B02 Attach 6 Non Disclosure Agreement.docx

Attachment 6 NDA Confidentiality and Non-Disclosure Agreement ODR&R Data Analytics Product and Support Services SBA Indefinite Delivery/Indefinite Quantity (IDIQ) and Respective Task Orders: TBD

This Confidentiality and Non-Disclosure Agreement (Agreement) is executed between the U.S. Small Business Administration (SBA) and the undersigned Contractor in conjunction with SBA Indefinite Delivery/Indefinite Quantity (IDIQ) No. and Respective Task Orders<insert contract number>. Federal law provides that only authorized persons or entities may access records which are contained in a system of records maintained by SBA and that are retrieved by an individual’s name or personal identifier. Pursuant to 13 C.F.R 102.34, all regulations contained in 13 C.F.R. part 102, subpart B, shall apply to Contractor during their performance of the Contract for purposes of the sanction provisions of the Privacy Act, including without limitation civil remedies such as damages and injunctive relief, 5 U.S.C. § 552a(g), and criminal penalties, 5 U.S.C. § 552a(i), for violations of the Privacy Act. In addition, other Federal laws obligate SBA to establish controls to limit access to Confidential Information, as defined below, which is included in SBA records regardless of whether it is contained in a System of Records. Applicable laws include without limitation, the Freedom of Information Act (FOIA), 5 U.S.C. § 552, the Procurement Integrity Act, and the Trade Secrets Act, 18 U.S.C. § 1905 (Trade Secrets Act).

1. Definitions

“Confidential Information” means non-public information provided to Contractor by SBA in connection with Contractor’s performance of the Contract, or that Contractor otherwise obtains, accesses, or develops in connection with its performance under the Contract. Non-public information includes but is not limited to information about: Government procurements and procurement related documents such as market research, draft or final statements of work that are not publicly available, or independent government estimates; information contained in any acquisition documentation created by or on behalf of the United States Government pursuant to FAR Subpart 7.1; requests for quotations/proposals, requests for quotation, source selection information (as defined in FAR 2.101), trade secrets and other proprietary information, PII, the number and identity of the Government personnel involved, and the schedule of key technical and acquisition events in the acquisition process; participants in any SBA government contracting or business development program; SBA’s business, economic, and policy plans; and SBA financial, and Agency related information that SBA has not made available to the public. Confidential Information includes information that contains any element of confidentiality, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of SBA.

“Need-to-know” means the determination made by an authorized holder of information that a prospective recipient requires access to specific information in order to perform or assist in a lawful and authorized governmental function, i.e., access is required for the performance of official duties.

“Personally Identifiable Information” or “PII” means information which can be used to distinguish or trace an individual’s identity, such as their name, address, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. This also includes, but is not limited to, education, financial information (e.g., account number, taxpayer identification number, access or security code, password and personal identification number), medical information, investigation report or database, criminal or employment history or information, or any other personal information which is linked or linkable to an individual.

“SBA Data” means all proprietary Data in SBA’s possession and all Data produced or developed by, or on behalf of, Contractor in connection with the performance of the Contract, and all Data provided by SBA to the Contractor related to the Contractor’s performance of the Contract.

1. Terms of Agreement

1. Agreement to Maintain Confidentiality. Contractor shall abide by Federal government and SBA requirements in this Agreement, Contract, and in policy guidance, regulations, and statute, for protecting PII and Confidential Information as it exists on the date of this Agreement and including any changes to such guidance after the date of signature. This Agreement applies to any SBA Data, PPI, and Confidential Information that the Contractor has access to starting on date of award of the Contract No. <insert contract number>. The Contractor’s signature on this Agreement confirms that the Contractor has not violated the terms of this Agreement as of <insert date of contract award>.

The requirements for maintaining confidentiality include but are not limited to, the Privacy Act, 13 C.F.R. part 102, subpart B, and SBA Standard Operating Procedure (SOP) 90 47 4 (or most recent version), Information Technology Security Policy, SBA’s Information Technology Rules of Behavior, FAR Part 3, and the Trade Secrets Act. Contractor agrees that any and all SBA Data and Confidential Information is and will remain the property of SBA; is privileged and confidential; and any release or disclosure of SBA Data or Confidential Information is subject to SBA prior written approval.

1. Use of SBA Data and Confidential Information. Contractor will review and use SBA Data and Confidential Information only as authorized by SBA in writing and solely for the purpose of performing its duties under the Contract and not for any other purpose, including but not limited to any commercial, personal, or other purpose not contemplated by this Agreement. Contractor understands that SBA may conduct inspections of any of the Contractor’s documents or files (electronic or hard copy) related to its performance of this Contract, at any time or place, for the purpose of ensuring compliance with this Agreement.

1. Clearance Form. The Contractor shall complete a Form 1228 “Computer Access/Clearance Form” and submit it to the COR to begin the mandatory clearance process at the beginning of Contractor’s assignment to the Contract.

1. Protection of SBA Data and Confidential Information. Contractor will take all actions reasonably necessary to preserve and protect any privilege or claim of confidentiality related to the SBA Data and Confidential Information as well as any information derived therefrom, including but not limited to, maintaining such safeguards and internal controls as are necessary and appropriate. Confidential Information and SBA Data received by the Contractor must be protected by Contractor against unauthorized use, release, disclosure and modification. The Contractor shall immediately notify the COR upon discovery of any unauthorized use, theft, loss, misplacement, unauthorized release or disclosure of SBA Data or Confidential Information whether or not the Contractor is personally involved.

1. Disclosure Prohibition. Contractor shall not release or disclose SBA Data or Confidential Information, either orally, or in written, electronic or any other form, to any person or entity, without the express written consent of the Contracting Officer’s Representative (COR), as named by the Contract. Confidential Information and SBA Data may only be disclosed to personnel employed by Contractor or one of its subcontractors with a Need-to-know, as defined in this Agreement, and only after the Contractor receives express, written consent from the COR.

1. Indemnification. The Contractor shall indemnify SBA for any damages resulting from a breach of the Agreement, and which are due to a third-party. A third-party is any party other than SBA or the Contractor.

1. Proprietary Information. Pursuant to 48 C.F.R. § 9.505-4(b), if Contractor gains access to proprietary information of other companies in performing advisory and assistance services for SBA, Contractor must agree with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished. Contractor shall ensure that such agreements are properly executed and shall provide copies of these agreements to the Contracting Officer within 5 business days of full execution.

1. Employees and Entities with a Need to Know. A list of: (1) personnel employed by the Contractor or subcontractors with a Need to Know; and (2) entities with a Need to Know, shall be provided by the Contractor to the COR within 5 business days of signing this Agreement and prior to any release or disclosure of SBA Data or Confidential Information that occurs starting from <insert date of contract award>. The list shall contain a description of each individual’s employer, title, and assigned tasks under this Contract.

1. Privileges. SBA expressly reserves all privileges, and immunities and protections applicable to the SBA Data and Confidential Information provided to Contractor under this Agreement. The provision of the SBA Data and any Confidential Information to Contractor pursuant to this Agreement will not constitute public disclosure nor will it be deemed a waiver of any privilege or claim of confidentiality to which the SBA Data or any Confidential Information is subject.

1. Legal Proceedings. If Contractor is requested or required in any legal proceeding to disclose SBA Data or Confidential Information, Contractor will provide SBA with prompt written notice, unless such notice is prohibited by law. Contractor will not disclose Confidential Information or SBA Data without SBA’s prior written consent or without a legally binding, valid and enforceable order from a court or adjudicatory or legislative body with jurisdiction over the subject matter and the parties.

1. Remedies. It is agreed that in the event of a breach or threatened breach of this Agreement by Contractor irreparable damages may occur to SBA with the amount of damages being impossible to ascertain. In such event, in addition to pursuing any remedies provided by law and without prejudice to any rights to judicial relief it may otherwise have, Contractor acknowledges that SBA may be entitled to seek equitable relief, including an injunction, against Contractor restraining any such breach or threatened breach of this Agreement or an order of specific performance of this Agreement without proof of actual damage. Contractor agrees that Contractor will not, directly, or indirectly; oppose the granting of such relief on the basis that SBA has an adequate remedy at law.

1. Penalties. Contractor may be subject to all penalties imposed by law for unlawful disclosure of SBA Data or Confidential Information by the Contractor, which may include termination of the Contract. Contractor has read and shall comply with the policy and guidelines described in SBA Standard Operating Procedures (SOP) 90 47 4 Information Technology Security Policy as well as SBA’s Information Technology Rules of Behavior. Contractor acknowledges that any misappropriation of SBA Data or Confidential Information by Contractor and/or any use of the SBA Data or the Confidential Information for any purpose other than in accordance with and to perform its duties under the Contract shall constitute a violation of 18 U.S.C. 641 and shall be subject to criminal penalties as set forth in the statute.

1. Entire Agreement. This Agreement supplements any current language in the Contract regarding IT security and supersedes any conflicting language and prior agreements regarding the non-disclosure or confidentiality of Confidential Information and SBA Data.

1. Time Period. Unless and until released in writing by an authorized representative of SBA, Contractor understands that all conditions and obligations imposed upon Contractor by this Agreement apply during the time that Contractor is granted access to Confidential Information or SBA Data, and at all times thereafter.

1. Employee Rights. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

1. Notices. Notices to SBA or the Contracting Officer that are required by this Agreement shall be sent by email or another method as agreed to by the Contracting Officer. Any notice required to be provided to the COR shall be delivered by email or another method as agreed upon by the COR.

1. Application. This Agreement must be signed by the Contractor, any subcontractor thereof, and any employee of either of the foregoing performing work in connection with the Contract. When this Agreement is signed by an individual or entity other than the Contractor, (i) the term “Contractor,” wherever it appears in this Agreement, other than in paragraph 8, shall be deemed to mean “employee,” in the case of an individual, or “subcontractor” or “Contractor,” as appropriate, in the case of an entity, (ii) notices to the Contracting Officer or COR shall be made by the Contractor’s authorized representative, and are not required to be made directly by the individual.

I have read this Agreement carefully and my questions, if any, have been answered. I represent and warrant that I have authority to enter into this Agreement.

Name:

Title:

Employer:

Date:

Signature: ______________________________________ I have read this Agreement carefully and my questions, if any, have been answered. If signing on behalf of Contractor or a subcontractor, I represent and warrant that I have authority to enter into this Agreement on the entity’s behalf.

Name:

Title at Entity:

Entity Name:

Date:

Signature: ______________________________________