Attachment_8-4_FTC_Clauses_LegalReferenceLibrary_2022_06-13.pdf

Federal Trade Commission Office of the Chief Administrative Services Officer

Library Division

Attachment 8.4 - FTC Specific Clauses Legal Reference Library

Attachment 8.4 – FTC Specific Clauses

Table of Contents

1152.201-90 Contracting Officer’s Representative (COR)

1152.203-91 Organizational and Individual Conflicts of Interest

1152.224-90 Special Protections for Sensitive Information – Experts and Consultants

1152.224-91 Safeguarding Personally Identifiable Information (February 2022)

1152.224-92 Handling of Third-Party Requests for Access to Records

1152.224-93 Data Breaches

1152.232-91 Electronic Invoicing and Payment Requirements

1152.232-92 Limitation of Funds

1152.242-91 Inspection and Acceptance

1152.201-90 Contracting Officer’s Representative (COR)

The contractor may accept technical direction, during the period of performance from the Contracting Officer’s Representative (COR), providing such direction is within the scope of the contract/order.

A. The COR is not authorized to change the scope of work as stated in the contract/order or obligate the Government (FTC) in any way. The Contracting Officer is the only agent for the FTC who has the authority to obligate the FTC or change the contract/order terms and conditions. Any such revision or obligation shall be authorized in writing only by the Contracting Officers. Any monies incurred beyond the dollar amount specified in this contract/order or its modifications may not be paid and does not warrant interest payments as offered under the Prompt Payment Act.

B. COR Responsibilities: A Contracting Officer’s Representative, (COR) has been named herein.

The COR is responsible for:

(1) monitoring the contractor’s technical progress, including the assessment of performance and recommending to the Contracting Officer changes in scope of work, contract/order schedules and/or specifications to meet changes in requirement;

(2) advising on technical matters within the scope of work;

(3) performing technical evaluation as required;

(4) performing technical inspections and acceptances required by this contract/order; and

(5) assisting the contractor in the resolution of technical problems encountered during performance.

1152.203-91 Organizational and Individual Conflicts of Interest

(a) Applicability (see Federal Acquisition Regulation 9.502(c)): An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential conflict of interest on a future acquisition. In the latter case, some restrictions on future activities of the contractor may be required. The same considerations apply when the Contractor is an individual, rather than an organization.

(b) The Federal Trade Commission (FTC or Commission) has determined that this Contract could result in an actual, potential, or perceived Organizational or Individual Conflict of Interest.

Specifically, work performed under this Contract could cause the Contractor to have to recuse itself, its subcontractor, or its firm from any actual, anticipated, or potential litigation or other matter in which the FTC has an interest, including, but not limited to, any FTC rulemaking, law enforcement investigation, Part 3 adjudicative (administrative) proceeding before the Commission, Federal court litigation, appeal, etc.

(c) The Contractor hereby represents that:

(1) There are no actual, potential, or perceived conflicts of interest; or

(2) There are actual, potential, or perceived conflicts of interest, but the conflict(s) can be avoided, neutralized or mitigated.

(d) If the Contractor represents that there are actual, potential, or perceived conflicts of interest, the Contractor must identify the conflicts and submit a written plan to avoid, neutralize, or mitigated said conflicts of interest prior to beginning work.

(e) The final decision as to the acceptance of the proposed plan to avoid, neutralize or mitigate any conflicts of interest rests with the Contracting Officer, after consulting with relevant FTC staff and officials. If the plan is deemed unacceptable, the FTC, in its sole discretion, may determine to waive the conflict where the public interest so warrants.

(f) If conditions change during contract performance that affect the Contractor’s conflict of interest assertion, the Contractor shall inform the Contracting Officer immediately of the change, and shall comply with the requirements of paragraph (d) above. Failure of the Contractor to comply in a timely manner with the requirement of this paragraph to notify the Contracting Officer, or the requirement of paragraph (d) to submit a proposed plan, shall be grounds for termination of the contract. The Government may deny any claim for payment for all or any portion of work performed by the Contractor, whether under this Contract or any other FTC contract, to the extent that such work, in the FTC’s sole judgment, is rendered unusable or otherwise unfit for the purpose it was required by the FTC, due to a conflict of interest that the Contractor failed to report or mitigate as required by this Contract.

(g) The Contractor shall insert the above conditions in each first tier subcontract, which shall be made binding on each such subcontractor.

1152.224-90 Special Protections for Sensitive Information – Experts and Consultants

(a) Definitions. For purposes of these requirements, the following definitions apply:

(1) “Information” includes any records, data, or other information that is: provided or made available to the Contractor by the FTC; provided or made available on the FTC’s behalf to the Contractor by a non-FTC party; created, compiled, generated, collected, or maintained for the FTC to the extent it is first produced in the performance of this contract; or delivered to the FTC under this contract, other than limited rights data or restricted computer software, see Federal Acquisition Regulation (FAR) 27.402-2.

(2) “Personally Identifiable Information” (PII). The term PII, as defined by the Office of Management and Budget in Memorandum 07-16 issued May 22, 2007, refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social Security Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

(3) “Sensitive Personally Identifiable Information” (Sensitive PII) refers to the following information, whether in paper, in electronic form, or communicated orally:

(i) An individual’s Social Security Number (SSN), Sensitive Health Information, or a Biometric Identifier; or

(ii) An individual’s name or address or phone number in combination with one or more of the following: date of birth; driver’s license number or other state identification number, or foreign country equivalent; military identification number; passport number; financial account number; or credit or debit card number.

(4) “Sensitive Health Information” (SHI) includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

(5) “Biometric Identifier” Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints; palm prints;

iris and retina scans; facial characteristics; and signature and voice dynamics. All Biometric Identifiers are treated as Sensitive Information, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone.

However, a database of photographs and corresponding analyses by facial recognition software are Sensitive Information. Likewise, voice recordings and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive Information.

(6) “Other Sensitive Information” means information filed with the FTC or the Department of Justice pursuant to the premerger notification provisions of the Hart-Scott-Rodino Act, 18 U.S.C.

7A(h), information subject to any in camera or protective order issued in any administrative or judicial proceeding, and any other confidential or sensitive information provided or made available to the Contractor by the FTC directly, or from a non-FTC party on behalf of the FTC, as identified and designated in writing to the Contractor by the Contracting Office Technical Representative

(COTR).

(7) “Sensitive Information” shall refer collectively to the categories of information defined in paragraphs (a)(3), (4), (5) and (6) of this provision.

(b) Protecting Sensitive Information: General Provisions.

Contractor is required to follow the FTC policies and procedures incorporated by reference in this provision or attached to this contract for the protection of Sensitive Information, and any superseding or supplemental policies and procedures that may be subsequently incorporated into the contract or attached hereto. These requirements shall govern the Contractor’s handling of such information when performing work for the FTC on-site and off-site (i.e., storage, transfer and shipping, traveling, sharing, disposal, and breach reporting). Contractor shall further ensure that its own data shall not be commingled with, and shall remain logically and physically separate from, Sensitive Information provided by or specifically compiled, created, stored, or processed for the FTC, except as needed on a temporary basis to carry out the analysis required by the contract and such commingled data shall not be stored or saved. Further, such Sensitive Information shall not be used for any purpose other than to carry out the Contractor’s obligations under the contract. All policies and procedures for safeguarding Sensitive PII or SHI incorporated into this contract or any modifications thereto shall apply to all Sensitive Information as defined by paragraph (a)(7) of this provision.

(c) Ensuring the Secure Use of Non-FTC Electronic IT Equipment. To provide further protection for Sensitive Information, the following conditions shall apply to the Contractor’s use of non-FTC electronic IT equipment.

(1) Prohibition on connecting unauthorized non-FTC portable electronic storage devices (PESDs), Mobile Wireless Devices (MWDs), or other non-FTC equipment to FTC networks or computers.

To protect FTC systems from the introduction of unauthorized software, viruses, and other threats, the Contractor shall not connect any non-FTC PESD or MWD (e.g., thumb or key chain drives, external hard drives, or other equipment with electronic storage or communications capability, such as digital cameras, personal digital assistants, portable digital music players, mobile phones, BlackBerrys), any laptop, or any other non-FTC equipment, to any FTC network or computer, except where expressly authorized by the terms of the contract, or by the COTR, after obtaining approval from the FTC’s Chief Information Security Officer (CISO).

(2) Limitations on using non-FTC PESDs or other non-FTC equipment to store, ship or transfer Sensitive Information. The Contractor shall not use any non-FTC PESD, MWD, or other non-FTC equipment (e.g., non-FTC laptops or desktop computers) to store, ship or transfer Sensitive Information, except where expressly authorized by the terms of this contract or by the COTR, with approval of the CISO. The FTC, in its discretion, may instead make FTC-approved equipment available to the Contractor for this purpose. In addition, Contractor shall not use any (FTC or non- FTC) PESD, MWD, or other non-FTC equipment to store, ship or transfer Sensitive Information in unencrypted form, except as expressly authorized by the terms of this contract, including any applicable policies or procedures that have been incorporated into or attached to this contract.

Such policies and procedures permit the COTR, in certain circumstances, to grant exceptions to encryption requirements for Sensitive PII; those requirements and the COTR’s authority to grant exceptions shall extend to all Sensitive Information as defined by this provision. The COTR shall consult, as necessary and appropriate, with the FTC’s Chief Privacy Officer (CPO), the CISO, and other relevant FTC officials or staff in determining whether to grant exceptions. Where encryption is required, the Contractor shall comply with technical standards designated by the FTC in paragraph (c)(4).

(3) Additional limitations on the use of non-FTC stand-alone computers and laptops.

(i) When a non-FTC stand-alone computer or laptop is connected to or otherwise made part of a non-FTC network or facility, including a stand-alone computer or laptop networked (over the Internet or otherwise) with other stand-alone computers, laptops, or other devices, its use shall be permitted only in accordance with and subject to the terms and conditions for the use of such a network and facility as set forth in paragraph (d) of this provision.

(ii) Use of non-FTC stand-alone computers or laptops to access the FTC network remotely.

Contractor may use non-FTC stand-alone computers or laptops to access the FTC network remotely (whether the information to be accessed from the network is Sensitive Information or not) only in accordance with applicable FTC security standards and procedures for secure remote access to such network, including an FTC-issued token, appropriate and active firewalls and antivirus software installed on the user’s equipment, and other technical requirements. Where the Contractor’s equipment does not satisfy such requirements, the FTC may, in its discretion, make available to the Contractor an FTC-encrypted computer or laptop for such remote access. Contractor shall be required to execute a rules of behavior form (FTC Form 734 or other designated form) before the Contractor may be granted such remote FTC network access.

(iii) Technical security standards and requirements for non-FTC stand-alone computers and laptops. Contractor must comply with the technical security standards and requirements set forth in this paragraph whenever using a non-FTC stand-alone computer or laptop to process, store, or transmit Sensitive Information. (Sensitive Information shall not be stored on such equipment except as provided under paragraph (2) above.) Access Controls: use unique user ID; use strong passphrase (minimum of 12 characters) and change it every 60 days; use session lock (i.e., lock initiates after 15 minutes or less of inactivity); apply appropriate user rights to disallow access by unauthorized users. Physical and Environmental Protections: restrict physical access to the computer from unauthorized users (e.g., store the equipment in a locked room); use a cable lock to secure the equipment;

configure the basic input/output system (BIOS) so that equipment boots from the hard drive only; remove or disable the Network Interface Card (NIC); disable wireless capabilities.

Computer Security Controls: use a FIPS 140-2 validated whole-disk encryption module, as provided in paragraph (c)(4) below; use anti-virus software.

(4) Encryption. Where encryption is required by this contract, the Contractor shall comply with National Institute of Standards and Technology (NIST) Federal Information Processing Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. The publication can be found here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf .

NIST-approved FIPS 140-2 validated vendors can be found here:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm.

The Contractor must use PGP whole-disk encryption with AES 256-bit encryption.

(5) Peer-to-Peer File-Sharing Software (P2P). The Contractor shall consult with the FTC before processing or transmitting any Sensitive Information on any stand-alone computer, laptop, or other device or network on which P2P software, programs, or applications have been installed or configured for open network use. P2P software generally refers to any software, program, application or system allowing individual users of the Internet to connect to each other and trade, share, or copy files such as music, video, photographs, and other files.

(d) Ensuring the Secure Use of Other Non-FTC Electronic IT Networks and Facilities.

(1) Limitation on use. Contractor warrants and agrees that it shall not use any non-FTC network or facility (e.g., commercial, corporate, university) to store or process Sensitive Information on behalf of the FTC, unless such network or facility is an information system currently certified and accredited under the Federal Information Security Management Act (FISMA), or such network or facility otherwise has reasonable administrative, technical, physical and procedural controls, including a program of continuous monitoring to ensure such controls remain in place and fully operational, to ensure the security (i.e., confidentiality, integrity and availability) of Sensitive Information stored or processed for the FTC using such network or facility.

(2) Supporting documentation; inspection. The FTC reserves the right to require at any time that the Contractor, without undue delay and at its own cost, produce documentation, including, for example, an IT system security plan, an independent audit or review, or other records or information sufficient to demonstrate to the FTC’s satisfaction the adequacy of the safeguards applicable to the network or facility. The COTR, at the direction of the Contracting Officer (CO) or as requested by the FTC’s CISO or CPO, shall exercise this right on behalf of the FTC by written notice to the Contractor, describing the nature and scope of documentation to be produced and setting forth the time period within which such documentation must be produced. The Contractor may also be required to make the relevant network or facilities reasonably available for physical inspection or audit by the FTC or other authorized Government or non-Government representatives. The COTR may extend the time period for compliance as the COTR deems appropriate.

(3) Remedies. In the event the Contractor fails to produce the documentation and/or reasonably permit the inspection, if any, required by the FTC under paragraph (d)(2) within the specified time period, or if the FTC at any time is notified or otherwise believes that the applicable safeguards are no longer operational or sufficient to protect Sensitive Information, the FTC, by written notice to the Contractor, may take any and all steps that it deems reasonable and necessary to protect such Sensitive Information, including, but not limited to:

(i) requiring that the Contractor no longer use the network or facility to perform work required by the contract;

(ii) requiring that the Contractor, at no additional cost to the FTC, ensure and certify that certain additional security controls approved or specified by the FTC have been implemented before the Contractor may continue to use such network or facilities;

(iii) requiring that the Contractor, at no additional cost to the FTC, use alternate networks or facilities approved by the FTC;

(iv) requiring that the Contractor use networks, facilities, or equipment furnished by the FTC; and/or

(v) suspending the Contractor’s performance or terminating the contract.

(e) Additional Requirements to Protect Sensitive Information.

(1) Photocopying, Facsimile Transmissions. The FTC has contractual arrangements with approved off-site photocopying and facsimile (fax) facilities. In the event the Contractor is required to photocopy or fax Sensitive Information off-site, the Contractor shall use photocopying or fax facilities designated by the COTR, or notify and seek the COTR’s express approval for the use of alternative facilities.

(2) Check-in Check-Out Moves (CICOM). If the Contractor is assigned any Government-furnished property (e.g., laptops, thumb drives, BlackBerrys, cell phones, identification badges or other official credentials), office space, or network system access (e.g., FTC email accounts, access rights to FTC or commercial subscription databases), the Contractor agrees to participate in the FTC’s CICOM process to ensure that all such property (e.g., records, equipment) is returned and that all logical and physical access rights are properly discontinued or revoked.

(3) Redaction. In the event the Contractor is required to redact documents electronically for delivery to or on behalf of the FTC, the Contractor shall use electronic redaction software or other equipment and technology as directed by the COTR to ensure that such redaction is done securely, completely and otherwise properly.

(4) Training. If the Contractor or its personnel have been granted FTC network access, the Contractor agrees that all such persons shall take FTC-mandated privacy and data security training and/or such other additional training as the COTR may specify.

(5) Web sites. Unless expressly authorized by this contract, the Contractor shall not operate any Web site or page (e.g., to collect, process, or disseminate information) on behalf of the FTC without prior written approval of the COTR, in order to ensure that such Web site complies with all requirements under applicable law, regulation, and policy (e.g., OMB Memoranda 10-22 and 10¬23).

(6) Subcontracting. Unless expressly authorized by this contract, Contractor may not subcontract performance of any work required under this contract without the express written approval of the FTC Contracting Officer. The Contractor shall, by separate contract or other separate binding agreement, require that all subcontractors who may handle or have access to Sensitive Information for the FTC comply with all requirements set forth in this provision.

1152.224-91 Safeguarding Personally Identifiable Information (February 2022)

A. Applicability and Scope.

These provisions are mandatory and binding on all contractors in performing services or supplying goods under this contract. (For purposes of these provisions, “contractor” shall include the contractor’s officials, employees, agents, and subcontractors, if any.) Compliance with these provisions do not relieve the contractor of its duty to comply with all other laws, rules, policies, procedures, and guidance governing information privacy and security, where applicable, including, but not limited to:

Privacy Act of 1974 (5 U.S.C. § 552a) and implementing FTC guidance for systems of records subject to that Act

OMB Circular No. A-130 (Managing Information as a Strategic Resource) OMB Circular No. A-108 (Federal Agency Responsibilities for Review, Reporting, and

Publication under the Privacy Act), or other contract requirements relating to privacy and security that may be incorporated by reference. See FAR Clauses:

o 52.224-1 (Privacy Act Notification) o 52.224-2 (Privacy Act) o 52.224-3 (Privacy Training) o 52.239-1 (Privacy or Security Safeguards) o 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)

Likewise, these provisions do not override or supersede any additional custodial procedures or notice requirements imposed by the FTC Act (see section 21 of the FTC Act, 15 U.S.C. § 57b-2;

16 C.F.R. § 4.10), Freedom of Information Act (5 U.S.C. § 552) or by other applicable law, regulation, order, or other FTC-specific requirements that may be separately incorporated into this contract (see, FTC 1152.203-90 (FTC Non-Disclosure), 1152.204-90 (Contractor Personnel Security Requirements), 1152.224-93 (Data Incidents and Breaches).

B. Definitions.

1. Personally Identifiable Information (PII).

PII is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. See OMB Memorandum M-17-12. Information that is not PII can become PII whenever additional information becomes available – in any medium or from any source – that would make it possible to identify an individual.

2. Sensitive Personally Identifiable Information (SPII).

SPII is a specific subset of PII where certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual. SPII refers to the following information, whether in paper, in electronic form, or communicated orally:

a. An individual's Social Security Number (SSN);

b. Sensitive Health Information (as defined below);

c. A Biometric Identifier (as defined below); or

d. An individual’s name, address, or phone number in combination with one or more of the following:

i. date of birth;

ii. driver’s license number or other state identification number, or foreign country equivalent;

iii. military identification number;

iv. passport number;

v. financial account number;

vi. credit or debit card number.

Sometimes multiple pieces of information, none of which may be particularly sensitive on their own, may present an increased risk of harm to the individual when combined. Accordingly, some information that does not fall within the scope of (a), (b), (c), or (d) should be treated as SPII because of the context in which it is collected, maintained, or handled. For example, a list containing names of individuals who subscribe to the FTC’s consumer information updates would not be considered SPII. However, a list containing names of individuals who have reported to the FTC that they have experienced identity theft could be considered SPII. In the latter example, context is important as these individuals may be targeted for further exploits if the list of names was not maintained in a secure and confidential manner. Moreover, the sheer volume of the data or the type of information – such as potentially private information like immigration status or derogatory personal information – can impact whether PII is considered SPII. If the contractor is unsure whether any information, in context, should be treated as SPII, the contractor shall consult with the contracting officer’s representative (COR) for guidance.

If compromised, SPII could be used to cause significant harm to individuals and/or consumers.

Such harm includes financial harm, identity theft, the potential for blackmail, the disclosure of private facts, mental pain and emotional distress, the disclosure of contact information for victims of abuse, the potential for secondary uses of the information which could result in fear or uncertainty, or the unwarranted exposure of the SPII, leading to humiliation or loss of self-esteem.

3. Sensitive Health Information (SHI).

SHI includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally. SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. SHI includes (but is not limited to) protected health information in personally identifiable form obtained under the Health Insurance Portability and Accountability Act (HIPAA), even if some or all direct identifiers have been removed (e.g., name, patient ID).

4. Biometric Identifier.

A Biometric Identifier refers to a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication.

a. Typical examples of Biometric Identifiers include: fingerprints, palm prints, iris and retina scans, facial characteristics, and signature and voice dynamics.

b. All Biometric Identifiers are treated as Sensitive PII, except for photographs (e.g., driver's license photographs), voice recordings (e.g., undercover tapings), and signatures, which are not subject to the procedures for handling SPII. A database of photographs and corresponding analyses by facial recognition software, however, are SPII. Likewise, voice recording and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are SPII.

C. Collection of PII.

To ensure that the FTC has the legal authority to collect PII, the contractor shall not collect PII from any individual or third party in the performance of this contract without the prior written approval of the FTC contracting officer, unless specifically provided for in this contract.

Collection that requires prior approval includes the use of any tracking technology to compile, generate, collect, or maintain any information or data that is or can be linked to an individual (see definition of PII above), regardless of whether the individual consents to the collection. If the contract requires the contractor to collect information from individuals, the contractor, as required by the Privacy Act of 1974, or other law, regulation, or order, may be required to provide appropriate notice or disclosure, in a form and manner to be determined by the FTC. In performing this contract, the contractor is not permitted at any time to serve advertising or otherwise communicate with such individuals except as may be expressly provided or required by this contract. In addition, the collection of information from or about individuals may require the establishment or modification of a Privacy Act system of records and/or a Privacy Impact Assessment, as determined by the FTC, before the contractor may engage in the collection, maintenance, or use of PII from or about such individuals. In some cases, the FTC must also obtain prior clearance from the Office of Management & Budget under the Paperwork Reduction Act (PRA). The contractor shall obtain guidance from the COR on when the above requirements may apply to the contractor’s information collection activities in the performance of this contract.

D. Storage and Maintenance of SPII.

Unless otherwise specifically provided for in the contract, the contractor shall store and maintain SPII in a manner that limits access to only those individuals authorized to see the information.

1. Electronic Information.

The contractor shall limit access to SPII in electronic form to only those individuals who have signed the FTC’s Nondisclosure Agreement for Contractors and are authorized by the COR to access the SPII.

2. Paper Records.

The contractor shall store paper records and files that contain SPII in a manner that limits access to only those authorized to see the information. In order to ensure that only authorized individuals have access to the information, paper files should be secured in locked cabinet, locked office, or locked room when not in use.

3. Portable Storage Devices.

The contractor shall only use portable storage devices that are encrypted using methods consistent with FIPS 140-3, unless an alternate standard is expressly approved and accepted by the FTC, when storing, maintaining, or transferring SPII.

E. Use and Sharing of PII.

Any PII provided by the FTC, and any information (including PII) collected by the contractor on behalf of the FTC with its approval or as specified in this contract, shall not be used or shared except for the purpose for which it was collected. The contractor shall not use or share any information provided or collected by or on behalf of the FTC for any other purpose of the contractor or any third-party. When practicable, the FTC shall seek express consent from individuals before using their PII for anything other than the purpose for which it was collected.

The FTC’s purposes for collecting and using PII are listed in applicable FTC Privacy Impact Assessments and FTC Privacy Act Systems of Record Notices. The contractor shall obtain guidance from the COR on whether a proposed use or sharing of PII falls within the purpose for which it was collected.

G. Transmission or Transfer of SPII.

When transmitting or transferring SPII, the contractor shall, if feasible, transmit or transfer the SPII in electronic form. Electronic transmission or transfer of SPII shall be encrypted using methods consistent with FIPS 140-3, unless an alternate standard is expressly approved and accepted by the FTC. If electronic transmission is not feasible, the contractor shall obtain guidance from the COR on approved methods for transferring (i.e., securely shipping) the SPII.

H. Disposal and Destruction of PII.

The contractor shall use the methods of disposal or destruction of PII consistent with NIST SP 800-88 Rev. 1, unless an alternate standard is expressly approved and accepted by the FTC. The contractor shall ensure that records (including PII) compiled or generated by the contractor in the performance of this contract are destroyed (or, where specified, are returned to the FTC) within the time-period specified in the contract or, if not specified, in a timely manner once contract performance has been completed. (The time-period for such destruction or disposal shall be governed by Federal records retention and destruction schedules, as applicable). Unless otherwise specifically required in this contract, the contractor shall, upon request by the FTC, certify in writing such records disposal or destruction. The contractor shall further ensure that such records are not retained (including in backup) or transferred to any other individual or entity, unless specifically permitted or required by this contract or otherwise approved by the FTC.

1152.224-92 Handling of Third-Party Requests for Access to Records

In the event that the Contractor receives any subpoena, order, or other voluntary or mandatory request for access to data first produced under the contract for the FTC, or for any other FTC materials or information, as defined by the Contractor’s nondisclosure agreement with the FTC, the Contractor shall immediately notify the Contracting Office Technical Representative (COTR) and the Contracting Officer (CO), so that the Government may intervene or take any other steps it deems necessary to protect its interests.

1152.224-93 Data Breaches

(a) General duty.

In performing the work required by this contract, the Contractor shall prevent and help remedy or resolve incidents and breaches, if any, involving personally identifiable information (PII) or FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC, and to provide the FTC with all information and cooperation necessary to enable the FTC to satisfy its duties to report and respond under applicable law, regulation, or policy in the event, if any, of such an incident or breach.

(b) Definition.

The term “incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies (see 44 U.S.C. 3552). The term “breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose (see Office of Management & Budget (OMB) Memorandum 17-12).

(c) Reporting.

Contractor must immediately report to the FTC all incidents and breaches affecting or potentially affecting PII or other FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC. Contractor shall follow the procedures set forth elsewhere in this contract or modifications thereto for reporting incidents or breaches.

(d) Liability; remedies.

In the event of an incident or breach, the Contractor may be held liable in whole or in part for any unauthorized disclosure, use, maintenance, transfer, sale, destruction, or other compromise of PII or other FTC materials and information, to the extent that the Contractor, by virtue of its own acts or omissions, or those of its agents, bears responsibility for such compromise, as determined by the FTC. Such acts or omissions include, but are not limited to: failure to comply with data privacy or security requirements expressly set forth in the contract; failure to take other reasonable and appropriate precautions to prevent such compromise; or failure to report the incident or breach immediately, such that the delay results in a harm that could have been avoided or mitigated had the incident or breach been reported immediately. Remedies may include, but shall not be limited to: costs of forensic analysis or other investigation; notification to affected individuals or entities; credit monitoring services for such individuals or entities;

training; or other costs associated with mitigating or remedying the breach, or preventing further incidents or breaches.

1152.232-91 Electronic Invoicing and Payment Requirements

Invoice Processing Platform (IPP) is a secure web-based electronic invoicing and payment information service available to all Federal agencies and their supplier by the U.S. Treasury's Bureau of Fiscal Service. IPP allows Federal agencies and their suppliers to exchange electronic purchase orders, blanket agreements, delivery orders, invoices, and payment information in one easy to access web portal. This service is free of charge to government agencies and their suppliers, including services and support.

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email ippgroup@bos.frb.org or phone (866)973-3131.

Under this contract, the following information is required to be submitted as an attachment to the monthly IPP invoice:

• Contractor-generated invoice with detailed cost breakdown of the following elements:

• Labor (labor hours, labor categories, and labor rates)

• Labor overhead

• Materials / Supplies descriptions and quantities

• Subcontractor

• Consultant

• Travel

• G&A

Invoices without required attachments are subject to rejection.

Receipts are required to be submitted with the invoice as backup documentation for all materials/supplies, travel (hotel/airfare/car rental), and ODCs.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the contracting officer with its proposal or quotation.

PAYMENT AND INVOICE QUESTIONS

For payment and invoice questions, contact the Accounts Payable Branch at (304) 480-8000 option 7 or via email at AccountsPayable@fiscal.treasury.gov.

OVERPAYMENTS

In accordance with 52.212-4 section (i) 5 Overpayments: Accounts Receivable Conversion of Check Payments to EFT: If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the government, it will be converted into an electronic funds transfer (EFT). This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within 24 hours and will be shown on the regular account statement.

The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

1152.232-92 Limitation of Funds

(a) Contract Line Items in the Schedule in initial awards may be incrementally funded in an amount shown that is less than the extended price. For these items, the funded amounts that accumulate through modifications up to the extended price (as may be modified) are presently available for payment and allotted to this task order.

(b) For incrementally funded CLINS the Contractor agrees to perform up to the funded ceilings at which the total amount payable by the Government, including reimbursement in the event of termination of those item(s) for the Government’s convenience, does not exceed the total amount currently allotted to any individual CLIN (fully funded or otherwise). The Contractor is not obliged to continue work under any individual CLIN beyond the cumulatively obligated funding. If, solely by reason of failure of the Government to allot additional funds by the dates indicated in Section G.2 – Funding Status below in amounts sufficient for timely performance of the contract line items identified in paragraph (a) of this clause, the Contractor incurs additional costs in the performance of the work under this task order and if additional funds are subsequently allotted, any hours expended and material costs incurred by the contractor in excess of the funded ceiling price before the increase shall be allowable to the same extent as if the hours expended and material costs incurred had been incurred after the increase of the funded ceiling. In the event of government cause delays, an equitable adjustment may be made in the price or prices (that may include appropriate target, billing, and ceiling prices where applicable) of the items, or in the time of delivery, or both. Failure to agree to any such equitable adjustment hereunder will be a dispute concerning a question of fact under the clause entitled “Disputes.”

(c) The Government will not be obligated in any event to reimburse the Contractor in excess of the amount allotted to the task order for those item(s) regardless of anything to the contrary in the clause entitled “Termination for Convenience of the Government.” The total amount payable by the Government in the event of termination for convenience of applicable contract line item(s) for may include costs, profit, and substantiated termination settlement costs for those item(s). Nothing stated previously affects the right of the Government to terminate this task order pursuant to the clause of this contract entitled “Termination for the Convenience of the Government.”

Furthermore, in the event of a termination for convenience of the task order, for line item(s) identified in paragraph (a), the Government’s liability is limited to the total amount allotted and obligated for those line item(s) as of the date of such termination.

(d) Notwithstanding the dates specified in the allotment schedule in Section G.2 Funding Status, the Contractor shall notify the Contracting Officer in writing at least 30 days prior to the date when, in the Contractor’s best judgment, the work will reach the point at which the total amount payable by the Government, including any cost for termination for convenience, will approximate 75 percent of the total amount then allotted to the task order for performance of the applicable items. The Contractor notification shall provide: (1) the estimated date when that point will be reached; and (2) an estimate of additional funding, if any, needed to continue performance of applicable line items up to the next scheduled date for allotment of funds identified in Section G.2

- Funding Status, or up to a mutually agreed upon substitute date. The notification shall also advise the Contracting Officer of the estimated amount of additional funds that will be required for the timely performance of the items funded, for a subsequent period as may be specified in the allotment schedule in Section G.2 – Funding Status or otherwise agreed to by the parties. If, after such notification, additional funds are not allotted by the date identified in the Contractor’s notification, or by a mutually agreed substitute date, the Contracting Officer will terminate any item(s) for which additional funds have not been allotted, pursuant to the clause of this contract entitled “Termination for Convenience of the Government.”

(e) The termination provisions do not limit the rights of the Government under the clause entitled “Default.” This clause no longer applies once the task order is fully funded except with regard to the rights or obligations of the parties concerning equitable adjustments negotiated under paragraphs (d) and (e).

(f) Nothing stated previously shall be construed as authorization of voluntary services whose acceptance is prohibited under 31 U.S.C. 1342.

(g) Funding Status shows the level of funds thus far cumulatively obligated and the not-to-exceed amount that may yet be obligated.

Task Order Funding Status Recap:

Ceiling Price

Obligated Amount

Unobligated Amount

Period of Performance

Base CLIN 0001 $ $ $ Option 1 CLIN 0002 $ $ $ Option 2 CLIN 0003 $ $ $ Option 3 CLIN 0004 $ $ $ Total $ $ $

1152.242-91 Inspection and Acceptance

Inspection and Acceptance will be accomplished by the COR for services performed and/or products delivered.