Attachment C Nondisclosure Agreement.docx

Attachment C Nondisclosure Agreement

NONDISCLOSURE AGREEMENT (NOV 2023)

I, _________________, during the performance of my work under Contract No. _____________ for the Federal Housing Finance Agency (FHFA) and after completing such performance, shall not disclose without the prior written approval of the FHFA’s Contracting Officer (CO) any Controlled Unclassified Information (CUI) obtained by, produced by, or disclosed to me in connection with my performance of work for FHFA to anyone other than persons within FHFA, who already have access to such CUI, or persons in my organization who are properly entitled to such information for the performance of their official duties. FHFA CUI obtained, produced, or disclosed under this contract constitutes FHFA Non-Public Information, a category of CUI. FHFA Non-Public Information is information in any medium, whether electronic, hard copy, or unwritten, that FHFA has not made public, that is created by, obtained by, or communicated to an FHFA employee or FHFA contractor personnel, in connection with the performance of official duties, regardless of who is in possession of the information. FHFA CUI includes, but is not limited to, information of the Federal National Mortgage Association, the Federal Home Loan Mortgage Corporation, and the Federal Home Loan Banks (collectively, the regulated entities), the Office of Finance of the Federal Home Loan Bank System (Office of Finance), or FHFA. FHFA CUI includes information in any form, including documents, electronic mail, computer files, conversations, audio or video recordings, and internal information technology infrastructure components, including Internet Protocols.

I will handle all CUI received and/or produced pursuant to this contract in accordance with (1) Executive Order 13556, Controlled Unclassified Information, 75 FR 68675 (Nov. 4, 2010); (2) 32 C.F.R. Part 2002; and (3) the CUI Registry (available at: https://www.archives.gov/cui). Unless otherwise directed by the Contracting Officer’s Representative (COR), I will mark all CUI in accordance with FHFA Policy No. 222, Controlled Unclassified Information Policy and the associated CUI Procedures. If I do not have access to FHFA’s intranet, I will request a copy of the CUI Policy and Procedures from the COR. I acknowledge that misuse of CUI may be subject to penalties established in applicable Federal laws, regulations, or Government-wide policies. I agree to report noncompliance with CUI handling requirements to FHFA's COR (used in this clause to mean the COR or the Invoice Approver).

I shall take all reasonable measures to avoid unintentional or inadvertent disclosure by me of FHFA CUI, and shall return to FHFA any such information, or copies thereof, not later than the date I have completed performance of my work. Should a question arise as to whether particular information is FHFA CUI, I shall immediately contact the FHFA COR and seek a determination as to the information’s status. In the absence of a COR, I shall immediately contact the FHFA CO. If the FHFA COR or CO notifies me that the information is FHFA CUI, I shall treat it in accordance with this Agreement.

If I create, receive or have access to personally identifiable information (PII) in the course of performing this contract, I understand that I must comply with FHFA Policy No. 301, Use and Protection of Personally Identifiable Information Policy, with respect to using and protecting PII, which is also a category of CUI. FHFA Policy No. 301 is available on FHFA’s intranet. If I do not have access to FHFA’s intranet, I will request a copy of FHFA Policy No. 301 from the FHFA COR. If required by FHFA, I acknowledge that I shall attend annual and role-based privacy awareness training. For the purposes of this clause, PII is defined as information that can be used to distinguish or trace an individual’s identity, such as name, home address, telephone number, social security number, or biometric records, alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date of birth, mother’s maiden name, and truncated or partial social security numbers.

I agree that if I become aware of an incident involving FHFA CUI, I will immediately notify the FHFA Help Desk at (202) 649-3990 or HelpDesk@fhfa.gov between 7:00 a.m. – 7:00 p.m. ET. After business hours and during office closures (e.g., holidays), I will report incidents via telephone. I shall immediately thereafter notify the CO and COR of any incident involving CUI.

I shall not use or permit the use of FHFA CUI obtained by me as a result of my performance of work for FHFA for private gain for myself or any other person or entity by direct action on my part or by counsel, recommendation, or suggestions to another person or entity.

In accordance with 12 C.F.R. Part 1215, unless by judicial order directed otherwise (after providing the CO with notice as specified below), I understand that I am prohibited from testifying in court or otherwise with respect to information obtained by, produced by, or disclosed to me in connection with my performance of work under this contract, and I am prohibited from furnishing documents of FHFA, the regulated entities, or the Office of Finance, or copies thereof, in compliance with a subpoena, order, or otherwise without prior written notice to the FHFA CO. I shall promptly notify the CO of any request, subpoena, court order, or other legal process requiring my attendance as a witness or the production of documents.

I understand that I am subject to criminal penalties under 18 U.S.C. 641 and 1905, and other applicable laws for the misuse or unauthorized disclosure of FHFA CUI.

EXECUTED this _______ day of _____________, 20____.

Signature: __________________________