B.05 Final-FRTIB1-24-Q-0011.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

OCFO_ACQ_MGT_DIV ADM

Washington DC DC 20002 Suite 1000 77 K Street NE

FRTIB

FTB LOCATION CODE 16. ADMINISTERED BYCODE

X

X

511210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCFO_ACQ_MGT_DIV ISS

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

04/23/2024 1200 ET

04/11/2024

Ronald Rheinhardt (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

FRTIB1-24-Q-0011

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 2 PR-24-OTS-0083OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

Washington DC 20002 77 K Street NE #1000

FRTIB

15. DELIVER TO

Washington DC DC 20002 Suite 1000 77 K Street NE

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$23.0

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

FRTIB

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Unified Compliance Framework Subscription

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

Ronald Rheinhardt

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Period of Performance: 06/12/2024 to 06/11/2025

1 UCF Common Controls Hub - Basic Subscription 1 EA

2 Common Controls Hub API Add-on 1 EA

3 UCF Mapper 1 EA

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

2 2 of

B. CONTINUATION OF SF-1449 (per FAR 12.303 format).

B.1 This document consists of the following sec�ons:

SECTION DESCRIPTION

A Standard Form 1449 B Continuation of the SF-1449 C Contract Clauses D Any Contract Documents, Exhibits or Attachments E Solicitation Provisions and Instructions to Offeror(s)

[End of text]

SECTION B - CONTINUATION OF BLOCK 18a.

B.2 Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (January 2019) Payment request must be submited electronically through the U.S. Department of Treasury’s Invoice Processing Pla�orm (IPP) system using the “Bill to Agency” of Interior Business Center – FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor. Any changes to submited invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To cons�tute a proper invoice, the payment request must comply with the requirements iden�fied in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Condi�ons – Commercial Items include in commercial item contracts. The IPP website address is: htps://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submi�ng requests for payment. The Contractor must atach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instruc�ons via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contac�ng the IPP Produc�on Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973 – 3131.

If the Contractor is unable to comply with the requirements to use IPP for submi�ng invoices for payment, the Contractor must submit a waiver request in wri�ng to the Contrac�ng Officer with its proposal or quota�on.

(End of Clause)

SECTION C - CONTRACT CLAUSES

C.1 FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Products and Commercial Services. (June 2023)

a) The Contractor shall comply with the following Federal Acquisi�on Regula�on (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Execu�ve orders applicable to acquisi�ons of commercial products and commercial services:

(1) 52.203-19, Prohibi�on on Requiring Certain Internal Confiden�ality Agreements or Statements (Jan 2017) (sec�on 743 of Division E, Title VII, of the Consolidated and Further Con�nuing Appropria�ons Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropria�ons acts (and as extended in con�nuing resolu�ons)).

(2) 52.204-23, Prohibi�on on Contrac�ng for Hardware, So�ware, and Services Developed or Provided by Kaspersky Lab and Other Covered En��es (Nov 2021) (Sec�on 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibi�on on Contrac�ng for Certain Telecommunica�ons and Video Surveillance Services or Equipment. (Nov 2021) (Sec�on 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibi�on on Contrac�ng with Inverted Domes�c Corpora�ons (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C.

3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest A�er Award (Aug 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contrac�ng Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Execu�ve orders applicable to acquisi�ons of commercial products and commercial services:

__ (1) 52.203-6, Restric�ons on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) ( 41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protec�ons under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Sec�on 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Repor�ng Execu�ve Compensa�on and First-Tier Subcontract Awards (Jun 2020) (Pub.

L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Repor�ng Requirements (Oct 2016) (Pub. L. 111-117, sec�on 743 of Div. C).

__ (7) 52.204-15, Service Contract Repor�ng Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, sec�on 743 of Div. C).

__ (8) 52.204-27, Prohibi�on on a ByteDance Covered Applica�on (Jun 2023) (Sec�on 102 of Division R of Pub. L. 117-328).

__ (9) 52.209-6, Protec�ng the Government’s Interest When Subcontrac�ng with Contractors Debarred, Suspended, or Proposed for Debarment. (Nov 2021) ( 31 U.S.C. 6101 note).

