B05 - 73351021Q0075 Att 2 NDA.pdf

ATTACHMENT 2 - RFQ: 73351021Q0075

Confidentiality and Non-Disclosure Agreement U.S. Small Business Administration

Office of Capital Access (OCA) Consolidated Credit Scoring & Reporting

RFQ: 73351021Q0075

I. Introduction

This Confidentiality and Non-Disclosure Agreement (Agreement) is executed between the U.S. Small Business Administration (SBA) and the undersigned Contractor in conjunction with SBA, Solicitation Number 73351021Q0075 for SBA, Office of Capital Access (OCA), Consolidated Credit Scoring & Reporting. SBA’s execution of this Agreement is accomplished through its signature on the Blanket Purchase Agreement (BPA) incorporating this Agreement.

Federal law provides that only authorized persons or entities may access records which are contained in a system of records maintained by SBA and that are retrieved by an individual’s name or personal identifier. In particular, Personally Identifiable Information (PII), as defined below, is protected from disclosure to the public. These legal restrictions include the Privacy Act of 1974, as amended (5 U.S.C. § 552a) (the Privacy Act); 13 C.F.R. part 102, subpart B; OMB Circular A-130, Appendix III; and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M- 07-16, M-06-16, and M-06-15.

Pursuant to 13 C.F.R 102.34, all regulations contained in 13 C.F.R. part 102, subpart B, shall apply to Contractor during their performance of the BPA for purposes of the sanction provisions of the Privacy Act, including without limitation civil remedies such as damages and injunctive relief, 5 U.S.C. § 552a(g), and criminal penalties, 5 U.S.C.

§ 552a(i), for violations of the Privacy Act.

In addition, other Federal laws obligate SBA to establish controls to limit access to Confidential Information, as defined below, which is included in SBA records regardless of whether it is contained in a System of Records.

Applicable laws include without limitation, the Freedom of Information Act (FOIA), 5 U.S.C. § 552, and the Trade Secrets Act, 18 U.S.C. § 1905 (Trade Secrets Act).

II. Definitions

“Confidential Information” means non-public information provided to Contractor by SBA in connection with Contractor’s performance of the BPA, or that Contractor otherwise obtains or develops in connection with its performance under the BPA. Non-public information includes but is not limited to information about SBA’s program participants and SBA’s business, economic, and policy plans, and SBA financial, and Agency related information that SBA has not made available to the public. Confidential Information includes: PII, information related to the conduct of a Federal agency procurement; FOUO; non-public information owned by, generated by or in the possession of SBA; information to which Contractor is given access by SBA or which Contractor may obtain by other means during the course of performing the BPA that is commercially valuable, market sensitive, proprietary, or related to an SBA oversight, examination or enforcement matter; information subject to a legal privilege benefitting SBA; and information otherwise deemed sensitive or confidential by an SBA office head, regardless of whether SBA has labeled the information as confidential or sensitive, and is not otherwise available to the public. Confidential Information includes information that contains any element of confidentiality, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of SBA Confidential. Confidential Information may take any form, including, but not limited to, Data and unrecorded conversations. Additional examples of Confidential Information include SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act. Confidential Information includes personal and business financial information that is protected from public disclosure by Federal law, including without limitation FOIA, the Trade Secrets Act, and the Privacy Act.

“Contractor” means the undersigned entity entering this Agreement with the SBA.

“Data” means written, oral, electronic or other recorded information, regardless of form or the media on which it may be recorded. The term includes without limitation technical and statistical data, computer software, computer files, electronic mail, and video recordings.

“For Official Use Only information” or “FOUO” means unclassified information of a sensitive nature, not otherwise categorized by statute or regulation, the unauthorized disclosure of which could adversely impact an individual or entity’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national interest.

“Need-to-know” means the determination made by an authorized holder of information that a prospective recipient requires access to specific information in order to perform or assist in a lawful and authorized governmental function, i.e., access is required for the performance of official duties.

“Personally Identifiable Information” or “PII” means information which can be used to distinguish or trace an individual’s identity, such as their name, address, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. This also includes, but is not limited to, education, financial information (e.g., account number, taxpayer identification number, access or security code, password and personal identification number), medical information, investigation report or database, criminal or employment history or information, or any other personal information which is linked or linkable to an individual.

“SBA Data” means all proprietary Data in SBA’s possession and all Data produced or developed by, or on behalf of, Contractor in connection with the performance of the BPA, and all Data provided by SBA to the Contractor, which is related to the Contractor’s performance of the BPA.

III. Terms of Agreement

1. Agreement to Maintain Confidentiality. Contractor agrees that any and all SBA Data and Confidential

Information is and will remain the property of SBA; is privileged and confidential; and any release or disclosure of SBA Data or Confidential Information is subject to SBA prior written approval. Contractor shall abide by Federal government and SBA requirements in this Agreement, BPA, and in policy guidance, regulations, and statute, for protecting PII and Confidential Information as it exists on the date of this Agreement and including any changes to such guidance after the date of signature. Such requirements include but are not limited to, the Privacy Act, 13 C.F.R. part 102, subpart B, and SBA SOP 90 47 4, Information Technology Security Policy, SBA’s Information Technology Rules of Behavior, and the Trade Secrets Act.

2. Use of SBA Data and Confidential Information. Contractor will review and use SBA Data and Confidential

Information only as authorized by SBA in writing and solely for the purpose of performing its duties under the BPA and not for any other purpose, including but not limited to any commercial, personal or other purpose not contemplated by this Agreement. Contractor understands that SBA may conduct inspections of any of the Contractor’s documents or files (electronic or hard-copy) related to its performance of this BPA , at any time or place, for the purpose of ensuring compliance with any terms or conditions under this Agreement. SBA Data and Confidential Information containing PII is prohibited from being used as test data or stored in a non-production processing environment for development/testing.

3. Clearance Form. The Contractor shall complete a Form 1228 “Computer Access/Clearance Form” and submit it to the COR to begin the mandatory clearance process at the beginning of Contractor’s assignment to the BPA.

4. Protection of SBA Data and Confidential Information. Contractor will take all actions reasonably necessary to preserve and protect any privilege or claim of confidentiality related to the SBA Data and Confidential Information as well as any information derived therefrom, including but not limited to, maintaining such safeguards and internal controls as are necessary and appropriate. Confidential Information and SBA Data received by the Contractor must be protected by Contractor against unauthorized use, release, disclosure and modification. The Contractor shall immediately notify the COR upon discovery of any unauthorized use, theft, loss, misplacement, unauthorized release or disclosure of SBA Data or Confidential Information whether or not the Contractor is personally involved. The Contractor must refer all requests for access to SBA Data or Confidential Information to the SBA COR.

5. Disclosure Prohibition. Contractor shall not release or disclose SBA Data or Confidential Information, either orally, or in written, electronic or any other form, to any person or entity, without the express written consent of the Contracting Officer’s Representative (COR), as named by the BPA. Confidential Information and SBA Data may only be disclosed to personnel employed by Contractor or one of its subcontractors with a Need-to-know, as defined in this Agreement, and only after the Contractor receives express, written consent from the COR.

6. Indemnification. The Contractor shall indemnify SBA for any damages resulting from a breach of the

Agreement, and which are due to a third-party. A third-party is any party other than SBA or the Contractor.

7. Intellectual Property Rights. Neither party acquires any intellectual property rights under this Agreement.

8. Employees and Entities with a Need to Know. A list of: (1) personnel employed by the Contractor or subcontractors with a Need to Know; and (2) entities with a Need to Know, shall be provided by the Contractor to the COR within 5 business days of signing this Agreement and prior to any release or disclosure of SBA Data or Confidential Information. The list shall contain a description of each individual’s employer, title, and assigned tasks under this BPA. No such release or disclosure of SBA Data or Confidential Information is permitted under this Agreement without the express, written consent of the COR. If there are any proposed changes to this list, the Contractor shall update the list and provide it to the COR prior to any disclosure or release of SBA Data or Confidential Information, and no such release is permitted without the COR’s express, written consent.

9. Return of Property. At the conclusion of Contractor’s or subcontractor’s performance of the BPA (whether due to termination or the end of the period of performance), the Contractor shall return to the COR all issued identification and any Federal government property to which it or its subcontractors have access or is in its or its subcontractors’ possession, no later than the last day of their work on the BPA. Contractor shall return to the COR within 5 days prior to the end of its performance on the BPA, all SBA Data and Confidential Information to which it or its subcontractors have access or which is in its or its subcontractors’ possession. In addition, if any Contractor or subcontractor employee stops work under this BPA prior to the end of BPA performance, the employee shall return to its employer all issued identification and any Federal government property no later than the last day of their work on the BPA.

10. Rights Remain with SBA. Contractor will not, by virtue of any right to review the SBA Data or Confidential

Information, acquire any rights with respect thereto, all of which rights shall remain exclusively with SBA.

Contractor acknowledges and agrees that any intellectual property derived from the BPA will be solely and exclusively owned by SBA.

11. Privileges. SBA expressly reserves all privileges, and immunities and protections applicable to the SBA Data and Confidential Information provided to Contractor under this Agreement. The provision of the SBA Data and any Confidential Information to Contractor pursuant to this Agreement will not constitute public disclosure nor will it be deemed a waiver of any privilege or claim of confidentiality to which the SBA Data or any Confidential Information is subject. SBA has not waived, and shall not be deemed to waive, any rights or remedies available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, forms, or written agreements.

12. Appropriations Act Restriction. These restrictions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by Executive Order No. 12958; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 U.S.C. 421 et seq.) (governing disclosures that could expose confidential

Government agents); and the statutes which protect against disclosure that may compromise the national security, including sections 641, 793, 794, 798, and 952 of title 18, United States Code, and section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. 783(b)). The definitions, requirements, obligations, rights, sanctions, and liabilities created by said Executive order and listed statutes are incorporated into this agreement and are controlling.

13. Legal Proceedings. If Contractor is requested or required in any legal proceeding to disclose SBA Data or

Confidential Information, Contractor will provide SBA with prompt written notice, unless such notice is prohibited by law. Contractor will not disclose Confidential Information or SBA Data without SBA’s prior written consent or without a legally binding, valid and enforceable order from a court or adjudicatory or legislative body with jurisdiction over the subject matter and the parties.

14. Remedies. It is agreed that in the event of a breach or threatened breach of this Agreement by Contractor irreparable damages may occur to SBA with the amount of damages being impossible to ascertain. In such event, in addition to pursuing any remedies provided by law and without prejudice to any rights to judicial relief it may otherwise have, Contractor acknowledges that SBA may be entitled to seek equitable relief, including an injunction, against Contractor restraining any such breach or threatened breach of this Agreement or an order of specific performance of this Agreement without proof of actual damage. Contractor agrees that Contractor will not, directly or indirectly, oppose the granting of such relief on the basis that SBA has an adequate remedy at law. In the event that Contractor shall have knowledge of any breach of this Agreement, Contractor shall promptly give written notice thereof to SBA. SBA has not waived, does not waive, and shall not be deemed to have waived, any rights or remedies otherwise available to SBA under applicable statutes, regulations, SBA Standard Operating Procedures, notices, or written agreements.

15. Employee Rights. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

16. Penalties. Contractor may be subject to all penalties imposed by law for unlawful disclosure of SBA Data or Confidential Information by the Contractor, which may include termination of the BPA. Contractor has read and shall comply with the policy and guidelines described in SBA Standard Operating Procedures (SOP) 90 47 4 Information Technology Security Policy as well as SBA’s Information Technology Rules of Behavior.

Contractor acknowledges that any misappropriation of SBA Data or Confidential Information by Contractor and/or any use of the SBA Data or the Confidential Information for any purpose other than in accordance with and to perform its duties under the BPA shall constitute a violation of 18 U.S.C. 641 and shall be subject to criminal penalties as set forth in the statute.

17. Applicable Law. This Agreement is incorporated into the BPA upon execution. This Agreement shall be governed by the Small Business Act of 1953, as amended, 15 U.S.C. § 631 et seq., Small Business Investment Act of 1958, as amended, 15 U.S.C. § 661 et seq., 13 CFR Part 102, and Federal law.

18. Entire Agreement. This Agreement supplements any current language in the BPA regarding IT security, and supersedes any conflicting language and prior agreements regarding the non-disclosure or confidentiality of Confidential Information and SBA Data. This Agreement does not contain the exclusive agreement on data rights provisions, which are also included in the BPA elsewhere.

19. Amendment. This Agreement may be amended only upon written agreement of the parties. Contractor may not assign its rights, duties or obligations under this Agreement without SBA’s prior written consent.

20. Time Period. Unless and until released in writing by an authorized representative of SBA, Contractor understands that all conditions and obligations imposed upon Contractor by this Agreement apply during the time that Contractor is granted access to Confidential Information or SBA Data, and at all times thereafter.

21. Notices. Notices to SBA required by this Agreement shall be sent by first class mail to the Contracting Officer, as designated in the Contract, at U.S. Small Business Administration, Denver Finance Center, Acquisitions Division, 721 19th Street, Suite 301, Denver, CO 80202. Any notice required to be provided to the COR shall be delivered by email or another method as agreed upon by the COR.

22. Application. This Agreement must be signed by the Contractor, any subcontractor thereof, and any employee of either of the foregoing performing work in connection with the BPA. When this Agreement is signed by an individual or entity other than the Contractor, the term “Contractor,” wherever it appears in this Agreement, other than in paragraphs 8, 9 and 20, shall be deemed to mean “employee,” in the case of an individual, or “subcontractor,” in the case of an entity.

23. Limitation of Application. This Agreement imposes no obligation upon the Recipient with respect to confidential information which (a) was in the Recipient's possession before receipt from SBA or the Agency;

(b) is or becomes a matter of public knowledge through no fault of the Recipient; (c) is received by the Recipient from a third party without a duty of confidentiality; (d) is disclosed by SBA to a third party without a duty of confidentiality on the third party; (e) is independently disclosed by the Recipient with SBA's prior written approval, or (f) is developed by the Recipient without reference to information disclosed hereunder.

I have read this Agreement carefully and my questions, if any, have been answered. I am aware that an unauthorized disclosure of procurement information may subject me to criminal, civil, and/or administrative penalties. I represent and warrant that I have authority to enter into this Agreement.

Name:

Title:

Employer:

Date:

Signature:

I have read this Agreement carefully and my questions, if any, have been answered. I am aware that an unauthorized disclosure of procurement information may subject me to criminal, civil, and/or administrative penalties. If signing on behalf of Contractor or a subcontractor, I represent and warrant that I have authority to enter into this Agreement on the entity’s behalf.

Name:

Title at Entity:

Entity Name:

Date:

Signature: