RFP 9531CB25R0004 - House Price Index (HPI) Data Subscription.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

518210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORCFP

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

08/21/2025

PATRICK SISK

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIME

09/05/2025 1000 ET

b. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

9531CB25R0004

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 65 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

WASHINGTON DC 20552

1700 G STREET, NW

OFFICE OF PROCUREMENT

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$40

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

Consumer Financial Protection Burea

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

House Price Index Subscription for CFPB

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

65 2 of

9531CB25R0004

1 CONSUMER FINANCIAL PROTECTION BUREAU

CONSUMER FINANCIAL PROTECTION BUREAU

WASHINGTON, D.C. 20552

Date: August 21, 2025

TO: Interested Offerors

SUBJECT: Request for Proposals; RFP # 9531CB25R0004, House Price Index (HPI)

Data Subscription

Dear Contractor:

The purpose of this Request for Proposal (RFP) 9531CB25R0004 is to acquire a House Price Index (HPI) data subscription, as outlined in the Statement of Work (SOW) provided herein.

The resulting contract will be a Firm-Fixed-Price contract with a one-year Base and four one-year Options not to exceed (5) years, if all options are exercised.

The CFPB hereby issues a combined synopsis/solicitation for commercial items issued on SAM.gov using the policies contained in FAR Part 12 – Acquisition of Commercial Items and FAR Part 13.5 Test Program for Certain Commercial Items, to obtain contractor services in support of this requirement. CFPB intends to award a single purchase order as a result of this solicitation.

This solicitation is not issued as a small business set-aside. The NAICS code for this procurement is 518210, Data Processing, Hosting and Related Services.

The Technical and Price Proposal must be received by September 5, 2025, 10:00 a.m.

Eastern Time (ET) and shall be emailed to Patrick.Sisk@cfpb.gov.

Questions concerning this solicitation must be received by August 25, 2025, 10:00 a.m.

Eastern Time (ET) and e-mailed to Patrick.Sisk@cfpb.gov. All responses to questions will be answered through the beta.SAM.gov website in the form of an amendment to the solicitation.

Sincerely, Patrick Sisk Contracting Officer mailto:Patrick.Sisk@cfpb.gov mailto:Patrick.Sisk@cfpb.gov

2 CONSUMER FINANCIAL PROTECTION BUREAU

REQUEST FOR PROPOSALS (RFP) 9531CB25R0004

TABLE OF CONTENTS

PART 1 THE SCHEDULE

PART 2 STATEMENT OF REQUIREMENTS (SOR)

PART 3 CONTRACT TERMS AND CONDITIONS

PART 4 SOLICITATION PROVISIONS - EVALUATION OF

PROPOSALS - INSTRUCTIONS TO OFFERORS

ATTACHMENTS:

Attachment 1 Non-Disclosure Agreement Attachment 2 Pricing Table

3 CONSUMER FINANCIAL PROTECTION BUREAU

SOLICITATION NUMBER 9531CB25R0004

HOUSE PRICE INDEX (HPI) DATA SUBSCRIPTION

FOR THE

CONSUMER FINANCIAL PROTECTION BUREAU

SECTION ONE- STATEMENT OF WORK

1.0 BACKGROUND AND SCOPE

The Consumer Financial Protection Bureau (CFPB or Bureau) conducts research in support of the Bureau’s mission in statutorily required functions around market monitoring, regulation, supervision and enforcement to protect consumers. To better assist in those efforts, the Research, Markets, and Regulations (RMR) Office seeks to obtain a set of house price indices that can provide richer geographic details, more comprehensive data coverage, and more frequent and timely updates of the series than what is currently available from public sources.

The required data shall:

• Provide empirical resources for statutorily required analyses regarding the effect of the CFPB’s rulemakings on the markets for financial products.

• Support the Bureau’s ability to conduct market monitoring, as required by the Dodd- Frank Act, for the housing and mortgage market by identifying potential risks to consumers and identifying the localized hot spots and system risk.

• Support CFPB’s research agenda on mortgage markets and consumer behavior. For example, the data will allow the Bureau to mark the value of housing stock and mortgage loan-to-value ratio (LTV) to the current market level (mark-to-market) at appropriate corresponding geographic levels. This will in turn greatly enhance the Bureau’s research capacity for modeling mortgage borrowers’ default and prepayment behaviors.

2.0 REQUIREMENTS

The CFPB requires a contractor to provide a subscription to historical and current house price indices data where the Bureau can obtain data on current and historical trends for single-family home prices at various geographic levels and for different transaction types and tiers.

