FRTIB1-25-Q-0018-RFQ (combined)-Financial Data Subscrp_6.16.25.pdf

FRTIB1-25-Q-0018

Financial Data Subscription Service

Combined Synopsis/Solicitation

Federal Retirement Investment Thrift Board (FRTIB)

FRTIB-25-Q-0018

Financial Data Subscription Service

1. Date: June 16, 2025

2. Year: 2025

3. Contracting Office ZIP Code: 20002

4. Product or Service Code: DA10, IT and Telecom - Business Application/Application Development Software as A Service

5. Contracting Office Address: FRTIB, 77 K Street NE, Suite 1000, Washington, DC

6. Subject: Financial Data Subscription Service

7. Solicitation Number: FRTIB1-25-Q-0018

8. Closing Response Date: July 11, 2025; 12 noon ET

9. Contact Point: Reference Solicitation below (Request for Quote)

10. Line Item Numbers: Reference Attachment B, Pricing Schedule

11. Place of Contract Performance: Reference Solicitation document (Request for Quote)

12. Description:

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested.

This combined/synopsis solicitation contains the following documents that are attached to this Notice:

i. Solicitation Document (Request For Quote)

ii. Attachment A- Performance Work Statement

iii. Attachment B- Pricing Schedule

REQUEST FOR QUOTE (RFQ)

RFQ Number: FRTIB1-25-Q-0018

The Federal Retirement Investment Board (FRTIB) is an independent Federal government agency in the Executive Branch created by the Federal Employees’ Retirement System Act of

1986 (FERSA).

FRTIB procurements will largely adhere to the FAR, unless doing so might infringe upon the Agency’s fiduciary obligations under Federal Employees’ Retirement System Act (FERSA).

FRTIB has adopted the FAR as its primary contracting policy and procedures for procuring its goods and services.

Points of Contact: Lashondria.Barber@frtib.gov, Joseph.Russo@frtib.gov, Sheri.Brooks@frtib.gov

RFQ Issue Date: June 16, 2025; 4:00 p.m. ET

Quote Due Date: July 11, 2025; 12 noon, ET- submitted via email to Points of contact.

Questions Due: June 24, 2025, 12 noon, ET.

The subject combined synopsis/solicitation is being issued by the FRTIB agency using the procedures in FAR Part 12, Acquisition of Commercial Services and Part 13, Simplified Acquisition Procedures. The offeror shall comply with the solicitation submission requirements outlined in this Request for Quote (RFQ).

As a result of this solicitation, FRTIB contemplates award of a Firm-Fixed Priced contract.

RFQ Table of Contents

A. Notice to Prospective Offerors B. Pricing Schedule - Attachment B C. Contract Clauses D. Performance Work Statement - Attachment A E. Solicitation Provisions

Instructions to Offeror’s Evaluation Factors/Basis For Award Offeror Representations and Certifications

A. NOTICE TO PROSPECTIVE OFFERORS

mailto:Lashondria.Barber@frtib.gov mailto:Joseph.Russo@frtib.gov mailto:Sheri.Brooks@frtib.gov

B. Pricing Schedule (Attachment B)

The contractor shall provide non-personal services IAW the Performance Work Statement- Attachment A.

Reference and complete the attached Pricing Schedule, Attachment B.

Period of Performance

Base Period Nov 1, 2025- Oct 31, 2026 Option Period 1 Nov 1, 2026- Oct 31, 2027 Option Period 2 Nov 1, 2027- Oct 31, 2028 Option Period 3 Nov 1, 2028- Oct 31, 2029 Option Period 4 Nov 1, 2029- Oct 31, 2030

Inspection and Acceptance

Destination Inspection/Acceptance by the Government.

Contracting Officer Representative (COR):

The Contracting Officer will designate a COR, who is responsible for administering the performance of work under this contract by:

• Monitoring the Contractor’s progress

• Assessing performance

• Recommending to the CO changes in requirements

• Interpreting the scope of work

• Performing inspections and acceptances of data items required by this order, and

• Assisting the Contractor in the resolution of technical problems encountered during the performance of the contract.

A COR appointment will be designated at the time of award.

FAR 52.252-2-Clauses Incorporated by Reference. (Feb 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/ and https://www.frtib.gov/pdf/procurement/Thrift_Federal_Acquisition_Supplement_T- FAS.pdf (End of Clause)

C. Contract Clauses http://www.acquisition.gov/ http://www.frtib.gov/pdf/procurement/Thrift_Federal_Acquisition_Supplement_T-

FAR 52.212-4 - Contract Terms and Conditions, Commercial Products and Services (Nov 2023) – SF 1449, Block 27a.

Addendum to FAR 52.212-4.

FAR 52.217-8 Option To Extend Services. (Nov 1999). The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days. (End of clause)

FAR 52.217-9 Option To Extend the Term of the Contract (Mar 2000). The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

If the Government exercises this option, the extended contract shall be considered to include this option clause.

The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years (5 yrs 6 mths) (End of clause)

FAR 52.237-3 Continuity of Services. (JAN 1991)

FAR 52.212-5-Contract Terms and Conditions Required to Implement Statues or Executive Orders-Commercial Products and Commercial Services (JAN 2025) (DEVIATION FEB 2025) FAR 52.212-5 Clauses incorporated by reference:

52.203-6 Restrictions on Subcontractor Sales to the Government. (Jun 2020) 52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform

Employees of Whistleblower Rights. (Nov 2023) 52.204-14 Service Contract Reporting Requirements. (Oct 2016) 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities. (Nov 2021) 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance

Services or Equipment. (Nov 2021) 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment. (Nov 2021) 52.204-26 Covered Telecommunications Equipment or Services-Representation. (Oct

2020) 52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023) 52.209-6 Protecting the Government-Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Jan 2025)

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters.

(Oct 2018)

52.222-3 Convict Labor. (Jun 2003) 52.222-19 Child Labor-Cooperation with Authorities and Remedies. (Jan 2025) 52.222-36 Equal Opportunity for Workers with Disabilities (JUN 2020) 52.222-40 Notification of Employee Rights Under the National Labor Relations Act (DEC

2010) 52.222-50 Combating Trafficking in Persons (NOV 2021)

52.224-3 Privacy Training (Jan 2017) 52.225-13 Restrictions on Certain Foreign Purchases (Feb 2021) 52.222-35 Equal Opportunity for Veterans (JUN 2020)

52.222-37 Employment Reports on Veterans (JUN 2020) 52.222-54 Employment Eligibility Verification (Jan 2025)

Local Agency Clauses (H)

H.1 Safeguarding Controlled Unclassified Information (CUI) (July 2020) Clause:

(a) Definitions. As used in this clause— “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information.

“Controlled Unclassified Information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government- wide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material http://www.archives.gov/cui/registry/category-list.html that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Technical information” means technical data or computer software, as those terms are defined in these clauses--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of and Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the Cloud Computing Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)

(A) The Contractor shall notify the FRTIB Chief Information Security Officer (CISO), via email, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the FRTIB Chief Technology Officer (CTO) or CISO.

The Contractor need not implement any security requirement adjudicated by an authorized representative of the FRTIB CTO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the time of the execution of this contract the

Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Reporting, including malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(d) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(e) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S.

Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause. (End of Clause) http://www.fedramp.gov/resources/documents/)

H.2 Compliance with Controls for Safeguarding Controlled Unclassified Information (CUI) (July 2020) Clause:

(a) Definitions. As used in this provision— “Controlled Unclassified Information (CUI),” “covered contractor information system,” “cyber incident,” “information system,” and “technical information” are defined in clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6, Cyber Incident Reporting.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled Unclassified Information (CUI) and Cyber Incident Reporting, shall be implemented for all Controlled Unclassified Information (CUI) on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see (b)(2) of clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6 - Cyber Incident Reporting.

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer.

(2) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the CISO, a written explanation of —

(i) Why a particular security requirement is not applicable; or

(ii) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award.

Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

(End of Clause)

H.6 Cyber Incident Reporting (July 2020) Clause:

(a) Definitions. As used in this clause— “Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that http://dx.doi.org/10.6028/NIST.SP.800-171) would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer- related data for investigative purposes in a manner that maintains the integrity of the data. “Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware. “Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which controlled unclassified Information is recorded, stored, or printed within a covered contractor information system.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a Breach or within one (1) hour of determining with reasonable certainty that there has been an incident or a Breach involving FRTIB data."

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor information system or the controlled unclassified information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to identify and report an incident or breach;

(iii) Conduct a review for evidence of compromise of Controlled Unclassified Information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts, in identifying what information was or may have been accessed and by whom, creating timelines of user activity, determining methods and techniques used to access federal information, and identifying the attack vector. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident or breach, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised Controlled Unclassified Information, or that affect the Contractor’s ability to provide operationally critical support.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for FRTIB and shall include, at a minimum, the required elements in accordance with FRTIB Cyber Incident Response Policy and Procedures.

mailto:IncidentResponse@tsp.gov

(c) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to FRTIB CIO in accordance with instructions provided by the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(d) Media preservation and protection. When a Contractor discovers a cyber incident or breach has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (b)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(e) Cyber incident damage assessment activities. The Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(f) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(g) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S.

Government statutory or regulatory requirements.

(h) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to provide the incident report number assigned by the Security Operations Center or Computer Security Incident Response Team (CSIRT), to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber-incident to FRTIB as required in paragraph (b) of this clause. (End of Clause)

H.7 Records Management Obligations (July 2020) Clause:

(a) “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

(b) The term Federal record:

(1) Includes Agency records;

(2) Does not include personal materials;

(3) Applies to records created, received, or maintained by Contractors pursuant to their

Agency contract;

(4) May include deliverables and documentation associated with deliverables.

(c) Requirements

(1) Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

(2) In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) FRTIB and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FRTIB or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the FRTIB Contracting Officer and COR. The agency must report promptly to NARA in accordance with 36 CFR 1230.

(5) The Contractor shall immediately notify the appropriate Contracting Officer and COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract vehicle. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FRTIB control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer and COR or address prescribed in the contract vehicle. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

(6) The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FRTIB guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

(7) The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FRTIB policy.

(8) The Contractor shall not create or maintain any records containing any non-public Agency information that are not specifically tied to or authorized by the contract.

(9) The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

(10) The FRTIB owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which FRTIB shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

(11) Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FRTIB provided records management training.

The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

(d) Flow down of requirements to subcontractors:

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor. (End of Clause)

H.8 Recordkeeping & Proprietary Information (July 2020) Clause:

(a) Definitions. As used in this clause— “Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

(b) The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract:

(1) The Contractor shall protect the information against unauthorized access, modification, release, or disclosure.

(2) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.

(3) All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FRTIB provided Controlled Unclassified

Information training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

(c) If contractor’s performance of services results in a Breach of FRTIB data, as defined in Section H.1, the Contractor shall bear the losses and expenses (including attorneys’ fees) associated with the breach including costs associated with (1) providing notice of the breach to affected individuals and to applicable regulatory bodies; (2) establishing call centers for affected individuals; and (3) providing individuals with credit and identity monitoring and credit and identity restoration services on an opt-in basis. The necessary remediation measures will be determined by FRTIB in accordance with FRTIB’s Breach Response policy and procedures.

(d) FRTIB safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with the Cyber Incident Reporting clause. To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(e) Use and release of contractor attributional/proprietary information not created by or for FRTIB. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for FRTIB is authorized to be released outside of FRTIB—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes;

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract.

(f) Use and release of contractor attributional/proprietary information created by or for FRTIB. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for FRTIB is authorized to be used and released outside of FRTIB for purposes and activities authorized by paragraph

(f) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information. (End of Clause)

H.9 Electronic Invoicing and Payment Requirements – Invoice Processing Platform

(IPP)

Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice Processing Platform (IPP) system using the “Bill to Agency” of Interior Business Center

– FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor. Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. The Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973–3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation. (End Clause)

H.10 Organizational Conflict of Interest (OCI) The purpose of this clause is to protect the integrity of the procurement by ensuring that a contractor does not obtain any unfair competitive advantage over other parties by virtue of its performance under this contract and is not able to manipulate a competition for a Government contract/task order to its favor.

H.10.1 OCI Scope The restrictions described herein apply to performance or participation by the contractor and any of its affiliates or their successors in interest (hereinafter collectively referred to as "contractor") in the activities covered by this clause as a prime contractor, subcontractor, cosponsor, participant in a joint venture, consultant, or in any similar capacity. For the purpose of this clause, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both. Further, the contractor may be required to describe how it will comply with the following limitations.

http://www.ipp.gov/ mailto:IPPCustomerSupport@fiscal.treasury.gov

H.10.2 Access and use of Information If the contractor, in the performance of this contract, obtains access to information such as contractor plans, policies, reports, studies, financial plans, internal data protected by the Privacy Act, or proprietary data which has not been released or otherwise made available to the public, the contractor agrees that it may not (without prior written approval of the COR):

(1) Use such information for any private purpose including, but not limited to, consulting services, advisory services, or responses to fair opportunity contract/task order processes or other federal procurement opportunities, unless the information has been released or otherwise made available to the public.

(2) Compete for work for any federal agency based on such information for a period of one year after FRTIB closes out the contract or task order with the contractor.

(3) Submit an unsolicited quote to any federal agency which is based on such information until one year after such information is released or otherwise made available to the public; and

(4) Release such information unless such information has been previously released or otherwise made available to the public.

In addition, the contractor agrees that to the extent it receives or is given access to proprietary data, data protected by the Privacy Act, source selection information or other confidential or privileged technical, business, or financial information under this contract, it may be required to treat such information in accordance with any restrictions imposed on such information.

Contractor agrees that if it receives any of this data/information without explicit consent by the Contracting Officer or Contracting Officer’s Representative or has reason to believe the information obtained was inadvertent or disclosed by mistake, that it will immediately notify the Contracting Officer and follow any Contracting Officer directives regarding removing and/or destroying such data.

H.11 Confidentiality and Nondisclosure The preliminary and final deliverables, all associated working papers, and any other materials generated by the contractor in the performance of the contract are the property of the U.S.

Government and must be submitted to the COR at the conclusion of the contract.

All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the contractor. All appropriate project documentation will be given to FRTIB during and at the end of this contract.

The contractor shall not release any information without the written consent of the CO. Any request to the contractor for information relating to the resulting contract must be submitted to the CO for approval prior to release.

Personnel working on any of the described tasks, at the Government’s request, will be required to sign formal nondisclosure and/or conflict of interest (COI) agreements to guarantee the protection and integrity of Government information and documents.

H.12 Individual and Nondisclosure Agreements The contractor’s employees assigned to any contract/task order under this contract/task order shall be required to sign contract specific Nondisclosure Agreements (NDAs) and/or Individual COI forms which become part of the Organizational Conflict of Interest (OCI) Plan.

H.13 Advertising and Release of Information The Contractor and any of its subcontractors shall not publicize or advertise in relation to this contract without the prior written approval of the Agency. Also, the Contractor and any of its subcontractors shall not release information or report on its performance under the contract without the prior written approval of the Agency.

Flowdown of requirements to subcontractors as follows:

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

H.14 Controlled Unclassified Information (CUI) Storage and Disclosure Controlled unclassified information (CUI), data, and/or equipment will only be disclosed to authorized personnel on a need-to-know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment shall be returned to the Government. The Government will determine the fate of such information, data, and/or equipment. If the Government determines that such information, data, and/or equipment is to be sanitized, it shall be accomplished in accordance with NIST SP 800-88 Rev 1, “Guidelines for Media Sanitization.”

H.15 Protection of Information The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as CUI. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

H.16 General Compliance Requirements FRTIB’s information systems are the property of the Government. The contractor shall be responsible for adhering to all aspects of the Privacy Act and is prohibited from removing from the worksite any programs, documentation, or data without the knowledge and written approval of the COR.

Reference Attachment A.

FAR 52.212-1 Instructions to Offerors-Commercial Products and Commercial Services.

(Sep 2023)

Addendum to 52.212-1

FAR 52.204-7 System for Award Management. (Nov 2024)

FAR 52.212-1(b) Submission of Offer

All offerors must complete and submit the following information:

Cover page that includes: Contractor Information: UEI/CAGE/Entity code Table of contents/Indexes/Appendices Note: not included in page limit count

Volume Title Page Limit I Technical/ Corporate

Capabilities 10 pages

II Price Schedule Attachment B

Volume I- Technical/ Corporate Capabilities Subscription Product/Service Capabilities o Subscription Services’ features and capabilities

Volume II- Pricing Schedule-Attachment B Offerors must submit one (1) completed copy of Attachment B, Pricing Schedule. The government reserves the right to order a quantity of four (4) to seven (7) licenses for the base year.

The quantity selected for the base year will remain the same for each option year.

The offeror shall submit pricing for each quantity within their quote.

D. Performance Work Statement

E. Solicitation Provisions

EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

Evaluation of Quotes

1. This solicitation utilizes a Best Value approach using a Comparative Evaluation of quotes in accordance with FAR 13.106-2(b). The Government will perform a comparative evaluation, comparing quotes to each other to select the contractor that is best suited and provides the Best Value, considering the Evaluation Factors below.

2. Using a Comparative Evaluation, the following factors will be evaluated:

a) Technical/Corporate Capabilities:

Product/Service Capabilities o Subscription Services features and capabilities

b) Price: Quotes will be evaluated for price fair and reasonableness and compared to each quoter.

Quotes will be evaluated by performing a direct comparison of each other to determine which quote best meets the requirements of the Performance Work Statement. The government may select a quote that offers more than the minimum requirement if it provides some benefit to the government. Therefore, award may be made to other than the lowest priced offer.

The Government will award a contract resulting from this RFQ to the responsible offeror whose offer is in compliance with the solicitation requirements (Instructions to Offerors) and will be most advantageous to the Government, price and other factors considered.

Price. The price evaluation will determine whether the proposed prices are complete, fair and reasonable in relation to the RFQ requirements and price comparison of quotes.

Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options shall not obligate the Government to exercise the option(s).

A written notice of award or acceptance of an offer will be furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. (End of provision)

FAR 52.212-3 Offeror Representations and Certifications-Commercial Products and Commercial Services. (May 2024)

FAR 52.212-2 Evaluation

FAR 52.216-1 Type of Contract. (Apr 1984) The Government contemplates award of a Firm-Fixed price contract resulting from this solicitation. (End of provision)

3 ATTACHMENTS

A. Performance Work Statement- 3 pages B. Pricing Schedule – 3 pages