FRTIB1-26-Q-0020_Amendment 0001.pdf

(x)

FRTIB1-26-Q-0020

x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

OCFO_ACQ_MGT_DIV ISS

Washington DC DC 20002 Suite 1000 77 K Street NE

FRTIB

06/25/20260001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

06/01/2026

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

This Amendment No. 0001 is issued to Solicitation No. FRTIB1-26-Q-0020.

The purpose of this amendment is to incorporate Government responses to vendor questions received regarding the solicitation.

The Questions and Answers (Q&A), attached hereto as Attachment C, are hereby incorporated into and made part of the solicitation. The Q&A are provided for informational purposes and to clarify the Government’s requirements. To the extent that the Q&A modify or conflict with the solicitation, the solicitation is hereby amended accordingly.

Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Ronald Rheinhardt

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

TEL: EMAIL: Ronald.Rheinhardt@FRTIB.GOV

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

FRTIB1-26-Q-0020/0001

Offerors are instructed to review the attached

Q&A in their entirety and consider this information when preparing their quotations.

Except as expressly amended herein, all other terms and conditions of the solicitation remain unchanged and in full force and effect.

Offerors shall acknowledge receipt of this amendment by completing Block 15A of the SF-30 and returning a copy with their quotation.

The due date for receipt of quotations is extended. New due date is extended to July 6, 2026 at 12:00pm.

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

Request for Quote (RFQ)

RFQ Number: FRTIB1-25-Q-0020

NOTICE TO PROSPECTIVE QUOTERS

A. Combined Synopsis Solicitation

Agency Contact: Ron Rheinhardt (Contracting Officer)

Agency Email: Ronald.Rheinhardt@frtib.gov.

RFQ Issue Date: June 1, 2026

Questions Due Date: June 15, 2026

Proposal Due Date: July 6, 2026

All questions or requests for clarification, citing the specific solicitation section, shall be emailed by June 15, 2026 at

12:00pm EST to the agency contact above.

The Contracting Officer shall be the sole point of contact (POC) for answering questions regarding the RFQ. Answers to all written questions will be provided to all prospective contractors, giving due regard to the proper protection of proprietary information and without reference to the source of the question. In posing questions, vendors must cite the relevant section, paragraph, and page number. Statements expressing opinions, sentiments, or conjectures are not considered valid inquiries and will not receive a response. Further, vendors are reminded that hypothetical questions aimed at receiving a potential

“evaluation decision” will not be addressed.

Proposal Due Date: Monday, July 6, 2026 at 12:00pm EST to Ronald.Rheinhardt@frtib.gov.

This solicitation is issued as a Request for Quotations (RFQ) for commercial services in accordance with the policies of FAR

Part 12, Acquisition of Commercial Products and Commercial Services, and the simplified acquisition procedures authorized by FAR Part 13, including FAR Subpart 13.5, Simplified Procedures for Certain Commercial Items. This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with the format in subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation;

proposals are being requested and a written solicitation will not be issued.

The Government intends to award an Indefinite-Delivery/Indefinite-Quantity (IDIQ) contract that allows for either fixed price or labor-hour orders for legal support services that meet the definition of a commercial service under FAR 2.101.

B. CONTINUATION OF SF-1449

B.1 This document consists of the following sections:

SECTION DESCRIPTION

A Standard Form 1449

B Continuation of the SF-1449

C Contract Clauses

D Contract Documents, Exhibits, or Attachments

Attachment A- Statement of Work

Attachment B-Pricing Schedule

Attachment C- Vendor Questions & Government Responses mailto:Ronald.Rheinhardt@frtib.gov mailto:Ronald.Rheinhardt@frtib.gov https://www.acquisition.gov/far/subpart-12.6#FAR_Subpart_12_6

E Solicitation Provisions

-Instruction to Quoter(s)

-Evaluation Factors for Award

Period of Performance

A Base Period plus four one-year options for a total of five years as shown below:

Base Period December 1, 2026- November 30,2027

Option Period One December 1, 2027- November 30,2028

Option Period Two December 1, 2028- November 30,2029

Option Period Three December 1, 2029- November 30,2030

Option Period Four December 1, 2030- November 30,2031

Observance of Federal Holidays

Normal business hours for FRTIB personnel are 8:00 AM to 5:00 PM Eastern Standard Time, Monday through Friday, excluding Federal holidays and official Federal Government closures in the Metropolitan DC area. The following Federal holidays are observed by the FRTIB:

