RFP-9531CB23R0001.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

541612

SIZE STANDARD:

100.00 % FOR:SET ASIDE:UNRESTRICTED ORCFP

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

10/28/2022 1700 ET

10/11/2022

MARCUS WHALEY

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

9531CB23R0001

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 216 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

WASHINGTON DC 20552

1700 G STREET, NW

OFFICE OF PROCUREMENT

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$16.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Consumer Financial Protection Burea

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

X

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Solicitation for EEO Investigation Services - Blanket Purchase Agreement establishment Period of Performance: 12/01/2022 to 11/30/2023

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

VANESSA DEL TORO

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

216 2 of

CONSUMER FINANCIAL PROTECTION BUREAU

WASHINGTON, DC 20552

Date: October 11, 2022

The Consumer Financial Protection Bureau (CFPB or “the Bureau”) seeks to establish a Blanket Purchase Agreement (BPA) to obtain investigative services during the formal phase of the EEO formal complaint process, as required by 29 CFR §§1614.106, 1614.108, 1614.204, the EEOC’s Management Directive 110, and as further specified in Appendix A (CFPB SOP for Investigations) or other CFPB-specific guidance provided.

This is a combined synopsis and solicitation. This Request for Proposals (RFP) is issued per Federal Acquisition Regulations (FAR) Part 12 and Part 13. Per the guidelines discussed herein, CFPB requests that you provide a response to this RFP.

Based upon the evaluation of Proposals received in response to this Request for Proposals (RFP), the Bureau intends to issue a single award but reserves the right to make no awards. Offerors must be able to meet the minimum requirements as specified in this RFP. Please note that this procurement is set aside for 8(a) certified small business. Other than 8(a) small business will not be considered for award.

Questions concerning this RFP must be submitted by e-mail to Vanessa.delToro@cfpb.gov and Marcus.Whaley@cfpb.gov by 10:00 a.m. Eastern Time (ET) on October 14, 2022.

Responses (Proposals) to this RFP should be received by Vanessa.delToro@cfpb.gov no later than 3:00 p.m. ET on October 28, 2022. Proposals received after that date and time may not be opened, evaluated, or considered for award.

We appreciate your taking the time to provide us with a proposal for these services.

Sincerely, Vanessa del Toro Contracting Officer mailto:Vanessa.delToro@cfpb.gov mailto:Marcus.Whaley@cfpb.gov mailto:Vanessa.delToro@cfpb.gov

RFP: 9531CB23R0001

Office of Civil Rights - EEO Investigation Support Services

TABLE OF CONTENTS

A. PERFORMANCE OBJECTIVES

B. PERFORMANCE WORK STATEMENT

C. SPECIAL TERMS AND CONDITIONS

D. EVALUATION OF PROPOSALS – INSTRUCTIONS TO OFFERORS

E. ATTACHMENTS

ATTACHMENT 1: BUREAU CLAUSES

ATTACHMENT 2: PRICING WORKSHEET

ATTACHMENT 3: QUESTIONS FORMAT

ATTACHMENT 4: CONTEXT AND BACKGROUND FOR TYPICAL INVESTIGATIONS

ATTACHMENT 5: PAST PERFORMANCE QUESTIONNAIRE

ATTACHMENT 6: EEO OPERATIONS MANUAL

3 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

SECTION A – Performance Objectives

1.0 OBJECTIVE. The purpose of this requirement is to procure contractor services to conduct EEO investigations in accordance with 29 C.F.R. §§1614.106-1614.108 and

MD-110.

This is a non-personal services contract to provide Labor Relations Investigations services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Labor Relations Investigations Services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

The awarded vendor shall conduct necessary and appropriate investigations into, and prepare Reports of Investigations (ROI) for, complaints of discrimination and retaliation Investigations are conducted timely

2.0 BACKGROUND.

The Consumer Financial Protection Bureau (CFPB) is a 21st century agency that helps make markets for consumer financial products and services work for Americans

— whether they are applying for a mortgage, choosing among credit cards, or using any number of other consumer financial products. The CFPB is committed to a work environment that promotes fairness and equality of opportunity for everyone — employees and job applicants — on the basis of merit and without regard to race, color, religion, sex (including pregnancy, sexual orientation, transgender status, gender identity or expression, gender non-conformity, or sex stereotyping of any kind), national origin, disability, age, genetic information, prior Equal Employment Opportunity (EEO) activity, parental status (collectively, “EEO bases”), and other federally protected bases. The CFPB categorically prohibits unlawful discrimination (including discriminatory harassment and retaliation) in the workplace.

CFPB wishes to provide a neutral and impartial forum for employees, former employees, eligible contractors, or applicants for employment to lodge complaints of discrimination based on any one or more of the protected EEO bases identified above.

Pursuant to 29 Code of Federal Regulations (C.F.R.) §1614.104, the Equal Employment Opportunity Commission’s (EEOC’s) Management Directive 110 (MD-

110) and related guidance, the CFPB is required to provide Counselees access to pre-complaint counseling and an alternative dispute resolution program, offering the

4 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552 parties an opportunity for an early resolution of disputes in a mutually satisfactory fashion. If the parties fail to reach a resolution, the Counselee may file a formal complaint of discrimination. The CFPB is required to investigate the complaint of discrimination in accordance with 29 C.F.R. §§1614.106-1614.108 and MD-110.

Additionally, CFPB may occasionally require investigation of claims brought under sections 504 and 508 of the Rehabilitation Act of 1973, which prohibits discrimination on the basis of disability in programs or activities conducted by the Bureau, and requires the Bureau to meet the accessibility standards for electronic and information technology.

The CFPB has an in-house investigator, but at times the workload is too heavy for one investigator. In addition, our in-house investigator cannot process cases that represent conflicts of interest for the CFPB’s Office of Civil Rights (OCR). CFPB is establishing a Blanket Purchase Agreement for formal EEO Investigation services and 504/508 investigations to maximize efficiency and standardization of approach in each investigation for which contractor investigative services are required.

3.0 PERFORMANCE WORK STATEMENT

Scope: The scope of CFPB requirements includes conducting necessary and appropriate investigations and prepare ROIs into complaints of discrimination over which the EEOC has jurisdiction, and which are filed by employees, former employees, eligible contractors, or applicants for employment who allege discrimination based on race, color, religion, sex (including pregnancy, sexual orientation, transgender status, gender identity or expression, gender non-conformity, or sex stereotyping of any kind), national origin, disability, age, genetic information, or any other basis over which CFPB has jurisdiction. It also includes complaints of retaliation based on prior Equal Employment Opportunity (EEO) activity and complaints of discrimination or retaliation based on sexual orientation, gender identity, or parental status under applicable Executive Orders. It also includes complaints of violations of sections 504 and/or 508 of the Rehabilitation Act, which prohibits discrimination on the basis of disability in programs or activities conducted by the Bureau and requires the Bureau to meet the accessibility standards for electronic and information technology.

EEO investigative services shall be performed in accordance with the regulations of the Equal Employment Opportunity Commission (EEOC) as set forth at in the most recent version of 29 C.F.R. Part 1614; EEOC Management Directive 110 (MD-110);

CFPB requirements; and any applicable law, statute, regulation, Executive Order, EEOC guidance, directive, or bulletin pertaining to the alleged discrimination.

5 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

Specific details on mandatory services, deliverables, and qualification requirements are included in Attachment 1 (CFPB SOP for Investigations).

Investigations shall conduct a thorough, impartial, and appropriate inquiry of the circumstances under which the alleged discrimination in employment occurred, and gather all relevant evidence (declarations/affidavits, documents, comparative evidence, statistical evidence etc.) from which the trier of fact is able to determine whether or not any violation of EEO laws/authorities occurred, and, where appropriate, evidence regarding the appropriate remedy/relief that may be appropriate or necessary. By gathering the relevant information and documentation, the EEO Investigator plays a critical role in helping prepare the factual record in a Part 1614 (or related) matter.

Investigators must be (and must maintain the appearance of being) unbiased, thorough, and objective. Investigators must always be neutral in their approach to developing the facts of the claims at issue and must never present the appearance or suggestion of promoting either the agency’s or the complainant’s position.

CFPB expects a constant workload, but may experience case surges at times which could require the vendor to be actively working on multiple cases simultaneously, which may require the vendor to assign sufficient investigative staff to process multiple cases simultaneously. Rather than assigning any available investigator to a particular task order, CFPB requires the Contractor to assign the same contractor staff to perform all CFPB work wherever possible, with the goal of having the smallest number of individual contractor staff necessary to handle CFPB caseload. Doing so will create a cadre of contractor staff with institutional knowledge of CFPB and OCR specific processes, which will aid efficiency and the quality of CFPB investigations.

Investigative services must be completed in the specific manner including the specific deliverables and within the deadlines detailed in CFPB’s Standard Operating Procedures for Investigations (Appendix A).

CFPB generally uses written interrogatories in lieu of in-person interviews. Many CFPB staff work remotely, telework, or work outside of the metropolitan Washington, D.C. area and phone, videoconferencing, and/or email communications in these instances are permissible so long as bargaining unit notification protocols are followed. If an interview is conducted via phone or videoconferencing, investigators will be expected to transcribe responses to questions asked and allow the witness sufficient time to review, correct, and supplement responses.

3.1 Specific Tasks:

• Create a detailed Investigative Plan (based on format provided).

o Investigative Plans (Ips) must accurately and thoroughly set out the applicable evidentiary framework and legal standards under federal-sector EEO guidance and case law with respect to each accepted claim to be

6 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552 investigated. This may require conducting relevant legal research to ensure the most current legal standards are used. Ips must be thorough and detailed, delineating each witness the investigator expects to interview and specifying all questions the investigator intends to ask each witness (including relevant questions about remedies/damages). Questions should be easy to understand, avoid compound inquiries, and seek to uncover directly the evidence needed. Ips must detail all other evidence and documents the investigator intends to request, and such evidence to be sought must be comprehensive and exhaustive (taking into account the nature of the relevant claims). Ips must be submitted for review by OCR within seven calendar (7) days of the date the investigator is assigned to the matter. Ips must be amended and re-submitted for OCR review as revised within three calendar (3) days of each complaint amendment accepted, or in light of evidence gathered that requires changes in scope of questions, documents needed, witnesses needed to be interviewed, or overall investigative strategy.

• Pursue all relevant evidentiary leads and may not refuse to interview relevant witnesses or gather relevant facts due to expediency. Relevancy must be broadly construed to ensure a thorough investigation. At the same time, all investigations shall be conducted and completed within all regulatory timeframes relayed by OCR staff.

• Document all contact of witnesses and will be required to annotate a witness’s failure to cooperate. When arranging interviews, the interviewee must be informed that they may request a reasonable accommodation, within the meaning of the Rehabilitation Act, for that process if needed.

• Create Letters of Authorization for complainant, responding management officials, and witnesses.

• Create detailed affidavits with questions for complainant, responding management officials, and witnesses.

• Create supplemental affidavits (when required) for complainant, responding management officials, and witnesses.

• Review draft affidavits and update with additional questions, as needed.

• Create a legally sufficient ROI to include the following:

o The ROI must be in digital/electronic format, organized and text searchable, and exhibits must be tabbed and labeled (according to all specifications contained in MD-110); pages must be numbered, and the ROI must be legible and clear.

o The ROI must include a relationship-of-affiants chart (an organizational chart), workforce profile information, any denials for official time requested as part of the EEO investigation, and any concerns from Complainant about the processing of this complaint.

o The ROI must contain digitally signed (or “wet” signature) and dated affidavits from complainant, all responding management officials, and all witnesses.

7 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552 o The affidavits must cover the necessary information for a fact finder to be able to make a determination regarding whether or not unlawful discrimination occurred.

o The ROI must contain a summary that sufficiently summarizes the evidence collected for each issue investigated, describe the applicable theory or theories of discrimination raised in the complaint, accurately capture Complainant’s alleged issues and bases and supporting evidence, and accurately capture any reasons that management articulated for its actions, as well as all rebuttal information provided from any witnesses.

o The ROI must include evidence that addresses each element of the relevant claim(s), as will vary depending upon the relevant theories of discrimination at issue.

o ROIs must contain a section summarizing all the testimony and evidence in the record – not just select affidavits or exhibits. The summary must be organized by each claim accepted and must identify and note any and all relevant evidence in the record related to each element of each claim or defense at issue, and specify the specific Exhibit Number in the ROI and page number where the relevant evidence appears. All documents in the ROI will be identified by an Exhibit Number. An Investigator’s Declaration may be necessary to include.

• Provide a redacted version of the ROI and a non-redacted version. Investigators must complete and compile final ROIs within sufficient time to enable OCR to review the ROI and provide feedback before the ROI is finalized. This is consistent with best practices outlined in the EEOC’s Management Directive 110, Chapter 6, Section X.

• In accordance with MD-110, if requested - Provide a physical copy of the redacted ROI to Complainant and/or their representative. The physical copy of the ROI will meet all of the requirements of MD-110, and the cost of the creation of the physical ROI will be covered by the investigator under “supplies” mentioned in Section 1.1 above.

• Provide updates to OCR personnel/case managers to ensure the investigation begins on time and remains on track to meet all interim deadlines. Investigators must consult or meet with the applicable OCR case manager (or designee) at least once a week regarding investigation status, timelines, issues/problems, etc. OCR expects a typical weekly check-in to last 30-60 minutes. The Investigator is responsible for scheduling the meetings, creating the agenda for the check-in, and alerting the OCR Director if OCR personnel are not attending the check-ins.

• For cases that are not a conflict of interest- Provide OCR case managers with affidavits and exhibits after the investigator has reviewed them but prior to finalization, during the course of the investigation, to enable the OCR case manager to review and provide feedback and provide follow-up topics/questions and suggestions regarding additional documentation, comparative evidence, statistical evidence and/or witnesses, as needed, which may then require an amendment to the

8 CONSUMER FINANCIAL PROTECTION BUREAU (CFPB), 1700 G STREET, NW WASHINGTON, DC 20552

Investigation Plan. Investigators must agree to work with OCR case managers in good faith to gather any and all testimony and other evidence deemed necessary by

OCR.

• For cases that are not conflict of interest - Copy the appropriate case manager on all emails sent and received between the Investigator and witnesses and other Bureau personnel, for cases that are not conflict of interest.

• Conduct work during core hours of 10:00 a.m. to 2:00 p.m. Typical hours may be amended based on business needs (e.g., interviews will employees in a different time zone).

• Notify to the Bargaining Unit prior to contacting witnesses for substantive in-person interviews pursuant to OCR procedures. The OCR case manager will provide the investigator with all relevant protocols and requirements for providing such notice.

• Demonstrate excellent attention to detail and provide draft and final work products free from any grammatical and typographical errors. All emails, letters, memos, and other deliverables prepared by the investigator (including IPs, written interrogatories presented to witnesses, and ROIs) must be proofread for clarity and completeness before issuance, and be free from any grammatical or typographical errors. In addition, all materials must be organized well (using headings and sub-headings as needed) and written in plain language to aid ease of understanding for the reader.

• Complete all deliverables using any templates/samples provided by OCR, which may be updated during the course of the BPA period.

• ave the technological capability to provide electronic (e.g., PDF) versions of all documents and in the format specified in the EEOC’s Management Directive 110 (e.g., at Chapter 6 Section VIII) or by OCR, and to receive and send encrypted emails containing large attachments.

• Protect Information - Protection of personally identifiable information (PII) and confidential information is of the utmost importance to OCR. The investigator must follow all protocols and requirements for safeguarding PII and other confidential information. Vendors and investigators must redact confidential supervisory information, confidential investigative information, confidential consumer complaint information and PII from a version of all deliverables (e.g., IPs and ROIs). OCR will provide guidance as needed. Vendors/investigators must provide a key with all deliverables containing redacted information to explain any redacted information.

• Certify that all electronic copies of deliverables (e.g., ROIs) match precisely the hard copies provided, and that each page of the electronic version of the deliverable is present and paginated with the same number in corresponding hard copies.

• All deliverables shall be accessible and 508 compliant. (See Universal Access and Design clause in Attachment 1).

• Fill out any form provided by OCR to facilitate proper and accurate No FEAR Act, Form 462, or other reporting of complaints-processing data.

• Agree never to perform investigation work as a contractor for any other CFPB office, including, for example, management inquiries conducted by the Office of Human

Capital or the Legal Division to avoid conflicts of interest or the appearance of conflicts of interest.

5.0 KEY PERSONNEL.

The following personnel are considered Contract Key Personnel by the government:

Contract Manager; and Investigators

The Contractor shall provide a Contract Manager who shall be responsible for the performance of the work and who shall serve as a central point of contact for all contract issues. The name of this person and an Alternate, who shall act for the Contractor when the Contract Manager is absent, shall be designated in writing to the Contracting Officer. The Contract Manager or Alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The Contract Manager or Alternate shall be available between 9:00 am to 5:00 pm Local Time Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

Investigator Minimum Requirements Investigators shall have a minimum of eight (8) years' experience conducting harassment or similar employee relations investigations.

6.0 ORDERING PERIOD.

The ordering period is anticipated to be one (1) Base Period of 12 months and four (4) 12-month Option Periods, with a potential for an additional six (6) months if FAR 52.217- 8 is exercised.

The one-year option periods are to be exercised at the sole discretion of the Government (see the clause entitled FAR 52.217-9, Option to Extend the Term of the Contract). The maximum life of the contract, including any options, is expected not exceed five (5) years and six (6) months.

8.0 QUALITY ASSURANCE SURVEILLANCE PLAN.

See Attachment 5 for a sample Quality Assurance Surveillance Plan (QASP). A QASP will be included with awarded Contract and will be pursuant to the requirements listed in this Performance Work Statement (PWS). This performance-based plan sets forth the procedures and guidelines CFPB will use in evaluating the technical performance of the Contractor. The QASP does not detail how the Contractor accomplishes the work;

however, it provides the method and basis for the Contracting Officer’s Representative (COR) to evaluate the quality of the Contractor’s performance.

9.0 INSPECTION AND ACCEPTANCE.

Inspection and acceptance of all products and services shall be by the COR and ACOR.

Deliverables and services shall be reviewed for accuracy, clarity, completeness, and timeliness within five working days after receipt unless specified differently elsewhere in the contract. CFPB will provide any concerns and comments to the Contractor, who shall ensure completion of each deliverable in a manner acceptable to the COR and ACOR within three working days of such CFPB notice. The Contractor shall deliver all copies of completed deliverables to the COR and ACOR.

SECTION C – SPECIAL TERMS AND CONDITIONS

1.0 CFPB BUREAU LOCAL CLAUSES – SEE ATTACHMENT 1

2.0 PRIVACY

3.1 FEDERAL ACQUISITION REGULATION (FAR) CLAUSES PERTAINING

TO PRIVACY, SUBPART 24.1 – PROTECTION OF INDIVIDUAL

PRIVACY AND SUBPART 39 – ACQUISITION OF INFORMATION

TECHNOLOGY

3.1.1 FAR 52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

A. The Contractor will be required to design, develop, or operate a system of records on individuals, to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

3.1.2 FAR 52.224-2 PRIVACY ACT (APR 1984)

A. The Contractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(i) The systems of records; and

(ii) The design, development, or operation work that the contractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(3) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

B. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

C. Definitions:

1) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

2) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

3) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

3.1.3 FAR 52.239-1 PRIVACY OR SECURITY SAFEGUARDS

i. The Contractor shall not publish or disclose in any manner, without the

Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

ii. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

iii. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

3.2 GENERAL REQUIREMENTS

A. All IT products and services provided by the contractor shall comply with all CFPB privacy directives, policies, and requirements unless the contractor obtains a written waiver from CFPB privacy staff.

B. All IT products and services provided by the contractor must comply with federal laws and standards addressing information privacy, including:

1) The Privacy Act of 1974, 5 U.S.C. 552a as amended (as outlined above);

2) Office of Management and Budget Circular A-130, Management of Federal Information Resources, including Appendices; and

3) E-Government Act of 2002, Title II, Section 208 – Privacy Provisions, and related OMB guidance.

C. All IT products and services provided by the contractor shall address privacy requirements throughout their design, development, implementation, maintenance and operation, and termination as provided in CFPB system development guidance. This includes completing or providing necessary information for the CFPB to complete privacy impact assessments (PIAs), and other privacy artifacts as required.

D. The contractor shall provide a point of contact (name, telephone number, e-mail address) with whom privacy staff may communicate throughout the duration of the contract about privacy issues.

3.0 BREACH OF PERSONALLY IDENTIFIABLE INFORMATION (PII)

In accordance with the CFPB’s voluntary adoption of OMB Memorandum M-07-16, breach of PII is defined to include “the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access to personally identifiable information, whether physical or electronic.” “Personally identifiable information (PII)”, as defined by the Office of Management and Budget, refers to “information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc.

alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.”

In the event either Party becomes aware of a breach of PII that Party shall notify the other immediately by phone and email, and shall collaborate with the other while voluntarily complying with applicable breach notification policies and procedures, including Office of Management and Budget Memoranda 06-19 (OMB M-06-19) and 07-16 (OMB M-07-16).

5.0 ADDITIONAL PRIVACY PROVISIONS

5.1 Suspected Loss or Compromise of Personally Identifiable Information (Privacy Incident)

A. Contractor must report the suspected loss or compromise of PII by its employees or subcontractors to the CFPB Service Desk at 1-202-435- 7777 within one (1) hour of the initial discovery.

B. The Contractor must provide to CFPB an internal system or plan by which its employees and subcontractors are trained to identify and report potential loss or compromise of PII.

C. The Contractor must provide a written report to CFPB COR and CFPB Privacy Officer at CFPB_Privacy@cfpb.gov within 24 hours of the suspected loss or compromise of PII containing the following information:

1) Narrative, detailed description of the events surrounding the suspected loss/compromise.

mailto:CFPB_Privacy@cfpb.gov

2) Date, time, and location of the incident.

3) Type of information lost or compromised.

4) Contractor’s assessment of the likelihood that the information was compromised or lost and the reasons behind the assessment.

5) Names of person(s) involved, including victim, Contractor employee/subcontractor and any witnesses.

6) Cause of the incident and whether the company’s security plan was followed or not, and which specific provisions were not followed.

7) Actions that have been or will be taken to minimize damage and/or mitigate further compromise.

8) Recommendations to prevent similar situations in the future, including whether the security plan needs to be modified in any way and whether additional training may be required.

D. The Contractor must cooperate with CFPB or other government agency inquiries into the suspected loss or compromise of PII to facilitate activities outlined in the CFPB Privacy Incident Response and Recovery Plan, and Office of Management and Budget M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007. The CFPB Privacy Incident Response and Recovery Plan is available upon request.

E. At the government’s discretion, Contractor employees or subcontractor employees may be identified as no longer eligible to access PII or to work on that contract based on their actions related to the loss or compromise of PII.

F. In the event of a PII compromise or loss by the Contractor, its employees, and/or subcontractors, the Contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should the Government elect to provide and/or procure such notification or identity protection service, the Contractor will be responsible for reimbursing the Government for those expenses.

Definitions “PII Compromise” (may be used interchangeably with “Privacy Incident”) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social Security Number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

5.2 PRIVACY TRAINING

A. The Contractor shall provide written acknowledgement of having thoroughly reviewed and understood all privacy documents incorporated by reference within this document.

B. All Contractor resources with access to Government-owned personal information shall at minimum complete annual privacy training on the collection, use, disclosure, protection, and destruction of personal information. Contractor shall complete training on conducting PIAs and preparing SORNs, NPRMs, Final Rules and Privacy Act Statements, as appropriate. Contractor shall attest to the content of their privacy training or the CFPB shall make training available to the Contractor.

C. Contractor shall also incorporate the privacy in the content of any system specific user training that the Government requests the Contractor to create. The training content of regarding privacy is subject to Government approval.

5.3 RESTRICT ACCESS TO DIRECT IDENTIFYING PII

A. Contractor shall have the ability to restrict access to direct identifying information, including the ability to redact, segregate, or mask direct identifying information.

5.4 RETENTION OF DIRECT IDENTIFYING PII

A. The Contractor shall destroy direct identifying information when it is no longer necessary or in accordance with the records retention schedule per FAR 4.705.

6.0 FAR 52.212-4, CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS OR COMMERCIAL SERVICES, incorporated by reference (see SF 1449 block 27a)

7.0 FAR 52.212-5 Contract Terms and Conditions Required to Implement

Statutes or Executive Orders-Commercial Products or Commercial Services(May 2022).

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

https://www.acquisition.gov/sites/default/files/current/far/html/52_212_213.html#wp1179465 https://www.acquisition.gov/sites/default/files/current/far/html/FormsStandard67.html#wp1189284 https://www.acquisition.gov/sites/default/files/current/far/html/FormsStandard67.html#wp1189284

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Nov 2021) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) ( 31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

_X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 2402).

_X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) ( 41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite- Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment.

(Nov 2021) ( 31 U.S.C. 6101 note).

_X_ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) ( 41 U.S.C. 2313).

__ (10) [Reserved].

__ (11) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Sep 2021) ( 15 U.S.C. 657a).

__ (12) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Sep 2021) (if the offeror elects to waive the preference, it shall so indicate in its offer) ( 15 U.S.C. 657a).

__ (13) [Reserved]

_X_ (14) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) ( 15 U.S.C. 637(d)(2) and (3)).

__ (17) (i) 52.219-9, Small Business Subcontracting Plan (Nov 2021) ( 15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Sep 2021) of 52.219-9.

__ (18) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) ( 15 U.S.C.

644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

_X_ (19) 52.219-14, Limitations on Subcontracting (Sep 2021) ( 15 U.S.C.

637s).

__ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Sep 2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Sep 2021) ( 15 U.S.C. 657f).

_X_ (22) (i) 52.219-28, Post Award Small Business Program Rerepresentation (Sep 2021) ( 15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Sep 2021) ( 15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Sep 2021) ( 15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) ( 15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (Sep 2021) ( 15U.S.C.

637(a)(17)).

_X_ (27) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

__ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan 2022) (E.O.13126).

_X_ (29) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (30) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

__ (31) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) ( 38 U.S.C.

4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

__ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

_X_ (33) 52.222-37, Employment Reports on Veterans (Jun 2020) ( 38 U.S.C. 4212).

_X_ (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (35) (i) 52.222-50, Combating Trafficking in Persons (Nov 2021) ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

_X_ (36) 52.222-54, Employment Eligibility Verification (May 2022) (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 ( 42 U.S.C. 6962(i)(2)(C)).

(Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) ( 42 U.S.C. 8259b).

__ (43) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

_X_ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

_X_ (47) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48) 52.225-1, Buy American-Supplies (Nov 2021) ( 41 U.S.C. chapter 83).

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Nov 2021) ( 41 U.S.C.chapter83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (Jan 2021) of 52.225-3.

__ (iii) Alternate II (Jan 2021) of 52.225-3.

__ (iv) Alternate III (Jan 2021) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (Oct 2019) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (51) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) ( 42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov2007) ( 42 U.S.C. 5150).

__ (55) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (56) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov 2021) ( 41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (57) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) ( 41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (58) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) ( 31 U.S.C. 3332).

__ (59) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) ( 31 U.S.C. 3332).

__ (60) 52.232-36, Payment by Third Party (May 2014) ( 31 U.S.C. 3332).

__ (61) 52.239-1, Privacy or Security Safeguards (Aug 1996) ( 5 U.S.C.

552a).

__ (62) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) ( 15 U.S.C. 637(d)(13)).

__ (63) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) ( 41 U.S.C.

chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor…