CORHQ-24-Q-0480 Bomgar Solicitation.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-24-Q-0480

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 58

Item

Purchase Category

Purchase Type

Description Manufacturer Part # Qty Unit Cost Total Cost

Base Year 1/1/2025 - 12/31/2025

1 SOFTWARE MAINTENANCE

Remote Support Concurrent User Renewal Maintenance, Annual BeyondTrust Corporation - RSU-ESS

Start Date: 01/01/2025 End Date: 12/31/2025

BeyondTrust RSU-ESS 67

2 SOFTWARE MAINTENANCE

BeyondTrust Appliance B Series-VM - Renewal Maintenance, Annual

BeyondTrust Corporation - BT-APP-B-VM-ESS Start Date: 01/01/2025 End Date: 12/31/2025

BeyondTrust BT-APP-B-VM-ESS 3

3 SOFTWARE MAINTENANCE

ServiceNow Premium Integration ESS, Annual BeyondTrust Corporation - RS-ESS-SNEI

Start Date: 01/01/2025 End Date: 12/31/2025

BeyondTrust RS-ESS-SNEI 1

Option Year 1 1/1/2026 - 12/31/2026

4 SOFTWARE MAINTENANCE

Remote Support Concurrent User Renewal Maintenance, Annual BeyondTrust Corporation - RSU-ESS

Start Date: 01/01/2026 End Date: 12/31/2026

BeyondTrust RSU-ESS 67

5 SOFTWARE MAINTENANCE

BeyondTrust Appliance B Series-VM - Renewal Maintenance, Annual

BeyondTrust Corporation - BT-APP-B-VM-ESS Start Date: 01/01/2026 End Date: 12/31/2026

BeyondTrust BT-APP-B-VM-ESS 3

6 SOFTWARE MAINTENANCE

ServiceNow Premium Integration ESS, Annual BeyondTrust Corporation - RS-ESS-SNEI

Start Date: 01/01/2026 End Date: 12/31/2026

BeyondTrust RS-ESS-SNEI 1

Option Year 2 1/1/2027 - 12/31/2027

7 SOFTWARE MAINTENANCE

Remote Support Concurrent User Renewal Maintenance, Annual BeyondTrust Corporation - RSU-ESS

Start Date: 01/01/2027 End Date: 12/31/2027

BeyondTrust RSU-ESS 67

8 SOFTWARE MAINTENANCE

BeyondTrust Appliance B Series-VM - Renewal Maintenance, Annual

BeyondTrust Corporation - BT-APP-B-VM-ESS Start Date: 01/01/2027 End Date: 12/31/2027

BeyondTrust BT-APP-B-VM-ESS 3

9 SOFTWARE MAINTENANCE

ServiceNow Premium Integration ESS, Annual BeyondTrust Corporation - RS-ESS-SNEI

Start Date: 01/01/2027 End Date: 12/31/2027

BeyondTrust RS-ESS-SNEI 1

Technical POC:

Company:

Telephone #:

Email Address:

PRICE SCHEDULE

Bomgar Software Maintenance

TOTAL

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 58

Section C - Description/Specifications/Work Statement

No attachments were added for this section.

Clauses Incorporated By Reference

Clause # Title Date

No reference clauses were found for this section.

Full Text Clauses

7.3.2-34 - Duty to Deliver or Perform - July 2008 Contractor agrees to perform the services (the "Services") or provide the goods (the "Goods"), in accordance with the terms and conditions set forth herein and in any attachments to the contract.

Section C - Description/Specifications/Work Statement PAGE 5 OF 58

Section E - Inspection and Acceptance

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have fifteen (15) business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 6 OF 58

Section F - Deliveries or Performance

7.3.1-09 - Delivery Schedule - July 2008 The goods must be delivered in accordance with the attached price schedule.

7.3.1-10 - Place of Delivery or Performance - November 2013 The place of delivery or performance is:

Federal Deposit Insurance Corporation (FDIC)

Division of Information Technology (DIT)

Distribution Center

3501 Fairfax Drive, Arlington, VA 22226

Contractor must ensure the contract number is listed on the shipping material or packing slip.

Non-tangible items shall be submitted to the following email address:

DITSoftwareMgt@fdic.gov.

To include all certificates and maintenance renewals.

7.3.1-12 - Period of Performance - July 2023 The Initial Period of Performance begins on January 1, 2025 ("Effective Date") and expires on December 31, 2025.

If all option periods are exercised, the final expiration date is December 31, 2027.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 7 OF 58

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum.

The Oversight Manager is Duane Bouie. He can be reached at dbouie@fdic.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders.

The Contracting Officer is Raven Childs. She can be reached at ravchilds@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Section G - Contract Administration Data PAGE 8 OF 58

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-12 - Schedule for Invoicing - July 2008 For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-13 - Contents of Invoice - March 2014 Contractor''s invoices must include the following items in order to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date. (Contractors must date invoices as close as possible to the date of electronic transmission to

FDIC.)

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number, Delivery Order Number, etc.)

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered or services performed.

(h) Total invoice amount.

(i) Payment terms (discount for prompt payment terms).

(j) Remittance address.

(k) Billing Point of Contact (e.g., name (where practicable), title, phone number, and mailing address of person to notify if there are questions regarding the invoice).

(l) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment.

Shipping charges, if any, must be shown as a separate item on the invoice).

(m) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(n) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(o) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice it submits to FDIC;

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor''s invoice when seeking reimbursement of subcontractor expenses.

(p) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clearly evident in the supporting documentation provided with the invoice.

(q) The following certification statement, signed by an authorized company representative:

"This is to certify that the services set forth herein [goods described herein] were performed [delivered] during the period stated.

Contractor''s Authorized Representative Date"

(r) Any other information or supporting documentation required by the award.

Section G - Contract Administration Data PAGE 9 OF 58

If an invoice does not contain the above required information; contains errors; or exceeds the total compensation ceiling limit for this award, the invoice will be returned to Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, in order to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because

Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no

Section G - Contract Administration Data PAGE 10 OF 58 decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 11 OF 58

Section H - Special Contract Requirements

Attachments for this section start after the clauses.

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.3.2-78 - Commercial Supplier Agreement Terms and Conditions - September 2021

1. Definitions:

A. “Commercial item” means any of the following: [Note: For purposes of this document, the term "commercial item" is interchangeable with the terms "commercially available”, "commercially available software”, "commercial component(s)", "commercial product(s)", and "commercial off-the-shelf (COTS)”.]

(1) Any item, other than real property, that is of a type customarily used by the general public or by nongovernmental entities for purposes other than governmental purposes and that has been sold, leased, licensed to the general public; or has been offered for sale, lease, or license to the general public.

(2) Any item that evolved from an item described in paragraph (1) through advances in technology or performance and that is not yet available in the commercial marketplace, but will be available in the commercial marketplace in time to satisfy the delivery requirements under a government solicitation.

(3) Any item that would satisfy a criterion expressed in paragraphs (1) and (2) of this definition, but for (i) modifications of a type customarily available in the commercial marketplace; or (ii) modifications of a type not customarily available in the commercial marketplace made to meet Federal government requirements.

(4) Any combination of items meeting the requirements of paragraphs (1), (2), (3), or (5) of this definition that are of a type customarily combined and sold in combination to the general public.

(5) Installation services, maintenance services, repair services, training services, and other services if such

Section H - Special Contract Requirements PAGE 12 OF 58 services are procured for support of an item referred to in paragraph (1), (2), (3), or (4) of this definition, and if the source of such services--(i) offers such services to the general public and the Federal government contemporaneously and under similar terms and conditions; and (ii) offers to use the same work force for providing the Federal government with such services as the source uses for providing such services to the general public.

(6) Services of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed under standard commercial terms and conditions. This does not include services sold based on hourly rates without an established catalog or market price for specific service performed.

(7) Any item, combination of items, or service referred to in paragraphs (1) through (6), notwithstanding the fact that the item, combination of items, or service is transferred between or among separate divisions, subsidiaries, or affiliates of a contractor.

(8) Any item determined by the procuring agency to have been developed exclusively at private expense and sold in substantial quantities, on a competitive basis, to multiple state and local governments.

B. “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” and intended to create a binding legal obligation on the end user, such as, but not exclusively, those used in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data. Such agreements may be referred to as Terms of Service (TOS), End User License Agreement (EULA) or another similar legal instrument or agreement and may be presented as a part of a proposal or quotation responding to a solicitation for contract or order. The term applies, regardless of the format or style of the document, whether in paper or electronic form.

