CORHQ-24-R-0437-P0001.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF AWARD

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicble)

7. ADMINISTERED BY (If other than Item 6) CODE

FDIC 3700/56 (3-08)

FACILITY CODE

9A. AMENDMENT OF SOLICIATION NO.

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended, is not extended.

Offer must acknowledge receipt of this amendment by signing in Block 15b below and including the signed amendment with the offeror's proposal.

12. N/A

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO THE CHANGE ORDERS CLAUSE

B. THIS MODIFICATION IS ENTERED INTO PURSUANT TO THE AUTHORITY OF THE FDIC CONTRACTING OFFICER

C. THIS MODIFICATION IS ENTERED INTO PURSUANT TO MUTUAL AGREEMENT OF THE PARTIES

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remain unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

CORHQ-24-R-0437 / 0001

The purpose of this Amendment is to incorporate the Questions & Answers related to this solicitation. In addition, this Amendment also incorporates the following:

Revised Pricing Workbook Instructions

FDIC form f3700‐46

FDIC form f3700‐46A

2027 Target State Architecture v1.1 2023‐09‐01

Target State Architecture Slides dated July 26, 2024

FDIC is requiring Offerors to include the following at a minimum on the cover page of each proposal submission cover pages:

Legal company name as registered in SAM.gov

Address

Point of contact: name, phone number, and e‐mail address

Unique Entity ID (UEI)

Everything included in this amendment and in addition to the unchanged requirements of the original solicitation are in full force and effect.

Question Applicable

Document Page # Question Response

Is there an incumbent on this contract? If so, please provide the incumbent name, current contract number, Period of performance , value of the contract.

Yes, there are incumbents for portions of the work. However, the incumbents do not provide support for the full scope of

FDIC's requirement as outlined in CORHQ-24-R-0437. The incumbents are CITIZANT, INC. with Task Order No. CORHQ-

21-G-0340-0006 and IT HUB INC. with Contract No. CORHQ-

23-C-0360. The contract values and period of performances are not being shared.

2 SOO 10-11 of 87, para 4 What tools are being used to develop and publish EA artifacts, data, reports, dashboards, etc.?

FDIC is currently using the following tools:

Ins-Pi

ServiceNow

SharePoint

Adobe AEM

Custom web pages and applications

3 SOO 10-11 of 87, para 4

Is ADS interested in conducting training activities to improve the maturity of the EA program within FDIC? If so, what departments of ADS could training be delivered to?

Iterative training strategies that grow in scope over time to all key contributors to EA data is the recommended approach.

Though training to improve the maturity of the EA program is not an objective included in the SOO and, therefore, not a specific requirement for this solicitation, ADS is interested in training opportunities that improve the maturity of the EA program. The training would need to be provided within the fixed price Agile Team ordered by the FDIC.

4 SOO 10-11 of 87, para 4

How are Enterprise Architecture products being leveraged today for Program Management Support, especially in regards to driving reporting, quarterly/yearly planning meetings and presentations, and work execution

FDIC enterprise architecture products are currently supporting program management by:

- Providing architecture governance

- Managing roadmaps used for investment planning

- Reporting technical capabilities

- Delivering consistent analyses of alternatives

5 SOO 10-11 of 87, para 4

How are Enterprise Architecture products being leveraged today for Operational Support, especially in regards to driving reporting, quarterly/yearly planning meetings and presentations, and work execution

FDIC enterprise architecture products are currently supporting operations by reporting technical capabilities and maintaining application inventory, governance.

6 SOO 10-11 of 87, para 4

Is the contract written intending for the contractor to also provide EA application installation and maintenance support or licensing purchases and provisioning?

ADS does not anticipate requiring support for purchasing or provisioning licenses, but we may require support for developing and maintaining reference applications, and provide support for usage of EA tools.

7 SOO 10-11 of 87, para 4

What is the organizational structure of the current EA COE at ADS in FDIC? Does this group have any formalized operations such as an Architecture Review Board?

FDIC does not currently have a COE per se.

The hierarchy of the organization of which ADS is a part is:

Chief Information Officer Organization (CIOO)

Division of Information Technology (DIT)

Deputy CIO - Technology, Chief Technology Officer (DCIO-

T/CTO)

Enterprise Strategy Branch (ESB)

Architecture & Design Section (ADS)

ADS chairs the Security and Enterprise Architecture

Technical Advisory Board which is the current formal governance board.

Architecture & Design Support Services Solitication CORHQ‐24‐R‐0437 Questions & Answers

Can a US Veteran owned small business reply that has not worked with FDIC before?

Yes. However, this solicitation does not include specific small business set asides.

9 pg. 13, item 10

CONTRACTOR STAFF BENCH - Do you have some clearance requirements. While we are cleared company for the DoD we are not a cleared company for FDIC. Must we be one in order to be responsive on day 1 of the contract?

Please see 7.5.2-03 - Background Investigations (January

2023). The extent of the background investigations conducted will be in direct relation to the risk level assigned in clause 7.5.2-08, Risk Level Designation (Functional

Responsibility).

10 SOO N/A

Can the FDIC provide the name of the incumbent if one exists?

There are incumbents for portions of the work. However, the incumbents do not provide support for the full scope of

FDIC's requirement as outlined in CORHQ-24-R-0437. The incumbents are CITIZANT, INC. and IT HUB INC.

11 SOO 9

In the SOO, in section 3.1, one of business objectives is

"Assist in establishing and maintaining architecture practices, centers of excellence and governance structures".

1) Can the FDIC share high level details on the established

Centers of Excellence (COE) and Governance structures?

2) Can the FDIC share high level details on any known target COE and Governance structures that it desires to have established?

ADS does not currently have a COE per se. See the response to Question 7 regarding existing Governance structure. FDIC has no high-level details to share on desired COE or

Governance.

12 SOO 14

In the paragraph for item #15, the FDIC discloses that services included within this contract creates the possibility of organizational conflicts of interest (OCI).

Would the FDIC consider the submission and evaluation of an OCI mitigation plan during execution of the contract for vendors currently delivering services to the FDIC to alleviate the OCI?

Yes. Please include any OCI mitigation plan in Volume IV.

13 SOO 42

Clause 7.5.5-01 excludes the base year in the period of performance listed. Can the FDIC confirm that the period of performance starts in 2025?

Yes, the period of performance is anticipated to start

January 1, 2025 for the base period. See clause 7.3.1-12 -

Period of Performance - July 2023 which states "the Initial

Period of Performance begins on January 1, 2025 and expires on December 31, 2025. If all option periods are exercised, the final expiration date is December 31, 2029.

"See clause 7.5.5-01, Option Period.

Clause 7.5.5-01 only is used to reference the option periods/years.

14 SOO 73, 79

On page 73, in Clause 7.3.2-16 item (d), the FDIC indicates that a commercial past performance can be submitted.

However, on page 79 titled "Overview of Two-Phased

Approach", in the "Content" cell for the "II - Past

Performance" row, the FDIC only lists content tailored to

Federal past performance.

We ask that the FDIC consider eliminating the use of

CPE/CPARS or other Government systems for Commercial past performance and utilize the past performance questionnaire for Commercial contracts.

While CPE/CPARS and other Government systems may be queried (7.3.2-20), the FDIC would consider the PPQs and offeror narratives that would be submitted under 7.3.2-16.

15 Evaluation Criteria Will the FDIC consider classifying this solicitation as a small business set aside?

No.

Is this a new solicitation or a recompete? Who is the current incumbent performing these services today?

This is a new solicitation, however there are incumbents for portions of the work. The incumbents do not provide support for the full scope of FDIC's requirement as outlined in CORHQ-24-R-0437. The incumbents are CITIZANT, INC. and

IT HUB INC.

17 SOO 8

Section 2 - Scope - can the FDIC elaborate on the existing architecture environment in an addendum for context?

FDIC uses a number of implementation and hosting platforms both on cloud and on premises. We also use legacy platforms, e.g., the mainframe that is targeted for retirement. Please see the additional documents, "FDIC TSA

Slides" and "2027 Target State Architecture" included with

Amendment 001 of this solicitation.

18 SOO 8

Section 2 - Scope - does the FDIC have a tentative list of office departments identified to support the identified enterprise architecture elements?

The scope relates to ADS providing support for the entire

Corporation. A listing off all FDIC Divisions and Offices is available here: https://www.fdic.gov/contact/headquarters-directory/

19 SOO 9

Section 3.1. Business Objectives - does the FDIC leverage / utilize any special or unique architecture modelling templates that need to be used to fulfill and support the architecture and design activities and deliverables?

No, FDIC does not use special or unique architecture modelling templates. The contractor is expected and encouraged to suggest new templates, models, formats, etc.

that would enhance FDIC design activities and deliverables.

20 SOO 9

Section 3.2. Technical Objectives - what is the current application inventory platform in use today?

ServiceNow

21 SOO 9

Section 3.2 - Technical Objectives - what enterprise architecture tools are currently deployed today?

FDIC is currently using the following tools:

Ins-Pi

ServiceNow

SharePoint

Adobe AEM

Custom web pages and applications

22 SOO 9

Section 3.2 - Technical Objectives - does the FDIC anticipate replacing any of the existing enterprise architecture tools as part of this solicitation?

No.

23 SOO 10

Section 4.2. Anticipated Deliverables - "Newsletters and enterprise-wide communications, FAQs, and white papers " -can the FDIC confirm the contractor will be responsible for developing and maintaining said Newsletters and enterprise-wide communications, FAQs, and white papers?

Confirmed, as stated in the SOO, Deliverables will be submitted by the Contractor to the project managers/leads and FDIC Technical Monitor.

24 SOO 13

Section 10 Contractor Staff Bench - for any unforeseen bench staff team member swap out - what is the expected / required time for the FDIC to fulfill the following items:

* clear the bench staff swap by FDIC’s Security and

Emergency Preparedness Section (SEPS)

* obtain a FDIC PIV card

* issue an FDIC laptop that is current with mandatory security and other patches

* provision FDIC network access and other common services including relevant SharePoint repositories, GitHub, Microsoft Team Foundation, Server (TFS), ServiceNow, and other necessary development tools?

* grant access to the development, quality assurance, and other environments used by the team(s)?

While the length of time to clear and provision access for a contractor resource can vary, it typically takes 6-8 weeks to complete the activities listed.

25 SOO 27

Section 7.5.2-08 - Risk Level Designation (Functional

Responsibility) - November 2014 - does the FDIC anticipate any security clearance requirements as mandatory to fulfill and support this solicitation?

Please see 7.5.2-03 - Background Investigations (January

2023). The extent of the background investigations conducted will be in direct relation to the risk level assigned in clause 7.5.2-08, Risk Level Designation (Functional

Responsibility).

26 SOO 50

Section K - Representations, Certifications and Other

Statements of Offerors - can the FDIC confirm said

Representations, Certifications and Other Statements of Offerors is to be included in Phase II submission or before?

This should be included in the Phase II proposal submission.

The solicitation discusses the design of the FDIC environment. Are there any additional technical details about the buildout and/or sustainment?

No.

Is the quote only for the 6-person team outlined in the spreadsheet or should each of the teams be filled out separately?

Please see the instructions in the Pricing Workbook. Rows 4-

12: Offeror shall enter biweekly charges per Team Size (2-10

Full-Time Equivalents) across the contract Base and Option

Periods.

Rows 19-55: Offeror shall also enter anticipated roles per

Agile Team size. Not all roles must be full time, however, the total FTE count must sum to the requested Agile Team size.

Can we work with subcontractors and provide a rolled-up rate with all contractors and sub-contractors?

Yes. Offerors shall only provide a single charge for each Agile

Team Size for each period regardless of whether they plan to utilize subcontractors. Pricing will be evaluated in accordance with provision 7.3.2-22 Evaluation of Pricing.

Any proposed subcontractors must be included in Offeror's

Subcontracting Plan.

Checking our understanding --- The FFP is for the 6-person team working for the base period which is 1 year, correct?

Options are then for additional team-years?

The FDIC anticipates awarding the contract with an initial 6-

FTE FFP team. However, as stated in the SOO, this contract includes multiple options to give the FDIC flexibility for varying the number of teams and the size of any team as time passes. This could happen in the base period or option periods.

31 SOO 9

Can the Government provide the anticipated metrics that will be used to evaluate the Contractor's performance?

How will "performance, velocity, quality, or other expectations" be defined and measured?

The metrics will be developed over time with the Contractor.

32 SOO 11 - 12

All three Key Personnel (Program Manager, Lead Enterprise

Architect, and Lead Solution Architect) require "substantial experience (typically 10+ years)". Will the government count education, such as a Master's degree, as part of this experience requirement (i.e., Master's = 2 years of experience)?

No, education will not be used in lieu of experience.

33 SOO 13

Can the Government please clarify the expected size of the

Contractor's FDIC-cleared bench staff?

FDIC expects the Offeror to provide a solution that meets the requirements of the SOO. The Contractor's bench shall be able to act as substitutes for team members who may become unavailable or be brought on in the event a team’s size needs to be increased.

34 SOO 68

Certified financial statements, or acceptable equivalents, for the current and preceding two fiscal years are required.

Will it be acceptable to the Government if bidders provide links to their fiscal year 10k SEC filings as the equivalent of the Balance Sheet and Income Statement requirements?

No

35 SOO 69 - 70, 72 - 74

Phase 1 Factor A "Demonstrated Relevant Experience" requires summaries of three contracts performed within the last five years. Phase 2 Factor D "Past Performance" requires three recent contracts by the offeror and up to two recent contracts by each subcontractor/joint venture partner. Do all contracts provided need to be different (5 total) or can the three contracts provided within Factor A be expanded upon in Factor D?

They do not need to be the same.

36 SOO General

Can the Government confirm that it is acceptable to use 8 point font in tables and figures? Are there font type and size requirements for the written summary and orals slide deck?

The minimum font size is 10 pt.

37 Pricing Workbook 82

Will it be acceptable to the Government if bidders can modify the pricing workbook to include additional contextual information, such as justification for alternate labor mix either in a separate tab or on one of the provided tabs?

No. Offerors may include that information in the Pricing

Narrative.

38 Pricing Workbook 82

Within the instructions for the pricing workbook, a note is provided: "For the 2 FTE Team, Offerors may assume the

Program Manager key personnel role would not be needed." For this 2 FTE team, are the other two Key

Personnel (Lead Enterprise Architect and Lead Solution

Architect) required? Are all 3 Key Personnel required in the other teams (3 - 10 FTE teams)?

No, the three key personnel are only required for the 6 FTE

Team size. It is up to the offeror which roles to include on the other team sizes. As a result, that particular note has been removed from the revise Pricing Workbook instructions.

39 N/A N/A Is there an incumbent performing this work? If so, please provide the company name and contract number.

Yes, there are incumbents for portions of the work. However, the incumbents do not provide support for the full scope of

FDIC's requirement as outlined in CORHQ-24-R-0437. The incumbents are CITIZANT, INC. with Task Order No. CORHQ-

21-G-0340-0006 and IT HUB INC. with Contract No. CORHQ-

23-C-0360.

40 N/A N/A Would the government consider a small business set aside for this contract?

No.

41 8

What is the overall maturity for the Architecture Program today? How integrated is it within governance processes? Is the program seen to add value and utilized for decision support?

Subjectively, the Architecture Program is at a moderate maturity level, with room for improvement. It is integrated with some existing governance processes, and is seen to add value to the Corporation and its decision support.

42 9 What architecture tooling is currently in place?

FDIC is currently using the following tools:

Ins-Pi

ServiceNow

SharePoint

Adobe AEM

Custom web pages and applications

43 9 What architecture framework does the FDIC ADS use?

Our architecture framework is loosely based on The Open

Group Architecture Framework (TOGAF).

44 9 How many business applications are in the inventory to get a better understanding of the scope?

Approximately 350

45 9 Regarding maintaining IT/business roadmaps, how well defined is the current As-Is and To-Be states?

Our target state architecture is well-defined at a high level.

The as-is and to-be states are defined for some domains.

46 11 Are there currently Cost Benefit Analysis (CBA) and Analysis of Alternatives (AoA) templates in place today?

Yes.

47 Pricing Workbook

As the Pricing sheet is looking for various team size from 2 to 10, can agency please clarify how many parallel team is the agency anticipating.

The FDIC anticipates awarding the contract with an initial 6-

FTE FFP team. However, as stated in the SOO, this contract includes multiple options to give the FDIC flexibility for varying the number of teams and the size of any team as time passes. This could happen in the base period or option periods.

48 SOO 71

"In addition, Offerors shall provide a 2-page written summary of the major points they will make in the oral presentation for this factor. The 2-page written summary may be included in the resultant contract" Can the agency please clarify if the 2 page written summary for Volume I:

Factor B is to be submitted separately from the powerpoint slides

This should be submitted in Phase II Volume 1.

49 SOO 80

"Up to 3 most recent and relevant contracts available in

CPE/CPARS", Can agency please clarify if the offeror has to provide past performance details that would have CPARS available or as written on 73 & 74, offeror need to submit

PPQs.

Both

Can the offerer work with the CSP of it's own choice? For example we are an Amazon Web Services Supplier.

The offeror must follow the FDIC target architecture.

Currently, FDIC uses Azure.

51 SOO 4-6

Can team size exceed 10 (roles) as the current table suggests that the total FTEs does not exceed 10? Is FDIC open to expanding the team past 10 FTE versus deploying a new agile team?

No. 10 FTE teams are the maximum size.

52 SOO 8

Can the government confirm if there a current incumbent or is this a new requirement? If their is a current incumbent please provide the name of the incumbent and the total value of the current contract?

Yes, there are incumbents for portions of the work. However, the incumbents do not provide support for the full scope of

FDIC's requirement as outlined in CORHQ-24-R-0437. The incumbents are CITIZANT, INC. and IT HUB INC. FDIC is not releasing the contract values.

53 SOO 8

ADS states its mission in the introductory paragraph, "to prepare the FDIC for the future by developing and managing architectural targets and standards as well as informing IT investment decisions." What does the ADS see as it's greatest future threat in achieving its mission?

The existence of legacy infrastructure.

54 SOO 8

What does the ADS value most between cost, schedule, and quality/innovativeness of solution?

All three are critically important and of high value to ADS and FDIC.

55 SOO 8

What specific architecture governance models are currently in use at ADS?

ADS chairs the Security and Enterprise Architecture

Technical Advisory Board which is the current formal governance board.

56 SOO 8

Can the government elaborate on the existing architecture frameworks and methodologies?

Our architecture framework is loosely based on The Open

Group Architecture Framework (TOGAF).

57 SOO 9

Can the government provide details on the existing

Technical Reference Model (TRM)?

We manage our TRM using the ServiceNow TRM module.

58 SOO 9

Can FDIC please provide the details on the existing business solutions and application that are to be assessed?

FDIC has approximately 350 applications that span on-premises and cloud-based implementation platforms.

59 SOO 9

What primary data sources from the FDIC can be used for conducting business capability analysis?

Our business capability analyses are usually informed by interviews with subject matter experts in the specific business domain.

60 SOO 10

Is there any particular emerging technology FDIC wanted to prioritize?

No.

61 SOO 11

How many enterprise-wide business and technical projects are expected to be supported?

It varies from year to year, but 5-10 projects should be expected.

62 SOO 11

How frequently does the government anticipate needing to adjust team compositions or roles?

It is likely to vary.

63 SOO 11

Are there any key business processes and systems that FDIC has currently identified for improvement?

FDIC is focused on improving its mission essential and mission critical business processes, systems, and platforms.

64 SOO 12

Can the government please confirm that employees are eligible to work remotely from any of the 48 contiguous states?

The Contractor shall determine places of performance for its team members; however, all places of performance shall be within the contiguous forty-eight U.S. states (CONUS).

65 SOO 13

Can the government confirm if contractor staff bench members are allowed to work for other government agencies? If so, what is the expected time frame for bench staff to be activated if needed?

Yes. As stated in the SOO, The Contractor shall coordinate with the FDIC Oversight Manager and designated ADS

Project/Program Managers for each team to ensure that

Contractor bench staff are able to step in for absent team members on a same-day or next-day basis.

66 SOO 14

Can ADS provide specific guidelines or definitions for what constitutes non-recurring, short-term absences versus extended or recurring unexplained absences to ensure clarity in invoicing practices?

The decision to excuse non-recurring, short-term absences of Contractor personnel is at the discretion of the FDIC

Oversight Manager. In general, absences exceeding one sprint (2 weeks) would not be excused and a bench resource would need to be provided to maintain performance, velocity, and quality.

67 SOO 70

Can the government confirm that "public-private partnerships" refers to the government/end users partnering with a private offeror to develop a solution? If no, can the government please provide an explanation.

Confirmed.

68 SOO 79

Can the government confirm that offeror's may add assumptions to the pricing narrative?

Yes, any assumptions must be included in the pricing narrative.

69 SOO 79

Can the government confirm that the pricing narrative may be submitted in Microsoft Word or PDF?

Confirmed.

70 SOO 79

Can the government please provide an estimated date for notice of advisory downselect?

Approximately September 13, 2024. The Government reserves the right to provide this notice prior or after this approximate date.

Revised Instructions for Pricing Workbook

1. General Instructions

Do not modify the structure of this Excel file.

Offeror shall only enter data in the green-shaded cells. All other cells and tabs have calculated fields or contain data entered by FDIC.

3. "Agile Team Pricing" Tab

This tab requests charges for various Agile Team sizes that can be ordered under this contract.

Rows 4-12: Offeror shall enter biweekly charges per Team Size (2-10 Full-Time Equivalents) across the contract

Base and Option Periods.

Rows 19-55: Offeror shall also enter anticipated roles per Agile Team size. Not all roles must be full time, however, the total FTE count must sum to the requested Agile Team size.

Note: For the 6 FTE Team, the FDIC has pre-populated the roles based on anticipated need. However, the FDIC is open to the best solution possible and Offerors may change the role composition of the team as they

4. "Agile Team Pricing Model" Tab

Offeror input not required.

CLIN 1: Column E pulls the biweekly charge proposed by Offeror on the "Agile Team Pricing" tab for the Team size listed in Column D. The charges for the period are then calculated by multiplying Column C and Column E.

Optional Future CLIN: FDIC may procure future services using an Agile FFP Teams model under this contract.

Because the exact scope of these services is not currently defined, Offerors are not required to provide

5. "Pricing Summary" Tab

This tab displays the summary charges for each contract period.

The proposed CLIN 1 pricing along with the Optional Future CLIN pricing model will constitute the overall evaluated price (OEP). This computation will be for evaluation purposes only.

Page of FDIC 3700/46 (9-23) Email Forms@fdic.gov with any technical difficulties using this form.

Federal Deposit Insurance Corporation

CONFIDENTIALITY AGREEMENT

(FOR CONTRACTORS/SUBCONTRACTORS/CONSULTANTS)

This Confidentiality Agreement (“Agreement”) is executed by contractor/subcontractor/ consultant (hereinafter "Contractor"), in conjunction with Contract/BOA/RBOA/Task Order No.

(“The Contract”).

For due consideration given, Contractor agrees to the following:

1. Contractor will protect the confidentiality, integrity and availability of the sensitive information Contractor receives from or is given access to by the FDIC, or may obtain by other means, during the course of performing work on The Contract. “Sensitive Information” is defined in FDIC Directive 1360.9, Protecting Sensitive Information, available on the FDIC website: www.fdic.gov/ buying/goods/acquisition/index.html, and incorporated herein by reference as amended from time to time.

2. Contractor has read FDIC Directive 1360.9, Protecting Sensitive Information and will abide by the policy described therein and will follow the guidelines given for protecting sensitive information.

3. Contractor will promptly report to the appropriate FDIC official any loss, theft, misuse, misplacement, or unauthorized disclosure of sensitive information of which Contractor has knowledge whether or not Contractor is personally involved. Contractor understands that its anonymity will be maintained to the maximum extent possible when reporting these incidents.

4. Contractor will use sensitive information only as authorized by FDIC. Contractor will not disclose, release, disseminate or transfer any sensitive information to any other person or entity, except as required in the performance of Contractor's duties under The Contract or with the express prior written consent of an authorized representative of the FDIC. Contractor understands that FDIC may conduct inspections, at any time or place, for the purpose of ensuring compliance with the conditions for access, dissemination, handling and safeguarding information under this Agreement.

5. The provisions of this Agreement apply to all officers, directors, partners, and employees of Contractor. Contractor is responsible for the compliance of these parties with the terms hereof.

6. Contractor is responsible for ensuring that its subcontractors and consultants protect the confidentiality, integrity and availability of the sensitive information Contractor receives from or is given access to by the FDIC during the course of performing work on The Contract.

7. Contractor will ensure that its employees performing work under the contract execute the FDIC “Confidentiality Agreement (for Contractor/Subcontractor/Consultant Personnel).” Contractor will also ensure that its subcontractors and consultants execute a copy of the Agreement and that the personnel of its subcontractor(s) and consultant(s) execute the FDIC “Confidentiality Agreement (for Contractor/Subcontractor/Consultant Personnel).”

8. Contractor will immediately notify FDIC of any subpoena or court order requiring Contractor to disclose or produce sensitive information and will cooperate with legal counsel for FDIC in any challenge to or appeal from such a subpoena or court order.

9. Contractor will ensure that its employees return all FDIC sensitive information to the Contractor when the employee is no longer working on The Contract and will conduct appropriate exit clearance procedures when employees leave the employment of Contractor to ensure that all FDIC sensitive information remains with Contractor.

10. Contractor will return or destroy, as directed by authorized FDIC personnel, all sensitive information to which it has access or which is in its possession 1) upon demand by an authorized FDIC individual; and/or 2) upon the conclusion of its duties, association, or support to FDIC; and/or 3) upon the determination that its official duties do not require further access to such information.

11. Unless and until released in writing by an authorized representative of FDIC, Contractor understands that all conditions and obligations imposed upon Contractor by this Agreement apply during the time that Contractor is granted access, and at all times thereafter.

Page of FDIC 3700/46 (9-23) Email Forms@fdic.gov with any technical difficulties using this form.

12. This Agreement is made and intended for the benefit of the FDIC and may be enforced by the FDIC. By granting Contractor access to information in this context, FDIC may seek any remedy available to it to enforce this Agreement. If Contractor violates the terms and conditions of this Agreement, it could be subjected to administrative, civil, or criminal action, as appropriate, under the laws, regulations, or directives applicable to the category of information involved. The FDIC has not waived any statutory or common law evidentiary privileges or protections that it may assert in any administrative or court proceeding to protect any sensitive information to which Contractor has been given access under the terms of this Agreement.

13. This Agreement is made part of The Contract upon execution and is governed by Federal law and will be construed accordingly.

To the extent State law may apply, in the case where there is no applicable Federal law, the State law that applies is the law of the State in which the FDIC office executing The Contract is located.

14. The provisions in this Agreement are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or

(4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

15. I have read this Agreement carefully and my questions, if any, have been answered. I acknowledge that applicable policies referenced in this document have been made available to me so that I may read them at this time. I represent and warrant that I have authority to enter into this Agreement.

16. Contractor's representations in this form are true, complete, and correct to the best of Contractor's knowledge and belief and are made in good faith. Contractor understands that a knowing and willful false statement on the Agreement can be punished by fine or imprisonment or both (see 18 U.S.C. 1001).

AUTHORIZED REPRESENTATIVE SIGNATURE

Name of Contractor

Authorized Representative Name Authorized Representative Title

Authorized Representative Signature Date

Page 1 of 2FDIC 3700/46A (9-23) Email Forms@fdic.gov with any technical difficulties using this form.

Federal Deposit Insurance Corporation

CONFIDENTIALITY AGREEMENT

(FOR CONTRACTOR/SUBCONTRACTOR/CONSULTANT PERSONNEL)

This Confidentiality Agreement (“Agreement”) is executed by the undersigned Recipient of this Agreement, in conjunction with

Contract/BOA/RBOA/Task Order Number (“The Contract”).

For due consideration given, Recipient agrees to the following:

1. Recipient will protect the confidentiality, integrity and availability of the sensitive information Recipient receives from or is given access to by the FDIC, or may obtain by other means, during the course of performing work on The Contract. “Sensitive Information” is defined in FDIC Directive 1360.9, Protecting Sensitive Information, available on the FDIC website: www.fdic.gov/ buying/goods/acquisition/index.html and incorporated herein by reference as amended from time to time.

2. Recipient has read FDIC Directive 1360.9, Protecting Sensitive Information and will abide by the policy described therein and follow the guidelines given for protecting sensitive information.

3. Recipient will promptly report to the appropriate FDIC official any loss, theft, misuse, misplacement, or unauthorized disclosure of sensitive information of which recipient has knowledge whether or not recipient is personally involved. Recipient understands that its anonymity will be kept to the maximum extent possible when reporting these incidents.

4. Recipient will use sensitive information only as authorized by FDIC. Recipient will not disclose, release, disseminate or transfer any sensitive information to any other person or entity, except as required in the performance of Recipient's duties under The Contract or with the express prior written consent of an authorized representative of the FDIC. Recipient understands that FDIC may conduct inspections, at any time or place, for the purpose of ensuring compliance with the conditions for access, dissemination, handling and safeguarding information under this Agreement.

5. Recipient will immediately notify FDIC of any subpoena or court order requiring Recipient to disclose or produce sensitive information and will cooperate with legal counsel for FDIC in any challenge to or appeal from such a subpoena or court order.

6. Recipient will return or destroy, as directed by authorized FDIC personnel, all information to which it has access or which is in its possession 1) upon demand by an authorized FDIC individual; and/or 2) upon the conclusion of its duties, association, or support to FDIC; and/or 3) upon the determination that its official duties do not require further access to such information. Recipient agrees that under no circumstances will it remove FDIC sensitive information from the employer's custody and control when leaving the employment of the employer.

7. Unless and until released in writing by an authorized representative of FDIC, Recipient understands that all conditions and obligations imposed upon Recipient by this Agreement apply during the time that Recipient is granted access, and at all times thereafter.

8. This Agreement is made and intended for the benefit of the FDIC and may be enforced by the FDIC. By granting Recipient access to information in this context, FDIC may seek any remedy available to it to enforce this Agreement. If Recipient violates the terms and conditions of this Agreement, it could be subjected to administrative, civil, or criminal action, as appropriate, under the laws, regulations, or directives applicable to the category of information involved. The FDIC has not waived any statutory or common law evidentiary privileges or protections that it may assert in any administrative or court proceeding to protect any sensitive information to which Recipient has been given access under the terms of this Agreement.

9. This Agreement is made part of The Contract upon execution and is governed by Federal law and will be construed accordingly.

To the extent State law may apply, in the case where there is no applicable Federal law, the State law that applies is the law of the State in which the FDIC office executing The Contract is located.

Page 2 of 2FDIC 3700/46A (9-23) Email Forms@fdic.gov with any technical difficulties using this form.

10. The provisions in this Agreement are consistent with and do not supersede, conflict with or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or

(4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

11. I have read this Agreement carefully and my questions, if any, have been answered. I acknowledge that the applicable policies referenced in this document have been made available to me so that I may read them at this time. I represent and warrant that I have authority to enter into this Agreement.

12. Recipient's representations in this form are true, complete, and correct to the best of Recipient's knowledge and belief and are made in good faith. Recipient understands that a knowing and willful false statement on this Agreement can be punished by fine or imprisonment or both (see 18 U.S.C. 1001).

RECIPIENT (EMPLOYEE) SIGNATURE

Recipient (Employee) Name Recipient (Employee) Title

Recipient (Employee) Signature Date

Chief Information Officer Organization (CIOO) Roadmap

(Version 1.3)

Last Updated: July 26, 2024

Align FDIC IT initiatives to strategic priorities

Promote a shared understanding of the drivers behind IT modernization plans and priorities

Based on contributions and active participation from organizations across CIOO

Compiled by the Architecture & Design Section

Purpose

CIOO Vision & Objectives

Vision: We value each other, have a healthy culture, and are the most respected and trusted information and technology organization within the Federal Government. We achieve this in collaboration with our partners to provide secure, reliable, and resilient capabilities that deliver business value.

Strategic Objectives * Objective Intended Results

Improve Customer Satisfaction Customer needs and expectations are consistently met.

Strengthen Partnerships Engaged and trusted partner amongst staff and customers in meeting the divisional mission objectives.

Improve Budget & Strategy Alignment We continuously refine and execute on a clear, comprehensive, multi-year plan.

Improve the Delivery of Services Secure and high-quality services are provided in a timely and efficient manner.

Improve Governance Established and communicated governance processes support orderly, repeatable, justifiable, and defensible processes across CIOO.

Enhance Culture A set of shared values, attitudes, competencies, and practices are established, adopted, and followed.

Improve Knowledge, Skills & Abilities Resources effectively support a modern, secure, cost-effective, and flexible IT environment.

Improve the Use of Technology Tangible progress is made against IT modernization goals.

*as specified in the CIOO Strategic Plan 2020-2024

IT Modernization Drivers

IT Modernization Roadmap | A comprehensive and strategic approach to planning and executing IT modernization across the Corporation informed by business and technical drivers.

B U

S

IN

E S

S D

R

IV

E R

S

Resilient & Cost Effective

Corporate Resource

Supervision Crisis Modernization Preparedness

Streamlined Stakeholder Interactions

Data as a Corporate Resource

Digital Workforce

T E

C H

N

IC

A L

D R

IV

E

R S

Modernize Aging Technology

Streamline Service Delivery

Maximize Quality and Performance

Strengthen Security and Privacy

Realize Operational Efficiencies

Current Challenges & Future Opportunities

Customer Experience

IT Operations

Modernization

• End-user capabilities do not adequately support a modern and hybrid FDIC workforce

• Delivering demands for IT services is not timely and sometimes misses customer expectations

• Siloed and disconnected data limits staff from performing data analytics

• Bankers and the public often need to go through multiple steps to access FDIC services

• Highly intuitive end-user services for a hybrid, diverse, and digitally-empowered workforce to deliver the mission

• IT solution/service delivery with speed and superior quality

• Connected, timely, reliable, and trusted data available for making informed business decisions

• Streamlined customer experience for bankers and the public

• Simplified, resilient, and amenable IT portfolio for secure and reliable operations

• Proactively addressed cybersecurity risks

• Integrated change management

• Complex IT portfolio with 300+ applications and a wide spectrum of technologies with many approaching end of life

• Reactive cybersecurity operations with long response times and expensive recovery

• Change management is distributed and expensive

• Delivering new and modernized services are time consuming and labor-intensive

• Limited support for innovation

• Delivery of new and modernized IT solutions in a cost-effective, timely, and less burdensome manner

• An ecosystem where innovation is encouraged and fostered

Current Challenges Future Opportunities

Transformation Strategy

To meet the demands of an evolving regulatory environment, the FDIC envisions operationalizing an Adaptive IT Architecture. An Adaptive IT

Architecture lends itself to continuously refining the underlying structure, behavior, and resources according to changing needs.

Key Enablers Adaptive IT Architecture

6. Resilience. Strengthen the ability of IT services to be flexible and quickly rebound from disruptions through intelligent automation and cloud-smart technologies.

5. Proactive Cybersecurity Operations.

Proactively reduce the risk of successful cyber-attacks against the FDIC digital infrastructure.

4. Digital Empowerment & Experience. Provide highly-intuitive end-user services and a streamlined customer experience to a hybrid, distributed, diverse, and tech-savvy workforce and financial industry customers.

1. Speed & Scale. Deliver new and modernized capabilities faster, with high quality, and capacity.

2. Enterprise Data Management & Analytics. Enable discovery and access to data assets, leading to data analytic capabilities that support data-driven decision-making across the Corporation.

3. Innovation. Foster a technology innovation ecosystem for staff to incubate, pilot, and scale new ideas.

Speed & Scale

Enterprise Data Management &

Analytics

Innovation

Digital Empowerment

& Experience

Resilience

Proactive Cybersecurity

Operations

Transformation Blueprint

Enabler Approaches

Im p ro ve

C u st o m e r

S a ti sf ac ti o n

S tr en gt h en

P a rt n e rs h ip s

Im p ro ve

B u d g et

S tr at e gy

A lig n m en t

Im p ro ve

S er vi ce

D el iv er y

Im p

G o ve rn an ce

E n h an ce C u lt u re

Im p

K n o w le d g e, S ki ll s

A b ili ti es

Im p ro ve t h e U se o f T ec h n o lo gy

Speed & Scale

• Implement a continuous-delivery (CI/CD) framework to modernize IT services with design-thinking, a human-centered approach, agile practices, and flexible procurement processes

• Strengthen customer-centric partnerships and feedback loops

• Simplify IT architecture/platforms with increased use of commodity/off-the-shelf solutions

Enterprise Data Management &

Analytics

• Enable trusted data with enterprise data management practices, data maturity, and continuous enrichment of enterprise data resources

• Promote data literacy to strengthen a data-driven culture across the corporation

• Advance data management and data analytics capabilities with secure access to documented, trusted, and relevant data aligned to business objectives

• Enhance predictive, prescriptive, and self-service analytics capabilities to address changing business demands

Innovation

• Implement an ecosystem with supporting processes, technologies, and governance for staff to ideate, incubate, prototype, and accelerate implementation of new ideas

• Operationalize a maturity framework to scale innovations

Digital Empowerment & Experience

• Promote human-centered digital employee and customer experience

• Increase self-service capabilities and ability to locate information with minimal dependence on IT personnel

• Enable hybrid work-life technologies

Proactive Cybersecurity

Operations

• Adopt risk-based security controls and explicit/zero trust for access to IT resources

• Implement continuous monitoring, evaluation, and enforcement of security policies

• - practices that scale with the infrastructure

• Enhance threat intelligence through increased visibility/observability into the infrastructure and supply chain

Resilience

• Strengthen IT infrastructure resilience with expanded use of multi-cloud architecture

• Maximize the use of SaaS/PaaS/Shared Services and leverage IaaS cloud-native solutions

• Augment IT services with intelligence

• Streamline governance through integrated change management

CIOO Strategic Objectives (2020-2024)

Enabler to CIOO Roadmap Mapping

Enabler IT/Cyber Security

Secure Connectivity

Solution Delivery

Platforms

Data Management

Enterprise Applications

FDITech

IT

Management Hosting Collaboration End User

Speed & Scale

Enterprise Data Management &

Analytics

Innovation

Digital Empowerment & Experience

Proactive Cybersecurity

Operations

Resilience

CIOO Roadmap Areas

Target State

Executive Summary To meet the demands of an ever-evolving regulatory environment, the FDIC envisions operationalizing an Adaptive IT Architecture over the next 5+ years. An Adaptive IT Architecture lends itself to continuously refine the structure, behavior, and resources enabling a composable enterprise that can be reconfigured by the business to meet changing needs. This architecture strengthens the resilience of the IT infrastructure through intelligent automation and cloud-smart technologies, proactively reduces the risk of successful cyber-attacks against the FDIC digital infrastructure, increases staff access to the corporate data to promote Evidence-Based Decisions, digitally empowers the hybrid workforce and tech-savvy customers, stimulates a technology innovation ecosystem, and delivers new/modernized capabilities with speed and scale.

The diagram at the right illustrates the desired outcomes and capabilities of an Adaptive IT Architecture.

Resilience Speed

Scale

Enterprise

Data

Management

& Analytics

Innovation

Proactive

Cybersecurity

Operations

Digital

Empowerment

& Experience

Bottom Line Up Front:

The target state works to align the technologies and systems of the FDIC with the FDIC Strategic Plan whose goals are repeated below:

FDIC Major Program Goals Program Areas Strategic Goals

Insurance FDIC-insured deposits are protected from loss without recourse to taxpayer funding.

Supervision

FDIC-insured institutions are safe and sound.

FDIC-supervised institutions comply with federal consumer protection laws, including fair lending laws, and the Community Reinvestment Act (CRA).

Large, complex financial institutions are resolvable in an orderly manner.

Receivership Management Resolutions are orderly and receiverships are managed effectively.

Moving Towards an Adaptive Enterprise The 2027 FDIC Target State outlines the next phase of the FDIC’s information technology (IT) modernization efforts.

It facilitates efforts to meet the FDIC’s business needs faster, with built in security, integration, resiliency, observability, analytics, and privacy. The 2027 target expands on the 2025 target state to drive a more adaptable/composable enterprise.

An adaptive enterprise harnesses the value generated by the ever closer relationship between…