CORHQ-25-Q-0294.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-25-Q-0294

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 52

NONPUBLIC//FDIC BUSINESS#

Total Price Base Period

Description of Subscription

Time of Delivery:

Technical Point of Contact:

Company:

Phone:

Email Address:

Fortify on Demand is a vulnerability scanning platform that is used as a part of FDIC's Application Security

Program.

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 52

NONPUBLIC//FDIC BUSINESS#

Line Item # Purchase Category Purchase Type Description Part # Period of Performance Serial # Qty List Price Discount Net Price

Exten ded Net

Price

1 SUBSCRIPTION GOODS

Fortify on Demand 100+ Assessment Units with

Managed Support SaaS - 1 Year

SA-AB137 11/01/2025-10/31/2026 NSN 1035

2 SERVICES SUPPORT Fortify on Demand Enhanced Support SaaS - 1 Year SA-AB840 11/01/2025-10/31/2026 NSN 1

Total Price -$

Requirement Description: Fortify on Demand

Price Schedule

Section B - Supplies or Services and Prices/Costs PAGE 5 OF 52

Section C - Description/Specifications/Work Statement

No attachments were added for this section.

Clauses Incorporated By Reference

Clause # Title Date

7.3.2-34 Duty to Deliver or Perform July 2008

Full Text Clauses

No full text clauses were found for this section.

Section C - Description/Specifications/Work Statement PAGE 6 OF 52

Section E - Inspection and Acceptance

No reference clauses were found for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have Fifteen (15) business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require Contractor to reperform the services or redeliver the goods in conformity with the requirements of the

Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require

Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 7 OF 52

Section F - Deliveries or Performance

7.3.1-09 - Delivery Schedule - July 2008 The goods must be delivered in accordance with Price Schedule.

7.3.1-10 - Place of Delivery or Performance - November 2013 The place of delivery or performance is:

Federal Deposit Insurance Corporation (FDIC)

Division of Information Technology (DIT)

Distribution Center

3501 Fairfax Drive, Arlington, VA 22226

Contractor must ensure the contract number is listed on the shipping material or packing slip.

Non-tangible items shall be submitted to the following email address:

DITSoftwareMgt@fdic.gov.

To include all certificates and maintenance renewals.

7.3.1-12 - Period of Performance - July 2023 The period of performance begins on November 1, 2025 and expires on October 31, 2026.

Section F - Deliveries or Performance PAGE 8 OF 52

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum.

The Oversight Manager is Meghan White. She can be reached at meghwhite@fdic.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders.

The Contracting Officer is Zachary Rich. He can be reached at zrich@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Section G - Contract Administration Data PAGE 9 OF 52

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-12 - Schedule for Invoicing - July 2008 For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-13 - Contents of Invoice - March 2014 Contractor''s invoices must include the following items in order to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date. (Contractors must date invoices as close as possible to the date of electronic transmission to

FDIC.)

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number, Delivery Order Number, etc.)

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered or services performed.

(h) Total invoice amount.

(i) Payment terms (discount for prompt payment terms).

(j) Remittance address.

(k) Billing Point of Contact (e.g., name (where practicable), title, phone number, and mailing address of person to notify if there are questions regarding the invoice).

(l) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment.

Shipping charges, if any, must be shown as a separate item on the invoice).

(m) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(n) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(o) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice it submits to FDIC;

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor''s invoice when seeking reimbursement of subcontractor expenses.

(p) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clearly evident in the supporting documentation provided with the invoice.

(q) The following certification statement, signed by an authorized company representative:

"This is to certify that the services set forth herein [goods described herein] were performed [delivered] during the period stated.

Contractor''s Authorized Representative Date"

Section G - Contract Administration Data PAGE 10 OF 52

(r) Any other information or supporting documentation required by the award.

If an invoice does not contain the above required information; contains errors; or exceeds the total compensation ceiling limit for this award, the invoice will be returned to Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, in order to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because

Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

Section G - Contract Administration Data PAGE 11 OF 52

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 12 OF 52

Section H - Special Contract Requirements

7.5.2-08 Risk Level Designation (Functional Responsibility) September 2024

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.4.2-01 - Security and Privacy Compliance for IT Services - September 2024

(a) Security and Privacy Compliance. The Contractor is responsible for Information Technology (IT) security for

Contractor personnel and subcontractor personnel granted access to: sensitive information as defined in FDIC

Directive 1360.09 (and referenced throughout this contract as ‘sensitive’ or ‘FDIC-sensitive information’); the FDIC network; systems connected to the FDIC network; and systems developed, maintained, implemented or operated by the Contractor for FDIC. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information shall comply with all FDIC information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from FDIC Information Security/Privacy staff.

(b) Laws and Standards. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information must comply with Federal laws and standards addressing information security and privacy. These include but are not limited to:

(1) The Privacy Act of 1974 (5 U.S.C. § 552a) as amended (if incorporated in the contract);

(2) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

(Transmittal Memorandum No. 4) including Appendices;

(3) E-Government Act of 2002 (P. L. 107-347) including Title II, Section 208 - Privacy Provisions and Title III -

Federal Information Security Modernization Act of 2014 (FISMA), and related OMB guidance; and

(4) National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and

Special Publications.

(c) FDIC Policy and Guidance. All IT products developed by and IT development services provided by the

Contractor, specifically for FDIC, shall address information security and privacy requirements throughout their

Section H - Special Contract Requirements PAGE 13 OF 52 design, development, implementation, maintenance, operation, and termination as provided in FDIC system development life cycle policy and guidance. This includes completing or providing the necessary information for the

FDIC to complete privacy impact assessments, security assessments, risk assessments, security plans, contingency plans, and other security and privacy artifacts as required.

(d) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the Oversight Manager. Information shall be returned securely in a format directed by the Oversight Manager. Retention of FDIC information by the Contractor beyond the conclusion of the contract is only permissible in accordance with clause 7.6.3-02, Contractor Return, Destruction and Retention of FDIC Information.

(c) Inspections/Assessments/Audits/Reviews/Examinations. To confirm Contractor’s compliance with this contract, as well as any applicable laws, regulations and industry standards, Contractor shall grant FDIC information security and privacy staff, the FDIC Office of the Inspector General, the U.S. Government Accountability Office (GAO), or an

FDIC-selected third party acting on the FDIC’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all FDIC information being handled and/or services being provided to FDIC pursuant to this contract. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores FDIC information pursuant to this contract.

These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the FDIC or the federal government’s audit and inspection rights delineated in other clauses of this contract or by statute.

(d) Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information

Section H - Special Contract Requirements PAGE 14 OF 52 systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 and FDIC’s Breach Response Plan, and to assist in responding to a breach. FDIC’s Breach Response Plan is available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with FDIC’s Breach Response Plan. All security and privacy incidents that involve FDIC information must be immediately reported to FDIC’s Computer Security Incident Response Team (CSIRT)/Security

Operations Center (SOC) at the telephone/email address provided in paragraph (e) below. The Contractor and subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what FDIC information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

(e) The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of FDIC information and with whom the Contracting Officer, Oversight Manager, and other applicable FDIC staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the FDIC as needed in resolving an incident;

2. Notify the FDIC of an incident immediately after the Contractor becomes aware of it; and

3. Notify FDIC’s Computer Security Incident Response Team (CSIRT) via email at fdic-csirt@fdic.gov or telephone at 1-877-FDIC-999 (877-334-2999), as well as to the Oversight Manager (OM) of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the FDIC in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

(f) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of

7.4.2-05 - Basic Safeguarding of Covered Contractor Information Systems - March 2021

(a) Definitions. As used in this clause:

“Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional

Section H - Special Contract Requirements PAGE 15 OF 52 information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on

National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract in which the subcontractor may have Federal contract information residing in or transiting through its information system.

Section H - Special Contract Requirements PAGE 16 OF 52

7.5.1-02 - Protecting Sensitive Information - May 2025

(a) Sensitive Information Defined. Per FDIC Directive 1360.09, sensitive information is any information, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of FDIC in carrying out its programs or the privacy to which individuals are entitled. It includes, but not exclusively, the following:

(1) Information that is exempt from disclosure under the Freedom of Information Act, such as trade secrets and commercial or financial information, information compiled for law enforcement purposes, personnel and medical files, and information contained in bank examination reports;

(2) Information under the control of FDIC contained in a Privacy Act system of record that is retrieved using an individual’s name or by other criteria that identifies an individual;

(3) Personally Identifiable Information (PII) about individuals maintained by FDIC that if released for unauthorized use may result in financial or personal damage to the individual to whom such information relates. Sensitive PII, a subset of PII, may be comprised of a single item of information (e.g., SSN) or a combination of two or more items

(e.g., full name along with, financial, medical, criminal, or employment information). Sensitive PII presents the highest risk of being misused for identity theft or fraud;

(4) Information about insurance assessments, resolution and receivership activities, as well as enforcement, legal, and contracting activities; and

(5) Information related to information technology specific to the FDIC that could be misused by malicious entities

(e.g., internal IP addresses, server names, firewall rules, encryption and authentication mechanisms, and network architecture pertaining to FDIC).

(b) Protecting Sensitive Information. Contractor, all Contractor Personnel, subcontractors and subcontractor personnel shall comply with FDIC Directive 1360.09, Protecting Information, and protect the confidentiality, integrity and availability of sensitive information, including PII, to which they have access. FDIC Directive 1360.09 is available at the FDIC website: https://www.fdic.gov/buying/goods/acquisition/index.html.

(c) Controlling Sensitive Information. All sensitive information, electronic and paper copy, remains the property of

FDIC. Sensitive information shall not be moved outside of FDIC premises or networks/systems unless this contract contains clause 7.4.2-02, Off-site Processing and Storing of FDIC Information.

(d) Confidentiality Agreement. An authorized representative of the Contractor, its subcontractors and consultants, and all personnel (key personnel and non-key personnel) who will have access to FDIC facilities, networks and/or information systems, or sensitive information (whether in hardcopy or electronic form) must execute confidentiality agreements. FDIC Form 3700/46, Confidentiality Agreement (for Contractors/Subcontractors/Consultants) and

FDIC Form 3700/46A, Confidentiality Agreement (for Contractor/Subcontractor/Consultant Personnel) are included as attachments to this contract. The 3700/46 forms must be signed by the Contractor, and each subcontractor or consultant and submitted at the time of award to the Contracting Officer, with the signed contract. Post-award, they must be submitted to the Contracting Officer when a new subcontractor or consultant is being requested. (For Basic

Ordering Agreements (BOAs), Receivership Basic Ordering Agreements (RBOAs), and Blanket Purchase

Agreements (BPAs), it is acceptable for the 3700/46 forms to be executed by the Contractor, subcontractors and consultants at the BOA/RBOA/BPA level, thereby being applicable to all task orders issued thereunder.) The

3700/46A forms executed by personnel must be submitted to FDIC no later than five (5) business days after starting performance and prior to receiving any sensitive information. The Contractor must submit the 3700/46A forms signed by key personnel to the Contracting Officer and those signed by non-key personnel to the Oversight

Section H - Special Contract Requirements PAGE 17 OF 52

Manager. Key personnel and non-key personnel who are required to sign a confidentiality agreement, and do not sign, will not be permitted to perform work on the contract. It is acceptable for any key personnel or non-key personnel working on one or more task orders issued under a BOA/RBOA/BPA to sign and submit a single

3700/46A at the BOA/RBOA/BPA level, thereby being applicable to all task orders issued thereunder.

(e) Cybersecurity and Privacy Awareness Training. Any key personnel or non-key personnel with access to sensitive information, who do not have access to the FDIC network and therefore are unable to take FDIC’s on-line

Cybersecurity and Privacy Awareness Training using FDIC’s internal website, must access the training through

FDIC’s external website https://www.fdic.gov/buying/goods/acquisition/index.html (Under the Miscellaneous section). Upon completion of the training, they must provide confirmation via email to the Oversight Manager. The email must contain the following:

• Trainee’s name and phone number;

• Contract number;

• Name of the Contractor (and subcontractor or consultant, if applicable); and

• Date the training was completed.

The training and email confirmation to the Oversight Manager must be accomplished prior to the individual’s initial receipt of any sensitive information, and annually thereafter until contract performance is completed. The Contractor must keep a record of when the training was accomplished, and provide it to FDIC upon request. Failure to complete this training and provide email confirmations within the required timeframes may result in removal from the contract.

(f) Subcontracts. Contractor must ensure this clause is included in all first–tier subcontracts and lower-tier levels of

7.5.1-03 - Access to FDIC Information Systems - February 2025

(a) The Contractor, all Contractor Personnel, subcontractors and subcontractor personnel granted access to FDIC’s network/systems must comply with these FDIC directives:

(1) Cybersecurity and Privacy Awareness Training. FDIC Directive 1360.16 Mandatory Cybersecurity and

Privacy Awareness Training, which requires the completion of on-line FDIC information security and privacy awareness training and electronic certification of completion within five (5) business days of receiving an FDIC network ID, and annually thereafter until such time as the access is terminated. Failure to complete this training and provide electronic certification within the required timeframes will result in revocation of network/system access privileges and possible removal of contractor personnel from the contract.

(2) Acceptable Use of Information Technology Resources. FDIC Directive 1300.04 Information Technology

Acceptable Use, which outlines the permitted and prohibited uses of FDIC hardware, software, and information technology services.

(3) Access Control. FDIC Directive 1360.15 Access Control for Information Technology Resources, which governs the granting and revocation of access to information technology resources, including the initial approval, continued review, and eventual termination of access. Contractor shall promptly notify Oversight Manager and

Contracting Officer when personnel join or leave the contract so access may be granted or revoked without delay.

Section H - Special Contract Requirements PAGE 18 OF 52

(4) Reporting Privacy/Security Incidents. FDIC Directive 1360.12 Reporting Information Security Incidents, which requires reporting to FDIC’s Computer Security Incident Response Team (CSIRT) of all suspected or actual security or privacy incidents involving unauthorized access, misuse, tampering, bypassing security controls, alteration, disclosure or theft of information technology resources, data, and passwords.

(b) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of

(c) The FDIC directives identified in this clause are available on the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html

Section H - Special Contract Requirements PAGE 19 OF 52

Section I - Contract Clauses

7.1.2-01 Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered

Entities

September 2020

7.1.2-02 Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment

April 2021

7.1.3-03 Contractor Employee Whistleblower Rights and Requirement to

Inform Employees of Whistleblower Rights

December 2022

7.3.1-13 OIG Fraud Hotline July 2008

7.3.1-14 Order of Precedence July 2008

7.3.2-35 Calendar Days July 2008

7.3.2-40 Change in Physical Location July 2008

7.3.2-42 Contractor Personnel July 2008

7.3.2-44 Representations and Certifications of Contractor March 2024

7.3.2-54 Cooperation with the Office of Inspector General July 2008

7.3.2-58 Limitation on Payments to Influence Certain Federal Transactions July 2023

7.3.2-63 Affirmative Action for Workers with Disabilities July 2008

7.3.2-64 Affirmative Action for Special Disabled Veterans and Vietnam Era

Veterans

July 2023

7.3.2-65 Employment Reports on Special Disabled Veterans and Vietnam

Era Veterans

July 2023

7.3.2-73 Compliance with 12 CFR Part 366 and Application of 12 CFR Part

September 2009

7.3.2-79 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

March 2024

Section I - Contract Clauses PAGE 20 OF 52

7.5.4-01 Authorization and Consent July 2008

7.5.4-02 Notice and Assistance Regarding Patent and Copyright

Infringement

July 2008

7.5.4-06 FDIC Rights in Data - General May 2025

7.5.4-09 Commercial Computer Software - Restricted Rights July 2008

7.5.6-04 Approved Subcontractors and Consent to Subcontract June 2025

7.5.8-04 Notice to the FDIC on Damage July 2023

7.5.8-11 Liability to Third Persons July 2008

7.5.9-01 FDIC Exempt from Federal, State, and Local Taxes July 2008

7.5.12-07 Restrictions on Certain Foreign Purchases November 2023

7.5.13-05 Payments Under Fixed Price Awards June 2009

7.5.13-09 Travel Expenses (Non-Reimbursable) July 2008

7.5.13-17 Right to Offset Contract Payments Against Delinquent Obligations July 2008

7.5.13-18 Prompt Payment December 2008

7.5.14-02 Notice and Certification of Claims July 2008

7.6.4-03 Risk of Loss or Damage July 2008

7.6.5-01 Changes July 2008

7.6.5-03 Stop Work Order July 2008

7.6.5-05 Assignment of Claims July 2008

7.6.6-01 Termination for Convenience of the FDIC August 2013

7.6.6-02 Termination for Default July 2008

7.6.6-04 Excusable Delays July 2008

7.0.1-02 - Clauses Incorporated by Reference - July 2023 This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. The full text of a contract clause is available in Module 7 of the document entitled Acquisition Procedures and Guidance Manual (APGM), which may be accessed electronically at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html.

Section I - Contract Clauses PAGE 21 OF 52

7.1.2-04 - Reporting Requirements for Supply Chain Events Involving Hardware, Software, and Services - December 2023

(a) Definitions. As used in this clause—

“Covered article” means any of the following:

(1) Information technology, as defined herein, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the

Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on an FDIC or non-FDIC information system, subject to the requirements of the

FDIC’s then current program for controlling Sensitive Unclassified Information; or

(4) Hardware, peripherals, systems, devices, software, or services that include embedded or incidental information technology.

“Information Technology” means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the FDIC, if the equipment is used by the FDIC directly or is used by a Contractor under a contract with the FDIC that requires the use-

(a) of that equipment; or

(b) of that equipment to a significant extent in the performance of a service or the furnishing of a product

Information technology includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but does not include any equipment acquired by a federal Contractor incidental to a federal contract.

“IT security incident” means an occurrence that:

(a) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

(b) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies;

(c) Results in lost, stolen, or inappropriately accessed FDIC information as defined in FDIC Directive 1360.09:

Protecting Information, lost or stolen FDIC-owned devices (mobile phones, laptops, Personal Identity Verification

(PIV) cards), and any other incident included in FDIC Directive 1360.12: Reporting Information Security Incidents, Cybersecurity and Privacy Awareness Training, and FDIC’s Breach Response Plan (available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html); or

(d) Results in a situation that severely impairs, manipulates, or shuts down the operation of a system or group of systems (e.g., Building Automation Systems, Heating, Ventilation, Air Conditioning (HVAC) systems, Physical

Access Control Systems (PACS), Advanced Metering Systems, Lighting Control Systems).

“Prohibited article” means any prohibited product, system, or service that the Contractor offers or provides to the

Government that conflicts with the supply chain terms or conditions of the contract (e.g., Federal Acquisition

Security Council (FASC) exclusion order, FDIC CIO Order, counterfeit or suspect counterfeit items, or FDIC contract provision or clause), including, without limitation, provision 7.3.2-76 Covered Telecommunications

Section I - Contract Clauses PAGE 22 OF 52

Equipment or Services-Representation, provision 7.3.2-77 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment, clause 7.1.2-01, Prohibition on Contracting for Hardware, Software, Products and Services Developed or Provided by Kaspersky Lab and Other Covered Entities, and clause 7.1.2-02, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

“Prohibited source” means any entity with which the FDIC may not enter into or renew a contract or from which the

FDIC may not purchase products or services due to conflicts with the supply chain terms or conditions of the contract (e.g., FASC exclusion order, FDIC CIO Order, FDIC contract provision or clause).

“Supply chain event” means any information, situation or occurrence within the vendor’s supply chain that causes or has the potential to cause damage to FDIC personnel, assets, interests, reputation, operations, or facilities.

Supply chain events can include, without limitation:

(a) Occurrence of an IT security incident;

(b) Discovery of a prohibited article or source; and

(c) Identification of supply chain risk information.

“Supply chain risk” means the risk that any person may sabotage, maliciously introduce unwanted functionality, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles so as to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted by or through covered articles.

“Supply chain risk information” includes, but is not limited to, information that describes or identifies:

(1) Functionality and features of covered articles, including access to data and information system privileges;

(2) The user environment where a covered article is used or installed;

(3) The ability of a source to produce and deliver covered articles as expected;

(4) Foreign control or ownership of, or influence over a source or covered article (e.g., personal or professional ties between a source and any foreign entity, legal regime of any foreign country in which a source is headquartered or conducts operations);

(5) Implications to U.S. government mission(s) or assets, national security, homeland security, or critical functions associated with use of a source or covered article;

(6) Vulnerability of Federal systems, programs, or facilities;

(7) Market alternatives to the covered source;

(8) Potential impact or harm caused by the possible loss, damage, or compromise of a product, material, or service to an organization's operations or mission;

(9) Likelihood of a potential impact or harm, or the exploitability of a system;

(10) Security, authenticity, and integrity of covered articles and their supply and compilation chain;

(11) Capacity to mitigate risks identified;

(12) Factors that may reflect upon the reliability of other supply chain risk information; and

(13) Any other considerations that would factor into an analysis of the security, integrity, resilience, quality, trustworthiness, or authenticity of covered articles or sources.

“Source” means a non-Federal supplier, or potential supplier, of products or services, at any tier.

“Supply chain” means a linked set of resources, processes and persons between multiple tiers of developers that begins with the sourcing of products and services and extends through the design, development, manufacturing, Section I - Contract Clauses PAGE 23 OF 52 processing, handling, and delivery of products and services to the acquirer.

“Suspect counterfeit item” means an item for which credible evidence…