Attachment_1-_OPIC_Terms_and_Conditions.pdf

Attachment 1- OPIC TERMS AND CONDITIONS

CONTRACT ADMINISTRATION DATA AND SPECIAL CONTRACT REQUIREMENTS

CONTRACT MANAGEMENT

Notwithstanding the Contractor's responsibility for total management responsibility during the performance of the contract, the administration of the contract will require maximum coordination between the Government and the Contractor during performance of the contract.

CONTRACTING OFFICER'S AUTHORITY

The Contracting Officer (CO) will perform all contract administration. The CO is the only person with the authority to act as an agent of the U.S. Government under this contract and is the only person authorized to make or approve any changes in any of the requirements of this contract. Notwithstanding any provisions contained elsewhere in this task order contract, the said authority remains solely in the Contracting Officer.

In the event the Contractor makes any changes at the direction of any person other than the CO, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. Only the CO has the authority to: (1) direct or negotiate any changes in the SOW or PWS; (2) modify or extend the period of performance; (3) change the delivery schedule, (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

Trenescia Cowans is the Contracting Officer (CO) for this task order. Communications pertaining to contract administration matters shall be addressed to the CO. No changes in or deviation from the scope of the work shall be effected without a Supplemental Agreement (contract modification) executed by the CO authorizing such changes.

The Contracting Officer’s contact information is:

Trenescia Cowans U.S. Overseas Private Investment Corporation 1100 New York Ave, NW Washington, D.C. 21527 Phone: 202-336-8575 E-mail: TCowans@opic.gov

CONTRACTING OFFICER'S REPRESENTATIVE (COR)

TBD is hereby designated as the Contracting Officer's Representative (COR). The Government may change the COR at any time without prior notice to the Contractor by a unilateral modification to the Contract. The COR is located at:

TBD- Contracting Officer’s Representative U.S. Overseas Private Investment Corporation 1100 New York Ave, NW Washington, D.C. 21527 Phone: TBD E-mail: TBDClick here to enter text.

The responsibilities and limitations of the COR are as follows:

(1) The COR is responsible for the technical aspects of the project and serves as technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports, and such other responsibilities as may be specified in the task order contract.

(2) The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes, which affect the Contract price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the expressed prior authorization of the Contracting Officer.

The COR may designate assistant COR(s) to act for the COR by naming such assistant(s) in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

ADDITIONAL PROCEDURES FOR INVOICING

The invoice will be submitted to cover the full payment of the contract and in in accordance with the procedures listed below.

Send invoice electronically to the Government Official receiving supplies/services AND OPICDMAInvoices@opic.gov. If there is not Contracting Officer’s Representative listed in this section, check the schedule for Government Official point of contact information.

The Federal Register, Page 52591, Volume 64, No. 188, dated September 29, 1999, requires that submitted invoices must include specific information in order for the Government to make payment.

Additionally, the Overseas Private Investment Corporation has supplemented these requirements.

Contractors may use Standard Form 1034 – Public Voucher for Purchases and Services Other than Personal (Part 53 of the Federal Acquisition Regulation under FAR 53-301-1034) or they may submit a company-generated voucher. However, no matter what type of voucher is submitted, it must contain the information described below.

PROPER INVOICE INFORMATION

• Name and Address of Contractor

• Contact Name, Title and Telephone Number

• Government Issued Contract Number

• Date of the Invoice

• Invoice Number, Account Number, and/or any other identifying number agreed to by the contract (At a minimum there must be an invoice number)

• Include the Actual date when services were performed or goods delivered.

• Include the Period of Performance on all invoices.

• Description – Including, for example, contract line/subline number, price, and quality of goods and services rendered.

• Include discount terms.

• Other substantiating documentation or information required by the contract.

SECURITY

The contractor shall comply with all contractual and Federal information security and privacy requirements applicable to the operation, maintenance, or support of a Federal information system. The contractor shall prevent and remedy data breaches and provide OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to mailto:OPICDMAInvoices@opic.gov.

satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs.

A. Contractor information systems subject to the Federal Information Security Management Act of 2002 (FISMA). All agency information systems, see 44 U.S.C. 3505(c), operated by or on behalf of the Government by a Contractor or subcontractor containing Federal data are subject to the requirements of FISMA, including routine testing without advance notice to or approval of the Contractor or its subcontractors. See 44 U.S.C 3544(b).

i. For all services acquisitions (including cloud services):

PROTECTION OF INFORMATION

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information as sensitive. All information about the systems gathered or created under this contract should be considered as Sensitive but Unclassified (SBU) information. It is anticipated that this information will be gathered, created, and stored within the primary work location. If contractor personnel must remove any information from the primary work area, they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

The data that is processed and stored by the various applications within the OPIC network infrastructure contains financial data as well as personally identifiable information (PII). This data and PII shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

SECURITY CLASSIFICATION

The preparation of the deliverables in this contract will be completed at a SBU level.

SECURITY DOCUMENTATION

The contractor shall provide documentation describing the functional properties of the security controls employed within the information system, its components, or services.

ii. Cloud-Based Systems:

Contractor shall be responsible for the following privacy and security safeguards:

a. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

b. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

c. The contractor shall also comply with any additional FedRAMP privacy requirements.

d. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, contractor shall be responsible for the following privacy and security safeguards:

i. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within XX hours. (FedRAMP recommends 72 hours) The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Authenticated and unauthenticated database application vulnerability scans

• Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

iii. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided, in full, to the Government.

FEDRAMP SECURITY COMPLIANCE REQUIREMENTS:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low and moderate impact system (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. While the FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

ASSESSMENT AND AUTHORIZATION:

OPIC may choose to cancel the Contract and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

AUTHORIZATION OF SYSTEM:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct on-site inspections.

The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

iii. Non-Cloud-Based, Contractor-Owned Systems and Services:

REQUIRED POLICIES AND REGULATIONS FOR OPIC CONTRACTS:

Contractors entering into an agreement for services to OPIC and/or its Federal customers shall be contractually subject to all OPIC and Federal IT Security standards, policies, and reporting requirements. The contractor shall meet and comply with all OPIC IT Security Policies and all applicable OPIC and NIST standards and guidelines, other Government-wide laws and regulations for protection and security of Information Technology.

Contractors are also required to comply with Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of

FISMA.

OPIC SECURITY COMPLIANCE REQUIREMENTS

FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”, is a mandatory federal standard that defines the minimum security requirements for federal information and information systems in seventeen security-related areas. Contractor systems supporting OPIC must meet the minimum security requirements through the use of the security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), and “Recommended Security Controls for Federal Information Systems.

NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with OPIC specifications. The OPIC-specified control parameters and supplemental guidance defining more specifically the requirements per FIPS 199 impact level are provided in Appendix A, of this document.

SYSTEM ASSESSMENT DOCUMENTATION

a. At the Moderate impact level and higher, the contractor or Government (as determined in the contract) will be responsible for providing an independent Security Assessment/Risk Assessment.

b. Identified gaps between required 800-53 controls and the contractor’s implementation as documented in the Security Assessment/Risk Assessment report shall be tracked for mitigation in a Plan of Action and Milestones (POA&M) document.

c. The Contractor is responsible for mitigating all security risks found during C&A and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

A. Handling of third-party requests for access to records. In the event that the Contractor receives any subpoena or other voluntary or mandatory request for access to data first produced under this Contract, the Contractor shall immediately notify the COR and the CO, so that the Government may intervene or take any other steps it deems necessary to protect its interests.

B. Data Breaches. As part of the requirement explained elsewhere in this document for the contractor to comply with all contractual and Federal information security, privacy, and confidentiality requirements applicable to the operation, maintenance or support of a Federal information system, the contractor shall be required to prevent and remedy data breaches and to provide the OPIC with all necessary information and cooperation, and to take all other reasonable and necessary steps and precautions, to enable the OPIC to satisfy its data breach reporting duties under applicable law, regulation, or policy in the event, if any, that a breach occurs. Special attention should be paid to OMB Memorandum 06-19 (July 12, 2006), particularly the extremely urgent reporting time frames included therein for certain breaches, as well as to any other subsequent laws, regulations, or policy governing data breaches that may arise during the performance of the contract. The Information System Security Plan required elsewhere in this document shall include policies and procedures necessary to ensure the timely detection of and reporting to the OPIC of data breaches, as well as safeguards to prevent and mitigate the risk of, as well as to remedy, such breaches, if any.

(3) Use of OPIC computer equipment by contractors is limited to what is necessary to accomplish the work identified under the contract. All contractors or his/her employees or subcontractors are subject to Internet access monitoring and auditing, and discoveries of inappropriate internet access or activity not directly related to the contract, will be reported to the COR and CO, and the contractor shall be held in default of the contract. Contractors or his/her employees or subcontractors found accessing inappropriate web sites while using an OPIC computer, may be grounds for initiating disbarment procedures.