Attachment_9-3_FTC_Clauses July 2026.pdf

Federal Trade Commission

Office of the Chief Administrative Services Officer

Logistics and Security Management Division

Attachment 9.3 - FTC Specific Clauses

Logistics and Asset Management Support Services

July 2026

Attachment 9.3 – FTC Specific Clauses

Logistics Support Services

Table of Contents

1152.201-90 Contracting Officer’s Representative (COR)

1152.203-90 FTC Non-Disclosure

1152.203-91 Organizational and Individual Conflicts of Interest

1152.204-90 Contractor Personnel Security Requirements

1152.211-90 FTC Observance of Legal Holidays - Facility Closures

1152.224-90 Special Protections for Sensitive Information – Experts and Consultants

1152.224-92 Handling of Third-Party Requests for Access to Records

1152.224-93 Data Breaches

1152.232-91 Electronic Invoicing and Payment Requirements

1152.232-92 Limitation of Funds

1152.242-91 Inspection and Acceptance

1152.201-90 Contracting Officer’s Representative (COR)

The contractor may accept technical direction, during the period of performance from the

Contracting Officer’s Representative (COR), providing such direction is within the scope of the contract/order.

A. The COR is not authorized to change the scope of work as stated in the contract/order or obligate the Government (FTC) in any way. The Contracting Officer is the only agent for the

FTC who has the authority to obligate the FTC or change the contract/order terms and conditions. Any such revision or obligation shall be authorized in writing only by the

Contracting Officers. Any monies incurred beyond the dollar amount specified in this contract/order or its modifications may not be paid and does not warrant interest payments as offered under the Prompt Payment Act.

B. COR Responsibilities: A Contracting Officer’s Representative, (COR) has been named herein. The COR is responsible for:

(1) monitoring the contractor’s technical progress, including the assessment of performance and recommending to the Contracting Officer changes in scope of work, contract/order schedules and/or specifications to meet changes in requirement;

(2) advising on technical matters within the scope of work;

(3) performing technical evaluation as required;

(4) performing technical inspections and acceptances required by this contract/order; and

(5) assisting the contractor in the resolution of technical problems encountered during performance.

1152.203-90 FTC Non-Disclosure

The unauthorized use of Federal Trade Commission files or information contained therein is a violation of the Federal Criminal Code and is punishable by a fine of up to $10,000 imprisonment of up to ten years, or both. The Contractor agrees to have each person who uses the materials relating to this contract/order execute the "NONDISCLOSURE AGREEMENT

FOR CONTRACTORS" attached hereto and return these documents to the Contracting Officer.

1152.203-91 Organizational and Individual Conflicts of Interest

(a) Applicability (see Federal Acquisition Regulation 9.502(c)): An organizational conflict of interest may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential conflict of interest on a future acquisition. In the latter case, some restrictions on future activities of the contractor may be required. The same considerations apply when the

Contractor is an individual, rather than an organization.

(b) The Federal Trade Commission (FTC or Commission) has determined that this Contract could result in an actual, potential, or perceived Organizational or Individual Conflict of Interest.

Specifically, work performed under this Contract could cause the Contractor to have to recuse itself, its subcontractor, or its firm from any actual, anticipated, or potential litigation or other matter in which the FTC has an interest, including, but not limited to, any FTC rulemaking, law enforcement investigation, Part 3 adjudicative (administrative) proceeding before the

Commission, Federal court litigation, appeal, etc.

(c) The Contractor hereby represents that:

(1) There are no actual, potential, or perceived conflicts of interest; or

(2) There are actual, potential, or perceived conflicts of interest, but the conflict(s) can be avoided, neutralized or mitigated.

(d) If the Contractor represents that there are actual, potential, or perceived conflicts of interest, the Contractor must identify the conflicts and submit a written plan to avoid, neutralize, or mitigated said conflicts of interest prior to beginning work.

(e) The final decision as to the acceptance of the proposed plan to avoid, neutralize or mitigate any conflicts of interest rests with the Contracting Officer, after consulting with relevant FTC staff and officials. If the plan is deemed unacceptable, the FTC, in its sole discretion, may determine to waive the conflict where the public interest so warrants.

(f) If conditions change during contract performance that affect the Contractor’s conflict of interest assertion, the Contractor shall inform the Contracting Officer immediately of the change, and shall comply with the requirements of paragraph (d) above. Failure of the Contractor to comply in a timely manner with the requirement of this paragraph to notify the Contracting

Officer, or the requirement of paragraph (d) to submit a proposed plan, shall be grounds for termination of the contract. The Government may deny any claim for payment for all or any portion of work performed by the Contractor, whether under this Contract or any other FTC contract, to the extent that such work, in the FTC’s sole judgment, is rendered unusable or otherwise unfit for the purpose it was required by the FTC, due to a conflict of interest that the

Contractor failed to report or mitigate as required by this Contract.

(g) The Contractor shall insert the above conditions in each first tier subcontract, which shall be made binding on each such subcontractor.

1152.204-90 Contractor Personnel Security Requirements

**SPECIAL NOTICE** - Contractor Orientation takes place on Wednesdays only. It is the CORs responsibility to coordinate with the FTC Administrative & Security staff and work with the

Contractor to ensure that all contractor personnel are sent through orientation.

A. GENERAL

The Federal Trade Commission (FTC) has determined that because this contract may require access to Federally controlled facilities, access to controlled unclassified information (CUI) and/or logical access to FTC Information Technology (IT) resources, the Contractor shall pre-screen all candidates designated for employment to perform work under this contract prior to their Entry on Duty (EOD) with the FTC to verify their compliance with minimum security fitness requirements.

Pre-screening will include, but not be limited to, the use of Employment Eligibility Verification

(E-Verify), the Office of Personnel Management (OPM) Central Verification System (CVS), and validation of the date of birth and the Social Security Number of the person/candidate prior to

EOD. See Employment Eligibility section below. For those individuals requiring access, the contractor will forward all of this information to the FTC Personnel Security Unit (PSU), which will make the determination of suitability for such individuals.

B. SUITABILITY (FITNESS) DETERMINATION

The FTC shall have and exercise full control over granting, denying, withholding or terminating access to Federal controlled facilities, access to CUI and/or logical access to FTC IT resources based upon the results of a background investigation. The FTC may, as it deems appropriate, authorize and make a favorable EOD decision based on preliminary security checks. The favorable

EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full suitability authorization will follow. The granting of a favorable EOD decision or a full suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by the FTC, at any time during the term of the contract. No employee of the Contractor performing work under the contract (Contractor Employee) shall be allowed EOD and/or access to sensitive information or systems without a favorable EOD decision or suitability determination by the PSU. No Contractor Employee shall be allowed unescorted access to an FTC facility without a favorable EOD decision or suitability determination by the

PSU. Contractor Employees who do not need access to Federally controlled facilities, access to

CUI and or logical access to IT resources will not be subject to suitability screening.

C. BACKGROUND INVESTIGATIONS

The Position Description provided by the Contracting Officer Representative (COR) for

Contractor Employees shall undergo a Position Risk Designation (PRD) based on the duties each individual will perform on the contract. The results of the PRD shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the FTC PSU.

Prospective Contractor Employees with prior favorable fitness or suitability determinations and/or security clearances (as appropriate) may be granted reciprocal recognition, to the extent practicable, when in the PSU’s sole discretion, it is determined that the prior determination or clearance meets or exceeds that which is required by the position. All Contractor Employees including any replacements or additions shall submit to fingerprinting and complete and provide the following pre-screening security forms no less than 15 business days before the starting date of the contract or 15 business days prior to the expected EOD:

1. Resume

2. Completed Credit Form – FCRA-gov

3. Completed Authorization for Release of Information – FTC 429

4. Completed Declaration for Federal Employment – OF 306

Required forms will be provided by the FTC at the time of award of the contract or upon identification of new individuals to be added to the Contractor’s workforce. Only complete packages will be accepted by the PSU. Specific instructions on submission of packages will be provided upon award of the contract. Such records shall be maintained in accordance with the

Privacy Act of 1974, 5 U.S.C. 552a.

The FTC PSU may not be able to complete a satisfactory background investigation for prospective

Contractor Employees who have not resided in the US for three of the past five years or who have not registered with the Selective Service, if required. In such cases, the FTC retains the right to deem a prospective Contractor Employee as ineligible to perform work under this contract due to insufficient background information.

D. CONTINUED ELIGIBILITY

If a prospective Contractor Employee is found to be ineligible for access to Federally controlled facilities, CUI, or FTC IT resources, the COR will advise the Contractor that the person shall not continue to work or to be assigned to perform any work under the contract requiring such access.

The PSU will perform annual fingerprinting and appropriate reinvestigation on all Contractor

Employees.

The FTC reserves the right and prerogative to deny and/ or restrict access to Government facilities, access to CUI and/or logical access to IT resources for any Contract Employee whose actions are inconsistent with or conflict with the standards of conduct that apply to Government employees, 5

CFR 2635 and 5 CFR 5701 Subpart 5.2, or whom the FTC determines to present a risk of compromising CUI to which he or she would have access under this contract.

The loss of any FTC-issued identification card or building pass must be immediately reported to the COR. The report must include the pass or card number, name of the individual to whom issued, and the last known location and disposition of the card or pass. Likewise, the loss of any FTC materials or information, and any lost device or equipment, including any device or equipment containing any personally identifiable information (PII), must be immediately reported to the COR and to the FTC Help Desk at (202) 326-3500 (24 hours, 7 days a week). Failure to comply with these requirements may result in revocation of the Contractor Employee’s continued eligibility to perform work under this contract.

The Contractor will formally report immediately to the PSU through the COR any adverse information coming to their attention concerning Contractor Employees. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of a Contractor

Employee does not obviate the requirement to submit this report. The report shall include the employee’s name and Social Security number, along with the adverse information being reported.

The PSU must be notified of all terminations/ resignations within five days of occurrence. The

Contractor will return all FTC-issued identification cards, equipment and building passes, for

Contractor Employees, as well as all FTC materials and information that terminated employees may have in their possession, to the COR. The COR will return the identification cards and building passes to the responsible PSU.

E. EMPLOYMENT ELIGIBILITY

The Contractor agrees that each Contractor Employee shall have successfully passed the FTC E-

Verify program operated by United States Citizenship and Immigration Services (USCIS) to establish work authorization.

The Contractor must record and retain the case verification number (obtained after closing a case upon completion of the search/verification) written on or attached to the I-9, which must be made available for inspection if requested by an authorized FTC or other authorized U.S. Government official.

The Contractor agrees that each Contractor Employee working on this contract shall have a Social

Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to the Government for the acts and omissions of its own employees and those of its

Subcontractor(s) and their employees.

Subject to existing law, regulations and/ or other provisions of this contract, illegal or undocumented aliens shall not be employed by the Contractor, or under this contract. The

Contractor shall ensure that this provision is expressly incorporated into any and all Subcontracts or subordinate agreements issued in support of this contract.

F. SECURITY MANAGEMENT

The Contractor shall provide a point of contact (individual) to work with the FTC PSU. This individual will interface with the PSU on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and the PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the

COR determine that the Contractor is not complying with the security requirements of this contract; the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

G. INFORMATION TECHNOLOGY

When CUI is processed using any telecommunications or automated information systems under this contract, the Contractor agrees to provide for the administrative, technical, and physical control of such data and to adhere to the IT security, privacy and confidentiality procedures governing such data including, but not limited to, those outlined in the FTC Non-

Disclosure Agreement for Contractors (FTC Form X-033).

Contractors who fail to comply with FTC IT security policy are subject to having their access to

FTC IT systems and facilities terminated, whether or not the failure results in criminal prosecution.

Any person who improperly uses, handles, or discloses protected information may be subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act of 1974, FTC

Act).

H. INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

All Contract Employees using FTC automated systems will be required to complete the annual basic FTC Security and Privacy Awareness Training, regarding security and privacy risks and vulnerabilities, accepted security practices, and system rules of behaviors. This training will be provided by the appropriate component of the FTC prior to the contractor entry date. Contractors using non-FTC systems to process FTC data under this contract must also provide security awareness training to their employees working on this contract.

Contractors involved in supporting the management, use, or operation of FTC IT systems, or, with any other significant security responsibilities, shall receive additional specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access FTC information systems will be continually evaluated while performing these duties. Supervisors should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures shall be reported immediately to the PSU and the Information Assurance Manager

(IAM).

I. APPLICABILITY TO SUBCONTRACTORS

The foregoing Contractor Employee Security Requirements shall also apply to all Subcontractors and their respective employees retained by the Contractor to perform work under this contract. The

Contractor shall incorporate these provisions into their contracts with, or shall otherwise ensure that these provisions are made legally binding on, such Subcontractors. Failure of the Contractor to ensure compliance with these requirements by its Subcontractor(s) shall constitute grounds for contract termination.

J. ADDITIONAL CONTRACT REQUIREMENTS

Contractor information systems subject to the Federal Information Security Management Act of

2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the

Contractor or its subcontractors. See 44 U.S.C 3544(b).

Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this

Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests. See also FTC

Clause 1152.224-92 Handling of Third-Party Requests for Access to Records.

Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to to prevent and remedy data breaches and to provide the FTC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the FTC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 17-12, particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information

System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the FTC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

Use of FTC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract. Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an FTC computer, may be grounds for initiating disbarment procedures. See also FTC Clause 1152.224-93 Data Incidents and Breaches

1152.211-90 FTC Observance of Legal Holidays - Facility Closures

The Federal Trade Commission observes the following days as holidays: New Year’s Day, Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, Christmas

Day, and any other day designated by Federal law, Executive Order, or Presidential

Proclamation.

When any such day falls on a Saturday or Sunday, the preceding Friday or the following Monday is observed, respectively.

1152.224-90 Special Protections for Sensitive Information – Experts and Consultants

(a) Definitions. For purposes of these requirements, the following definitions apply:

(1) “Information” includes any records, data, or other information that is: provided or made available to the Contractor by the FTC; provided or made available on the FTC’s behalf to the

Contractor by a non-FTC party; created, compiled, generated, collected, or maintained for the

FTC to the extent it is first produced in the performance of this contract; or delivered to the FTC under this contract, other than limited rights data or restricted computer software, see Federal

Acquisition Regulation (FAR) 27.402-2.

(2) “Personally Identifiable Information” (PII). The term PII, as defined by the Office of

Management and Budget in Memorandum 07-16 issued May 22, 2007, refers to information which can be used to distinguish or trace an individual’s identity, such as their name, Social

Security Number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

(3) “Sensitive Personally Identifiable Information” (Sensitive PII) refers to the following information, whether in paper, in electronic form, or communicated orally:

(i) An individual’s Social Security Number (SSN), Sensitive Health Information, or a

Biometric Identifier; or

(ii) An individual’s name or address or phone number in combination with one or more of the following: date of birth; driver’s license number or other state identification number, or foreign country equivalent; military identification number; passport number;

financial account number; or credit or debit card number.

(4) “Sensitive Health Information” (SHI) includes medical records and other individually identifiable health information, whether on paper, in electronic form, or communicated orally.

SHI relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

(5) “Biometric Identifier” Biometric Identifier means a measurable anatomical, physiological, or behavioral characteristic collected or used for purposes of automated identity verification or other types of authentication. Typical examples of Biometric Identifiers are: fingerprints; palm prints; iris and retina scans; facial characteristics; and signature and voice dynamics. All

Biometric Identifiers are treated as Sensitive Information, except for photographs (e.g., driver’s license photographs), voice recordings (e.g., undercover tapings), and signatures, standing alone.

However, a database of photographs and corresponding analyses by facial recognition software are Sensitive Information. Likewise, voice recordings and signatures that are captured in a database so that they can be analyzed and used to verify a person’s identity or check against other entries within the database (e.g., to authenticate that a particular person has access rights to a building or computer system) are Sensitive Information.

(6) “Other Sensitive Information” means information filed with the FTC or the Department of

Justice pursuant to the premerger notification provisions of the Hart-Scott-Rodino Act, 18 U.S.C.

7A(h), information subject to any in camera or protective order issued in any administrative or judicial proceeding, and any other confidential or sensitive information provided or made available to the Contractor by the FTC directly, or from a non-FTC party on behalf of the FTC, as identified and designated in writing to the Contractor by the Contracting Office Technical

Representative (COTR).

(7) “Sensitive Information” shall refer collectively to the categories of information defined in paragraphs (a)(3), (4), (5) and (6) of this provision.

(b) Protecting Sensitive Information: General Provisions.

Contractor is required to follow the FTC policies and procedures incorporated by reference in this provision or attached to this contract for the protection of Sensitive Information, and any superseding or supplemental policies and procedures that may be subsequently incorporated into the contract or attached hereto. These requirements shall govern the Contractor’s handling of such information when performing work for the FTC on-site and off-site (i.e., storage, transfer and shipping, traveling, sharing, disposal, and breach reporting). Contractor shall further ensure that its own data shall not be commingled with, and shall remain logically and physically separate from, Sensitive Information provided by or specifically compiled, created, stored, or processed for the FTC, except as needed on a temporary basis to carry out the analysis required by the contract and such commingled data shall not be stored or saved. Further, such Sensitive

Information shall not be used for any purpose other than to carry out the Contractor’s obligations under the contract. All policies and procedures for safeguarding Sensitive PII or SHI incorporated into this contract or any modifications thereto shall apply to all Sensitive

Information as defined by paragraph (a)(7) of this provision.

(c) Ensuring the Secure Use of Non-FTC Electronic IT Equipment. To provide further protection for Sensitive Information, the following conditions shall apply to the Contractor’s use of non-

FTC electronic IT equipment.

(1) Prohibition on connecting unauthorized non-FTC portable electronic storage devices

(PESDs), Mobile Wireless Devices (MWDs), or other non-FTC equipment to FTC networks or computers. To protect FTC systems from the introduction of unauthorized software, viruses, and other threats, the Contractor shall not connect any non-FTC PESD or MWD (e.g., thumb or key chain drives, external hard drives, or other equipment with electronic storage or communications capability, such as digital cameras, personal digital assistants, portable digital music players, mobile phones, BlackBerrys), any laptop, or any other non-FTC equipment, to any FTC network or computer, except where expressly authorized by the terms of the contract, or by the COTR, after obtaining approval from the FTC’s Chief Information Security Officer (CISO).

(2) Limitations on using non-FTC PESDs or other non-FTC equipment to store, ship or transfer

Sensitive Information. The Contractor shall not use any non-FTC PESD, MWD, or other non-

FTC equipment (e.g., non-FTC laptops or desktop computers) to store, ship or transfer Sensitive

Information, except where expressly authorized by the terms of this contract or by the COTR, with approval of the CISO. The FTC, in its discretion, may instead make FTC-approved equipment available to the Contractor for this purpose. In addition, Contractor shall not use any

(FTC or non-FTC) PESD, MWD, or other non-FTC equipment to store, ship or transfer Sensitive

Information in unencrypted form, except as expressly authorized by the terms of this contract, including any applicable policies or procedures that have been incorporated into or attached to this contract. Such policies and procedures permit the COTR, in certain circumstances, to grant exceptions to encryption requirements for Sensitive PII; those requirements and the COTR’s authority to grant exceptions shall extend to all Sensitive Information as defined by this provision. The COTR shall consult, as necessary and appropriate, with the FTC’s Chief Privacy

Officer (CPO), the CISO, and other relevant FTC officials or staff in determining whether to grant exceptions. Where encryption is required, the Contractor shall comply with technical standards designated by the FTC in paragraph (c)(4).

(3) Additional limitations on the use of non-FTC stand-alone computers and laptops.

(i) When a non-FTC stand-alone computer or laptop is connected to or otherwise made part of a non-FTC network or facility, including a stand-alone computer or laptop networked (over the Internet or otherwise) with other stand-alone computers, laptops, or other devices, its use shall be permitted only in accordance with and subject to the terms and conditions for the use of such a network and facility as set forth in paragraph (d) of this provision.

(ii) Use of non-FTC stand-alone computers or laptops to access the FTC network remotely. Contractor may use non-FTC stand-alone computers or laptops to access the

FTC network remotely (whether the information to be accessed from the network is

Sensitive Information or not) only in accordance with applicable FTC security standards and procedures for secure remote access to such network, including an FTC-issued token, appropriate and active firewalls and antivirus software installed on the user’s equipment, and other technical requirements. Where the Contractor’s equipment does not satisfy such requirements, the FTC may, in its discretion, make available to the Contractor an FTC-encrypted computer or laptop for such remote access. Contractor shall be required to execute a rules of behavior form (FTC Form 734 or other designated form) before the

Contractor may be granted such remote FTC network access.

(iii) Technical security standards and requirements for non-FTC stand-alone computers and laptops. Contractor must comply with the technical security standards and requirements set forth in this paragraph whenever using a non-FTC stand-alone computer or laptop to process, store, or transmit Sensitive Information. (Sensitive Information shall not be stored on such equipment except as provided under paragraph (2) above.) Access

Controls: use unique user ID; use strong passphrase (minimum of 12 characters) and change it every 60 days; use session lock (i.e., lock initiates after 15 minutes or less of inactivity); apply appropriate user rights to disallow access by unauthorized users.

