CORHQ-26-Q-0110.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-26-Q-0110

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 41

NONPUBLIC//FDIC INTERNAL ONLY#

Total Price $ -

Description of Requirement

Time of Delivery:

Technical Point of Contact:

Company:

Phone:

Email Address:

Idera ER Studio is a COTS product used EIM DA’s for data modeling, data management, and data governance for all FDIC production databases. The tool includes the following components:

Data Architect (ER DA)– the application residing on the client desktops

- Repository Server – Part of the application that manages the models - Team Server- A business user GUI - License server – manages the application licenses. Data architecure and data modeling are not able to performed which is critical to all MC/ME applications.

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 41

NONPUBLIC//FDIC INTERNAL ONLY#

Item # Purchase Category Purchase Type Description Part # Period of Performance Qty List Price Discount Net Price Extended Price

Base Period

1 SOFTWARE MAINTENANCE ER/Studio Team Server Core Support Renewal - Multi-Platform PID: 1079737 ETTX00ERNWWB9 7/14/2026 - 7/13/2027 1 $0.00 $0.00 $0.00 $0.00

2 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213654

ERTX00ERNCWB9 7/14/2026 - 7/13/2027 1 $0.00 $0.00 $0.00 $0.00

3 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213653

ERTX00ERNCWB9 7/14/2026 - 7/13/2027 19 $0.00 $0.00 $0.00 $0.00

Total Base Period $0.00

- Optional Period 1:

1 SOFTWARE MAINTENANCE ER/Studio Team Server Core Support Renewal - Multi-Platform PID: 1079737 ETTX00ERNWWB9 7/14/2027 - 7/13/2028 1 $0.00 $0.00 $0.00 $0.00

2 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213654

ERTX00ERNCWB9 7/14/2027 - 7/13/2028 1 $0.00 $0.00 $0.00 $0.00

3 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213653

ERTX00ERNCWB9 7/14/2027 - 7/13/2028 19 $0.00 $0.00 $0.00 $0.00

Total Option Period 1 $0.00

- Optional Period 2:

1 SOFTWARE MAINTENANCE ER/Studio Team Server Core Support Renewal - Multi-Platform PID: 1079737 ETTX00ERNWWB9 7/14/2028 - 7/13/2029 1 $0.00 $0.00 $0.00 $0.00

2 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213654

ERTX00ERNCWB9 7/14/2028 - 7/13/2029 1 $0.00 $0.00 $0.00 $0.00

3 SOFTWARE MAINTENANCE

ER/Studio Enterprise Team Edition Multi

Platform Concurrent Support Renewal Multi- Platform PID: 1213653

ERTX00ERNCWB9 7/14/2028 - 7/13/2029 19 $0.00 $0.00 $0.00 $0.00

Total Option Period 2 $0.00

Total Price $0.00

Price Schedule Requirement Description: Embarcadero Software Maintenance

Section B - Supplies or Services and Prices/Costs PAGE 5 OF 41

Section C - Description/Specifications/Work Statement

No attachments were added for this section.

Clauses Incorporated By Reference

Clause # Title Date

7.3.2-34 Duty to Deliver or Perform July 2008

Full Text Clauses

No full text clauses were found for this section.

Section C - Description/Specifications/Work Statement PAGE 6 OF 41

Section E - Inspection and Acceptance

No reference clauses were found for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have Fifteen (15) business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require Contractor to reperform the services or redeliver the goods in conformity with the requirements of the

Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require

Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 7 OF 41

Section F - Deliveries or Performance

7.3.1-09 - Delivery Schedule - July 2008 The goods must be delivered in accordance with the Price Schedule.

7.3.1-10 - Place of Delivery or Performance - November 2025 All tangible items shall be delivered to the following address:

Federal Deposit Insurance Corporation (FDIC)

Division of Information Technology (DIT)

Distribution Center

3501 Fairfax Drive, Arlington, VA 22226

Phone Number: 571-629-8111

Contractor must ensure the contract number is listed on the shipping material or packing slip. Please do not ship items to the Contracting Officer or Oversight Manager.

Non-tangible items shall be submitted to the following email address:

DITSoftwareMgt@fdic.gov.

To include all certificates and maintenance renewals.

7.3.1-12 - Period of Performance - July 2023 The Initial Period of Performance begins on July 14, 2027 and expires on July 13, 2026. If all option periods are exercised, the final expiration date is July 13, 2029.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 8 OF 41

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum. The Oversight Manager is Russell Rodgers who can be reached at rurogers@FDIC.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders. The Contracting Officer is Diamond Toles who can be reached at ditoles@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a

Section G - Contract Administration Data PAGE 9 OF 41 proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-12 - Schedule for Invoicing - July 2008 For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as

Section G - Contract Administration Data PAGE 10 OF 41 year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 11 OF 41

Section H - Special Contract Requirements

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the Oversight Manager. Information shall be returned securely in a format directed by the Oversight Manager. Retention of FDIC information by the Contractor beyond the conclusion of the contract is only permissible in accordance with clause 7.6.3-02, Contractor Return, Destruction and Retention of FDIC Information.

Section H - Special Contract Requirements PAGE 12 OF 41

(c) Inspections/Assessments/Audits/Reviews/Examinations. To confirm Contractor’s compliance with this contract, as well as any applicable laws, regulations and industry standards, Contractor shall grant FDIC information security and privacy staff, the FDIC Office of the Inspector General, the U.S. Government Accountability Office (GAO), or an

FDIC-selected third party acting on the FDIC’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all FDIC information being handled and/or services being provided to FDIC pursuant to this contract. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores FDIC information pursuant to this contract.

These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the FDIC or the federal government’s audit and inspection rights delineated in other clauses of this contract or by statute.

(d) Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 and FDIC’s Breach Response Plan, and to assist in responding to a breach. FDIC’s Breach Response Plan is available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with FDIC’s Breach Response Plan. All security and privacy incidents that involve FDIC information must be immediately reported to FDIC’s Computer Security Incident Response Team (CSIRT)/Security

Operations Center (SOC) at the telephone/email address provided in paragraph (e) below. The Contractor and subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what FDIC information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

(e) The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of FDIC information and with whom the Contracting Officer, Oversight Manager, and other applicable FDIC staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the FDIC as needed in resolving an incident;

2. Notify the FDIC of an incident immediately after the Contractor becomes aware of it; and

3. Notify FDIC’s Computer Security Incident Response Team (CSIRT) via email at fdic-csirt@fdic.gov or telephone at 1-877-FDIC-999 (877-334-2999), as well as to the Oversight Manager (OM) of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the FDIC in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

Section H - Special Contract Requirements PAGE 13 OF 41

(f) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

7.4.2-05 - Basic Safeguarding of Covered Contractor Information Systems - March 2021

(a) Definitions. As used in this clause:

“Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on

National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information

Section H - Special Contract Requirements PAGE 14 OF 41 systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract in which the subcontractor may have Federal contract information residing in or transiting through its information system.

Section H - Special Contract Requirements PAGE 15 OF 41

Section I - Contract Clauses

7.1.2-01 Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered

Entities

September 2020

7.1.2-02 Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment

April 2021

7.3.1-13 OIG Fraud Hotline July 2008

7.3.1-14 Order of Precedence July 2008

7.3.2-35 Calendar Days July 2008

7.3.2-40 Change in Physical Location July 2008

7.3.2-42 Contractor Personnel July 2008

7.3.2-44 Representations and Certifications of Contractor March 2024

7.3.2-54 Cooperation with the Office of Inspector General July 2008

7.3.2-60 Anti-Kickback Procedures July 2023

7.3.2-63 Affirmative Action for Workers with Disabilities July 2008

7.3.2-64 Affirmative Action for Special Disabled Veterans and Vietnam Era

Veterans

July 2023

7.3.2-65 Employment Reports on Special Disabled Veterans and Vietnam

Era Veterans

July 2023

7.3.2-73 Compliance with 12 CFR Part 366 and Application of 12 CFR Part

September 2009

7.3.2-79 Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements

March 2024

7.5.4-01 Authorization and Consent July 2008

7.5.4-02 Notice and Assistance Regarding Patent and Copyright July 2008

Section I - Contract Clauses PAGE 16 OF 41

Infringement

7.5.4-03 Patent Indemnity July 2008

7.5.4-06 FDIC Rights in Data - General May 2025

7.5.4-09 Commercial Computer Software - Restricted Rights July 2008

7.5.8-04 Notice to the FDIC on Damage July 2023

7.5.8-11 Liability to Third Persons July 2008

7.5.9-01 FDIC Exempt from Federal, State, and Local Taxes July 2008

7.5.12-07 Restrictions on Certain Foreign Purchases November 2023

7.5.13-05 Payments Under Fixed Price Awards June 2009

7.5.13-09 Travel Expenses (Non-Reimbursable) July 2008

7.5.13-17 Right to Offset Contract Payments Against Delinquent Obligations July 2008