(1) New Year's Day (January 1)

(2) Birthday of Martin Luther King, Jr. (Third Monday in January)

(3) Washington's Birthday (Third Monday in February)

(4) Memorial Day (Last Monday in May)

(5) Juneteenth (June 19)

(6) Independence Day (July 4)

(7) Labor Day (First Monday in September)

(8) Columbus Day (Second Monday in October)

(9) Veterans Day (November 11)

(10) Thanksgiving Day (Fourth Thursday in November)

(11) Christmas Day (December 25)

In addition to the days designated as holidays, the Government may also observe the following days:

Any day designated by Federal Statute; Executive Order; or President’s Proclamation

Notwithstanding holidays and Government closures, the contractor shall perform in accordance with the terms established in the associated contract.

Contract Type

This contract is an Indefinite-Delivery/Indefinite-Quantity (IDIQ) contract. The Government does not guarantee that all labor categories identified in this contract will be utilized for every task order.

Each task order issued under this contract may require a different combination and number of labor categories, based on the specific requirements of the work to be performed. The Government will identify the required labor categories, estimated and/or not-to-exceed (NTE) labor hours, and performance period in each task order.

Overtime

Overtime hours can only be approved by the Contracting Officer or COR.

SECTION C - CONTRACT CLAUSES

52.217-7 Option For Increased Quantity-Separately Priced Line Item (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the

Contractor within 30 days. Delivery of added items shall continue at the same rate that like items are called for under the contract unless the parties otherwise agree.

(End of clause)

52.217-8 Option To Extend Services. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor.

The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years (5 years 6 months)

52.222-90 Addressing DEI Discrimination by Federal Contractors.

As prescribed in 22.2203, insert the following clause:

ADDRESSING DEI DISCRIMINATION BY FEDERAL CONTRACTORS (DEVIATION DATE)

(a) Definitions. As used in this clause—

Program participation means membership or participation in, or access or admission to: training, mentoring, or leadership development programs; educational opportunities; clubs; associations; or similar opportunities that are sponsored or established by the contractor or subcontractor.

Racially discriminatory diversity, equity, and inclusion (DEI) activities means disparate treatment based on race or ethnicity in the recruitment, employment (e.g., hiring, promotions), contracting (e.g., vendor agreements), program participation, or allocation or deployment of an entity's resources.

(b) In connection with the performance of work under this contract, the Contractor agrees as follows:

(1) The Contractor will not engage in any racially discriminatory DEI activities;

(2) The Contractor will furnish all information and reports, including providing access to books, records, and accounts, as required by the Contracting Officer, for purposes of ascertaining compliance with this clause;

(3) In the event of the Contractor's or a subcontractor's noncompliance with this clause, this contract may be canceled, terminated, or suspended in whole or in part, and the Contractor or subcontractor may be declared ineligible for further

Government contracts;

(4) The Contractor will report any subcontractor's known or reasonably knowable conduct that may violate this clause to the

Contracting Officer and take any appropriate remedial actions directed by the Contracting Officer; and

(5) The Contractor will inform the Contracting Officer if a subcontractor sues the Contractor and the suit puts at issue, in any way, the validity of this clause.

(6) The Contractor recognizes that compliance with the requirements of this clause are material to the Government's payment decisions for purposes of 31 U.S.C. 3729(b)(4).

(c) The Contractor must include the substance of this clause, including this paragraph (c), in subcontracts at any tier, including those for commercial products and commercial services, except those where the place of delivery or performance is outside the United States.

FAR 52.233-2 Service of Protest (Sept 2006)

a) Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting

Officer at the address or email listed below by obtaining written and dated acknowledgment of receipt from the Contracting

Officer.

Service may be made to:

Contracting Officer:

Ron Rheinhardt

Email: Ron.Rheinhardt@frtib.gov or

Senior Procurement Executive:

Nieema Strong

Email: Nieema.Strong@frtib.gov

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the

GAO.

FAR 52.237-3 Continuity of Services (JAN 1991)

(a) The Contractor recognizes that the services under this contract are vital to the

Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to-

(1) Furnish phase-in training; and

(2) Exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

(b) The Contractor shall, upon the Contracting Officer’s written notice, (1) furnish phase-in, phase-out services for up to 90 days after this contract expires and (2) negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required.

The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the Contracting Officer’s approval.

The Contractor shall provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

(c) The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this contract.

The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

(d) The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e., costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations) and a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract.

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial

Products and Commercial Services. (Oct 2025)

FAR 52.212-5 Clauses incorporated by reference:

52.203-6 Restrictions on Subcontractor Sales to the Government. (Jun 2020)

52.203-13 Contractor Code of Business Ethics and Conduct, (Nov 2021)

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (Nov 2023)

52.204-14 Service Contract Reporting Requirements. (Oct 2016)

52.204-7 System of Award Management (Oct 2018)

52.204-8 Annual Representations and Certifications (Oct 2025)

52.204-13 System of Award Management Maintenance (Oct 2018)

52.204-16 Commercial and Government Entity Code Reporting (Aug 2020)

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities. (Nov 2021)

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance

Services or Equipment. (Nov 2021)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance

Services or Equipment. (Nov 2021)

52.204-26 Covered Telecommunications Equipment or Services Representation. (Oct 2020)

52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023)

52.209-6 Protecting the Government-Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Nov 2021)

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters. (Oct

2018)

52.222-3 Convict Labor. (Jun 2003)

52.222-19 Child Labor-Cooperation with Authorities and Remedies. (Feb 2024)

52.222-21 Prohibition of Segregated Facilities. (April 2015)

52.222-26 Equal Opportunity. (Sept 2016)

52.222-36 Equal Opportunity for Workers with Disabilities (JUN 2020)

52.222-40 Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010)

52.222-50 Combating Trafficking in Persons (NOV 2021)

52.224-3 Privacy Training (Jan 2017)

52.225-13 Restrictions on Certain Foreign Purchases

52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020)

52.222-35 Equal Opportunity for Veterans (JUN 2020)

52.222-37 Employment Reports on Veterans (JUN 2020)

52.222-54 Employment Eligibility Verification (MAY 2022)

52.232-39 Unenforceability of Unauthorized Obligations (June 2013)

52.233-2 Service of Protest (Sept 2026)

52.243-3 Changes-Time-and-Materials or Labor-Hours (Sept 2000)

52.246-6 Inspection-Time-and-Material and Labor-Hour (May 2021)

FRTIB Contract Provisions and Clauses

A.1 Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (Oct 2025)

Clause:

Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice Processing Platform

(IPP) system using the “Bill to Agency” of Interior Business Center – FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor. Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. The

Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email

IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973 – 3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End Clause)

A.2 Key Personnel (Oct 2025)

(a) The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the Contractor voluntarily diverting any of the specified individuals to other programs or contracts, the Contractor shall notify the Contracting Officer and COR. The Contractor shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the task order. If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than 30 days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances.

https://www.ipp.gov/ mailto:IPPCustomerSupport@fiscal.treasury.gov

The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the

Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of Clause)

A.3 Records Management Obligations (Oct 2025)

Clause:

(a) “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

(b) The term Federal record:

(1) Includes Agency records;

(2) Does not include personal materials;

(3) Applies to records created, received, or maintained by Contractors pursuant to their Agency contract;

(4) May include deliverables and documentation associated with deliverables.

(c) Requirements

(1) Contractor shall comply with all applicable records management laws and regulations, as well as

National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. Chapters 21, 29, 31, 33), NARA regulations at 36

CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

(2) In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA)

(5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) FRTIB and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FRTIB or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the FRTIB Contracting

Officer and COR. The agency must report promptly to NARA in accordance with 36 CFR 1230.

(5) The Contractor shall immediately notify the appropriate Contracting Officer and COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract vehicle.

The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment are properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the

Contracting Activity. When information, data, documentary material, records and/or equipment are no longer required, it shall be returned to FRTIB control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer and COR or address prescribed in the contract vehicle. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with

Paragraph (4).

(1) The Contractor is required to obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and

FRTIB guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

(2) The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FRTIB policy.

(3) The Contractor shall not create or maintain any records containing any non-public Agency information that are not specifically tied to or authorized by the contract.

(4) The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

(5) The FRTIB owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FRTIB shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

(6) Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FRTIB provided records management training. The

Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

[Note: To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.]

(d) Flow down of requirements to subcontractors:

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the

Contractor.

(End of Clause)

A.4 Recordkeeping & Proprietary Information (Oct 2025)

(a) Definitions. As used in this clause—

“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s)

(e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

(b) The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract:

(1) The Contractor shall protect the information against unauthorized access, modification, release, or disclosure.

(2) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.

(3) All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FRTIB provided Controlled Unclassified Information training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

(4) All Contractor employees assigned to this contract who create, work with, or otherwise handle FRTIB or TSP records using Government Furnished Property are required to take FRTIB provided Controlled Unclassified Information training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

(c) FRTIB safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with the Cyber

Incident Reporting clause. To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the

Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is released.

(d) Use and release of contractor attributional/proprietary information not created by or for FRTIB.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for FRTIB is authorized to be released outside of

FRTIB—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes;

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract.

(e) Use and release of contractor attributional/proprietary information created by or for FRTIB.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for FRTIB is authorized to be used and released outside of FRTIB for purposes and activities authorized by paragraph (f) of this clause, and for any other lawful

Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

A.5 Advertising and Release of Information (Oct 2025)

The Contractor and any of its subcontractors shall not publicize or advertise in relation to this contract without the prior written approval of the Agency. Also, the Contractor and any of its subcontractors shall not release information or report on its performance under the contract without the prior written approval of the Agency.

Flow down of requirements to subcontractors as follows:

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

A.6 Safeguarding Unclassified Information (CUI) (Oct 2025)

Controlled Unclassified Information (CUI)” means information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

• Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

• Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

(b) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government, the following security requirements apply:

(i) The covered contractor information system shall be subject to the security requirements in current version of National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations” and related guidance.

(ii) Within 30 days of the contract award, the Contractor shall email the Contracting Officer, with a copy to the FRTIB Chief Information Security Officer (CISO), to report any security requirements from NIST SP 800-171 that were not implemented at the time of the award or at any point thereafter. Additionally, the Contractor must notify the CO, with a copy to the

CISO, of any requirements that lack a self-assessment using NIST SP 800-171A.

(c) Controlled Unclassified Information (CUI) shall be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they shall protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

(d) The contractor shall provide the Government, or its authorized representatives, access to all Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, investigations, inspections, or other similar activities, as authorized by law or regulation.

(e) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(f) The safeguarding and cyber incident reporting required by this contract in no way abrogates the

Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(g) Upon notification by the Government of a spillage or upon the Contractor’s discovery of a spillage, the

Contractor shall cooperate with the Contracting Officer to address the spillage in compliance with agency procedures.

(h) Flow-down of requirements to subcontractors including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(3) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when security requirements are not satisfied in accordance with paragraph (b)(ii) of this clause. The prime Contractor shall then report the security shortfall to FRTIB in accordance with (b)(ii) of this clause.

A.7 Compliance with Controlled Unclassified Information (CUI) Protection Guidance (Oct 2025)

Controlled Unclassified Information (CUI)” means information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

• Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

• Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

(b) By submission of this offer, the Quoter represents that it will implement the security requirements specified by the current version of National Institute of Standards and Technology (NIST) Special Publication (SP)

800-171 “Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and

Organizations.”

A.8 Federal Information Security Modernization Act (FISMA) Compliance (Oct 2025)

(a) Definitions. As used in this clause—

“Continuous Diagnostics and Mitigation (CDM) agency dashboard” displays data about devices, users, privileges, and vulnerabilities. This dashboard collects and arranges detailed information on vulnerabilities gathered and provides an object-level view of an agency’s cybersecurity posture.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information. This system doesn’t receive an agency authorization.

“Federal information system” means information system used or operated by an agency or by a contractor of an agency or by another organization on behalf of an agency. This system receives an agency authorization.

“Government data” means any information, document, media, or machine-readable material regardless of physical form or characteristics, that is created or obtained by the Government in the course of official Government business.

“Government-related data” means any information, document, media, or machine-readable material regardless of physical form or characteristics that is created or obtained by a contractor through the storage, processing, or communication of

Government data. This does not include contractor’s business records, e.g. financial records, legal records etc. or data such as operating procedures, software coding or algorithms that are not uniquely applied to the Government data.

“High Value Asset” means designation of information or an information system that is so critical to an organization that the loss or corruption of this information or loss of access to the system would have serious impacts on the organization’s ability to perform its mission or conduct business.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Privacy control” means the administrative, technical, and physical safeguards employed within an agency to ensure compliance with applicable privacy requirements and manage privacy risks.

“Security controls” means the management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

As applicable:

(b) The Contractor shall comply with Federal Information Security Modernization Act (FISMA) in accordance with current versions of National Institute of Standards and Technology (NIST) Special Publication 800-53 series, 800-37 and the

Cybersecurity Framework (CSF); as well as guidance issued in furtherance of FISMA that includes, but is not limited to, Executive Orders, Office of Management and Budget (OMB) guidance, other related NIST publications and guidance, Binding Operational Directives (BODs), and other guidance issued by the Cybersecurity and Infrastructure Security Agency

(CISA). Contractor shall take actions to comply with revisions and/or new versions of FISMA that are part of routine operations at no additional cost to FRTIB.

(c) Cybersecurity is a rapidly changing and evolving area governed by a variety of laws, regulations, directives, and guidance. Contractor shall be responsible for maintaining reasonable compliance with the cybersecurity requirements made applicable to this contract and Contractor’s own evolving cybersecurity best practices.

(d) The Contractor shall select security controls according to the categorization approved by FRTIB, including applicable

High Value Asset (HVA) controls.

(e) FRTIB may accept system security controls other than those recommended by NIST. However, if other controls are used, they must be appropriately mapped to the NIST recommended controls and pass the assessment criteria outlined by

NIST. Deviations from the agency’s FISMA policies and above-mentioned related guidance must be approved by the

Contracting Officer.

(f) Contractor’s security plan and implementation of its controls must be designed to support ongoing authorization requirements as defined by the FRTIB’s Information Security Continuous Monitoring (ISCM) program. The Contractor must have the ability to support real-time authorization decisions based on factors such as Continuous Diagnostics and Mitigation

(CDM) agency dashboard data, automated control assessments, and agreed-upon assessments of non-automated controls.

Contractor is required to implement the CDM tools and technologies as a part of the initial authorization process.

(g) On a periodic basis, FRTIB reserves the right to evaluate any or all of the security controls, privacy controls, and other privacy practices implemented by the Contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the FRTIB, the Contractor shall fully cooperate and assist in an FRTIB-sponsored security and privacy controls assessment at each location wherein FRTIB information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of FRTIB. The FRTIB may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by FRTIB in the event of an incident or other circumstances indicating material non-compliance or urgent risk to agency information.

(h) FRTIB or TSP information systems that support processing, transmitting, or storing of

Agency data are to be used in support of FRTIB mission only. All data contained on FRTIB or TSP information systems in support of FRTIB is owned by the FRTIB and may be monitored, intercepted, recorded, read or captured.

(i) The Contractor shall provide the Government, or its authorized representatives, access to all Government data and

Government-related data, access to contractor personnel involved in the performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, investigations, inspections, or other similar activities, as authorized by law or regulation.

(j) Flow-down of requirements to subcontractors

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

(End Clause)

A.9 General Cybersecurity Compliance (Oct 2025)

Clause:

(a) Definitions. As used in this clause—

Error! Reference source not found.

Error! Reference source not found.

(b) The Contractor shall establish, implement, and maintain a comprehensive cybersecurity program that adheres to cybersecurity best practices and addresses the risks associated with the information systems and data used to perform this contract.

(c) The Contractor has no reasonable expectation of privacy while performing work in support of the contract on any

Agency information system that processes, transmits, or stores FRTIB data.

(d) All Contractors accessing a federal information system shall utilize a government-issued Personal Identity Verification

(PIV) card or another agency approved phishing-resistant authenticator.

(e) The contractor shall be responsible for properly protecting all information and data used, gathered, or developed as a result of work under this contract. All FRTIB information, data, and/or equipment shall only be disclosed to authorized personnel on a need-to-know basis in order to support the performance of the contract. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment shall be returned to the government. Disposition of this information shall be followed in accordance with the

A.3 Records Management Obligations clause and the current version of NIST SP 800-88, “Guidelines for Media

Sanitization.” The Contractor shall provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures

(f) The Contractor shall use Government-related data only to manage the operational environment that supports the

Government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting

Officer.

(g) The Contractor shall notify the Contracting Officer promptly of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contracting Officer to take all measures to protect Government data and Government-related data from any unauthorized disclosure.

(h) Flow-down of requirements to subcontractors including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

A.10 Cyber Incident Reporting (Oct 2025)

(a) Definitions. As used in this clause—

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses sensitive information (e.g., CUI, personally identifiable information, contract-sensible, etc.) or (2) an authorized user accesses or potentially accesses personally identifiable information for unauthorized purposes.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer databases or computer software documentation.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information. This system doesn’t receive an agency authorization.

“Controlled Unclassified Information (CUI)” means information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

• Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

• Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the confidentiality, integrity, or availability of information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers…