CORHQ-24-Q-0493 - 11.12.24.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-24-Q-0493

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 78

NONPUBLIC//FDIC BUSINESS#

Total Price Base Period + Option Periods $ -

Description of Requirement

Time of Delivery:

Technical Point of Contract:

Company:

Phone:

Email Address:

The Thales 2FA hardware maintenance and support (also known as FDIC’s Enterprise Identity Management (EIDM) 2FA solution) ensures that external users accessing

FDIC resources and applications, such as FDICConnect (FCX) and Examination Tool Suite (ETS), provide appropriate authentication information before gaining entry to FDIC systems. Without these capabilities, the FDIC would not be able to support applications with 2FA.

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 78

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Qty List Price Discount Net Price Extended Net Price

0001 HARDWARE MAINTENANCE Authentication Service Cost 22,000 Users NPN 3/1/2025 - 2/28/2026 22000 $ - $ - $ - $ -

0002 HARDWARE MAINTENANCE Hard Token Purchase Cost **Estimate NPN 3/1/2025 - 2/28/2026 500 $ - $ - $ - $ -

0003 HARDWARE MAINTENANCE Hard Token Shipping Cost ** Estimate NPN 3/1/2025 - 2/28/2026 500 $ - $ - $ - $ -

0004 HARDWARE MAINTENANCE SMS Message Costs 250,000**Estimate NPN 3/1/2025 - 2/28/2026 1 $ - $ - $ - $ -

0005 HARDWARE MAINTENANCE 20Mbps Bandwidth Bundle NPN 3/1/2025 - 2/28/2026 1 $ - $ - $ - $ -

0006 HARDWARE MAINTENANCE 50 Mbps Bandwidth Bundle NPN 3/1/2025 - 2/28/2026 1 $ - $ - $ - $ -

0007 HARDWARE MAINTENANCE Intercity Port (replication) NPN 3/1/2025 - 2/28/2026 1 $ - $ - $ - $ -

0008 HARDWARE MAINTENANCE Fortigate (Managed) NPN 3/1/2025 - 2/28/2026 2 $ - $ - $ - $ -

0009 HARDWARE MAINTENANCE Microsoft SQL Enterprise License NPN 3/1/2025 - 2/28/2026 2 $ - $ - $ - $ -

0010 HARDWARE MAINTENANCE Public IP Address NPN 3/1/2025 - 2/28/2026 10 $ - $ - $ - $ -

0011 HARDWARE MAINTENANCE DRaaS Zerto License NPN 3/1/2025 - 2/28/2026 9 $ - $ - $ - $ -

0012 HARDWARE MAINTENANCE IaaS Backup Service - 1 Server NPN 3/1/2025 - 2/28/2026 9 $ - $ - $ - $ -

0013 HARDWARE MAINTENANCE DRaaS Reserved Compute 2GHz/2GB NPN 3/1/2025 - 2/28/2026 27 $ - $ - $ - $ -

0014 HARDWARE MAINTENANCE IaaS Compute 2Ghz/2GB NPN 3/1/2025 - 2/28/2026 27 $ - $ - $ - $ -

0015 HARDWARE MAINTENANCE DRaaS Reserved Storage NPN 3/1/2025 - 2/28/2026 800 $ - $ - $ - $ -

0016 HARDWARE MAINTENANCE IaaS Standard Storage - 1GB NPN 3/1/2025 - 2/28/2026 800 $ - $ - $ - $ -

0017 HARDWARE MAINTENANCE IaaS Backup Storage - 1GB NPN 3/1/2025 - 2/28/2026 1200 $ - $ - $ - $ -

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Hours List Price Discount Net Price Extended Net Price

0018 SERVICES SUPPORT Part Time Engineer NPN 3/1/2025 - 2/28/2026 35 $ - $ - $ - $ -

Total Price -$

Price Schedule - Base Period Requirement Description: Thales Hardware Maintenance and Support Services

Labor Hour CLIN

Section B - Supplies or Services and Prices/Costs PAGE 5 OF 78

Performance Qty List Price Discount Net Price Extended Net Price

1001 HARDWARE MAINTENANCE Authentication Service Cost 22,000 Users NPN 3/1/2026 - 2/28/2027 22000 $ - $ - $ - $ -

1002 HARDWARE MAINTENANCE Hard Token Purchase Cost **Estimate NPN 3/1/2026 - 2/28/2027 500 $ - $ - $ - $ -

1003 HARDWARE MAINTENANCE Hard Token Shipping Cost ** Estimate NPN 3/1/2026 - 2/28/2027 500 $ - $ - $ - $ -

1004 HARDWARE MAINTENANCE SMS Message Costs 250,000**Estimate NPN 3/1/2026 - 2/28/2027 1 $ - $ - $ - $ -

1005 HARDWARE MAINTENANCE 20Mbps Bandwidth Bundle NPN 3/1/2026 - 2/28/2027 1 $ - $ - $ - $ -

1006 HARDWARE MAINTENANCE 50 Mbps Bandwidth Bundle NPN 3/1/2026 - 2/28/2027 1 $ - $ - $ - $ -

1007 HARDWARE MAINTENANCE Intercity Port (replication) NPN 3/1/2026 - 2/28/2027 1 $ - $ - $ - $ -

1008 HARDWARE MAINTENANCE Fortigate (Managed) NPN 3/1/2026 - 2/28/2027 2 $ - $ - $ - $ -

1009 HARDWARE MAINTENANCE Microsoft SQL Enterprise License NPN 3/1/2026 - 2/28/2027 2 $ - $ - $ - $ -

1010 HARDWARE MAINTENANCE Public IP Address NPN 3/1/2026 - 2/28/2027 10 $ - $ - $ - $ -

1011 HARDWARE MAINTENANCE DRaaS Zerto License NPN 3/1/2026 - 2/28/2027 9 $ - $ - $ - $ -

1012 HARDWARE MAINTENANCE IaaS Backup Service - 1 Server NPN 3/1/2026 - 2/28/2027 9 $ - $ - $ - $ -

1013 HARDWARE MAINTENANCE DRaaS Reserved Compute 2GHz/2GB NPN 3/1/2026 - 2/28/2027 27 $ - $ - $ - $ -

1014 HARDWARE MAINTENANCE IaaS Compute 2Ghz/2GB NPN 3/1/2026 - 2/28/2027 27 $ - $ - $ - $ -

1015 HARDWARE MAINTENANCE DRaaS Reserved Storage NPN 3/1/2026 - 2/28/2027 800 $ - $ - $ - $ -

1016 HARDWARE MAINTENANCE IaaS Standard Storage - 1GB NPN 3/1/2026 - 2/28/2027 800 $ - $ - $ - $ -

1017 HARDWARE MAINTENANCE IaaS Backup Storage - 1GB NPN 3/1/2026 - 2/28/2027 1200 $ - $ - $ - $ -

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Hours List Price Discount Net Price Extended Net Price

1018 SERVICES SUPPORT Part Time Engineer NPN 3/1/2026 - 2/28/2027 35 $ - $ - $ - $ -

Total Price -$

Price Schedule - Option Period 1 Requirement Description: Thales Hardware Maintenance and Support Services

Labor Hour CLIN

Section B - Supplies or Services and Prices/Costs PAGE 6 OF 78

Performance Qty List Price Discount Net Price Extended Net Price

2001 HARDWARE MAINTENANCE Authentication Service Cost 22,000 Users NPN 3/1/2027 - 2/28/2028 22000 $ - $ - $ - $ -

2002 HARDWARE MAINTENANCE Hard Token Purchase Cost **Estimate NPN 3/1/2027 - 2/28/2028 500 $ - $ - $ - $ -

2003 HARDWARE MAINTENANCE Hard Token Shipping Cost ** Estimate NPN 3/1/2027 - 2/28/2028 500 $ - $ - $ - $ -

2004 HARDWARE MAINTENANCE SMS Message Costs 250,000**Estimate NPN 3/1/2027 - 2/28/2028 1 $ - $ - $ - $ -

2005 HARDWARE MAINTENANCE 20Mbps Bandwidth Bundle NPN 3/1/2027 - 2/28/2028 1 $ - $ - $ - $ -

2006 HARDWARE MAINTENANCE 50 Mbps Bandwidth Bundle NPN 3/1/2027 - 2/28/2028 1 $ - $ - $ - $ -

2007 HARDWARE MAINTENANCE Intercity Port (replication) NPN 3/1/2027 - 2/28/2028 1 $ - $ - $ - $ -

2008 HARDWARE MAINTENANCE Fortigate (Managed) NPN 3/1/2027 - 2/28/2028 2 $ - $ - $ - $ -

2009 HARDWARE MAINTENANCE Microsoft SQL Enterprise License NPN 3/1/2027 - 2/28/2028 2 $ - $ - $ - $ -

2010 HARDWARE MAINTENANCE Public IP Address NPN 3/1/2027 - 2/28/2028 10 $ - $ - $ - $ -

2011 HARDWARE MAINTENANCE DRaaS Zerto License NPN 3/1/2027 - 2/28/2028 9 $ - $ - $ - $ -

2012 HARDWARE MAINTENANCE IaaS Backup Service - 1 Server NPN 3/1/2027 - 2/28/2028 9 $ - $ - $ - $ -

2013 HARDWARE MAINTENANCE DRaaS Reserved Compute 2GHz/2GB NPN 3/1/2027 - 2/28/2028 27 $ - $ - $ - $ -

2014 HARDWARE MAINTENANCE IaaS Compute 2Ghz/2GB NPN 3/1/2027 - 2/28/2028 27 $ - $ - $ - $ -

2015 HARDWARE MAINTENANCE DRaaS Reserved Storage NPN 3/1/2027 - 2/28/2028 800 $ - $ - $ - $ -

2016 HARDWARE MAINTENANCE IaaS Standard Storage - 1GB NPN 3/1/2027 - 2/28/2028 800 $ - $ - $ - $ -

2017 HARDWARE MAINTENANCE IaaS Backup Storage - 1GB NPN 3/1/2027 - 2/28/2028 1200 $ - $ - $ - $ -

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Hours List Price Discount Net Price Extended Net Price

2018 SERVICES SUPPORT Part Time Engineer NPN 3/1/2027 - 2/28/2028 35 $ - $ - $ - $ -

Total Price -$

Price Schedule - Option Period 2 Requirement Description: Thales Hardware Maintenance and Support Services

Labor Hour CLIN

Section B - Supplies or Services and Prices/Costs PAGE 7 OF 78

Performance Qty List Price Discount Net Price Extended Net Price

3001 HARDWARE MAINTENANCE Authentication Service Cost 22,000 Users NPN 3/1/2028 - 2/28/2029 22000 $ - $ - $ - $ -

3002 HARDWARE MAINTENANCE Hard Token Purchase Cost **Estimate NPN 3/1/2028 - 2/28/2029 500 $ - $ - $ - $ -

3003 HARDWARE MAINTENANCE Hard Token Shipping Cost ** Estimate NPN 3/1/2028 - 2/28/2029 500 $ - $ - $ - $ -

3004 HARDWARE MAINTENANCE SMS Message Costs 250,000**Estimate NPN 3/1/2028 - 2/28/2029 1 $ - $ - $ - $ -

3005 HARDWARE MAINTENANCE 20Mbps Bandwidth Bundle NPN 3/1/2028 - 2/28/2029 1 $ - $ - $ - $ -

3006 HARDWARE MAINTENANCE 50 Mbps Bandwidth Bundle NPN 3/1/2028 - 2/28/2029 1 $ - $ - $ - $ -

3007 HARDWARE MAINTENANCE Intercity Port (replication) NPN 3/1/2028 - 2/28/2029 1 $ - $ - $ - $ -

3008 HARDWARE MAINTENANCE Fortigate (Managed) NPN 3/1/2028 - 2/28/2029 2 $ - $ - $ - $ -

3009 HARDWARE MAINTENANCE Microsoft SQL Enterprise License NPN 3/1/2028 - 2/28/2029 2 $ - $ - $ - $ -

3010 HARDWARE MAINTENANCE Public IP Address NPN 3/1/2028 - 2/28/2029 10 $ - $ - $ - $ -

3011 HARDWARE MAINTENANCE DRaaS Zerto License NPN 3/1/2028 - 2/28/2029 9 $ - $ - $ - $ -

3012 HARDWARE MAINTENANCE IaaS Backup Service - 1 Server NPN 3/1/2028 - 2/28/2029 9 $ - $ - $ - $ -

3013 HARDWARE MAINTENANCE DRaaS Reserved Compute 2GHz/2GB NPN 3/1/2028 - 2/28/2029 27 $ - $ - $ - $ -

3014 HARDWARE MAINTENANCE IaaS Compute 2Ghz/2GB NPN 3/1/2028 - 2/28/2029 27 $ - $ - $ - $ -

3015 HARDWARE MAINTENANCE DRaaS Reserved Storage NPN 3/1/2028 - 2/28/2029 800 $ - $ - $ - $ -

3016 HARDWARE MAINTENANCE IaaS Standard Storage - 1GB NPN 3/1/2028 - 2/28/2029 800 $ - $ - $ - $ -

3017 HARDWARE MAINTENANCE IaaS Backup Storage - 1GB NPN 3/1/2028 - 2/28/2029 1200 $ - $ - $ - $ -

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Hours List Price Discount Net Price Extended Net Price

3018 SERVICES SUPPORT Part Time Engineer NPN 3/1/2028 - 2/28/2029 35 $ - $ - $ - $ -

Total Price -$

Price Schedule - Option Period 3 Requirement Description: Thales Hardware Maintenance and Support Services

Labor Hour CLIN

Section B - Supplies or Services and Prices/Costs PAGE 8 OF 78

Section C - Description/Specifications/Work Statement

Attachments for this section start after the clauses.

Clauses Incorporated By Reference

Clause # Title Date

No reference clauses were found for this section.

Full Text Clauses

7.3.2-21 - Description/Specifications/Work Statement - October 2008 The name/description of the goods or services being acquired is as follows:

Thales Hardware Maintenance and Support Services

The specifications for and the description of the work to be performed under this award are fully detailed in either a

Statement of Work (SOW) as an attachment to Section C of this award document.

7.3.2-34 - Duty to Deliver or Perform - July 2008 Contractor agrees to perform the services (the "Services") or provide the goods (the "Goods"), in accordance with the terms and conditions set forth herein and in any attachments to the contract.

Section C - Description/Specifications/Work Statement PAGE 9 OF 78

Statement of Work 2FA Solution for EIDM

1.0. GENERAL

1.1. Background.

The Federal Deposit Insurance Corporation (FDIC) maintains the stability and public confidence in the nation’s financial system by (1) insuring deposits, (2) examining and supervising financial institutions, and (3) managing resolutions and receiverships. The Federal Deposit Insurance Corporation (FDIC) maintains partnership with a variety of external organizations including financial institutions, vendors, service providers, other government entities and regulators. Many core business processes involve users from these external partners. The FDIC needs to manage and maintain trusted relationships with these users, and grant them access to FDIC IT resources and data. Thus, the FDIC has developed an Extranet Identity Management (EIDM) solution to fulfill this need. A critical component of the EIDM solution includes the ability for certain user types (roles) to authenticate into FDIC resources using two-factor authentication (2FA). This statement of work is focused on the 2FA component.

1.2. Scope of Work.

The purpose of the existing 2FA solution is to ensure that external users accessing FDIC resources provide appropriate authentication information for the resources they are trying to access. The 2FA service shall meet the following FDIC requirements:

• The solution shall be a vendor hosted service package to include One Time Password (OTP) token authentication service infrastructure and support.

• The solution shall integrate with FDIC's Identity Management solution. Specifically, the 2FA service exposes an API that can be leveraged by the Optimal Virtual Identity Federation (VISFED) Server and Microsoft Active Directory Federated Services (ADFS). It shall be compatible with ASP.NET and have either ISAPI filter-based authentication process compatible with IIS7.x (or higher) or provide a .NET v3 (or higher) programming interface, or API interface via Web Services and have support for SAML.

• The solution shall be capable of supporting multiple OTP provider technologies (for example, hard tokens, soft tokens, SMS, etc.) and be able to deliver those tokens to end-users via first-class or expedited mail (hard tokens), electronic delivery (downloadable application for soft tokens), and via SMS gateway to cellular phones within USA.

• The solution shall provide administrative capability for FDIC staff, including but not limited to reports providing trend information pertaining to failed logons, along with all other reports available by the 2FA solution platform.

• The 2FA service shall provide a simple user experience for the user to register to use the 2FA service and deliver seamlessly those tokens to users as mentioned above.

Section C - Description/Specifications/Work Statement PAGE 10 OF 78

• The 2FA service shall be fully integrated with the FDIC Extranet Identity Management solution in the FDIC DEV (PIE, CIE), QA, PROD, and DR environments.

1.3. Government-Furnished Property.

N/A

2.0. APPLICABLE DOCUMENTS

N/A

3.0. REQUIREMENTS

OVERALL

• The 2FA service provider shall provide the FDIC with a subject matter expert with deep product knowledge and experience with implementation of 2FA service in different environments, in particular experience with successful implementations of 2FA service with a US government agency.

• The contractor shall provide all necessary management, supervision, personnel, supplies, materials and equipment.

• The 2FA service shall be available 99.9% of the time (three 9s) outside any maintenance window.

• The 2FA service provider shall provide user support for users for issues associated with using the 2FA service.

• The 2FA service provider shall provide life-cycle management support for the chosen OTP technologies (for example, replacement of hard tokens, updates of soft tokens, etc.).

• The 2FA provider shall be committed to the 2FA industry space and has a roadmap for the service for the next four years.

• The 2FA service shall be recoverable in the event of disaster in a backup data center with a recovery time objective (RTO) of no more than 12 hours and recovery point in time objective of no more than 12 hours prior and the backup data center must reside in a different U.S. power grid region from the primary data center as per FDIC Continuity of Operations and FEMA Category II requirements.

SECURITY SPECIFIC

• All FDIC data must be stored and processed in the United States only.

• Any vendor technical support staff must be physically located within the United States soil.

• Non-U.S. citizens shall not be authorized to access or assist in the any FDIC system without

Section C - Description/Specifications/Work Statement PAGE 11 OF 78 official approval from the FDIC Contracting Officer.

• Vendor shall provide information regarding primary and backup data processing handling sites, including type and locations.

• Vendor shall provide common criteria certification information.

• 2FA service to be purchased by the FDIC shall be FIPS 140-2 compliant, including encryption of sensitive data at rest and in transit and comply with Security Requirement is Section 3.2.

3.2. System Security Assessment and Authorization Requirements

3.2.1. Authority to Operate

3.2.1.1. The Contractor shall not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall adhere to current FDIC policies, procedures, and guidance for the SSA process as defined below.

3.2.1.2. Complete the Security Authorization Process. The SSA process shall proceed according to the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any successor publication including templates.

3.2.1.3. System Security Assessment and Authorization Process Documentation. SSA documentation shall be developed by the Contractor using the FDIC provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

3.2.1.4. Independent Assessment. Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

3.2.1.5. Support the Completion of the Privacy Compliance Documentation. As part of the SSA process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use PII. Upon review of the PTA, the OCISO Privacy

Section C - Description/Specifications/Work Statement PAGE 12 OF 78

Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

3.2.1.6. Authorization to Operate. Upon completion of the SSA documentation and independent assessment, the Contractor shall submit a signed SSA package, validated by the independent third party, to the Oversight Manager for acceptance by the FDIC Authorizing Official (AO), or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively. The SSA package must include the following:

3.2.1.6.1. Deliverables (30 Days Prior to System Use)

3.2.1.6.1.1. Security and privacy plans

3.2.1.6.1.2. Security and privacy assessment reports

3.2.1.6.1.3. Plan of action and milestones

3.2.1.6.1.4. Supporting assessment evidence or other documentation, as required.

3.2.1.7. Continuous Monitoring/Ongoing Assessment. After an initial authorization, the Contractor shall have the security and privacy controls assessed on an ongoing basis in accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency. Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the Oversight Manager for acceptance by the FDIC AO. The system needs to undergo a Security Impact Assessment (SIA) whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

3.3. Personnel. N/A

Section C - Description/Specifications/Work Statement PAGE 13 OF 78

3.4. Deliverables

The contractor shall provide the following deliverables in connection with this work:

Deliverable Description Estimated Delivery Date

A working 2FA solution for the FDIC DEV (PIE, CIE), QA, PROD and DR environments including required tokens, authentication service and support.

Contract Award

Integration support with FDIC for all release upgrades of the 2FA solution platform.

As required

Operational support for the 2FA platform and escalation support for end-users issues associated with using the 2FA service.

As required

Weekly Status Report, in a format to be agreed upon by the FDIC project manager (or designee) and the contractor project manager to capture weekly performance against ATO Project Plan and scope of work performed by solution engineers. This plan shall include hours worked weekly under any labor hour category and planned hours for the following week.

Weekly

User registration documentation for users to sign up to use the 2FA service.

As required

System documentation, Configuration and maintenance procedures as required by FDIC Operations Personnel.

As required

Support for FDIC Security requests pertaining to security of the system, penetration testing, configuration baselines.

As required

Systems usage and other agreed upon reports. Monthly

System Maintenance and support services. As required

Re-configuration of system and ATO Deliverables

System Security Assessment and Authorization Requirements project plan: Timelines for system build out, assessment, and implementation within 30 days of contract award. This project plan is required to be updated once the initial scanning assessment has been completed.

30 Days after award

Section C - Description/Specifications/Work Statement PAGE 14 OF 78

System Security Assessment and Authorization Documentation

In accordance with Project Plan

Independent Assessment Results In accordance with Project Plan

SSA Package (must include Security and Privacy Plans, Security and Privacy Reports, POAMs, & support assessment evidence)*

In accordance with Project Plan but NLT 31 December 2022

ATO Maintenance Deliverables:

Monthly security scan reports* Monthly

* Payment for these items will only begin after FDIC has approved the ATO. Vendor shall submit invoices on a monthly basis for services furnished during the preceding month, unless otherwise stated, and each invoice shall reference the applicable line under the Statement of Work and shall include supporting detail and documentation of all charges. In no event shall FDIC pay for services not performed during the period of performance of this contract.

3.5. Place of Delivery or Performance.

The performance will take place at a contractor’s facility, and third-party shipping facility.

Section C - Description/Specifications/Work Statement PAGE 15 OF 78

Section E - Inspection and Acceptance

No attachments were added for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have 15 business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 16 OF 78

Section F - Deliveries or Performance

7.3.1-09 - Delivery Schedule - July 2008 The goods must be delivered in accordance with the Price Schedule.

7.3.1-10 - Place of Delivery or Performance - November 2013 All tangible items shall be delivered to the following address:

Federal Deposit Insurance Corporation (FDIC)

Division of Information Technology (DIT)

Distribution Center

3501 Fairfax Drive, Arlington, VA 22226

Contractor must ensure the contract number is listed on the shipping material or packing slip.

Non-tangible items shall be submitted to the following email address:

DITSoftwareMgt@fdic.gov.

To include all certificates and maintenance renewals.

7.3.1-11 - Deliverables - July 2008 The Contractor must provide all deliverables described in the statement of work.

7.3.1-12 - Period of Performance - July 2023 The Initial Period of Performance begins on 3/1/2025 and expires on 2/28/2026. If all option periods are exercised, the final expiration date is 2/28/2029.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 17 OF 78

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum. The Oversight Manager is Russell Rogers who can be reached at rurogers@fdic.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders. The Contracting Officer is Diamond Toles who can be reached at ditoles@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a

Section G - Contract Administration Data PAGE 18 OF 78 proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-06 - Compensation Ceiling - Contract or Task Order - July 2008 Not-to-Exceed

Period of Performance Ceiling Amount

Initial Period: $________________

Option Period 1: $________________

Option Period 2: $________________

Option Period 3: $________________

Total (if all option periods are exercised): $________________

In no event will total FDIC compensation to Contractor, including any reimbursed costs and expenses, exceed the sum of ________________ Dollars ($__________) for the entire Period of Performance, including the initial period and all options, if any. Contractor must notify the Contracting Officer, in writing, when Contractor has incurred charges amounting to seventy-five percent (75%) of the ceiling amount for each performance period.

7.5.13-12 - Schedule for Invoicing - July 2008 For Labor-Hour or Time-and-Material, Contractor must submit invoices within thirty (30) days after the end of each month. For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-13 - Contents of Invoice - March 2014 Contractor''s invoices must include the following items in order to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date. (Contractors must date invoices as close as possible to the date of electronic transmission to

FDIC.)

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number, Delivery Order Number, etc.)

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered or services performed.

(h) Total invoice amount.

(i) Payment terms (discount for prompt payment terms).

(j) Remittance address.

(k) Billing Point of Contact (e.g., name (where practicable), title, phone number, and mailing address of person to notify if there are questions regarding the invoice).

(l) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment.

Shipping charges, if any, must be shown as a separate item on the invoice).

(m) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(n) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(o) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice it submits to FDIC;

Section G - Contract Administration Data PAGE 19 OF 78

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor''s invoice when seeking reimbursement of subcontractor expenses.

(p) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clearly evident in the supporting documentation provided with the invoice.

(q) The following certification statement, signed by an authorized company representative:

"This is to certify that the services set forth herein [goods described herein] were performed [delivered] during the period stated.

Contractor''s Authorized Representative Date"

(r) Any other information or supporting documentation required by the award.

If an invoice does not contain the above required information; contains errors; or exceeds the total compensation ceiling limit for this award, the invoice will be returned to Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, in order to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because

Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

Section G - Contract Administration Data PAGE 20 OF 78

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 21 OF 78

Section H - Special Contract Requirements

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.3.2-78 - Commercial Supplier Agreement Terms and Conditions - September 2021

1. Definitions:

A. “Commercial item” means any of the following: [Note: For purposes of this document, the term "commercial item" is interchangeable with the terms "commercially available”, "commercially available software”, "commercial component(s)", "commercial product(s)", and "commercial off-the-shelf (COTS)”.]

(1) Any item, other than real property, that is of a type customarily used by the general public or by nongovernmental entities for purposes other than governmental purposes and that has been sold, leased, licensed to the general public; or has been offered for sale, lease, or license to the general public.

(2) Any item that evolved from an item described in paragraph (1) through advances in technology or performance and that is not yet available in the commercial marketplace, but will be available in the commercial marketplace in time to satisfy the delivery requirements under a government solicitation.

(3) Any item that would satisfy a criterion expressed in paragraphs (1) and (2) of this definition, but for (i) modifications of a type customarily available in the commercial marketplace; or (ii) modifications of a type not customarily available in the commercial marketplace made to meet Federal government requirements.

(4) Any combination of items meeting the requirements of paragraphs (1), (2), (3), or (5) of this definition that are of a type customarily combined and sold in combination to the general public.

(5) Installation services, maintenance services, repair services, training services, and other services if such

Section H - Special Contract Requirements PAGE 22 OF 78 services are procured for support of an item referred to in paragraph (1), (2), (3), or (4) of this definition, and if the source of such services--(i) offers such services to the general public and the Federal government contemporaneously and under similar terms and conditions; and (ii) offers to use the same work force for providing the Federal government with such services as the source uses for providing such services to the general public.

(6) Services of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed under standard commercial terms and conditions. This does not include services sold based on hourly rates without an established catalog or market price for specific service performed.

(7) Any item, combination of items, or service referred to in paragraphs (1) through (6), notwithstanding the fact that the item, combination of items, or service is transferred between or among separate divisions, subsidiaries, or affiliates of a contractor.

(8) Any item determined by the procuring agency to have been developed exclusively at private expense and sold in substantial quantities, on a competitive basis, to multiple state and local governments.

B. “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” and intended to create a binding legal obligation on the end user, such as, but not exclusively, those used in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data. Such agreements may be referred to as Terms of Service (TOS), End User License Agreement (EULA) or another similar legal instrument or agreement and may be presented as a part of a proposal or quotation responding to a solicitation for contract or order. The term applies, regardless of the format or style of the document, whether in paper or electronic form.

2. Applicability. The following terms and conditions apply to any commercial supplier agreement as defined in this clause. These terms take precedence and supersede any conflicting or contrary terms in a contractor, subcontractor or associated third party Commercial license agreement. When any supply or service acquired under this contract is subject to a commercial supplier agreement, the terms of this clause shall be deemed incorporated into the commercial supplier agreement. In addition, the Commercial Supplier Agreement is a part of a contract between the commercial supplier and the FDIC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including all contracts, task orders, and delivery orders). For accepted terms under the commercial supplier agreement, the ordering activity FDIC may be bound as end user, but a

Government employee or person acting on behalf of the government in his or her personal capacity will not be bound. The commercial supplier or license agreement may be incorporated into an FDIC contract as modified by this clause. If a Commercial Supplier Agreement is not required for the goods and services performed by the contractor, all the terms listed below in this clause are not applicable to the contract.

3. Contract Formation. All terms intended to bind the FDIC must be included in static text form within the contract signed by the FDIC. Neither the FDIC nor any authorized end user shall be deemed to have agreed to any terms in the commercial supplier agreement or any terms of any associated third-party agreement by a click box or other comparable mechanism (e.g., “click-wrap” or "browse-wrap" agreements) and such purported execution does not bind the FDIC or an authorized end user and is null and void.

4. Authorization. By executing the Contract, Contractor represents that it is duly authorized to enter into the

Contract, including any amendments to the commercial supplier agreement as incorporated into the contract.

Section H - Special Contract Requirements PAGE 23 OF 78

5. Venue. Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

6. Limitations on Actions. Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

7. Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, binding arbitration shall not be used unless specifically authorized by a FDIC guidance, and equitable or injunctive relief, including award of attorney fees, costs or interest, may be awarded against FDIC only when explicitly provided by statute (e.g. Prompt Payment Act). Any terms in the commercial supplier agreement requiring that disputes be submitted to arbitration or that claims the supplier has the right to injunctive relief, attorney fees, costs or interest is null and void and shall not be enforceable against the Government.

8. Updating Terms. After award the contractor may unilaterally revise terms if they are not material.