2-Addendum1-REVISED-Clauses Provisions-07112013.pdf

Addendum 1 – Clauses & Provisions

SBAHQ-13-R-0002 – Fiscal Transfer Agent (FTA/Contractor) for the SBA 7(a) Guaranteed Loan Program

SECTION A - Solicitation/Contract Form

The contract form is a Standard Form (SF) 1447. These contract clauses are a continuation of the Standard Form, and are Addendum 1 to the awarded contract.

The solicitation provisions (Sections L & M) govern the solicitation portion of the acquisition and will not be a part of the awarded contract. Sections L & M instruct Offerors how to submit proposals and how those proposals will be evaluated.

The Contractor is not compensated under this contract with appropriated funds. The contract type is a no-cost to the Government. The Contractor is compensated with fees generated by the secondary market activity for the SBA 7(a) guaranteed loans, in accordance with the Performance-Based Statement of Work (SOW), Addendum 2, and

Contractor’s Pricing Schedule, Addendum 3.

The Contractor fees are firm, fixed, and fully loaded. Contractor’s fees, as stated on its

Pricing Schedule, Addendum 3, represent Contractor’s sole compensation pursuant to this

Contract.

The contract is for a Base Year and four Option Years.

SECTION B - Supplies or Services/Prices

See Addendum 3, Pricing Schedule, for the Contractor’s firm, fixed, fully loaded fees for a

Base Year and four Option Years.

SECTION C - Description/Specifications

See Addendum 2 to the SF-33 for the Performance-Based Statement of Work (SOW), titled, “PERFORMANCE-BASED DESCRIPTION / SPECIFICATIONS /

STATEMENT OF WORK - FISCAL TRANSFER AGENT FOR THE SBA 7(a)

GUARANTEED LOAN PROGRAM,” consisting of 27 pages.

SECTION D - Packaging and Marking

See Addendum 2, the SOW.

SECTION E - Inspection and Acceptance

52.246-4 Inspection of Services - Fixed-Price. (AUG 1996)

SECTION F - Deliveries or Performance

See Addendum 2, the SOW.

SECTION G - Contract Administration Data

The Contracting Officer (CO) and Contracting Officer’s Representative (COR) will administer this Contract on behalf of the U. S. Small Business Administration (SBA).

The names and contact information for the CO and for the COR will be provided to the

Contractor upon award of this contract. The COR appointment letter will also be provided to the Contractor after award.

SECTION H - Special Contract Requirements

H-1 Bonding and Insurance Requirements

See Addendum 2, SOW, Section 3.0 – SPECIAL CONTRACT REQUIREMENTS, Paragraph C-9, Bonding Requirements, Pages 19-20.

Upon award, and annually thereafter, the Contractor shall provide written proof to the COR that the bonding and insurance required are in place. Contractor shall provide immediate written notice to the COR at any time during the contract period when the bonding or insurance is no longer in place.

For purposes of bonding and insurance, the Contractor shall be defined as the entity comprised of both the Contractor and all banks or financial institution where the 7(a) program fund accounts are located.

H-2 Penalties

Notwithstanding any other payment provision of this contract, failure of the Fiscal Transfer

Agent (FTA/Contractor) to submit required reports or failure to perform or deliver required work, supplies, or services required under this contract when due or as reasonably extended by CO in writing, may result in the determination by SBA that the Contractor is not entitled to retain all or part of the fees and float income otherwise authorized by this contract. The

SBA will promptly notify the Contractor of any such determination and provide written instructions as to the disposition of funds. Failure arising out of a cause beyond the control of the Contractor, and without the fault or negligence of the Contractor, will not result in penalties. The Contractor will be given a reasonable opportunity to respond to a penalty claim. The determination of fault and penalty by the CO will be final.

H-3 Access to Records

SBA’s duly authorized representatives shall have access, during regular business hours, to audit, inspect, make transcripts or excerpts of, or reproduce in whole or in part, any pertinent books, electronic records, documents, papers and any other records of the

Contractor relating to the operation of the 7(a) Program. Notwithstanding SBA’s expressed intention to require certain Contractor staff in Washington, D.C., the Contractor shall otherwise supply space, equipment, phones, and access to photocopiers at no cost to SBA.

SBA shall supply at its expense space, equipment, phones, and access to photocopiers to the Contractor staff located at SBA headquarters.

H-4 Assignment

This Contract may not be assigned by either party without the consent of the other -except that if either party shall merge or consolidate with any other corporation, entity, or governmental agency, then the new other corporation, entity, or governmental agency may be substituted for the previous party if the new party assumes all obligations and liabilities of the previous party hereunder, and if the new party agrees in writing to be bound by this Contract. In the event of an assignment, a change of name agreement and a formal contract modification, as governed by FAR part 42.12, shall be executed.

Notwithstanding the foregoing, the Contractor shall assign bank accounts of the

Contractor under the contract, and any services related thereto, to a trust company or bank that is acceptable to SBA.

H-5 Third Party Rights

Nothing contained in this contract, express or implied, is intended to or shall confer upon any person, corporation or other entity, other than the parties hereto and their successors and assigns, as may be permitted herein, any rights or remedies, under or by reason of this contract. There are no third party rights pursuant to this Contract.

H-6 Conflict of Interest

The Contractor warrants that from the time of submission of an offer until the completion of the contract, there shall be no conflict or apparent conflict of interest between the

Contractor’s private interests and the public interests of the United States with respect to the Contractor's duties or responsibilities under Government contracts. This clause covers the firm, its principals, its employees, and subcontractors. Examples of potential conflicts of interest are in personal, business, or professional activities. The Contractor shall be responsible for having an adequate conflict of interest clause present in all subcontracts stemming from the contract.

For purposes of this contract, it is not considered a conflict of interest for the Contractor to operate an SBA 7(a) guaranteed loan program. However, throughout the life of this contract, Contractor shall keep in effect the provisions of separation and independence between the duties in its 7(a) loan program and its FTA contractual duties to the SBA.

H-7 Security Requirements

Section 8.0, SECURITY REQUIREMENTS, of the SOW, states the primary security requirements as it relates to the Contract Requirements. However, the following clause governs the entire SBA IT environment, including the security requirement for

Contractor’s employees working on-site at the SBA Headquarters Offices.

Pursuant to Federal Acquisition Regulation (FAR) clause 52.204-9, incorporated into this solicitation and the resulting contract, each Contractor and Subcontractor must comply with Agency Personal Identity Verification (PIV) procedures when the Contractor and

Subcontractor will have unescorted physical access to a federally-controlled facility and/or access to a federally-controlled information system (including, but not limited to, computer systems, networks, or information technology infrastructure).

In addition, data contained within all SBA computer systems are governed by Agency record disclosure and privacy regulations (13 C.F.R. part 102), IT Security regulations as well as other regulations, and statutes and guidance, including the Privacy Act of 1974, as amended (5 U.S.C. § 552a). The Contractor and its Subcontractors will be held accountable for adherence to these statutes, regulations and guidance, as well as following

SBA requirements described in this clause. Thus, anytime the term “Contractor” is used, it shall be meant to include the Contractor and all of its Subcontractors working on this contract that have access to a federally-controlled facility and/or routine access to a federally-controlled information system (including, but not limited to, computer systems, networks, or IT infrastructure).

In addition, various Federal requirements obligate SBA to establish controls to limit access to PII and sensitive information, as defined below, to authorized personnel. These include

OMB Circular A-130, Appendix III, and OMB Memoranda M-10-15, M-09-29, M-08-21, M-07-19, M-07-16, M-06-16, and M-06-15.

a. General. The Contractor, if newly awarded, shall within 30 days of Contract award, must develop a final Systems Security Plan (SSP), which shall be updated at least annually.

The SSP will be reviewed by the COR or designated technical point of contact. The SSP shall establish administrative, technical, and physical security measures at the Contractor’s computer facility to protect sensitive and personally identifiable information (PII) from unauthorized disclosure, alteration, or misuse; prevent unauthorized access to the contractor’s computer system; and protect the availability of data and services to SBA.

Sensitive information includes: Sensitive but Unclassified (SBU) information;

procurement sensitive information; For Official Use Only (FOUO) information;

information generated by or in the possession of SBA that is commercially valuable, trade secret, market sensitive, proprietary, related to an SBA enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed sensitive, confidential or non-public by an SBA office head, and is not otherwise available to the public. This definition applies to sensitive information in any form, including documents, electronic mail, computer files, conversations, and audio or video recordings.

Examples of sensitive information include corporate financial data provided to SBA that has not been made public; SBA planned or contemplated courses of action regarding SBA examinations, investigations, and enforcement actions; and SBA personnel information covered by the Privacy Act, 5 U.S.C. § 552a.

b. Protection of Sensitive and PII Data. Physical access to the Contractor’s office areas that contain sensitive and PII SBA data, including SBA loan and any other data subsequently identified by SBA as sensitive or PII, shall be controlled to prevent unauthorized personnel from acquiring access to this data. Log-on passwords, identifiers, and access procedures must be safeguarded from unauthorized use and disclosure.

Contractor personnel must comply as follows:

(1) The 1228 “Computer Access/Clearance Form” (available from the YES page) shall be read and signed;

(2) Passwords shall be changed every 90 days;

(3) The contractor shall notify the COR as soon as it is known that an employee or

Subcontractor of Contractor will no longer be working on the Contract. The

Contractor’s project manager shall ensure that all personnel leaving this Contract return all issued identification and any Government property no later than the last day of their employment on the contract. Such identification and property must then be provided to the COR within 24 hours.

(4) The Contractor shall not release SBA data outside of its facility, either orally or in written form, without the express written consent of the COR. The

Contractor shall refer all requests for SBA data to the assigned COR for action.