__ (10) 52.209-9, Updates of Publicly Available Informa�on Regarding Responsibility Maters (Oct 2018) ( 41 U.S.C. 2313).

__ (11) [Reserved].

__ (12) 52.219-3, No�ce of HUBZone Set-Aside or Sole-Source Award (Oct 2022) ( 15 U.S.C. 657a).

__ (13) 52.219-4, No�ce of Price Evalua�on Preference for HUBZone Small Business Concerns (Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) ( 15 U.S.C. 657a).

__ (14) [Reserved] __ (15) (i) 52.219-6, No�ce of Total Small Business Set-Aside (Nov 2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (16) (i) 52.219-7, No�ce of Par�al Small Business Set-Aside (Nov 2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (17) 52.219-8, U�liza�on of Small Business Concerns (Oct 2022) ( 15 U.S.C. 637(d)(2) and (3)).

__ (18) (i) 52.219-9, Small Business Subcontrac�ng Plan (Oct 2022) ( 15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Sep 2021) of 52.219-9.

__ (19) (i) 52.219-13, No�ce of Set-Aside of Orders (Mar 2020) ( 15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (20) 52.219-14, Limita�ons on Subcontrac�ng (Oct 2022) ( 15 U.S.C. 637s).

__ (21) 52.219-16, Liquidated Damages—Subcontrac�ng Plan (Sep 2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

__ (22) 52.219-27, No�ce of Service-Disabled Veteran-Owned Small Business Set-Aside (Oct 2022) ( 15 U.S.C. 657f).

__ (23) (i) 52.219-28, Post Award Small Business Program Rerepresenta�on (Mar 2023)( 15 U.S.C.

632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (24) 52.219-29, No�ce of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Oct 2022) ( 15 U.S.C. 637(m)).

__ (25) 52.219-30, No�ce of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) ( 15 U.S.C. 637(m)).

__ (26) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) ( 15 U.S.C. 644(r)).

__ (27) 52.219-33, Nonmanufacturer Rule (Sep 2021) ( 15U.S.C. 637(a)(17)).

__ (28) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

__ (29) 52.222-19, Child Labor-Coopera�on with Authori�es and Remedies (Dec 2022) (E.O.13126).

__ (30) 52.222-21, Prohibi�on of Segregated Facili�es (Apr 2015).

__ (31) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

__ (32) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) ( 38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

__ (33) (i) 52.222-36, Equal Opportunity for Workers with Disabili�es (Jun 2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

__ (34) 52.222-37, Employment Reports on Veterans (Jun 2020) ( 38 U.S.C. 4212).

__ (35) 52.222-40, No�fica�on of Employee Rights Under the Na�onal Labor Rela�ons Act (Dec 2010) (E.O. 13496).

X (36) (i) 52.222-50, Comba�ng Trafficking in Persons (Nov 2021) ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (37) 52.222-54, Employment Eligibility Verifica�on (May 2022) (Execu�ve Order 12989). (Not applicable to the acquisi�on of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (38) (i) 52.223-9, Es�mate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisi�on of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 ( 42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisi�on of commercially available off-the-shelf items.)

__ (39) 52.223-11, Ozone-Deple�ng Substances and High Global Warming Poten�al Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (40) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigera�on Equipment and Air Condi�oners (Jun 2016) (E.O. 13693).

__ (41) (i) 52.223-13, Acquisi�on of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (42) (i) 52.223-14, Acquisi�on of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (43) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) ( 42 U.S.C. 8259b).

__ (44) (i) 52.223-16, Acquisi�on of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

X (45) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O.

13513).

__ (46) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (47) 52.223-21, Foams (Jun2016) (E.O. 13693).

__ (48) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (49) (i) 52.225-1, Buy American-Supplies (Oct 2022) ( 41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__ (50) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Dec 2022) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sec�ons 4501- 4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112- 41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Dec 2022) of 52.225-3.

__ (iv) Alternate III (Jan 2021) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (51) 52.225-5, Trade Agreements (Dec 2022) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (52) 52.225-13, Restric�ons on Certain Foreign Purchases (Feb 2021) (E.O.’s, proclama�ons, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (53) 52.225-26, Contractors Performing Private Security Func�ons Outside the United States (Oct 2016) (Sec�on 862, as amended, of the Na�onal Defense Authoriza�on Act for Fiscal Year 2008; 10 U.S.C.

Sub�tle A, Part V, Subpart G Note).

__ (54) 52.226-4, No�ce of Disaster or Emergency Area Set-Aside (Nov 2007) ( 42 U.S.C. 5150).

__ (55) 52.226-5, Restric�ons on Subcontrac�ng Outside Disaster or Emergency Area (Nov2007) ( 42 U.S.C. 5150).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

__ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) ( 31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) ( 31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (May 2014) ( 31 U.S.C. 3332).

__ (62) 52.239-1, Privacy or Security Safeguards (Aug 1996) ( 5 U.S.C. 552a).

__ (63) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) ( 15 U.S.C. 637(d)(13)).

__ (64) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) ( 46 U.S.C.

55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contrac�ng Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Execu�ve orders applicable to acquisi�ons of commercial products and commercial services:

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) ( 41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Mul�ple Year and Op�on Contracts) (Aug 2018) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemp�on from Applica�on of the Service Contract Labor Standards to Contracts for Maintenance, Calibra�on, or Repair of Certain Equipment-Requirements (May 2014) ( 41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemp�on from Applica�on of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) ( 41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Execu�ve Order 14026 (Jan 2022).

__ (8) 52.222-62, Paid Sick Leave Under Execu�ve Order 13706 (Jan 2022) (E.O. 13706).

__ (9) 52.226-6, Promo�ng Excess Food Dona�on to Nonprofit Organiza�ons (Jun 2020) ( 42 U.S.C.

1792).

(d) Comptroller General Examina�on of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisi�on threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Nego�a�on.

(1) The Comptroller General of the United States, or an authorized representa�ve of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly per�nent records involving transac�ons related to this contract.

(2) The Contractor shall make available at its offices at all reasonable �mes the records, materials, and other evidence for examina�on, audit, or reproduc�on, un�l 3 years a�er final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Reten�on, of the other clauses of this contract. If this contract is completely or par�ally terminated, the records rela�ng to the work terminated shall be made available for 3 years a�er any resul�ng final termina�on setlement.

Records rela�ng to appeals under the disputes clause or to li�ga�on or the setlement of claims arising under or rela�ng to this contract shall be made available un�l such appeals, li�ga�on, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accoun�ng procedures and prac�ces, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) ( 41 U.S.C. 3509).

(ii) 52.203-19, Prohibi�on on Requiring Certain Internal Confiden�ality Agreements or Statements (Jan 2017) (sec�on 743 of Division E, Title VII, of the Consolidated and Further Con�nuing Appropria�ons Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropria�ons acts (and as extended in con�nuing resolu�ons)).

(iii) 52.204-23, Prohibi�on on Contrac�ng for Hardware, So�ware, and Services Developed or Provided by Kaspersky Lab and Other Covered En��es (Nov 2021) (Sec�on 1634 of Pub. L. 115-91).

(iv) 52.204-25, Prohibi�on on Contrac�ng for Certain Telecommunica�ons and Video Surveillance Services or Equipment. (Nov 2021) (Sec�on 889(a)(1)(A) of Pub. L. 115-232).

(v) 52.204-27, Prohibi�on on a ByteDance Covered Applica�on (Jun 2023) (Sec�on 102 of Division R of Pub. L. 117-328).

(vi) 52.219-8, U�liza�on of Small Business Concerns (Oct 2022) ( 15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontrac�ng opportuni�es. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower �er subcontracts that offer subcontrac�ng opportuni�es.

(vii) 52.222-21, Prohibi�on of Segregated Facili�es (Apr 2015).

(viii) 52.222-26, Equal Opportunity (Sep 2015) (E.O.11246).

(ix) 52.222-35, Equal Opportunity for Veterans (Jun 2020) ( 38 U.S.C. 4212).

(x) 52.222-36, Equal Opportunity for Workers with Disabili�es (Jun 2020) ( 29 U.S.C. 793).

(xi) 52.222-37, Employment Reports on Veterans (Jun 2020) ( 38 U.S.C. 4212).

(xii) 52.222-40, No�fica�on of Employee Rights Under the Na�onal Labor Rela�ons Act (Dec 2010) (E.O.

13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xiii) 52.222-41, Service Contract Labor Standards (Aug 2018) ( 41 U.S.C. chapter 67).

(xiv) (A) 52.222-50, Comba�ng Trafficking in Persons (Nov 2021) ( 22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

(xv) 52.222-51, Exemp�on from Applica�on of the Service Contract Labor Standards to Contracts for Maintenance, Calibra�on, or Repair of Certain Equipment-Requirements (May 2014) ( 41 U.S.C. chapter 67).

(xvi) 52.222-53, Exemp�on from Applica�on of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) ( 41 U.S.C. chapter 67).

(xvii) 52.222-54, Employment Eligibility Verifica�on (May 2022) (E.O. 12989).

(xviii) 52.222-55, Minimum Wages for Contractor Workers Under Execu�ve Order 14026 (Jan 2022).

(xix) 52.222-62, Paid Sick Leave Under Execu�ve Order 13706 (Jan 2022) (E.O. 13706).

(xx) (A) 52.224-3, Privacy Training (Jan 2017) ( 5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxi) 52.225-26, Contractors Performing Private Security Func�ons Outside the United States (Oct 2016) (Sec�on 862, as amended, of the Na�onal Defense Authoriza�on Act for Fiscal Year 2008; 10 U.S.C.

Sub�tle A, Part V, Subpart G Note).

(xxii) 52.226-6, Promo�ng Excess Food Dona�on to Nonprofit Organiza�ons (Jun 2020) ( 42 U.S.C. 1792).

Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxiii) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxiv) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) ( 46 U.S.C.

55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247- 64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of addi�onal clauses necessary to sa�sfy its contractual obliga�ons.

(End of clause)

C.2 FAR 52.252-2 Clauses Incorporated by Reference (February 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contrac�ng Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

htps://www.acquisi�on.gov/far/ and htps://www.fr�b.gov/pdf/procurement/thri�_federal_acquisi�on_supplement_t-fas.pdf

(End of Clause)

C.3 Notice Listing Clauses Incorporated by Reference The following clauses are hereby incorporated by reference (by Cita�on Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" contained in this document. See FAR 52.252-2 for an internet address (if specified) for electronic access to the full text of a clause.

FEDERAL ACQUISITION REGULATION (48 CFR Chapter 1) Citation Number Title Date

FAR 52.204-26 Covered Telecommunications Equipment or Services--Representation October 2020 FAR 52.232-39 Unenforceability of Unauthorized Obligations June 2013

(End of Clause)

C.4 FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (November 2021) The Offeror shall not complete the representa�on at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunica�ons equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunica�ons Equipment or Services—Representa�on, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representa�ons and Cer�fica�ons-Commercial Products or Commercial Services. The Offeror shall not complete the representa�on in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunica�ons equipment or services, or any equipment, system, or service that uses covered telecommunica�ons equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Defini�ons. As used in this provision— Backhaul, covered telecommunica�ons equipment or services, cri�cal technology, interconnec�on arrangements, reasonable inquiry, roaming, and substan�al or essen�al component have the meanings provided in the clause 52.204-25, Prohibi�on on Contrac�ng for Certain Telecommunica�ons and Video Surveillance Services or Equipment.

