B.01 FRTIB1-25-Q-0010.pdf

SEE ADDENDUMIS CHECKED

CODE

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

OCFO_ACQ_MGT_DIV ADMFTB LOCATION CODE 16. ADMINISTERED BY

FRTIB

77 K Street NE Suite 1000 Washington DC 20002

18a. PAYMENT WILL BE MADE BY

See section B.3.

CODE

X

X

513210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OR

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

OCFO_ACQ_MGT_DIV ISS 10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

03/26/2025 (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIME

See Clause Section E.3.1.

b. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

FRTIB1-25-Q-0010

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 27OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

FRTIB

77 K Street NE #1000 Washington DC 20002

Pending award.

Washington DC 20002 Suite 1000 77 K Street NE

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

FRTIB

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Litmus Software subscription. Please see the clauses and attachments for more info.

ronald.rheinhardt@frtib.gov <<< please email

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCEzero

PR-25-OTS-0084

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

Columns 1 9 to 24 of th is p age have been left in tentionally blank.

SECTION B - CONTINUATION BLOCK

B.1 This document consists of the following sections:

SECTION DESCRIPTION

A Standard Form 1449 B Continuation of the SF-1449 C Contract Clauses D Any Contract Documents, Exhibits or Attachments E Solicitation Provisions

(End of Section)

B.2 SF-1449 Block 16: Contract Administration To be provided at the time of award.

(End of Text)

B.3 SF-1449 Block 18A: Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice Processing Platform (IPP) system using the “Bill to Agency” of Interior Business Center – FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor. Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. The Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973 – 3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Text)

SECTION C - CONTRACT CLAUSES

C.1 FAR 52.252-2 Clauses Incorporated by Reference (FEB 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/ and https://www.frtib.gov/pdf/procurement/Thrift_Federal_Acquisition_Supplement_T-FAS.pdf

(End of Clause)

C.2 Notice Listing Clauses Incorporated by Reference The following clauses are hereby incorporated by reference (by Citation Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" contained in this document. See FAR 52.252-2 for an internet address (if specified) for electronic access to the full text of a clause.

FEDERAL ACQUISITION REGULATION (48 CFR Chapter 1) FAR Number Citation Title Date

FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment OCT 2020

FAR 52.216-18 Ordering AUG 2020 FAR 52.216-21 Requirements OCT 1995 FAR 52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

(End of Text)

C.3 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders— Commercial Items (JAN 2025)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C.

3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.] _x_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_x_ (4) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

__ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub.

L. 109-282) ( 31 U.S.C. 6101 note).

__ (6) [Reserved].

__ (7) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_x_ (9) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Dec 2023) (Pub. L. 115–390, title

II).

__ (11)(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Dec 2023) (Pub.

L. 115–390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204-30.

__ (12) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. (Jan 2025) (31 U.S.C. 6101 note).

__ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Oct 2022) (15 U.S.C. 657a).

__ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved] __ (18)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (19)(i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (20) 52.219-8, Utilization of Small Business Concerns (Jan 2025)(15 U.S.C. 637(d)(2) and (3)).

__ (21)(i) 52.219-9, Small Business Subcontracting Plan (Jan 2025) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Jan 2025) of 52.219-9.

__ (22)(i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (23) 52.219-14, Limitations on Subcontracting (Oct 2022) (15 U.S.C. 657s).

__ (24) 52.219-16, Liquidated Damages—Subcontracting Plan (Sep 2021) (15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (Feb 2024) (15 U.S.C. 657f).

__ (26)(i) 52.219-28, Postaward Small Business Program Rerepresentation (Jan 2025) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Oct 2022) (15 U.S.C. 637(m)).

__ (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (Sep 2021) (15 U.S.C. 637(a)(17)).

__ (31) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

__ (32) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2025)(E.O. 13126).

__ (33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

__ (34)(i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

__ (35)(i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

__ (36)(i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

__ (37) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

__ (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_x_ (39)(i) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (40) 52.222-54, Employment Eligibility Verification (Jan 2025) (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (41)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (May 2024) (42 U.S.C. 7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (May 2024) (42 U.S.C. 7671, et seq.).

__ (44) 52.223-20, Aerosols (May 2024) (42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (May 2024) (42 U.S.C. 7671, et seq.).

__ (46) 52.223-23, Sustainable Products and Services (May 2024) (E.O. 14057, 7 U.S.C. 8102, 42 U.S.C.

6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47)(i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48)(i) 52.225-1, Buy American-Supplies (Oct 2022) (41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__ (49)(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV 2023) (19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501- 4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112- 41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Jan 2025) of 52.225-3.

__ (iv) Alternate III (Feb 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (NOV 2023) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_x_ (51) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

_x_ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (May 2024) (E.O.

13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

__ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) (31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

__ (62) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (63) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (Nov 2024) (Sections 1821-1826, Pub. L. 118-31, 41 U.S.C.

3901 note prec.).

__ (64) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

__ (65)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C.

55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.] __ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

__ (10) 52.247-69, Reporting Requirement for U.S.-Flag Air Carriers Regarding Training to Prevent Human Trafficking (Jan 2025) (49 U.S.C. 40118(g)).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement.

Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

(vii)(A) 52.204–30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Dec 2023) (Pub. L.

115–390, title II).

(B) Alternate I (Dec 2023) of 52.204–30.

(viii) 52.219-8, Utilization of Small Business Concerns (Jan 2025) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(x) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

(xi) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O.

13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(xvi)(A) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (Jan 2025) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

(xxii)(A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C.

3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (Nov 2024) (Sections 1821-1826, Pub. L. 118-31, 41 U.S.C.

3901 note prec.).

(xxvii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C.

55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247- 64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

C.4 52.217-8 Option to Extend Services (NOV 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

C.5 52.217-9 Option to Extend the Term of the Contract (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five (5) years.

C.6 Safeguarding Controlled Unclassified Information (CUI) (JULY 2020) - H.1

(a) Defini ons. As used H.1 in this clause— “Adequate security” means protec ve measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modifica on of informa on.

“Covered contractor informa on system” means an unclassified informa on system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Informa on.

“Controlled Unclassified Informa on” means unclassified controlled technical informa on or other informa on, as described in the Controlled Unclassified Informa on Registry at h p://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemina on controls pursuant to and consistent with law, regula ons, and Government-wide policies, and is—

(1) Marked or otherwise iden fied in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmi ed, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer so ware” means computer programs, source code, source code lis ngs, object code lis ngs, design details, algorithms, processes, flow charts, formulae and related material that would enable the so ware to be reproduced, recreated, or recompiled. Computer so ware does not include computer data bases or computer so ware documenta on.

“Informa on system” means a discrete set of informa on resources organized for the collec on, processing, maintenance, use, sharing, dissemina on, or disposi on of informa on.

“Technical informa on” means technical data or computer so ware, as those terms are defined in this clause--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicita on or contract. Examples of technical informa on include research and engineering data, engineering drawings, and associated lists, specifica ons, standards, process sheets, manuals, technical reports, technical orders, catalog-item iden fica ons, data sets, studies and analyses and related informa on, and computer so ware executable code and source code.

“Technical data” means recorded informa on, regardless of the form or method of the recording, of a scien fic or technical nature (including computer so ware documenta on). The term does not include computer so ware or data incidental to contract administra on, such as financial and/or management informa on.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor informa on systems. To provide adequate security, the Contractor shall implement, at a minimum, the following informa on security protec ons:

(1) For covered contractor informa on systems that are part of, and Informa on Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud compu ng services shall be subject to the security requirements specified in the Cloud Compu ng Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud compu ng) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor informa on systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor informa on system shall be subject to the security requirements in Na onal Ins tute of Standards and Technology (NIST) Special Publica on (SP) 800-171, “Protec ng Controlled Unclassified Informa on in Nonfederal Informa on Systems and Organiza ons” (available via the internet at h ps://csrc.nist.gov/publica ons/detail/sp/800-171/rev-2/final) in effect at the me the solicita on is issued or as authorized by the Contrac ng Officer.

(ii)(A) The Contractor shall no fy the FRTIB Chief Informa on Security Officer (CISO), via email, within 30 days of contract award of any security requirements specified by NIST SP 800-171 not implemented at the me of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in wri ng to the Contrac ng Officer, for considera on by the FRTIB Chief Technology Officer (CTO) or CISO. The Contractor need not implement any security requirement adjudicated by an authorized representa ve of the FRTIB CTO to be non-applicable or to have an alterna ve, but equally effec ve, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the me of the execu on of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indica ng that a requirement is not applicable or that an alterna ve security measure is equally effec ve, a copy of that approval shall be provided to the Contrac ng Officer when reques ng its recogni on under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered informa on in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authoriza on Management Program (FedRAMP) Moderate baseline (h ps://www.fedramp.gov/documents-templates/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Repor ng, including malicious so ware, media preserva on and protec on, access to addi onal informa on and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other informa on systems security measures when the Contractor reasonably determines that informa on systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facili es, personnel and informa on system documenta on for the purposes of audit or inspec on by an authorized regulator or designated security cer fica on ac vity to ensure appropriate informa on security prac ces are in place.

(d) The Contractor shall conduct ac vi es under this clause in accordance with applicable laws and regula ons on the intercep on, monitoring, access, use, and disclosure of electronic communica ons and data.

(e) Other safeguarding or repor ng requirements. The safeguarding and cyber incident repor ng required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident repor ng pertaining to its unclassified informa on systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(1) Subcontracts. The Contractor shall—

(2) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for opera onally cri cal support, or for which subcontract performance will involve Controlled Unclassified Informa on, including subcontracts for commercial items, without altera on, except to iden fy the par es. The Contractor shall determine if the informa on required for subcontractor performance retains its iden ty as Controlled Unclassified Informa on and will require protec on under this clause, and, if necessary, consult with the Contrac ng Officer; and

(3) Require subcontractors to no fy the prime Contractor (or next higher- er subcontractor) when submi ng a request to vary from a NIST SP 800-171 security requirement to the Contrac ng Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause.

C.7 Compliance with Controls for Safeguarding Controlled Unclassified Information (CUI) (JULY 2020) - H.2

(a) Defini ons. As used in this provision— “Controlled Unclassified Informa on (CUI),” “covered contractor informa on system,” “cyber incident,” “informa on system,” and “technical informa on” are defined in clause H.1, Safeguarding Controlled Unclassified Informa on (CUI) and H.6, Cyber Incident Repor ng.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled Unclassified Informa on (CUI) and Cyber Incident Repor ng, shall be implemented for all Controlled Unclassified Informa on (CUI) on all covered contractor informa on systems that support the performance of this contract.

(c) For covered contractor informa on systems that are not part of an informa on technology service or system operated on behalf of the Government (see (b)(2) of clause H.1, Safeguarding Controlled Unclassified Informa on (CUI) and H.6 - Cyber Incident Repor ng.

(1) By submission of this offer, the Quoter represents that it will implement the security requirements specified by Na onal Ins tute of Standards and Technology (NIST) Special Publica on (SP) 800-171 “Protec ng Controlled Unclassified Informa on (CUI) in Nonfederal Informa on Systems and Organiza ons” (see https://doi.org/10.6028/NIST.SP.800-171r3 ) that are in effect at the me the solicita on is issued or as authorized by the contrac ng officer.

(2) If the Quoter proposes to vary from any of the security requirements specified by NIST SP 800- 171 that are in effect at the me the solicita on is issued or as authorized by the Contrac ng Officer, the Quoter shall submit to the Contrac ng Officer, for considera on by the CISO, a wri en explana on of —

(i) Why a par cular security requirement is not applicable; or

(ii) How an alterna ve but equally effec ve, security measure is used to compensate for the inability to sa sfy a par cular requirement and achieve equivalent protec on.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate Quoter requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

(End of Clause)

C.8 Cloud Computing Services (JULY 2020) - H.4

(a) Defini ons. As used in this clause— “Authorizing official,” means the senior Federal official or execu ve with the authority to formally assume responsibility for opera ng an informa on system at an acceptable level of risk to organiza onal opera ons (including mission, func ons, image, or reputa on), organiza onal assets, individuals, other organiza ons, and the Na on.

“Cloud compu ng” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable compu ng resources (e.g., networks, servers, storage, applica ons, and services) that can be rapidly provisioned and released with minimal management effort or service provider interac on. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elas city, and measured service. It also includes commercial offerings for so ware-as-a-service, infrastructure-as-a-service, and pla orm-as-a-service.

“Compromise” means disclosure of informa on to unauthorized persons, or a viola on of the security policy of a system, in which unauthorized inten onal or uninten onal disclosure, modifica on, destruc on, or loss of an object, or the copying of informa on to unauthorized media may have occurred.

“Cyber incident” means ac ons taken through the use of computer networks that result in a compromise or an actual or poten ally adverse effect on an informa on system and/or the informa on residing therein.

“Government data” means any informa on, document, media, or machine-readable material regardless of physical form or characteris cs, which is created or obtained by the Government in the course of official Government business.

“Government-related data” means any informa on, document, media, or machine-readable material regardless of physical form or characteris cs that is created or obtained by a contractor through the storage, processing, or communica on of Government data. This does not include contractor’s business records e.g., financial records, legal records etc. or data such as opera ng procedures, so ware coding or algorithms that are not uniquely applied to the Government data.

“Informa on system” means a discrete set of informa on resources organized for the collec on, processing, maintenance, use, sharing, dissemina on, or disposi on of informa on.

“Media” means physical devices or wri ng surfaces including, but not limited to, magne c tapes, op cal disks, magne c disks, large-scale integra on memory chips, and printouts onto which informa on is recorded, stored, or printed within an informa on system.

“Spillage” security incident that results in the transfer of classified or controlled unclassified informa on onto an informa on system not accredited (i.e., authorized) for the appropriate security level.

(b) Cloud compu ng security requirements. The requirements of this clause are applicable when using cloud compu ng to provide informa on technology services in the performance of the contract.

(1) If the Contractor indicated in its offer that it “does not an cipate the use of cloud compu ng services in the performance of a resultant contract,” in response to provision H No. H.3_, Representa on of Use of Cloud Compu ng, and a er the award of this contract, the Contractor proposes to use cloud compu ng services in the performance of the contract, the Contractor shall obtain approval from the Contrac ng Officer prior to u lizing cloud compu ng services in performance of the contract.

(2) The Contractor shall implement and maintain administra ve, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Compu ng Security Requirements Guide (SRG) (version in effect at the me the solicita on is issued or as authorized by the Contrac ng Officer) found at h p://iase.disa.mil/cloud_security/Pages/index.aspx, unless no fied by the Contrac ng Officer that this requirement has been waived by the FRTIB Chief Informa on Officer.

(3) The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on FRTIB premises, unless the Contractor receives wri en no fica on from the Contrac ng Officer to use another loca on.

(4) All cloud compu ng service must meet security requirements equivalent to those established by the Government for the Federal Risk and Authoriza on Management Program (FedRAMP) Moderate baseline (h ps://www.fedramp.gov/resources/documents/).

(c) Limita ons on access to, and use and disclosure of Government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder.

(i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibi ons and obliga ons.

(iii) These access, use, and disclosure prohibi ons and obliga ons shall survive the expira on or termina on of this contract.

(2) The Contractor shall use Government-related data only to manage the opera onal environment that supports the Government data and for no other purpose unless otherwise permi ed with the prior wri en approval of the Contrac ng Officer.

(d) Cloud compu ng services cyber incident repor ng. The Contractor shall immediately report all actual or poten al cyber incidents that are related to the cloud compu ng service provided under this contract. Reports shall be submi ed to IncidentResponse@tsp.gov.

(e) Malicious so ware. The Contractor or subcontractors that discover and isolate malicious so ware in connec on with a reported cyber incident shall submit the malicious so ware in accordance with instruc ons provided by the Contrac ng Officer.

(f) Media preserva on and protec on. When a Contractor discovers a cyber-incident has occurred, the Contractor shall preserve and protect images of all known affected informa on systems iden fied in the cyber incident report (see sec on (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days unless directed otherwise by FRTIB CISO or CTO from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(g) Access to addi onal informa on or equipment necessary for forensic analysis. Upon request by FRTIB, the Contractor shall provide FRTIB with access to addi onal informa on or equipment that is necessary to conduct a forensic analysis.

(h) Cyber incident damage assessment ac vi es. If FRTIB elects to conduct a damage assessment, the Contrac ng Officer will request that the Contractor provide all of the damage assessment informa on gathered in accordance with paragraph (f) of this clause.

(i) Records management and facility access.

(1) The Contractor shall provide the Contrac ng Officer all Government data and Government-related data in the format specified in the contract.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirma on of disposi on to the Contrac ng Officer in accordance with contract closeout procedures.

(3) The Contractor shall provide the Government, or its authorized representa ves, access to all Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, inves ga ons, inspec ons, or other similar ac vi es, as authorized by law or regula on.

(j) No fica on of third-party access requests. The Contractor shall no fy the Contrac ng Officer promptly of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contrac ng Officer to take all measures to protect Government data and Government-related data from any unauthorized disclosure.

(k) Spillage. Upon no fica on by the Government of a spillage, or upon the Contractor’s discovery of a spillage, the Contractor shall promptly no fy the Contrac ng Officer and cooperate with the Contrac ng Officer to address the spillage in compliance with agency procedures.

(l) Subcontracts. The Contractor shall include this clause, including this paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial items.

C.9 Cyber Incident Reporting (JULY 2020) - H.6

(a) Defini ons. As used in this clause— “Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisi on, or any similar occurrence where (1) a person other than an authorized user accesses or poten ally accesses personally iden fiable informa on or (2) an authorized user accesses or poten ally accesses personally iden fiable informa on for another than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of informa on to unauthorized persons, or a viola on of the security policy of a system, in which unauthorized inten onal or uninten onal disclosure, modifica on, destruc on, or loss of an object, or the copying of informa on to unauthorized media may have occurred.

“Computer so ware” means computer programs, source code, source code lis ngs, object code lis ngs, design details, algorithms, processes, flow charts, formulae and related material that would enable the so ware to be reproduced, recreated, or recompiled. Computer so ware does not include computer data bases or computer so ware documenta on.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or poten ally adverse effect on an informa on system and/or the informa on residing therein.

“Forensic analysis” means the prac ce of gathering, retaining, and analyzing computer-related data for inves ga ve purposes in a manner that maintains the integrity of the data.

“Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confiden ality, integrity, or availability of FRTIB’s informa on or an FRTIB informa on system; or cons tutes a viola on or imminent threat of viola on of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s informa on or an FRTIB informa on system. “Malicious so ware” means computer so ware or firmware intended to perform an unauthorized process that will have adverse impact on the confiden ality, integrity, or availability of an informa on system. This defini on includes a virus, worm, Trojan horse, or other code-based en ty that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or wri ng surfaces including, but is not limited to, magne c tapes, op cal disks, magne c disks, large-scale integra on memory chips, and printouts onto which controlled unclassified Informa on is recorded, stored, or printed within a covered contractor informa on system.

“Informa on system” means a discrete set of informa on resources organized for the collec on, processing, maintenance, use, sharing, dissemina on, or disposi on of informa on.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a Breach or within one (1) hour of determining with reasonable certainty that there has been an incident or a Breach involving FRTIB data."

(b) Cyber incident repor ng requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor informa on system or the controlled unclassified informa on residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as opera onally cri cal support and iden fied in the contract, the Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to iden fy and report an…