(5) SBA reserves the right to inspect the Contractor’s security measures, data handling procedures and other security safeguards to determine the security posture of the Contractor facility. The Contractor shall provide SBA access to the

Contractor’s and any Subcontractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of this Contract, with no additional cost to SBA. Authorized SBA personnel include the Chief

Information Security Officer (CISO), the Contracting Officer (CO), the

Contracting Officer’s Representative (COR), the Office of Inspector General (OIG) and other personnel designated by the Chief Information Officer (CIO).

(6) Weaknesses in physical, personnel, or computer security noted by SBA during the accreditation process shall be corrected as specified by the CISO. Quarterly updates of the status of the corrective actions shall be in writing and forwarded through the COR to the information system owner.

(7) Contingency plans shall be implemented and tested annually, at a minimum, to avoid loss of SBA data and to minimize, within the provisions of the Contract, the impact of contingencies (environmental failures, fire, severe weather, natural disasters, etc.) on services provided to SBA. Contractors shall develop and provide plans for responding to security incidents, as that term is used in OMB

Circular A-130, Appendix III, involving sensitive data and PII, and procedures for making any changes to the data processing environment. Documentation shall be provided to the COR within 30 days from the date of contract award. (See NIST

800 53, as revised.)

c. Information Handling and Disposition.

(1) Sensitive data and PII when distributed electronically shall be protected against unauthorized disclosure and modification. At a minimum, draft and final documents shall be encrypted.

(2) The CO’s approval is required prior to engaging in any contractual relationship (Sub-contractor) in support of this Contract requiring the disclosure of sensitive information received under, generated under, or relating to this contract.

The Contractor support team will be required to abide by Government and Agency guidance for protecting sensitive data and PII. Any such information made available in any format will be used only for the purpose of carrying out the provisions of this Contract. Such information shall not be divulged or made known in any manner to anyone outside the Agency or removed from approved work sites without approval from the COR or other authorized SBA personnel. The

Contractor support team shall immediately notify the COR upon discovery of any inadvertent disclosures of information. The Contractor will not disclose sensitive or proprietary information of, or in the possession of, SBA or any of its operating units, contractors, or business partners to unauthorized persons. The Contractor will be subjected to any and all penalties imposed by law for unlawful disclosure of

SBA information, which may include termination of the Contract.

(3) Sensitive data and PII, and/or equipment shall only be disclosed to authorized personnel with “a need-to-know,” as described in the Contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established prior to storing SBA data to ensure the security and confidentiality of this information. Data containing PII information is prohibited from being used as test data or stored in a non-production-processing environment for development/testing.

(4) All contracts supporting SBA’s Information Systems shall require Internet

Protocol Version 6 (IPv6) compliant products to be included in all new IT acquisitions using Internet protocol.

d. Contractor Background Investigations. The following guidelines apply to Contractor employee / subcontractor/ personnel background investigations:

(1) Office of Management and Budget (OMB) Circular A-130 requires that as a condition for access to Government Automated Information System (AIS)

(including data), SBA must screen contractor personnel commensurate with the level of risk presented by their access to sensitive SBA systems. Not all SBA automated information systems (AIS) and data are considered sensitive. SBA policy is to perform background investigations on personnel accessing sensitive data and PII to perform their primary job functions. (See SOP 90 47 3.)

(2) SBA designates all Contractor positions requiring access to AIS and physical access to a Federally-controlled facility as Moderate Risk and requires a minimum background investigation (MBI) or higher level, if required by SBA, for all such

Contractor employees. An adjudicated background investigation is required for all Contractor personnel who cannot show positive results of a recent MBI (one that was successfully adjudicated within the last five years or the Contractor has not had a break in time as a Contractor from the Federal Government exceeding two years) or higher level investigation, such as a Limited Background Investigation or other background investigation. The COR or designated staff may assign each contract labor category a higher security sensitivity rating, which will determine the type of background investigation to be performed for that labor position.

(3) The Office of Security Operations (OSO) in the Office of Inspector General, Office of Investigations, will coordinate with the Office of Personnel Management

(OPM) which will perform all required investigations. Any background investigation received by a Contractor employee / subcontractor prior to employment on an SBA contract must have been conducted by OPM (or contracting firm approved by Defense Security Service (DSS) and/or OPM.) In order to be accepted by SBA, a Contractor’s background investigation must be reviewed and approved by OSO to determine if it meets OPM’s standards.

The background investigation must also meet the requirements applicable to all other SBA contractor personnel. The cost of background checks is borne by the

Government. Background investigations are not required if the Contractor is not working in an SBA facility, not accessing an SBA information system, and working with non-sensitive, non-personally identifiable data.

(4) Investigation results will be reviewed by OSO for adjudication. The COR will be informed of any issues requiring additional action by the Contractor.