2. Applicability. The following terms and conditions apply to any commercial supplier agreement as defined in this clause. These terms take precedence and supersede any conflicting or contrary terms in a contractor, subcontractor or associated third party Commercial license agreement. When any supply or service acquired under this contract is subject to a commercial supplier agreement, the terms of this clause shall be deemed incorporated into the commercial supplier agreement. In addition, the Commercial Supplier Agreement is a part of a contract between the commercial supplier and the FDIC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including all contracts, task orders, and delivery orders). For accepted terms under the commercial supplier agreement, the ordering activity FDIC may be bound as end user, but a

Government employee or person acting on behalf of the government in his or her personal capacity will not be bound. The commercial supplier or license agreement may be incorporated into an FDIC contract as modified by this clause. If a Commercial Supplier Agreement is not required for the goods and services performed by the contractor, all the terms listed below in this clause are not applicable to the contract.

3. Contract Formation. All terms intended to bind the FDIC must be included in static text form within the contract signed by the FDIC. Neither the FDIC nor any authorized end user shall be deemed to have agreed to any terms in the commercial supplier agreement or any terms of any associated third-party agreement by a click box or other comparable mechanism (e.g., “click-wrap” or "browse-wrap" agreements) and such purported execution does not bind the FDIC or an authorized end user and is null and void.

4. Authorization. By executing the Contract, Contractor represents that it is duly authorized to enter into the

Contract, including any amendments to the commercial supplier agreement as incorporated into the contract.

Section H - Special Contract Requirements PAGE 13 OF 58

5. Venue. Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

6. Limitations on Actions. Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

7. Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, binding arbitration shall not be used unless specifically authorized by a FDIC guidance, and equitable or injunctive relief, including award of attorney fees, costs or interest, may be awarded against FDIC only when explicitly provided by statute (e.g. Prompt Payment Act). Any terms in the commercial supplier agreement requiring that disputes be submitted to arbitration or that claims the supplier has the right to injunctive relief, attorney fees, costs or interest is null and void and shall not be enforceable against the Government.

8. Updating Terms. After award the contractor may unilaterally revise terms if they are not material. A material change is defined as: (A) Terms that significantly change Government’s rights or obligations; and (B) Terms that increase Government prices; (C) Terms that decrease overall level of service; or (D) Terms that limit any other

Government right addressed elsewhere in this contract. For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be incorporated into the contract using a bilateral modification. Any terms or conditions unilaterally revised subsequent to award that are inconsistent with any material term or provision of this contract shall not be enforceable against the Government, and the Government shall not be deemed to have consented to them.

9. Representation. Any clause of this agreement requiring the commercial supplier or licensor to defend or indemnify the end user is hereby amended to provide that the U.S. Department of Justice has the sole right to represent the United States in any such action, in accordance with 28 U.S.C. § 516 or FDIC under 12 U.S.C. §

1819, unless otherwise provided by Federal law.

10. Warranties and Disclaimers. FDIC will accept the contractor’s commercial warranty, but does not accept a disclaimer of the implied warranty that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract. Additionally, FDIC does not accept a disclaimer of any warranties expressly provided for in the Contract.

11. Limitation of Liability. All limitations of liability accepted by FDIC shall only apply to claims based on contract and any limitations related to tort or other causes of action shall not apply and shall be null and void and unenforceable against the government. Notwithstanding anything to the contrary in the commercial supplier agreement, nothing in the contract or the commercial supplier agreement shall impair the U.S. Government''s right to recover for fraud or crimes arising out of or related to this Government contract under any federal fraud statute, including but not necessarily limited to the False Claims Act, 31 U.S.C. §§ 3729-3733.

12. Audit. Any audit requested by the contractor will be at the contractor’s or Licensor’s expense without reimbursement by the FDIC. Further, such audit may only be conducted if the auditor satisfies the FDIC’s security requirements for access to its facilities, systems and information.

13. Term and Termination. Neither the Contractor nor Licensor can unilaterally revoke, terminate or suspend an

Agreement or any associated rights granted to the FDIC. In the event of a dispute, the requirements specified in

Section H - Special Contract Requirements PAGE 14 OF 58 the Disputes paragraph of this document would apply.

14. Continued Performance. The supplier or licensor shall not unilaterally revoke, terminate or suspend any rights granted to the Government except as allowed by this contract. If the supplier or licensor believes the FDIC to be in breach of the agreement, it shall pursue its rights under the Disputes Clause of the contract or other applicable

Federal statute while continuing performance.

15. Confidentiality. If the agreement includes a confidentiality clause, it shall be amended to state that the

Government and Government employee’s obligations with regard to confidentiality are governed by statute, such as, but not exclusively, the Trade Secrets Act, 18 U.S.C. § 1905 and the Freedom of Information Act, 5 U.S.C. §

552. To the extent that the confidentiality language conflicts or in any way purports to alter the Government or

Government employee’s obligation with regard to confidentiality, such language shall be null and void and will not be enforceable against the Government.

16. Indemnification. Any language requiring the FDIC to indemnify a contractor or related third-party licensor is null and void and is unenforceable against the Government.

17. Automatic Renewal. Except as otherwise expressly agreed to by the FDIC, any provision of an Agreement requiring automatic renewal of the Agreement is unenforceable against the FDIC.

18. Integration. Any integration clause shall be amended to recognize the associated Contract and these terms and conditions as part of an “entire agreement.”

19. Disputes. If the supplier or licensor believes FDIC is in breach of the Agreements, it shall pursue its rights under the Disputes clause of the Contract and Federal laws and performance under the Contract shall continue pending resolution of the dispute.

20. Governing Law. This agreement shall be governed by Federal law. Any language purporting to subject the

U.S. Government to the laws of a U.S. state, U.S. territory, district, or municipality, or a foreign nation, except where

Federal law expressly provides for the application of such laws, is hereby deleted.

21. Assignment. Neither the Contract nor these Agreements, as amended, shall be assigned, nor may any rights or obligations be delegated, without FDIC’s prior approval, except as permitted pursuant to Clause 7.6.5-05, Assignment of Claims.

22. Payment. The FDIC Contract governs the purchase and payment of fees. Payment for awards made by the

FDIC in its corporate capacity are subject to the Prompt Payment Act. 31 USC §§ 3901-05.

23. Taxes. The FDIC is exempt from paying any City, County, State, and Federal taxes as provided by Tax

Exempt Certificate No. 53-0185558.

24. Force Majeure. Failure to perform this contract according to its terms is excusable and not an event of default if the failure to perform is caused by events beyond the control of Contractor, and through no fault or negligence of

Contractor.

Section H - Special Contract Requirements PAGE 15 OF 58

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the Oversight Manager. Information shall be returned securely in a format directed by the Oversight Manager. Retention of FDIC information by the Contractor beyond the conclusion of the contract is only permissible in accordance with clause 7.6.3-02, Contractor Return, Destruction and Retention of FDIC Information.

(c) Inspections/Assessments/Audits/Reviews/Examinations. To confirm Contractor’s compliance with this contract, as well as any applicable laws, regulations and industry standards, Contractor shall grant FDIC information security and privacy staff, the FDIC Office of the Inspector General, the U.S. Government Accountability Office (GAO), or an

FDIC-selected third party acting on the FDIC’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all FDIC information being handled and/or services being provided to FDIC pursuant to this contract. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores FDIC information pursuant to this contract.

These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the FDIC or the federal government’s audit and inspection rights delineated in other clauses of this contract or by statute.

(d) Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 and FDIC’s Breach Response Plan, and to assist in responding to a breach. FDIC’s Breach Response Plan is available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with FDIC’s Breach Response Plan. All security and privacy incidents that involve FDIC information must be immediately reported to FDIC’s Computer Security Incident Response Team (CSIRT)/Security

Operations Center (SOC) at the telephone/email address provided in paragraph (e) below. The Contractor and

Section H - Special Contract Requirements PAGE 16 OF 58 subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what FDIC information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

(e) The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of FDIC information and with whom the Contracting Officer, Oversight Manager, and other applicable FDIC staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the FDIC as needed in resolving an incident;

2. Notify the FDIC of an incident immediately after the Contractor becomes aware of it; and

3. Notify FDIC’s Computer Security Incident Response Team (CSIRT) via email at fdic-csirt@fdic.gov or telephone at 1-877-FDIC-999 (877-334-2999), as well as to the Oversight Manager (OM) of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the FDIC in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

(f) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

Section H - Special Contract Requirements PAGE 17 OF 58

Solicitation Number CORHQ-24-Q- Part Number See Price Schedule Name of good/software/service See Price Schedule Model or Version Number See Price Schedule Model or Version Name See Price Schedule

Name and Address(es) of Manufacturer

Name and Address(es) of Subcontractors

Offeror's status as one of the following required categories: Original Equipment Manufacturer (OEM), Aftermarket Manufacturer (AM), or Authorized Supplier based on the definitions in 7.1.2-03. Failure to provide status as one of these three categories may result in ineligibility for award.

7.1.2-03 - Pre-Award Risk Management (SCRM) Information

Section H - Special Contract Requirements PAGE 18 OF 58

Section I - Contract Clauses

7.3.1-13 OIG Fraud Hotline July 2008

7.3.1-14 Order of Precedence July 2008

7.3.2-35 Calendar Days July 2008

7.3.2-40 Change in Physical Location July 2008

7.3.2-42 Contractor Personnel July 2008

7.3.2-44 Representations and Certifications of Contractor March 2024

7.3.2-54 Cooperation with the Office of Inspector General July 2008

7.3.2-58 Limitation on Payments to Influence Certain Federal Transactions July 2023

7.3.2-60 Anti-Kickback Procedures July 2023

7.3.2-62 Equal Opportunity July 2008

7.3.2-63 Affirmative Action for Workers with Disabilities July 2008

7.3.2-64 Affirmative Action for Special Disabled Veterans and Vietnam Era

Veterans

July 2023

7.3.2-65 Employment Reports on Special Disabled Veterans and Vietnam

Era Veterans

July 2023

7.3.2-69 Joint and Several Liability July 2008

7.3.2-73 Compliance with 12 CFR Part 366 and Application of 12 CFR Part

September 2009

7.3.2-79 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

March 2024

7.5.4-01 Authorization and Consent July 2008

7.5.4-02 Notice and Assistance Regarding Patent and Copyright

Infringement

July 2008

Section I - Contract Clauses PAGE 19 OF 58

7.5.4-03 Patent Indemnity July 2008

7.5.4-06 FDIC Rights in Data - General July 2008

7.5.8-04 Notice to the FDIC on Damage July 2023

7.5.8-06 Payment and/or Performance Bonds July 2023

7.5.8-11 Liability to Third Persons July 2008

7.5.9-01 FDIC Exempt from Federal, State, and Local Taxes July 2008

7.5.12-07 Restrictions on Certain Foreign Purchases November 2023

7.5.13-05 Payments Under Fixed Price Awards June 2009

7.5.13-09 Travel Expenses (Non-Reimbursable) July 2008

7.5.13-17 Right to Offset Contract Payments Against Delinquent Obligations July 2008

7.5.13-18 Prompt Payment December 2008

7.5.14-02 Notice and Certification of Claims July 2008

7.6.4-03 Risk of Loss or Damage July 2008

7.6.5-01 Changes July 2008

7.6.5-03 Stop Work Order July 2008

7.6.5-05 Assignment of Claims July 2008

7.6.6-01 Termination for Convenience of the FDIC August 2013

7.6.6-02 Termination for Default July 2008

7.6.6-04 Excusable Delays July 2008

7.0.1-02 - Clauses Incorporated by Reference - July 2023 This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. The full text of a contract clause is available in Module 7 of the document entitled Acquisition Procedures and Guidance Manual (APGM), which may be accessed electronically at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html.

7.1.2-01 - Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities - September 2020

Section I - Contract Clauses PAGE 20 OF 58

(a) Definitions. As used in this clause—

“Covered article” means any hardware, software, or service that–

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity.

“Covered entity” means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L.

115-91) prohibits Government use of any covered article. The Contractor is prohibited from—

(1) Providing any covered article that the FDIC will use; and

(2) Using any covered article in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event the Contractor identifies a covered article provided to the FDIC during contract performance, or the

Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer. For Basic Ordering Agreements (BOAs), Receivership BOAs (RBOAs) and

Blanket Purchase Agreements (BPAs), the Contractor shall report to the Contracting Officer for the

BOA/RBOA/BPA, and the Contracting Officer(s) for any affected order.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

7.1.2-02 - Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment - April 2021

Section I - Contract Clauses PAGE 21 OF 58

"Backhaul" means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

"Covered foreign country" means The People's Republic of China.

"Covered telecommunications equipment or services" means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua

Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the

Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

"Critical technology" means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the International

Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export

Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such

Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of

2018 (50 U.S.C. 4817).

"Interconnection arrangements" means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

"Reasonable inquiry" means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that

Section I - Contract Clauses PAGE 22 OF 58 excludes the need to include an internal or third-party audit.

"Roaming" means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

"Substantial or essential component" means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered…