20240523 eDiscovery RFP Attachment 1_Basic Ordering Agreement_Amendment 002.pdf

Ver 2024 05 23

ELECTRONIC DISCOVERY / LEGAL DIVISION

BASIC ORDERING AGREEMENT

(All Service Provider)

This Basic Ordering Agreement (“Agreement”) entered into as of _________, 2024, by and between the Federal Deposit Insurance Corporation (“FDIC”), an independent agency of the federal government, and __________________________________ [CONTRACTOR NAME] with offices at _________________________________________ [CONTRACTOR ADDRESS] (“Contractor”) and Tax ID Number ______________________.

WHEREAS, FDIC wishes to retain Contractor for the purpose of obtaining certain services, and Contractor is willing to undertake to provide such services upon the terms and conditions herein provided.

NOW, THEREFORE, in consideration of the foregoing and the mutual covenants herein contained the parties agree as follows:

1.0 DEFINITIONS

“Employee(s)” will mean all employees, agents, consultants, and subcontractors of Contractor who perform Services under this Agreement.

“Services” will mean the professional services and/or Deliverables as set forth in Attachment A, Statement of Objectives (SOO), and Attachment B, Pricing Workbook, as amended or modified.

2.0 TERM

This Agreement will be effective as of the date first above written (the “Effective Date”), and will have an ordering period (the “Term”) that terminates five (5) years from the effective date, unless terminated sooner, such as provided in Sections 8.0, 15.0, and 16.0.

3.0 SCOPE

3.1 During the Term, Contractor will provide Electronic Discovery (“E-Discovery”) legal support services, support, and materials. Such Services will be ordered by the FDIC as described in the Statement of Objectives. As the FDIC issues Task Orders for specific tasks/projects, the orders are deemed incorporated into the Agreement, and will be consecutively numbered as A-l, A-2, B-1, B-2, etc. (or similar). Execution of this Agreement itself does not guarantee that any Task Orders will be awarded, and FDIC reserves the right not to award Task Orders.

3.2 The Services will be provided by Contractor at such locations as FDIC requires from time to time. When providing Services, all Contractor Employees will be required to abide by those procedures, rules, and regulations specific to such location, as determined by the FDIC, and as made known to Contractor or its Employees.

4.0 FEES AND EXPENSES

4.1 FDIC will pay Contractor the fees determined in accordance with the “not-to-exceed” prices attached hereto as Attachment B (Pricing Workbook), as well as any pricing obtained in response to specific orders, which will not exceed the Attachment B prices, and which will become part of this Agreement and appended to the Task Order. At least annually, unless requested sooner by the FDIC, the Contractor will submit a revised Attachment B reflecting current Services pricing, which will become part of this Agreement. However, the revised pricing may not be adjusted above the original prices listed on Attachment B. In no event will FDIC be liable to pay any fees and expenses where invoices are not completed and submitted in accordance with this Agreement Section 4.0, Section 5.0, and Chapter 5 of the FDIC Legal Support Services Deskbook (the “Deskbook”), which is incorporated herein by reference as if fully set forth herein. (See Deskbook.) Any fees payable by FDIC will be exclusive of any sales, goods and services, excise, value-added or similar taxes of any kind, whether of federal, state, local or other jurisdictional level. FDIC will not be liable for, and the Contractor may not bill for, items or charges that are omitted from Attachment B to this Agreement. Services and labor categories that were not submitted on the original or revised Attachment B may be added, with written approval from the FDIC.

4.2 All FDIC payment obligations are expressly subject to submission of an itemized invoice and completion of weekly time sheets or other supporting documentation, which will be submitted with the invoice to the FDIC Oversight Attorney and/or assigned eDiscovery Group (“eDG”) Project Manager. All invoices and supporting documentation (if any) must be submitted by using the FDIC Legal Division’s electronic billing procedures in effect at the time of submission. Invoices must be submitted on a monthly basis. Invoices will be processed for payment by FDIC within thirty (30) days of receipt, provided that completed, approved time sheets or other supporting documentation is submitted with such invoices and provided that the invoice is not disputed.

4.3 FDIC will reimburse Contractor and its Employees for reasonable expenses incurred and paid for travel and lodging as provided in the Deskbook.