(5) The COR will request the Contractor to complete the 1228 “Computer

Access/Clearance Form” and provide additional information (e.g., social security number, date and place of birth, position description). This information will be submitted to OSO to initiate the clearance process.

e. Designation of a System Security Officer (SSO). The Contractor shall designate a management official responsible for fulfilling the responsibilities of an SSO who is knowledgeable in Automated Data Processing technology and computer security methodology. The SSO shall:

(1) Ensure that an appropriate level of physical, operational, and technical security is maintained to protect the computing environment(s) and facility that process SBA information, and the information is processed in accordance with

SBA policy. This security shall include implementing controls described in an

SBA approved System Security Plan and ensuring vulnerability scanning is routinely conducted for all devices supporting SBA operations. Scanning shall also be conducted by the contractor’s external auditors as a part of the scope of the

SOC 1 evaluation.

(2) Assist SBA’s CISO in the investigation of information technology security breaches that affect processing at the Contractor’s facility.

(3) Implement, at the direction of SBA’s CISO, SBA AIS security policies, procedures, and standards that affect systems that process SBA information at the contractor’s facility.

(4) Support SBA’s CISO in maintaining the system security plan and in conducting periodic information security audits and internal control reviews.

Reviews shall be scheduled and conducted at least every three years, and additionally, as required by changes in the system, data, and operating environment.

(5) Recommend security enhancements and improvements where appropriate.

(6) Ensure the timely correction or remediation of discrepancies found during the periodic information security audits and internal control reviews.

(7) Ensure that an accurate inventory list of all networking devices and licensed software products is maintained.

(8) Ensure that security patches and updates are applied to SBA-owned, Contractor-operated computing devices in a timely fashion.

(9) Notify information system owner of all security incidents immediately after they are discovered. Detailed follow-up reports shall be submitted to the CISO describing the incidents, successful/unsuccessful network penetrations, root or user account compromises, denial of service attacks, website defacing attacks, malicious code, viruses, probes and scans, etc.

(10) Ensure that all Contractors with access to SBA’s IT systems and/or sensitive data and PII, complete the annual Computer Security Awareness Training (CSAT) and report status of completion to SBA for tracking. New Contractors must complete the CSAT within 45 days from starting to work as an SBA contractor.

(11) Provide SBA with a copy of the facility’s SOC 1 audit in accordance with

Federal guidelines over hosted applications as outlined in NIST 800-53, Recommended Security Controls for Federal Information Systems and

Organizations and provisions of OMB Bulletin 07-04, Audit Requirements for

Federal Financial Statements. The SOC 1 audit is a “Report on the Processing of

Transactions by Service Organizations” where professional standards are set up to audit and assess internal controls of that specific service organization. In this instance, the specific organization would be the outsourcing facility that hosts and/or processes data belonging to SBA. The SOC 1 audit serves as SBA’s verification that the facility has satisfactory controls and safeguards in place to protect Agency data housed at a third party service provider.

(12) SBA system owners will ensure that all Contractors that have been granted access to one or more of SBA’s information systems are provided with a copy of the system’s “Rules of Behavior” which is a group of standards detailing permissible actions while using the system.

f. Service Level for Reporting, Review and Resolution. SBA system owners and

Contractors hosting SBA systems off-site, must ensure the system is capable of logging and the logging feature is enabled. Logs should capture account, name, normal and exceptional activities time, data and source of occurrence. Logs for privileged accounts

(e.g., administrator, auditor, database administrator) must be set up to capture all activities carried out with these accounts with controls that cannot be altered by an individual. The

Contractor shall include in their proposal an established process and designated resources for the review and monitoring of such logs.

(1) Frequency of review of system and audit logs

a. Logs shall be reviewed daily.

b. Critical and High alerts shall be addressed within one hour.

(2) Log Retention

a. Logs shall be kept for at least 90 days before deleting. After 90 days, logs must be archived offline.

b. Archived logs shall be kept for at least one year.

(3) Turn-around time for reporting of events such as security incidents and violations.

a. Security incidents and violations shall be reported to SBA within one hour.

(4) Turn-around time for resolution of reported security problems

a. Reported security problems shall be resolved within three business days of initial report.

(5) Turn-around time for applying approved security patches, updates and changes

a. Security patches, updates and changes shall be applied within one week from release date. However, quality assurance testing shall be done on all patches, updates and changes before they are applied.

(6) Submission of reports such as periodic problems, audit and system reports a.Weekly report submission is required.

g. SBA Information Technology Security Program Requirements. The following

Federal laws, OMB/NIST/SBA Policies and Guidelines are applicable to operating or hosting all SBA systems. See documents and links below:

SBA’s IT Security Policies

Please access the website to review and comply with the following SOPs pertaining to

SBA’s Information Security Program:

• SBA Standard Operating Procedure (SOP) 90 47 3, Automated Information

Systems Security Program

• SBA Standard Operating Procedure (SOP) 90 49, Appropriate Use of SBA’s

Automated Information Systems

• Standard Operating Procedure (SOP) 90 50, Breach Notification Response Plan

Upon request, the CO or the COR will provide you with copies of the following documents:

• SBA Procedural Notice 9000-1709: Protecting End User Files Containing

Sensitive and Personally Identifiable Information

• SBA Information Notice 9000-1241: New Internet Monitor (November 22, 2000)

• SBA Information Notice 9000-1227: Computer Security Reminder, (September 21, 2000)

• SBA Information Notice 9000-1205: E-Mail Passwords (April 13, 2000)

• SBA Procedural Notice 9000-1383: Managing Security Alerts and Vendor

Patches (October 22, 2000)

• SBA Procedural Notice 9000-1388: Information Technology System

Interconnection Requirements (November 19, 2002)

• SBA Procedural Notice 9000-1391: Storage Media Handling and Disposal

(November 26, 2002)

• SBA Procedural Notice 9000-1392: Information Technology - Maintaining

System Security Documentation (November 26, 2002)

• SBA Procedural Notice 9000-1797 Computer Security Awareness and Training

(May 14, 2009)

• SBA Procedural Notice 9000-1397: Telecommuting Security Policy (December

27, 2002)

• SBA Procedural Notice 9000-1400: Information Technology - Computer Security

Rules of Behavior (January 2, 2003)

• SBA Procedural Notice 9000-1403: Automated Information System Support

Separation of Duties (January 7, 2003)

• SBA Procedural Notice 9000-1405: Information Technology - Protection of

Backup and Recovery Media (January 14, 2003)

• SBA Procedural Notice 9000-1406: Removal of Old Computer User Accounts

(January 13, 2003)

• SBA Procedural Notice 9000-1407: Information Technology - System and

Application Audit Logs and Trails (January 13, 2003)

• SBA Policy Notice 9000-1830: Wireless Security Policy (October 14, 2009)

Public Law and Statutes http://www.whitehouse.gov/omb

• Privacy Act of 1974 (5 U.S.C. § 552a)

• Freedom of Information Act (5 U.S.C. § 522b)

• Federal Managers Financial Integrity Act of 1982 (31 U.S.C. § 1352)

• Paperwork Reduction Act of 1986 (44 U.S.C. 35)

• Electronic Communications Privacy Act of 1986 (P.L. 99-508, as amended;

codified in 18 U.S.C. chapters 119, 121 and 206)

• Computer Fraud and Abuse Act of 1986 (P.L. 99-474, as amended; codified at 18

U.S.C. § 1030)

• Information Technology Management Reform Act of 1996 (Clinger-Cohen Act)

(Division E of P.L. 104-106, as amended; codified in part in 44 U.S.C. chapters 111, 113, 115 and 117)

• Title III of the E-Government Act of 2002 (P.L. 107-347) and Federal Information

Security Management Act of 2002 (FISMA) (P.L. 107-296; codified in part in 44 U.S.C.

chapters 35 and 36)

• Computer Security Act of 1987 (P.L. 100-235, as amended)

Office of Management and Budget (OMB) Circulars and Bulletins http://www.whitehouse.gov/omb

• Office of Management and Budget (OMB) Circular A-123, Management’s

Responsibility for Internal Control, Dec. 21, 2004, OMB Circular A-127, Financial

Management Systems, revised July 23, 1993;

• OMB Circular A-130, Management of Federal Information Resources, Appendix

III, Transmittal #4, Security of Federal Automated Information Resources, Nov. 28, 2000;

• Executive Order (EO) 12656, Assignment of Emergency Preparedness

Responsibilities (COOP Plans), Nov. 18, 1988, as amended by EO 13074, Feb. 9, 1998;

• EO 13011, Federal Information Technology, July 16, 1996;

• OMB Circular No. A-130, Appendix III establishes a minimum set of controls to be included in the Federal automated information security programs and links agency automated information security programs and agency management control systems established in accordance with OMB Circular No. A-123; OMB Bulletin 90-08, Guidance for Preparation and Submission of Security Plans for Federal Computer Systems that Contain Sensitive Information, July 9, 1990;

• Homeland Security Presidential Directive (HSPD-7), Critical Infrastructure

Identification, Prioritization and Protection;

• HSPD-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

• Presidential Decision Directive (PDD) 67, Continuity of Government (COG) and

Continuity of Operations (COOP) Plans Practices for Securing Critical Information and

Information Systems and Networks, 1988;

• M-03-22 – OMB Guidance for Implementing the Privacy Provisions of the

E-Government Act of 2002;

• M-05-16 – Regulation on Maintaining Telecommunication Services During a

Crisis or Emergency in Federally-owned Buildings;

• M-06-16 – Protection of Sensitive Agency Information;

• M-06-20 – FY 2006 Reporting Instructions for the Federal Information Security

Management Act and Agency Privacy Management;

• M-06-15 – Safeguarding Personally Identifiable Information;

• M-06-19 – Reporting Incidents Involving Personally Identifiable Information and

Incorporating the Cost for Security in Agency Information Technology Investments;

• M-07-11 – Implementation of commonly Accepted Security Configurations for

Windows Operating Systems, March 22, 2007;

Federal Information Processing Standards Publications (FIPS PUBs):

http://www.nist.gov/index.html

• FIPS-201, Personal Identity Verification (PIV) of Federal Employees and

Contractors;

• FIPS PUB 199, Standards for Security Categorization of Federal Information and

Information Systems;

• FIPS PUB 200, Minimum Security Requirements for Federal Information Systems;

• National Institute of Standards and Technology (NIST) Special Publication (SP)

800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems;

• NIST SP 800-37, Guide for the Security Certification and Accreditation of Federal information Systems;

• NIST SP 800-53, Recommended Security Controls for Federal Information

Systems, and referenced supplemental guidance documents;

• NIST SP 800-60, Guide for Mapping Types of Information and Information

Systems to Security Categories.

H-8 Status of Successful Proposal in Awarded Contract

The Contractor’s successful proposal and pricing schedule are incorporated into this contract. The proposal and schedule shall be given precedence with the other contract documents in the following order – most important to lesser:

(a) The Performance-Based Statement of Work:

(b) Contract Clauses;

(c) Contractor’s successful Proposal which includes Technical Approach, Personnel

Approach, Management Approach, Business Approach, and Pricing Schedule; and

(d) Other documents, exhibits, and attachments.

H-9 Key Personnel

The Contractor shall designate in writing to the COR specific senior-level professional and managerial personnel as Key Personnel who are essential by the successful performance of work under this contract. Key personnel shall be available for full-time assignment to the contract’s duties as necessary to efficiently manage the contract work. Key personnel shall be available on the Award Date of this Contract. Following Contract Award and throughout the life of the Contract, the Contractor shall not permit the substitution of Key

Personnel without the prior written consent of the COR, unless the substitution is necessitated by an individual’s sudden illness, death, or employment termination.

In the event the substitution of Key Personnel is desired, the Contractor shall submit a justification to the COR. The justification shall be in sufficient detail to permit evaluation of the effect on this contract. The justification shall include the resumes of proposed substitute key personnel. Proposed substitute key personnel shall have education and experience substantially equal to the key personnel being replaced. Request for a substitution shall provide a detailed explanation of the circumstances necessitating the substitution. The COR will evaluate the request and notify the Contractor of approval or disapproval in writing.

Key personnel shall work full-time on this contract at the SBA Headquarters in

Washington, DC, unless the COR agrees otherwise in writing.

H-10 Confidential or Sensitive Information

While performing contractual duties, the Contractor may gain access to confidential data which is the sole property of SBA and to proprietary data which is the property of others.

The Contractor shall maintain the confidentiality of all such data. The Contractor shall not disclose any data or interpretations and derivatives of any data to any third party without the express written approval of the COR and of the party in which title to the data is vested. The Contractor shall include this clause in all subcontracts, consulting contracts or auditing contracts relating to this contract. Each employee of the contractor shall sign a

Non-Disclosure Agreement prior to beginning work on this contract.

The work to be performed and data released to the Contractor’s designated key personnel shall be treated as sensitive in nature and shall not be discussed with or released to anyone except Government employees assigned to this work and other contract-employees assigned to work on this contract’s work. The Contractor shall be responsible for having all its employees working under this contract or having access to privileged information under this contract to execute Non-Disclosure Agreements and all additional certifications required by SBA. The SBA, as it deems appropriate, may require additional certifications related to confidential or sensitive information from the Contractor during the life of this contract.

Additionally, the Contractor shall not disclose any information contained in this contract or the work papers related to examination of conditions, or reports prepared by, on behalf of, or for the use of the Contractor to third parties, including clients and customers, without the prior written permission of the COR.

H-11 Continuity of Services - Transitioning

The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption, and that, upon contract expiration, a successor may continue the contractual effort. The Contractor agrees to furnish phase-in-training, and to exercise its best efforts and cooperation to affect an orderly and efficient transition to a successor.

Upon written notification from the COR, the Contractor shall furnish phase-in, phase-out services for up to 180 days after this contract expires. The Contractor shall negotiate in good faith a plan with a successor to determine the nature and extent of phase-in and phase-out services required. The plan shall cover all facets of the Contractor’s requirements under the expired contract, including the identification and utilization of all

System software, procedures, policies, and protocols developed – which workflow tools shall all be in a written format. These workflow tools are the property of the SBA, and are to be available for review and release to a new contractor within 30 days of the new contract award. The plan shall also specify a training program for employees of the new contractor and a timeline for transferring responsibilities for each division (task) of work described in the plan. The timeline included in the plan shall be subject to the approval of the COR prior to full implementation.

The Contractor shall transfer responsibilities for the existing loan portfolio, as well as the related servicing function, only upon written authorization by the COR. Until such transfer is authorized by the COR, the Contractor will continue to receive compensation pursuant to the Schedule of Fees detailed in the Pricing Schedule (Section B). The Contractor shall be required to provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of acceptance as detailed in this contract.

