CI solicitation 83310123R0001 CRTI Online Due Diligence System.pdf

RFP for CI solicitation CRTI Online Due Diligence System FAR 12 and 13.5 Commercial Item - Full and Open Competition

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

REQUEST

FOR

PROPOSAL

PROJECT:

CRTI Online Due Diligence System *** Subject to the Availability of Funding ***

TECHNICAL AND PRICE

PROPOSAL

- and -

ORAL PRESENTATION /

PRODUCT DEMONSTRATION

CLOSING

DUE

DATES

and

TIMES:

November 15, 2022 (Tuesday) 5:00pm Eastern Time

November 15, 2022 (Tuesday) See solicitation for Scheduling a Time

SUBMIT TO:

Export Import Bank of the United States See 52.212-1 and ADDENDUM to 52.212-1

INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS

SOLICITATION NUMBER: 83310123R0001

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Table of Contents Section A – Standard Form (SF) 1449

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

A.2 NAICS CODE and PSC ASSSIGNMENTS

A.3. 52.216-1 Type of Contract

Section B – Continuation of SF 1449

B.1 SUBMISSION OF INVOICES (CONTINUATION OF BLOCK 18b)

B.2 SCHEDULE OF SUPPLIES/SERVICES (CONTINUATION OF BLOCK 19-24)

B.3 GENERAL

B.3.1. LABOR STANDARDS AND WORK HOURS

B.3.2. SAFETY REQUIREMENTS

B.3.3. PERIOD OF PERFORMANCE

B.3.4. PLACE OF PERFORMANCE

B.4 STATEMENT OF REQUIREMENTS (CONTINUATION OF BLOCK 20)

SOR SECTION 1 – BACKGROUND

SOR SECTION 2 – SCOPE

SOR SECTION 3 – REQUIREMENTS CAPABILITIES OF DUE DILIGENCE COMPLIANCE SYSTEM

SOR SECTION 4 – SCHEDULE

SOR SECTION 5 – DELIVERABLES

SOR SECTION 6 – WATCH LISTS

SOR SECTION 7 – SERVICES AGREEMENTS

SOR SECTION 8 – DESIRED FUTURE ENHANCEMENTS

SOR SECTION 9 – Information Security Requirements

B.5 DELIVERABLES SPECIFIC

B.6 COOPERATION

B.7 INFORMATION PROTECTION

B.8 COMPLIANCE WITH IT SECURITY POLICES, PROCEDURES, AND REQUIREMENTS

Section C – Contract Clauses

C.1 PROVISIONS AND CLAUSES INCORPORATED BY REFERENCE (IBR) IAW FAR 52.102

C.2 PROVISIONS AND CLAUSES INCORPORATED BY FULL TEXT

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

52.212-2 Evaluation—Commercial Products and Commercial Services

52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Products and Commercial Services

52.217-8 Option to Extend Services

52.217-9 Option to Extend the Term of the Contract

52.252-4 Alterations in Contract

52.232-18 Availability of Funds

52.252-1 Solicitation Provisions Incorporated by Reference

52.252-2 Clauses Incorporated by Reference

17.204 ntracts

Section D – Contract Exhibits

D.1 PAST PERFORMANCE INFORMATION

Section E – Solicitation Provisions

E.1 52.212-1 Instructions to Offerors—Commercial Products and Commercial Services

E.2 ADDENDUM TO 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS

E.3 52.212-2 Evaluation—Commercial Products and Commercial Services

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Section A – Standard Form (SF) 1449

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

Questions concerning this solicitation may be submitted to Ms. Patricia Ludlow, Contracting Officer via email at patricia.ludlow@exim.gov.

Definitions and Acronyms for Solicitation NAICS Code North American Industry Classification System (NAICS) Code is a standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the US business economy performed by the US Census Bureau.

PSC Manual Product and Service Code (PSC) Manual provide codes to describe products, services, and research and development (R&D) purchased by the federal government. These codes indicate “WHAT” was bought for each contract action and reported and tracked in the Federal Procurement Data System (FPDS).

SBA US Small Business Administration (SBA) helps Americans start, build, and grow businesses. Through an extensive network of field offices and partnerships, the SBA assists and protects the interests of small business concerns.

SBA sets the SBA Size Standards within the published Table of size standards per the North American Industry Classification System (NAICS) Code.

COR Contracting Officer’s Representative (COR) has specific written delegated authority from the contracting officer to perform approved tasks.

CO Contracting Officer (CO or KO) is a government employee empowered to obligate the US Federal Government.

Metered Usage Costs Metered usage is a technique where customers pay for a product or service based on its usage. For this solicitation requirement, the US Government is looking for a Firm-Fixed-Price solution.

A.2 NAICS CODE and PSC ASSSIGNMENTS 519130 Internet Publishing and Broadcasting and Web Search Portals

1,000 Size standards in number of employees 7A21 - IT AND TELECOM - BUSINESS APPLICATION SOFTWARE (PERPETUAL LICENSE SOFTWARE)

A.3. 52.216-1 Type of Contract.

Per the Federal Acquisition Regulations (FAR) Part 12 Acquisition of Commercial Products and Commercial Services, this acquisition constitutes an acquisition of commercial products or commercial services IAW 12.102. The contract format is generally IAW FAR 12.303, Contract Format for Acquisition of Commercial Products and Commercial Services.

As a Commercial Item/Service Acquisition, conducted as a Full and Open Competition (unrestrictive) per FAR 6.102 and 12, the government contemplates award of a single contract with CLINS for Firm-Fixed- Price (FFP) to cover any resulting tasks from this solicitation.

(End of provision)

IAW FAR 12.214, the resulting contract exempt from 48 CFR § 9903.201-1 - CAS applicability, Cost Accounting Standards (CAS). However, the CAS standards/definitions/procedures for travel expenses are made applicable to this contract and each task order issued thereunder, as a matter of contract administration.

Contractor is to provide commercial best customer firm-fixed pricing to cover all the requirements and tasks per this solicitation.

https://www.census.gov/naics/ https://www.census.gov/naics/ https://www.acquisition.gov/psc-manual https://www.acquisition.gov/psc-manual https://www.sba.gov/federal-contracting/contracting-guide/size-standards https://www.sba.gov/document/support-table-size-standards

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Section B – Continuation of SF 1449

B.1 SUBMISSION OF INVOICES (CONTINUATION OF BLOCK 18b)

Submission of Invoices to the Invoice Processing Platform (IPP) Offeror / contractor must be registered in the System for Award Management (SAM) https://www.sam.gov.

Invoicing instructions will be provided upon receipt of an award.

Additional Invoice Requirements:

• Contractor invoices must clearly be in in a font size that is greater than a 7-font size.

• Contractor invoices must provide a clear explanation for each expense from a third-party vendor/subcontractor which the contractor is submitting to EXIM in its prime contractor invoice.

• Acronyms must be spelled out or an acronym key provided on the invoice.

• Each invoice must be complete and “proper” before it shall be considered received for the purposes of Prompt Payment Act interest accrual.

• Each invoice submitted by the contractor constitutes an official statement of the contractor seeking a benefit/compensation from the US Government.

B.2 SCHEDULE OF SUPPLIES/SERVICES (CONTINUATION OF BLOCK 19-24)

Proposed pricing shall be in United States Dollars (USD) and rounded to the nearest whole cent. The Schedule of Supplies/Services (Schedule) is to be provided by the vendor to meet all requirements in their entirety as identified in this solicitation.

Product / Services Reference and Complete the Standard Form (SF) 1449

B.3 GENERAL

B.3.1. LABOR STANDARDS AND WORK HOURS

All work performed by the prime contractor and each of its subcontractors/suppliers shall be performed in accordance with commercial business practices and regulated labor standards prevailing in the jurisdiction where the services are being performed. The contractor is responsible for ensuring that all such practices and labor standards are enforced and followed and agrees to hold harmless and indemnify the US Government for any violation of same.

B.3.2. SAFETY REQUIREMENTS

All work performed by the prime contractor and each of its subcontractors/suppliers shall be performed in accordance with commercial business practices and regulated labor standards prevailing in the jurisdiction where the services are being performed. The contractor is responsible for ensuring that all such practices and labor standards are enforced and followed and agrees to hold harmless and indemnify the US Government for any violation of same.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

B.3.3. PERIOD OF PERFORMANCE

The period of performance for this purchase order is schedule to begin as a transition / handoff of 1-month with one (1) year beginning February 1, 2023 with four (4) option periods with the right to extend up to 6-months per clause 52.217-8.

B.3.4. PLACE OF PERFORMANCE

The primary place of performance will be at the contractor’s facilities and the contractor must provide all necessary equipment, tools, materials, or other to successfully complete performance for each task.

B.4 STATEMENT OF REQUIREMENTS (CONTINUATION OF BLOCK 20)

Initiating Offices:

Research and Information Services, the Credit Review and Compliance Division, and the Office of General Counsel

Project Title:

Character, Reputational, and Transaction Integrity (CRTI) Due Diligence Compliance System

Requiring Activity: Library

Statement of Requirements (SOR)

Salient and essential features required for a Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System (up to 2 users) are:

SOR SECTION 1 – BACKGROUND

The Export Import Bank of the United States’ (EXIM) Research and Information Services, the Credit Review and Compliance Division, and the Office of General Counsel has a need for a semi-automated online due diligence compliance system. The system must be able to perform bulk/batch uploads to screen multiple individuals and business entities names at one time. This system will replace EXIM’s current bulk/batch upload due diligence compliance system.

As the United States (US) Government Export Credit Agency (ECA), EXIM supports US export transactions and is mandated to do business with parties that are presently responsible. EXIM follows the anti-bribery provisions set forth in the Foreign Corrupt Practices Act (FCPA) and has established know your customer practices. EXIM also follows these procedures for its guaranteed and insured lender partners and participants.

SOR SECTION 2 – SCOPE

The US Government follows the Organisation for Economic Co-operation and Development (OECD) anti-bribery recommendations in its export credit practices including the recommendation to conduct enhanced due diligence compliance with regard to any exporter or applicant that has been indicted, convicted, or debarred for bribery. As such, we are required to run individual(s) and business entity(ies) name(s) of transaction participants against a due diligence compliance system including the

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) lists, the US Government SAM.gov Exclusions also referred to as suspensions and debarments.

EXIM’s due diligence compliance check process for Character, Reputational and Transaction Integrity (CRTI) involves multiple daily bulk/batch searches carried out by staff in our Research and Information Services Division. All medium- and long-term transaction participants are screened against all required watch lists and, under special circumstances, seven (7) additional lists as determined by EXIM asset management staff. This includes both individual(s) and business entity(ies) name(s). When there is a match that links an exporter, lender, or supplier in a transaction to fraud or corruption, the results are forwarded to EXIM loan officers working on the transactions, the Credit Monitoring and Review Division, and the Office of the General Counsel for remediation. For higher dollar valued transactions, participants that appear on the Politically Exposed Person (PEP) list are flagged.

EXIM staff undertakes, on average, 30,000 checks per year which can vary per month to clear all participants involved with EXIM. We have found that a bulk/batch upload system that accommodates input of multiple individuals and business entities names at one time decreases human intervention and errors and saves many hours of valuable work time. Due diligence compliance system must be able to accept upload from either MS Excel forms filled out by EXIM staff or those that are electronically generated.

SOR SECTION 3 – REQUIREMENTS CAPABILITIES OF DUE DILIGENCE COMPLIANCE SYSTEM

A. To meet EXIM’s requirements, the due diligence compliance system must have the following capabilities:

1) Online access to a due diligence compliance system for two (2) users (system is not to be an enterprise system (due diligence compliance system is not to be connected to EXIM network)).

2) Solution is to be a stand-alone system that does not require EXIM to pay for subscriptions to additional databases.

3) Database interface must have a clean and clear design.

4) Manner of input must be allowed by way of MS Excel format.

5) Input system must allow submission of multiple participant individuals and business entities names for screening at one time by way of MS Excel bulk/batch upload.

6) Input system must allow single searching by individual(s) and business entity(ies) name(s).

7) Search criteria must be able to do the following:

a. Recognize stop words (e.g., entities that end with Limited/Ltd, Company/Co, SA, S.A. de C.V., BV, AS, etc.).

b. Advanced name matching, including name transposition capabilities to reduce false positives (e.g., Jose Martinez Rodriguez will return Jose Martinez Rodriguez, Jose Rodriguez, and Jose Martinez).

c. Skips titles (e.g., Mr, Mr., Doctor, Sultan, Admiral, etc.).

d. Searches across both nationality and location for individuals.

e. Searches across country of registration for individual(s) and business entity(ies) name(s) and also displays additional locations.

8) Database content updated in real-time that always reflects the current version of all watch https://sam.gov/content/exclusions

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 lists that EXIM is required to search.

9) Assurance / confirmation with each screening in-bulk batch that all watch lists have been checked. NOTE: A lack of hits or failure reports is not confirmation that all compliance checks are being completed.

10) An accurate and complete reporting of matches and hits.

11) Profile report format that clearly identifies and delineates matches and hits without superfluous information.

12) Matches and hits supported by comprehensive and reliable research, data, and news.

13) Matches and hits supported by source documents that are available at no extra cost.

14) Centralized collection and management of searches, matches, and hits.

15) Responsive to content, research, and technical specialists’ questions from users and provides satisfactory answers within two (2) business days with a specific Point of Contact(s) (POC(s)).

16) Access to background details of any findings from reports which may require explanation.

17) Due diligence compliance check lists and beneficial ownership research that meets the following:

a. Searches and reports on all required EXIM CRTI lists including all sanctions, PEP, and watch lists maintained by the US government and certain foreign governments and multilateral organizations (See SECTION 6 – REQUIRED WATCH LISTS).

b. Provides information on relationships with companies doing business with Iran beyond sanctions and watch lists.

c. Searches and reports on SAM.gov Exclusions.

d. Searches and reports on federal and state regulatory and law enforcement convictions, settlements, and deferred prosecution agreements.

e. International coverage of ultimate beneficial ownership that meets OFAC and Financial

Crimes Enforcement Network (FinCEN) requirements.

f. Searches and reports on individual(s) and business entity(ies) name(s) in accordance with

FinCEN's beneficial ownership rule*.

g. Searches and reports on individual(s) and business entity(ies) name(s) in accordance with

OFAC’s 50 Percent Rule**.

* Securities Industry and Financial Markets Association (SIFMA) memorandum, May 7, 2018 - FinCEN beneficial ownership definition includes two parts:

1. the control prong, covering a single individual with significant responsibility to control, manage, or direct a legal entity customer, including an executive officer, a senior manager or any other individual who regularly performs similar functions; and

2. the ownership prong, covering each individual (if any) who directly or indirectly owns 25% or more of the equity interests of a legal entity customer. “...some financial institutions may collect information about owners of 10% or more of the equity interests. They may do so as a matter of practice, based on their own assessments of risk, or pursuant to other regulatory requirements."

**Treasury.gov, "Entities Owned by Persons Whose Property and Interest in Property are Blocked (50% Rule)" https://home.treasury.gov/policy-issues/financial-sanctions/faqs/401

SOR SECTION 4 – SCHEDULE

Annual subscription with online access (two (2) users) to the due diligence compliance system throughout the year to meet EXIM’s ongoing needs.

5.1 PERIOD OF PERFORMANCE: TBD

https://home.treasury.gov/policy-issues/financial-sanctions/faqs/401

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

The period of performance is inclusive of a base period with four (4) option periods.

5.2 PLACE OF PERFORMANCE: Work will be listed as the awardee’s address as the end-user product is Internet / cloud-based.

SOR SECTION 5 – DELIVERABLES

No. Deliverable EXIM Deliverable

Awardee Deliverable

I. List of all sanctions and watch lists currently searched by the due diligence compliance system is a stand-alone, non-customized database, unassociated with any added subscription databases.

Not an EXIM deliverable.

Affirmation and Verification @ time of proposal and oral presentation / product demonstration

II. Profile report sample(s) for at least two (2) companies and two (2) individuals. Of the profile report samples, one for the company and one for the individual must not have met at least one compliance check.

Not an EXIM deliverable.

@ time of proposal

III. Copy of actual input form in MS Excel file or CSV file format (not a screen caption or screenshot).

Not an EXIM deliverable.

@ time of proposal

IV. Description of the process for carrying out a due diligence compliance multiple individual(s) and business entity(ies) name(s) search from beginning to end, e.g., user manual.

Include assistance when help is required.

Not an EXIM deliverable.

@ time of proposal

V. Data Confidentiality, Privacy Act, and Data Rights.

EXIM business is confidential. The contractor must secure all data and computers and must keep EXIM queries and interests private. EXIM will ensure that the prospective vendor follows due diligence technological best practices for the handling of confidential information in a cloud-based system. GOVERNMENT-FURNISHED EQUIPMENT:

None

Not an EXIM deliverable.

Affirmation @ time of proposal

VI. Description of the stand-alone due diligence compliance system and its cloud-based environment.

Information Security Requirements

Meet Information Technology (IT) Security controls and requirements set out within the SOR of this solicitation.

Reference SOR Section 9 of Section

B.4 SOR

below.

@ time of proposal

VII. Description of the stand-alone due diligence compliance system and its cloud-based environment.

ATO REQUIREMENT

If applicable, willingness to work with EXIM's IT Security team to complete a full or partial ATO (Authority To

Informational only; ATO not required at time of solicitation.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Operate) package fulfilling FISMA and EXIM security controls.

VIII. Description of the stand-alone due diligence compliance system and its cloud-based environment.

No PII *** System of Record Notice (SORN) to the Federal Register (FR) wait period of ## days (can run parallel to ATO process to be determined based on Privacy Assessment)

Informational only; SORN not required at time of solicitation.

SOR SECTION 6 – WATCH LISTS

# Required Watch Lists 1 Blocked government relevant lists 2 All entries sanctioned under U.S. State Dept - Bureau of International Security and

Nonproliferation sanctions 3 U.S. Bureau of Industry and Security - Denied Persons Lists 4 U.S. Bureau of Industry and Security - Entity List 5 U.S. Bureau of Industry and Security - Military End-User List 6 U.S. Bureau of Industry and Security - Unverified List 7 U.S. Dept. of Treasury Office of Foreign Assets Control (OFAC) Civil Penalties 8 Australia’s Department of Foreign Affairs and Trade (DFAT) Consolidated List 9 European Union sanctions: Cons, list of persons, groups, and entities subject to EU financial sanctions 10 FBI List of Most Wanted and Other press releases 11 Financial Crimes Enforcement Network (FinCEN) 12 Immigration and Customs Enforcement 13 Inter-American Development Bank List of Sanctioned Firms and Individuals 14 International Sanctions Associated Entity 15 Interpol Wanted List 16 Iran Economic Interest 17 Iran Sanctions Act 18 Special Designated Nationals (SDN) List and OFAC list of entities not included in the SDN

(NONSDN)

19 Canada’s Office of the Superintendent of Financial Institutions Consolidated List 20 International Consortium of Investigative Journalist Panama Papers 21 PEP (Politically Exposed Person) keyword: only for SOE (State Owned Entity) and SIE (State

Invested Entity) sub-keywords 22 Subsidiary owned 50% or more by an OFAC listed Russian Sectoral Sanctioned company 23 U.S. Department of State Terrorist Exclusion List (TEL) 24 U.S. Securities and Exchange Commission 25 HM Treasury Consolidated List of Financial Sanctions 26 UK Sanctions List (UK sanctions made under the Sanctions and Anti-Money Laundering Act

2018) 27 U.S. Department of Justice 28 U.S. Dir. of Defense Trade Controls List of Statutorily and Administratively Debarred Parties

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

29 Chinese Military Companies - Entities subject to the Executive Order 13959 in relation to Communist Chinese

30 Entities subject to prohibitions pursuant to Directive 1 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

31 Entities subject to prohibitions pursuant to Directive 2 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

32 Entities subject to prohibitions pursuant to Directive 3 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

33 Entities subject to prohibitions pursuant to Directive 4 under Executive Order 14024, Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation.

34 U.S. State Attorneys General 35 U.S. System for Award Management 36 World Bank Listing of Ineligible Firms # Extended List for Special Circumstances 1 U.S. Federal Deposit Insurance Corp - Failed Banks 2 U.S. Federal Deposit Insurance Corp 3 U.S. Federal Reserve Board 4 U.S. National Credit Union Administration 5 U.S. OCC Enforcement Actions 6 U.S. OCC National Banks 7 U.S. Office of Thrift Supervision

SOR SECTION 7 – SERVICES AGREEMENTS

EXIM as agency of the Federal Government, does not sign services agreements as a means of entering into contract with commercial entities. EXIM may incorporate such service agreements into government contracts with an appropriate caveat that conflicts arising between the terms of the contract and the incorporated service agreement shall be resolved in favor of the former as some terms in a private sector service agreement are inappropriate for incorporation into a Federal Government contract.

SOR SECTION 8 – DESIRED FUTURE ENHANCEMENTS

Below are additional due diligence compliance system desired enhancements EXIM would like to potentially have if available now or in the future.

1. Continuous on-going monitoring feature with an alerting and notification function that is available with

a. Ongoing monitoring and notification features,

b. Continual tracking with whack-a-mole insight and mapping, and

2. Provision of an Application Programming Interface (API) which would allow, Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

a. EXIM’s disparate transaction systems to speak to each other,

b. API customer programming applications,

c. A centralized process, and

d. Existing duplicative activities eliminated.

SOR SECTION 9 – Information Security Requirements

Cybersecurity Protection (Required FAR Clauses)

The following FAR clauses are included by reference below, in all IT service and/or IT service-related solicitations and contracts.

52.224-1, Privacy Act Notification 52.224-2, Privacy Act 52.224-3, Privacy Training 52.239-1, Privacy or Security Safeguards 52.204-21, Basic Safeguarding of Covered Vendor/Contractor Information Systems 52.227-14, Rights in Data – General and Alternate V 36 C.F.R. § 1194.1 and Appendices A, C and D to Part 1194, Revised 508 Standards

Laws, Standards, Policy, and Guidance The activities as required by this SOW necessitate the Vendor/Contractor’s access to Government Information, which may include Controlled Unclassified Information (CUI) and personally identifiable information (PII). The Vendor/Contractor shall meet and comply with all EXIM’s Information Technology (IT) security policy requirements, NIST standards and OMB guidelines, and other applicable Government-wide laws and regulations that apply to the protection and security of IT systems.

The Vendor/Contractor is required to comply with current IT security and privacy requirements as outlined in EXIM policies and Federal statutes, regulations, policies and guidance, as applicable. These requirements include but are not limited to:

Federal Information Security Modernization Act of 2014 (FISMA) (Public Law 113-283) (PDF, December 2014), as amended

Privacy Act of 1974, (5 U.S.C. § 552a) E-Government Act of 2002, Section 207 and 208 Digital Government Strategy (May 2012) Cybersecurity Executive Order 13800 (May 11, 2017) Clinger-Cohen Act of 1996 also known as the “Information Technology Management

Reform Act of 1996” Office of Management and Budget (OMB) memorandums and circulars specifically including, but not limited to:

Office of Management and Budget (OMB) Circular A-130, “Managing Strategic

Information as a Resource” o OMB M-17-06, Policies for Federal Agency Public Websites and Digital Services (PDF, 1.2 MB, 18 pages, November 2016) o OMB Circular A-130, Managing Information as a Strategic Resource (July 28, 2016) o OMB M-15-13, Policy to Require Secure Connections across Federal Websites and Web Services (PDF, 258 KB, 5 pages, June 2015)

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 o OMB M-04-15 Reporting Instructions for the Federal Information Security Management Act (PDF, 269 KB, 28 pages, August 2004)

Title V - Confidential Information Protection and Statistical Efficiency Act of 2002 of the E- Government Act of 2002 (CIPSEA)

Director Order 14028 for Improving the Nation’s Cybersecurity Executive Order 13556 for Controlled Unclassified Information (CUI) NIST guidelines and publications specifically including, but not limited to: o NIST Special

Publication (SP) 800-18 (as amended), “Guide for Developing Security Plans for Federal Information Systems o NIST Guidelines on Securing Public Web Servers (PDF, 960 KB, 142 pages, September 2007) o NIST SP 800-30, “Risk Management Guide for Information Technology Security Risk Assessment Procedures for Information Technology Systems” o NIST SP 800-34, “Contingency Planning Guide for Information Technology Systems” o NIST SP 800-37, (as amended), “Guide for the Security Certification and Accreditation of Federal Information Systems” o NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems” o NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations o NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations

FIPS Publications specifically including, but not limited to: o FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems o FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems o FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

The Vendor/Contractor and any sub-Contractor must not publish or disclose in any manner without prior written consent, the data/information to which the Vendor/Contractor will have access because of this contract, as this is the sole property of EXIM. Information received in the course of performing this contract will only be used for the purpose of performing this contract, and may not be used for general corporate purposes or otherwise disclosed outside of the team performing this contract. The use of any information for the preparation of other proposals or defense of any action against the government outside of this contract is expressly prohibited. If there is a future potential conflict with this contract (e.g., submitting a new proposal to the government), the Vendor/Contractor must have an approved plan to use any staff assigned to this contract participate in any way in the preparation of work outside of this proposal. Vendor/Contractor /sub-Contractors may be held responsible for any violations of confidentiality.

Information System Security Requirements

Information System

The Vendor/Contractor shall comply with implementation of required security and privacy controls for protection of the EXIM information based on the sensitivity of the data as outlined by Federal, Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 statutory and regulatory requirements and guidance, and EXIM policies and rules of behavior. The Vendor/Contractor facilities and IT systems shall meet the security requirements for the same Impact Level or greater as defined by the FIPS PUB 199 as required for the protection of Government Information.

The Vendor/Contractor shall implement and maintain an Information Security program that includes privacy and is consistent with EXIM’s approach to cybersecurity risk management and that is compliant with EXIM policies, FISMA, and applicable NIST Special Publications, OMB guidelines, and other applicable laws, throughout the performance of this contract.

The Vendor/Contractor shall meet or exceed the continuous monitoring requirements identified in the EXIM Information Security Continuous Monitoring (ISCM) Strategy and Federal statutory and regulatory requirements and other applicable OMB and EXIM policies. All systems provided for EXIM use must obtain and maintain an Authority to Operate (ATO) Authorization from EXIM. The ATO must include how the system meets continuous monitoring of security controls of the Vendor/Contractor’s system, and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. The Vendor/Contractor shall also store monthly continuous monitoring data at its location or a location identified by EXIM for a period not less than one year from the creation date.

a) Information System Security Officer (ISSO) - The Vendor/Contractor is responsible for appointing a designated person as the Vendor/Contractor ISSO for an information system as defined in this paragraph. The ISSO must have experience in system security, continuous monitoring, and security assessments of at least two years.

b) The Vendor/Contractor must be willing to work with EXIM in order to complete all of the requirements of an ATO after acquisition using the ISSO as the main point of contact (POC) to work with the EXIM cybersecurity team. Cloud-based solutions must be FedRAMP Authorized, or committed to work with EXIM to become FedRAMP Authorized if directed. ATO and FedRAMP documentation and inspections must be provided in a timely manner one (1) business day for items up to one (1) page or one (1) hour of time, five (5) business days for items up to ten (10) pages for four (4) hours of time, ten (10) business days for up to twenty

(20) pages or eight (8) hours of time, negotiable with the government if in excess of these limits. Once obtained, the solution must maintain EXIM ATO and FedRAMP Authorization through the life of the contract.

c) Supply Chain Risk Management (SCRM) - The Federal Information Security Modernization Act of 2014 (Public Law 113-283) and associated NIST guidance requires Federal agencies to manage supply chain risks for Federal information systems and to ensure the effectiveness of information security controls and risks. The Contractor shall have in-place a program or capability to identify threats to its supply chain, and coordinate with the EXIM CISO the timely identification and mitigation of supply chain risk in the provision of supplies and services to

EXIM.

d) Pass-through or minimum two-factor-authentication is required (examples are Personal Identity Verification (PIV) card – preferred, phone via text or voice, registered computer, etc.).

e) Configuration Baselines/Security Configurations - The Vendor/Contractor must configure its systems that contain EXIM information in accordance with configuration requirements that are defined in EXIM policies and procedures. The Vendor/Contractor shall not publish or disclose in any manner, without written consent, the details of any safeguards either

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 designed or developed by the Vendor/Contractor under this contract or otherwise provided by the Government. Any exceptions must be approved in writing from the CIO or CISO.

f) Reporting Requirements - The Vendor/Contractor shall immediately report and handle, as tasked, any threats, incidents, potential incidents/events, and any other hazards to the integrity, availability, and confidentiality of EXIM data and/or information systems and in compliance with requirements and procedures defined in the EXIM Incident Response Policies and Procedures and any other relevant system documentation.

g) Access – After appropriate notice, the Vendor/Contractor must provide EXIM, including EXIM’s Office of Inspector General, with access to the Vendor/Contractor’s and Subcontractors’ facilities, installations, operations, documentation, databases, and personnel used in the performance of the contract.

h) Employee Termination - The Vendor/Contractor shall immediately notify the COR when a direct support employee plans to terminate employment or an employee is removed from the contract.

i) Contract Termination - Failure on the part of the Vendor/Contractor to comply with the terms of this clause may result in termination of this contract.

j) Statutory and Regulatory Requirements - The Vendor/Contractor must comply with all requirements in the paragraphs above including the EXIM Cybersecurity and Privacy Policies, which lists in detail the requirements for Federal information systems.

Privacy Impact Assessment

The Vendor/Contractor must assist EXIM in the completion of a Privacy Impact Assessment (PIA) in accordance to the E-Government Act of 2002, sec. 208, and the Privacy Act of 1974, for Vendor/Contractor systems or new technologies that collect, maintains, or disseminates PII from ten

(10) or more members of the public.

In order to ensure the physical and information systems security of the confidential information, agencies shall conduct inspections of any off-site facility that harbors confidential information protected under CIPSEA.

Use of EXIM Information

Vendor/Contractor shall:

The vendor will not remove any government furnished information from EXIM facilities or systems unless expressly authorized.

Use the EXIM CUI, PII, or sensitive information (EXIM data) only for the purposes described herein;

Not reproduce the EXIM data, and will hold in confidence and protect the information from dissemination to, and use by, any third party;

Except as required in performance obligations under the contract, it will not create any derivative work from EXIM data;

Restrict access to the EXIM data to its personnel, agents, or consultants, if any, who have a need to have access and who have been advised of and have agreed in writing or are otherwise bound to treat such information in accordance with the terms of the contract;

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

As part of the contract closeout, return or destroy (as directed by EXIM) all EXIM data in its possession upon termination or expiration of the contract or as otherwise requested by the

EXIM;

Submit evidence of compliance with the close-out requirements in this provision, in a manner described by EXIM, at its discretion;

Not commingle EXIM data with Vendor/Contractor- specific records or data;

Contractors engaging in cross-device tracking at all phases should truthfully disclose their tracking activities, accurately identify the categories of data collected involved, and provide meaningful information about whether and how cross-device tracking occurs; and

Follow the agency’s Records Control Schedule and/or the General Records Schedules for EXIM data.

Privacy or EXIM’s Data Breach Notification (if any)

In the event that the Vendor/Contractor suspects or confirms a privacy or EXIM data breach (if any), the Vendor/Contractor is required to do the following:

Notify the CORs and EXIM Helpdesk at 202-565-3990 (helpdesk@exim.gov), within one hour of a suspected or confirmed breach, in any medium or form, including paper, oral, and electronic.

Vendor/Contractor shall provide at a minimum, the following information (and be responsive to further questions on details from the Helpdesk and/or the Cybersecurity team):

Date and time the breach was discovered;

The type of information potentially compromised by the suspected or confirmed breach;

Number of individuals affected by the suspected or confirmed breach;

Steps taken to notify the individuals affected by the suspected or confirmed breach;

Identification of the breakdown in safeguards that led to the suspected or confirmed breach;

and Any additional information relevant to the breach.

Understand that reporting a privacy breach shall not, by itself, be interpreted as evidence that the Vendor/Contractor or its subcontractor (at any tier) failed to provide adequate safeguards for EXIM data.

All determinations related to EXIM information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Vendor/Contractor in consultation with the EXIM COR and/or Chief Privacy Officer (CPO).

The Vendor/Contractor shall provide full access and cooperation for all activities determined by EXIM to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

Incident response activities determined to be required by EXIM may include, but are not limited to, the following:

Inspections;

Investigations;

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

Forensic reviews; and Data analyses and processing.

EXIM, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

Recordkeeping

The Vendor/Contractor’s operating information systems on behalf of the Government or operating systems containing sensitive information shall cooperate and comply with Federal reporting requirements.

Service Level Agreement (SLA)

EXIM as an agency of the Federal Government, does not sign services agreements as a means of entering into contract with commercial entities. EXIM may incorporate such service agreements into government contracts with an appropriate caveat that conflicts arising between the terms of the contract and the incorporated service agreement shall be resolved in favor of the former as some terms in a private sector service agreement are inappropriate for incorporation into a Federal Government contract.

B.5 DELIVERABLES SPECIFIC

Reference Statement of Requirements (SOR) above.

B.6 COOPERATION

The contractor will be required to cooperate with any other firms or individuals as directed by EXIM.

B.7 INFORMATION PROTECTION

Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of this contract. Contractor shall implement procedures that ensure appropriate administrative, technical, and physical safeguards are established for the security and confidentiality of US Government information, data, and/or equipment.

The contractor’s procedures with respect to access to / safeguarding / use of government information / records / data shall be consistent with then current US Government law and regulation in general, and the OMB Circular A-130 Management of Federal Information Resources in particular.

In addition, during all activities and operations on government premises, the contractor shall comply with the policies, rules, procedures, and regulations governing the conduct of personnel upon or within government facilities, and or the protection of government information / records / data as are in general effect and or promulgated locally by EXIM, written or oral. All documents and information in contractor’s possession pertaining to government network vulnerabilities, security policy, operational procedures or related functions shall be maintained by the contractor under absolute accountability and relinquished to the COR upon completion of the contract.

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

B.8 COMPLIANCE WITH IT SECURITY POLICES, PROCEDURES, AND REQUIREMENTS

IAW FAR 4.1903 and 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, the contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the Federal Information Security Management Act of 2014 (“FISMA”), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology (“NIST”) Special Publications (“SP”), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards (“FIPS”) Publications 140-2, 199, and 200, OMB Memoranda, Federal Risk and Authorization Management Program (“FedRAMP”).

a) Section 508 – Accessibility of Electronic and Information Technology This requirement is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220).

URL: https://www.congress.gov/bill/105th-congress/house-bill/1385 full text: https://www.congress.gov/105/plaws/publ220/PLAW-105publ220.pdf

Section C – Contract Clauses

C.1 PROVISIONS AND CLAUSES INCORPORATED BY REFERENCE (IBR) IAW FAR 52.102

The following provisions and clauses were pulled from the Federal Acquisition Regulations FAR Smart Matrix and are incorporated by reference per the Subpart 52.3 - Provision and Clause Matrix Key in addition to the clauses 51.212-4 and 52.212-5.

Provisions and Clauses Incorporated by Reference Prescribed In FAR Provision (P) or Clause (C)

52.214-34 Submission of Offers in the English Language 14.201-6(w) P 52.215-19 Notification of Ownership Changes 15.408(k) C 52.217-4 Evaluation of Options Exercised at Time of Contract Award. 17.208(b) P 52.217-5 Evaluation of Options. 17.208(c) P 52.225-14 Inconsistency between English Version and Translation of Contract. 25.1103(b) C 52.227-19 Commercial Computer Software License 27.409(g) C 52.227-23 Rights to Proposal Data (Technical) 27.409(l) C 52.232-23 Assignment of Claims 32.806(a)(1) C 52.232-40 Providing Accelerated Payments to Small Business Subcontractors. 32.009-2 C 52.233-2 Service of Protest 33.106 P

52.233.3 Protest After Award 33.106(b) C

52.237-3 Continuity of Services 37.110(c) C 52.242-5 Payments to Small Business Subcontractors. 42.1504 C 52.242-13 Bankruptcy 42.903 C 52.242-15 Stop-Work Order 42.1305(b) C

C.2 PROVISIONS AND CLAUSES INCORPORATED BY FULL TEXT

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services.

Referenced below in Section E.

52.212-2 Evaluation—Commercial Products and Commercial Services Referenced below in Section E.

52.212-3 Offeror Representations and Certifications—Commercial Products and Commercial Services.

SAM.gov prime contractor information shall be used for 52.212-3.

https://www.congress.gov/bill/105th-congress/house-bill/1385 https://www.congress.gov/105/plaws/publ220/PLAW-105publ220.pdf https://www.acquisition.gov/far-smart-matrix https://www.acquisition.gov/far-smart-matrix https://www.acquisition.gov/far-smart-matrix https://acquisition-uat.gsa.gov/far/part-52#FAR_Subpart_52_3

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services.

Referenced in Section C. To be included in full text with award document.

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Products and Commercial Services.

Referenced in Section C. To be included in full text with award document.

52.217-8 Option to Extend Services.

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within fifteen (15) days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

b) The Government may extend the term of this contract by written notice to the Contractor within fifteen (15) days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least fifteen (15) days before the contract expires. The preliminary notice does not commit the Government to an extension.

c) If the Government exercises this option, the extended contract shall be considered to include this option clause.

d) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years and 6 months.

(End of clause)

52.252-4 Alterations in Contract.

As prescribed in 52.107(d), insert the following clause in solicitations and contracts in order to revise or supplement, as necessary, other parts of the contract, or parts of the solicitation that apply after contract award, except for any clause authorized for use with a deviation. Include clear identification of what is being altered.

Portions of this contract are altered as follows: To be determined by the contracting officer as applicable.

(End of clause)

52.232-18 Availability of Funds.

As prescribed in 32.706-1(a), Funds are not presently available for this contract. The Government’s obligation under this contract is contingent upon the availability of appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise until funds are made available to the Contracting Officer for this contract and until the Contractor receives notice of such availability, to be confirmed in writing by the Contracting Officer.

(End of clause)

52.252-1 Solicitation Provisions Incorporated by Reference.

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed https://www.acquisition.gov/far/part-52#FAR_52_107 https://www.acquisition.gov/far/32.706-1#FAR_32_706_1

Character, Reputational, and Transaction Integrity (CRTI) Online Due Diligence System Solicitation 83310123R0001 by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer.