RFP-9531CB25R0001.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

524114

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORCFP

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

11/12/2024 1500 ET

10/25/2024

VANESSA DEL TORO

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

9531CB25R0001

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 68 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

WASHINGTON DC 20552

1700 G STREET, NW

OFFICE OF PROCUREMENT

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$47

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Consumer Financial Protection Burea

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

Request for Proposals for Business Travel Insurance Period of Performance: 01/01/2025 to 12/31/2025

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

68 2 of

9531CB25R0001

1 CONSUMER FINANCIAL PROTECTION BUREAU

t

CONSUMER FINANCIAL PROTECTION BUREAU

WASHINGTON, D.C. 20552

Date: October 25, 2024

TO: Interested Offerors

SUBJECT: Request for Proposal; RFP # 9531CB25R0001, Business Travel Accident

Insurance Services

Dear Contractor:

The purpose of this Request for Proposal (RFP) 9531CB25R0001 is to acquire an insurance carrier to provide business travel accident insurance benefits to CFPB employees, as outlined in the Statement of Requirements (SOR) provided herein. The resulting contract will be a Firm-Fixed-Price contract with a one-year Base and four one-year Options not to exceed (5) years, if all options are exercised.

The CFPB hereby issues a combined synopsis/solicitation for commercial items issued on beta.SAM.gov using the policies contained in FAR Part 12 – Acquisition of Commercial Items and FAR Part 13.5 Test Program for Certain Commercial Items, to obtain contractor services in support of this requirement. CFPB intends to award a single contract as a result of this solicitation.

This solicitation is not issued as a small business set-aside. The NAICS code is 524114, Direct Health and Medical Insurance Carriers, and the business size standard is $47 Mil.

The Technical and Price Proposal must be received by November 12, 2024, 3:00 p.m.

Eastern Time (ET) and shall be emailed to Vanessa.delToro@cfpb.gov.

Questions concerning this solicitation must be received by October 30, 2024, 12:00 p.m.

Eastern Time (ET) and e-mailed to Vanessa.delToro@cfpb.gov. All responses to questions will be answered through the beta.SAM.gov website in the form of an amendment to the solicitation.

Sincerely, Vanessa del Toro Contracting Officer mailto:Vanessa.delToro@cfpb.gov mailto:Vanessa.delToro@cfpb.gov

2 CONSUMER FINANCIAL PROTECTION BUREAU

REQUEST FOR PROPOSALS (RFP) 9531CB25R0001

TABLE OF CONTENTS

PART 1 THE SCHEDULE

PART 2 STATEMENT OF REQUIREMENTS (SOR)

PART 3 CONTRACT TERMS AND CONDITIONS

PART 4 SOLICITATION PROVISIONS - EVALUATION OF

PROPOSALS - INSTRUCTIONS TO OFFERORS

ATTACHMENTS:

Attachment 1 Non-Disclosure Agreement Attachment 2 Extended Prices Template

3 CONSUMER FINANCIAL PROTECTION BUREAU

SOLICITATION NUMBER 9531CB25R0001

BUSINESS TRAVEL ACCIDENT INSURANCE

FOR THE

CONSUMER FINANCIAL PROTECTION BUREAU

PART I - THE SCHEDULE

1. Solicitation/Contract Form: Standard Form (SF) 1449.

2. Continuation of SF 1449 Block 20 –Supplies/Services and Prices.

3. TYPE OF CONTRACT.

This Contract will be issued on a Firm-Fixed Price basis. The performing contractor shall furnish all resources, management, supervision, and services (except for Government furnished items) necessary to perform and provide work in accordance with the requirements.

The firm-fixed price proposed are inclusive of all direct and indirect costs (including salaries;

fringe benefits; overhead; and general and administrative expenses) and profit and will be applicable for the duration of the Contract.

PART II - STATEMENT OF REQUIREMENTS

1. BACKGROUND

The Consumer Financial Protection Bureau (CFPB) is a Federal Agency whose mission is to make markets for consumer financial products and services work for Americans — whether they are applying for a mortgage, choosing among credit cards, or using any number of other consumer financial products. CFPB is an equal opportunity employer that seeks to create and maintain a vibrant, diverse, and talented workforce to attract that type of workforce, CFPB offers a highly competitive benefits package.

2. PURPOSE

The purpose of this requirement is to establish a business travel accident (BTA) insurance plan for all eligible employees in the United States effective January 1, 2025. BTA insurance offers protection against accidental death and dismemberment for employees while in a business travel status. The ceiling number of employees covered at CFPB is 1806.

3. ELIGIBILITY (FOR INSURANCE)

The eligibility requirement is defined as below:

4 CONSUMER FINANCIAL PROTECTION BUREAU

• Regular employees (full-time or part-time).

