CORHQ-26-R-0394 Software Supply Chain Container.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-26-R-0394

Software Supply Chain Container

Section B Price Schedule is for REFERENCE only.

Please complete Excel Attachment "Software Supply Chain Container Price Schedule"

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

CORHQ-26-R-0394

Section B - Supplies or Services and Prices/Costs

CLIN # Description Quantity Unit Unit Price Total Price

0001 Software Supply Chain Container

(Section B Price Schedule is for

REFERENCE only)

1 EA

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 71

Item # Item Description Manufacturer Part # Qty Unit Price Total Price

Initial Performance Period - (1/6/2027 - 1/5/2028) 0001 Container Images (See Section 3 of the SOO) 50 $0.00 0002 Software Maintenance 1 $0.00 0003 Professional Services (See Section 4 of the SOO) 1 $0.00

$0.00

Option Period 1 (1/6/2028 - 1/5/2029) 0001 Container Images 50 $0.00 0002 Software Maintenance 1 $0.00

$0.00

Option Period 2 (1/6/2029 - 1/5/2030) 0001 Container Images 50 $0.00 0002 Software Maintenance 1 $0.00

$0.00

Option Period 3 (1/6/2030 - 1/5/2031) 0001 Container Images 50 $0.00 0002 Software Maintenance 1 $0.00

$0.00

Option Period 4 (1/6/2031 - 1/5/2032) 0001 Container Images 50 $0.00 0002 Software Maintenance 1 $0.00

$0.00

$0.00

Base Total

Instruction to Offeror: Please enter data in only the yellow shadded boxes

Software Supply Chain Container Price Schedule

Option 4 Total

Option 1 Total

Option 2 Total

Email Address:

Contract Total

Technical Point of Contact:

Company:

Telephone#:

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 71

Section C - Description/Specifications/Work Statement

Attachments for this section start after the clauses.

Clauses Incorporated By Reference

Clause # Title Date

7.3.2-34 Duty to Deliver or Perform July 2008

Full Text Clauses

7.3.2-21 - Description/Specifications/Work Statement - October 2008 The name/description of the goods or services being acquired is as follows:

Software Supply Chain Software

The specifications for and the description of the work to be performed under this award are fully detailed in either a

Statement of Work (SOW) which is included as an attachment in Section C of this award document.

Section C - Description/Specifications/Work Statement PAGE 5 OF 71

NONPUBLIC//FDIC INTERNAL ONLY

FDIC

Federal Deposit Insurance Corporation Division of Information Technology

Statement of Objectives

Cloud Infrastructure Platform Software Supply Chain Security Solution

1. Introduction and Purpose

The Federal Deposit Insurance Corporation (FDIC) is an independent agency created by Congress to maintain stability and public confidence in the nation's financial system. The FDIC insures deposits, examines and supervises financial institutions for safety and soundness, makes large and complex financial institutions resolvable, and manages receiverships. In fulfilling this mission, the FDIC operates critical information technology systems that must meet the highest standards of security, availability, and compliance.

The Infrastructure and Operations Services Branch (IOSB), an organization within the Division of Information Technology (DIT), operates and maintains all centralized IT infrastructure, engineering and integration services, and cloud operation services for the FDIC. IOSB manages, performs and modernizes functions for IT engineering; operations; operational information security over all IT infrastructure and cloud environments (e.g., firewall and intrusion prevention system monitoring and management, patch management, network policy enforcement); network; storage; database; computing; identity, credential and access management (ICAM); and endpoint services (e.g., email, customer support, video conferencing, end-user computing services) that support the FDIC’s mission and adoption of DevSecOps.

IOSB is responsible for obtaining and securing container images prior to the deployment in the environment. As part of the FDIC's ongoing commitment to secure software development practices and supply chain security, the agency seeks to procure a comprehensive Software Supply Chain Security Solution that provides hardened, compliant container images with minimal attack surfaces, comprehensive vulnerability management, and enterprise-grade support capabilities.

This will be a single-award contract.

2. Objective

The objective of this acquisition is to obtain a Software Supply Chain Security Solution that delivers secure, compliant, and continuously maintained container images to support the FDIC's application development and deployment infrastructure. The solution must significantly reduce the FDIC's vulnerability exposure, accelerate compliance posture, and minimize the engineering burden associated with container image hardening and maintenance.

Section C - Description/Specifications/Work Statement PAGE 6 OF 71

Scope of Work

The contractor shall provide a Software Supply Chain Security Solution consisting of:

1. Access to a comprehensive catalog of secure, hardened container images

2. Continuous vulnerability monitoring and rapid remediation services

3. Compliance artifacts including Software Bills of Materials (SBOMs), attestations, and provenance documentation

4. Enterprise management portal with authentication integration

5. API access to container registry for automated workflows

6. Professional services for implementation, integration, and ongoing support

The scope of work is represented in the following diagram, it is also included in Appendix B, to show the dependent systems that will process data from the Software Supply Chain Security Solution:

3. Mandatory Requirements

3.1. Compliance and Security Standards

3.1.1. Remediate container images to comply with FedRAMP Moderate, NIST 800-190, DISA STIG/CIS benchmarks, and support for DoD IL5/IL6 environments. The contractor shall ensure all container images meet federal security baselines and are suitable for classified and sensitive but unclassified (SBU) environments.

3.1.2. Deliver the responses to the FDIC Authority to Operate control statements.

3.2. Transparency

Section C - Description/Specifications/Work Statement PAGE 7 OF 71

3.2.1. Provide secure container images with a written artifact of the dependencies used in the container. Each image shall include comprehensive documentation of all software components, libraries, and dependencies

3.2.2. Provide secure container images with a Software Bill of Materials (SBOM) signed by a certificate signing authority. SBOMs must be machine-readable (e.g., SPDX, CycloneDX format) and cryptographically signed to ensure integrity

3.2.3. Provide zero-trust equivalent information to include the signature and any bundles that occur with the image. All cryptographic signatures and associated metadata must be provided for verification purposes

3.3. Vulnerability Management Remediation

3.3.1. Update images against zero-day vulnerabilities within 48 hours of disclosure. The contractor shall maintain processes to rapidly patch zero-day vulnerabilities and make updated images available to the FDIC within two calendar days of public disclosure

3.3.2. Provide a service level agreement (SLA) that critical Common Vulnerabilities and Exposures (CVEs) will be remediated within seven (7) calendar days after the patch is available from the upstream maintainer

3.3.3. Provide a service level agreement (SLA) that high severity CVEs will be remediated within fourteen (14) calendar days after the patch is available from the upstream maintainer.

3.3.4. Provide a service level agreement (SLA) that medium severity CVEs will be remediated within thirty (30) calendar days after the patch is available from the upstream maintainer.

3.3.5. Check and apply new packages daily for the container images hosted in the vendor repository. The contractor shall implement continuous integration processes to incorporate security updates on a daily basis.

3.3.6. Provide a process that monitors for changes to upstream packages and creates a new image when the package changes automatically. Automated rebuild processes must be in place to ensure images remain current.

3.3.7. Have a process to build a new image within 24 hours when the upstream package changes. The contractor shall demonstrate capability to rapidly respond to upstream changes.

3.4. Image Characteristics and Optimization

3.4.1. Provide container images with the least amount of packages for a production deployment. Images must be minimal and contain only essential components required for runtime operation, reducing attack surface and image size.

Section C - Description/Specifications/Work Statement PAGE 8 OF 71

3.4.2. Provide container images that are as small as possible. The contractor shall employ distro-less or minimal base image strategies to optimize image size and security.

3.4.3. Provide tagging of the images to demonstrate the latest production package versus the development package. Clear tagging conventions must distinguish between production-ready and development variants.

3.4.4. Provide container images with a development variant that includes the packages needed for troubleshooting. Development images may include debugging tools, shells, and diagnostic utilities not present in production images.

3.5. Platform and Portal Capabilities

3.5.1. Provide a management portal for the product that can be integrated with Active Directory for single sign-on. The portal must support enterprise authentication mechanisms used by the FDIC.

3.5.2. Provide Azure Entra ID integration with the FDIC authentication system. The solution must support modern identity protocols including SAML 2.0, OAuth 2.0, and OpenID Connect.

3.5.3. Provide role-based access control (RBAC) authentication. The platform must support granular permission models allowing administrators to control user access to images, repositories, and management functions

3.5.4. Provide a command-line interface (CLI) for access to the vendor container registry.

The CLI must support API V2 protocol and token-based authentication for automated workflows and CI/CD pipeline integration.

3.5.5. Provide a graphical user interface to browse for container images. The portal shall include search, filtering, and discovery capabilities to help users locate appropriate images.

3.5.6. Provide a portal that displays the following information fields for each image: Image creation date, Software Bill of Materials (SBOM), vulnerabilities and advisories.

Complete metadata must be easily accessible through the web interface.

3.5.7. Provide the ability to receive notifications of product changes, critical vulnerability notifications, and patches. The system must support email, webhook, or API-based notification mechanisms.

3.5.8. Integrate with the JFROG pipeline

Section C - Description/Specifications/Work Statement PAGE 9 OF 71

3.6. Lifecycle Management

3.6.1. Provide a report of the vulnerabilities from the proposed solution for the container images listed in Appendix A. As part of the technical proposal, offerors shall demonstrate their solution's capability by providing vulnerability scan results for the FDIC's specified test images.

3.7. Additional Capabilities The following additional capabilities are not mandatory but represent capabilities desirable to the FDIC. Offerors that offer these additional capabilities may or may not receive favorable consideration in the Best Value evaluation, dependent upon their value to the FDIC, in accordance with the solicitation.

3.8. Enhanced Transparency and Traceability

3.8.1. Provide container images with signed attestations. Images shall include provenance attestations demonstrating secure build processes and supply chain integrity.

3.8.2. Provide a written artifact that correlates the production release with the development release. When the vendor builds a new image from source files, the vendor should provide documentation demonstrating that their build is based on the upstream open-source build, including commit hashes, build timestamps, and verification checksums.

3.8.3. Provide security advisory notifications with a YAML file that can be retrieved from GitHub showing the status of CVEs. Machine-readable vulnerability status files should be available via public repository for automated monitoring.

3.9. Extended Lifecycle Support

3.9.1. Provide the capability to use a container image beyond the end of life for a specific package. Extended support for legacy versions may be necessary for applications with long modernization timelines.

3.10. Self-Service and Customization

3.10.1. Provide a self-service capability to obtain a custom image that is not in the repository using a portal. Users should be able to request custom image builds through the web interface without requiring command-line tools.

3.10.2. Provide the ability to install any shell in an image that is downloaded for development testing. Development variants should support installation of debugging tools and shells (e.g., bash, zsh) as needed.

3.11. Compliance and Tagging

Section C - Description/Specifications/Work Statement PAGE 10 OF 71

3.11.1. Perform scanning on a daily basis and provide scan results. Continuous vulnerability scanning with accessible results enhances security visibility.

3.11.2. Images are tagged appropriately, such as indicating FIPS-compliant images. Clear tagging conventions help users identify images meeting specific compliance requirements (e.g., FIPS 140-2, STIG-hardened)

3.12. Licensing and Flexibility

3.12.1. Provide the ability to license the product for fifty (50) images without requiring specification of the image name in advance. Flexible licensing models that allow the FDIC to select images as needs evolve are preferred.

3.12.2. Provide minimum image purchase or minimum dollar requirement, if any. Offerors should clearly state any minimum commitments or purchasing thresholds.

3.13. Technical Architecture

3.13.1. Provide an underlying image that is based on GLIBC. Standard C library implementations ensure broad compatibility with enterprise applications.

3.13.2. Provide images for multiple architectures: AMD64, Intel x86-64, ARM64. Multi-architecture support enables deployment across diverse hardware platforms.

3.13.3. Integrating with existing vulnerability scanning tools and security orchestration platforms. The vulnerability scanning tools includes: Crowdstrike, and Trivy. The binary/artifact repository manager that is JFROG.

3.13.4. Integrating with Splunk system event monitoring.

4. Professional Services

In addition to the Software Supply Chain Security Solution, the FDIC requires Professional Services to ensure successful implementation and integration with JFROG. The FDIC technical architecture is captured in Appendix B. The contractor shall provide personnel that has demonstrated experience with containerization framework architectures which will support the following functions:

4.1. Technical Integration Services

4.1.1. The contractor shall provide a Technical Consultant who will be responsible for integrating the Software Supply Chain Security Solution with the FDIC's existing pipeline infrastructure listed in Appendix A which is represented as the JFROG product.

• Conducting technical discovery and requirements validation sessions

• Designing the integration architecture for container registry access, authentication systems (Active Directory, Azure Entra ID), and CI/CD pipelines including SSL implementation

Section C - Description/Specifications/Work Statement PAGE 11 OF 71

• Configuring the vendor provided management portal and establishing role-based access controls

• Providing hands-on training in a virtual and/or on-premise environment to FDIC development teams and DevOps engineers

• Supporting pilot deployments and production cutover activities

• Troubleshooting technical issues during and after implementation

• Completing security control statements and responding with audit data as requested prior to the production approval. Once the product has obtained the FDIC Change Control Board approval, then the control statement and audit data requests will terminate for this engagement.

4.2. Security and Compliance Services

4.2.1. The contractor shall provide a Security Control Specialist who will support the FDIC's security and compliance requirements, including:

• Answering questions related to NIST SP 800-53 security controls and mapping solution capabilities to specific control requirements

• Supporting the development of security authorization documentation, including System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms). Note: Offerors can expect to answer a customized set of questions from the NIST 800-53 Revision 5. The FDIC does not require the vendor solution to obtain FedRamp status and therefore is not expected to apply all control statements during the implementation.

• Providing technical evidence and artifacts to support FedRAMP, FISMA, and other federal compliance processes

• Conducting security configuration reviews and hardening recommendations

• Assisting with the interpretation and implementation of DISA STIGs, CIS Benchmarks, and NIST 800-190 guidance

• Supporting audit and assessment activities conducted by the FDIC's Office of the Chief Information Security Officer (OCISO)

• Advising on secure software development lifecycle (SSDLC) best practices and supply chain risk management

Section C - Description/Specifications/Work Statement PAGE 12 OF 71

Appendix A

Image Name Manufacturer Alpine Open Source Red Hat OS IBM NGINX Open Source TomCat Open Source Spring boot Open Source

Section C - Description/Specifications/Work Statement PAGE 13 OF 71

Appendix B

Section C - Description/Specifications/Work Statement PAGE 14 OF 71

Section E - Inspection and Acceptance

No attachments were added for this section.

No reference clauses were found for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have 25 business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 15 OF 71

Section F - Deliveries or Performance

7.3.1-10 - Place of Delivery or Performance - November 2025 The place of delivery or performance is: Remote

Contractor must ensure the contract number is listed on the shipping material or packing slip.

Tangible items: Shipment-tracking information must be provided to the following email addresses:

DITDDC@FDIC.gov and the Oversight Manager listed in Clause 7.3.2-41 FDIC Personnel within one business day of when a tangible item is shipped to the FDIC.

Non-tangible items: Shall be submitted to the following email addresses: DITSoftwareMgt@FDIC.gov and the

Oversight Manager listed in Clause 7.3.2-41 FDIC Personnel. This includes all documentation such as product keys, activation codes, digital certificates or related materials necessary to install, activate, subscribe, and operate the software in accordance with the terms of the contract and evidence of maintenance or subscription renewals.

This requirement applies to electronic records or documentation associated with deliverables under this contract and does not modify any negotiated software license terms or rights.

7.3.1-11 - Deliverables - July 2008 The Contractor must provide all deliverables described in the statement of work.

7.3.1-12 - Period of Performance - July 2023 The Initial Period of Performance begins on January 6, 2027 and expires on January 5, 2028. If all option periods are exercised, the final expiration date is January 5, 2032.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 16 OF 71

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum. The Oversight Manager is Russell Rogers and can be reached at rurogers@FDIC.gov.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders. The Contracting Officer is Hamilton Jackson and can be reached at hamjackson@fdic.gov.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a

Section G - Contract Administration Data PAGE 17 OF 71 proper invoice as defined in the Prompt Payment Act clause herein.

7.5.13-12 - Schedule for Invoicing - July 2008 For Firm-Fixed-Price, Contractor must submit invoice upon completion of the service or delivery of the goods.

7.5.13-13 DEV-01 - Contents of Invoice - Deviation - March 2026 Contractor’s invoices must include the following items to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date.

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number/Delivery Order Number, etc.). The complete

Contract Number, including the Task Order suffix, is required on each invoice (e.g., CORHQ-22-C-0559 or

CORHQ-21-G-0442-0004).

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered, or services performed.

(h) Billing period covered for services rendered.

(i) Total invoice amount.

(j) Payment terms (discount for prompt payment terms).

(k) Remittance address.

(l) Billing Point of Contact (e.g., name (where practicable), title, phone number, and email address of person to notify if there are questions regarding the invoice).

(m) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment).

Shipping charges, if any, must be shown as a separate item on the invoice.

(n) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(o) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(p) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice

Section G - Contract Administration Data PAGE 18 OF 71 it submits to FDIC.

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor’s invoice when seeking reimbursement of subcontractor expenses.

(q) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clear in the supporting documentation provided with the invoice.

(r) Any other information or supporting documentation required by the award.

If an invoice does not contain the above required information; contains errors; contains mismatches between information in the electronic invoice form and the supporting attachments or exceeds the total compensation ceiling limit for this award, the invoice will be returned to the Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 DEV-01 - Electronic Invoice Preparation and Submission - Deviation - March

Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Invoices shall be submitted via the Invoice Processing Platform (IPP), a service provided by the U.S. Treasury’s

Bureau of the Fiscal Service. Contractors are solely responsible for ensuring that invoices are accepted by IPP and transmitted to the FDIC. IPP will submit a status update to the Contractor when the invoice is transmitted to the

FDIC.

(b) Contractors not enrolled in IPP will be notified to register upon award of a contract, agreement, or order. Unless already enrolled in IPP, and following an FDIC invitation to do so, Contractor shall enroll at https://www.ipp.gov.

Contractor shall contact IPP Customer Support for system-related questions at

IPPCustomerSupport@fiscal.treasury.gov.

(c) Contractor shall ensure that their System for Award Management (SAM) account remains active during the contract/order performance. IPP will not allow submission or payment of an invoice if Contractor’s SAM registration has expired.

(d) Contractor shall include or input the following information. Additional information may also be required in accordance with your contract, agreement, or order. Items noted with an asterisk are typically automatically populated from the contract or purchase order. Items below may be included on supporting attachments to the electronic invoice and must match what was entered on the electronic invoice.

(1) *Contractor name and address.

(2) Invoice date. Future dates cannot be entered into IPP.

Section G - Contract Administration Data PAGE 19 OF 71

(3) Invoice number.

(i) The only valid characters allowed for invoice numbers are: capital letters, numbers, hyphens, periods, and underscores.

(ii) If an invoice status is “Rejected” in IPP, a resubmitted invoice must have REV added as a suffix to the original invoice number. In the event of multiple invoice resubmissions, the next sequential suffix must be used

(e.g., REV1, REV2, etc.).

(4) *Contract and/or order number.

(5) Quantity per Contract Line-Item Number (CLIN) and Schedule Line.

(6) *Description, unit of measure, unit price, and extended price of delivered items or provided services.

(i) Unless otherwise specified in the contract or order, a billing period for services is a month.

(ii) For time-and-materials contracts or orders, Contractors shall invoice no less often than monthly.

(7) Discount terms for prompt payment if offered.

(8) Name and phone number of Contractor’s Point of Contact (POC).

(9) Attachments, including Contractor’s internally generated invoice and supporting documents.

(i) Contractor must submit at least one supporting attachment file with each invoice in IPP. If a zip file is used, the individual files inside the zip file have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.

(e) Contractors agree that, in submitting any related invoice for payment, Contractor is certifying the truthfulness and completeness of all such submissions.

(f) IPP allows Contractors to view the status of their invoices in IPP. IPP status codes are:

(1) Pending Approval - Invoice has been submitted via IPP and received by FDIC.

(2) Rejected - Invoice has been rejected and will need to be resubmitted with REV added as the suffix of the original invoice number.

(3) Paid - Payment has been made to the Contractor’s financial institution.

(4) Saved in Exception - Invoice has not been created in IPP because of rule set error.

(5) Denied - Invoice submitted via IPP and denied by FDIC. Denied invoices cannot be edited and resubmitted.

(g) The counting of days for the possible payment of Prompt Payment Act interest begins on the date the invoice’s status is changed to “Pending Approval” in IPP.

Section G - Contract Administration Data PAGE 20 OF 71

Section H - Special Contract Requirements

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.3.2-78 - Commercial Supplier Agreement Terms and Conditions - May 2025

1. Definitions:

A. “Commercial item” means any of the following: [Note: For purposes of this document, the term "commercial item" is interchangeable with the terms "commercially available”, "commercially available software”, "commercial component(s)", "commercial product(s)", and "commercial off-the-shelf (COTS)”.]

(1) Any item, other than real property, that is of a type customarily used by the general public or by nongovernmental entities for purposes other than governmental purposes and that has been sold, leased, licensed to the general public; or has been offered for sale, lease, or license to the general public.

(2) Any item that evolved from an item described in paragraph (1) through advances in technology or performance and that is not yet available in the commercial marketplace, but will be available in the commercial marketplace in time to satisfy the delivery requirements under a government solicitation.

(3) Any item that would satisfy a criterion expressed in paragraphs (1) and (2) of this definition, but for (i) modifications of a type customarily available in the commercial marketplace; or (ii) modifications of a type not customarily available in the commercial marketplace made to meet Federal government requirements.

(4) Any combination of items meeting the requirements of paragraphs (1), (2), (3), or (5) of this definition that are of a type customarily combined and sold in combination to the general public.

(5) Installation services, maintenance services, repair services, training services, and other services if such

Section H - Special Contract Requirements PAGE 21 OF 71 services are procured for support of an item referred to in paragraph (1), (2), (3), or (4) of this definition, and if the source of such services--(i) offers such services to the general public and the Federal government contemporaneously and under similar terms and conditions; and (ii) offers to use the same work force for providing the Federal government with such services as the source uses for providing such services to the general public.

(6) Services of a type offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed under standard commercial terms and conditions. This does not include services sold based on hourly rates without an established catalog or market price for specific service performed.

(7) Any item, combination of items, or service referred to in paragraphs (1) through (6), notwithstanding the fact that the item, combination of items, or service is transferred between or among separate divisions, subsidiaries, or affiliates of a contractor.

(8) Any item determined by the procuring agency to have been developed exclusively at private expense and sold in substantial quantities, on a competitive basis, to multiple state and local governments.

B. “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” and intended to create a binding legal obligation on the end user, such as, but not exclusively, those used in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data. Such agreements may be referred to as Terms of Service (TOS), End User License Agreement (EULA) or another similar legal instrument or agreement and may be presented as a part of a proposal or quotation responding to a solicitation for contract or order. The term applies, regardless of the format or style of the document, whether in paper or electronic form.

2. Applicability. The following terms and conditions apply to any commercial supplier agreement as defined in this clause. These terms take precedence and supersede any conflicting or contrary terms in a contractor, subcontractor or associated third party Commercial license agreement. When any supply or service acquired under this contract is subject to a commercial supplier agreement, the terms of this clause shall be deemed incorporated into the commercial supplier agreement. In addition, the Commercial Supplier Agreement is a part of a contract between the commercial supplier and the FDIC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including all contracts, task orders, and delivery orders). For accepted terms under the commercial supplier agreement, the ordering activity FDIC may be bound as end user, but a

Government employee or person acting on behalf of the government in his or her personal capacity will not be bound. The commercial supplier or license agreement may be incorporated into an FDIC contract as modified by this clause. If a Commercial Supplier Agreement is not required for the goods and services performed by the contractor, all the terms listed below in this clause are not applicable to the contract.

3. Contract Formation. All terms intended to bind the FDIC must be included in static text form within the contract signed by the FDIC. Neither the FDIC nor any authorized end user shall be deemed to have agreed to any terms in the commercial supplier agreement or any terms of any associated third-party agreement by a click box or other comparable mechanism (e.g., “click-wrap” or "browse-wrap" agreements) and such purported execution does not bind the FDIC or an authorized end user and is null and void.

4. Authorization. By executing the Contract, Contractor represents that it is duly authorized to enter into the

Contract, including any amendments to the commercial supplier agreement as incorporated into the contract.

Section H - Special Contract Requirements PAGE 22 OF 71

5. Venue. Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

6. Limitations on Actions. Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

7. Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, binding arbitration shall not be used unless specifically authorized by a FDIC guidance, and equitable or injunctive relief, including award of attorney fees, costs or interest, may be awarded against FDIC only when explicitly provided by statute (e.g. Prompt Payment Act). Any terms in the commercial supplier agreement requiring that disputes be submitted to arbitration or that claims the supplier has the right to injunctive relief, attorney fees, costs or interest is null and void and shall not be enforceable against the Government.

8. Updating Terms. After award the contractor may unilaterally revise terms if they are not material. A material change is defined as: (A) Terms that significantly change Government’s rights or obligations; and (B) Terms that increase Government prices; (C) Terms that decrease overall level of service; or (D) Terms that limit any other

Government right addressed elsewhere in this contract. For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be incorporated into the contract using a bilateral modification. Any terms or conditions unilaterally revised subsequent to award that are inconsistent with any material term or provision of this contract shall not be enforceable against the Government, and the Government shall not be deemed to have consented to them.

9. Representation. Any clause of this agreement requiring the commercial supplier or licensor to defend or indemnify the end user is hereby amended to provide that the U.S. Department of Justice has the sole right to represent the United States in any such action, in accordance with 28 U.S.C. § 516 or FDIC under 12 U.S.C. §

1819, unless otherwise provided by Federal law.

10. Warranties and Disclaimers. FDIC will accept the contractor’s commercial warranty, but does not accept a disclaimer of the implied warranty that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract. Additionally, FDIC does not accept a disclaimer of any warranties expressly provided for in the Contract.

11. Limitation of Liability. All limitations of liability accepted by FDIC shall only apply to claims based on contract and any limitations related to tort or other causes of action shall not apply and shall be null and void and unenforceable against the government. Notwithstanding anything to the contrary in the commercial supplier agreement, nothing in the contract or the commercial supplier agreement shall impair the U.S. Government''s right to recover for fraud or crimes arising out of or related to this Government contract under any federal fraud statute, including but not necessarily limited to the False Claims Act, 31 U.S.C. §§ 3729-3733.

12. Audit. Any audit requested by the contractor will be at the contractor’s or Licensor’s expense without reimbursement by the FDIC. Further, such audit may only be conducted if the auditor satisfies the FDIC’s security requirements for access to its facilities, systems and information.

13. Term and Termination. Neither the Contractor nor Licensor can unilaterally revoke, terminate or suspend an

Agreement or any associated rights granted to the FDIC. In the event of a dispute, the requirements specified in

Section H - Special Contract Requirements PAGE 23 OF 71 the Disputes paragraph of this document would apply.

14. Continued Performance. The supplier or licensor shall not unilaterally revoke, terminate or suspend any rights granted to the Government except as allowed by this contract. If the supplier or licensor believes the FDIC to be in breach of the agreement, it shall pursue its rights under the Disputes Clause of the contract or other applicable

Federal statute while continuing performance.

15. Confidentiality. If the agreement includes a confidentiality clause, it shall be amended to state that the

Government and Government employee’s obligations with regard to confidentiality are governed by statute, such as, but not exclusively, the Trade Secrets Act, 18 U.S.C. § 1905 and the Freedom of Information Act, 5 U.S.C. §

552. To the extent that the confidentiality language conflicts or in any way purports to alter the Government or

Government employee’s obligation with regard to confidentiality, such language shall be null and void and will not be enforceable against the Government.

16. Indemnification. Any language requiring the FDIC to indemnify a contractor or related third-party licensor is null and void and is unenforceable against the Government.

17. Automatic Renewal. Except as otherwise expressly agreed to by the FDIC, any provision of an Agreement requiring automatic renewal of the Agreement is unenforceable against the FDIC.

18. Integration. Any integration clause shall be amended to recognize the associated Contract and these terms and conditions as part of an “entire agreement.”

19. Disputes. If the supplier or licensor believes FDIC is in breach of the Agreements, it shall pursue its rights under the Disputes clause of the Contract and Federal laws and performance under the Contract shall continue pending resolution of the dispute.

20. Governing Law. This agreement shall be governed by Federal law. Any language purporting to subject the

U.S. Government to the laws of a U.S. state, U.S. territory, district, or municipality, or a foreign nation, except where

Federal law expressly provides for the application of such laws, is hereby deleted.

21. Assignment. Neither the Contract nor these Agreements, as amended, shall be assigned, nor may any rights or obligations be delegated, without FDIC’s prior approval, except as permitted pursuant to Clause 7.6.5-05, Assignment of Claims.

22. Payment. The FDIC Contract governs the purchase and payment of fees. Payment for awards made by the

FDIC in its corporate capacity are subject to the Prompt Payment Act. 31 USC §§ 3901-05.

23. Taxes. The FDIC is exempt from paying any City, County, State, and Federal taxes as provided by Tax

Exempt Certificate No. 53-0185558.

24. Force Majeure. Failure to perform this contract according to its terms is excusable and not an event of default if the failure to perform is caused by events beyond the control of Contractor, and through no fault or negligence of

Contractor.

Section H - Special Contract Requirements PAGE 24 OF 71

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the…