the following conditions shall apply to the Contractor’s use of non-FTC electronic IT equipment.

(1) Prohibition on connecting unauthorized non-FTC portable electronic storage devices (PESDs), Mobile Wireless Devices (MWDs), or other non-FTC equipment to FTC networks or computers. To protect FTC systems from the introduction of unauthorized software, viruses, and other threats, the Contractor shall not connect any non-FTC PESD or MWD (e.g., thumb or key chain drives, external hard drives, or other equipment with electronic storage or communications capability, such as digital cameras, personal digital assistants, portable digital music players, mobile phones, BlackBerrys), any laptop, or any other non-FTC equipment, to any FTC network or computer, except where expressly authorized by the terms of the contract, or by the COTR, after obtaining approval from the FTC’s Chief Information Security Officer (CISO).

(2) Limitations on using non-FTC PESDs or other non-FTC equipment to store, ship or transfer Sensitive Information. The Contractor shall not use any non-FTC PESD, MWD, or other non-FTC equipment (e.g., non-FTC laptops or desktop computers) to store, ship or transfer Sensitive Information, except where expressly authorized by the terms of this contract or by the COTR, with approval of the CISO. The FTC, in its discretion, may instead make FTC-approved equipment available to the Contractor for this purpose. In addition, Contractor shall not use any (FTC or non- FTC) PESD, MWD, or other non-FTC equipment to store, ship or transfer Sensitive Information in unencrypted form, except as expressly authorized by the terms of this contract, including any applicable policies or procedures that have been incorporated into or attached to this contract. Such policies and procedures permit the COTR, in certain circumstances, to grant exceptions to encryption requirements for Sensitive PII; those requirements and the COTR’s authority to grant exceptions shall extend to all Sensitive Information as defined by this provision. The COTR shall consult, as necessary and appropriate, with the FTC’s Chief Privacy Officer (CPO), the CISO, and other relevant FTC officials or staff in determining whether to grant exceptions. Where encryption is required, the Contractor shall comply with technical standards designated by the FTC in paragraph (c)(4).

(3) Additional limitations on the use of non-FTC stand-alone computers and laptops.

(i) When a non-FTC stand-alone computer or laptop is connected to or otherwise made part of a non-FTC network or facility, including a stand-alone computer or laptop networked (over the Internet or otherwise) with other stand-alone computers, laptops, or other devices, Attachment 2 – FTC Specific Clauses its use shall be permitted only in accordance with and subject to the terms and conditions for the use of such a network and facility as set forth in paragraph (d) of this provision.

(ii) Use of non-FTC stand-alone computers or laptops to access the FTC network remotely. Contractor may use non-FTC stand-alone computers or laptops to access the FTC network remotely (whether the information to be accessed from the network is Sensitive Information or not) only in accordance with applicable FTC security standards and procedures for secure remote access to such network, including an FTC-issued token, appropriate and active firewalls and antivirus software installed on the user’s equipment, and other technical requirements. Where the Contractor’s equipment does not satisfy such requirements, the FTC may, in its discretion, make available to the Contractor an FTC- encrypted computer or laptop for such remote access. Contractor shall be required to execute a rules of behavior form (FTC Form 734 or other designated form) before the Contractor may be granted such remote FTC network access.

(iii) Technical security standards and requirements for non-FTC stand-alone computers and laptops. Contractor must comply with the technical security standards and requirements set forth in this paragraph whenever using a non-FTC stand-alone computer or laptop to process, store, or transmit Sensitive Information. (Sensitive Information shall not be stored on such equipment except as provided under paragraph (2) above.) Access Controls: use unique user ID; use strong passphrase (minimum of 12 characters) and change it every 60 days; use session lock (i.e., lock initiates after 15 minutes or less of inactivity); apply appropriate user rights to disallow access by unauthorized users. Physical and Environmental Protections: restrict physical access to the computer from unauthorized users (e.g., store the equipment in a locked room); use a cable lock to secure the equipment; configure the basic input/output system (BIOS) so that equipment boots from the hard drive only; remove or disable the Network Interface Card (NIC); disable wireless capabilities. Computer Security Controls: use a FIPS 140-2 validated whole-disk encryption module, as provided in paragraph (c)(4) below; use anti-virus software.

(4) Encryption. Where encryption is required by this contract, the Contractor shall comply with National Institute of Standards and Technology (NIST) Federal Information Processing Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. The publication can be found here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf .

NIST-approved FIPS 140-2 validated vendors can be found here: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm.

The Contractor must use PGP whole-disk encryption with AES 256-bit encryption.

(5) Peer-to-Peer File-Sharing Software (P2P). The Contractor shall consult with the FTC before processing or transmitting any Sensitive Information on any stand-alone computer, laptop, or other device or network on which P2P software, programs, or applications have been installed or configured for open network use. P2P software generally refers to any software, program, application or system allowing individual users of the Internet to connect to each other and trade, share, or copy files such as music, video, photographs, and other files.

(d) Ensuring the Secure Use of Other Non-FTC Electronic IT Networks and Facilities.

(1) Limitation on use. Contractor warrants and agrees that it shall not use any non-FTC network or facility (e.g., commercial, corporate, university) to store or process Sensitive Information on behalf of the FTC, unless such network or facility is an information system currently certified and accredited under the Federal Information Security Management Act (FISMA), or such network or facility otherwise has reasonable administrative, technical, physical and procedural controls, including a program of continuous monitoring to ensure such controls remain in place and fully operational, to ensure the security (i.e., confidentiality, integrity and availability) of Sensitive Information stored or processed for the FTC using such network or facility.

(2) Supporting documentation; inspection. The FTC reserves the right to require at any time that the Contractor, without undue delay and at its own cost, produce documentation, including, for example, an IT system security plan, an independent audit or review, or other records or information sufficient to demonstrate to the FTC’s satisfaction the adequacy of the safeguards applicable to the network or facility. The COTR, at the direction of the Contracting Officer (CO) or as requested by the FTC’s CISO or CPO, shall exercise this right on behalf of the FTC by written notice to the Contractor, describing the nature and scope of documentation to be produced and setting forth the time period within which such documentation must be produced. The Contractor may also be required to make the relevant network or facilities reasonably available for physical inspection or audit by the FTC or other authorized Government or non-Government representatives. The COTR may extend the time period for compliance as the COTR deems appropriate.

(3) Remedies. In the event the Contractor fails to produce the documentation and/or reasonably permit the inspection, if any, required by the FTC under paragraph (d)(2) within the specified time period, or if the FTC at any time is notified or otherwise believes that the applicable safeguards are no longer operational or sufficient to protect Sensitive Information, the FTC, by written notice to the Contractor, may take any and all steps that it deems reasonable and necessary to protect such Sensitive Information, including, but not limited to:

(i) requiring that the Contractor no longer use the network or facility to perform work required by the contract;

(ii) requiring that the Contractor, at no additional cost to the FTC, ensure and certify that certain additional security controls approved or specified by the FTC have been implemented before the Contractor may continue to use such network or facilities;

(iii) requiring that the Contractor, at no additional cost to the FTC, use alternate networks or facilities approved by the FTC;

(iv) requiring that the Contractor use networks, facilities, or equipment furnished by the FTC; and/or

(v) suspending the Contractor’s performance or terminating the contract.

(e) Additional Requirements to Protect Sensitive Information.

(1) Photocopying, Facsimile Transmissions. The FTC has contractual arrangements with approved off-site photocopying and facsimile (fax) facilities. In the event the Contractor is required to photocopy or fax Sensitive Information off-site, the Contractor shall use photocopying or fax facilities designated by the COTR, or notify and seek the COTR’s express approval for the use of alternative facilities.

(2) Check-in Check-Out Moves (CICOM). If the Contractor is assigned any Government- furnished property (e.g., laptops, thumb drives, BlackBerrys, cell phones, identification badges or other official credentials), office space, or network system access (e.g., FTC email accounts, access rights to FTC or commercial subscription databases), the Contractor agrees to participate in the FTC’s CICOM process to ensure that all such property (e.g., records, equipment) is returned and that all logical and physical access rights are properly discontinued or revoked.

(3) Redaction. In the event the Contractor is required to redact documents electronically for delivery to or on behalf of the FTC, the Contractor shall use electronic redaction software or other equipment and technology as directed by the COTR to ensure that such redaction is done securely, completely and otherwise properly.

(4) Training. If the Contractor or its personnel have been granted FTC network access, the Contractor agrees that all such persons shall take FTC-mandated privacy and data security training and/or such other additional training as the COTR may specify.

(5) Web sites. Unless expressly authorized by this contract, the Contractor shall not operate any Web site or page (e.g., to collect, process, or disseminate information) on behalf of the FTC without prior written approval of the COTR, in order to ensure that such Web site complies with all requirements under applicable law, regulation, and policy (e.g., OMB Memoranda 10-22 and 10¬23).

(6) Subcontracting. Unless expressly authorized by this contract, Contractor may not subcontract performance of any work required under this contract without the express written approval of the FTC Contracting Officer. The Contractor shall, by separate contract or other separate binding agreement, require that all subcontractors who may handle or have access to Sensitive Information for the FTC comply with all requirements set forth in this provision.

1152.224-91 Safeguarding Personally Identifiable Information (February 2022)

A. Applicability and Scope.

These provisions are mandatory and binding on all contractors in performing services or supplying goods under this contract. (For purposes of these provisions, “contractor” shall include the contractor’s officials, employees, agents, and subcontractors, if any.) Compliance with these provisions do not relieve the contractor of its duty to comply with all other laws, rules, policies, procedures, and guidance governing information privacy and security, where applicable, including, but not limited to:

· Privacy Act of 1974 (5 U.S.C. § 552a) and implementing FTC guidance for systems of records subject to that Act

· OMB Circular No. A-130 (Managing Information as a Strategic Resource)

· OMB Circular No. A-108 (Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act), or other contract requirements relating to privacy and security that may be incorporated by reference. See FAR Clauses:

· 52.224-1 (Privacy Act Notification)

· 52.224-2 (Privacy Act)

· 52.224-3 (Privacy Training)

· 52.239-1 (Privacy or Security Safeguards)

· 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)

Likewise, these provisions do not override or supersede any additional custodial procedures or notice requirements imposed by the FTC Act (see section 21 of the FTC Act, 15 U.S.C. § 57b-2; 16 C.F.R. § 4.10), Freedom of Information Act (5 U.S.C. § 552) or by other applicable law, regulation, order, or other FTC-specific requirements that may be separately incorporated into this contract (see, FTC 1152.203-90 (FTC Non-Disclosure), 1152.204-90 (Contractor Personnel Security Requirements), 1152.224-93 (Data Incidents and Breaches).

B. Definitions.

1. Personally Identifiable Information (PII).

PII is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. See OMB Memorandum M-17-12. Information that is not PII can become PII whenever additional information becomes available – in any medium or from any source – that would make it possible to identify an individual.

2. Sensitive Personally Identifiable Information (SPII).

SPII is a specific subset of PII where certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual. SPII refers to the following information, whether in paper, in electronic form, or communicated orally:

a. An individual's Social Security Number (SSN);

b. Sensitive Health Information (as defined below);

c. A Biometric Identifier (as defined below); or

d. An individual’s name, address, or phone number in combination with one or more of the following:

i. date of birth;

ii. driver’s license number or other state identification number, or foreign country equivalent;

iii. military identification number;

iv. passport number;

v. financial account number;

vi. credit or debit card number.

Sometimes multiple pieces of information, none of which may be particularly sensitive on their own, may present an increased risk of harm to the individual when combined. Accordingly, some information that does not fall within the scope of (a), (b), (c), or (d) should be treated as SPII because of the context in which it is collected, maintained, or handled. For example, a list containing names of individuals who subscribe to the FTC’s consumer information updates would not be considered SPII. However, a list containing names of individuals who have reported to the FTC that they have experienced identity theft could be considered SPII. In the latter example, context is important as these individuals may be targeted for further exploits if the list of names was not maintained in a secure and confidential manner. Moreover, the sheer volume of the data or the type of information – such as potentially private information like immigration status or derogatory personal information – can impact whether PII is considered SPII. If the contractor is unsure whether any information, in context, should be treated as SPII, the contractor shall consult with the contracting officer’s representative (COR) for guidance.

If compromised, SPII could be used to cause significant harm to individuals and/or consumers. Such harm includes financial harm, identity theft, the potential for blackmail, the disclosure of private facts, mental pain and emotional distress, the disclosure of contact information for victims of abuse, the potential for secondary uses of the information which could result in fear or uncertainty, or the unwarranted exposure of the SPII, leading to humiliation or loss of self-esteem.

3. Sensitive Health Information (SHI).

SHI includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. SHI includes (but is not limited to) protected health information in personally identifiable form obtained under the Health Insurance Portability and Accountability Act (HIPAA), even if some or all direct identifiers have been removed (e.g., name, patient ID).

4. Biometric Identifier.

A Biometric Identifier refers to a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication.

a. Typical examples of Biometric Identifiers include: fingerprints, palm prints, iris and retina scans, facial characteristics, and signature and voice dynamics.

b. All Biometric Identifiers are treated as Sensitive PII, except for photographs (e.g., driver's license photographs), voice recordings (e.g., undercover tapings), and signatures, which are not subject to the procedures for handling SPII. A database of photographs and corresponding analyses by facial recognition software, however, are SPII. Likewise, voice recording and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are SPII.

C. Collection of PII.

To ensure that the FTC has the legal authority to collect PII, the contractor shall not collect PII from any individual or third party in the performance of this contract without the prior written approval of the FTC contracting officer, unless specifically provided for in this contract. Collection that requires prior approval includes the use of any tracking technology to compile, generate, collect, or maintain any information or data that is or can be linked to an individual (see definition of PII above), regardless of whether the individual consents to the collection. If the contract requires the contractor to collect information from individuals, the contractor, as required by the Privacy Act of 1974, or other law, regulation, or order, may be required to provide appropriate notice or disclosure, in a form and manner to be determined by the FTC. In performing this contract, the contractor is not permitted at any time to serve advertising or otherwise communicate with such individuals except as may be expressly provided or required by this contract. In addition, the collection of information from or about individuals may require the establishment or modification of a Privacy Act system of records and/or a Privacy Impact Assessment, as determined by the FTC, before the contractor may engage in the collection, maintenance, or use of PII from or about such individuals. In some cases, the FTC must also obtain prior clearance from the Office of Management & Budget under the Paperwork Reduction Act (PRA). The contractor shall obtain guidance from the COR on when the above requirements may apply to the contractor’s information collection activities in the performance of this contract.

D. Storage and Maintenance of SPII.

Unless otherwise specifically provided for in the contract, the contractor shall store and maintain SPII in a manner that limits access to only those individuals authorized to see the information.

1. Electronic Information.

The contractor shall limit access to SPII in electronic form to only those individuals who have signed the FTC’s Nondisclosure Agreement for Contractors and are authorized by the COR to access the SPII.

2. Paper Records.

The contractor shall store paper records and files that contain SPII in a manner that limits access to only those authorized to see the information. In order to ensure that only authorized individuals have access to the information, paper files should be secured in locked cabinet, locked office, or locked room when not in use.

3. Portable Storage Devices.

The contractor shall only use portable storage devices that are encrypted using methods consistent with FIPS 140-3, unless an alternate standard is expressly approved and accepted by the FTC, when storing, maintaining, or transferring SPII.

E. Use and Sharing of PII.

Any PII provided by the FTC, and any information (including PII) collected by the contractor on behalf of the FTC with its approval or as specified in this contract, shall not be used or shared except for the purpose for which it was collected. The contractor shall not use or share any information provided or collected by or on behalf of the FTC for any other purpose of the contractor or any third-party. When practicable, the FTC shall seek express consent from individuals before using their PII for anything other than the purpose for which it was collected. The FTC’s purposes for collecting and using PII are listed in applicable FTC Privacy Impact Assessments and FTC Privacy Act Systems of Record Notices. The contractor shall obtain guidance from the COR on whether a proposed use or sharing of PII falls within the purpose for which it was collected.

G. Transmission or Transfer of SPII.

When transmitting or transferring SPII, the contractor shall, if feasible, transmit or transfer the SPII in electronic form. Electronic transmission or transfer of SPII shall be encrypted using methods consistent with FIPS 140-3, unless an alternate standard is expressly approved and accepted by the FTC. If electronic transmission is not feasible, the contractor shall obtain guidance from the COR on approved methods for transferring (i.e., securely shipping) the SPII.

H. Disposal and Destruction of PII.

The contractor shall use the methods of disposal or destruction of PII consistent with NIST SP 800-88 Rev. 1, unless an alternate standard is expressly approved and accepted by the FTC. The contractor shall ensure that records (including PII) compiled or generated by the contractor in the performance of this contract are destroyed (or, where specified, are returned to the FTC) within the time-period specified in the contract or, if not specified, in a timely manner once contract performance has been completed. (The time-period for such destruction or disposal shall be governed by Federal records retention and destruction schedules, as applicable). Unless otherwise specifically required in this contract, the contractor shall, upon request by the FTC, certify in writing such records disposal or destruction. The contractor shall further ensure that such records are not retained (including in backup) or transferred to any other individual or entity, unless specifically permitted or required by this contract or otherwise approved by the FTC.

1152.224-92 Handling of Third-Party Requests for Access to Records

In the event that the Contractor receives any subpoena, order, or other voluntary or mandatory request for access to data first produced under the contract for the FTC, or for any other FTC materials or information, as defined by the Contractor’s nondisclosure agreement with the FTC, the Contractor shall immediately notify the Contracting Office Technical Representative (COTR) and the Contracting Officer (CO), so that the Government may intervene or take any other steps it deems necessary to protect its interests.

1152.224-93 Data Breaches

(a)…