5.0 INVOICES AND PAYMENT

5.1 Contractor will certify each invoice issued for Services and will follow the procedures for invoicing set forth in the Deskbook. Invoices will be based solely on Services actually performed by Contractor, or will consist of reasonable expenses actually incurred and paid for travel and lodging as set forth in the Deskbook. FDIC reserves the right to audit all invoices, and Contractor will give FDIC reasonable access to all supporting documentation to enable FDIC to do so as set forth in the Deskbook.

5.2 Contractor will utilize the FDIC Legal Division’s current e-billing software, Wolters Kluwer’s Passport (or any successor thereto), when submitting invoices for payment.

https://www.fdic.gov/about/doing-business/legal-support-services-deskbook/index.html

5.3. The FDIC is required by statute to make payments by electronic funds transfer (“EFT”) (wire transfer) absent a waiver. The guidelines and required forms for EFT payments are set forth in the Deskbook. Contractor will comply with these guidelines.

6.0 REPORTS /DELIVERABLES

Contractor will submit such reports as may be required by FDIC, including but not limited to progress reports respecting any project involving Contractor or its Employees. Reports and deliverables will be specified in the Task Order, as applicable. Such documentation will also be subject to verification and audit. Contractor shall virtually participate in periodic meetings, at no additional cost, to provide updates on Task Order statuses, invoicing, or any other issue related to BOA and Task Order execution.

7.0 WARRANTIES, REPRESENTATIONS AND CERTIFICATIONS

7.1 Contractor represents and warrants that each Employee furnished by Contractor will be qualified to perform the Services. Contractor further warrants that the Services will conform to the requirements of this Agreement and be performed in a good, timely, professional, and highly skilled manner that adheres to standards not less than those generally accepted in the industry. Contractor will promptly correct, at its own expense, any failure of the Services to conform to the above warranties, even where such failures were unknown and unforeseeable.

7.2 Contractor is subject to the provisions of 12 Code of Federal Regulations Chapter III, Part 366. (See CFR.) Part 366 establishes the minimum standards of integrity and fitness that Contractors, subcontractors, and Employees of Contractors and subcontractors must meet if they perform any service or function on FDIC’s behalf. The representations and certifications identified in the Agreement must be completed by an official authorized to bind the Contractor, and must be returned with its Proposal. These representations and certifications concern matters within the jurisdiction of an agency of the United States, and the making of a false, fictitious, or fraudulent certification may render the Contractor and certifying official subject to prosecution under 18 United States Code §§ 1001, 1007, and 1014. (For purposes of these certifications, FDIC is considered an agency of the United States only with respect to its rights and remedies under Title 18 of the United States Code.) In addition, any misrepresentations or false, fictitious, or fraudulent certifications may render the Contractor and the certifying official subject to administrative remedies available to FDIC, which include suspension and/or exclusion from contracting, or termination of the Agreement (12 CFR 366.16;

12 CFR Part 367). The Contractor must provide notice to the Oversight Attorney and/or eDG Project Manager within 10 business days of discovery, or at any time prior to contract award, if the Contractor learns that one or more of its representations and certifications were erroneous when submitted or have become erroneous by reason of changed circumstances. The execution of this Agreement constitutes the making of the applicable representations and certifications.

The applicable representations and certifications are referenced in Subsection 18.4 and in Attachments E and F and are certifications with respect to the following subject matter:

Conflicts of Interest Default on a Material Obligation Pattern or Practice of Defalcation of Obligations http://www.fdic.gov/buying/legal/supportdeskbook/eftLSSD.html https://www.fdic.gov/regulations/laws/rules/2000-8800.html

Substantial Loss to Federal Deposit Insurance Fund Felony Convictions Independent Price Determinations Contingent Fee Representation Payments to Influence Certain Federal Transactions Equal Opportunity Registration in System for Award Management (SAM) Delinquent Federal Tax Liability Fair Inclusion of Minorities and Women

8.0 CONFIDENTIAL INFORMATION

8.1 “Confidential Information” will include all communications between Contractor and FDIC. Communication of confidential information may only be made with those Employees who have executed a confidentiality agreement as required in Subsection 8.2 of this Agreement.

Contractor will not disclose to any other person or entity, without the advance written permission of FDIC, the nature or content of any oral or written communication, any information gained from the inspection of any record or document, or any other information coming into Contractor’s possession as a result of this engagement. All electronically stored information, work papers, records, or other documents, including copies, regardless of their nature, format or the source from which they emanate, will be held by Contractor solely for FDIC’s convenience and subject to FDIC’s unqualified right to instruct Contractor with respect to possession and control of such materials. Confidential Information will include, but not be limited to: (i) technical drawings, (ii) designs and concepts; (iii) software programs, routines, formulae and concepts; (iv) production plans, designs, layouts and schedules; (v) marketing analyses, plans, customer data and surveys; (vi) all matters relating to FDIC's finances and FDIC employees;

(vii) information exempt from disclosure under the Freedom of Information Act, 5 U.S.C. § 552, as amended; (viii) information subject to the Privacy Act of 1974, 5 U.S.C. § 552(a); (ix) personally identifiable information (“PII”) maintained by FDIC that if released may result in financial or personal damage to the individual to whom such information relates; (x) all Deliverables; and (xi) all information subject to the attorney-client communication privilege and work product doctrine. “Confidential Information” includes “Sensitive Information,” as defined in clause 9.4 below.

8.2 Contractor covenants that Contractor and its Employees will:

(a) protect and maintain the confidentiality of such information in a manner to avoid intentional or inadvertent disclosure;

(b) execute on behalf of the Contractor entity, the Confidentiality Agreement appended hereto as Attachment C, and require its Employees working under this Agreement to execute the Confidentiality Agreement appended as Attachment D, and provide the fully executed agreements to the Oversight Attorney and/or eDG Project Manager;

(c) not disclose, or allow to be disclosed, the Confidential Information to any person other than to Employees who have a need-to-know basis in order to perform the Services and who have executed the Confidentiality Agreement;

(d) not use, or allow to be used, the Confidential Information for any purpose other than to perform the Services; and

(e) take all necessary precautions to restrict access to the Confidential Information.

8.3 Contractor acknowledges and agrees that monetary damages may not be adequate in the event of a default of this Section 8.0 by Contractor, and that FDIC will be entitled to seek injunctive or other affirmative relief or to terminate this Agreement, or both, without such constituting an election of remedies.

9.0 SECURITY OF INFORMATION TECHNOLOGY SYSTEMS AND FDIC

INFORMATION

9.1 Cyber-security and Information-security Requirements.

9.1.1 At all times for the duration of the BOA, all of the Contractor’s managed hosting and processing of FDIC electronically stored information must be either: (1) performed by a solution that has a Federal Risk and Authorization Management Program (FedRAMP) MODERATE authorization, or (2) or performed entirely within a FedRAMP MODERATE authorized environment.

9.1.2 See pages 20-21 of this BOA for all provisions and clauses applicable to this BOA.

The clauses incorporated by reference have the same force and effect as if the full text of each clause was set forth in the BOA. The full-text of each clause is available in the FDIC’s Acquisition Procedures and Guidance Manual (APGM), available at https://www.fdic.gov/formsdocuments/apgm.pdf Text of Clauses begins at page 7-4) For ease of reference, the cyber-security and information-security related clauses include:

7.4.2-01 Security and Privacy Compliance for IT Services (March 2021) 7.4.2-02 Off-site Processing and Storing of FDIC Information (August 2018) 7.4.2-05 Basic Safeguarding of Covered Contractor Information Systems (March 2021) 7.5.1-01 Privacy Act (July 2008)

7.5.1-02 Protecting Sensitive Information (February 2019) 7.5.1-03 Access to FDIC Information Systems (April 2015)

9.2 System Security Assessment and Authorization Requirements

9.2.1 Authority to Operate

The Contractor shall not input, store, process, output, and/or transmit FDIC data within a Contractor IT system without an Authority to Operate (ATO) signed by the FDIC Authorizing Official (AO) granted via the System Security Authorization (SSA) process. The FDIC process for obtaining and maintaining ATO, is in accordance with NIST SP 800-37 Risk Management Framework for Information Systems and Organizations. The Contractor shall adhere to current FDIC policies, procedures, and guidance for the SSA process as defined below.

https://www.fdic.gov/formsdocuments/apgm.pdf

Complete the Security Authorization Process. The SSA process shall proceed according to the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations or any successor publication including templates.

a. System Security Assessment and Authorization Process Documentation.

SSA documentation shall be developed by the Contractor using the FDIC provided security documentation templates. SSA documentation consists of the following: Security Categorization Worksheet, System Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

b. Independent Assessment.

Contractor shall have an independent third party perform an assessment of the FDIC-prescribed security and privacy controls as outlined in NIST SP 800-53 to determine the extent to which the selected controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting security and privacy requirements for the system and the FDIC. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track Plans of Action & Milestones (POA&Ms) to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

c. Support the Completion of the Privacy Compliance Documentation.

As part of the SSA process, the Contractor may be required to support the FDIC in the completion of a Privacy Threshold Analysis (PTA). The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a contractor IT system that will store, maintain and use personally identifying information (PII), as defined by the Privacy Act, 5 U.S.C. § 552a. Upon review of the PTA, the OCISO Privacy Section determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the FDIC in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the FDIC about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the FDIC’s privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at www.fdic.gov/privacy.

d. Authorization to Operate.

Upon completion of the SSA documentation and independent assessment, the Contractor shall submit a signed SSA package, validated by the independent third party, to the Oversight Manager for acceptance by the FDIC AO, or designee, at least thirty (30) days prior to the use of the system. The FDIC is the final authority on the compliance of the SSA package and may limit the number of resubmissions of a modified SSA package. Once the ATO has been granted by the FDIC AO the Contracting Officer shall incorporate the ATO letter into the contract as a compliance document. The FDIC’s issuance of the ATO does not alleviate the Contractor’s responsibility to ensure the controls are implemented and operating effectively.

The SSA package must include the following:

Deliverables (30 Days Prior to System Use) Security and privacy plans Security and privacy assessment reports Plans of Action & Milestones Supporting assessment evidence or other documentation, as required.

e. Continuous Monitoring/Ongoing Assessment.

After an initial authorization, the Contractor shall have the security and privacy controls assessed on an ongoing basis in accordance with NIST SP 800-37 and based on the FDIC Control Assessment Frequency. Ongoing assessment of the control effectiveness is part of the continuous monitoring activities of the FDIC. Adherence to the terms and conditions specified by the AO as part of the authorization decision are also monitored. Ongoing control assessment continues as the information generated as part of continuous monitoring is correlated, analyzed, and reported to the Oversight Manager for acceptance by the FDIC AO.

The system needs to undergo a Security Impact Assessment (SIA) whenever any changes/modifications are made to the system. Should the independent assessment find deficiencies, the Contractor must follow the direction of the FDIC to create and track POA&Ms to be included in the final authorization package. FDIC has the unilateral right to determine if the results and mitigation strategy are acceptable. In the case of unacceptable results or mitigation strategy, or if the Contractor does not remediate control weaknesses in a timely manner as established in POA&Ms, FDIC may treat the failure as an event of default.

Subcontracts. The Contractor will include the substance of cyber-security and information-security related clauses in any subcontracts under this BOA in which the subcontractor may have federal information residing in or transiting through its subcontractor information system. The Contractor also must require its subcontractors (first tier) to include of cyber-security and information-security related clauses in any of their subcontracts (second tier and below) to when these lower-tier subcontracts may have federal information residing in or transiting through its Subcontractor information system.

9.3. Background Investigations.

9.3.1 At the discretion of the FDIC, any Contractor Employees or subcontractor Employees with access to FDIC information under this Agreement will undergo a background investigation, in accordance with FDIC Circular 1610.2 (Personnel Security Policy and Procedures for FDIC Contractors) located here. The extent of the background investigation conducted will be in direct relation to the risk level assigned in 9.3.1.1 below.

https://www.fdic.gov/about/doing-business/acquisition/index.html

9.3.1.1 The risk level designations for functional areas under this Agreement are as follows:

• Employees with system administration responsibilities are designated as HIGH risk.

• All other functional categories are designated as MODERATE.

• Employees performing functional responsibilities designated as HIGH must be United

States Citizens. Employees performing functional responsibilities designated at the MODERATE or LOW risk levels must be either United States Citizens or Lawful Permanent Residents of the United States.

9.3.2 Where an FDIC identification/access badge is required to perform the work and prior to commencing work, Contractor Employees and subcontractor Employees are required to undergo both a fingerprint and a credit check. In addition, Contractor personnel and subcontractor personnel may be subject to a Defense Counterintelligence and Security Agency (DCSA) background investigation, based on the risk level assigned to the functional responsibilities or to the labor categories. No Contractor personnel or subcontractor personnel subject to the background investigation requirement, including any new personnel added at any time during the term of the Agreement, shall be permitted to begin work until the fingerprint and the credit check processes have been completed, FDIC has rendered a favorable determination, and the paperwork for any further DCSA background investigations has been submitted.

9.3.3 FDIC’s Enterprise Workforce Solution (eWORKS) is a tool that automates the background investigation process for new applicants and contractors. Unless another method of delivery is requested, the Contractor must provide the Oversight Attorney and/or eDG Project Manager with the following for all contractor personnel and subcontractor personnel subject to the background investigation requirement:

1) An executed Background Investigation Questionnaire for Contractor Personnel and Subcontractors (FDIC 1600/04)(Attachment H);

2) An executed Notice and Authorization Pertaining to Consumer Reports (FDIC 1600/10).

For reference, FDIC Forms 1600/04 and 1600/10 are available at the FDIC website:

https://www.fdic.gov/about/doing-business/acquisition/index.html 3. Fingerprints, which are required, must be completed at a GSA USAccess Shared Facility, which may include a FDIC Regional Office, FDIC’s Virginia Square location, or FDIC’s main office in Washington, DC. Additionally, fingerprinting may be completed at a third party FBI approved fingerprint channeler.

9.3.4 In addition, where the assigned risk level of the Agreement mandates background investigations by the DCSA, the Contractor must provide the Oversight Attorney and/or eDG Project Manager with the completed paperwork for contractor personnel and subcontractor personnel needed to initiate a DCSA background investigation. The Oversight Attorney and/or eDG Project Manager will notify the Contractor of the method by which to submit the paperwork

- either manually, using Standard Form 85P Questionnaire for Public Trust Positions, or via an electronic system.

9.3.5 Any Contractor Employees or subcontractor Employees whose background investigation reveals an adverse finding, may be excluded from working on the Agreement at the discretion of the Oversight Attorney and/or eDG Project Manager. Contractor is obligated to replace any Employees so excluded with Employees acceptable to FDIC. Replacement of Employees will be made at no additional cost to the FDIC and without relieving Contractor of performance and delivery requirements of the Agreement.

9.3.6 Contractor must comply with Homeland Security Presidential Directive-12 (HSPD-

12) and Federal Information Processing Standard Publication 201 (FIPS 201) entitled “Personal Identification Verification for Federal Employees and Contractors.” Contractor Employees and subcontractor Employees must present two forms of identification in original form prior to badge issuance; at least one document must be a valid State or federal government-issued picture ID. Acceptable forms of identification are listed in Form I-9, OMB No. 1615-0047, “Employment Eligibility Verification.” In addition, Contractor Employees and subcontractor Employees must appear in person at least once before an FDIC official who is responsible for checking the identification documents. FDIC will not issue identification/access badges to Contractor Employees and subcontractor personnel until proof-of-identity has been established.

9.3.7 Subcontracts. Contractor must include Section 9.0 (and subsection) requirements in all its subcontracts to which the conditions and requirements described would apply. Contractor also must require its subcontractors (first-tier) to include Section 9.0 (and subsection) requirements in any of their subcontracts (second-tier) to which the conditions and requirements would apply. The Contractor should seek FDIC clarification if/when uncertain as to flow down requirements.

9.4 Protecting Sensitive Information

(a) FDIC Circular 1360.09 defines Sensitive Information as any information, the loss, misuse, or unauthorized access to or modification of which could adversely impact the interests of FDIC in carrying out its programs or the privacy to which individuals are entitled. It includes, but not exclusively, the following:

(1) Information that is exempt from disclosure under the Freedom of Information

Act, such as trade secrets and commercial or financial information, information compiled for law enforcement purposes, Employment and medical files, and information contained in bank examination reports;

(2) Information under the control of FDIC contained in a Privacy Act system of record that is retrieved using an individual’s name or by other criteria that identifies an individual;

(3) Personally Identifiable Information (“PII”) about individuals maintained by

FDIC that if released for unauthorized use may result in financial or personal damage to the individual to whom such information relates. Sensitive PII, a subset of PII, may be comprised of a single item of information (e.g., Social Security Number or “SSN”) or a combination of two or more items (e.g., full name along with, financial, medical, criminal, or employment information). Sensitive PII presents the highest risk of being misused for identity theft or fraud;

(4) Information about insurance assessments, resolution and receivership activities, as well as enforcement, legal, and contracting activities; and

(5) Information related to information technology specific to the FDIC that could be misused by malicious entities (e.g., internal IP addresses, server names, firewall rules, encryption and authentication mechanisms, and network architecture pertaining to FDIC).

(b) Protecting Sensitive Information. Information furnished to the Contractor may contain Sensitive Information, and Contractor, all Contractor Employees, subcontractors and subcontractor Employees will protect all Information in accordance with the standards for Sensitive Information set forth in FDIC Circular 1360.09, unless otherwise authorized by the Oversight Attorney and/or eDG Project Manager. All Sensitive Information, whether in electronic or paper form, remains the property of FDIC.

(c) Confidentiality Agreement. As noted in Paragraphs 8.1 & 8.2 above, Contractor acknowledges that it will have access to Confidential Information, and that it will take the necessary steps to protect and maintain Confidential Information. Accordingly, an authorized representative of the Contractor, its subcontractors and consultants, and all Employees (key personnel and non-key personnel) who will have access to FDIC facilities, networks and/or information systems, or sensitive information (whether in hardcopy or electronic form) must execute confidentiality agreements. FDIC Form 3700/46, Confidentiality Agreement (for Contractors/Subcontractors/Consultants) and FDIC Form 3700/46A, Confidentiality Agreement (for Contractor/Subcontractor/Consultant Personnel) are included as Attachments C and D to this Agreement. The 3700/46 forms must be signed by the Contractor, and each subcontractor or consultant, and submitted at the time of award to the Oversight Attorney and/or eDG Project Manager with the signed Agreement. Post-award, these forms must also be executed for any new Employees employed to work on this Agreement. For BOAs, it is acceptable for the 3700/46 forms to be executed by the Contractor, subcontractors and consultants at the BOA level, thereby being applicable to all Task Orders issued thereunder. The 3700/46A forms executed by Employees must be submitted to FDIC no later than five (5) business days after starting performance and prior to receiving any sensitive information. The Contractor must submit the 3700/46A forms to the Oversight Attorney and/or eDG Project Manager. Key personnel and non-key personnel who are required to sign a confidentiality agreement, and do not sign, will not be permitted to perform work on any Task Orders issued under the Agreement.

(d) System or Data Breach and/or Loss of, or Loss of Access to, Data. Whether on system servers/network switches, in the cloud (hosted on the Contractor’s system or by another vendor or agent on the Contractor’s behalf), on tablets/laptops/desktops, and/or removable media of any kind, if the Contractor has an IT system or data breach, and/or loses agency data, or loses access to agency data, related to or arising out of a cybersecurity incident or ransomware attack, Contractor must immediately report the incident to the FDIC’s Computer Security Incident Response Team (“CSIRT”). Such an event constitutes a material default of the Agreement.

(e) Subcontracts. Contractor must include Section 9.4 in all its subcontracts to which the conditions and requirements described in Section 9.4 would apply. Contractor also must require its subcontractors (first-tier) to include Section 9.4 in any of their subcontracts (second-tier) to which the conditions and requirements of Section 9.4 would apply.

9.5 Prohibition on Use of Certain Hardware, Software, and Services

9.5.1 Kaspersky Lab and other covered entities:

(a) Definitions. As used in this clause— “Covered article” means any hardware, software, or service that–

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity.

“Covered entity” means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any covered article.

Contractor is prohibited from—

(1)Providing any covered article that the FDIC will use; and

(2) Using any covered article in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event Contractor identifies a covered article provided to the FDIC during contract performance, or Contractor is notified of such by a subcontractor at any tier or any other source, Contractor must report, in writing, to the FDIC Contact identified in Clause 16 below. For Basic Ordering Agreements (BOAs), Receivership BOAs (RBOAs) and Blanket Purchase Agreements (BPAs), Contractor also must report to the Contracting Officer for the BOA/RBOA/BPA, and the Contracting Officer(s) for any affected order.

(2) Contractor must report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, Contractor agrees to describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts to prevent future use or submission of covered articles.

(d) Subcontracts. Contractor must insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

9.5.2 Certain Telecommunications and Video Surveillance Services or Equipment

(a) Definitions. As used in this clause— “Backhaul” means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

“Covered foreign country” means The People's Republic of China.

“Covered telecommunications equipment or services” means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

“Critical technology” means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code;

or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

“Interconnection arrangements” means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

“Reasonable inquiry” means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

“Roaming” means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

“Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to FDIC any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FDIC Procedures, Guidance, and Information (PGI) 1.214(b)(iv).

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FDIC PGI 1.214(b)(iv). This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a FDIC contract.

(c) Exceptions. This clause does not prohibit contractors from providing—

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement:

(1) In the event Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor must report the information in paragraph (d)(2) of this clause to the FDIC Contact identified in Clause 16 below. For Basic Ordering Agreements (BOAs), Receivership BOAs (RBOAs) and Blanket Purchase Agreements (BPAs), Contractor also agrees to report to the Contracting Officer for the BOA/RBOA/BPA, and the Contracting Officer(s) for any affected order.

(2) Contractor must report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within one business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor must describe in writing the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. Contractor agrees to insert the substance of this clause, including this paragraph (e), and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

10.0 INDEPENDENT CONTRACTOR

10.1 Contractor and each of its Employees will perform the Services as an independent contractor, and nothing contained in this Agreement will be construed to create or imply a joint venture, partnership, principal-agent or employment relationship between the parties or between FDIC and the Employees. Contractor and its Employees will not take any action or permit any action to be taken on its behalf which purports to be done in the name of or on behalf of FDIC or its affiliates and will have no power or authority to bind FDIC or to assume or create any obligation or responsibility express or implied on FDIC's behalf or in its name, nor will Contractor or its Employees represent to any one that it has such power or authority.

10.2 Neither Contractor nor any of its Employees will be eligible or entitled to any benefits, perquisites or privileges given or extended to FDIC’s employees. No oral representations by employees of FDIC will have the effect of overriding any of the provisions of this Section 10.

10.3 At no cost to FDIC, Contractor will recruit, interview, test, select, hire and train its Employees assigned to perform work for FDIC. Contractor will make provision for the payment of its Employees assigned to provide the Services and will provide for the maintaining of all necessary payroll and personnel records, computation of wages, the withholding of applicable taxes, and any other payments required by law for such Employees. Contractor has sole responsibility with regard to the counseling, discipline, review, evaluation process, determination of payroll rates, and termination of employment of its Employees assigned pursuant to this Agreement; provided, however, that FDIC may release any Employee of Contractor from an assignment at any time and for any reason pursuant to Section 12.0 below.

11.0 INSURANCE

11.1 Insurance Coverage

(a) During the Term of this Agreement, Contractor will obtain and maintain the following insurance at its own expense:

(1) Workers’ Compensation in accordance with the statutory requirements of the jurisdiction in which the Employee is employed by Contractor. Contractor will at all times pay or cause to be paid any assessment or contribution required to be paid pursuant to Workers’ Compensation legislation;

(2) Comprehensive General Liability Insurance with limits of at least One Million Dollars ($1,000,000) per occurrence, inclusive for bodily injury or property damage; and

(3) Cybersecurity/Data Breach Insurance with limits of at least One Million Dollars ($1,000,000) per occurrence, including, but not limited to, coverage for any and all losses related to or arising out of the loss of, or loss of access to, data, whether personally identifiably information, sensitive data, or privileged attorney-client communications or work-product, further including, but not limited to, impacts to ongoing litigation and related damage or sanction claims of all types.

(b) If requested by FDIC, Contractor will present certificates which show that the above insurance is in effect, and which provide for thirty (30) days’ prior written notice to FDIC from the insurer of material changes, cancellation, and renewal.

(c) Comprehensive General Liability Insurance coverage maintained by Contractor during the Term will not act as a limitation of Contractor's liability hereunder.

11.2 Contractor will be liable for any Workers’ Compensation claims by its Employees in connection with any injuries occurring in the course of, or arising out of, the performance of the Services hereunder, whether or not such claims are made against Contractor.

12.0 QUALIFICATIONS OF CONTRACTOR EMPLOYEES

Citizenship requirements are contained in paragraph section 9.3.1.1. Additionally, FDIC has the right to review the qualifications of Contractor’s Employees who are assigned to perform Services. FDIC may request that the Contractor remove Employees from work or not assign Employees to work on the FDIC contract whose performance is considered unsatisfactory by FDIC. Where the Contractor removes an Employee from work on the FDIC Contract, the Contractor agrees to replace the Employee at no charge to FDIC and without interruption in service. Upon notice of removal of the Employee from work on the FDIC contract, FDIC will no longer be responsible to Contractor for payment for further services of that Employee. An Employee who is removed from work under the FDIC Contract will not be assigned by Contractor to another project under the BOA without the prior written consent of FDIC.

Contractor agrees and acknowledges that neither the reservation nor the exercise of the rights set forth in this Section 12.0 is intended to create an employer-employee relationship between Contractor's Employees and FDIC.

13.0 INDEMNITIES; LIMITATION OF LIABILITY

13.1 Contractor will indemnify and hold harmless FDIC and its employees, officers, directors, agents and other authorized representatives (the “FDIC Indemnitees”) from any and all threatened or actual claims, suits, proceedings, investigations and all losses, damages, liabilities and costs of any kind howsoever arising, including, but not limited to, legal fees (collectively, “Losses”) which are attributable to any act or omission of Contractor or its Employees hereunder or which are in any way connected to or arise out of this Agreement or the performance of the Services, including, but not limited to, any such Losses which arise from any injury or death to persons or loss of or injury to property, or inadvertent or malicious releases, or dissemination of confidential or personal data.

13.2 Contractor will indemnify and hold harmless each of the FDIC Indemnitees from any and all Losses associated with or arising out of any alleged or actual infringement of copyrights, patents, trademarks, trade secrets, mask works or other intellectual property rights of a third party, arising out of the manufacture or delivery of supplies, or the performance of services under this Agreement, or out of the use or disposal by or for the account of FDIC of such supplies or services.

13.3 Contractor agrees to indemnify and hold harmless each of the FDIC Indemnitees from any and all Losses which arise by reason of Contractor or its Employees being considered agents, representatives or employees of FDIC, including without limitation, liability for notice of termination or severance pay, statutory or otherwise or any other type of employment-related expenses as FDIC may be made to incur as a result of FDIC being deemed the employer of any Employee.

13.4 Contractor agrees to indemnify and hold harmless each of the FDIC Indemnitees from any and all Losses which arise by reason of any IT system or data breach or other ransomware attack, and/or a breach permitting access to, or loss or loss of access to, FDIC data, including all potential losses, claims or damages related to or in any way arising therefrom.

13.5 IN NO EVENT WILL FDIC BE LIABLE FOR ANY LOSS OF PROFITS,

BUSINESS INTERRUPTION OR ANY OTHER INDIRECT, CONSEQUENTIAL,

INCIDENTAL, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES OF ANY KIND

HOWSOEVER ARISING OR INCURRED BY CONTRACTOR, EVEN IF FDIC HAS BEEN

ADVISED OF THE POSSIBILITY OF SAME OR EVEN IF SAME WERE REASONABLY

FORESEEABLE.

14.0 TERMINATION

14.1 Upon written notice to Contractor, FDIC may terminate this Agreement or any portion hereof for its convenience, without obligation or liability of any nature except to pay Contractor for the portion of the Services satisfactorily performed prior to the effective date of termination. If requested in writing by FDIC, Contractor and its Employees will complete any tasks specified in the notice, and the terms and conditions of this Agreement will continue to govern such tasks. Otherwise, Contractor and its Employees will use its best efforts to conclude its activities and minimize any charges to FDIC prior to the effective date of termination.