(b) Prohibi�on. (1) Sec�on 889(a)(1)(A) of the John S. McCain Na�onal Defense Authoriza�on Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an execu�ve agency on or a�er August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunica�ons equipment or services as a substan�al or essen�al component of any system, or as cri�cal technology as part of any system. Nothing in the prohibi�on shall be construed to—

(i) Prohibit the head of an execu�ve agency from procuring with an en�ty to provide a service that connects to the facili�es of a third-party, such as backhaul, roaming, or interconnec�on arrangements;

or

(ii) Cover telecommunica�ons equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Sec�on 889(a)(1)(B) of the John S. McCain Na�onal Defense Authoriza�on Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an execu�ve agency on or a�er August 13, 2020, from entering into a contract or extending or renewing a contract with an en�ty that uses any equipment, system, or service that uses covered telecommunica�ons equipment or services as a substan�al or essen�al component of any system, or as cri�cal technology as part of any system. This prohibi�on applies to the use of covered telecommunica�ons equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibi�on shall be construed to—

(i) Prohibit the head of an execu�ve agency from procuring with an en�ty to provide a service that connects to the facili�es of a third-party, such as backhaul, roaming, or interconnec�on arrangements;

or

(ii) Cover telecommunica�ons equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded par�es in the System for Award Management (SAM) ( htps://www.sam.gov) for en��es excluded from receiving federal awards for "covered telecommunica�ons equipment or services".

(d) Representa�on. The Offeror represents that—

(1) It □ will, □ will not provide covered telecommunica�ons equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resul�ng from this solicita�on. The Offeror shall provide the addi�onal disclosure informa�on required at paragraph (e)(1) of this sec�on if the Offeror responds "will" in paragraph (d)(1) of this sec�on; and

(2) A�er conduc�ng a reasonable inquiry, for purposes of this representa�on, the Offeror represents that— It □ does, □ does not use covered telecommunica�ons equipment or services, or use any equipment, system, or service that uses covered telecommunica�ons equipment or services. The Offeror shall provide the addi�onal disclosure informa�on required at paragraph (e)(2) of this sec�on if the Offeror responds "does" in paragraph (d)(2) of this sec�on.

(e) Disclosures. (1) Disclosure for the representa�on in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representa�on in paragraph (d)(1) of this provision, the Offeror shall provide the following informa�on as part of the offer:

(i) For covered equipment—

(A) The en�ty that produced the covered telecommunica�ons equipment (include en�ty name, unique en�ty iden�fier, CAGE code, and whether the en�ty was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A descrip�on of all covered telecommunica�ons equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item descrip�on, as applicable); and

(C) Explana�on of the proposed use of covered telecommunica�ons equipment and any factors relevant to determining if such use would be permissible under the prohibi�on in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A descrip�on of all covered telecommunica�ons services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item descrip�on, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided;

and explana�on of the proposed use of covered telecommunica�ons services and any factors relevant to determining if such use would be permissible under the prohibi�on in paragraph (b)(1) of this provision.

(2) Disclosure for the representa�on in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representa�on in paragraph (d)(2) of this provision, the Offeror shall provide the following informa�on as part of the offer:

(i) For covered equipment—

(A) The en�ty that produced the covered telecommunica�ons equipment (include en�ty name, unique en�ty iden�fier, CAGE code, and whether the en�ty was the OEM or a distributor, if known);

(B) A descrip�on of all covered telecommunica�ons equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item descrip�on, as applicable); and

(C) Explana�on of the proposed use of covered telecommunica�ons equipment and any factors relevant to determining if such use would be permissible under the prohibi�on in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A descrip�on of all covered telecommunica�ons services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item descrip�on, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explana�on of the proposed use of covered telecommunica�ons services and any factors relevant to determining if such use would be permissible under the prohibi�on in paragraph (b)(2) of this provision.

(End of provision)

C.5 Safeguarding Controlled Unclassified Information (CUI) (July 2020)

(a) Defini�ons. As used in this clause— “Adequate security” means protec�ve measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modifica�on of informa�on.

“Covered contractor informa�on system” means an unclassified informa�on system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Informa�on.

“Controlled Unclassified Informa�on” means unclassified controlled technical informa�on or other informa�on, as described in the Controlled Unclassified Informa�on Registry at htp://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemina�on controls pursuant to and consistent with law, regula�ons, and Government-wide policies, and is—

(1) Marked or otherwise iden�fied in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmited, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer so�ware” means computer programs, source code, source code lis�ngs, object code lis�ngs, design details, algorithms, processes, flow charts, formulae and related material that would enable the so�ware to be reproduced, recreated, or recompiled. Computer so�ware does not include computer data bases or computer so�ware documenta�on.

“Informa�on system” means a discrete set of informa�on resources organized for the collec�on, processing, maintenance, use, sharing, dissemina�on, or disposi�on of informa�on.

“Technical informa�on” means technical data or computer so�ware, as those terms are defined in this clauses--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicita�on or contract. Examples of technical informa�on include research and engineering data, engineering drawings, and associated lists, specifica�ons, standards, process sheets, manuals, technical reports, technical orders, catalog-item iden�fica�ons, data sets, studies and analyses and related informa�on, and computer so�ware executable code and source code.

“Technical data” means recorded informa�on, regardless of the form or method of the recording, of a scien�fic or technical nature (including computer so�ware documenta�on). The term does not include computer so�ware or data incidental to contract administra�on, such as financial and/or management informa�on.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor informa�on systems. To provide adequate security, the Contractor shall implement, at a minimum, the following informa�on security protec�ons:

(1) For covered contractor informa�on systems that are part of and Informa�on Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud compu�ng services shall be subject to the security requirements specified in the Cloud Compu�ng Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud compu�ng) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor informa�on systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor informa�on system shall be subject to the security requirements in Na�onal Ins�tute of Standards and Technology (NIST) Special Publica�on (SP) 800-171, “Protec�ng Controlled Unclassified Informa�on in Nonfederal Informa�on Systems and Organiza�ons” (available via the internet at htps://csrc.nist.gov/publica�ons/detail/sp/800-171/rev-2/final) in effect at the �me the solicita�on is issued or as authorized by the Contrac�ng Officer.

(ii)(A) The Contractor shall no�fy the FRTIB Chief Informa�on Security Officer (CISO), via email, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the �me of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in wri�ng to the Contrac�ng Officer, for considera�on by the FRTIB Chief Technology Officer (CTO) or CISO. The Contractor need not implement any security requirement adjudicated by an authorized representa�ve of the FRTIB CTO to be non-applicable or to have an alterna�ve, but equally effec�ve, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the �me of the execu�on of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indica�ng that a requirement is not applicable or that an alterna�ve security measure is equally effec�ve, a copy of that approval shall be provided to the Contrac�ng Officer when reques�ng its recogni�on under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered informa�on in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authoriza�on Management Program (FedRAMP) Moderate baseline (htps://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Repor�ng, including malicious so�ware, media preserva�on and protec�on, access to addi�onal informa�on and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other informa�on systems security measures when the Contractor reasonably determines that informa�on systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facili�es, personnel and informa�on system documenta�on for the purposes of audit or inspec�on by an authorized regulator or designated security cer�fica�on ac�vity to ensure appropriate informa�on security prac�ces are in place.

(d) The Contractor shall conduct ac�vi�es under this clause in accordance with applicable laws and regula�ons on the intercep�on, monitoring, access, use, and disclosure of electronic communica�ons and data.

(e) Other safeguarding or repor�ng requirements. The safeguarding and cyber incident repor�ng required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident repor�ng pertaining to its unclassified informa�on systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for opera�onally cri�cal support, or for which subcontract performance will involve Controlled Unclassified Informa�on, including subcontracts for commercial items, without altera�on, except to iden�fy the par�es. The Contractor shall determine if the informa�on required for subcontractor performance retains its iden�ty as Controlled Unclassified Informa�on and will require protec�on under this clause, and, if necessary, consult with the Contrac�ng Officer; and

(2) Require subcontractors to no�fy the prime Contractor (or next higher-�er subcontractor) when submi�ng a request to vary from a NIST SP 800-171 security requirement to the Contrac�ng Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause.

C.6 Federal Information Security Modernization Act (FISMA) Compliance (JULY 2020)

(a) Contractor shall implement security requirements specified by the Federal Informa�on Security Moderniza�on Act (FISMA) for the relevant covered contractor informa�on systems. Contractor shall implement controls from NIST Special Publica�on 800-53 Rev. 4 as recommended for the [select: low, medium, high] security categoriza�on and in accordance with all FRTIB FISMA Baseline Policies, and the agency’s implementa�on of the NIST Risk Management Framework. Devia�ons from the agency’s FISMA policies must be approved by the CISO and an Authority to Operate must be maintained on an ongoing basis.

(b) The contractor shall provide access to the Contractor’s facili�es, personnel and informa�on system documenta�on for the purposes of audit or inspec�on by an authorized regulator or designated security cer�fica�on ac�vity to ensure appropriate informa�on security prac�ces are in place.

(End of Clause)

C.7 Cloud Computing Services (July 2020)

(a) Defini�ons. As used in this clause— “Authorizing official,” means the senior Federal official or execu�ve with the authority to formally assume responsibility for opera�ng an informa�on system at an acceptable level of risk to organiza�onal opera�ons (including mission, func�ons, image, or reputa�on), organiza�onal assets, individuals, other organiza�ons, and the Na�on.

“Cloud compu�ng” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable compu�ng resources (e.g., networks, servers, storage, applica�ons, and services) that can be rapidly provisioned and released with minimal management effort or service provider interac�on. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elas�city, and measured service. It also includes commercial offerings for so�ware-as-a-service, infrastructure-as-a-service, and pla�orm-as-a-service.

“Compromise” means disclosure of informa�on to unauthorized persons, or a viola�on of the security policy of a system, in which unauthorized inten�onal or uninten�onal disclosure, modifica�on, destruc�on, or loss of an object, or the copying of informa�on to unauthorized media may have occurred.

“Cyber incident” means ac�ons taken through the use of computer networks that result in a compromise or an actual or poten�ally adverse effect on an informa�on system and/or the informa�on residing therein.

“Government data” means any informa�on, document, media, or machine readable material regardless of physical form or characteris�cs, that is created or obtained by the Government in the course of official Government business.

“Government-related data” means any informa�on, document, media, or machine readable material regardless of physical form or characteris�cs that is created or obtained by a contractor through the storage, processing, or communica�on of Government data. This does not include contractor’s business records e.g. financial records, legal records etc. or data such as opera�ng procedures, so�ware coding or algorithms that are not uniquely applied to the Government data.

“Informa�on system” means a discrete set of informa�on resources organized for the collec�on, processing, maintenance, use, sharing, dissemina�on, or disposi�on of informa�on.

“Media” means physical devices or wri�ng surfaces including, but not limited to, magne�c tapes, op�cal disks, magne�c disks, large-scale integra�on memory chips, and printouts onto which informa�on is recorded, stored, or printed within an informa�on system.

“Spillage” security incident that results in the transfer of classified or controlled unclassified informa�on onto an informa�on system not accredited (i.e., authorized) for the appropriate security level.

(b) Cloud compu�ng security requirements. The requirements of this clause are applicable when using cloud compu�ng to provide informa�on technology services in the performance of the contract.

(1) If the Contractor indicated in its offer that it “does not an�cipate the use of cloud compu�ng services in the performance of a resultant contract,” in response to provision H No. ___, Representa�on of Use of Cloud Compu�ng, and a�er the award of this contract, the Contractor proposes to use cloud compu�ng services in the performance of the contract, the Contractor shall obtain approval from the Contrac�ng Officer prior to u�lizing cloud compu�ng services in performance of the contract.

(2) The Contractor shall implement and maintain administra�ve, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Compu�ng Security Requirements Guide (SRG) (version in effect at the �me the solicita�on is issued or as authorized by the Contrac�ng Officer) found at htp://iase.disa.mil/cloud_security/Pages/index.aspx, unless no�fied by the Contrac�ng Officer that this requirement has been waived by the FRTIB Chief Informa�on Officer.

(3) The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on FRTIB premises, unless the Contractor receives writen no�fica�on from the Contrac�ng Officer to use another loca�on.

(4) All cloud compu�ng service must meets security requirements equivalent to those established by the Government for the Federal Risk and Authoriza�on Management Program (FedRAMP) Moderate baseline (htps://www.fedramp.gov/resources/documents/).

(c) Limita�ons on access to, and use and disclosure of Government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder.

(i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibi�ons and obliga�ons.

(iii) These access, use, and disclosure prohibi�ons and obliga�ons shall survive the expira�on or termina�on of this contract.

(2) The Contractor shall use Government-related data only to manage the opera�onal environment that supports the Government data and for no other purpose unless otherwise permited with the prior writen approval of the Contrac�ng Officer.

(d) Cloud compu�ng services cyber incident repor�ng. The Contractor shall immediately report all actual or poten�al cyber incidents that are related to the cloud compu�ng service provided under this contract.

Reports shall be submited to IncidentResponse@tsp.gov.

(e) Malicious so�ware. The Contractor or subcontractors that discover and isolate malicious so�ware in connec�on with a reported cyber incident shall submit the malicious so�ware in accordance with instruc�ons provided by the Contrac�ng Officer.

(f) Media preserva�on and protec�on. When a Contractor discovers a cyber-incident has occurred, the Contractor shall preserve and protect images of all known affected informa�on systems iden�fied in the cyber incident report (see sec�on (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days unless directed otherwise by FRTIB CISO or CTO from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(g) Access to addi�onal informa�on or equipment necessary for forensic analysis. Upon request by FRTIB, the Contractor shall provide FRTIB with access to addi�onal informa�on or equipment that is necessary to conduct a forensic analysis.

(h) Cyber incident damage assessment ac�vi�es. If FRTIB elects to conduct a damage assessment, the Contrac�ng Officer will request that the Contractor provide all of the damage assessment informa�on gathered in accordance with paragraph (f) of this clause.

(i) Records management and facility access.

(1) The Contractor shall provide the Contrac�ng Officer all Government data and Government-related data in the format specified in the contract.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirma�on of disposi�on to the Contrac�ng Officer in accordance with contract closeout procedures.

(3) The Contractor shall provide the Government, or its authorized representa�ves, access to all Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, inves�ga�ons, inspec�ons, or other similar ac�vi�es, as authorized by law or regula�on.

(j) No�fica�on of third party access requests. The Contractor shall no�fy the Contrac�ng Officer promptly of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contrac�ng Officer to take all measures to protect Government data and Government-related data from any unauthorized disclosure.

(k) Spillage. Upon no�fica�on by the Government of a spillage, or upon the Contractor’s discovery of a spillage, the Contractor shall cooperate with the Contrac�ng Officer to address the spillage in compliance with agency procedures.

(l) Subcontracts. The Contractor shall include this clause, including this paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial items.

C.8 Cyber Incident Reporting (July 2020)

(a) Definitions.