After the 180-day transition period (which may be in addition to any formal extensions of this existing contract), the Contractor, at its own cost, shall continue to staff a level of experienced personnel to assist the successor contractor in maintaining the continuity and consistency of the services required by this contract. The Contractor shall disclose necessary personnel records of employees seeking employment opportunities with the new contractor, and shall provide adequate office space to allow the successor contractor to conduct on-site interviews with these employees. This interviewing process is to be conducted during normal business hours, and will be at no cost to the new contractor or to

SBA. If a selected employee of the Contractor is agreeable to the employment change, the

Contractor shall release the employee at a mutually agreeable date between the Contractor, the employee, and the successor contractor.

H-12 Subcontract Approval

Any subcontracting efforts shall be approved in writing by the Contracting Officer (CO) prior to the beginning of work by the subcontractor. Subcontractors shall meet the security requirements of the contract as stated for the Contractor.

H-13 Litigation

1. Notification. The Contractor shall notify the CO in writing within five business days of the service of any claim or legal process against the Contractor as a result of its performance of its duties under this contract.

2. Indemnification. The Contractor agrees to indemnify and hold harmless SBA and

SBA’s officers, employees, and agents, from any costs, liabilities, and expenses arising from any action or failure to act by the Contractor arising out of this contract and which may constitute negligence, breach of authority, breach of contract, or bad faith on the part of the Contractor.

H-14 Data Rights – System Ownership

Legal title to and full ownership rights in the software and operating procedures developed for the System shall reside with SBA. Contractor shall keep sufficient written documentation of the software and operating procedures to support this SBA ownership.

Copies of this documentation will be provided to the COR on a timely, updated basis by the

Contractor. In addition, and on a quarterly basis Contractor shall provide the COR an updated report that details the software and operating procedures developed as the contract is performed.

H-15 Advertising of Award

The Contractor agrees not to publicize this award in any manner without prior approval by the COR. In general, the Government does not endorse a contractor, or a product or service.

H-16 Permits and Licenses

The Contractor shall, at its own expense, obtain and maintain the necessary permits, franchises, licenses, or other authorizations and certifications required to lawfully perform the services required under this contract. The Contractor specifically shall be subject to federal securities and banking laws and regulations.

SECTION I - Contract Clauses

52.202-1 Definitions. (JAN 2012)

52.203-3 Gratuities. (APR 1984)

52.203-5 Covenant Against Contingent Fees. (APR 1984)

52.203-6 Restrictions on Subcontractor Sales to the Government. (SEP 2006)

52.203-7 Anti-Kickback Procedures. (OCT 2010)

52.203-8 Cancellation, Rescission, and Recovery of Funds for Illegal or Improper Activity.

(JAN 1997)

52.203-10 Price or Fee Adjustment for Illegal or Improper Activity. (JAN 1997)

52.203-12 Limitation on Payments to Influence Certain Federal Transactions. (OCT 2010)

52.203-13 Contractor Code of Business Ethics and Conduct. (APR 2010)

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper. (May

2011)

52.204-7 Central Contractor Registration. (AUG 2012)

52.204-9 Personal Identity Verification of Contractor Personnel. (Jan 2011)

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards. (AUG

2012)

52.209-6 Protecting the Government's Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (DEC 2010)

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters.

(FEB 2012)

52.216-24 Limitation of Government Liability. (APR 1984)

(a) In performing this contract, the Contractor is not authorized to make expenditures or incur obligations exceeding zero dollars.

(b) The maximum amount for which the Government shall be liable if this contract is terminated is zero dollars.

52.217-8 Option to Extend Services. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 7 days of the contract expiration date.

52.217-9 Option to Extend the Term of the Contract. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the

Contractor within 7 days of the contract expiration date; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 7 days (60 days unless a different number of days is inserted) before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months / five years.

52.219-16 Liquidated Damages - Subcontracting Plan. (JAN 1999)

52.222-3 Convict Labor. (JUN 2003)

52.222-21 Prohibition of Segregated Facilities. (FEB 1999)

52.222-35 Equal Opportunity for Veterans. (SEP 2010)

52.222-36 Affirmative Action for Workers with Disabilities. (OCT 2010)

52.222-37 Employment Reports on Veterans. (SEP 2010)

52.222-40 Notification of Employee Rights Under the National Labor Relations Act. (DEC

2010)

52.222-41 Service Contract Act of 1965. (NOV 2007)

52.222-42 Statement of Equivalent Rates for Federal Hires. (MAY 1989)

In compliance with the Service Contract Act of 1965, as amended, and the regulations of the Secretary of Labor (29 CFR Part 4), this clause identifies the classes of service employees expected to be employed under the contract and states the wages and fringe benefits payable to each if they were employed by the contracting agency subject to the provisions of 5 U.S.C. 5341 or 5332.

This Statement is for Information Only:

It is not a Wage Determination

Employee Class Monetary Wage - Fringe Benefits

General Service, Steps 3 – 12, with hourly wage base rate between $10.48 and $37.54, with a fringe benefit rate of approximately 20%.

52.222-43 Fair Labor Standards Act and Service Contract Act - Price Adjustment

(Multiple Year and Option Contracts). (SEP 2009)

52.222-49 Service Contract Act – Place of Performance Unknown (MAY 1989)

52.222-50 Combating Trafficking in Persons. (FEB 2009)

52.222-54 Employment Eligibility Verification. (JUL 2012)

52.223-5 Pollution Prevention and Right-to-Know Information. (MAY 2011)

52.223-6 Drug-Free Workplace. (MAY 2001)

52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving. (AUG

2011)

52.224-1 Privacy Act Notification. (APR 1984)

52.224-2 Privacy Act. (APR 1984)

52.225-1 Buy American Act – Supplies. (FEB 2009)

52.225-13 Restrictions on Certain Foreign Purchases. (JUN 2008)

52.225-25 Prohibition on Engaging in Sanctioned Activities Relating to Iran-Certification

(SEP 2010)

52.226-6 Promoting Excess Food Donation to Nonprofit Organizations. (MAR 2009)

52.227-1 Authorization and Consent. (DEC 2007)

52.227-14 Rights in Data--General. (DEC 2007)

(a) Definitions. As used in this clause--

"Computer database" or "database" means a collection of recorded information in a form capable of, and for the purpose of, being stored in, processed, and operated on by a computer. The term does not include computer software.

"Computer software" --

(1) Means (i) Computer programs that comprise a series of instructions, rules, routines, or statements, regardless of the media in which recorded, that allow or cause a computer to perform a specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, processes, flow charts, formulas, and related material that would enable the computer program to be produced, created, or compiled.

(2) Does not include computer databases or computer software documentation.

"Computer software documentation" means owner's manuals, user's manuals, installation instructions, operating instructions, and other similar items, regardless of storage medium, that explain the capabilities of the computer software or provide instructions for using the software.

"Data" means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

"Form, fit, and function data" means data relating to items, components, or processes that are sufficient to enable physical and functional interchangeability, and data identifying source, size, configuration, mating and attachment characteristics, functional characteristics, and performance requirements. For computer software it means data identifying source, functional characteristics, and performance requirements but specifically excludes the source code, algorithms, processes, formulas, and flow charts of the software.

"Limited rights" means the rights of the Government in limited rights data as set forth in the Limited Rights Notice of paragraph (g)(3) if included in this clause.

"Limited rights data" means data, other than computer software, that embody trade secrets or are commercial or financial and confidential or privileged, to the extent that such data pertain to items, components, or processes developed at private expense, including minor modifications.

"Restricted computer software" means computer software developed at private expense and that is a trade secret, is commercial or financial and confidential or privileged, or is copyrighted computer software, including minor modifications of the computer software.

"Restricted rights," as used in this clause, means the rights of the Government in restricted computer software, as set forth in a Restricted Rights Notice of paragraph (g) if included in this clause, or as otherwise may be provided in a collateral agreement incorporated in and made part of this contract, including minor modifications of such computer software.

"Technical data," means recorded information (regardless of the form or method of the recording) of a scientific or technical nature (including computer databases and computer software documentation). This term does not include computer software or financial, administrative, cost or pricing, or management data or other information incidental to contract administration. The term includes recorded information of a scientific or technical nature that is included in computer databases (See 41 U.S.C. 403(8)).

"Unlimited rights" means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of rights. (1) Except as provided in paragraph (c) of this clause, the

Government shall have unlimited rights in--

(i) Data first produced in the performance of this contract;

(ii) Form, fit, and function data delivered under this contract;

(iii) Data delivered under this contract (except for restricted computer software) that constitute manuals or instructional and training material for installation, operation, or routine maintenance and repair of items, components, or processes delivered or furnished for use under this contract; and

(iv) All other data delivered under this contract unless provided otherwise for limited rights data or restricted computer software in accordance with paragraph (g) of this clause.

(2) The Contractor shall have the right to--

(i) Assert copyright in data first produced in the performance of this contract to the extent provided in paragraph (c)(1) of this clause;

(ii) Use, release to others, reproduce, distribute, or publish any data first produced or specifically used by the Contractor in the performance of this contract, unless provided otherwise in paragraph (d) of this clause;

(iii) Substantiate the use of, add, or correct limited rights, restricted rights, or copyright notices and to take other appropriate action, in accordance with paragraphs (e) and (f) of this clause; and

(iv) Protect from unauthorized disclosure and use those data that are limited rights data or restricted computer software to the extent provided in paragraph (g) of this clause.

(c) Copyright--

(1) Data first produced in the performance of this contract. (i) Unless provided otherwise in paragraph (d) of this clause, the Contractor may, without prior approval of the Contracting

Officer, assert copyright in scientific and technical articles based on or containing data first produced in the performance of this contract and published in academic, technical or professional journals, symposia proceedings, or similar works. The prior, express written permission of the Contracting Officer is required to assert copyright in all other data first produced in the performance of this contract.

(ii) When authorized to assert copyright to the data, the Contractor shall affix the applicable copyright notices of 17 U.S.C. 401 or 402, and an acknowledgment of

Government sponsorship (including contract number).

(iii) For data other than computer software, the Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted data to reproduce, prepare derivative works, distribute copies…