7.5.13-18 Prompt Payment December 2008

7.5.14-02 Notice and Certification of Claims July 2008

7.6.4-03 Risk of Loss or Damage July 2008

7.6.5-01 Changes July 2008

7.6.5-03 Stop Work Order July 2008

7.6.5-05 Assignment of Claims July 2008

7.6.6-01 Termination for Convenience of the FDIC August 2013

7.6.6-02 Termination for Default July 2008

7.6.6-04 Excusable Delays July 2008

7.0.1-02 - Clauses Incorporated by Reference - July 2023 This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. The full text of a contract clause is available in Module 7 of the document entitled Acquisition Procedures and Guidance Manual (APGM), which may be accessed electronically at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html.

Section I - Contract Clauses PAGE 17 OF 41

7.3.1-15 - Governing Law - July 2008 This contract is governed by Federal law and will be construed accordingly. To the extent State law may apply, in the case where there is no applicable Federal law, the State law that applies is the law of the State in which the

FDIC office executing the contract is located (or the law of the District of Columbia for contracts executed by the

FDIC office located in the District of Columbia).

7.3.2-33 - Independent Contractors - July 2008 The FDIC retains Contractor as an independent contractor for the sole purpose of performing the services or providing the goods described in this contract. If subcontracting is permitted, the use of the term "Contractor" herein refers to both the Contractor and all Subcontractors at all levels. Contractor must ensure that all

Subcontractors adhere to all of the terms and conditions of this contract that have flow-down requirements.

7.3.2-37 - Audit of Records - July 2008

(a) Audit and Inspection Rights. The FDIC, through its Contracting Officer or his designated representative(s), has the right to audit and examine Contractor''s records and inspect its facilities. The scope of these rights is described below.

(b) Examination of Costs. Contractor is required to maintain sufficiently detailed records of the costs it incurs in performing this contract. The FDIC has the right to audit and examine Contractor''s books and records, and its accounting procedures and practices, regardless of their form (e.g., machine readable media) or type (e.g., databases, applications software, database management software). The FDIC has the right to inspect, at reasonable times, the facilities used by Contractor during performance of the contract.

(c) Reports. If Contractor is required to furnish cost, funding or performance reports, the FDIC has the right to audit and examine Contractor''s books, records, other documents and supporting materials to evaluate (1) the data underlying the reports and (2) the effectiveness of Contractor''s policies and procedures to produce data compatible with the objectives of these reports.

(d) Comptroller General.

(1) The Comptroller General of the United States, or his authorized representative, shall have access to and the right to examine any of the contractor''s directly pertinent records involving transactions related to this contract or a subcontract hereunder for a period of three (3) years following final payment under the contract.

(2) The period of access and examination is automatically extended for records relating to claims or litigation arising from the performance of this contract, or costs and expenses of this contract to which the Comptroller

General has taken exception, and continues until all claims, litigation, appeals or exceptions are resolved.

(3) This paragraph may not be construed to require contractors or subcontractors to create or maintain any record that the contractor or subcontractor does not maintain in ordinary course of business or pursuant to a provision of law.

(e) Retention Requirement. Contractor must retain the materials described in paragraphs (b) and (c) above for three (3) years following final payment under this contract, or for any longer period required by statute or another clause in this contract. Contractor must make the materials available to the FDIC for audit, examination and reproduction, at reasonable times during the retention period. Contractor must also provide the FDIC with working space at its facilities to conduct the audit and examination. If this contract is terminated, completely or partially, Contractor must maintain the materials described in subparagraphs (b) and (c) above for three (3) years following

Section I - Contract Clauses PAGE 18 OF 41 any final settlement Contractor must maintain, and make available to the FDIC, records relating to appeals under the "Disputes" clause of this contract, or to claims or litigation arising under or from this contract, until the appeals, claims or litigation are resolved.

(f) Computer Data. Contractor may transfer computer data in machine readable form from one reliable computer medium to another. Contractor''s computer data retention and transfer procedures must maintain the integrity, reliability and security of the original data. Contractor''s choice of media affects neither Contractor''s obligations nor the FDIC''s rights under this clause.

(g) Subcontracts. Contractor is required to insert a clause containing all the terms of this clause, including this subparagraph (g) - altered as necessary to identify properly the contracting parties and the Contracting Officer under the FDIC prime contract - in all subcontracts under this contract that exceed $100,000.

7.3.2-57 - Public Release of Contract Award and Advertising and Publicity Information -

April 2013

(a) The Contractor, its affiliates, agents or subcontractors, and their respective employees shall not issue press releases or provide other information to the public regarding any FDIC contract award.

(b) The Contractor, its affiliates, agents or subcontractors, and their respective employees shall not make statements to the media or issue press releases regarding the goods or services provided under this Contract.

Requests for information from anyone representing themselves as working for, or on the behalf of, a media or news organization must be directed to the Contracting Officer, who will obtain appropriate approval from the FDIC Office of Communications at 202-898-6993.

(c) Advertising or publicity materials (including the placement of information on its website):

(1) The Contractor may include a reference to "FDIC" or "Federal Deposit Insurance Corporation" in a list of the

Contractor''s clients, along with a short, broad description of the goods or services provided, such as "FDIC - IT

Services" or "FDIC - Security Services". In no event may any confidential information regarding the details of the contract or the name of the financial institutions where work is being performed be disclosed.

(2) Without the prior written approval from the Contracting Officer, the Contractor shall not:

(i) issue or sponsor any advertising or publicity (including the placement of information on its website) that states or implies the FDIC endorses, recommends or prefers the Contractor''s goods or services. (ii) use the FDIC''s logo or other FDIC material or refer to the FDIC in its advertising and publicity materials (including its website).

All requests for such approvals must be submitted to the Contracting Officer at least 30 days prior to the scheduled release of advertising or publicity materials. The Contracting Officer will coordinate with the FDIC Office of

Communications and notify the Contractor of the final decision.

(d) The prohibitions addressed in the preceding paragraphs also apply to information placed on social networks

(Twitter, LinkedIn, Facebook, blogs, etc.).

(e) The Contractor agrees to include this clause in all its subcontracts under this contract.

Section I - Contract Clauses PAGE 19 OF 41

7.3.2-72 - FDIC Contracting Capacity - Contracts/Task Orders/Delivery Orders - July 2009 FDIC is acting in its corporate capacity for this award and will execute it in this capacity throughout the period of performance.

7.5.3-01 - Section 508, Information and Communication Technology (ICT) - March 2024

(a) Definition:

Information and Communication Technology (ICT) - Information technology and other equipment, systems, technologies, or processes, for which the principal function is the creation, manipulation, storage, display, receipt, or transmission of electronic data and information, as well as any associated content.

(b) If this award is for the purchase, development, or maintenance of Information and Communication Technology

(ICT), the items or services must, at the time of delivery, be in compliance with the following:

1) Section 508 of the Rehabilitation Act and the Architectural and Transportation Barriers Compliance Board’s

(Access Board’s) Information and Communication Technology Standards and Guidelines (36 C.F.R. Part 1194) -https://www.access-board.gov/ict/;

2) FDIC regulation 12 C.F.R. § 352.5 - https://www.fdic.gov/regulations/laws/rules/2000-50.html; and

3) FDIC Directive 1370.07, Information and Communication Technology Accessibility Under Section 508 of the

Rehabilitation Act of 1973, is the FDIC policy for implementation of Section 508. The directive is available on the

FDIC website: https://www.fdic.gov/buying/goods/acquisition/index.html.

7.5.5-01 - Option Period - October 2015 The Period of Performance may be extended, at the discretion of the FDIC, for the Option Period(s) identified below:

Period of Performance

Option Period1 From:July 14, 2027 To: July 13, 2028

Option Period2 From:July 14, 2028 To: July 13, 2029

Exceptwherespecificallyindicatedotherwise,"PeriodofPerformance"asusedhereafterinthiscontractrefersbothtothe

InitialPeriodofPerformanceandtoanyOptionPeriodwhichmaybeexercised.

7.5.5-02 - Notice of Exercise of Option - July 2008 If the FDIC desires to exercise the option to extend the Period of Performance, the FDIC must notify Contractor, in writing, of its intent not less than thirty (30) days before the expiration of the current Period of Performance.

7.5.6-04 - Approved Subcontractors and Consent to Subcontract - June 2025 The Contractor must not engage any subcontractors to perform any contract responsibilities without the prior written approval of the FDIC. The Contractor must notify the FDIC of any proposed changes in approved subcontracting arrangements. If the Contractor proposes to add a subcontractor after award, the Contractor must obtain consent from the Contracting Officer. The Contractor must send a written request to the Contracting Officer, which sets forth

Section I - Contract Clauses PAGE 20 OF 41 the following:

(1) Name, Address, and Unique Entity Identifier (UEI) number of the subcontractor if the subcontractor has a UEI number. (Note: A subcontractor is considered to be any entity or person, other than an employee of the Contractor, that will receive payment from the Contractor and is a direct charge to the contract.);

(2) Summary of capabilities of the subcontractor, to include qualifications and resources;

(3) Identify the roles of any Key Personnel (see clauses 7.3.2-43) that will be filled by the subcontractor, if applicable;

(4) Estimated dollar amount of each subcontract;

(5) Description of services to be performed or goods/material to be provided by the subcontractor; and

(6) Rationale and the offeror’s policy for subcontracting.

In the case of time and material or labor hour contracts, the contractor must provide pricing support for the reasonableness of the proposed labor rates. If markup on the subcontractor rates has been approved by the

Contracting Officer, any proposed markup rates must be identified in the pricing support.

A subcontractor must not begin work until the Contractor receives written approval by the FDIC Contracting Officer.

The following subcontractors are approved for performance under this contract:

Consent by the FDIC to any proposed subcontractor does not: (1) constitute a determination of the acceptability of any subcontract terms or conditions; or (2) constitute a determination of the acceptability of any amount paid under any subcontract; or (3) relieve Contractor of any of its responsibilities under the award.

7.5.14-01 - Disputes - June 2012 Except as otherwise provided in this award, any factual dispute arising under this award, which is not disposed of by agreement, will be decided by the Contracting Officer. The Contracting Officer must, within 60 days, decide the claim or notify the contractor of the date by which the decision will be made. The Contracting Officer will furnish the contractor with a copy of the written decision.

The decision of the Contracting Officer is final and conclusive unless the contractor submits a written request for appeal of the decision to the Division of Administration, Acquisition Services Branch (ASB), Deputy Director, within

60 days from receipt of the Contracting Officer decision. The ASB Deputy Director must, within 30 days, decide the claim or notify the contractor of the date by which the decision will be made. The decision of the ASB Deputy

Director is final and conclusive unless a court of competent jurisdiction finds the decision fraudulent, arbitrary and capricious, so grossly erroneous as to imply bad faith, or not supported by substantial evidence. The contractor has

Section I - Contract Clauses PAGE 21 OF 41

180 days from the date of the ASB Deputy Director''s decision to appeal to a court of competent jurisdiction.

Contractor will be afforded an opportunity to be heard and to offer evidence in support of its appeal, if it requests.

Pending final decision of a dispute, Contractor remains obligated to proceed diligently with the performance of the contract, in accordance with the Contracting Officer''s decision.

Questions of law may be considered in deciding disputes under the process described above. However, consideration of questions of law by any administrative official, representative or board is not a final decision, and is not to be construed as one.

7.6.4-04 - Fair Inclusion of Minorities and Women - November 2025

(a) In accordance with Section 342(c) of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub L.

No. 111-203, 124 Stat. 1376 (2010) (Dodd-Frank Act), the Contractor shall ensure, to the maximum extent possible and consistent with applicable law, the fair inclusion of minorities and women in its workforce. The Contractor shall insert the substance of this clause in all subcontracts under this Contract whose dollar value exceeds $100,000.

Within ten business days of a written request from the Contracting Officer, or such longer time as the Contracting

Officer determines, and without any additional consideration required from FDIC, the Contractor shall provide documentation, satisfactory to FDIC, of the actions it (and as applicable, its subcontractors) has undertaken to demonstrate its good faith effort to comply with this clause. The Contractor shall not take any action pursuant to this clause that violates any applicable anti-discrimination laws.

(b) Consistent with Section 342(c)(3) of the Dodd-Frank Act, a failure to demonstrate a good faith effort to include minorities and women in the Contractor’s workforce (and as applicable, the workforce of its subcontractors), may result in termination of the Contract, referral to the Office of Federal Contract Compliance Programs of the

Department of Labor, or other appropriate action.

(c) For purposes of this clause, the terms “minority,” “minority-owned business” and “women-owned business” shall have the meanings set forth in Section 342(g) of the Dodd-Frank Act.

Section I - Contract Clauses PAGE 22 OF 41

Section J - List of Attachments

The table below lists all of the attachments for Section J which start on the following page

Order of Appearance Name

Attachments B-1 Price Schedule

Section J - List of Attachments PAGE 23 OF 41

Section K - Representations, Certifications and Other Statements of Offerors

7.3.1-03 Restriction on Disclosure of Information July 2008

7.3.2-45 - Preamble to Contractor Representations and Certifications - March 2024 Contractors receiving awards from the FDIC are subject to the provisions of 12 Code of Federal Regulations

Chapter III, Part 366, which may be found at: http://www.fdic.gov/buying/goods/acquisition/index.html. The representations and certifications set out in this solicitation must be completed by an official authorized to bind the offeror, and must be returned with its proposal. These representations and certifications concern matters within the jurisdiction of an agency of the United States, and the making of a false, fictitious, or fraudulent certification may render the offeror and certifying official subject to prosecution under 18 United States Code §§ 1001, 1007, and

1014. (For purposes of these certifications, the Federal Deposit Insurance Corporation (FDIC) is considered an agency of the United States only with respect to its rights and remedies under Title 18 of the United States Code).

In addition, any misrepresentations or false, fictitious, or fraudulent certifications may render the offeror and the certifying official subject to administrative remedies available to the FDIC, which include suspension and/or exclusion from contracting, or termination of the contract (12 CFR 366.16; 12 CFR Part 367).

The offeror must provide notice to the Contracting Officer within 10 business days of discovery or at any time prior to contract award, if the contractor learns that one or more of its representations and certifications were erroneous when submitted or have become erroneous by reason of changed circumstances.

The signature of the offeror on the FDIC form 3700/55 constitutes the making of the applicable representations and certifications.

The applicable representations and certifications will be incorporated by reference into any contract awarded to the offeror pursuant to this solicitation.

PRIVACY ACT STATEMENT

The FDIC is authorized to request this information from you by 12 U.S.C. §§ 1819, and 1821. The purpose for collecting this information is to examine a contractor's eligibility for potential FDIC contract awards. Furnishing the requested information is voluntary, but failure to provide the requested information in whole or in part may delay or prohibit you from receiving an FDIC contract. The information provided by individuals is protected by the Privacy

Act, 5 U.S.C. 552a. The information you provide may be provided to appropriate Federal, state, local or foreign law enforcement authorities; to a court, administrative tribunal, or a party in litigation; to contractors, agents and other third parties as authorized by law; and in accordance with any of the other routine uses described in the FDIC

Financial Information System (30-64-0012) System of Records available at www.fdic.gov/about/privacy. If you have

Section K - Representations, Certifications and Other Statements of Offerors PAGE 24 OF 41 questions or concerns about the collection or use of the information, you may contact the FDIC's Chief Privacy

Officer at Privacy@fdic.gov.

7.3.2-46 - Integrity and Fitness Representations and Certifications - March 2024 Answer all questions and fill in the information asked for.

The offeror certifies to the following:

I. IDENTIFYING INFORMATION:

(a) Type of Organization

The contractor operates as [ ] an individual, [ ] a State or local agency, [ ] a partnership, [ ] a joint venture, [ ] a nonprofit organization, [ ] an educational institution, [ ] a corporation organized and existing under the laws of the state of ____________________________.

(b) Parent Information

The contractor [ ] is [ ] is not owned or controlled by a parent company. If it is, complete the blanks below and include an organizational chart of parent company:

NAME OF PARENT COMPANY ____________________________

UNIQUE ENTITY IDENTIFIER (UEI) NUMBER ____________________________

ADDRESS ______________________________________________

CITY ________________________ STATE _________________

ZIP CODE ____________________

(c) Joint Venture Information

The contractor [ ] is [ ] is not a joint venture.