Addendum1-SBAHQ-12-R-0006-Clauses-Provisions.rtf

file_0.png file_1.wmf

Addendum 1 - SF-1447 – Clauses and Provisions Page 61 of 64

SECTION A - Solicitation/Contract Form

The Contract Form is a Standard Form (SF) 1447. These Contract Clauses are a continuation of that Standard Form and are Addendum 1. The Solicitation Provisions govern the solicitation portion of the acquisition and will not be a part of the final awarded contract. The Contract Clauses will be a part of the final award.

This Contract Type is a no-cost contract to the Government. See Addendum 3, Pricing Schedule, for Contractor’s firm, fixed, fully loaded service fees for a base year and four option years. These fees will be paid out of loan proceeds generated as a result 503/504 loan actions.

SECTION B - Supplies or Services/Prices

See Addendum 3, Pricing Schedule, for Contractor’s firm, fixed, fully loaded service fees for a base year and four option years.

SECTION C - Description/Specifications

See Addendum 2 to the SF-1447 for the Performance-Based Statement of Work (SOW), titled, Performance-Based Statement of Work CENTRAL SERVICING AGENT FOR THE 503/504 LOAN PROGRAMS”, along with its 7 attachments.

The Period of Performance for this Contract is a base year with four option years. The exact dates are stated on the finalized and signed SF-1447, as the exact dates are dependent on the award date.

SECTION D - Packaging and Marking

See Addendum 1, SOW and its 7 attachments.

SECTION E - Inspection and Acceptance

52.246-4 Inspection of Services - Fixed-Price. (AUG 1996)

(a) Definition: "Services," as used in this clause, includes services performed, workmanship, and material furnished or utilized in the performance of services.

(b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires.

(c) The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all times and places during the term of the contract. The Government shall perform inspections and tests in a manner that will not unduly delay the work.

(d) If the Government performs inspections or tests on the premises of the Contractor or a subcontractor, the Contractor shall furnish, and shall require subcontractors to furnish, at no increase in contract price, all reasonable facilities and assistance for the safe and convenient performance of these duties.

(e) If any of the services do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by reperformance, the Government may -

(1) Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

(2) Reduce the contract price to reflect the reduced value of the services performed.

(f) If the Contractor fails to promptly perform the services again or to take the necessary action to ensure future performance in conformity with contract requirements, the Government may -

(1) By contract or otherwise, perform the services and charge to the Contractor any cost incurred by the Government that is directly related to the performance of such service; or

(2) Terminate the contract for default.

(End of clause)

SECTION F - Deliveries or Performance

See Addendum 2, SOW and its 7 attachments.

SECTION G - Contract Administration Data

The Contracting Officer (CO) and Contracting Officer’s Representative (COR) will administer this Contract on behalf of the Small Business Administration (SBA). The names and contact information for the CO and the COR will be provided to the Contractor upon award of this Contract. The COR appointment letter will also be provided to the Contractor after award.

SECTION H - Special Contract Requirements

H-1 Bonding and Insurance Requirements

Bonding. The Central Servicing Agent (CSA) agrees to carry a fidelity bond or similar insurance (“the bond”) in an amount of at least $200 Million. The bond shall be in place prior to award, or Contractor shall provide written evidence from a bonding agency that the bond can be obtained and put in place within 10 days following the award of the contract. Obtaining a bond is a precondition to the award of the contract. If the bond is not in place with a copy of the bond provided to the SBA within 10 days following the award of the contract, the award can be cancelled by the SBA.

The CSA shall provide proof annually that the bond is in place. The CSA shall provide the SBA with immediate notification if the bond is not in place at any time during the performance of this contract.

Bankers Insurance. At all times the CSA shall maintain a standard Bankers’ Blanket Bond Insurance policy or its equivalent in an amount customary and sufficient to provide protection against loss caused by or resulting from any actions of the CSA, its employees, or its agents. The CSA shall provide proof annually to the SBA that this insurance policy is in place. The CSA shall provide the SBA with immediate notification if this insurance is not in place at any time during the performance of this contract.

Mail Insurance. The CSA shall also maintain first class mail insurance coverage of not less than $250,000.00. The CSA shall provide proof annually to the SBA that this insurance policy is in place. The CSA shall provide the SBA with immediate notification if this insurance is not in place at any time during the performance of this contract.

Coverage. For purposes of this clause H-1 only, the CSA shall be defined as the entity comprised of both the CSA and the Trustee where the 503/504 fund accounts are located – so that the bonding and insurance cover both the CSA and the Trustee, their employees, and their agents. If the SBA requires the CSA to appoint a separate Trustee or the CSA appoints a different Trustee, the Trustee shall be required to obtain and maintain bonding and insurance as detailed in this clause.

H-2 Provision for CSA Fees

SBA will cause the terms of each Note to provide for payment of the CSA fees. SBA shall not be liable to the CSA or any other party if the CSA encounters problems collecting these fees.

H-3 Appointment of the CSA

As a condition of its guarantee of a Certified Development Company’s (CDC’s) debenture, SBA will required that the CDC appoint the CSA to service the related Note pursuant to the terms of this contract and of the individual Fiscal or Servicing Agent Agreement. SBA will require that each CDC processing office forward one or more fully executed counterparts of each Fiscal or Servicing Agent Agreement with a copy of each Note – to arrive at the CSA’s offices no later than five business days prior to the Offering Date.

H-4 Notice of Changes

It is understood that each CDC is responsible for notifying the CSA in a timely manner of any change to its name and address or of any change to the information of any Borrower, including name, address, and Automated Clearing House (ACH) information. The CSA shall maintain up-to-date records.

H-5 503/504 Measures of Quality

Timely Postings. All ACH payments shall be posted upon receipt by the CSA. All checks shall be deposited on the day they are received. All identifiable checks shall be posted within one business day of deposit. All unidentified checks shall be researched. If they cannot be identified within 10 business days, the CSA shall return them to the sender, if possible. If it is not possible to return them, the CSA shall deposit them to the Master Reserve Account (MRA) and shall maintain an unidentified check log so that the checks can be identified in the future when a borrower or other entity contacts the CSA. All identifiable wires (those wires containing a loan number or borrower’s name) shall be posted on the day they appear in the wire report of the CSA bank. All remaining wires shall either be identified or returned within three business days.

On-line System. The CSA shall completely update the on-line system files each business day to reflect loan file changes made during the previous day.

Customer Service.

Liaison. The CSA shall provide sufficient staff, and never less than one person, whose primary function shall be to act as a liaison among the CSA, the CDCs, and the SBA for the purpose of handling requests and answering questions. The CSA shall resolve ninety per cent of the requests and questions on the day received. The CSA shall resolve the remaining requests and questions within five business days – or the CSA shall inform the caller/requester of the problem and anticipated date of resolution.

Timely Transfer of Funds. If the CSA fails to disburse the amount of any Servicing Fee to the CDC or SBA, as appropriate, within the time period specified in the Statement of Work (SOW), the CSA shall pay interest on such funds to the CDC or SBA for each day such failure continues, including for the day such disbursement or transfer was required. The rate per annum for the interest shall be equal to 150% of the Wall Street Journal Prime Rate.

H-6 Penalties

Notwithstanding any other payment provision of this contract, the failure of the CSA to submit required report to perform or delivery required work, supplies, or services when due or as reasonable extended by the Contracting Officer (CO) in writing, may result in the determination by the SBA that the CSA is not entitled to retain all or part of the fees otherwise authorized by this contract. The SBA will promptly notify the CSA of any such determination and provide written instructions as to the disposition of funds. Failure arising out of a cause beyond the control of the CSA, or without the fault or negligence of the CSA will not result in penalties. The CSA will be given an opportunity to respond to a penalty claim. The determination of fault and penalty by the CO will be final.

H -7 Accesses to Records

The CSA shall provide access during regular business hours to SBA duly authorized representatives to books, electronic records, documents, papers, and any other business records (“records”) of the CSA relating to the CSA contractual duties. The CSA shall allow and facilitate the auditing and inspection by the SBA representatives. The CSA shall facilitate the ability of the SBA representatives to auditing, inspect, make transcripts or excerpts, and reproduce records. The CSA shall provide space, equipment, phones, and access to photocopiers at no cost to SBA.

H – 8 Assignment

Contract Assignment. This contract may not be assigned by either party without the consent of the other – except that, if either party merges or consolidates with any other corporation, entity, or governmental agency, such other corporation, entity, or governmental agency may be substituted for each party if it assumes all obligations and liabilities of such party hereunder and agree in writing to be bound by this contract. Novation and change of name agreements are governed by Federal Acquisition Regulation (FAR) 42.12.

Bank Account Assignment. Notwithstanding the foregoing, and in the event of a merging, consolidation, or novation, the CSA shall assign bank accounts of the

CSA relating to this contract and any related services, to a trust company or bank that is acceptable to SBA.

H-9 Litigation

Notification. The CSA shall notify the CO in writing within five business days of the service of any claim or legal process against the CSA as a result of its performance of its duties under this contract.

Indemnification. The CSA agrees to indemnify and hold harmless SBA and SBA’s officers, employees, and agents, from any costs, liabilities, and expenses arising from any action or failure to act by the CSA arising out of this contract and which constitutes negligence, breach of authority, breach of contract, or bad faith on the part of the CSA.

H-10 Third Party Rights

Nothing contained in this contract, express or implied, confers upon any person, corporation, or other entity (other than the parties hereto, and their successor and assigns as may be permitted herein) any rights or remedies under or by reason of this contract.

H-11 Audit Requirements

Fiscal Year Audit. At its own expense, the CSA shall engage an independent certified public accountant to perform an opinion audit of its financial statements for each fiscal year. The Contracting Officer’s Representative (COR) will approve the accountant selection in writing prior to the audit. The CSA shall provide the COR a copy of the accountant’s audit report within six months of the fiscal year end.

Annual Operations Audit. At its own expense, the CSA shall engage an independent certified public accountant to perform an audit of the CSA operations at the end of each fiscal year. The COR will approve the accountant selection in writing prior to the audit. The accountant shall provide a written opinion to the COR regarding the adequacy of CSA financial and operational procedures and controls. The accountant shall also give a written opinion as to whether the operational procedures and controls required by this contract are being implemented by the CSA. These opinions may contain privileged and commercial information about the CSA which may not be disclosed by SBA to third parties, except to the extent the disclosure is required by law. SBA agrees to consult with the CSA prior to disclosure of audit information to a third party.

SOC 1 Audit. At its own expense, the CSA shall conduct a Service Organization Control 1 (SOC 1) audit [previously Statement of Auditing Standards Number 70 (SAS 70)] for the operations of the 504 program. The CSA shall conduct a SOC 1 audit on an annual basis at the end of the fiscal year. The CSA shall provide a copy of this audit to the COR within ten days of obtaining the audit. As a minimum standard for the control objectives, the audit shall be conducted using The American Institute of Certified Public Accounts (AICPS) Statement on Standards for Attestation Engagements (SSAE) No. 16, which is equivalent to the General Accounting Office (GAO) Information Systems Computer Audit Manual (FISCAM) for performing all work. The procedures and report for this audit shall meet the FISCAM requirements and supplements to include application systems testing. The audit shall follow guidance provided by GAO’s Federal Information System Controls Audit Manual.

H-12 Conflict of Interest

The CSA warrants that from the time of submission of its offer until the completion of this contract that there is no conflict or apparent conflict of interest between the CSA’s private interests, and the public interest of the United States Government and SBA with respect to CSA’s duties and responsibilities under this contract. For purposes of this clause, the “CSA” includes the contractor firm or entity, its principals, its employees, its agents, and its subcontractors. The term “conflict or apparent conflict of interest” includes personal, business, and professional activities. The CSA shall include an adequate conflict of interest clause in all subcontracts stemming from this contract.

