CORHQ-24-R-0437.pdf

SOLICITATION/AWARD

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. CONTACT INFORMATION 8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. N/A

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ RFP

Price only

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. N/A 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. FEDERAL DEPOSIT INSURANCE CORPORATION (SIGNATURE OF CO)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

FDIC 3700/55 (3-08)

10. SOCIO-ECONOMIC STATUS

NO

NAICS:

ETHNICITY:

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. SUB-CONTRACTING

PERMITTED/APPROVED

YES

SDB

MWOB

SERVICE-DISABLED VETERAN-

OWNED SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

YES NO

YES NO

27a. SOLICITATION INCLUDES ATTACHMENTS 27b. AWARD INCLUDES ATTACHMENTS

RFI RFP

Best Value

CORHQ-24-R-0437

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QTY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

FDIC 3700/55 (3-08)

Section B - Supplies or Services and Prices/Costs

Attachments for this section start after this page.

Section B - Supplies or Services and Prices/Costs PAGE 3 OF 87

CLIN # Base OP 1 OP 2 OP 3 OP 4 Total POP

CLIN 1 -$ -$ -$ -$ -$ -$

Optional Future CLIN -$ -$ -$ -$ -$ -$ Total per Period -$ -$ -$ -$ -$ -$

ADS Support - Pricing Summary

Section B - Supplies or Services and Prices/Costs PAGE 4 OF 87

Period

Biweekly

Sprints in

Period

Estimated

Team Size Team Charge Period Charges

Base 26 6 -$ -$

OP1 26 6 -$ -$

OP2 26 6 -$ -$

OP3 26 6 -$ -$

OP4 26 6 -$ -$

CLIN 1 Total -$

Period

Biweekly

Sprints in

Period

Estimated

Team Size Team Charge Period Charges

Base 26 3 -$ -$

OP1 26 3 -$ -$

OP2 26 5 -$ -$

OP3 26 5 -$ -$

OP4 26 5 -$ -$

Optional Total -$

ADS Support - Agile Team Pricing Model

CLIN 1

Optional Future CLIN

Section B - Supplies or Services and Prices/Costs PAGE 5 OF 87

FTE Team Size Base OP 1 OP 2 OP 3 OP 4

2 -$ -$ -$ -$ -$

3 -$ -$ -$ -$ -$

4 -$ -$ -$ -$ -$

5 -$ -$ -$ -$ -$

6 -$ -$ -$ -$ -$

7 -$ -$ -$ -$ -$

8 -$ -$ -$ -$ -$

9 -$ -$ -$ -$ -$

10 -$ -$ -$ -$ -$

Role FTE Role FTE Role FTE

Total FTEs 0.0 Total FTEs 0.0 Total FTEs 0.0

Role FTE Role FTE Role FTE

Sr. Program Manager 1.0

Sr. Enterprise Architect 1.0

Sr. Solution Architect 1.0

Sr. Business Analyst 1.0

Mid-Level Business Analyst 1.0

Mid-Level Solution Architect 1.0

Total FTEs 0.0 Total FTEs 6.0 Total FTEs 0.0

Role FTE Role FTE Role FTE

Total FTEs 0.0 Total FTEs 0.0 Total FTEs 0.0

ADS Support - Agile Team Biweekly Pricing

8 FTE Team 9 FTE Team 10 FTE Team

2 FTE Team 3 FTE Team 4 FTE Team

5 FTE Team 6 FTE Team 7 FTE Team

Anticipated Roles per Team Size

Section B - Supplies or Services and Prices/Costs PAGE 6 OF 87

Section C - Description/Specifications/Work Statement

Attachments for this section start after the clauses.

Clauses Incorporated By Reference

Clause # Title Date

No reference clauses were found for this section.

Full Text Clauses

7.3.2-21 - Description/Specifications/Work Statement - October 2008 The name/description of the goods or services being acquired is as follows:

The scope of work includes contractor support to perform the following activities: All services required to support the

Architecture and Design Section. The contractor will frequently, cost-effectively, and responsively deliver business value with expert enterprise architecture, strategic planning, cloud cost management, and business analysis services.

The specifications for and the description of the work to be performed under this award are fully detailed in the

Statement of Objective.

7.3.2-34 - Duty to Deliver or Perform - July 2008 Contractor agrees to perform the services (the "Services") or provide the goods (the "Goods"), in accordance with the terms and conditions set forth herein and in any attachments to the contract.

Section C - Description/Specifications/Work Statement PAGE 7 OF 87

Architecture & Design Support Services Statement of Objectives

Introduction

The Architecture and Design Section (ADS) of the Federal Deposit Insurance Corporation (FDIC) Chief Information Officer Organization (CIOO) is responsible for directing the process of acquiring, building, modifying, and interfacing IT resources throughout the FDIC enterprise—in short, IT architecture and design. In addition, the ADS is responsible for identifying and articulating the need for change in how FDIC invests in IT at present and in the coming years, as well as facilitating that change. The ADS also provides other enterprise architecture services to the Corporation such as:

defining the current state and future/target state architectures;

developing strategy;

conducting analysis and research; and providing governance to achieve the target state.

FDIC is undergoing a comprehensive effort to maximize and modernize its architecture and business analysis practices under a new model of continuous service delivery. The ADS is accountable for a multitude of capabilities and services that support this transition and the operations of the Corporation. The ADS’ mission is to prepare the FDIC for the future by developing and managing architectural targets and standards as well as informing IT investment decisions. In support of this mission, the ADS is seeking a Contractor to assist and provide support to the FDIC in maintaining, maturing, and accelerating its ability to effectively and efficiently deliver architecture design, strategy, research and analysis, and governance services to FDIC customers.

The purpose of this Statement of Objectives (SOO) is to describe the services and solutions that would bring value to the ADS and the Corporation through lean, innovative, efficient, and effective solutions, while leveraging agile methodologies.

Scope

The scope of this contract includes all services required to support the Architecture and Design Section. This engagement will support the ADS in its support for all Divisions/Offices within the FDIC.

The Contractor shall provide cross-functional teams that will be part of a community of federal employees and additional Contractor staff across the organization. The team will frequently, cost-effectively, and responsively deliver business value with expert enterprise architecture, strategic planning, cloud cost management, and business analysis services. The Contractor shall be responsible for supporting all elements within enterprise architecture including but not limited to:

architecture governance architecture framework development and maintenance architecture methodology architecture artifacts architecture standards architecture analysis architecture best practices, and

Section C - Description/Specifications/Work Statement PAGE 8 OF 87 defining and tracking transitions from the current to the future state.

The Contractor shall be responsible for supporting all functions within the ADS including but not limited to:

developing and maintaining IT/business roadmaps conducting business analysis analyzing/prototyping emerging technology maintaining the FDIC Technical Reference Model (TRM) cloud cost management platform architecture support for Low Code No Code cloud platforms maintaining enterprise architecture tool(s), and managing business application inventory.

The Contractor shall provide best-practice Agile and Product Management methodologies to support the continuous improvement of ADS’ operation. The Contractor shall also contribute to evolving architecture standards at the FDIC and share lessons learned with other stakeholders.

The Contractor and the FDIC shall work in coordination to develop and maintain a backlog of work items for ADS support. The FDIC is responsible for establishing priority for backlog items with input from the Contractor and may also restructure the backlog according to changing business needs. As new work is introduced to the backlog, priorities may change.

Therefore, the Contractor may be required to reorganize teams in order to support emerging architecture needs. This could mean scaling teams up or down, shifting roles on teams, or reorganizing teams to meet the needs of the ADS portfolio. The adjustment of a team’s composition to keep pace with the evolving needs of the work occurs within the fixed-price model of the team and will not require a contract modification.

Objectives

The FDIC seeks to accomplish the following objectives through this contract for the ADS Portfolio.

3.1. Business Objectives

1. Modernize and enhance enterprise architecture capabilities to provide an improved user experience (UX).

2. Identify and address opportunities to improve the communication and adoption of architecture insights and strategic direction to CIOO, and ensure ADS services are clearly defined, communicated and structured.

3. Improve the performance and availability of architecture services through scalable processes and procedures.

4. Improve the usability of architecture artifacts for increased stakeholder value.

5. Advocate for emerging trends in the market.

6. Establish architecture adoption measures and metrics that demonstrate value to the organization, and collect/analyze the relevant metrics.

7. Assist in establishing and maintaining architecture practices, centers of excellence and governance structures.

Section C - Description/Specifications/Work Statement PAGE 9 OF 87

8. Ensure a strategic technological direction for CIOO to be informed by the target state architecture (TSA).

9. Provide expertise in strategic and tactical planning for business solutions and application portfolio optimization strategies including the development of efficient roadmaps for change.

10. Execute projects using appropriate analysis techniques to deliver quality business recommendations/results in short timeframes (e.g., 3-6 weeks).

11. Analyze, model, and identify improvement opportunities in business processes or applications with measurable baselines and benefits to justify change.

12. Support a range of discovery initiatives.

13. Provide expertise in the Requirements Management.

14. Conduct alternatives analyses, cost/benefit analyses, financial analyses, feasibility studies, market research/analyses, portfolio/sub portfolio rationalization analyses, software analyses, and similar types of analysis in support of a range of business needs to recommend efficient, effective, and secure strategies and solutions.

15. Provide expertise in assessing feasibility of cloud or managed service solutions to address business pain points, business capability needs and provide cost effective alternatives to custom development.

16. Provide expertise in enterprise and solutions architecture and design that aligns with the FDIC business strategy and IT capabilities ensuring the effectiveness of our current technology portfolio and identify any future gaps.

17. Provide support for organizational change management (OCM) and OCM communication related activities on projects or initiatives.

3.2. Technical Objectives

1. Conduct research on and assess the feasibility of technologies and design approaches to establish guidelines that support the FDIC IT strategies, document results of the analysis including perceived benefits, shortcomings and risks, and develop technology roadmaps for transitioning to the target architectures.

2. Provide technical assistance and guidance to business and IT stakeholders on the adoption of relevant solution delivery standards/guidelines and the use of reference applications.

3. Conduct analysis of the alternative feasible tools or toolsets best suited to meet architecture standards and business needs.

Anticipated Activities and Deliverables Some activities and deliverables to be provided by Contractor are listed below. This is not an exhaustive list. In addition, the scope of the activities and the delivery dates for any deliverables will be managed through the backlog. Deliverables will be submitted by the Contractor to the project managers/leads and FDIC Technical Monitor.

4.1. Anticipated Activities

Maintaining the ADS backlog of work in GitHub, ServiceNow, or other platform(s), as designated by the FDIC;

Identifying current FDIC capabilities, performance gaps, and projected future needs;

Section C - Description/Specifications/Work Statement PAGE 10 OF 87

Providing on-demand support for enterprise-wide business and technical projects, reports and studies;

Develop and maintain FDIC IT Modernization Plan;

Facilitating and leading cross-business and organization working groups;

Supporting strategic planning and development for enterprise IT needs;

Supporting the organization’s ability to develop and deliver against its IT strategy;

Creating line of sight views and aligning technology with the enterprise mission;

Analyzing and documenting business architecture(s);

Evaluating business needs against technology trends;

Developing strategies for aligning CIOO strategies with FDIC’s mission needs;

Supporting the enterprise architecture governance process;

Application analysis and rationalization, providing landscape of individual applications, their interactions, and their relationships to the FDIC business capabilities;

Change management processes to support individual efforts and documents used to socialize new processes, benefits, and impacts to stakeholders to generate buy-in and support;

Business capability analysis, identification of existing gaps in IT enablement of the FDIC mission, high-level market research;

Developing presentations at the appropriate level for a broad audience across

FDIC.

4.2. Anticipated Deliverables

Architecture governance frameworks Documented change management processes to support IT decision making Organizational change management plans Acquisition document development Project charters and project plans Newsletters and enterprise-wide communications, FAQs, and white papers Analysis of Alternatives (AoA) Cost Benefit Analysis (CBA) Epics and user stories IT modernization and business roadmaps Customer journey maps

Key Personnel

The following subsections outline the experience and capabilities that are required for the roles that are essential to the proper performance of Contractor’s duties under this contract.

5.1. Program Manager

Substantial experience (typically 10+ years) performing the following activities:

Managing a portfolio of work across multiple work streams Leading end-to-end enterprise efforts within an organization

Section C - Description/Specifications/Work Statement PAGE 11 OF 87

Developing customer-facing project plans to document project scope, schedule, tasks, dependencies, and risk management

Experience with Agile Management tools such as TFS, GitHub, ServiceNow

Performing hands-on project work, including analysis, design, process engineering, and change management

5.2. Lead Enterprise Architect

Substantial experience (typically 10+ years) performing the following activities:

Creating line of site views and aligning technology with the enterprise mission

Developing enterprise architecture artifacts such as current and target state business process models, data models, sequence diagrams, etc.

Experience with ins-pi and its components, e.g., YouDesign, UPM-x, and Designer

Experience evaluating business needs against technology trends Developing strategies for aligning organizations with mission needs

5.3. Lead Solution Architect

Substantial experience (typically 10+ years) performing the following activities:

Experience with Event Driven Architecture, Service Oriented

Architecture, Containerization, Object Oriented Development, CI/CD Automation, Cloud Architecture, Platform as a Service, Technical Documentation

Developing enterprise architecture artifacts such as current and target state business process models, data models, sequence diagrams, etc.

Experience with ins-pi and its components, e.g., YouDesign, UPM-x, and Designer

Period and Place of Performance The period of performance of this contract shall not exceed 60 months, as shown in the table below.

Period Dates Base Period 1/1/2025 -12/31/2025 Option Period 1 1/1/2026 -12/31/2026 Option Period 2 1/1/2027 – 12/31/2027 Option Period 3 1/1/2028 – 12/31/2028 Option Period 4 1/1/2029 – 12/31/2029

Place of Performance

The Contractor shall determine places of performance for its team members; however, all places of performance shall be within the contiguous forty-eight US states. FDIC will not pay Contractor for travel in the event travel is required for onboarding activities such as fingerprinting, renewing PIV cards, etc.

