CORHQ-25-R-0409.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-25-R-0409

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 87

NONPUBLIC//FDIC BUSINESS#

Total Price Base Period + Option Period $ -

Time of Delivery:

Technical Point of Contact:

Company:

Phone:

Email Address:

Instructions for Offerors: Offerors are to insert Unit Price, any discount information, and total price for each CLIN. Offeror must use this Pricing Workbook for Pricing submission.

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 87

NONPUBLIC//FDIC BUSINESS#

CLIN Description QTY Period of Performance Unit Price Total Price Discount Applied

0001 Records lifecycle & policy enforcement software - max 100TB 1 12 Months -$ -$ -$ 0002 Business Support & Updates 1 12 Months -$ -$ -$ 0003 Limited Extended Support 1 12 Months -$ -$ -$

Planning, Workshops, Installation, Testing, PM (hours) NOT TO EXCEED 200 12 Months

Configuration, Training and Knowledge Transfer (hours) NOT TO EXCEED 400 12 Months

0006 Lead 1st round repositiories migration (hours) NOT TO EXCEED 200 12 Months

Total Base Period Price

NTE

1001 Records lifecycle & policy enforcement software - max 100TB 1 12 Months -$ -$ -$ 1002 Business Support & Updates 1 4 Months -$ -$ -$

Miscelleneous - reserve for 2nd round of repository migration (hours) NOT TO EXCEED 150 4 Months

Total Option Period 1 Price NTE

-$ Total Discount Applied

Total Not to Exceed Ceiling

Base Period

Labor Hour CLINS

Firm Fixed Price CLINS

Option Period 1 Firm Fixed Price CLIN

Labor Hour CLIN

Section B - Supplies or Services and Prices/Costs PAGE 5 OF 87

Section C - Description/Specifications/Work Statement

Attachments for this section start after the clauses.

Clauses Incorporated By Reference

Clause # Title Date

7.3.2-34 Duty to Deliver or Perform July 2008

Full Text Clauses

7.3.2-21 - Description/Specifications/Work Statement - October 2008 The name/description of the goods or services being acquired is as follows:

File Management Categorization and Analysis Tool (FMCAT)

The specifications for and the description of the work to be performed under this award are fully detailed in either a

Statement of Work (SOW) or a Statement of Objective coupled with a Performance Work Statement (PWS), which is included as an attachment in Section J of this award document.

Section C - Description/Specifications/Work Statement PAGE 6 OF 87

CONTROLLED//FDIC INTERNAL ONLY

Statement of Objectives (SOO)

File Management Categorization and Analysis Tool (FMCAT) Version 1.0

Section C - Description/Specifications/Work Statement PAGE 7 OF 87

TABLE OF CONTENTS

1. INTRODUCTION AND PURPOSE

2. BACKGROUND

3. OBJECTIVES

4. TECHNICAL SUPPORT

5. ASSUMPTIONS

6. BUSINESS REQUIREMENTS

7. DELIVERABLES

APPENDIX A – BUSINESS REQUIREMENTS

1. AUDIT

2. CRITERIA

3. DELETION

4. FLAGGING/TAGGING

5. IDENTIFY

6. NOTIFICATIONS

7. PERFORMANCE / SCALABILITY

8. PROCESSING

9. REPORTING

10. SEARCH/SORT/GROUP

11. SECURITY/PRIVACY

13. USABILITY

14. WORKFLOW

APPENDIX B - NON-FUNCTIONAL REQUIREMENTS

APPENDIX C – USE CASE SCENARIO

Section C - Description/Specifications/Work Statement PAGE 8 OF 87

Statement of Objectives

1. Introduction and Purpose This Statement of Objectives (SOO) aims to secure authorization to procure and implement the File Management Categorization and Analysis Tool (FMCAT) within the FDIC environment. FMCAT is a critical enabler for successfully launching the Content Information Management (CIM) initiative, which seeks to transform how enterprise content is governed, accessed, and stored in the cloud. This initiative cannot proceed without conducting a comprehensive analysis and cleanup of redundant, obsolete, and trivial (ROT) content currently residing across the FDIC's network shares.