H-13 Security Requirements

Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each contractor and subcontractor must comply with Agency Personal Identity Verification (PIV) procedures when the contractor and subcontractor will have unescorted physical access to a federally-controlled facility and/or access to a federally-controlled information system (including, but not limited to, computer systems, networks, or information technology infrastructure).

In addition, data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, and statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C. § 552a). The contractor and its subcontractors will be held accountable for adherence to these statutes, regulations and guidance, as well as following SBA requirements described in this clause. Thus, anytime the term contractor is used, it shall be meant to include the contractor and all of its subcontractors working on this contract that have access to a federally-controlled facility and/or routine access to a federally-controlled information system (including, but not limited to, computer systems, networks, or IT infrastructure).

In addition, various Federal requirements obligate SBA to establish controls to limit access to PII and sensitive information, as defined below, to authorized personnel. These include OMB Circular A-130, Appendix III, and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

a. General. The contractor, within 30 days of contract award, must develop a final Systems Security Plan (SSP), which shall be updated at least annually. The SSP will be reviewed by the COR or designated technical point of contact. The SSP must establish administrative, technical, and physical security measures at the contractor’s computer facility to protect sensitive and personally identifiable information (PII) from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA. Sensitive information includes: Sensitive but Unclassified (SBU) information; procurement sensitive information; For Official Use Only (FOUO) information; information generated by or in the possession of SBA that is commercially valuable, trade secret, market sensitive, proprietary, related to an SBA enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed sensitive, confidential or non-public by an SBA office head, and is not otherwise available to the public. This definition applies to sensitive information in any form, including documents, electronic mail, computer files, conversations, and audio or video recordings. Examples of sensitive information include corporate financial data provided to SBA that has not been made public; SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act, 5 U.S.C. § 552a.

b. Protection of Sensitive and PII Data. Physical access to the contractor’s office areas that contain sensitive and PII SBA data, including SBA loan and any other data subsequently identified by SBA as sensitive or PII, must be controlled to prevent unauthorized personnel from acquiring access to this data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure. Contractor personnel must comply as follows:

(1) The 1228 “Computer Access/Clearance Form” (available from the YES page) must be read and signed.

(2) Passwords must be changed every 90 days.

(3) The contractor shall notify the COR as soon as it is known that a contractor will no longer be working on the contract. The contractor’s project manager must ensure that all personnel leaving this contract return all issued identification and any government property no later than the last day of their employment on the contract. Such identification and property must then be provided to the COR within 24 hours.

(4) The contractor must not release SBA data outside of its facility, either orally or in written form, without the express written consent of the SBA COR. The contractor must refer all requests for SBA data to the assigned SBA COR for action.

(5) SBA reserves the right to inspect the contractor’s security measures, data handling procedures and other security safeguards to determine the security posture of the contractor facility. The contractor shall provide SBA access to the contractor’s and subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of this contract, with no additional cost to SBA. Authorized SBA personnel include the Chief Information Security Officer (CISO), the Contracting Officer (CO), the COR, the Office of Inspector General (OIG) and other personnel designated by the Chief Information Officer (CIO).

(6) Weaknesses in physical, personnel, or computer security noted by SBA during the accreditation process must be corrected as specified by the CISO. Quarterly updates of the status of the corrective actions must be in writing and forwarded through the COR to the information system owner.

(7) Contingency plans must be implemented and tested annually, at a minimum, to avoid loss of SBA data and to minimize, within the provisions of the contract, the impact of contingencies (environmental failures, fire, severe weather, natural disasters, etc.) on services provided to SBA. Contractors must develop and provide plans for responding to security incidents, as that term is used in OMB Circular A-130, Appendix III, involving sensitive data and PII, and procedures for making any changes to the data processing environment. Documentation must be provided to the COR within 30 days from the date of contract award. (See NIST 800 53, as revised.)

c. Information Handling and Disposition.

(1) Sensitive data and PII when distributed electronically must be protected against unauthorized disclosure and modification. At a minimum, draft and final documents must be encrypted.

(2) The CO’s approval is required prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of sensitive information received under, generated under, or relating to this contract. The contractor support team will be required to abide by government and Agency guidance for protecting sensitive data and PII. Any such information made available in any format will be used only for the purpose of carrying out the provisions of this agreement.

Such information will not be divulged or made known in any manner to anyone outside the Agency or removed from approved work sites without approval from the COR or other authorized SBA personnel.

The contractor support team will immediately notify the COR upon discovery of any inadvertent disclosures of information. The contractor will not disclose sensitive or proprietary information of, or in the possession of, SBA or any of its operating units, contractors, or business partners to unauthorized persons. The contractor will be subjected to any and all penalties imposed by law for unlawful disclosure of SBA information which may include termination of the contract.

(3) Sensitive data and PII, and/or equipment will only be disclosed to authorized personnel with “a need-to-know” as described in the contract or order. The contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established prior to storing SBA data to ensure the security and confidentiality of this information. Data containing PII information is prohibited from being used as test data or stored in a non production-processing environment for development/testing.

(4) All contracts supporting SBA’s Information Systems shall require Internet Protocol Version 6 (IPv6) compliant products to be included in all new IT acquisitions using Internet protocol.

d. Contractor Background Investigations. The following guidelines apply to contractor background investigations:

(1) Office of Management and Budget (OMB) Circular A-130 requires that as a condition for access to Government Automated Information System (AIS) (including data), SBA must screen contractor personnel commensurate with the level of risk presented by their access to sensitive SBA systems. Not all SBA automated information systems (AIS) and data are considered sensitive. SBA policy is to perform background investigations on personnel accessing sensitive data and PII to perform their primary job functions. (See SOP 90 47 2a.)

(2) SBA designates all contractor positions requiring access to AIS and physical access to a federally-controlled facility as Moderate Risk and requires a minimum background investigation (MBI) or higher level, if required by SBA, for all such contractor employees. An adjudicated background investigation is required for all contractor personnel who cannot show positive results of a recent MBI (one that was successfully adjudicated within the last five years or the contractor has not had a break as a contractor from the Federal Government exceeding two years) or higher level investigation, such as a Limited Background Investigation or other background investigation. The COR or designated staff may assign each contract labor category a higher security sensitivity rating, which will determine the type of background investigation to be performed for that labor position.

(3) The Office of Security Operations (OSO) in the Office of Inspector General, Office of Investigations, will coordinate with the Office of Personnel Management (OPM) which will perform all required investigations. Any background investigation received by a contractor prior to employment on an SBA contract must have been conducted by OPM (or contracting firm approved by Defense Security Service (DSS) and/or OPM.) In order to be accepted by SBA, a contractor’s background investigation must be reviewed and approved by OSO to determine if it meets OPM’s standards.

The background investigation must also meet the requirements applicable to all other SBA contractor personnel. Contractor will reimburse SBA the total cost for each investigation (cost is subject to an increase by OPM each fiscal year). The FY2012 cost is $752.00. SBA’s Acquisitions Division will update you with the annual increases and provide you with the procedures to follow to ensure the Agency is reimbursed for all costs incurred.

Background investigations are not required if the contractor is not working in an SBA facility, not accessing an SBA information system, and working with non-sensitive, non-personally identifiable data.

(4) Investigation results will be reviewed by OSO for adjudication. The COR will be informed of any issues requiring additional action by the contractor.

(5) The COR will request the contractor to complete the 1228 “Computer Access/Clearance Form” and provide additional information (e.g., social security number, date and place of birth, position description). This information will be submitted to OSO to initiate the clearance process.

e. Designation of a System Security Officer (SSO). The contractor shall designate a management official responsible for fulfilling the responsibilities of an SSO who is knowledgeable in Automated Data Processing technology and computer security methodology. The SSO shall:

(1) Ensure that an appropriate level of physical, operational, and technical security is maintained to protect the computing environment(s) and facility that process SBA information, and the information is processed in accordance with SBA policy. This must include implementing controls described in an SBA approved System Security Plan and ensuring vulnerability scanning is routinely conducted for all devices supporting Agency operations. Scanning should also be conducted by the contractor’s external auditors as a part of the scope of the SOC 1 evaluation.

(2) Assist SBA’s CISO in the investigation of information technology security breaches that affect processing at the contractor’s facility.

(3) Implement, at the direction of SBA’s CISO, SBA AIS security policies, procedures, and standards that affect systems that process SBA information at the contractor’s facility.

(4) Support SBA’s CISO in maintaining the system security plan and in conducting periodic information security audits and internal control reviews. Reviews will be scheduled and conducted at least every three years, and additionally, as required by changes in the system, data, and operating environment.

(5) Recommend security enhancements and improvements where appropriate.

(6) Ensure the timely correction or remediation of discrepancies found during the periodic information security audits and internal control reviews.

(7) Ensure that an accurate inventory list of all networking devices and licensed software products is maintained.

(8) Ensure that security patches and updates are applied to SBA-owned, contractor operated computing devices in a timely fashion.

(9) Notify information system owner of all security incidents immediately after they are discovered. Detailed follow-up reports must be submitted to the CISO describing the incidents, successful/unsuccessful network penetrations, root or user account compromises, denial of service attacks, website defacing attacks, malicious code, viruses, probes and scans, etc.

(10) Ensure that all contractors with access to SBA’s IT systems and/or sensitive data and PII, complete the annual Computer Security Awareness Training (CSAT) and report status of completion to SBA for tracking. New contractors must complete the CSAT within 45 days from starting to work as an SBA contractor.

(11) Provide SBA with a copy of the facility’s SOC 1 audit in accordance with Federal guidelines over hosted applications as outlined in NIST 800-53, Recommended Security Controls for Federal Information Systems and Organizations and provisions of OMB Bulletin 07-04, Audit Requirements for Federal Financial Statements. The SOC 1 audit is a “Report on the Processing of Transactions by Service Organizations” where professional standards are set up to audit and assess internal controls of that specific service organization. In this instance, the specific organization would be the outsourcing facility that hosts and/or processes data belonging to SBA. The SOC 1 audit serves as SBA’s verification that the facility has satisfactory controls and safeguards in place to protect Agency data housed at a third party service provider.

(12) SBA system owners will ensure that all contractors that have been granted access to one or more of SBA’s information systems are provided with a copy of the system’s “Rules of Behavior” which is a group of standards detailing permissible actions while using the system.

f. Service Level for Reporting, Review and Resolution. SBA system owners and contractors hosting SBA systems off-site, must ensure the system is capable of logging and the logging feature is enabled. Logs should capture account, name, normal and exceptional activities time, data and source of occurrence. Logs for privileged accounts (e.g., administrator, auditor, database administrator) must be set up to capture all activities carried out with these accounts with controls that cannot be altered by an individual. The contractor shall include in their proposal an established process and designated resources for the review and monitoring of such logs.

(1) Frequency of review of system and audit logs

a. Logs must be reviewed daily.

b. Critical and High alerts must be addressed within one hour.

(2) Log Retention

a. Logs must be kept for at least 90 days before deleting. After 90 days, logs must be archived offline.

b. Archived logs must be kept for at least one year.

(3) Turn-around time for reporting of events such as security incidents and violations.

a. Security incidents and violations need to be reported to SBA within one hour.

(4) Turn-around time for resolution of reported security problems

a. Reported security problems must be resolved within three business days of initial report.

(5) Turn-around time for applying approved security patches, updates and changes

a. Security patches, updates and changes need to be applied within one week from release date. However, quality assurance testing must be done on all patches, updates and changes before they are applied.

(6) Submission of reports such as periodic problems, audit and system reports a.Weekly report submission is required.

g. SBA Information Technology Security Program Requirements. The following Federal laws, OMB/NIST/SBA Policies and Guidelines are applicable to operating or hosting all SBA systems. See documents and links below:

SBA’s IT Security Policies Please access the website to review and comply with the following SOPs pertaining to SBA’s Information Security Program:

• SBA Standard Operating Procedure (SOP) 90 47 2, Automated Information Systems Security Program

Upon request, the CO or the COR will provide you with copies of the following documents:

Patches (October 22, 2000)

Public Law and Statutes http://www.whitehouse.gov/omb

Office of Management and Budget (OMB) Circulars and Bulletins http://www.whitehouse.gov/omb

E-Government Act of 2002;

Federal Information Processing Standards Publications (FIPS PUBs):

http://www.nist.gov/index.html

H-14 Participation in Training Programs

At its own expense and each year, the CSA shall participate in a minimum of 12 industry-sponsored and SBA-sponsored training programs. Participation shall include sending at least one person to conduct a training session or provide technical assistance to the training session. The CSA shall report its participation in writing to the COR.

H-15 Customer Service Representative Location

All CSA customer service representatives shall be located in the continental United States of America, Alaska, Hawaii, or any location where the SBA has a district office. The CSA shall receive prior written approval from the COR prior to performing any work related to this contract outside of the continental United States of America, Alaska, Hawaii, or any location where the SBA has a district office.

H-16 Status of Successful Proposal in Awarded Contract

The CSA’s successful technical proposal and pricing schedule are a part of this contract. The proposal and schedule shall be given precedent in the order that follows:

The Statement of Work along with the 7 attachments, Representations by the CSA in response to Solicitation Provisions (including Contractor’s technical proposal and pricing schedule), Contract Clauses, and

Documents, exhibits, and attachments to the Contract clauses.

H-17 Key Personnel

The CSA shall designate in writing to the COR specific senior-level professional and managerial personnel as key personnel who are essential by the successful performance of work under this contract. Key personnel shall be available for full-time assignment to the contract’s duties as necessary to efficiently manage the contract work. Key personnel shall be available on the award date of this contract. Following contract award and throughout the life of the contract, the CSA shall not permit the substitution of key personnel without the prior written consent of the COR, unless the substitution is necessitated by an individual’s sudden illness, death, or employment termination.

In the event the substitution of key personnel is desire, the CSA shall submit a justification to the COR. The justification shall be in sufficient detail to permit evaluation of the effect on this contract. The justification shall include the resumes of proposed substitute key personnel. Proposed substitute key personnel shall have education and experience substantially equal to the key personnel being replaced. Request for a substitution shall provide a detailed explanation of the circumstances necessitating the substitution. The COR will evaluate the request and notify the CSA of approval or disapproval in writing.

H - 18 Confidential or Sensitive Information

While performing contractual duties, the CSA may gain access to confidential data which is the sole property of SBA and to proprietary data which is the property of others. The CSA shall maintain the confidentiality of all such data. The CSA shall not disclose any data or interpretations and derivatives of any data to any third party without the express written approval of the COR and of the party in which title to the data is vested. The CSA shall include this clause in all subcontracts, consulting contracts or auditing contracts relating to this Contract. Each employee of the CSA shall sign a Non-Disclosure Agreement (the form of which is attached to the SOW) prior to beginning work on this contract.

The work to be performed and data released to the CSA’s designated key personnel shall be treated as sensitive in nature and shall not be discussed with or released to anyone except Government employees assigned to this work and other contract-employees assigned to work on this contract’s work. The CSA shall be responsible for having all its employees working under this contract or having access to privileged information under this contract to execute Non-Disclose Agreements and all additional certifications required by SBA. The SBA, as it deems appropriate, may require additional certifications related to confidential or sensitive information from the CSA during the life of this contract.

Additionally, the CSA shall not disclose any information contained in this contract or the work papers related to examination of conditions, or reports prepare by, on behalf of, or for the use of the CSA to third parties, including clients and customers.

H – 19 Continuity of Services

The CSA recognizes that the services under this contract are vital to the Government and must be continued without interruption, and that, upon contract expiration, a successor may continue the contractual effort. The CSA agrees to furnish phase-in-training and to exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

Upon written notification from the COR, the CSA shall furnish phase-in, phase-out services for up to 120 days after this contract expires. The CSA shall negotiate in good faith a plan with a successor to determine the nature and extent of phase-in and phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division (task) of work described in the plan, and shall be subject to the approval of the COR.

The CSA shall transfer at least 50% of the existing loan portfolio, as well as the related servicing function, to the successor within the first 60 days of the phase-in, phase-out period. The CSA shall provide sufficient experience personnel during the phase-in, phase-out period to ensure that the services call for by this contract are maintained at the required level of proficiency.

The CSA shall allow as many personnel as practical to remain on the job to assist the successor in maintaining the continuity and consistency of the services required by this contract. The CSA shall also disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees of the CSA are agreeable to the change, the CSA shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

During the transition period the CSA shall continue to be compensated pursuant to the fee rates set forth in its pricing schedule for the servicing of loans in its portfolio as the loans and servicing functions are transferred to the successor. It is understood that the successor will be compensated pursuant to the fee rates set forth in its contract.

H – 20 Subcontract Approval

Any subcontracting efforts shall be approved in writing by the Contracting Officer (CO) prior to the beginning of work by the subcontractor. Subcontractors shall meet the security requirements of the contract as stated for the contractor.

The CSA shall submit the required subcontracting reports in the Government database known as the Electronic Subcontracting Reporting System (eSRS).

SECTION I - Contract Clauses

52.202-1 Definitions. (JUL 2004)

52.203-3 Gratuities. (APR 1984)

52.203-5 Covenant Against Contingent Fees. (APR 1984)

52.203-6 Restrictions on Subcontractor Sales to the Government. (SEP 2006)

52.203-7 Anti-Kickback Procedures. (OCT 2010)

52.203-8 Cancellation, Rescission, and Recovery of Funds for Illegal or Improper Activity. (JAN 1997)

52.203-10 Price or Fee Adjustment for Illegal or Improper Activity. (JAN 1997)

52.203-12 Limitation on Payments to Influence Certain Federal Transactions. (OCT 2010)

52.203-13 Contractor Code of Business Ethics and Conduct. (APR 2010)

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper. (May 2011)

52.204-7 Central Contractor Registration. (APR 2008)

52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause)

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards. (JUL 2010)

52.209-6 Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (DEC 2010)

52.209-9 - UPDATES OF PUBLICLY AVAILABLE INFORMATION REGARDING RESPONSIBILITY MATTERS (JAN 2011)

(a) The Contractor shall update the information in the Federal Awardee Performance and Integrity Information System (FAPIIS) on a semi-annual basis, throughout the life of the contract, by posting the required information in the Central Contractor Registration database at http://www.ccr.gov/.

(b)(1) The Contractor will receive notification when the Government posts new information to the Contractor's record.

(2) The Contractor will have an opportunity to post comments regarding information that has been posted by the Government. The comments will be retained as long as the associated information is retained, i.e., for a total period of 6 years. Contractor comments will remain a part of the record unless the Contractor revises them.

(3)(i) Public requests for system information posted prior to April 15, 2011, will be handled under Freedom of Information Act procedures, including, where appropriate, procedures promulgated under E.O. 12600.

(ii) As required by section 3010 of Public Law 111-212, all information posted in FAPIIS on or after April 15, 2011, except past performance reviews, will be publicly available.

(End of clause)

52.215-2 Audit and Records - Negotiation. (OCT 2010)

52.215-8 Order of Precedence - Uniform Contract Format. (OCT 1997)

52.216-24 Limitation of Government Liability. (APR 1984)

(a) In performing this contract, the Contractor is not authorized to make expenditures or incur obligations exceeding “zero amount” dollars.

(b) The maximum amount for which the Government shall be liable if this contract is terminated is “zero amount” dollars.