A house price index (HPI) is a broad measurement of the price movement of certain types of residential properties. Typically, it is estimated over certain geographic areas over a historical time. It provides valuable information regarding the trend and volatility of house prices over that period. A reliable house price index can help users better understand the dynamics of housing markets, its past performance and recent market conditions. Paired with micro level housing transaction or mortgage data, it can also allow users to dynamically estimate the equity position of the homeowners.

The contractor shall meet all requirements detailed below, which are categorized into four mandatory areas: General Data Requirements, Data Coverage, Data Quality and Format, and Technical Support.

4 CONSUMER FINANCIAL PROTECTION BUREAU

2.1 General Data Requirements

The HPI data shall provide insight into the house prices at various geographic levels that must be derived from reliable data sources and use a repeat sales methodology. The data shall:

• Indicate estimated home price levels (e.g., $450,000), allowing for comparisons across time, geography, and other characteristics such as property and transaction type. Home price changes from a specific point in time (e.g., percent change from 1990) are insufficient to meet the requirements.

• Also include estimate home sales volumes and estimated distressed sales volumes, using reasonable designations such as real estate owned sales and short sales.

The subscription shall provide all available (current and historical) data, methodology descriptions, and associated codebooks and data dictionaries as they become available and according to the prescribed frequency. The codebooks and data dictionaries shall provide, at a minimum:

• List of tables

• List of fields on the tables

• Descriptions of fields

• Acceptable values for fields

• Data types of fields

The subscription shall also provide access to additional data, research reports, and notes that reflect local housing market conditions that complement the HPI data provided to the Bureau and are made generally available as part of the subscription.

2.2 Data Coverage

2.2.1 Geographic Coverage Requirement. The data shall be available on at least five geographic levels: national, state, metropolitan statistical area, county, and zip code. The data shall cover all 50 states and at least 8,000 zip codes. The geographic coverage of the data shall be comprehensive and based on reliable data sources and a demonstrably sound methodology. The contactor must update the Bureau on its detailed geographic coverage and any changes when they occur.

2.2.2 Market Segmentation and Seasonality Requirement. The contractor shall provide data for different price tiers, transaction types, property types, and seasonality adjustments.

• The data shall include at least four pricing tiers.

• The data shall appropriately differentiate and account for the effects of distressed sales on its indices or maintain a set of separate indices for non-distress sales.

• The data shall differentiate by property type, including single-family homes, condos, and manufactured or mobile homes.

• Home price indices shall include both seasonally adjusted data and unadjusted data.

5 CONSUMER FINANCIAL PROTECTION BUREAU

The data shall be structured such that these requirements can be layered so that analyses can be done, for example, using seasonally adjusted prices over time for non-distressed sales of single-family properties for a particular price tier within a particular metropolitan statistical area.

2.2.3 Data Frequency and Time Period. Monthly data shall be made available from the year 1995 or earlier to the current year. Projected home prices are welcome, but not required.

Data must be updated at least monthly and should have a lag of 4 weeks or less.

2.3 Data Quality and Format

The contractor shall ensure the transmission of high-quality data. The contractor shall provide or make available to the Bureau its updated indices in a timely manner. The HPI data files must be in a readable format and contain uncorrupted data. The contractor shall provide the Bureau with its periodical data validation reports for the HPIs supplied.

The contractor shall utilize data transfer using commonly accepted methods, such as web-based download or Secure File Transfer Protocol (SFTP). Fixed-width text files do not meet the requirement.

2.4 Technical Support

The contractor shall provide technical support to answer queries within two business days after notification by the CFPB Contracting Officer Representative (COR) or designee. If data quality issues are encountered, the contractor must be available to remedy the issues and put in place an approach to avoid future issues.

3.0 DELIVERABLES

Reference Deliverable Schedule

2.1 HPI Data At least monthly

2.2 Validation Reports As Required by

COR

2.2 Data Updates As Required by

COR

2.3 Technical Support As Required by

COR

4.0 PERIOD OF PERFORMANCE

The period of performance of this contract shall be one (1) Base Period with four (4) one-year Option Periods as follows:

Term Period of Performance

Base Period Date of Contract Award through 12 Months Thereafter

Option Period 1 Date of Option Exercise through 12 Months Thereafter

Option Period 2 Date of Option Exercise through 12 Months Thereafter

6 CONSUMER FINANCIAL PROTECTION BUREAU

Option Period 3 Date of Option Exercise through 12 Months

Option Period 4 Date of Option Exercise through 12 Months

5.0 DATA RETENTION AND USAGE

The Bureau has the right to retain and use the data for a period not to exceed five years beyond the termination of the contract.

7 CONSUMER FINANCIAL PROTECTION BUREAU

SECTION TWO – SCHEDULE OF SUPPLIES, SERVICES, AND PRICES

1. PRICING

The contractor shall provide a firm fixed price for the scope defined in the SOW by filling in the Pricing Table below. The proposed total firm fixed price shall include all necessary labor, material, and other direct costs to meet the CFPB’s requirements.

The maximum budget for the Base Period is $92,700.

PRICING TABLE

Period Item Description Price Base Period House Price Index Data Subscription $

Option Period 1 House Price Index Data Subscription $ Option Period 2 House Price Index Data Subscription $ Option Period 3 House Price Index Data Subscription $ Option Period 4 House Price Index Data Subscription $

Total Firm Fixed Price $

2. NAICS CODE AND SIZE INFORMATION

This competition is being conducted on an unrestricted, full and open basis; therefore, a NAICS Code and Size Standard have been assigned. The NAICS code assigned to this procurement is 518210 (Data Processing, Hosting, and Related Services). The corresponding small business size standard is $40 million in average annual receipts over the past three years. This means that if the average annual receipts for a prime contract offeror exceeds this amount, the offeror must certify itself as a “Large” business under this procurement.

8 CONSUMER FINANCIAL PROTECTION BUREAU

PART III – CONTRACT TERMS AND CONDITIONS

1. PERIOD OF PERFORMANCE.

The period of performance of this Contract shall be for a twelve (12) month Base Period, beginning September 28, 2025, and four (4) twelve (12) month options periods, for a potential total of five (5) years, if all options are exercised.

2. RECOGNIZED HOLIDAYS.

The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day Washington’s Birthday Veterans Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

3. PLACE OF PERFORMANCE.

The work to be performed under this contract will primarily be performed at the Contractor’s location.

4. CONTRACTING OFFICER’S AUTHORITY (MARCH 2019).

The Contracting Officer for this contract is:

Patrick Sisk Contracting Officer Consumer Financial Protection Bureau 1700 G St NW Washington, DC 20002 Email: Patrick.Sisk@cfpb.gov

a. The Contracting Officer, in accordance with Subpart 1.6 of the Federal

Acquisition Regulation, is the only person authorized to make or approve any changes in any of the requirements of this contract, and notwithstanding any clauses contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment

9 CONSUMER FINANCIAL PROTECTION BUREAU

will be made in the contract price to cover any increase in cost incurred as a result thereof.

5. CONTRACTING OFFICER’S REPRESENTATIVE (COR) AND ALTERNATE

CONTRACTING OFFICER’S REPRESENTATIVE (ACOR) DESIGNATION AND

AUTHORITY (JUNE 2019).

The COR for this requirement is:

Erik Rubinyi Consumer Financial Protection Bureau Email: Erik.Rubinyi@cfpb.gov

The ACOR for this requirement is:

Benita Hampton Consumer Financial Protection Bureau Email Address: Benita.Hampton@cfpb.gov

a. Performance of work under this contract must be subject to the technical direction of the COR/ACOR identified above, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the Contractor that directs or redirects the labor effort, shifts the work between work areas or locations, fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

b. Technical direction must be within the scope of the specification(s)/work statement.

The COR/ACOR does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the specification(s);

(2) Constitutes a change as defined in the clause entitled “Changes”;

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the Contractor’s right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the Contractor’s employees.

c. Technical direction may be oral or in writing. The COR/ACOR shall confirm oral direction in writing within five workdays, with a copy to the contracting officer.

d. The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR/ACOR. If, in the opinion of the Contractor, any direction of the COR/ACOR, or his/her designee, falls within the limitations in (c), mailto:Erik.Rubinyi@cfpb.gov mailto:Benita.Hampton@cfpb.gov

10 CONSUMER FINANCIAL PROTECTION BUREAU

above, the Contractor shall immediately notify the contracting officer no later than the beginning of the next Government workday.

e. Failure of the Contractor and the contracting officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled “Disputes.”

6. ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (JULY 2022).

a. Definition. As used in this clause, “Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation.

The payment request must comply with the requirements identified in FAR 32.905(b), "Payment documentation and process" and the applicable Payment clause included in this contract.

b. Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP).

Information regarding IPP is available on the Internet at ipp.gov. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

c. The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate payment procedures in writing.

d. If alternate payment procedures are authorized, the contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

e. Each payment request submitted shall be supported by appropriate documentation necessary to substantiate the request.

For commercial firm-fixed-price/fixed-price contracts/CLINs, payment requests shall be submitted in accordance with this local clause and FAR 52.212-4(g).

For commercial Time and Materials/Labor-Hour contracts, payment requests shall be submitted in accordance with FAR 52.212-4, Contract Terms and Conditions - Commercial Items and Alternate 1.

Payment requests shall be submitted by the 5th calendar day of each month following the month of performance and shall meet the approval of the Contracting Officer Representative (COR). For payment and invoice questions, go to https://ipp.for.fiscal.treasury.gov/ or contact the Accounting Services Division at

(304) 480-8000 or via email at AccountsPayable@fiscal.treasury.gov.

f. Prorated Refund Upon Termination. In the event the Government terminates this contract, in whole or part, for its convenience or due to Contractor’s default, the Contractor shall provide the Government with a prorated refund of any advance payments or fees paid for goods and services not delivered or performed as of the effective date of the termination. The prorated amount shall be calculated on a straight-line basis over the performance period or applicable subscription/license mailto:AccountsPayable@fiscal.treasury.gov

11 CONSUMER FINANCIAL PROTECTION BUREAU

term, unless otherwise agreed in writing. Refunds shall be made within 30 calendar days of the Government’s written notice of termination.

7. PROCESSING OVERPAYMENTS (SEPTEMBER 2018).

a. Accounts Receivable Conversion of Check Payments to electronic funds transfer (EFT): If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the Government, it will be converted into an EFT.

This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within twenty-four hours and will be shown on the regular account statement.

b. The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

c. Credit Memos: Contractors are allowed, with the Contracting Officer’s written permission, to issue a credit memo when an overpayment is paid by the Bureau. The full overpayment will be credited in full to the Bureau on the next payment request (invoice/voucher). If the credit memo exceeds the payment request, it will be applied to the next payment request.

8. CONTRACTOR POINT OF CONTACT (POC) (SEPTEMBER 2018).

The Contractor’s designated Point of Contact (POC) is:

Name:

Office No:

E-Mail Address:

The POC shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the Government. The POC shall have full authority to act for the Contractor in the performance of the required supplies/services.

9. INSPECTION OF BOOKS & RECORDS (MARCH 2019).

9.1 This clause is applicable to any contractual vehicle, regardless of the amount or the manner into which it was entered.

9.2 The Contractor agrees that the Consumer Financial Protection Bureau

(including its authorized representative and/or its Office of Inspector General)

12 CONSUMER FINANCIAL PROTECTION BUREAU

(collectively, "CFPB") shall, until expiration of three (3) years after final payment under this Contract, have access to and the right to examine any directly pertinent books, documents, papers, and records of the Contractor involving transactions related to this Contract. The Contractor further agrees to include in all its subcontracts hereunder a provision to the effect that the subcontractor agrees that the CFPB shall have the same rights to the subcontractor books, documents, papers and records as specified above.

9.3 The periods of access and examination described above, for records which relate to (1) litigation or the settlement of claims arising out of the performance of this Contract, or (2) costs and expenses of this Contract as to which exception has been taken by the CFPB, shall continue until such litigation, claims, or exceptions have been disposed of, and CFPB has specified in writing that exception is no longer being taken.

10. CONTRACTOR PUBLICITY (SEPTEMBER 2018).

The Contractor, or any entity or representative acting on behalf of the Contractor, shall not refer to the equipment or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such equipment or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government may institute all remedies available under applicable law. Further, any violation of this provision may be considered during the evaluation of past performance in future acquisitions.

11. BUREAU OFFICE OF THE INSPECTOR GENERAL (OIG) (SEPTEMBER 2018)

For the avoidance of doubt, nothing in this contract shall limit the OIG's authority under the Inspector General Act to examine the Contractor's books, documents, papers, etc.

The Contractor and any subcontractor shall make notification (including posting notices in each of their respective facilities) to all Contractor and subcontractor employees working on this contract of the OIG’s hot line telephone number, 1-800-827-3340, and to report any suspected "waste, fraud, or abuse" transactions related to the performance of this contract.

12. COOPERATING WITH OTHER ORGANIZATIONS (SEPTEMBER 2018)

The Contractor(s) agrees to cooperate with representatives of other contractors, Federal Reserve Banks, Federal agencies, Governmental entities, and other organizations, as may be required by the Bureau, but only to the extent such cooperation does not violate the Contractor’s independence, create a conflict of interest, or materially interfere with the Contractor’s performance of services under this Contract.

13 CONSUMER FINANCIAL PROTECTION BUREAU

13. UNIVERSAL ACCESS AND DESIGN (SEPTEMBER 2018)

a. The Contractor shall ensure that all Electronic and Information Technology (EIT) deliverables meet or exceed accessibility and usability design requirements under Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended and refreshed January 2018, and under the Web Content Accessibility Guidelines 2.0 (WCAG 2.0) Level AA. The refreshed Section 508 Standards (January 2018) can be found at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule. The refreshed Section 508 Standards harmonize with WCAG 2.0 Level AA. EIT is also referred to as Information Computer Technology (ITC).

b. EIT deliverables include, but are not limited to: websites, mobile applications, web based applications, cloud solutions, software as a solution (SaaS), commercial off-the-shelf (COTS) products, software, hardware, webcasts, webinars, podcasts, multimedia, social media, collaborative workspaces and tools, surveys, print and electronic documents, PDFs, forms, and all training and related training materials.

c. The Contractor shall have the ability and experience in creating Section 508 conformant deliverables and in determining the Section 508 compliance of EIT including design specification, testing and verification, and remediation as required.

d. The Contractor shall acquire the necessary authoring and testing tools to create EIT deliverables and perform accessibility and usability testing in multiple environments to include a comprehensive selection of assistive technologies. The Contractor shall use the most updated version of an authoring tool that creates Section 508 conformant outputs in order to ensure its deliverables are Section 508 conformant and usable.

e. Upon the request of the Contracting Officer (CO) or the Contacting Officer’s Representative (COR), the Contractor shall present a Government Product Accessibility Template (GPAT) (https://www.section508.gov/) for each EIT deliverable. GPAT findings shall be presented in an accessible electronic format.

f. Materials intended for print shall also include an accessible, dynamic and Section 508 conformant electronic version of the deliverable. Print materials shall be made available in an alternate accessible format when requested.

g. When producing EIT deliverables, the Contractor shall follow the Bureau’s Design Manual (https://cfpb.github.io/design-manual/), including Bureau templates.

14. CYBERSECURITY/INFORMATION SECURITY (FEBRUARY 2024)

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.section508.gov/ https://cfpb.github.io/design-manual/

14 CONSUMER FINANCIAL PROTECTION BUREAU

a. The Consumer Financial Protection Bureau (CFPB) defines terms consistent with those determined by the National Institute of Standards and Technology (NIST) Glossary | CSRC (nist.gov).

1. Per NIST, an information system can be described as the following: “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.”

2. An information system includes any computer that contains Bureau data and performs any of the above tasks, not just systems of records.

b. Contractors retained for purposes of providing expert witness services to provide analysis and/or testimony in support of the Federal Government in any current or anticipated litigation or dispute are not “working on behalf of, nor agents of the CFPB.”

c. In accordance with Homeland Security Presidential Directive 12 (HSPD-12), Office of the Management and Budget (OMB) Memorandum M-19-17, CFPB Information System Security and Secure Access Controls Via Multi-Factor Authentication Policies, any Contractor requiring routine physical access to a CFPB facility and/or routine access to a CFPB federally controlled information system will be required to obtain a CFPB-issued Personal Identity Verification (PIV) card. Contractors shall take the necessary steps to obtain a PIV card, including enrollment and activation, within 45-calendar days of their CFPB start date, loss or expiration of their current PIV card. Contractors who fail to comply with this policy will be removed from their CFPB contract.

1. The Contractor shall provide its own PIV reader(s), if necessary.

2. In some situations, a PIV card may not be possible to use for CFPB information system access. If so, the Contractor shall use a CFPB authentication application on a personal or corporate mobile device.

d. The Contractor shall adhere to CFPB cybersecurity requirements for all information systems connected to CFPB network/resources or operated by the Contractor for, or on behalf of, the CFPB, regardless of location. The Contractor shall protect all CFPB-provided data to CFPB policies and standards, if stored in a Contractor system. This clause applies to all or any part of the contract that includes information technology, information resources, data, or services for which the Contractor must have physical or electronic access to CFPB information or data.

https://csrc.nist.gov/glossary

15 CONSUMER FINANCIAL PROTECTION BUREAU

e. CFPB information technology and data provided to the Contractors shall remain in the United States. The receipt, transmission, backup, accessing, maintenance, operation, and/or processing of CFPB technology and information must take place, and originate from, within the United States. Any exceptions to this must be approved in writing by the Chief Operating Officer and the Chief Information Officer.

f. The Contractor shall maintain a complete and accurate inventory of all CFPB-provided data, along with complete access records. Upon request by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR), the inventory and access records shall be made available for inspection within one business day.

g. Contractors serving as an agent of the Bureau or on the Bureau’s behalf, and are receiving, transmitting, storing, or processing intellectual property, records, or Bureau-provided data must use government-furnished equipment (GFE) or Citrix-based virtual desktop interface (VDI) to complete Bureau work. A contractor not serving as a CFPB agent or on CFPB’s behalf may elect to receive data via VDI or GFE. However, if a contractor is creating independent content (training, documentation, etc.) that the Bureau receives, approves, and then executes; the Contracting Officer’s Representative (COR) may elect to exclude specific contractor roles from requiring GFE. The COR may elect to exclude contractor roles from GFE/VDI, if the contractor role:

1. Does not access the Bureau network, resources, or data;

2. Does not manage Bureau social media or live links;

3. Does not act as a Bureau agent to generate, receive, transmit, store, or process Bureau data or act upon the Bureau’s behalf;

4. Contractor role does not generate, receive, transmit, store, or process

Bureau data (i.e., records, intellectual property, etc.);

5. Produces the content without the input of Bureau data; and,

6. All federal decision-making happens after Bureau receipt of content.

Each exclusion must be documented by the COR, approved in writing by the Bureau Authorizing Official or designee, and revisited annually.

h. The Contractor system or facility hosting CFPB information resources must meet all applicable federal, state, and local zoning, environmental, and building laws and regulations. The system or facility must include protection against unauthorized access at all hours, including alarms and notification systems, should such protection be breached.

16 CONSUMER FINANCIAL PROTECTION BUREAU

i. Detected or suspected security compromises to CFPB information must be reported to the CO or COR and soc@cfpb.gov within 60 minutes of discovery by the Contractor. In the event of a compromise, the Contractor shall grant the Government access to all facilities and information resources used in support of the contract to safeguard CFPB information resources.

j. The Contractor shall grant the Government access to all facilities and information resources used in support of the contract. The CFPB may conduct reviews to ensure that the security requirements in the contract are implemented, enforced, effective, and operating as intended. These reviews include, but are not limited to, comprehensive technical testing of the control environment used to safeguard CFPB information, data, or information resources.

k. At the expiration of the contract, the Contractor shall return all CFPB information resources provided to, or generated by, the Contractor during the period of the contract. The Contractor shall provide certification and artifacts to prove that all CFPB information/data has been sanitized from any non-GFE information system in accordance with CFPB standards and procedures. With advance notification, CFPB may surveil and/or inspect the sanitization/destruction/disposition. All equipment sanitization procedures must be environmentally sound as outlined by the U.S. Environmental Protection Agency (EPA).

l. To the extent the Contractor has Bureau assets or devices (i.e., laptop, thumb drive), the Contractor shall comply with the Bureau’s Asset Management Policy and is responsible for:

Using and protecting its assigned equipment in accordance with the Acceptable Use Policy and Guidance laid out in the Facilities Non-IT Asset Management Directive and IT Asset Management Directive; providing access to their assigned equipment when requested by the responsible Asset Management team; and immediately reporting the loss or theft of IT hardware, software, and/or data upon discovery to the COR, the CFPB Security Office at extension 59001 or (202) 435-9001, and to the Service Desk at extension 57777 or (202) 435-7777.

m. For the purposes of application development, the Contractor shall adhere to NIST Secure Software Development Framework (SSDF), SP 800-218, 800- 161, and the NIST Software Supply Chain Security Guidance for developing secure software or providing third-party software to include the adoption of open-source libraries or other application packages. CFPB encourages and prefers the use of cloud-hosted solutions. All cloud-hosted solutions will need mailto:soc@cfpb.gov

17 CONSUMER FINANCIAL PROTECTION BUREAU

to go through the Federal Risk and Authorization Management Program (FedRAMP) authorization, if not already FedRAMP authorized. If not cloud-based, CFPB prefers web-based, commercial off the shelf software that is browser agnostic. Cloud and non-cloud based solutions will need to go through CFPB’s authority to operate process. Data in cloud-based or non-cloud-based systems must be maintained within the United States at all times and may not be accessible by unauthorized individuals, including, but not limited to non-U.S.

citizens.

n. The Contractor shall adhere to all CFPB common security configurations and practices or system operation. Security configurations and practices include:

1. The provider of information technology shall certify applications are fully functional and operate as intended on systems using the United States Government Configuration Baseline and other operating system and application standards.

2. Final acceptance of the product will be based on the CFPB interpretation of the National Institute of Standards and Technology, National Checklist Program Repository (NIST, NCPR). Checklists are available at the NIST, NCPR website. In situations where security configurations are not available for proposed technologies, the CFPB shall provide instruction.

3. The installation, operation, maintenance, and update of software shall not alter any CFPB-accepted or established security configuration.

4. Applications designed for users shall run in standard user context without elevated system administrator privileges.

o. The Contractor shall notify the CO and the COR within 30 calendar days of any organizational change or impact that may interfere with the full execution of the information security requirements under the contract.

p. Throughout the term of the contract, should the Contractor deliver a product or provide a service that does not meet (and maintain) CFPB’s information security requirements, the Contractor, at their own expense, shall correct non-compliant deliverables within 90 days of notification by the CO or the COR.

q. If not a CFPB agent or working on the Bureau’s behalf, the Contractor shall maintain a computing environment that complies with NIST SP 800-171 requirements and Bureau policy and standards at all times. These requirements include, but are not limited to, documentation of the processes and procedures that the Contractor shall follow to ensure the security of IT resources that are

18 CONSUMER FINANCIAL PROTECTION BUREAU

developed, processed, transmitted, used, or maintained under this contract and comprehensive technical testing of the Contractor’s computing environment by the CFPB or CFPB-approved independent third-party.

r. Prior to the execution of the contract, the CFPB may require validation to ensure adequate security controls in the Contractor environment. When a validation is required, the validation may be conducted by the CFPB as part of an on-site inspection process or CFPB-approved independent third-party.

s. Contractors providing services that are FedRAMP certified shall ensure their FedRAMP packages remain current throughout the life of the contract.

t. The Contractor shall demonstrate, upon request by the CO or COR, the technical, operational, and management safeguards that protect the confidentiality, integrity, and availability of CFPB information that it generates, develops, processes, transmits, uses, or maintains during the execution of this contract. This demonstration may include the delivery of artifacts within the scope of the FedRAMP package and independent from FedRAMP artifacts.

u. The Contractor shall ensure its computing environment complies with Federal laws that include, but are not limited to, the Federal Information Security Modernization Act of 2014 (FISMA), and with Federal policies and procedures that include, but are not limited to: the most current versions of NIST Special Publication (SP) 800-60, 800-63A, 800-218, 800-161, 800-53 or 800-171 (as determined by CFPB), Federal Information Processing Standard (FIPS) 200, 140, and CFPB Information Security Standards (CS-S-01). Copies of these documents are maintained by the CFPB Office of Cybersecurity and are available upon request. Failure to maintain compliance with applicable statutes, regulations, and guidance is a breach of the contract. The CO or COR may conduct one or more on-site inspections to ensure compliance.

1. All Contractors and systems shall adhere to the most current OMB

Circular A-130 and NIST SP 800-53 or 800-171 requirements in alignment with the Bureau-established FIPS Publication 199 determination for that authorized system, CFPB data extract, or derived data. Unless waived by the CFPB Authorizing Official (AO) in writing:

a. Information system(s) shall have the ability to transfer audit logs to the Bureau’s centralized log collection and analysis system, Splunk by using an application programming interface (API) or a secure system log file (syslog).

https://team.cfpb.local/wiki/images/0/05/CS-S-01_-_Information_Security_Standards_V4.0_05012018.pdf

19 CONSUMER FINANCIAL PROTECTION BUREAU

b. Information system(s) shall support Security Assertion Markup Language (SAML) 2.0 or OpenID Connect (OIDC) for federated login to any web console provided by the tool, if providing a log-in capability.

c. Information system(s) shall provide a user management application programming interface or web services capability that allows for the creation, updating, disabling and deletion of accounts and permissions, if the application requires accounts.

d. The project technical team shall submit an information system security baseline in alignment with Bureau common information security standards (ISS) and the system sensitivity classifications per the Federal Information Processing Standard (FIPS) 199/200 assessments, if appropriate.

v. If not a CFPB agent or working on CFPB’s behalf, the Contractor shall adhere to applicable Federal laws, regulations, and directives as well as the most current NIST Special Publication (SP) 800-171 requirements and other security standards and policies set by CFPB for non-federal contractor information systems that receive, transmit, process, store, or collect any form of Controlled Unclassified Information (CUI) collected for or provided by the Bureau. This is applicable to sub-contractors and Vendors who also do not serve in any capacity as Bureau agents and do not have the authority to act on the Bureau’s behalf.

w. The Contractor shall adhere to NIST SP 800-218 and Bureau-defined requirements regarding all Bureau system development life cycle (SDLC) policies, procedures, and activities, as applicable. The Contractor shall adhere to NIST Secure Software Development Framework (SSDF) and the NIST Software Supply Chain Security Guidance for developing secure software or providing third-party software to include open-source software or other application packages. Further, this includes the removal and disposal of all Bureau data from Contractor-owned and operated information systems once no longer needed to complete the contract. The Contractor shall provide all requested artifacts required to verify and attest that all Bureau data has been permanently removed once the information system is no longer required to process, store, or transmit Bureau data. These artifacts include, but are not limited to:

20 CONSUMER FINANCIAL PROTECTION BUREAU

1. Independent 800-171A or 800-53A Risk Assessment per NIST Standards, as assigned by CFPB.

2. Signed letter or document from the Contractor showing/attesting that all bureau level data has been properly and correctly removed per 800- 171 or 800-53.

3. Information Security Program documentation

4. Screen captures, or equivalent, showing each step taken within the information system and result when permanently removing Bureau data.

5. On-site inspection or remote surveillance of the sanitization/disposal/disposition process.

x. If the Contractor does not report within 2 business days or does not adhere to the CFPB policy and standards, the Bureau may impose penalties until such time that the reporting and standards are remedied to the Bureau’s satisfaction and may have non-conformant systems or actions suspended until remediation conforms.

y. The Contractor shall adhere to CFBP blocking apps and sites on government-issued devices or contractor-operated networks/devices in support of CFPB work. Exceptions can be made by the CFPB AO in coordination with OMB, if a compelling business need exists.

z. The Contractor shall maintain an active information security (infosec) program to 800-171 or 800-53 standards with detective, preventative, and responsive elements to ensure administrative, managerial, technical, and physical controls per above. The program shall specifically address methods regarding handling and protecting CFPB information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems, to include end-user systems.

1. CFPB will review infosec program documentation and may interview for clarification with the proposed Contractor to assure confidence in the Contractor’s infosec program.

2. The Contractor, as deemed necessary, may use additional safeguards other than as provided for by the Contract to prevent use or disclosure of CFPB information.

21 CONSUMER FINANCIAL PROTECTION BUREAU

aa. The Contractor shall, at its own expense, take action to mitigate any harmful effect that is known to the Contractor of a use or disclosure of CFPB information/data by the Contractor in violation of the requirements of this clause.

bb. The Contractor shall not use meta-data about CFPB’s use of the service for any purpose except for troubleshooting, technical performance monitoring, or ensuring security and functionality of the service.

cc. The CFPB Office of Cybersecurity maintains current information security requirements and standards and will provide details to the Contractor as needed after contract award. The CO or COR will notify the Contractor of any substantive changes to information security requirements that have a significant impact on the Contractor’s information security obligations under the Contract.

The accountable senior executive, such as a Company Risk Executive or Chief Information Security Officer must sign acknowledgement of receipt, understanding, and compliance with all current 800-171 or 800-53 standards.

dd. The Contractor shall include the substance of this clause in all subcontracts under this Contract.

15. NON-DISCLOSURE (JANUARY 2022)

a. The Contractor recognizes that, in providing services under this contract, the Contractor may obtain access to or may become aware of confidential information pursuant to the Bureau’s regulations at 12 CFR Part 1070, et seq,.(including but not limited to information that may be privileged or proprietary in nature or contain Personally Identifiable Information (PII) and/or qualifies as Controlled Unclassified Information (CUI), as that term is defined under Executive Order 13556 (November 4, 2010) Without prior written approval by the Contracting Officer Representative (COR) or unless otherwise permitted by law, information acquired or prepared by the Contractor pursuant to providing services under this contract shall not be:

1. used by the Contractor for any purpose other than to perform work under the contract or;

2. disclosed by the Contractor to others outside

i. the approved Contractor personnel whether that personnel are providing services under this contract or another Bureau contract or

ii. the Government personnel serving in an oversight role or participating on a “need to know” basis.

b. The Contractor shall secure acquired or prepared information in a location with access limited to only the personnel groups previously stated or in a location that is determined by the COR to be acceptable. In accordance with the Contract Disputes Act, any unauthorized disclosure of non-public sensitive, confidential, or proprietary information, or Personally Identifiable Information (PII) is considered a violation of a material term of this contract.

Classified information will NOT be made available to the Contractor.

22 CONSUMER FINANCIAL PROTECTION BUREAU

c. Prior to any Contractor personnel (i.e., individual personnel working for the Contractor as an employee or under a subcontract) performing services under this contract whereby such personnel will have conditional access to confidential information, and prior to any Contractor personnel participating in any discussions or receiving any confidential information specific to this contract, each such individual Contractor personnel shall sign a Non-Disclosure Agreement (NDA). A signed NDA is required for each individual Contractor personnel meeting the criteria stated directly above. Signed NDAs are provided to the COR. If any individual Contractor personnel to be given conditional access to confidential information does not sign an NDA, the individual is not permitted to perform services, participate in discussions or receive information affiliated with this contract. The NDA covers all information relative to this contract that the Contractor may obtain access to or be made aware of, including, but not limited to, all deliverables, documents, or records.

16. PROHIBITION AGAINST THE USE OF FEDERAL EMPLOYEES (SEPTEMBER

2018)

Contracts are not to be awarded to Government employees or a business concern or other organization owned or substantially owned or controlled by one (1) or more Government employees.