Implementing FMCAT addresses urgent business needs, including reducing compliance risk, eliminating ROT content, ensuring adherence to records management retention policies, and improving operational efficiency in preparation for future cloud migrations.

The FMCAT initiative directly supports:

• The CIM Program’s core requirements for data preparation.

• FDIC’s enterprise data governance strategy.

• Security, privacy, and compliance mandates under federal guidance and NIST standards.

• IT modernization and digital transformation by reducing technical debt and streamlining operations.

2. Background

The Federal Deposit Insurance Corporation (FDIC) is facing mounting challenges in managing its growing volume of unstructured and semi-structured data. Legacy content—much of it duplicative, outdated, or irrelevant—poses a significant obstacle to efficient operations while creating compliance, legal, and financial risks. Network shares are burdened with data left by former employees, improperly stored PII, inconsistent naming conventions, and a lack of unified retention enforcement. This has made it increasingly difficult for staff to locate important information, assess the value of stored files, and ensure content complies with federal records and privacy mandates.

The CIM initiative is a strategic enterprise effort to modernize organizational content lifecycle management. However, this initiative cannot begin without the foundational step of analyzing and cleansing existing file shares. FMCAT provides the technology and functionality needed to empower Division Subject Matter Experts (SMEs) and Records Management Officers (RMOs) to apply consistent retention logic and systematically and securely dispose of unneeded content.

3. Objectives This SOO sets forth the following objectives for the FMCAT project:

1. Acquire the software licenses and assist the FDIC with the installation, implementation, and configuration of an ROT tool on-premises that meets the

Section C - Description/Specifications/Work Statement PAGE 9 OF 87 capabilities outlined in sections 4, 5, 6, and Appendices A & B of this SOO for integration within the FDIC’s environment.

2. Provide comprehensive training for administrators and end users to support compliance with the Records Management Policy by offering a centralized, user-friendly solution that enables SMEs and RMOs to classify, tag, and dispose of files according to the FDIC’s records retention schedules, labeling guidelines, and legal hold requirements.

3. Support the FDIC in obtaining an Authority to Operate (ATO) for the proposed ROT as well.

4. Minimize Organizational Risk - Identify and flag sensitive information that is improperly stored (e.g., PII, SII), which may present security and privacy risks if retained unnecessarily or migrated incorrectly.

5. Optimize Storage and Lower IT Costs - Decrease the amount of stored data across FDIC file shares through intelligent categorization and disposal, thereby reducing infrastructure costs and storage overhead.

6. Provide guidance and support for the FDIC to establish sustainable File and Labeling Governance with consistent best practices. Lay the groundwork for a standardized, automated, and repeatable file management process that can be expanded across divisions and sustained in the long term.

The new solution must comply with FDIC security and privacy requirements and provide an administration tool for user and access management. Potential contractors will be asked to submit documentation regarding their solution's features, technical specifications, security, privacy, and integration capabilities outlined below.

From the preliminary submission, FDIC will evaluate contractor proposals and request selected contractors to demonstrate their product, as detailed below in Appendix C.

4. Technical Support The FDIC will require access to robust technical support from the vendor. This support will assist FDIC employees and contractors in configuring and implementing the solution, operating and maintaining the system during the contract performance period, and fully utilizing all the solution features to identify and categorize files as ROT.

Offerors may propose this technical support either as a fixed-price service or as consulting services billed by the hour. Regardless of the pricing model, this support will enable FDIC users to be self-sufficient in configuring, implementing, administering, operating, and maintaining the solution. Additionally, the FDIC will require access to technical support during business hours from 8 am to 6 pm. When there is a business need, we seek the ability to receive support outside of business hours in the evenings and on weekends.

5. Assumptions

FDIC seeks a solution to identify, analyze, and categorize redundant, obsolete, and trivial content (ROT) files. The deployment of a solution in the FDIC environment will enable users to efficiently analyze, categorize, and manage various file types based on

Section C - Description/Specifications/Work Statement PAGE 10 OF 87 defined criteria. This will improve our records retention compliance and risk mitigation.

Ultimately, the FDIC desires to reduce the footprint of network shares as relevant content is migrated to our cloud-based storage. As of the 1st quarter of 2025, it is estimated that there are roughly 330TB of files that need to be reviewed and flagged by the ROT tool.

Some of the pain points being experienced with redundant and obsolete files include:

• Many documents are redundant, particularly those left behind by previous employees.

• Files could be transferred without proper cleanup, leading to unnecessary or outdated data migration.

• Files that should have been deleted years ago are still retained on the shared drive, cluttering the data landscape.

• PII may be stored incorrectly in shared drives and migrated with other files, leading to potential compliance and security risks.

• The same documents are stored with different names.

• There is no cohesive retention policy, which complicates applying consistent rules to different documents with varying retention requirements.

• Files created by former employees are inaccessible to current users, making it difficult to assess their importance or determine if they should be retained or deleted.

• The absence of a consistent naming convention for documents creates challenges in identifying and organizing files.

• Multiple drafts are circulated, stored, and retained after a document is finalized, resulting in confusion about which version(s) should be kept and by whom.

6. Business Requirements

The new solution will incorporate capabilities to meet our needs for identifying and deleting redundant, obsolete, and trivial files. To assist FDIC in efficiently managing data, reducing storage costs, and maintaining compliance with data retention policies, FDIC plans to implement the ROT data management tool on the FDIC Enterprise Network Share Drives hosted at FDIC on-premises data centers. A network share, also known as a network drive, file share, or shared drive, is typically a folder on a network server that multiple users can access. The purpose of network shares is to make files available to FDIC users from a centralized location. These files may include business documents, multimedia files, software installation binaries, application log files, database files, and other data types intended for widespread distribution. Typically, users connect a drive to a network share to create a permanent shortcut to that location on their computers. The volume of files on the network share may range from 10TB to 100 TB. The FDIC will need to determine if there are any incremental costs associated with processing the volume of files.

Section C - Description/Specifications/Work Statement PAGE 11 OF 87

7. Deliverables The contractor shall deliver these deliverables using an agile methodology whenever possible to the FDIC Oversight Manager (OM) and Technical Monitor (TM).

Deliverables Required Calendar Days (after award)

• Project Schedule and Implementation Plan

15 days

• Project Status Report Once a month

• Security-related reports as per OCISO requirements As needed basis

• Obtain ATO or appropriate security authorization

At least two months before the go-live date

• Training Plan Per the approved project schedule and release plan

• Training 15 days prior to production go-live. For new functionality and enhancements, provide virtual production release training and include written documentation as necessary that aligns with a train-the-trainer approach.

Updates for new functionality are included in subsequent releases 15 days before the production release.

• Standard Operating Procedures (SOPs)

Within 30 days before the implementation release date. Reflects solution capabilities, configurations, and the administrator's guide.

• Job Aids Within 15 days before the implementation release date. Reflects selected key user functions and processes.

• Delivery of a configured solution Per the approved project schedule and implementation plan

• Security and Privacy Plans Part of System Security Authorization Process Documentation

• Security and Privacy Assessment Reports

Part of System Security Authorization Process Documentation

• Plan of Action and Milestones Part of System Security Authorization Process Documentation

• Configured Solution (Go-live) Per the approved project schedule and release plan

• Initial categorization and workflows for one division

Per project schedule and implementation plan, no later than 30 days post-implementation.

Section C - Description/Specifications/Work Statement PAGE 12 OF 87

• Categorization and updated workflows for each remaining division/office of the organization.

Per the project schedule and implementation plan, after acceptance of the initial categorization and workflows.

Section C - Description/Specifications/Work Statement PAGE 13 OF 87

Outlined below are the categories for each requirement detailed in the Business Requirements section of Appendix A. Additionally, the Offeror shall support all applicable non-functional requirements proposed by the Offeror and agreed to by the FDIC from those listed in Appendix B – Non-functional Requirements.

Appendix A – Business Requirements

7.1 Audit

The ROT tool should offer a compliance-friendly deletion process that records and retains what was deleted, the reason for the deletion, and the date of the deletion.

7.2 Criteria

1. The ROT tool should allow users to apply and implement multiple retention criteria.

2. The ROT tool should have the ability to accommodate many different criteria.

3. The ROT tool should allow authorized users to set criteria and cadence for the disposition of files/data.

7.3 Deletion

1. The ROT tool should be able to delete flagged files or data according to the approved criteria.

2. The ROT tool should be able to prevent Legal Hold files/data from being deleted or altered.

3. The ROT tool should enable users to review files or data before deletion.

7.4 Flagging/Tagging

1. The ROT tool should be capable of flagging or tagging files and data.

2. The ROT tool should enable users to flag files or data for deletion.

3. The ROT tool must be capable of flagging documents that contain SII and PII.

7.5 Identify

1. The ROT tool should be able to identify redundant files/data even if it is stored under different names or locations.

2. The ROT tool should be able to identify obsolete files/data.

3. The ROT tool should be able to identify trivial files/data.

4. The ROT tool should be able to recognize all file types (e.g., Excel, Word, Access

Database, PDFs, etc.).

5. The ROT tool should be able to identify empty folders.

6. The ROT tool should be able to identify dormant folders.

7. The ROT tools should be able to recognize files/data that are on Legal Hold.

Section C - Description/Specifications/Work Statement PAGE 14 OF 87

7.6 Notifications

The ROT tool should be able to notify file owners before files/data are deleted.

7.7 Performance / Scalability

The ROT tool should be able to efficiently perform ROT identification on large volumes of data/files.

7.8 Processing

1. The ROT tool should be available for use as needed.

2. The ROT tool should be able to process actions such as identify, select, delete, move, etc. in bulk.

7.9 Reporting

1. The ROT tool should generate comprehensive and detailed reports and analytics on an ad hoc basis.

2. The ROT tools must have dashboards, key metrics, and timelines.

3. The ROT tool should be capable of generating a comprehensive data map detailing where data resides, its file formats, sensitivity levels, and the relevant custodians and owners.

4. The ROT tool should be capable of generating customizable, comprehensive, and detailed reports and analytics.

7.10 Search/Sort/Group

1. The ROT tool should be capable of searching files and data based on keywords, file properties, and metadata (e.g., matter/case numbers, author details, document type, who accessed and/or modified specific files and data, etc.).

2. The ROT tool should be able to sort and group files and data based on various criteria (e.g., creation date, version (draft or final), data labels/classifications (e.g., public, non-public, controlled, etc.), file size, file name, etc.).

7.11 Security/Privacy

1. The ROT tool must identify documents containing SII and PII.

2. The ROT tool must ensure that access controls are established to safeguard sensitive information.

3. The ROT tool should be capable of identifying password-protected, encrypted files or data.

4. The ROT tool must guarantee data security and privacy.

1. System Integration The ROT tool must integrate and function seamlessly within FDIC's IT structure.

7.12 Usability

The ROT tool should provide a user-friendly interface and be simple to use.

Section C - Description/Specifications/Work Statement PAGE 15 OF 87

7.13 Workflow

The ROT tool must be capable of creating workflows for the review and approval of files or data before their deletion.

Section C - Description/Specifications/Work Statement PAGE 16 OF 87

Appendix B - Non-Functional Requirements

The FDIC has non-functional requirements for compliance by selected solutions. The Offeror shall support all applicable non-functional requirements proposed by the Offeror and agreed upon by the FDIC from those listed in Attachment B – Non-Functional Requirements.

Section C - Description/Specifications/Work Statement PAGE 17 OF 87

Appendix C – Use Case Scenario

The purpose of a use case scenario is to clearly describe how a system, tool, or process will be used to achieve a specific business goal or outcome from the perspective of the end user or stakeholder. It defines the interactions between users (actors) and the system, capturing functional requirements in a practical, understandable, and real-world-focused manner.

Key Purposes of a Use Case Scenario:

1. Clarify Requirements It helps stakeholders (business, technical, legal, vendors, etc.) understand what the system should do, ensuring everyone shares a common vision of its functionality.

2. Define Scope and Boundaries It outlines where a process starts and finishes, what conditions must be satisfied, and what outcomes are anticipated, helping to manage project scope and expectations.

3. Support Communication Use cases connect technical and non-technical teams by using clear language to explain processes, decisions, and system behavior.

4. Guide Development and Design Developers and system architects utilize use cases to design features and workflows based on anticipated user interactions with the system.

5. Enable Testing and Validation Test cases can be developed directly from use case scenarios to ensure that the system operates as expected in both typical and edge-case conditions.

6. Drive Training and Change Management Use cases assist in creating realistic training materials and guiding end users on how the new system or tool fits into their daily work.

7. Support Business Justification A well-crafted use case can effectively illustrate the value of a system by showing how it addresses a real problem or improves a process.

1. Use Case Description

This case describes how the File Management Categorization and Analysis Tool (FMCAT) is used by FDIC personnel to identify, categorize, and take disposition actions on redundant, obsolete, and trivial (ROT) data in the FDIC on-premises network share drives. It supports the FDIC’s Content Information Management (CIM) initiative by ensuring data is organized, relevant, and compliant with labeling, security, and records management retention policies. It also improves operational efficiency, reduces storage costs, and enhances data security.

2. Actors

Actor Role Administrator Configures the tool, initiates scans, reviews reports, and

Section C - Description/Specifications/Work Statement PAGE 18 OF 87 manages ROT classification and cleanup IT Manager Overseas the cleanup process ensures policy compliance and validates that no critical data is lost.

End Users Provide input on file relevance and help verify data classification in cases of uncertainty.

3. Goals

• Identify and remove redundant, obsolete, and trivial (ROT) data from FDIC network shares.

• Enhance data organization and storage efficiency across the enterprise.

• Ensure compliance with retention and data governance policies.

• Lower storage costs and data-related risk exposure.

• Prepare content for migration to cloud-based repositories (e.g., SharePoint, Azure).

4. Preconditions

• The FMCAT has been fully installed and configured, received an ATO, and is operational in the FDIC product environment.

• User roles and permissions have been assigned as necessary.

• Retention policies, classification rules, and legal hold guidelines are integrated into the tool.

• FMCAT can access FDIC on the premise network share drives

5. Main Flow (Basic Scenario)

Step Action:

1 Log In – The Administrator logs into FMCAT.

2 Configure Scan – The Administrator selects network shares and initiates a data scan.

3 Scan Data Repositories – FMCAT scans selected locations for ROT data.

4 Identify ROT Data – The tool identifies redundant, outdated, or trivial files according to predefined rules.

5 Flag Sensitive Content – FMCAT automatically flags files with PII, SII, or legal hold indicators for review.

6 Generate Report – A detailed report of ROT findings is generated, including classifications and recommendations.

7 Review Report – The Administrator and End Users (as needed) review the report to confirm accuracy.

8 Approve Actions – Approved files are marked for deletion, archiving, or retention.

9 Execute Cleanup – FMCAT performs cleanup actions and retains an audit log of all changes.

10 Verify Cleanup – The IT Manager validates the cleanup process, ensuring no

Section C - Description/Specifications/Work Statement PAGE 19 OF 87

Step Action:

critical data was removed.

11 Monitor Storage – The Administrator monitors post-cleanup storage usage and efficiency gains.

6. Alternative Flows

Alt Flow Description

A1. False Positives If FMCAT incorrectly identifies important data as ROT, the Administrator or SME reclassifies it as "retain," and it is excluded from deletion.

A2. Data Recovery If critical data is mistakenly deleted, FMCAT’s recovery feature allows restoration from backups or retention logs.

A3. Legal Hold Detection

Files under legal hold are automatically protected and flagged for manual review by the Records or Legal teams.

A4. PII/Sensitive Data Handling

Detected PII or sensitive content is redirected for review and secure handling and not automatically deleted.

7. Postconditions

• ROT content has been removed or archived according to retention and compliance rules.

• Network shares are streamlined and easier for users to navigate.

• Sensitive content has been flagged and addressed securely.

• Storage space has been reduced and associated costs lowered.

• Data is prepared for structured migration into cloud storage systems (e.g., SharePoint, Azure).

• Audit trails and reports are available for internal and regulatory review.

8. Exceptions

Exception Description Tool Malfunction

If FMCAT encounters a system or processing error, the Administrator notifies technical support for remediation.

Incomplete Scan

If network share access fails or is interrupted, the Administrator adjusts access permissions and restarts the scan.

Section C - Description/Specifications/Work Statement PAGE 20 OF 87

Section E - Inspection and Acceptance

No attachments were added for this section.

No reference clauses were found for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have 15 business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 21 OF 87

Section F - Deliveries or Performance

7.3.1-09 - Delivery Schedule - July 2008 The goods must be delivered in accordance with the following schedule.

(TBD)

Item Description Day after Award

7.3.1-10 - Place of Delivery or Performance - November 2013 All tangible items shall be delivered to the following address:

Federal Deposit Insurance Corporation (FDIC)

Division of Information Technology (DIT)

Distribution Center

3501 Fairfax Drive, Arlington, VA 22226

Phone Number: 571-629-8111

Contractor must ensure the contract number is listed on the shipping material or packing slip. Please do not ship items to the Contracting Officer or Oversight Manager.

Non-tangible items shall be submitted to the following email address:

DITSoftwareMgt@fdic.gov.

To include all certificates and maintenance renewals.

7.3.1-11 - Deliverables - July 2008 The Contractor must provide all deliverables described in the statement of work.

7.3.1-12 - Period of Performance - July 2023

Section F - Deliveries or Performance PAGE 22 OF 87

The Initial Period of Performance begins on 12/15/2025 and expires on 12/14/2026. If all option periods are exercised, the final expiration date is 12/14/2027.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 23 OF 87

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum. The Oversight Manager is Duane Bouie who can be reached at dbouie@fdic.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders. The Contracting Officer is Diamond Toles who can be reached at ditoles@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a

Section G - Contract Administration Data PAGE 24 OF 87 proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-06 - Compensation Ceiling - Contract or Task Order - July 2008 Not-to-Exceed

Period of Performance Ceiling Amount

Initial Period: $________________

Option Period 1: $________________

In no event will total FDIC compensation to Contractor, including any reimbursed costs and expenses, exceed the sum of TBD Dollars ($TBD) for the entire Period of Performance, including the initial period and all options, if any.

Contractor must notify the Contracting Officer, in writing, when Contractor has incurred charges amounting to seventy-five percent (75%) of the ceiling amount for each performance period.

7.5.13-12 - Schedule for Invoicing - July 2008 For Labor-Hour or Time-and-Material CLINS, Contractor must submit invoices within fifteen (15) days after the end of each month. For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-13 - Contents of Invoice - March 2014 Contractor''s invoices must include the following items in order to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date. (Contractors must date invoices as close as possible to the date of electronic transmission to

FDIC.)

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number, Delivery Order Number, etc.)

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered or services performed.

(h) Total invoice amount.

(i) Payment terms (discount for prompt payment terms).

(j) Remittance address.

(k) Billing Point of Contact (e.g., name (where practicable), title, phone number, and mailing address of person to notify if there are questions regarding the invoice).

(l) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment.

Shipping charges, if any, must be shown as a separate item on the invoice).

(m) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(n) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(o) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice it submits to FDIC;

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor''s invoice when seeking reimbursement of subcontractor expenses.

Section G - Contract Administration Data PAGE 25 OF 87

(p) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clearly evident in the supporting documentation provided with the invoice.

(q) The following certification statement, signed by an authorized company representative:

"This is to certify that the services set forth herein [goods described herein] were performed [delivered] during the period stated.

Contractor''s Authorized Representative Date"

(r) Any other information or supporting documentation required by the award.

If an invoice does not contain the above required information; contains errors; or exceeds the total compensation ceiling limit for this award, the invoice will be returned to Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, in order to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because

Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting

Section G - Contract Administration Data PAGE 26 OF 87 information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 27 OF 87

Section H - Special Contract Requirements

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.3.2-78 - Commercial Supplier Agreement Terms and Conditions - May 2025

1. Definitions:

A. “Commercial item” means any of the following: [Note: For purposes of this document, the term "commercial item" is interchangeable with the terms "commercially available”, "commercially available software”, "commercial component(s)", "commercial product(s)", and "commercial off-the-shelf (COTS)”.]

(1) Any item, other than real property, that is of a type customarily used by the general public or by nongovernmental entities for purposes other than governmental purposes and that has been sold, leased, licensed to the general public; or has been offered for sale, lease, or license to the general public.

(2) Any item that evolved from an item described in paragraph (1) through advances in technology or performance and that is not yet available in the commercial marketplace, but will be available in the commercial marketplace in time to satisfy the delivery requirements under a government solicitation.

(3) Any item that would satisfy a criterion expressed in paragraphs (1) and (2) of this definition, but for (i) modifications of a type customarily available in the commercial marketplace; or (ii) modifications of a type not customarily available in the commercial marketplace made to meet Federal government requirements.

(4) Any combination of items meeting the requirements of paragraphs (1), (2), (3), or (5) of this definition that are of a type customarily combined and sold in combination to the general public.

(5) Installation services, maintenance services, repair services, training services, and other services if such

Section H - Special Contract Requirements PAGE 28 OF 87 services are procured for support of an item referred to in paragraph (1), (2), (3), or (4) of this definition, and if the source of such services--(i) offers such services to the general public and the Federal government contemporaneously and under similar terms and conditions; and (ii) offers to use the same work force for providing the Federal government with such services as the source uses for providing such services to the general public.

(6) Services of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed under standard commercial terms and conditions. This does not include services sold based on hourly rates without an established catalog or market price for specific service performed.

(7) Any item, combination of items, or service referred to in paragraphs (1) through (6), notwithstanding the fact that the item, combination of items, or service is transferred between or among separate divisions, subsidiaries, or affiliates of a contractor.

(8) Any item determined by the procuring agency to have been developed exclusively at private expense and sold in substantial quantities, on a competitive basis, to multiple state and local governments.

B. “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” and intended to create a binding legal obligation on the end user, such as, but not exclusively, those used in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data. Such agreements may be referred to as Terms of Service (TOS), End User License Agreement (EULA) or another similar legal instrument or agreement and may be presented as a part of a proposal or quotation responding to a solicitation for contract or order. The term applies, regardless of the format or style of the document, whether in paper or electronic form.

2. Applicability. The following terms and conditions apply to any commercial supplier agreement as defined in this clause. These terms take precedence and supersede any conflicting or contrary terms in a contractor, subcontractor or associated third party Commercial license agreement. When any supply or service acquired under this contract is subject to a commercial supplier agreement, the terms of this clause shall be deemed incorporated into the commercial supplier agreement. In addition, the Commercial Supplier Agreement is a part of a contract between the commercial supplier and the FDIC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including all contracts, task orders, and delivery orders). For accepted terms under the commercial supplier agreement, the ordering activity FDIC may be bound as end user, but a

Government employee or person acting on behalf of the government in his or her personal capacity will not be bound. The commercial supplier or license agreement may be incorporated into an FDIC contract as modified by this clause. If a Commercial Supplier Agreement is not required for the goods and services performed by the contractor, all the terms listed below in this clause are not applicable to the contract.

3. Contract Formation. All terms intended to bind the FDIC must be included in static text form within the contract signed by the FDIC. Neither the FDIC nor any authorized end user shall be deemed to have agreed to any terms in the commercial supplier agreement or any terms of any associated third-party agreement by a click box or other comparable mechanism (e.g., “click-wrap” or "browse-wrap" agreements) and such purported execution does not bind the FDIC or an authorized end user and is null and void.

4. Authorization. By executing the Contract, Contractor represents that it is duly authorized to enter into the

Contract, including any amendments to the commercial supplier agreement as incorporated into the contract.

Section H - Special Contract Requirements PAGE 29 OF 87

5. Venue. Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

6. Limitations on Actions. Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

7. Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, binding arbitration shall not be used unless specifically authorized by a FDIC guidance, and equitable or injunctive relief, including award of attorney fees, costs or interest, may be awarded against FDIC only when explicitly provided by statute (e.g. Prompt Payment Act). Any terms in the commercial supplier agreement requiring that disputes be submitted to arbitration or that claims the supplier has the right to injunctive relief, attorney fees, costs or interest is null and void and shall not be enforceable against the Government.

8. Updating Terms. After award the contractor may unilaterally revise terms if they are not material. A material change is defined as: (A) Terms that significantly change Government’s rights or obligations; and (B) Terms that increase Government prices; (C) Terms that decrease overall level of service; or (D) Terms that limit any other

Government right addressed elsewhere in this contract. For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be…