Physical and Environmental Protections: restrict physical access to the computer from unauthorized users (e.g., store the equipment in a locked room); use a cable lock to secure the equipment; configure the basic input/output system (BIOS) so that equipment boots from the hard drive only; remove or disable the Network Interface Card (NIC); disable wireless capabilities. Computer Security Controls: use a FIPS 140-2 validated whole-disk encryption module, as provided in paragraph (c)(4) below; use anti-virus software.

(4) Encryption. Where encryption is required by this contract, the Contractor shall comply with

National Institute of Standards and Technology (NIST) Federal Information Processing

Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. The publication can be found here: http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

NIST-approved FIPS 140-2 validated vendors can be found here:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. The Contractor must use

PGP whole-disk encryption with AES 256-bit encryption.

(5) Peer-to-Peer File-Sharing Software (P2P). The Contractor shall consult with the FTC before processing or transmitting any Sensitive Information on any stand-alone computer, laptop, or other device or network on which P2P software, programs, or applications have been installed or configured for open network use. P2P software generally refers to any software, program, application or system allowing individual users of the Internet to connect to each other and trade, share, or copy files such as music, video, photographs, and other files.

(d) Ensuring the Secure Use of Other Non-FTC Electronic IT Networks and Facilities.

(1) Limitation on use. Contractor warrants and agrees that it shall not use any non-FTC network or facility (e.g., commercial, corporate, university) to store or process Sensitive

Information on behalf of the FTC, unless such network or facility is an information system currently certified and accredited under the Federal Information Security

Management Act (FISMA), or such network or facility otherwise has reasonable administrative, technical, physical and procedural controls, including a program of continuous monitoring to ensure such controls remain in place and fully operational, to ensure the security (i.e., confidentiality, integrity and availability) of Sensitive

Information stored or processed for the FTC using such network or facility.

(2) Supporting documentation; inspection. The FTC reserves the right to require at any time that the Contractor, without undue delay and at its own cost, produce documentation, including, for example, an IT system security plan, an independent audit or review, or other records or information sufficient to demonstrate to the FTC’s satisfaction the adequacy of the safeguards applicable to the network or facility. The

COTR, at the direction of the Contracting Officer (CO) or as requested by the FTC’s

CISO or CPO, shall exercise this right on behalf of the FTC by written notice to the

Contractor, describing the nature and scope of documentation to be produced and setting forth the time period within which such documentation must be produced. The

Contractor may also be required to make the relevant network or facilities reasonably available for physical inspection or audit by the FTC or other authorized Government or non-Government representatives. The COTR may extend the time period for compliance as the COTR deems appropriate.

(3) Remedies. In the event the Contractor fails to produce the documentation and/or reasonably permit the inspection, if any, required by the FTC under paragraph (d)(2) within the specified time period, or if the FTC at any time is notified or otherwise believes that the applicable safeguards are no longer operational or sufficient to protect

Sensitive Information, the FTC, by written notice to the Contractor, may take any and all steps that it deems reasonable and necessary to protect such Sensitive Information, including, but not limited to:

(i) requiring that the Contractor no longer use the network or facility to perform work required by the contract;

(ii) requiring that the Contractor, at no additional cost to the FTC, ensure and certify that certain additional security controls approved or specified by the FTC have been implemented before the Contractor may continue to use such network or facilities;

(iii) requiring that the Contractor, at no additional cost to the FTC, use alternate networks or facilities approved by the FTC;

(iv) requiring that the Contractor use networks, facilities, or equipment furnished by the

FTC; and/or

(v) suspending the Contractor’s performance or terminating the contract.

(e) Additional Requirements to Protect Sensitive Information.

(1) Photocopying, Facsimile Transmissions. The FTC has contractual arrangements with approved off-site photocopying and facsimile (fax) facilities. In the event the Contractor is required to photocopy or fax Sensitive Information off-site, the Contractor shall use photocopying or fax facilities designated by the COTR, or notify and seek the COTR’s express approval for the use of alternative facilities.

(2) Check-in Check-Out Moves (CICOM). If the Contractor is assigned any

Government-furnished property (e.g., laptops, thumb drives, BlackBerrys, cell phones, identification badges or other official credentials), office space, or network system access

(e.g., FTC email accounts, access rights to FTC or commercial subscription databases), the Contractor agrees to participate in the FTC’s CICOM process to ensure that all such property (e.g., records, equipment) is returned and that all logical and physical access rights are properly discontinued or revoked.

(3) Redaction. In the event the Contractor is required to redact documents electronically for delivery to or on behalf of the FTC, the Contractor shall use electronic redaction software or other equipment and technology as directed by the COTR to ensure that such redaction is done securely, completely and otherwise properly.

(4) Training. If the Contractor or its personnel have been granted FTC network access, the Contractor agrees that all such persons shall take FTC-mandated privacy and data security training and/or such other additional training as the COTR may specify.

(5) Web sites. Unless expressly authorized by this contract, the Contractor shall not operate any Web site or page (e.g., to collect, process, or disseminate information) on behalf of the FTC without prior written approval of the COTR, in order to ensure that such Web site complies with all requirements under applicable law, regulation, and policy (e.g., OMB Memoranda 10-22 and 10¬23).

(6) Subcontracting. Unless expressly authorized by this contract, Contractor may not subcontract performance of any work required under this contract without the express written approval of the FTC Contracting Officer. The Contractor shall, by separate contract or other separate binding agreement, require that all subcontractors who may handle or have access to Sensitive Information for the FTC comply with all requirements set forth in this provision.

1152.224-92 Handling of Third-Party Requests for Access to Records

In the event that the Contractor receives any subpoena, order, or other voluntary or mandatory request for access to data first produced under the contract for the FTC, or for any other FTC materials or information, as defined by the Contractor’s nondisclosure agreement with the FTC, the Contractor shall immediately notify the Contracting Office Technical Representative (COTR) and the Contracting Officer (CO), so that the Government may intervene or take any other steps it deems necessary to protect its interests.

1152.224-93 Data Breaches

(a) General duty.

In performing the work required by this contract, the Contractor shall prevent and help remedy or resolve incidents and breaches, if any, involving personally identifiable information (PII) or FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC, and to provide the FTC with all information and cooperation necessary to enable the FTC to satisfy its duties to report and respond under applicable law, regulation, or policy in the event, if any, of such an incident or breach.

(b) Definition.

The term “incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies (see 44 U.S.C. 3552). The term “breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose

(see Office of Management & Budget (OMB) Memorandum 17-12).

(c) Reporting.

Contractor must immediately report to the FTC all incidents and breaches affecting or potentially affecting PII or other FTC materials and information, as defined by the Contractor’s nondisclosure agreement with the FTC. Contractor shall follow the procedures set forth elsewhere in this contract or modifications thereto for reporting incidents or breaches.

(d) Liability; remedies.

In the event of an incident or breach, the Contractor may be held liable in whole or in part for any unauthorized disclosure, use, maintenance, transfer, sale, destruction, or other compromise of PII or other FTC materials and information, to the extent that the Contractor, by virtue of its own acts or omissions, or those of its agents, bears responsibility for such compromise, as determined by the FTC. Such acts or omissions include, but are not limited to: failure to comply with data privacy or security requirements expressly set forth in the contract; failure to take other reasonable and appropriate precautions to prevent such compromise; or failure to report the incident or breach immediately, such that the delay results in a harm that could have been avoided or mitigated had the incident or breach been reported immediately. Remedies may include, but shall not be limited to: costs of forensic analysis or other investigation; notification to affected individuals or entities; credit monitoring services for such individuals or entities;

training; or other costs associated with mitigating or remedying the breach, or preventing further incidents or breaches.

1152.232-91 Electronic Invoicing and Payment Requirements

I Invoice Processing Platform (IPP) is a secure web-based electronic invoicing and payment information service available to all Federal agencies and their supplier by the U.S. Treasury's

Bureau of Fiscal Service. IPP allows Federal agencies and their suppliers to exchange electronic purchase orders, blanket agreements, delivery orders, invoices, and payment information in one easy to access web portal. This service is free of charge to government agencies and their suppliers, including services and support.

Payment requests must be submitted electronically through the U. S. Department of the

Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the

Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. Assistance with enrollment can be obtained by contacting the IPP Production

Helpdesk via email ippgroup@bos.frb.org or phone (866)973-3131.

Under this contract, the following information is required to be submitted as an attachment to the monthly IPP invoice:

• Contractor-generated invoice with detailed cost breakdown of the following elements:

• Labor (labor hours, labor categories, and labor rates)

• Labor overhead

• Materials / Supplies descriptions and quantities

• Subcontractor

• Consultant

• Travel

• G&A

Invoices without required attachments are subject to rejection.

Receipts are required to be submitted with the invoice as backup documentation for all materials/supplies, travel (hotel/airfare/car rental), and ODCs.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the contracting officer with its proposal or quotation.

PAYMENT AND INVOICE QUESTIONS

For payment and invoice questions, contact the Accounts Payable Branch at (304) 480-8000 option 7 or via email at AccountsPayable@fiscal.treasury.gov.

OVERPAYMENTS

In accordance with 52.212-4 section (i) 5 Overpayments: Accounts Receivable Conversion of

Check Payments to EFT: If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the government, it will be converted into an electronic funds transfer (EFT). This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check.

The debit from the Contractor’s account will usually occur within 24 hours and will be shown on the regular account statement.

The Contractor will not receive the original check back. The Government will destroy the

Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

1152.232-92 Limitation of Funds

(a) Contract Line Items in the Schedule in initial awards may be incrementally funded in an amount shown that is less than the extended price. For these items, the funded amounts that accumulate through modifications up to the extended price (as may be modified) are presently available for payment and allotted to this task order.

(b) For incrementally funded CLINS the Contractor agrees to perform up to the funded ceilings at which the total amount payable by the Government, including reimbursement in the event of termination of those item(s) for the Government’s convenience, does not exceed the total amount currently allotted to any individual CLIN (fully funded or otherwise). The Contractor is not obliged to continue work under any individual CLIN beyond the cumulatively obligated funding.

If, solely by reason of failure of the Government to allot additional funds by the dates indicated in Section G.2 – Funding Status below in amounts sufficient for timely performance of the contract line items identified in paragraph (a) of this clause, the Contractor incurs additional costs in the performance of the work under this task order and if additional funds are subsequently allotted, any hours expended and material costs incurred by the contractor in excess of the funded ceiling price before the increase shall be allowable to the same extent as if the hours expended and material costs incurred had been incurred after the increase of the funded ceiling. In the event of government cause delays, an equitable adjustment may be made in the price or prices (that may include appropriate target, billing, and ceiling prices where applicable) of the items, or in the time of delivery, or both. Failure to agree to any such equitable adjustment hereunder will be a dispute concerning a question of fact under the clause entitled “Disputes.”

(c) The Government will not be obligated in any event to reimburse the Contractor in excess of the amount allotted to the task order for those item(s) regardless of anything to the contrary in the clause entitled “Termination for Convenience of the Government.” The total amount payable by the Government in the event of termination for convenience of applicable contract line item(s) for may include costs, profit, and substantiated termination settlement costs for those item(s).

Nothing stated previously affects the right of the Government to terminate this task order pursuant to the clause of this contract entitled “Termination for the Convenience of the

Government.” Furthermore, in the event of a termination for convenience of the task order, for line item(s) identified in paragraph (a), the Government’s liability is limited to the total amount allotted and obligated for those line item(s) as of the date of such termination.

(d) Notwithstanding the dates specified in the allotment schedule in Section G.2 Funding Status, the Contractor shall notify the Contracting Officer in writing at least 30 days prior to the date when, in the Contractor’s best judgment, the work will reach the point at which the total amount payable by the Government, including any cost for termination for convenience, will approximate 75 percent of the total amount then allotted to the task order for performance of the applicable items. The Contractor notification shall provide: (1) the estimated date when that point will be reached; and (2) an estimate of additional funding, if any, needed to continue performance of applicable line items up to the next scheduled date for allotment of funds identified in Section G.2 - Funding Status, or up to a mutually agreed upon substitute date. The notification shall also advise the Contracting Officer of the estimated amount of additional funds that will be required for the timely performance of the items funded, for a subsequent period as may be specified in the allotment schedule in Section G.2 – Funding Status or otherwise agreed to by the parties. If, after such notification, additional funds are not allotted by the date identified in the Contractor’s notification, or by a mutually agreed substitute date, the Contracting Officer will terminate any item(s) for which additional funds have not been allotted, pursuant to the clause of this contract entitled “Termination for Convenience of the Government.”

(e) The termination provisions do not limit the rights of the Government under the clause entitled “Default.” This clause no longer applies once the task order is fully funded except with regard to the rights or obligations of the parties concerning equitable adjustments negotiated under paragraphs (d) and (e).

(f) Nothing stated previously shall be construed as authorization of voluntary services whose acceptance is prohibited under 31 U.S.C. 1342.

(g) Funding Status shows the level of funds thus far cumulatively obligated and the not-to-exceed amount that may yet be…