Section C - Description/Specifications/Work Statement PAGE 12 OF 87

Contract Type

The Contract Line Item Numbers (CLINs) in this contract are Firm-Fixed-Price (FFP) based on Agile Team size. The CLINs are listed below:

CLIN 1 – Team 1: 6 FTEs (FFP) Optional CLINs (FFP) o The purpose of these optional CLINs is to complete work that may require additional teams beyond those ordered in CLIN 1

Agile Team Size

The work on CLIN 1, and potentially on future optional CLINs, will be accomplished through Agile teams. The number of teams, and the size of any team, is specified in Section 8 above. This contract includes multiple options to give the FDIC flexibility for varying the number of teams and the size of any team as time passes. The team size will be stated in terms of full-time contractor staff. For example, a team size of seven might be satisfied by seven full-time contractor staff, or five full-time contractor staff and four half-time contractor staff. At no point in time shall any contractor staff be dedicated less than half-time to this contract.

A key aspect of this contract is that the Contractor will provide fully staffed cross-functional team(s) to accomplish the needed work. The Contractor’s inability to provide fully staffed cross-functional teams to accomplish the needed work will be a failure on the Contractor’s part, as the velocity and quality of the work is dependent on fully staffed cross-functional teams.

All full-time Contractor staff who are assigned to an Agile Team for any period of time under this contract shall not be used by the Contractor for any other work during that period of time. In other words, full-time Contractor staff working on this contract are expected to work only on this contract.

Contractor Staff Bench It is expected that the Contractor will have reach-back to a bench of Contractor staff who can act as substitutes for team members who may become unavailable or be brought on in the event a team’s size needs to be increased. The Contractor bench staff shall have a breadth of skills and experience sufficient for them to effectively pick up the work of substituted colleagues. The Contractor shall coordinate with the FDIC Oversight Manager and designated ADS Project/Program Managers for each team to ensure that Contractor bench staff are able to step in for absent team members on a same-day or next-day basis. Bench staff shall:

have been cleared by FDIC’s Security and Emergency Preparedness Section (SEPS);

have an unexpired FDIC PIV card;

have an FDIC laptop that is current with mandatory security and other patches;

have been provisioned for FDIC network access and other common services, including relevant SharePoint repositories, GitHub, Microsoft Team Foundation Server (TFS), ServiceNow, and other necessary development tools; and have been granted access to the development, quality assurance, and other environments used by the team(s).

Section C - Description/Specifications/Work Statement PAGE 13 OF 87

Contractor Staff Absences Notification of planned or unplanned absences, along with identification of bench staff to be substituted in, shall be provided to both the FDIC Oversight Manager and the designated Technical Monitor on a timely basis or as requested by the Oversight Manager. Additionally, for each team, the Contractor shall ensure that over the course of each Agile sprint FDIC receives in total the number of full-time staff hours it is entitled to based on the team size and the number of workdays in the sprint. The FDIC may excuse non-recurring, short-term absences of Contractor personnel provided the team’s performance, velocity, quality, or other expectations are satisfied. Should there be any extended or recurring unexplained absences, the vendor shall invoice at a reduced rate commensurate with the team size performing during the time.

Team LCAT Composition As the work progresses or evolves, the Contractor shall adjust its team composition as appropriate to the new needs and with the approval of the FDIC Oversight Manager. These adjustments occur within the fixed-price and fixed-size of the team, and do not require contract modifications. For example, a four-member team of three solution architects and one business analyst might evolve to two solution architects, 1.5 business analysts, and 0.5 agile coach.

Re-Sizing Teams within a Performance Period The FDIC anticipates awarding the base period and subsequent option periods with its best projection regarding team sizes. However, within a particular performance period the FDIC may resize a team for a different size for the remainder of that period using the pricing table in the contract, provided the FDIC gives reasonable notice to the Contractor. Here, reasonable means at least two months advance notice if done unilaterally by the FDIC, or any time if done bilaterally.

Temporary Loan of Team Members Between Teams In the event FDIC chooses to prioritize work of a particular team during a given sprint and deprioritize work on another team, the Parties may agree to request the Contractor to temporarily detail Contractor staff from one team to another team without a change in contract price and without a change in the price of either team. For example, the Parties may agree that one team temporarily increase by one full-time Contractor staff while another team correspondingly decreases by one full-time Contractor staff. Here, temporarily means less than two months. Such an agreement may be memorialized by email exchange between the FDIC Oversight Manager and the Contractor lead.

Conflict of Interest The services included in this contract are of a type that creates the possibility of organizational conflicts of interest. For example, the contractor may help to prepare specifications or work statements that the FDIC may use in upcoming procurements. In such a case, the contractor may be ineligible for prime contract or subcontract award in that procurement.

Section C - Description/Specifications/Work Statement PAGE 14 OF 87

Section E - Inspection and Acceptance

No attachments were added for this section.

7.6.4-01 - Inspection and Acceptance - July 2008

(a) All goods and services shall be subject to inspection and test by the FDIC Oversight Manager, to the extent practicable, at all times and places during the term of the award. All inspections by the FDIC shall be made in such a manner as not to unduly delay the work.

(b) The FDIC shall have 15 business days from the date of Contractor''s delivery to determine if such goods and services are in compliance with the requirements of the contract. If any services performed or goods delivered hereunder are not in conformity with the requirements of this Award, the FDIC shall have the right to require

Contractor to reperform the services or redeliver the goods in conformity with the requirements of the Award, at no additional increase in total contract amount. When the services to be performed are of such a nature that the defect cannot be corrected by reperformance of the services, the FDIC shall have the right to (1) require Contractor immediately to take all necessary steps to ensure future performance of the services in conformity with the requirements of the contract; and (2) reduce the contract price to reflect the reduced value of the services performed. In the event Contractor fails promptly to reperform the services or redeliver the goods, or to take necessary steps to ensure future performance of the services or delivery of the goods in conformity with the requirements of the Award, the FDIC shall have the right to either (1) by contract or otherwise, have the services performed or the goods delivered in conformity with the contract requirements and charge to Contractor any cost occasioned to the FDIC that is directly related to the performance of such services or the delivery of such goods; or

(2) terminate this Award for default as provided in 7.6.6-02, Termination for Default.

(c) Contractor shall provide and maintain an inspection system acceptable to the FDIC covering the goods or services to be delivered or performed hereunder. Records of all inspection work by Contractor shall be kept complete and available to the FDIC during the term of this Award and for such longer period as may be specified elsewhere in this Award.

Section E - Inspection and Acceptance PAGE 15 OF 87

Section F - Deliveries or Performance

7.3.1-10 - Place of Delivery or Performance - November 2013 For the place of performance, the Contractor shall determine places of performance for its team members;

however, all places of performance shall be within the contiguous forty-eight US states. FDIC will not pay

Contractor for travel in the event travel is required for onboarding activities such as fingerprinting, renewing PIV cards, etc.

7.3.1-11 - Deliverables - July 2008 The Contractor must provide all deliverables described in the statement of work.

7.3.1-12 - Period of Performance - July 2023 The Initial Period of Performance begins on January 1, 2025 and expires on December 31, 2025. If all option periods are exercised, the final expiration date is December 31, 2029.

See clause 7.5.5-01, Option Period.

Section F - Deliveries or Performance PAGE 16 OF 87

Section G - Contract Administration Data

7.3.2-41 - FDIC Personnel - July 2008

(a) FDIC Oversight Manager. The Oversight Manager is the person designated in writing by the Contracting

Officer to represent the FDIC for the purpose of monitoring technical performance and accepting goods or services.

The Oversight Manager is not authorized to issue any instructions or directions which effect any substantive change in this contract, including, but not limited to, an increase or decrease in the price of this contract, or a change in the delivery date(s) or Period of Performance. Specific areas of delegated authority are more particularly defined in the

Oversight Manager Appointment Memorandum. The Oversight Manager is _________TBD_____________.

(b) FDIC Contracting Officer. The Contracting Officer is the person with FDIC-delegated authority to enter into, modify, administer, and terminate contracts and orders. The Contracting Officer is Brittany Helmkamp.

7.5.13-01 - Method of Payment - Electronic Fund Transfer (EFT) - March 2014

(a) Payment methods. Payments by the FDIC may be made by check or electronic funds transfer (EFT), or by a third party in lieu of payment directly from the FDIC, at the option of the FDIC. If the FDIC makes payment by EFT, the FDIC may, at its option, also forward the associated payment information by electronic transfer. Any third party payments will be made by the FDIC''s commercial purchase card issuer. In the event Contractor certifies in writing to the payment office that Contractor does not have an account with a financial institution or an authorized payment agent, the FDIC would make payments by other than EFT.

(b) Contractor Payment Requests. If the FDIC elects for third party payments to be made, Contractor shall make payment requests through a charge to the FDIC purchase card with the third party, at the time and for the amount due in accordance with the terms of this contract. Contractor and the third party shall agree that payments due under this contract shall be made upon submittal of payment requests to the third party in accordance with the terms and conditions of an agreement between Contractor, the Contractor''s financial agent (if any), and the third party and its agents (if any). No payment shall be due the Contractor until such agreement is made. Payments made or due by the third party are not subject to the Prompt Payment Act or any implementation thereof in this contract. Documentation of each charge against the FDIC''s purchase card shall be provided to the Contracting

Officer upon request.

Contractor is required, as a condition to any payment, to maintain current information in the System for Award

Management (SAM) database. Any invoice submitted with incorrect EFT information shall be deemed not to be a proper invoice as defined in the Prompt Payment Act clause herein.

Section G - Contract Administration Data PAGE 17 OF 87

7.5.13-12 - Schedule for Invoicing - July 2008 For Firm-Fixed-Price, Contractor must submit invoice within 10 days after the end of each month.

7.5.13-13 - Contents of Invoice - March 2014 Contractor's invoices must include the following items in order to be processed for payment:

(a) Contractor name, address and phone number.

(b) Invoice date. (Contractors must date invoices as close as possible to the date of electronic transmission to

FDIC.)

(c) Invoice number.

(d) Contract Number (e.g., Contract Number, Task Order Number, Delivery Order Number, etc.)

(e) Line Item Number(s), as identified in the contract, and the amount invoiced for each Line Item Number.

(f) Allocation of all hours and expenses to Financial Institution Number (FIN) and Asset Name/Number, if applicable.

(g) Description, quantity, unit of measure, unit price, extended price of goods delivered or services performed.

(h) Total invoice amount.

(i) Payment terms (discount for prompt payment terms).

(j) Remittance address.

(k) Billing Point of Contact (e.g., name (where practicable), title, phone number, and mailing address of person to notify if there are questions regarding the invoice).

(l) Shipping information (e.g., shipment number, date of shipment, bill of lading number and weight of shipment.

Shipping charges, if any, must be shown as a separate item on the invoice).

(m) For time and material or labor hour awards, copies of time sheets in support of direct labor charges.

(n) If travel expenses are reimbursable under the award, Contractor must submit travel documentation, receipts and other proof of expenses as required by the FDIC Contractor Travel Reimbursement Guidelines.

(o) If subcontractor expenses are reimbursable under a labor-hour or time-and-material award, Contractor must:

(1) identify subcontractor expenses and costs separate from prime contractor expenses and costs on the invoice it submits to FDIC;

(2) submit with its invoice, as supporting documentation, a copy of its subcontractor''s invoice when seeking reimbursement of subcontractor expenses.

(p) Pass through costs - If expenses or costs are reimbursable under the terms of the award, a description of each shall be provided in the invoice along with the quantity, unit amount, and total amount. Also, if amounts are derived from application of any formula, calculation, percentage, etc., such application must be clearly evident in the supporting documentation provided with the invoice.

(q) The following certification statement, signed by an authorized company representative:

"This is to certify that the services set forth herein [goods described herein] were performed [delivered] during the period stated.

Contractor''s Authorized Representative Date"

(r) Any other information or supporting documentation required by the award.

If an invoice does not contain the above required information; contains errors; or exceeds the total compensation ceiling limit for this award, the invoice will be returned to Contractor and processing of the invoice for payment will be delayed until the deficiency is corrected.

Section G - Contract Administration Data PAGE 18 OF 87

In addition, the FDIC requires Contractors to maintain current information in the System for Award Management

(SAM) database and complete the annual renewal process, in order to receive timely invoice payments. FDIC may reject any invoice received from Contractor where processing of the invoice cannot be completed because

Contractor has failed to maintain its registration, including electronic funds transfer (EFT) information, in the SAM database.

7.5.13-14 - Electronic Invoice Preparation and Submission (CORHQ Business Unit) -

November 2023 Contractor must follow the FDIC’s electronic invoice preparation and submission instructions stated below:

(a) Contractor must email electronic invoices to the FDIC’s Division of Finance/Accounts Payable (DOF/AP) at the following address: DOFAPInvoice@fdic.gov

(b) Contractor must only email their invoices to the above DOF/AP email address and not the Oversight Manager or

Contracting Officer. The FDIC will not accept hand-delivered invoices or invoices sent to any other address (i.e., FDIC street address or any other email addresses).

(c) Contractor must submit the electronic invoice as a single file document, in PDF or Excel (.xlsx) format. If the size of a single PDF/Excel file exceeds 30 MB, the invoice may either be submitted as two PDF/Excel files, with neither

PDF/Excel file exceeding 30 MB, or it may be submitted as a zip file that does not exceed 30 MB. If two PDF/Excel files are used, each email must clearly identify that the invoice has been separated into two PDF/Excel files to accommodate the size limitation. If a zip file is used, the individual files inside the zip file must be kept to a minimum and each must have a descriptive file name, such as "Invoice cover page", "Timesheets", etc.)

If submitting in Excel, the following applies:

(1) The Excel file must be formatted in a manner acceptable to the Contracting Officer. The first tab or worksheet

(“Sheet”) in the Excel workbook must be the invoice itself, and subsequent tabs may be used for supporting information and calculations;

(2) The entire workbook (all tabs) must be formatted for printing in portrait format using letter-size pages, unless the Contracting Officer allows for landscape format and/or legal-size pages for one or more specified tabs;

(3) The entire workbook must allow for searching, sorting, filtering, and other data viewing options by FDIC personnel. All formulas in cells must be visible to FDIC personnel;

(4) Any unit price or hourly rate must be an exact amount as rounded and displayed in the contract schedule or pricing attachment, and all calculations using the unit price or hourly rate must use that exact displayed amount.

The Contractor must not use a unit price or hourly rate on an invoice that differs from the amount displayed in the contract. For example, if a unit price or hourly rate is displayed as $135.15 in the contract, all calculations in the workbook must be based on $135.15 (with no decimals beyond the cent), and must not be based on a pre-rounded amount from elsewhere in the Contractor’s systems; and

(5) Any cell containing a calculation or formula using dollar amounts must be rounded to two decimal places (no decimals beyond the cent). This rounding guideline must be applied to both intermediate and final calculations.

(d) Contractor must not include more than one electronic invoice in the same email. (For example, if a Contractor has four task orders, a separate email with a single invoice must be submitted for each of the four task orders.)

Section G - Contract Administration Data PAGE 19 OF 87

(e) Contractor must name the PDF/Excel file or zip file in the following format (with invoice date shown as year/month/date followed by a space and the invoice number):

Invoice date and invoice number (e.g., 2023-01-31 1067876)

(f) Contractor’s email subject line must include the words, “Contractor Invoice”, followed by a hyphen and the

Contract Number (or Task Order Number, or Delivery Order Number, as applicable), as shown in the example below:

"Contractor Invoice – CORHQ-23-C-0000"

(g) Task Assignments: For contracts and task orders containing provisions for Task Assignments, a separate invoice must be submitted via a separate email for each Task Assignment.

(h) The counting of days for Prompt Payment begins on the date the invoice is received in the inbox of the DOF/AP email address, until 4PM. Invoices received after 4PM will be counted as being received the following FDIC workday.

Section G - Contract Administration Data PAGE 20 OF 87

Section H - Special Contract Requirements

Attachments for this section start after the clauses.

7.1.3-02 - Post-Government Employment Certification (Post-Award) - May 2009 Any former Federal Deposit Insurance Corporation (FDIC) or Resolution Trust Corporation (RTC) employee who the contractor intends to use in performance of work under the contract or its subcontracts must complete and submit the post-government employment certification found at FDIC website https://www.fdic.gov/buying/goods/acquisition/index.html. The certification must be submitted to the Contracting

Officer prior to the former employee commencing work under the contract. The FDIC Legal Division Ethics Unit will review the certification to determine compliance with the post-government employment restrictions. The former employee may be required to provide additional information as to their position and responsibilities while employed at FDIC or RTC and as a post-government employee working on the FDIC contract or subcontract.

7.3.2-43 - Key Personnel - January 2023

(a) The following key personnel are essential to the proper performance of Contractor's duties under this contract:

Name Title

_____________________________ Program Manager

_____________________________ Lead Enterprise Architect

_____________________________ Lead Solution Architect

(b) Contractor must make the above named key personnel available for performance under this contract as long as such persons are employed by Contractor or its related entities. All key personnel changes must be authorized in writing by the FDIC Contracting Officer prior to the new key personnel beginning work. Contractor must give a minimum of a 14-day advance written notice to the FDIC Contracting Officer of any proposed substitutions of key personnel. The notice must describe the reason for the proposed change and give the name of the proposed substitute individual with a description of their educational and professional background. A completed background investigation questionnaire is required for any key personnel that will work on-site and have unescorted access to

FDIC offices or facilities, have access to FDIC networks/systems, or have access to sensitive information. The determination of acceptability of proposed substitute personnel is in the sole discretion of the FDIC.

7.4.2-01 - Security and Privacy Compliance for IT Services - March 2021

(a) Security and Privacy Compliance. The Contractor is responsible for Information Technology (IT) security for

Contractor Personnel and subcontractor personnel granted access to: sensitive information as defined in FDIC

Circular 1360.9 (and referenced throughout this contract as ‘sensitive’ or ‘FDIC-sensitive information’); the FDIC network; systems connected to the FDIC network; and systems developed, maintained, implemented or operated

Section H - Special Contract Requirements PAGE 21 OF 87 by the Contractor for FDIC. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information shall comply with all FDIC information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from FDIC Information Security/Privacy staff.

(b) Laws and Standards. All IT products and services provided by the Contractor that collect, process, maintain, or store FDIC-sensitive information must comply with Federal laws and standards addressing information security and privacy. These include but are not limited to:

(1) The Privacy Act of 1974 (5 U.S.C. 552a) as amended (if incorporated in the contract);

(2) Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

(Transmittal Memorandum No. 4) including Appendices;

(3) E-Government Act of 2002 (P. L. 107-347) including Title II, Section 208 - Privacy Provisions and Title III -

Federal Information Security Modernization Act of 2014 (FISMA), and related OMB guidance; and

(4) National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and Special Publications.

(c) FDIC Policy and Guidance. All IT products developed by and IT development services provided by the

Contractor, specifically for FDIC, shall address information security and privacy requirements throughout their design, development, implementation, maintenance, operation, and termination as provided in FDIC system development life cycle policy and guidance. This includes completing or providing the necessary information for the

FDIC to complete privacy impact assessments, security assessments, risk assessments, security plans, contingency plans, and other security and privacy artifacts as required.

(d) Subcontracts. Contractor must must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

7.4.2-02 - Off-site Processing and Storing of FDIC Information - August 2018

(a) Control and Protection of FDIC Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all FDIC information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of FDIC information shall comply with all applicable federal and state laws and FDIC directives, rules and regulations regarding protection of information. The

Contractor shall not use any FDIC information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose FDIC information to any third party unless disclosure is authorized in the contract, the Contractor obtains the prior written consent of the Contracting Officer, or to the extent expressly required by applicable law, in which case the Contractor shall notify the Contracting Officer at least ten (10) business day before such disclosure, to allow the FDIC to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose FDIC information outside the United States, unless specifically directed by the contract or otherwise authorized by the

Contracting Officer.

(b) Return, Destruction and Retention of FDIC Information. All FDIC information remains the property of the FDIC.

Upon completion or termination of the contract, or at any time upon request of the Contracting Officer, Contractor shall promptly return to the Oversight Manager all FDIC information in its possession and/or securely dispose of it as required in the contract, Statement of Work, or as directed by the Oversight Manager. Information shall be returned securely in a format directed by the Oversight Manager. Retention of FDIC information by the Contractor

Section H - Special Contract Requirements PAGE 22 OF 87 beyond the conclusion of the contract is only permissible in accordance with clause 7.6.3-02, Contractor Return, Destruction and Retention of FDIC Information.

(c) Inspections/Assessments/Audits/Reviews/Examinations. To confirm Contractor’s compliance with this contract, as well as any applicable laws, regulations and industry standards, Contractor shall grant FDIC information security and privacy staff, the FDIC Office of the Inspector General, the U.S. Government Accountability Office (GAO), or an

FDIC-selected third party acting on the FDIC’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all FDIC information being handled and/or services being provided to FDIC pursuant to this contract. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores FDIC information pursuant to this contract.

These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the FDIC or the federal government’s audit and inspection rights delineated in other clauses of this contract or by statute.

(d) Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 and FDIC’s Breach Response Plan, and to assist in responding to a breach. FDIC’s Breach Response Plan is available at the FDIC website:

https://www.fdic.gov/buying/goods/acquisition/index.html. The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with FDIC’s Breach Response Plan. All security and privacy incidents that involve FDIC information must be immediately reported to FDIC’s Computer Security Incident Response Team (CSIRT)/Security

Operations Center (SOC) at the telephone/email address provided in paragraph (e) below. The Contractor and subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what FDIC information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

(e) The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of FDIC information and with whom the Contracting Officer, Oversight Manager, and other applicable FDIC staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the FDIC as needed in resolving an incident;

2. Notify the FDIC of an incident immediately after the Contractor becomes aware of it; and

3. Notify FDIC’s Computer Security Incident Response Team (CSIRT) via email at fdic-csirt@fdic.gov or telephone at 1-877-FDIC-999 (877-334-2999), as well as to the Oversight Manager (OM) of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the FDIC in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of

Section H - Special Contract Requirements PAGE 23 OF 87 complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

(f) Subcontracts. Contractor must ensure this clause is included in all first-tier subcontracts and lower-tier levels of subcontracts to which the conditions and requirements described in this clause would apply.

7.5.1-02 - Protecting Sensitive Information - February 2019

(a) Sensitive Information Defined. Per FDIC Circular 1360.9, sensitive information is any information, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of FDIC in carrying out its programs or the privacy to which individuals are entitled. It includes, but not exclusively, the following:

(1) Information that is exempt from disclosure under the Freedom of Information Act, such as trade secrets and commercial or financial information, information compiled for law enforcement purposes, personnel and medical files, and information contained in bank examination reports;

(2) Information under the control of FDIC…