Attachment_2-_OPIC_Terms_and_Conditions.pdf

Attachment 2 1

ATTACHMENT 2 -CONTRACT ADMINISTRATION DATA AND

SPECIAL CONTRACT REQUIREMENTS

CONTRACT MANAGEMENT

Notwithstanding the Contractor's responsibility for total management responsibility during the performance of the contract, the administration of the contract will require maximum coordination between the Government and the Contractor during performance of the contract.

CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer (CO) will perform all contract administration. The CO is the only person with the authority to act as an agent of the U.S. Government under this contract and is the only person authorized to make or approve any changes in any of the requirements of this contract. Notwithstanding any provisions contained elsewhere in this task order contract, the said authority remains solely in the Contracting Officer.

In the event the Contractor makes any changes at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. Only the CO has the authority to: (1) direct or negotiate any changes in the SOW or PWS; (2) modify or extend the period of performance; (3) change the delivery schedule, (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

Emily McLaughlin is the Contracting Officer (CO) for this task order. Communications pertaining to contract administration matters shall be addressed to the CO. No changes in or deviation from the scope of the work shall be effected without a Supplemental Agreement (contract modification) executed by the CO authorizing such changes.

The Contracting Officer’s contact information is:

Emily McLaughlin U.S. Overseas Private Investment Corporation 1100 New York Ave, NW Washington, D.C. 21527 Phone: 202-336-8549 E-mail: Emily.McLaughlin@opic.gov

CONTRACTING OFFICER'S REPRESENTATIVE (COR)

TBD is hereby designated as the Contracting Officer's Representative (COR). The Government may change the COR at any time without prior notice to the Contractor by a unilateral modification to the Contract. The COR is located at:

TBD - Contracting Officer’s Representative U.S. Overseas Private Investment Corporation 1100 New York Ave, NW Washington, D.C. 21527 Phone: TBD E-mail: TBD

The responsibilities and limitations of the COR are as follows:

a. The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and such other responsibilities as may be specified in the task order contract.

Attachment 2 2

b. The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes, which affect the Contract price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR.

No such changes shall be made without the expressed prior authorization of the Contracting Officer. The COR may designate assistant COR(s) to act for the COR by naming such assistant(s) in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

ADDITIONAL PROCEDURES FOR INVOICING

Invoices are required by the 5th day following contract performance.

The Federal Register, Page 52591, Volume 64, No. 188, dated September 29, 1999, requires that submitted invoices must include specific information in order for the Government to make payment. Additionally, the Overseas Private Investment Corporation has supplemented these requirements. Contractors may use Standard Form 1034 – Public Voucher for Purchases and Services Other than Personal (Part 53 of the Federal Acquisition Regulation under FAR 53-301-1034) or they may submit a company-generated voucher. However, no matter what type of voucher is submitted, it must contain the information described below.

It must be especially noted that in accordance with the requirements set forth in FAR Clause 52.232-7 – Payments under the Time and Materials and Labor Hour Contracts, all invoices/vouchers submitted for payment shall be accompanied by individual daily job timecards/sheets or other substantiation previously approved by the Contracting Officer. Vouchers/invoices received without the substantiating documents will be considered incomplete, and will be returned to the Contractor without payment. Invoices shall be submitted monthly.

If the voucher/invoice is for services on a time and materials and labor hour basis, the COR’s copy of the voucher/invoice must have copies of the timesheets or other substantiation attached, and must be clearly marked “COR’s Copy”. The second set of the two sets of a voucher/invoice does not require that the timesheets or other substantiation be attached. However, it must be clearly marked “Original for Finance”.

Both copies must be submitted to the COR.

PROPER INVOICE INFORMATION

• Name and Address of Contractor

• Contact Name, Title and Telephone Number

• Government Issued Contract Number or Other Authorization for Delivery of Goods or

Services

• Date of the Invoice

• Invoice Number, Account Number, and/or any other identifying number agreed to by the contract (At a minimum there must be an invoice number)

• Include the Actual date when services were performed or goods delivered.

• Include the Period of Performance on all invoices.

• Description – Including, for example, contract or task order line/subline number, price, and quality of goods and services rendered.

• Include discount terms.

• Other substantiating documentation or information required by the contract.

• Shipping and Payment Terms (Required unless mutually agreed that this information is only required in the contract – Contact the Contracting Officer or Contract Specialist

Attachment 2 3 for clarification)

INVOICE RECIPIENTS

Send invoice electronically to the Government Official receiving supplies/services COR- TBD.

TRAVEL REQUIREMENT

Travel by the Contractor is anticipated for this requirement. Should the Government determine that travel is necessary, the required authorization for travel will be provided by the Contracting Officer, the appointed

COR.

PREAUTHORIZATION FOR TRAVEL

Travel shall not be undertaken without authorization. If travel is authorized, OPIC will only reimburse the Contractor for actual travel costs incurred during the authorized travel period. Profit/Fee shall not be applied to travel costs or per diem, and is not allowable under this contract. Handling rates shall not be applied to travel costs.

When travel is authorized, the Contractor shall provide estimated travel costs to the authorizer in advance of scheduling travel. Requests for travel must include the following information:

a. Name of traveler;

b. Dates of travel;

c. Destination(s);

d. Purpose of travel;

e. Estimated transportation costs;

f. Estimated lodging expense;

g. Estimated meals and incidental expenses; and

h. Other expenses.

TRAVEL COST REIMBURSEMENT LIMITATIONS

All travel shall be performed in accordance with Government travel regulations. The Government will reimburse travel expenses at actual cost, in accordance with limitations equivalent to those set forth in the Federal Travel Regulations (FTR). Unless authorized by the Contracting Officer, reimbursement of lodging, meals and incidental expenses will not exceed the applicable rates set forth in the FTR for the travel destinations.

TRAVEL SECURITY CONDITIONS AND REPORTING

a. The Contractor must remain vigilantly aware of security conditions while traveling for OPIC, and by entering into a contract, assumes full responsibility for the safety of its employees. Prior to commencing work, the Contractor must ensure that it has adequate procedures in place to advise its employees of situations or changed conditions that could adversely affect their security.

b. The Contractor acknowledges that security conditions are subject to change at any moment, that OPIC cannot guarantee the accuracy of any information that it may provide to the Contractor and that OPIC assumes no responsibility for the reliability of such information. The Contractor has sole responsibility for approving all travel plans for its employees. The Contractor is also responsible for immediately notifying OPIC and the U.S. Embassy American Citizen Services section in the event a U.S. citizen employee does not return from travel as expected or does not report to work.

c. LIFE SUPPORT AND SECURITY SERVICES. The Contractor is responsible for maintaining the security of its personnel, materials and equipment. All employees of the Contractor must meet the requirements of their work-site, which may include, but not limited to background

Attachment 2 4 checks, security/restricted area clearances, drug-free workplace, safety training and/or any other company safety and security requirements.

d. The Contractor shall report any security threats and/or incidents verbally / by telephone, immediately to the nearest United States Embassy.

i) Subsequently, a written report shall be submitted through the Contracting Officer’s Representative (COR) to OPIC Office of Security, Continuity, and Emergency Preparedness.

The Contractor shall develop a list of specific steps to track any potential/identified threats, which will be part of its overall security system.

SECURITY AND MEDICAL EVACUATION SERVICE COVERAGE

a. Contractors must provide medical evacuation service coverage to all U.S. citizen, U.S.

resident alien, and Third Country National employees and their authorized dependents (hereinafter “individual”) while overseas under an OPIC-financed direct contract. OPIC will reimburse reasonable, allowable, and allocable costs for medical evacuation service coverage incurred under the contract. The Contracting Officer will determine the reasonableness, allowability, and allocability of the costs based on cost principles and cost accounting standards, if applicable.

b. Contractor must insert a clause similar to this clause in all subcontracts that require performance by Contractor employees overseas.

RESTRICTIONS AGAINST DISCLOSURE

The Contractor agrees, in the performance of this contract, to keep in strict confidence the information furnished by the Government and designated by the Contracting Officer or Contracting Officer's Representative as non-public OPIC materials and information. The Contractor also agrees not to publish or otherwise divulge such information in whole or in part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the Contractor's possession, to those employees needing such information to perform the work provided herein, i.e., on a need to know basis. The Contractor agrees to immediately notify the Contracting Officer in writing in the event that the Contractor determines or has reason to suspect a breach of this requirement.

The Contractor agrees that it will not disclose any information described in paragraph 1 of this section to any persons or individual unless prior written approval is obtained from the Contracting Officer. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

DUPLICATION OF EFFORT

The Contractor hereby certifies that costs for work to be performed under this contract and any subcontract hereunder are not duplicative of any cost charged against any other Government contract, subcontract, or other Government source. The Contractor agrees to advise the Contracting Officer, in writing, of any other Government contract or subcontract it has performed or is performing which involves work directly related to the purpose of this contract. The Contractor also certifies and agrees that any and all work performed under this contract shall be directly and exclusively for the use and benefit of the Government, and not incidental to any other work, pursuit, research, or purpose of the Contractor, whose responsibility it will be to account for it accordingly.

KEY PERSONNEL

Contractor personnel assigned to the following key positions are considered Key Personnel and are subject to paragraphs b and c of this section:

a. The following positions are considered key positions:

Attachment 2 5

Project Manager

Developer Quality Assurance Tester

b. The Contractor shall obtain the consent of the Contracting Officer prior to making Key Personnel

Substitutions. Replacement for Key Personnel must possess qualifications equal to or exceeding the qualifications of the key personnel being replaced specified. The Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

c. Requests for changes shall be submitted to the Contracting Officer at least 15 working days prior to making any permanent substitutions. The request should contain a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. The Contracting Officer will notify the Contractor within 10 working days after receipt of all required information of the decision on substitutions. The contract will be modified to reflect any approved changes.

REGULATORY NOTICE

Contractors are advised that certain provisions and clauses identified throughout this contract are not FAR provisions or clauses; however, all of these items are binding for this acquisition.

NOTIFICATION OF INTENT TO SUBCONTRACT

As required in FAR 44.201-1, the Contractor shall notify the Contracting Officer of its intent to subcontract any portion of the contract requirements. The Government reserves the right to recommend potential sources for subcontracts to whom solicitations must be mailed during the performance of this contract.

SECURITY

CONTRACTOR PERSONNEL SECURITY/ SUITABILITY CLEARANCE REQUIREMENTS

All contract personnel who will have access to United States Overseas Private Investment Corporation data or websites shall have an Overseas Private Investment Corporation approved background investigation prior to gaining access to the Overseas Private Investment Corporation (per the standards in 5 CFR Part 731). Overseas Private Investment Corporation approved background investigations may include the Applicant Name Check, the National Agency Check and Inquiry (NACI), Special Agreement Check (OFI- 86C), and/or other Overseas Private Investment Corporation approved previous investigation(s). Personnel and Physical security contract employees must be able to obtain and maintain a favorable fitness / suitability determination.

Should the Contracting Officer or designee receive an unsuitable report on any contract employee as a result of processing the required forms, or should an existing employee under this contract become unsuitable or unfit for assigned duties in this regard, the Contractor will be advised by the Government that such employee cannot be assigned to work or continue to work under the contract. The Contractor shall immediately remove any such employee and begin the process to replace him/her with a suitable substitute.

Potential contract employees who have previously had their suitability determined may not need to submit forms, pending verification to the Overseas Private Investment Corporation by the prior Government agency or unless one (1) calendar year or more has elapsed since they last started work. These potential contract employees shall, however, submit, in lieu of Overseas Private Investment Corporation required paperwork and prior to employment, a statement on the prior agency’s letterhead that they have a current suitability determination. In addition to being submitted on the respective agency's letterhead, the statement

Attachment 2 6 shall also list the following: Full Name, Social Security Number, Date of Birth, and a Point-of-Contact, including an up-to-date telephone number, contract number(s), and performance dates for contracts on which they have or are currently participating, which required such a determination.

Proposed OPIC Contractor staff may be required to complete the following:

a. Personal Identification Verification (PIV) Online Training

b. I-9 Form, Employment Eligibility Verification

c. SF-85, Questionnaire for Non-Sensitive Positions

d. Fingerprints

e. OF-306, Declaration for Federal Employment

CONTRACTOR PERSONNEL ISSUES

Should the Contractor become aware of Contractor personnel issues, including poor performance, misconduct, or any other event in which employee impending resignation or termination becomes known, the Contractor shall notify OPIC immediately or 48 hours in advance, whichever comes first. Notification shall be sent via email to the COR and ContractorPersonnel@opic.gov. In the event of termination, the Contractor will notify OPIC before notifying the employee and conduct the termination off-site whenever possible. If requested, the Contractor will provide OPIC with an incident report detailing the events which led to the employee’s departure or termination.

INFORMATION SECURITY

The Contractor shall comply will all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system. The contractor shall be required to prevent and remedy data breaches and to provide OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

c. Contractor information systems subject to the Federal Information Security Management Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data shall be subject to the requirements of the FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

d. For all services acquisitions (including cloud services):

PROTECTION OF INFORMATION

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The Contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as SBU information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If Contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The Government will retain unrestricted rights to Government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

mailto:ContractorPersonnel@opic.gov

Attachment 2 7

The data that is processed and stored by the various applications within the network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The Contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The Contractor shall provide requested data at no additional cost to the Government.

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

e. SECURITY CLASSIFICATION The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

f. SECURITY DOCUMENTATION The Contractor shall provide documentation describing the functional properties of the security controls employed within the information system, its components, or services.

i. For Cloud-based systems:

Contractor shall be responsible for the following privacy and security safeguards:

1. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

2. If new or unanticipated threats or hazards are discovered by either the Government or the

Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

3. The Contractor shall also comply with any additional FedRAMP privacy requirements.

4. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, Contractor shall be responsible for the following privacy and security safeguards:

a. The Contractor shall not publish or disclose in any manner, without the Contracting

Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

b. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government

Attachment 2 8 data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include, but is not limited to:

-Authenticated and unauthenticated operating system/network vulnerability scans -Authenticated and unauthenticated web application vulnerability scans -Authenticated and unauthenticated database application vulnerability scans

c. Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

d. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

5. FedRAMP Security Compliance Requirements:

The Contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The Contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the Contractor shall use generally accepted industry best practices for IT security.

6. Assessment and Authorization:

(Agency) may choose to cancel the (Contract/award) and terminate any outstanding orders if the Contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

7. Authorization of System:

The Contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct on-site inspections. The Contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

ii. Other than Cloud-based Contractor-Owned Systems and Services:

1. Required Policies and Regulations for OPIC Contracts

Contractors entering into an agreement for services to OPIC and/or its Federal customers shall be contractually subject to all OPIC and Federal IT Security standards, policies, and reporting

Attachment 2 9 requirements. The Contractor shall meet and comply with all OPIC IT Security Policies and all applicable OPIC and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are also required to comply with Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of FISMA.

2. OPIC Security Compliance Requirements FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting OPIC must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), and “Recommended Security Controls for Federal Information Systems.”

NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with OPIC specifications. OPIC-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS 199 impact level are provided in Appendix A, of this document (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf).

3. System Assessment Documentation

a. At the Moderate impact level and higher, the Contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment.

b. Identified gaps between required 800-53 controls and the Contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

c. The Contractor is responsible for mitigating all security risks found during C&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

g. HANDLING OF THIRD-PARTY REQUESTS FOR ACCESS TO RECORD

In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

h. DATA BREACHES

As part of the requirement explained elsewhere in this document for the Contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the Contractor shall be required to prevent and remedy data breaches and to provide OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data

Attachment 2 10 breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to OPIC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

As part of the requirement explained elsewhere in this document for the Contractor to comply with all contractual and Federal information security, privacy and confidentiality requirements applicable to the operation, maintenance or support of a Feder...