B.01 Solicitation_Final.pdf

FRTIB1-24-Q-0005

Section A: Solicitation/Contract Form

A.1. Introduction and Background

The Federal Retirement Thrift Investment Board (FRTIB or Agency) requires professional legal services from a law firm with expertise in advising clients on diverse and complex matters including large scale procurements, securities litigation, insurance, privacy and cybersecurity protection, and issues relating to defined contribution plans, such as the

Employee Retirement Income Security Act of 1974 (ERISA).

The FRTIB is an independent Federal government agency in the Executive Branch created by the Federal Employees’ Retirement System Act of 1986 (FERSA). The Thrift Savings

Plan (TSP) is a retirement savings and investment plan for Federal civilian employees and members of the uniformed services that offers its participants the same type of savings and tax benefits that many private corporations offer their employees under I.R.C.§401(k) plans. The TSP has approximately five million participants and approximately $500 billion in assets under management. The TSP is the largest participant-directed defined contribution plan in the world. The mission of the FRTIB is to administer the TSP solely in the interest of the participants and beneficiaries. In fulfilling this mission, the FRTIB strives to offer high quality services and benefits, while maintaining low administrative costs. The Federal Acquisition Regulation (FAR) informs the Agency’s procurement activities.

A.2. Objectives

The FRTIB Office of General Counsel (OGC) occasionally requires outside legal counsel services for specific legal issues that OGC is unable to resolve or advise upon because of the specialized nature of the issue. Accordingly, OGC seeks to establish a maximum of three multiple-award, Indefinite-Delivery, Indefinite-Quantity (IDIQ) labor-hour contracts with law firms to obtain outside counsel services when required. Task orders issued under this contract will be issued on a labor hour basis.

A.3. Scope

The scope of this contract includes but is not strictly limited to providing advice, written memorandums, and support to negotiations for FRTIB’s Office of General Counsel on complex legal matters. In general, these legal matters will be related to analysis of actions taken or considered for action by the Agency’s Executive Director, its Board, and other

Agency personnel. These legal matters generally fall into one of the following areas:

i. Fiduciary responsibilities of Board Members, the Executive Director, and other

Agency officials.

ii. Other legal areas relevant to federal agency operations and defined contribution retirement plans, including analysis of Agency actions to determine whether such actions might cause a prohibited transaction under ERISA.

iii. Securities litigation, to include ongoing monitoring as well as advice regarding ongoing litigation.

iv. Contract structure including risk allocation and dispute resolution relating to areas such as resolution of claims arising from contractor error or negotiating liability caps.

v. Privacy, Data protection, and Cybersecurity issues, including privacy compliance

(e.g., notices, policies, and consents, vendor contracting and oversight), cybersecurity preparedness, data breach response, investigations, litigation.

vi. Issues related to insurance coverage in the federal and/or financial services sector.

vii. Custodial issues relevant to the management of large investment vehicles.

Contractor staff shall not be required to represent the Agency, appear in court on the

Agency’s behalf, or provide other legal services outside of research, advice, and counsel.

Unless otherwise specifically provided in this contract, the quality of all services rendered under this contract shall conform to the highest standards in the legal profession. All services shall be rendered by or supervised directly by individuals fully qualified and licensed in the practice of law.

Section B: Supplies or Services and Prices/Cost

B.1. Contract Line Item Number (CLIN) Structure

This RFQ will result in a multiple award IDIQ contract, with one twelve-month base year and four twelve-month option years. The contract period of performance is not expected to exceed 60 months. The Government is obligated only to the extent of authorized task orders actually awarded under the IDIQ contract. Specific tasks and/or work to be performed will be detailed in individual delivery/task orders issued under this IDIQ contract.

The table below lists the required labor category positions and estimated ceiling hours per position per period of performance.

CLIN Labor Category Hours (Est.) Hourly Rate Extended Total

0001 Partner 750

0002 Associate 700

0003 Paralegal 50

0004 Travel/ODCs $5,000 (NTE)

BASE YEAR SUBTOTAL

1001 Partner 750

1002 Associate 700

1003 Paralegal 50

1004 Travel/ODCs $5,000 (NTE)

OPTION YEAR ONE SUBTOTAL

CLIN Labor Category Hours (Est.) Hourly Rate Extended

Total

2001 Partner 750

2002 Associate 700

2003 Paralegal 50

2004 Travel/ODCs $5,000(NTE)

OPTON YEAR TWO SUBTOTAL

3001 Partner 750

3002 Associate 700

3003 Paralegal 50

3004 Travel/ODCs $5,000(NTE)

OPTION YEAR THREE SUBTOTAL

4001 Partner 750

4002 Associate 700

4003 Paralegal 50

4004 Travel/ODCs $5,000(NTE)

OPTION YEAR FOUR SUBTOTAL

Overall Total:

B.2. Ordering

FRTIB will issue task orders on a competitive basis to satisfy requirements as they arise.

FRTIB will select the appropriate CLINs and The Contractor shall provide a quote for the required legal counsel support services on a labor hour basis. The Contractor’s cost shall be at or below negotiated IDIQ contract pricing for the applicable IDIQ contract year.

Task order RFQs will include specific task order requirements as well as response instructions and evaluation criteria. The Contractor shall have the opportunity to provide a technical proposal as well as pricing for required services on a labor-hour basis, as required by individual task order requests for proposal. The hourly rate shall include all costs necessary to complete the work for which the price is established including indirect costs, fees, taxes, and profit.

B.3. Minimum and Maximum Quantities

The minimum order quantity shall consist of a preliminary kick-off meeting to be conducted with each Awardee at the beginning of the contract period of performance. The maximum will be set at the labor hour ceilings in the CLIN structure. The Agency is obligated only to the minimum value of the IDIQ contract and to the extent of additional authorized purchases actually awarded via delivery/task orders under the IDIQ.

Section C: Statement of Work

The scope of this contract includes, but is not strictly limited to, providing advice, written memorandums, and support to negotiations for FRTIB’s Office of General Counsel on complex legal matters. In general, these legal matters will be related to analysis of actions taken or considered for action by the Agency’s Executive Director, its Board, and other

Agency personnel. These legal matters generally fall into one of the following areas:

i. Fiduciary responsibilities of Board Members, the Executive Director, and other

Agency officials.

ii. Other legal areas relevant to federal agency operations and defined contribution retirement plans, including analysis of Agency actions to determine whether such actions might cause a prohibited transaction under ERISA.

iii. Securities litigation, to include ongoing monitoring as well as advice regarding ongoing litigation.

iv. Contract structure including risk allocation and dispute resolution relating to areas such as resolution of claims arising from contractor error or negotiating liability caps.

v. Privacy, Data protection, and Cybersecurity issues, including privacy compliance

(e.g., notices, policies, and consents, vendor contracting and oversight), cybersecurity preparedness, data breach response, investigations, litigation.

vi. Issues related to insurance coverage in the federal and/or financial services sector.

vii. Custodial issues relevant to the management of large investment vehicles.

Contractor staff shall not be required to represent the Agency, appear in court on the

Agency’s behalf, or provide other legal services outside of research, advice, and counsel.

Unless otherwise specifically provided in this contract, the quality of all services rendered under this contract shall conform to the highest standards in the legal profession. All services shall be rendered by or supervised directly by individuals fully qualified and licensed in the practice of law.

C.1 Task Orders

After receiving a task order, the firm will select the partner and/or associates/s who will perform the task. The Contracting officer, in consultation with the Agency’s Office of

General Counsel, will have the right to accept or reject the firm’s recommendation concerning the number of partners, associates, and other related personnel.

C.2 Initial Matters

Task 1 Kick-Off Meeting allows for the initial ramp-up period and includes site visits, teleconferences, and meetings to familiarize the Contractor with the Agency, its operational and legal history, and its legal posture. Task 1 Kick-Of Meeting also allows for time to gather and manage the documents that the Contractor will require familiarity with to perform the services required under this Contract. The Contractor may also be asked to review Agency practices, policies, procedures, contracts, and agreements. The Contractor shall complete Task 1 Kick-Off Meeting on or before two weeks after receipt of the contract award.

C.3 Outside Counsel Services

The government may order additional legal services that are related to the legal matters, areas, or issues referenced above. Goals and standards for such work shall be provided in the task order. The Contractor shall provide pricing for such services on a labor hour basis.

The Contractor’s hourly rate shall include all costs necessary to complete the work for which the price is established including but not limited to, travel, indirect costs, fees, expenses, taxes and profit.

C.4 Task Deliverables

The contractor may be required to perform any or all of the following activities:

i. Contract kick off meeting;

ii. Review applicable documents (e.g., Agency contracts);

iii. Perform legal research and analysis regarding the legal issues identified by OGC;

iv. Render professional opinions regarding the legal issues identified by OGC, stating the factual and legal basis for all opinions;

v. Prepare and submit to OGC written memoranda or other written documents reflecting the contractor's research, analysis and opinions regarding the legal issues identified by OGC, and;

vi. Attend and participate at meetings as requested by OGC.

Section D: Packaging and Marking

Not applicable.

Section E: Inspection and Acceptance

The basis for acceptance shall be in compliance with the requirements set forth in the award resulting from this RFQ. The Contracting Officer Representative (COR) will have the right to reject or require correction of any deficiencies found in deliverables. In the event of rejection of any deliverable, the Contractor will be notified in writing by the COR of the specific reasons the deliverable was rejected. If no comments from the COR are provided within 10 business days of receipt, the deliverable will be deemed to have been accepted by the Agency. Documents not approved by the FRTIB must be resubmitted with changes within 10 business days and the FRTIB will have another 10 business-day review period.

If after the third submission the deliverable is unacceptable to FRTIB, the Program

Manager, COR, and Contracting Officer will meet to discuss corrective actions.

Section F: Deliverables/Performance

F.1 Deliverable Management

Specific deliverables with associated due dates, and the required period of performance will be identified in each task order request for proposal.

Task order deliverables may include memoranda documenting research, analyses, and opinions, and other related documents. Additionally, the meeting deliverables and associated due dates below shall be standard to all task orders.

F.2 Deliverable Submission

All deliverables shall be submitted to the COR.

F3. Period of Performance

The Period of Performance (POP) for this requirement is for five (5) years. The POP will begin upon award date of the contract. The POP shall be a one twelve-month base year and four twelve-month option years and is estimated on or about:

Base: Apr. 28, 2024 – Apr. 27, 2025

Option Year 1: Apr. 28, 2025 – Apr. 27, 2026

Option Year 2: Apr. 28, 2026 – Apr. 27, 2027

Option Year 3: Apr. 28, 2027 – Apr. 27, 2028

Option year 4: Apr. 28, 2028 – Apr. 27, 2029

F4. Place of Performance

The contractor will work from their own offices except for any trips required by this contract to the Agency’s offices in Washington, DC. The contractor must fund and provide its own furniture, all equipment (including computers, modems, printers, faxes and copiers) and supplies, telephones telephone service, janitorial services, and physical security in their performance of this project.

F.5 Delivery Schedule

The contractor shall be responsible for providing legal services as specified in each task order (TO) issued against this master IDIQ contract. The contractor shall be responsible for providing all labor and materials to perform each task order. Task orders shall be proposed and issued on a labor-hour basis, as required by individual task order requests for quotation.

The quality of all services rendered under this contract shall conform to the highest standards in the legal profession. All services shall be rendered by or supervised directly by individuals fully qualified and licensed in the practice of law. Legal staff shall not be required to represent the Agency, appear in court on the Agency’s behalf, or provide other legal services outside of research, advice, and counsel.

Unless otherwise stated, all provisions that follow throughout the remaining sections of this master IDIQ contract may be revised within the overall scope of the contract, as necessary based on the needs and regulations of the Agency, in Agency TO Request for

Proposals (RFP).

F.10 Agency Furnished Equipment (AFE) and Agency Furnished Information (AFI)

The contractor must fund and provide its own furniture, all equipment (including computers, modems, printers, faxes, and copiers) and supplies, telephones, telephone service, janitorial services, and physical security in their performance of this project.

Section G: Contract Administration Data

G.1 Contracting Officer

Responsibility for contracting activities rests solely with the FRTIB CO. The CO is responsible for directing any changes in the terms, conditions, or amounts cited in the contract. No conversation, recommendations, or direction, whether given directly by, or implied by FRTIB personnel, which will affect the scope, schedule, or price of this contract, shall be acted upon by the Contractor unless specifically approved by the FRTIB’s

CO. In the event that the Contractor implements changes to the contract at the direction of any person other than the CO, the Contractor will not receive reimbursement for work performed pursuant to those unauthorized changes. Contractual interpretation and assistance may be obtained by contacting the CO.

G.1.1 Contracting Officer Point of Contact

Name: David Ouellette

Phone: 202-841-7795

Email: david.ouellette@frtib.gov

G2. Contracting Officer Representative (COR)

The CO shall designate a COR, who is responsible for administering the performance under the contract by:

1. Monitoring the Offeror’s performance

2. Assessing performance

3. Recommending changes to the CO

4. Interpreting the scope of work

5. Performing inspection and acceptance

G.2.1 Contracting Officer Representative Point of Contact

Name: TBD

Email: TBD

Phone: TBD

G.3 Personnel Supervision

At no time will Contractor personnel be supervised by FRTIB managers or other FRTIB personnel. The FRTIB will provide, as needed by the Contractor and its employees, limited assistance in the form of technical and policy guidance through the assigned COR.

G3. Invoices

Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP)

Payment request must be submitted electronically through the U.S. Department of

Treasury’s Invoice Processing Platform (IPP) system using the “Bill to Agency” of Interior

Business Center – FMD. “Payment request” means any request for contract financing mailto:david.ouellette@frtib.gov payment or invoice payment by the Contractor. Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract

Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is: https://www.ipp.gov

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. The Contractor must attach invoices in IPP. The Contractor

Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email

IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973–3131.

G4. Legal Holidays: The following Federal holidays are observed by the Agency:

Holiday Date

New Year’s Day January 1, as observed

Inauguration Day – National

Capital Region only

January 20, as observed

Martin Luther King’s Birthday Third Monday in January

President’s Day Third Monday in February

Memorial Day Last Monday in May

Juneteenth National

Independence Day

June 19, as observed

Independence Day July 4, as observed

Labor Day First Monday in September

Columbus Day Second Monday in October

Veteran’s Day November 11, as observed

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25, as observed https://www.ipp.gov/

G.5 Additional Contract Requirements

G.5.1 Non-Disclosure and Conflicts of Interest

The contractor will be required to sign a Non-Disclosure Agreement and identify any potential conflicts of interest at, or prior to, the task order kickoff meeting.

G.5.2 Agency Property Accounting

The contractor will fund and provide its own furniture, all equipment (including computers, modems, printers, faxes, and copiers) and supplies, telephones, telephone service, janitorial services, and physical security in their performance of this project.

G.5.3 Data Rights

The FRTIB owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FRTIB shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

G.5.5 Section 508 Accessibility Standards

In accordance with the Rehabilitation Act of 1973 and the Workforce Improvement Act of 1998, offerors shall demonstrate compliance with the following Section 508

Accessibility Standards.

☐ 1194.21 Software Applications and Operating Systems

☐ 1194.22 Web-Based Intranet and Internet Information and Applications

☐ 1194.23 Telecommunications Products

☐ 1194.24 Video and Multimedia Products

☐ 1194.25 Self-Contained, Closed Products

☐ 1194.26 Desktop and Portable Computers

☐ 1194.31 Functional Performance Criteria

☐ 1194.41 Information, documentation, and support

Section H: Agency Contract Clauses

H.1 Safeguarding Controlled Unclassified Information (CUI) (JULY 2020)

(a) Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled

Unclassified Information.

“Controlled Unclassified Information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled.

Computer software does not include computer data bases or computer software documentation.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Technical information” means technical data or computer software, as those terms are defined in this clauses--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation).

The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of and Information

Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the

Cloud Computing Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting

Controlled Unclassified Information in Nonfederal Information Systems and

Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)

(A) The Contractor shall notify the FRTIB Chief Information Security Officer (CISO), via email, within 30 days of contract award of any security requirements specified by NIST SP

800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the

Contracting Officer, for consideration by the FRTIB Chief Technology Officer (CTO) or

CISO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the FRTIB CTO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the time of the execution of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization

Management Program (FedRAMP) Moderate baseline

(https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Reporting, including malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(d) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(e) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall:

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled

Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause.

(End of Clause)

H.2 Compliance with Controls for Safeguarding Controlled Unclassified Information

(CUI) (JULY 2020)

(a) Definitions. As used in this provision—

“Controlled Unclassified Information (CUI),” “covered contractor information system,”

“cyber incident,” “information system,” and “technical information” are defined in clause

H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6, Cyber Incident

Reporting.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled

Unclassified Information (CUI) and Cyber Incident Reporting, shall be implemented for all Controlled Unclassified Information (CUI) on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see (b)(2) of clause

H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6 - Cyber Incident

Reporting.

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-171 “Protecting Controlled Unclassified Information (CUI) in

Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer.

(2) If the Offeror proposes to vary from any of the security requirements specified by NIST

SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the

Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the CISO, a written explanation of —

(i) Why a particular security requirement is not applicable; or

(ii) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

(End of Clause)

H.3 Federal Information Security Modernization Act (FISMA) Compliance (JULY

2020)

(a) Contractor shall implement security requirements specified by the Federal Information

Security Modernization Act (FISMA) for the relevant covered contractor information systems. Contractor shall implement controls from NIST Special Publication 800-53 Rev.

4 as recommended for the [select: low, medium, high] security categorization and in accordance with all FRTIB FISMA Baseline Policies, and the agency’s implementation of the NIST Risk Management Framework. Deviations from the agency’s FISMA policies must be approved by the CISO and an Authority to Operate must be maintained on an ongoing basis.

(b) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(End of Clause)

H.4 Cloud Computing Services (JULY 2020)

(a) Definitions. As used in this clause—

“Authorizing official,” means the senior Federal official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

“Cloud computing” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Government data” means any information, document, media, or machine-readable material regardless of physical form or characteristics, which is created or obtained by the

Government in the course of official Government business.

“Government-related data” means any information, document, media, or machine-readable material regardless of physical form or characteristics that is created or obtained by a contractor through the storage, processing, or communication of Government data. This does not include contractor’s business records e.g. financial records, legal records etc. or data such as operating procedures, software coding or algorithms that are not uniquely applied to the Government data.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

“Spillage” security incident that results in the transfer of classified or controlled unclassified information onto an information system not accredited (i.e., authorized) for the appropriate security level.

(b) Cloud computing security requirements. The requirements of this clause are applicable when using cloud computing to provide information technology services in the performance of the contract.

(1) If the Contractor indicated in its offer that it “does not anticipate the use of cloud computing services in the performance of a resultant contract,” in response to provision H

No. ___, Representation of Use of Cloud Computing, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract.

(2) The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at the time the solicitation is issued or as authorized by the Contracting Officer) found at http://iase.disa.mil/cloud_security/Pages/index.aspx, unless notified by the Contracting

Officer that this requirement has been waived by the FRTIB Chief Information Officer.

(3) The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on FRTIB premises, unless the Contractor receives written notification from the Contracting Officer to use another location.

(4) All cloud computing service must meet security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management

Program (FedRAMP) Moderate baseline

(https://www.fedramp.gov/resources/documents/).

(c) Limitations on access to and use and disclosure of Government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder.

(i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibitions and obligations.

(iii) These access, use, and disclosure prohibitions and obligations shall survive the expiration or termination of this contract.

(2) The Contractor shall use Government-related data only to manage the operational environment that supports the Government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

(d) Cloud computing services cyber incident reporting. The Contractor shall immediately report all actual or potential cyber incidents that are related to the cloud computing service provided under this contract. Reports shall be submitted to IncidentResponse@tsp.gov.

(e) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with instructions provided by the Contracting Officer.

(f) Media preservation and protection. When a Contractor discovers a cyber-incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in the cyber incident report (see section (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days unless directed otherwise by FRTIB CISO or CTO from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(g) Access to additional information or equipment necessary for forensic analysis. Upon request by FRTIB, the Contractor shall provide FRTIB with access to additional information or equipment that is necessary to conduct a forensic analysis.

(h) Cyber incident damage assessment activities. If FRTIB elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (f) of this clause.

(i) Records management and facility access.

(1) The Contractor shall provide the Contracting Officer all Government data and

Government-related data in the format specified in the contract.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures.

(3) The Contractor shall provide the Government, or its authorized representatives, access to all Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with

Government data, for the purpose of audits, investigations, inspections, or other similar activities, as authorized by law or regulation.

(j) Notification of third-party access requests. The Contractor shall notify the Contracting

Officer promptly of any requests from a third party for access to Government data or

Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contracting Officer to take all measures to protect Government data and

Government-related data from any unauthorized disclosure.

(k) Spillage. Upon notification by the Government of a spillage, or upon the Contractor’s discovery of a spillage, the Contractor shall cooperate with the Contracting Officer to address the spillage in compliance with agency procedures.

(l) Subcontracts. The Contractor shall include this clause, including this paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial items.

(End of Clause)

H.5 System Development/Engineering Lifecycle (JULY 2020)

(a) Contractor shall implement a System Development Life Cycle (SDLC) or System

Engineering Life Cycle (SELC) to manage systems, applying cyber resiliency design principles, constructs, and concepts from NIST Special Publication 800-160 and its associated volumes. Contractor shall attest that all systems have a documented SDLC and provide FRTIB with documentation on an annual basis.

(b) The SDLC/SELC must be designed to receive and incorporate from FRTIB the necessary security requirements, including those outlined in NIST Special Publication 800-

53a Rev. 4, control SA-4.

(End of Clause)

H.6 Cyber Incident Reporting (JULY 2020)

(a) Definitions. As used in this clause—

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled.

Computer software does not include computer data bases or computer software documentation.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which controlled unclassified Information is recorded, stored, or printed within a covered contractor information system.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a

Breach or within one (1) hour of determining with reasonable certainty that there has been an incident or a Breach involving FRTIB data."

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor information system or the controlled unclassified information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to identify and report an incident or breach.

(iii) Conduct a review for evidence of compromise of Controlled Unclassified Information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts, in identifying what information was or may have been accessed and by whom, creating timelines of user activity, determining methods and techniques used to access federal information, and identifying the attack vector. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident or breach, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised Controlled

Unclassified Information, or that affect the Contractor’s ability to provide operationally critical support.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for FRTIB and shall include, at a minimum, the required elements in accordance with

FRTIB Cyber Incident Response Policy and Procedures.

(c) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to FRTIB CIO in accordance with instructions provided by the Contracting

Officer. Do not send the malicious software to the Contracting Officer.

(d) Media preservation and protection. When a Contractor discovers a cyber incident or breach has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (b)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(e) Cyber incident damage assessment activities. The Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(f) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(g) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(h) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled

Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to provide the incident report number assigned by the Security

Operations Center or Computer Security Incident Response Team (CSIRT), to the prime

Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber-incident to FRTIB as required in paragraph (b) of this clause.

(End of Clause)

H.7 Records Management Obligations (JULY 2020)

(a) “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United

States Government or because of the informational value of data in them.

(b) The term Federal record:

(1) Includes Agency records.

(2) Does not include personal materials.

(3) Applies to records created, received, or maintained by Contractors pursuant to their

Agency contract.

(4) May include deliverables and documentation associated with deliverables.

(c) Requirements

(1) Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

(2) In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act

(FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) FRTIB and its contractors are…