• Temporary and Term employees with an appointment greater than one year; and actively at work at least 60 hours biweekly.

• Eligible dependents - includes lawful spouses, domestic partners, and children up to age 22 (when authorized by the CFPB to travel during relocation visits or when invited to attend a CFPB sponsored event).

• Prospective employees in conjunction with CFPB employment interviews.

• Authorized guests who have been invited by the CFPB to be a speaker or panelist at a CFPB sponsored event.

4. PLAN DESIGN

The Contractor shall duplicate the current Business Travel Accident (BTA) insurance benefits as closely as possible, as explained herein. The benefits listed below represent minimum requirements for technical acceptability. No deviations from the benefits listed in the chart, below, are authorized. Any deviations shall provide equivalent benefits.

5. ADMINISTRATIVE REQUIREMENTS

The Contractor shall provide the following administrative services for the CFPB BTA Insurance Plan. The Contractor shall provide administrative services for the Business Travel Accident Insurance benefits including, but not limited to, the following:

Benefits Benefit Amount 4 times total annual pay with a minimum of $50,000 and a maximum of $1,000,000 Overall Accident Limit $5,000,000 Loss of Life Full Benefit Amount Double Dismemberment (any combination of two: hands, feet or eyesight, or the combined loss of speech and hearing)

Full Benefit Amount

Single Dismemberment (loss of one hand, foot, or sight in one eye, speech or hearing)

One-half Benefit Amount

Thumb and index finger on either hand One-fourth Benefit Amount Prospective employees, authorized guests, spouses and domestic partners

$50,000

Dependent Children $10,000 per child

5 CONSUMER FINANCIAL PROTECTION BUREAU

A. Administrative Services Requirements

a) Administer a BTA Insurance Plan that provides the benefits described in Part II on a fully insured, non-participating basis.

b) Provide a dedicated Account Representative who is accessible and knowledgeable in all aspects of the CFPB BTA Insurance Plan.

c) Design, produce and distribute, subject to the approval of CFPB, CFPB-specific, beneficiary forms, employee booklets, summary plan descriptions, Standard Operating Procedures, and all other forms and materials required to administer the plan.

d) Provide electronic files of forms and customized administrative manual to be used by CFPB (booklets, etc.) in prescribed format that can be uploaded to the CFPB Intranet.

All PDF deliverables are to be dynamic and Section 508 compliant. More information regarding compliance is included in Section Three, 22.0 – Universal Access and Design.

e) Provide an annual premium bill to CFPB using the Invoice Processing Platform (IPP) (https://www.ipp.gov). Provide for a 30-day net payment due. Implement an email notification process to proactively alert CFPB benefit staff of late or missing premium payments. Note that registration and invoicing procedure information is further detailed at Section One, 2.0 Electronic Submission of Payment Requests.

f) As requested by CFPB assist in communication to employees regarding the CFPB BTA Insurance Plan including mid-year webinars, annual open enrollment meetings and regional meetings. These meetings can be held at CFPB Headquarters in Washington, DC, virtually and may also be held at regional locations around the country.

g) Provide for direct communication between CFPB administrative staff and dedicated Account Representative.

h) Meet with CFPB on an as needed basis to review status and overall operations of the program.

i) Conduct an annual account management satisfaction survey.

j) The plan should be situated in Washington, DC.

https://www.ipp.gov/

6 CONSUMER FINANCIAL PROTECTION BUREAU

B. Claims Administration and Customer Service Requirements

a) Process Business Travel employee claims for the following:

• Loss of Life

• Double Dismemberment

• Single Dismemberment

• Thumb or Index Finger

• Prospective Employee

• Authorized Guests

• Spouses or Domestic Partners

• Dependent Children in accordance with the decedent’s validated designation of beneficiary form on file or Standard Order of Precedence.

b) Provide CFPB with notification of the name of claimant (employee, prospective employee, authorized guest(s), spouse, domestic partner, or dependent children), type of claim paid, amount and date of claim paid and if the claim is paid to a beneficiary(s).

c) Maintain a claims service unit for customer service questions with office hours from

8:30 a.m. until 6:30 p.m. Eastern Time Monday through Friday (except Federal Holidays) with a message device to handle calls after business hours or on weekends.

d) Provide a toll-free telephone information line that has capability to place calls in a hold queue during peak call hours with adequate staff so that calls are answered on average in 30 seconds.

e) Provide legal defense on disputed claims or to determine eligible designated beneficiaries where there is ambiguity.

C. Management Information Systems (MIS) Reporting and Monitoring Service Requirement Transition

a) The contractor shall provide quarterly and yearly Financial Accounting Reports to include current and cumulative year to date information and incurred claims.

b) The contractor shall be available to provide ad hoc reports such as but not limited to enrollment information, date reports on specific elements or specific claims.

7 CONSUMER FINANCIAL PROTECTION BUREAU

D. Transition Period

The contractor shall provide a transition period which shall begin at the contract award and continue through December 31, 2025. During the transition period the contractor shall be responsible for setting up the plan design in its system, assisting CFPB with establishing enrollment and billing processes and providing materials to staff to aid in the benefit plan to employees. The new contractor shall be responsible for all claims incurred beginning January 1, 2025.

During the final year of performance of this contract, the contractor will prepare for and assist with a seamless transition to the new contractor if applicable by transferring to CFPB and or the new contractor as determined by CFPB, within 30 days’ notice of this requirement, all required data and records necessary to administer the plan subject to state and federal confidentiality considerations without a break in service. The transfer may be made electronically in a file format to be determined based on a mutual agreement between CFPB and the provider of service. The contractor may be asked to provide phase-in, phase-out services for up to a one-year period if necessary.

6. MINIMUM INSURER FINANCIAL RATING/ PREMIUM SIZE

The Contractor shall maintain at least one of the following minimum insurer financial ratings during the life of the contract from one of the five independent agencies: A.M. Best, Fitch, Kroll Bond Rating Agency (KBRA), Moody’s and Standard & Poor’s. If the Contractor is rated by more than one of these rating organizations, each rating shall at least meet the above minimums. In lieu of being rated by one or more of these financial agencies, the Contractor must have an annual premium volume of $1 billion or more as documented in the Contractor's annual report.

7. PACKAGING AND MARKING.

Reserved.

8. INSPECTION AND ACCEPTANCE.

Reserved.

9. DELIVERABLES.

Deliverable Due Date/ timeline Enrollment Report Biweekly Program Status Report Quarterly CFPB Claims Report Annually B customized Summary Plan Description

CFP

Annually

Financial Accounting Report Annually

8 CONSUMER FINANCIAL PROTECTION BUREAU

*These dates are subject to change based on mutual agreement.

PART III – CONTRACT TERMS AND CONDITIONS

1. PERIOD OF PERFORMANCE.

The period of performance of this Contract shall be for a twelve (12) month Base Period, beginning January 1, 2025, and four (4) twelve (12) month options periods, for a potential total of five (5) years, if all options are exercised.

2. RECOGNIZED HOLIDAYS.

The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day Washington’s Birthday Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

3. PLACE OF PERFORMANCE.

The work to be performed under this contract will primarily be performed at the Contractor’s location.

4. CONTRACTING OFFICER’S AUTHORITY (MARCH 2019).

The Contracting Officer for this contract is:

Account Management Satisfaction Survey

Annually

Standard Operating Procedure 30 Days After Contract Award Customized CFPB Administration Manual 30 Days After Contract Award Customized CFPB claims processing forms 30 Days After Contract Award Toll Free Information Line 30 Days After Contract Award

9 CONSUMER FINANCIAL PROTECTION BUREAU

Vanessa del Toro Contracting Officer Consumer Financial Protection Bureau 1700 G St NW Washington, DC 20002 Phone Number: 202-957-8824 Email: Vanessa.delToro@cfpb.gov

a. The Contracting Officer, in accordance with Subpart 1.6 of the Federal

Acquisition Regulation, is the only person authorized to make or approve any changes in any of the requirements of this contract, and notwithstanding any clauses contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof.

5. CONTRACTING OFFICER’S REPRESENTATIVE (COR) AND ALTERNATE

CONTRACTING OFFICER’S REPRESENTATIVE (ACOR) DESIGNATION AND

AUTHORITY (JUNE 2019).

The COR for this requirement is:

Dennyne Gunn Human Resources Specialist Consumer Financial Protection Bureau Tel: 202-435-7371 Email: Dennyne.Gunn@cfpb.gov

The ACOR for this requirement is:

Valerie Gatling Human Resources Specialist Consumer Financial Protection Bureau Phone: (202) 435-7308 Email Address: valerie.gatling@cfpb.gov

a. Performance of work under this contract must be subject to the technical direction of the COR/ACOR identified above, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

b. Technical direction must be within the scope of the specification(s)/work statement.

The COR/ACOR does not have authority to issue technical direction that:

mailto:Dennyne.Gunn@cfpb.gov mailto:valerie.gatling@cfpb.gov

10 CONSUMER FINANCIAL PROTECTION BUREAU

(1) Constitutes a change of assignment or additional work outside the specification(s);

(2) Constitutes a change as defined in the clause entitled “Changes”;

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the Contractor’s right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the Contractor’s employees.

c. Technical direction may be oral or in writing. The COR/ACOR shall confirm oral direction in writing within five workdays, with a copy to the contracting officer.

d. The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR/ACOR. If, in the opinion of the Contractor, any direction of the COR/ACOR, or his/her designee, falls within the limitations in (c), above, the Contractor shall immediately notify the contracting officer no later than the beginning of the next Government work day.

e. Failure of the Contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled “Disputes.”

6. ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (JULY 2022).

a. Definition. As used in this clause, “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation.

The payment request must comply with the requirements identified in FAR 32.905(b), "Payment documentation and process" and the applicable Payment clause included in this contract.

b. Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

Information regarding IPP is available on the Internet at ipp.gov. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

c. The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate payment procedures in writing.

d. If alternate payment procedures are authorized, the contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

e. Each payment request submitted shall be supported by appropriate documentation necessary to substantiate the request.

For commercial firm-fixed-price/fixed-price contracts/CLINs, payment requests shall be submitted in accordance with this local clause and FAR 52.212-4(g).

11 CONSUMER FINANCIAL PROTECTION BUREAU

For commercial Time and Materials/Labor-Hour contracts, payment requests shall be submitted in accordance with FAR 52.212-4, Contract Terms and Conditions - Commercial Items and Alternate 1.

Payment requests shall be submitted by the 5th calendar day of each month following the month of performance and shall meet the approval of the Contracting Officer Representative (COR). For payment and invoice questions, go to https://ipp.for.fiscal.treasury.gov/ or contact the Accounting Services Division at

(304) 480-8000 or via email at AccountsPayable@fiscal.treasury.gov.

7. PROCESSING OVERPAYMENTS (SEPTEMBER 2018).

a. Accounts Receivable Conversion of Check Payments to electronic funds transfer (EFT): If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the Government, it will be converted into an EFT.

This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within twenty-four hours and will be shown on the regular account statement.

b. The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

c. Credit Memos: Contractors are allowed, with the Contracting Officer’s written permission, to issue a credit memo when an overpayment is paid by the Bureau. The full overpayment will be credited in full to the Bureau on the next payment request (invoice/voucher). If the credit memo exceeds the payment request, it will be applied to the next payment request.

8. CONTRACTOR POINT OF CONTACT (POC) (SEPTEMBER 2018).

The Contractor’s designated Point of Contact (POC) is:

Name:

Office No:

E-Mail Address:

The POC shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the Government. The POC shall have full authority to act for the Contractor in the performance of the required supplies/services.

9. HISTORICALLY BLACK COLLEGES AND UNIVERSITIES AND

MINORITY INSTITUTIONS (SEPTEMBER 2020)

12 CONSUMER FINANCIAL PROTECTION BUREAU

The Consumer Financial Protection Bureau (CFPB or Bureau) promotes and is committed to the participation of Historically Black Colleges and Universities (HBCUs) and Minority Institutions (MIs) in its procurements.

I. Definitions – For the purposes of this clause:

a. Historically black college or university means an institution determined by the

Secretary of Education to meet the requirements of 34 CFR 608.2.

b. Minority institution means an institution of higher education meeting the requirements of Section 365(3) of the Higher Education Act of 1965 (20 U.S.C.1067k), including a Hispanic-serving institution of higher education, as defined in Section502(a) of the Act (20 U.S.C.1101a).

II. Contractor Obligation:

a. The Contractor has made and shall continue to make, or shall make, during this contract, a good faith effort to promote and to ensure, to the maximum extent possible, HBCU/MI inclusion in its subcontracts.

b. Subcontractors – The Contractor shall insert the substance of this clause in all subcontracts under this contract.

10. INSPECTION OF BOOKS & RECORDS (MARCH 2019).

10.1 This clause is applicable to any contractual vehicle, regardless of the amount or the manner into which it was entered.

10.2 The Contractor agrees that the Consumer Financial Protection Bureau

(including its authorized representative and/or its Office of Inspector General) (collectively, "CFPB") shall, until expiration of three (3) years after final payment under this Contract, have access to and the right to examine any directly pertinent books, documents, papers, and records of the Contractor involving transactions related to this Contract. The Contractor further agrees to include in all its subcontracts hereunder a provision to the effect that the subcontractor agrees that the CFPB shall have the same rights to the subcontractor books, documents, papers and records as specified above.

10.3 The periods of access and examination described above, for records which relate to (1) litigation or the settlement of claims arising out of the performance of this Contract, or (2) costs and expenses of this Contract as to which exception has been taken by the CFPB, shall continue until such litigation, claims, or exceptions have been disposed of, and CFPB has specified in writing that exception is no longer being taken.

11. CONTRACTOR PUBLICITY (SEPTEMBER 2018).

13 CONSUMER FINANCIAL PROTECTION BUREAU

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the equipment or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such equipment or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government may institute all remedies available under applicable law. Further, any violation of this provision may be considered during the evaluation of past performance in future acquisitions.

12. BUREAU OFFICE OF THE INSPECTOR GENERAL (OIG) (SEPTEMBER 2018)

For the avoidance of doubt, nothing in this contract shall limit the OIG's authority under the Inspector General Act to examine the Contractor's books, documents, papers, etc.

The Contractor and any subcontractor shall make notification (including posting notices in each of their respective facilities) to all Contractor and subcontractor employees working on this contract of the OIG’s hot line telephone number, 1-800-827-3340, and to report any suspected "waste, fraud, or abuse" transactions related to the performance of this contract.

13. COOPERATING WITH OTHER ORGANIZATIONS (SEPTEMBER 2018)

The Contractor(s) agrees to cooperate with representatives of other contractors, Federal Reserve Banks, Federal agencies, Governmental entities, and other organizations, as may be required by the Bureau, but only to the extent such cooperation does not violate the Contractor’s independence, create a conflict of interest, or materially interfere with the Contractor’s performance of services under this Contract.

14. UNIVERSAL ACCESS AND DESIGN (SEPTEMBER 2018)

a. The Contractor shall ensure that all Electronic and Information Technology (EIT) deliverables meet or exceed accessibility and usability design requirements under Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended and refreshed January 2018, and under the Web Content Accessibility Guidelines 2.0 (WCAG 2.0) Level AA. The refreshed Section 508 Standards (January 2018) can be found at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule. The refreshed Section 508 Standards harmonize with WCAG 2.0 Level AA. EIT is also referred to as Information Computer Technology (ITC).

b. EIT deliverables include, but are not limited to: websites, mobile applications, web based applications, cloud solutions, software as a solution (SaaS), commercial off-the-shelf (COTS) products, software, hardware, webcasts, webinars, podcasts, multimedia, social media, collaborative workspaces and tools, surveys, print and electronic documents, PDFs, forms, and all training and related training materials.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule

14 CONSUMER FINANCIAL PROTECTION BUREAU

c. The Contractor shall have the ability and experience in creating Section 508 conformant deliverables and in determining the Section 508 compliance of EIT including design specification, testing and verification, and remediation as required.

d. The Contractor shall acquire the necessary authoring and testing tools to create EIT deliverables and perform accessibility and usability testing in multiple environments to include a comprehensive selection of assistive technologies. The Contractor shall use the most updated version of an authoring tool that creates Section 508 conformant outputs in order to ensure its deliverables are Section 508 conformant and usable.

e. Upon the request of the Contracting Officer (CO) or the Contacting Officer’s Representative (COR), the Contractor shall present a Government Product Accessibility Template (GPAT) (https://www.section508.gov/) for each EIT deliverable. GPAT findings shall be presented in an accessible electronic format.

f. Materials intended for print shall also include an accessible, dynamic and Section 508 conformant electronic version of the deliverable. Print materials shall be made available in an alternate accessible format when requested.

g. When producing EIT deliverables, the Contractor shall follow the Bureau’s Design Manual (https://cfpb.github.io/design-manual/), including Bureau templates.

15. CYBERSECURITY/INFORMATION SECURITY (FEBRUARY 2024)

a. The Consumer Financial Protection Bureau (CFPB) defines terms consistent with those determined by the National Institute of Standards and Technology (NIST) Glossary | CSRC (nist.gov).

1. Per NIST, an information system can be described as the following: “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.”

2. An information system includes any computer that contains Bureau data and performs any of the above tasks, not just systems of records.

b. Contractors retained for purposes of providing expert witness services to provide analysis and/or testimony in support of the Federal Government in any current or anticipated litigation or dispute are not “working on behalf of, nor agents of the CFPB.”

https://www.section508.gov/ https://cfpb.github.io/design-manual/ https://csrc.nist.gov/glossary

15 CONSUMER FINANCIAL PROTECTION BUREAU

c. In accordance with Homeland Security Presidential Directive 12 (HSPD-12), Office of the Management and Budget (OMB) Memorandum M-19-17, CFPB Information System Security and Secure Access Controls Via Multi-Factor Authentication Policies, any Contractor requiring routine physical access to a CFPB facility and/or routine access to a CFPB federally controlled information system will be required to obtain a CFPB-issued Personal Identity Verification (PIV) card. Contractors shall take the necessary steps to obtain a PIV card, including enrollment and activation, within 45-calendar days of their CFPB start date, loss or expiration of their current PIV card. Contractors who fail to comply with this policy will be removed from their CFPB contract.

1. The Contractor shall provide its own PIV reader(s), if necessary.

2. In some situations, a PIV card may not be possible to use for CFPB information system access. If so, the Contractor shall use a CFPB authentication application on a personal or corporate mobile device.

d. The Contractor shall adhere to CFPB cybersecurity requirements for all information systems connected to CFPB network/resources or operated by the Contractor for, or on behalf of, the CFPB, regardless of location. The Contractor shall protect all CFPB-provided data to CFPB policies and standards, if stored in a Contractor system. This clause applies to all or any part of the contract that includes information technology, information resources, data, or services for which the Contractor must have physical or electronic access to CFPB information or data.

e. CFPB information technology and data provided to the Contractors shall remain in the United States. The receipt, transmission, backup, accessing, maintenance, operation, and/or processing of CFPB technology and information must take place, and originate from, within the United States. Any exceptions to this must be approved in writing by the Chief Operating Officer and the Chief Information Officer.

f. The Contractor shall maintain a complete and accurate inventory of all CFPB-provided data, along with complete access records. Upon request by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR), the inventory and access records shall be made available for inspection within one business day.

g. Contractors serving as an agent of the Bureau or on the Bureau’s behalf, and are receiving, transmitting, storing, or processing intellectual property, records, or Bureau-provided data must use government-furnished equipment (GFE) or Citrix-based virtual desktop interface (VDI) to complete Bureau work. A contractor not serving as a CFPB agent or on CFPB’s behalf may elect to

16 CONSUMER FINANCIAL PROTECTION BUREAU

receive data via VDI or GFE. However, if a contractor is creating independent content (training, documentation, etc.) that the Bureau receives, approves, and then executes; the Contracting Officer’s Representative (COR) may elect to exclude specific contractor roles from requiring GFE. The COR may elect to exclude contractor roles from GFE/VDI, if the contractor role:

1. Does not access the Bureau network, resources, or data;

2. Does not manage Bureau social media or live links;

3. Does not act as a Bureau agent to generate, receive, transmit, store, or process Bureau data or act upon the Bureau’s behalf;

4. Contractor role does not generate, receive, transmit, store, or process

Bureau data (i.e., records, intellectual property, etc.);

5. Produces the content without the input of Bureau data; and,

6. All federal decision-making happens after Bureau receipt of content.

Each exclusion must be documented by the COR, approved in writing by the Bureau Authorizing Official or designee, and revisited annually.

h. The Contractor system or facility hosting CFPB information resources must meet all applicable federal, state, and local zoning, environmental, and building laws and regulations. The system or facility must include protection against unauthorized access at all hours, including alarms and notification systems, should such protection be breached.

i. Detected or suspected security compromises to CFPB information must be reported to the CO or COR and soc@cfpb.gov within 60 minutes of discovery by the Contractor. In the event of a compromise, the Contractor shall grant the Government access to all facilities and information resources used in support of the contract to safeguard CFPB information resources.

j. The Contractor shall grant the Government access to all facilities and information resources used in support of the contract. The CFPB may conduct reviews to ensure that the security requirements in the contract are implemented, enforced, effective, and operating as intended. These reviews include, but are not limited to, comprehensive technical testing of the control environment used to safeguard CFPB information, data, or information resources.

k. At the expiration of the contract, the Contractor shall return all CFPB information resources provided to, or generated by, the Contractor during the period of the contract. The Contractor shall provide certification and artifacts to prove that all CFPB information/data has been sanitized from any non-GFE information system in accordance with CFPB standards and procedures. With mailto:soc@cfpb.gov

17 CONSUMER FINANCIAL PROTECTION BUREAU

advance notification, CFPB may surveil and/or inspect the sanitization/destruction/disposition. All equipment sanitization procedures must be environmentally sound as outlined by the U.S. Environmental Protection Agency (EPA).

l. To the extent the Contractor has Bureau assets or devices (i.e., laptop, thumb drive), the Contractor shall comply with the Bureau’s Asset Management Policy and is responsible for:

Using and protecting its assigned equipment in accordance with the Acceptable Use Policy and Guidance laid out in the Facilities Non-IT Asset Management Directive and IT Asset Management Directive; providing access to their assigned equipment when requested by the responsible Asset Management team; and immediately reporting the loss or theft of IT hardware, software, and/or data upon discovery to the COR, the CFPB Security Office at extension 59001 or (202) 435-9001, and to the Service Desk at extension 57777 or (202) 435-7777.

m. For the purposes of application development, the Contractor shall adhere to NIST Secure Software Development Framework (SSDF), SP 800-218, 800- 161, and the NIST Software Supply Chain Security Guidance for developing secure software or providing third-party software to include the adoption of open-source libraries or other application packages. CFPB encourages and prefers the use of cloud-hosted solutions. All cloud-hosted solutions will need to go through the Federal Risk and Authorization Management Program (FedRAMP) authorization, if not already FedRAMP authorized. If not cloud-based, CFPB prefers web-based, commercial off the shelf software that is browser agnostic. Cloud and non-cloud based solutions will need to go through CFPB’s authority to operate process. Data in cloud-based or non-cloud-based systems must be maintained within the United States at all times and may not be accessible by unauthorized individuals, including, but not limited to non-U.S.

citizens.

n. The Contractor shall adhere to all CFPB common security configurations and practices or system operation. Security configurations and practices include:

1. The provider of information technology shall certify applications are fully functional and operate as intended on systems using the United States Government Configuration Baseline and other operating system and application standards.

2. Final acceptance of the product will be based on the CFPB interpretation of the National Institute of Standards and Technology, National Checklist Program Repository (NIST, NCPR). Checklists are

18 CONSUMER FINANCIAL PROTECTION BUREAU

available at the NIST, NCPR website. In situations where security configurations are not available for proposed technologies, the CFPB shall provide instruction.

3. The installation, operation, maintenance, and update of software shall not alter any CFPB-accepted or established security configuration.

4. Applications designed for users shall run in standard user context without elevated system administrator privileges.

o. The Contractor shall notify the CO and the COR within 30 calendar days of any organizational change or impact that may interfere with the full execution of the information security requirements under the contract.

p. Throughout the term of the contract, should the Contractor deliver a product or provide a service that does not meet (and maintain) CFPB’s information security requirements, the Contractor, at their own expense, shall correct non-compliant deliverables within 90 days of notification by the CO or the COR.

q. If not a CFPB agent or working on the Bureau’s behalf, the Contractor shall maintain a computing environment that complies with NIST SP 800-171 requirements and Bureau policy and standards at all times. These requirements include, but are not limited to, documentation of the processes and procedures that the Contractor shall follow to ensure the security of IT resources that are developed, processed, transmitted, used, or maintained under this contract and comprehensive technical testing of the Contractor’s computing environment by the CFPB or CFPB-approved independent third-party.

r. Prior to the execution of the contract, the CFPB may require validation to ensure adequate security controls in the Contractor environment. When a validation is required, the validation may be conducted by the CFPB as part of an on-site inspection process or CFPB-approved independent third-party.

s. Contractors providing services that are FedRAMP certified shall ensure their FedRAMP packages remain current throughout the life of the contract.

t. The Contractor shall demonstrate, upon request by the CO or COR, the technical, operational, and management safeguards that protect the confidentiality, integrity, and availability of CFPB information that it generates, develops, processes, transmits, uses, or maintains during the execution of this contract. This demonstration may include the delivery of artifacts within the scope of the FedRAMP package and independent from FedRAMP artifacts.

u. The Contractor shall ensure its computing environment complies with Federal laws that include, but are not limited to, the Federal Information Security

19 CONSUMER FINANCIAL PROTECTION BUREAU

Modernization Act of 2014 (FISMA), and with Federal policies and procedures that include, but are not limited to: the most current versions of NIST Special Publication (SP) 800-60, 800-63A, 800-218, 800-161, 800-53 or 800-171 (as determined by CFPB), Federal Information Processing Standard (FIPS) 200, 140, and CFPB Information Security Standards (CS-S-01). Copies of these documents are maintained by the CFPB Office of Cybersecurity and are available upon request. Failure to maintain compliance with applicable statutes, regulations, and guidance is a breach of the contract. The CO or COR may conduct one or more on-site inspections to ensure compliance.

1. All Contractors and systems shall adhere to the most current OMB

Circular A-130 and NIST SP 800-53 or 800-171 requirements in alignment with the Bureau-established FIPS Publication 199 determination for that authorized system, CFPB data extract, or derived data. Unless waived by the CFPB Authorizing Official (AO) in writing:

a. Information system(s) shall have the ability to transfer audit logs to the Bureau’s centralized log collection and analysis system, Splunk by using an application programming interface (API) or a secure system log file (syslog).

b. Information system(s) shall support Security Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) for federated login to any web console provided by the tool, if providing a log-in capability.

c. Information system(s) shall provide a user management application programming interface or web services capability that allows for the creation, updating, disabling and deletion of accounts and permissions, if the application requires accounts.

d. The project technical team shall submit an information system security baseline in alignment with Bureau common information security standards (ISS) and the system sensitivity classifications per the Federal Information Processing Standard (FIPS) 199/200 assessments, if appropriate.

v. If not a CFPB agent or working on CFPB’s behalf, the Contractor shall adhere to applicable Federal laws, regulations, and directives as well as the most current NIST Special Publication (SP) 800-171 requirements and other security standards and policies set by CFPB for non-federal contractor information https://team.cfpb.local/wiki/images/0/05/CS-S-01_-_Information_Security_Standards_V4.0_05012018.pdf

20 CONSUMER FINANCIAL PROTECTION BUREAU

systems that receive, transmit, process, store, or collect any form of Controlled Unclassified Information (CUI) collected for or provided by the Bureau. This is applicable to sub-contractors and Vendors who also do not serve in any capacity as Bureau agents and do not have the authority to act on the Bureau’s behalf.

w. The Contractor shall adhere to NIST SP 800-218 and Bureau-defined requirements regarding all Bureau system development life cycle (SDLC) policies, procedures, and activities, as applicable. The Contractor shall adhere to NIST Secure Software Development Framework (SSDF) and the NIST Software Supply Chain Security Guidance for developing secure software or providing third-party software to include open-source software or other application packages. Further, this includes the removal and disposal of all Bureau data from Contractor-owned and operated information systems once no longer needed to complete the contract. The Contractor shall provide all requested artifacts required to verify and attest that all Bureau data has been permanently removed once the information system is no longer required to process, store, or transmit Bureau data. These artifacts include, but are not limited to:

1. Independent 800-171A or 800-53A Risk Assessment per NIST

Standards, as assigned by CFPB.

2. Signed letter or document from the Contractor showing/attesting that all bureau level data has been properly and correctly removed per 800- 171 or 800-53.

3. Information Security Program documentation

4. Screen captures, or equivalent, showing each step taken within the information system and result when permanently removing Bureau data.

5. On-site inspection or remote surveillance of the sanitization/disposal/disposition process.

x. If the Contractor does not report within 2 business days or does not adhere to the CFPB policy and standards, the Bureau may impose penalties until such time that the reporting and standards are remedied to the Bureau’s satisfaction and may have non-conformant systems or actions suspended until remediation conforms.

y. The Contractor shall adhere to CFBP blocking apps and sites on government-issued devices or contractor-operated networks/devices in support of CFPB

21 CONSUMER FINANCIAL PROTECTION BUREAU

work. Exceptions can be made by the CFPB AO in coordination with OMB, if a compelling business need exists.

z. The Contractor shall maintain an active information security (infosec) program to 800-171 or 800-53 standards with detective, preventative, and responsive elements to ensure administrative, managerial, technical, and physical controls per above. The program shall specifically address methods regarding handling and protecting CFPB information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems, to include end-user systems.

1. CFPB will review infosec program documentation and may interview for clarification with the proposed Contractor to assure confidence in the Contractor’s infosec program.

2. The Contractor, as deemed necessary, may use additional safeguards other than as provided for by the Contract to prevent use or disclosure of CFPB information.

aa. The Contractor shall, at its own expense, take action to mitigate any harmful effect that is known to the Contractor of a use or disclosure of CFPB information/data by the Contractor in violation of the requirements of this clause.

bb. The Contractor shall not use meta-data about CFPB’s use of the service for any purpose except for troubleshooting, technical performance monitoring, or ensuring security and functionality of the service.

cc. The CFPB Office of Cybersecurity maintains current information security requirements and standards and will provide details to the Contractor as needed after contract award. The CO or COR will notify the Contractor of any substantive changes to information security requirements that have a significant impact on the Contractor’s information security obligations under the Contract.

The accountable senior executive, such as a Company Risk Executive or Chief Information Security Officer must sign acknowledgement of receipt, understanding, and compliance with all current 800-171 or 800-53 standards.

dd. The Contractor shall include the substance of this clause in all subcontracts under this Contract.

16. NON-DISCLOSURE (JANUARY 2022)

22 CONSUMER FINANCIAL PROTECTION BUREAU

a. The Contractor recognizes that, in providing services under this contract, the Contractor may obtain access to or may become aware of confidential information pursuant to the Bureau’s regulations at 12 CFR Part 1070, et seq,.(including but not limited to information that may be privileged or proprietary in nature or contain Personally Identifiable Information (PII) and/or qualifies as Controlled Unclassified Information (CUI), as that term is defined under Executive Order 13556 (November 4, 2010) Without prior written approval by the Contracting Officer Representative (COR) or unless otherwise permitted by law, information acquired or prepared by the Contractor pursuant to providing services under this contract shall not be:

1. used by the Contractor for any purpose other than to perform work under the contract or;

2. disclosed by the Contractor to others outside

i. the approved Contractor personnel whether that personnel are providing services under this contract or another Bureau contract or

ii. the Government personnel serving in an oversight role or participating on a “need to know” basis.

b. The Contractor shall secure acquired or prepared information in a location with access limited to only the personnel groups previously stated…