A1_Statement_of_Work_(SOW)-Revised_2.16.2018.pdf

Attachment 1

SECTION C – STATEMENT OF WORK

Revised February 16, 2018

HOTLINE FOR THE ANONYMOUS OR CONFIDENTIAL REPORTING OF

COMPLAINTS

C-1 BACKGROUND

The U. S. Securities and Exchange Commission (“SEC”) Office of Inspector General (“OIG”) is responsible for investigating allegations of fraud, waste, and abuse involving agency programs and operations, and misconduct by agency employees or contractors. The SEC OIG requires a Contractor to operate and maintain its “Hotline” for the anonymous or confidential reporting of complaints.

C-2 SPECIFIC TASKS AND SERVICES REQUIRED

C-2.1 The Contractor shall operate and maintain both: (1) a toll-free number that can be called 24 hours a day, 365 days a year, to speak anonymously, or in confidence, with a trained Hotline operator; and, (2) a web-based system through which complaints may be made anonymously, or in confidence. The call operators shall take the caller information and record that information.

The telephone Hotline will use a message to be provided by the OIG to inform the caller of his/her options. The live operators and messages shall be in English, unless requested differently from the SEC OIG Both the telephone and web-based complaints systems will be designated as the SEC OIG Hotline, through which agency employees and outside individuals may confidentially report fraud, waste, and abuse, as well as complaints of staff and contractor misconduct, to the OIG. Both the telephone operator call format and the web-based complaint form must be customized and tailored to meet the specific needs of the SEC OIG. In addition, incident codes used for the telephone and web-based complaint reports must adhere to the requirements of, and meet the approval of, the SEC OIG. The contractor shall also provide mechanisms by which persons contacting the Hotline can submit follow-up information pertaining to their complaints and by which the SEC OIG may provide responses to complainants.

C-2.2 The Contractor shall be able to respond within four (4) hours or sooner when a call is received and shall also obtain appropriate follow-up information concerning complaints received. Calls shall be answered within 5 rings. The Contractor shall provide timely reports in electronic form (within no more than 24 hours of receipt of a complaint) to the OIG’s Contracting Officer’s Representative (COR) and other designated representatives or e-mail addresses regarding all Hotline complaints (both telephone and web-based) received. The Contractor shall notify the OIG of any complaints categorized as urgent within one (1) hour of receipt of the complaint. The Contractor shall provide monthly summaries of statistical data concerning Hotline complaints. The Contractor’s reports of Hotline complaints shall show, at minimum, the report number; date and time of the call or web-based complaint; the nature and subject of the complaint; details of the allegations; questions asked by the call center staff member (for telephone complaints); name, telephone number, mailing address, and e-mail address of the complainant, if provided upon request; the complainant’s preference on maintaining or waiving confidentiality; nature of any response given to the complainant; any follow-up performed, when the follow-up was completed; and other information identified by the

SEC OIG.

The Contractor shall segregate SEC OIG data entered into the Contractor’s system to ensure the data is isolated from other data contained in the data base. The call data shall be transferred to the SEC OIG using a secure method of communication as approved by the SEC OIG. The Contractor shall participate in on-site review meetings or conference calls with SEC staff as requested during the period of performance.

C-2.3 The Contractor shall maintain a fully operational facility with staff who have executed SEC non-disclosure agreements if they are or will be handling SEC OIG complaints, in accordance with Section C, during the entire period of performance. The Contractor must be a U.S. vendors operating within the Continental United States (CONUS). All work shall be performed in the CONUS.

C-2.4 The Contractor may be required to add, delete, or modify existing fields, which are considered minor adjustments, in the web-based complaint request form.

C-3. CONTRACTOR PERSONNEL

The Contractor shall provide qualified personnel in sufficient quantities, including operators and project management and support staff, to meet the requirements of this contract. The Contractor shall ensure confidentiality of data. The Contractor shall provide supervisory/management personnel required for effective project management. The Contractor shall verify United States citizenship for all personnel performing services under this Contract. The Contractor shall ensure that all telephone operators, supervisors, managers, and quality assurance personnel speak, read, and write English fluently.

C-4. TRAINING

C-4.1 The Contractor shall provide an ongoing training program for its staff in administering the Hotline telephone and web services for the SEC OIG. The SEC OIG will provide information on SEC OIG specific requirements as necessary. The Contractor shall ensure immediate release from the assignment of any employee who does not successfully complete the training program.

C-4.2 The Contractor, in consultation with the SEC OIG, shall provide initial training to SEC OIG staff on the telephone and web-based Hotline systems, including training on its procedures for notifying the SEC OIG of calls, including any urgent calls.

C-5. EQUIPMENT AND FACILITIES

The Contractor will provide all facilities and workspace for operation of the Hotline. The Contractor will also provide the telephone and computer equipment and services needed for operation of the Hotline, which includes furnishing the toll-free number and website Any required maintenance of equipment shall not interfere with services. As such, there shall be no interruption of Hotline services via toll-free number or web form.

C-6. QUALITY CONTROL AND CUSTOMER SERVICE

C-6.1 The Contractor shall develop internal controls and procedures to identify performance problems and shall promptly resolve any identified problems.

C-6.2 The Contractor shall have a supervisor and/or other qualified person monitor each telephone operator’s performance for quality assurance and appropriate coaching. Industry accepted customer service standards will be followed. The Contractor’s staff who do not meet acceptable customer service standards, as determined by the Contractor, shall be re-trained or released from the contract with the SEC.

C-7. RECORDS

All the records generated under the contract shall be SEC OIG’s property and shall be returned to the SEC OIG upon the termination of the contract.

C-8. SECTION 508 REQUIREMENTS

All electronic and information technology (EIT) procured through this award must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www//access-board.gov.

The Contractor shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility standards at 36 CFR 1194. Further, the quote must indicate where full details of compliance can be found (e.g., vendor’s website or other exact locations).

For contracts issued on or after June 25, 2001, Subsection 508(a)(30) of the Rehabilitation Act of 1973 requires that: When federal departments or agencies develop, procure, maintain or use Electronic and Information Technology (EIT) they must ensure that the EIT allows Federal employees with disabilities to have access to and use of information and that data is comparable to the access to and use of information and data by other Federal employees; and, that individuals with disabilities who are members of the public seeking information or services from a Federal Department or agency, have access to and use of information and data that is comparable to that provided to the public without disabilities. The Contractor agrees to abide by this law and to ensure that all information created or used under this contract conforms to the above requirements.

1194.31, Functional Performance Criteria, and 1194-41, Information Documentation, and Support - - in order to comply with this Section of 508, the Contractor shall submit all soft copies in a format that will be readable by SEC’s standard screen reader. All imbedded charts, graphs, http://www/access-board.gov pictures, etc., must be accessible and understandable through a screen reader. To view the entire text on 36 CFR Part 1194, go to www.section 508.gov or www.access-board.gov and for 48 CFR Subpart 39.2, go to www.arnet.gov/far.

All web sites and applications have to be compliant with Section 508.

C-9. NON-PERSONAL SERVICES

C-9.1 This is not a personal services contract. The Government and the Contractor understand and agree that the services delivered by the Contractor to the Government are non-personal services. The parties also recognize and agree that no employer-employee or master-servant relationship exists or will exist between the Government and the Contractor. Contractor personnel are not employees of the Federal Government and are not eligible for entitlement and benefits given federal employees.

C-9.2 Contractor personnel under this contract shall not (i) be placed in a position where there is an appearance that they are employed by the Federal government, or are under the supervision, direction (other than the technical direction with respect to the tasks listed in Section C.1 – Requirements), or evaluation of a Federal employee, or (ii) be placed in a position of command, supervision, administration or control over Government personnel.

SECTION D- PACKAGING AND MARKING

D-1 (2001.00) PRESERVATION

Packaging Packing, and Marking (MAR 2009) Preservation, packaging, packing and marking of all deliverable contract line items must conform to normal commercial packing standards to assure safe delivery at destination.

D-2 (2002.00) MARKING (MAR 2009)

All information submitted to the Contracting Officer, the POC, or his/her designated contact shall clearly indicate the number of the contract for which the information is being submitted.

D-3 The Contractor shall use Standard Best Commercial Practices for all required packaging and marking of deliverables.

SECTION E - INSPECTION AND ACCEPTANCE

E-1 (3001.01) INSPECTION AND ACCEPTANCE BY THE CONTRACTING

OFFICER’S REPRESENTATIVE (COR) (Aug 2013)

The inspection and acceptance of the services to be furnished under this Task Order will be performed by the Contracting Officer’s Representative (COR), and/or the Alternate COR. The COR/Alternate COR will accomplish inspection and acceptance of the services provided hereunder. Inspection and acceptance will be performed at the U.S. Securities and Exchange http://www.section/ http://www.access-board.gov/ http://www.arnet.gov/far

Commission, 100 F Street, NE, Washington, DC 20549. Services shall conform to the requirements set forth in the Task Order.

E-2 ACCEPTANCE CRITERIA

The COR shall review all deliverables for accuracy and completeness. The Contractor shall make those corrections required by the COR. The deliverables require acceptance by the COR.

General quality measures, as set forth below shall be applied to each deliverable product received from the Contractor under this SOW.

E-2.1 Accuracy: Deliverable products shall be accurate in presentation, technical content and adherence to accepted elements of style.

E-2.2 Clarity: Deliverable products shall be clear and concise; financial terms shall be used, as appropriate. All diagrams shall be easy to understand and be relevant to the supporting narrative.

E-2.3 File Editing: All text and diagrammatic files shall be editable by the SEC.

E-2.4 Format: Deliverable products shall be submitted in media defined by COR. Hard copy formats shall be in contractor format, unless otherwise specified by the COR.

E-2.5 Timeliness: Deliverable products shall be submitted on or before the due date specified in Section I.10.

E-2.6 Correction of Nonconformities.

If a deliverable fails to meet the relevant acceptance criteria (each such failure or deficiency is referred to as “nonconformity”), the SEC will provide written notification to the Contractor of such failure. Upon receiving such notice, the Contractor will take appropriate corrective action.

The corrected nonconformity will be redelivered to the SEC, which will then confirm in writing whether the redelivered deliverable conforms to and satisfies the applicable acceptance criteria.

The process described in this section may be repeated as necessary until all nonconformities are corrected and the deliverable conforms to and satisfies its acceptance criteria to meet the delivery dates specified in the task order.

SECTION F - DELIVERIES OR PERFORMANCE

F-1 FAR CLAUSE TITLE

52.247-34 F.O.B. Destination (Nov 1991)

F-2 (4001.00) PERIOD OF PERFORMANCE W/OPTION YEARS (Mar 2009)

The base period of performance under this contract shall be from 07/01/2018 to 06/30/2019. This contract has a total of five (5) options, which consists of four (4) 12-month options and one (1) 6 month option. At the end of the base year, if exercised, the first option will begin. If all options are exercised, the period of performance will not exceed a total of 5 years and 6 months with options. If exercised, the period of performance for each successive option will begin the day after expiration of the previous period. Exercise of any option requires a contract modification signed by the SEC Contracting Officer.

Period Performance Dates Base July 1, 2018 – June 30, 2019 Option 1, if exercised July 1, 2019 – June 30, 2020 Option 2, if exercised July 1, 2020 – June 30, 2021 Option 3, if exercised July 1, 2021 – June 30, 2022 Option 4, if exercised July 1, 2022 – June 30, 2023 Option 5, if exercised July 1, 2023 – December 31, 2023

F-3 SCHEDULE OF DELIVERABLES

SECTION Deliverable Schedule C 2.2 Contractor’s Fully Operational Call

Center and web-based complaint system By no later than 12 a.m.

July 1, 2018.

C 2.2 Individual Complaint Reports Transmitted within 24 hours or less of receipt by the Hotline (via telephone or the web site).

C 2.2 Monthly Summary Reports Five days after end of the previous month.

F-4 DELIVERABLES FORMAT

The contract deliverables shall be furnished in softcopy (electronic media) transmitted via e-mail to the COR and other designated representatives or e-mail addresses. All deliverables shall be compatible using the Microsoft Office Suite including MS-Word, MS-Excel, MS-Project and MS-PowerPoint. Flow charts and other diagrams included in the deliverables should be developed using Visio Professional 2000 software.

SECTION G - CONTRACT ADMINISTRATIVE DATA

G-1 (5001.00) CONTRACT ADMINISTRATION (Dec 2011)

This Order will be administered by the SEC’s Office of Acquisitions. All inquiries should be directed to the following address:

U.S. Securities and Exchange Commission Office of Acquisitions 100 F Street, NE Washington, DC 20549 Attn: Selina F. Euley

Ph: 202-551-3734 E-mail: EuleyS@sec.gov

G.2 (5001.03) CONTRACT ADMINISTRATION FOR NON-SEVERABLE SERVICES

(AUG 2013)

The services for the contract are considered non-severable services. Non-severable services are considered to be new tasks, each with details of the task and when it is due.

The task is described by SEC employees and e-mailed to the Contracting Officer’s Representative (COR).

a. COR ensures it is in scope and e-mails it to the vendor Project Manager (PM).

b. Vendor PM reviews it and assigns the task to the contractor personnel (CP).

c. SEC employees work with the assigned CP.

The COR will review deliverables within the time frames indicated in approved technical direction letter/e-mail.

G-3 (5003.00) SUBMISSION OF INVOICES (Apr 2012)

The Securities and Exchange Commission accepts only electronic/e-mail invoices.

Invoices shall be submitted on a monthly basis.

Contractors should submit invoices in accordance with the SEC Prompt Payment Provision of the contract. Contractors are cautioned against submitting an invoice prior to goods and services being received/accepted. Invoices submitted prematurely may be rejected.

Electronic/e-mail Invoice Instructions:

• Invoices must be in PDF Format and may not exceed 10MB

• Subject Line: Company name and the invoice number

• e-mail Message:

• Company logo or letterhead

• Company name and payment address

• Company point of contact (POC) for the invoice with phone and e-mail

• Invoice Number

• SEC Contract or Order number

• SEC COR

For supplies: contract line item number, item description, quantity delivered, and unit and extended price, per Section B CLIN structure

For services: contract line item number, item description, period of performance and associated costs, per Section B, contract line item, CLIN, structure

Shipping and handling charges, if applicable

Clearly mark duplicates of previous invoice submissions with “DUPLICATE”

Clearly mark the final invoice with “FINAL INVOICE”

Attach the invoice and any supporting documents in a secure tamper-proof or tamper-resistant format compatible with Adobe Acrobat.

Electronic signatures are acceptable in scanned documents. Each page of a document must be clearly marked with information identifying it with the company, the contract, the invoice, and any other information required by the contract.

E-mail invoices to the following address: 9-AMC-AMZ-SEC-Invoices@faa.gov. If you have questions regarding submission of invoices, the SEC’s Office of Financial Management may be reached at (202) 551-7860.

G.4 (5004.00) APPOINTMENT OF CONTRACTING OFFICER’S REPRESENTATIVE

(COR) (Nov 2012)

a. The SEC OIG will designate a Primary and Alternate COR, respectively, for administration and information relating to this contract.

b. The Contracting Officer (CO) shall appoint, in writing, a Contracting Officer’s Representative (COR) and, if possible, an Alternate COR for this award. The COR and Alternate COR shall have a current Federal Acquisition Certification for CORs (FAC-COR) at the appropriate certification level for the contract. A COR may serve on a contract requiring certification at or below his/her level, but not on one requiring a higher level. The CO shall provide the Contractor with a copy of the COR appointment letter(s). The COR may not re-delegate his or her authority;

only the CO has this authority.

c. The COR will manage the contract in coordination with the CO and within the terms of the contract and the boundaries of a COR’s duties as outlined in the document “Instructions for CORs and Their Supervisors.” The COR’s responsibilities include reviewing invoices and charges by the Contractor and informing the CO of areas where exceptions are taken. If this is an award for services and contractor personnel are brought on-site to SEC facilities, the COR must adhere to SECR 10-24.

d. Only the CO has the authority to change the terms and conditions of this contract. The COR may request a contract modification, but the CO will make the final determination. The COR may not agree to or issue a change to the contract terms and conditions. In the event the Contractor effects changes to the contract at the direction of any person other than the CO, the changes will be considered to have been made without any authority and no adjustments will be made to the contract.

G-5 (5005.00) CONTRACT OPTIONS (Mar 2009) mailto:9-AMC-AMZ-SEC-Invoices@faa.gov

(a) Award of an initial contract will not obligate the Government to exercise any contractual option. Prior to exercising any option, the Government will make a determination that (1) funds are available, (2) the requirement covered by the option fulfills an existing need of the Government, and (3) the exercise of the option is the most advantageous method of fulfilling the Government’s need, price and other factors considered.

(b) Failure to exercise an option shall not obligate the Government to pay any charges other than the contract price including exercised options.

G-4 (5007.00) PAYMENT INFORMATION (Feb 2012)

Payment will be made to small business contractors within 30 days of receipt of a valid invoice.

Unless otherwise stated, and the contractor is not a small business, payment will be made within the guidelines of the Prompt Payment Act and requires that payment is made within 30 days from receipt of a valid invoice.

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H-1 (6001.00) SEC Non-Disclosure Requirements and Agreements (Jul 2012)

Required non-disclosure agreements are attached and must be completed and returned to the Contracting Officer before starting work under this contract.

Provisions of the SEC Regulation Concerning Conduct of Members and Employees and Former Members and Employees of the Commission expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. See 17 C.F .R. § 200.7353(b)(1) & (b)(2). The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who will have access to confidential or non-public information or documents in the performance of the contract, agree to be bound by the provisions of Sections 200.735-3(b)(1) and 200.735-3(b)(2) of the SEC's Regulation Concerning Conduct and the terms set forth in the attached non-disclosure agreements (Attachments 1& 2). For purposes of this clause, “confidential or non-public information,” is defined as information generated by or in the possession of the SEC that is commercially valuable, trade secret, market sensitive, proprietary, related to an SEC enforcement or examination matter, subject to privilege, protected by the Privacy Act (5 U.S.C. § 552a), or otherwise deemed confidential or non-public by an SEC division director or office head, and is not otherwise available to the public.

An officer or executive authorized to bind the Contractor shall execute the non-disclosure agreement (Attachment 1) on behalf of the Contractor and return it to the Contracting Officer prior to the Contractor commencing work on the contract. The Contractor shall submit to the Contracting Officer a list of its employees, agents, and subcontractors that will be authorized access to SEC information by virtue of performing the requirements set forth in this contract.

Each person identified on the list shall then sign the non-disclosure agreement on behalf of themselves (Attachment 2) and submit it to the Contracting Officer before commencing work on the contract.

The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to the terms of the non-disclosure agreement, protecting all confidential or non-public information, and to not divulge to any unauthorized person. Assignment of staff who has not executed the non-disclosure agreement or failure to adhere to this statement shall result in action by the Contracting Officer, as deemed appropriate. Violation of this clause or the attached non-disclosure agreements by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or civil suits and/or criminal prosecution.

(End of clause)

H-2 (6001.01) Restrictions on Use, Disclosure, and Duplication of Confidential and Non- Public Information (Nov 2010)

Confidential or non-public information, for purposes of this clause includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential or non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor, and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non-public information, in whole or in part, outside the Securities and Exchange Commission (SEC) for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

(End of clause)

H-3 (6002.00) TYPE OF CONTRACT (MAR 2009)

This is a firm-fixed-price type purchase order.

H-4 (6003.00) REPRESENTATIONS AND CERTIFICATIONS (MAR 2009)

The Contractor’s completed Representations, Certifications, and Other Statements of Offerors or Respondents is located at www.sam.gov.

H-5 (6006.00) Conflicts of Interest (Mar 2009) http://www.sam.gov/

(a) General. Subpart 9.5 of the Federal Acquisition Regulation 48 C.F.R. 9.5, prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving organization conflicts of interest.

(b) Purpose. The purpose of this clause is to avoid, neutralize, or otherwise mitigate organizational conflicts of interest which might exist related to a Contractor’s performance of work required by this contract. Such conflicts may arise in situations including, but not limited to: a Contractor’s participation, as a Quoter or representative of a Quoter, in a procurement in which it has provided assistance in the preparation of the Government’s requirements and specifications; a Contractor’s providing advisory assistance to the Government in a procurement in which the Contractor’s firm or one which the Contractor represents is an actual or potential Quoter; and a Contractor’s participation, as a Quoter or representative of a Quoter, in a procurement where the Contractor has obtained confidential or proprietary information relating to competing Quoters as a result of the Contractor’s work on prior task orders.

(c) Definition. For purposes of this clause, the term “Contractor” means: The Contractor; any of the Contractor’s parents, affiliates or other entities in which the Contractor or such parents or affiliates have a financial interest; successors in interest to the Contractor or any of its parents or affiliates; proposed consultants or subcontractors at any tier; and employees thereof.

(d) Restrictions. The Contractor agrees:

(1) To remain ineligible to participate in any capacity (including participating as a prime contractor, subcontractor, or as the representative of another party) in contracts, subcontracts, or quotes (whether solicited or unsolicited) that directly relate to the Contractor’s performance of work under this Contract.

(2) Prior to beginning work on a task order, to execute such Confidentiality Agreements, Statements of Non-Disclosure or other documents which the Contracting Officer may, in his/her sole discretion, require in order to protect the proprietary nature or confidentiality of information provided by the Government or otherwise received by the Contractor in connection with its work under this Contract.

(3) As otherwise provided in this Contract, not to accept any compensation or any other form of payment from a broker, potential lessor, or any source other than the Government for services rendered under this Contract, and to employ aggressive strategies to minimize the Government’s lease costs where the Contractor would entitled by common business practice to received a real estate commission or any form of payment from a broker, potential lessor, or other party, for work performed under this Contract.

(4) To immediately notify the Contracting Officer of any offer of compensation, other form of payment, or thing of value, made by a broker, potential lessor, or any source other than the Government to the Contractor related to services rendered under this Contract, regardless of whether such offer was made during Contractor’s performance of work under a given task order or subsequent to Contractor’s completion of work under such task order.

(5) Prior to the acceptance of a task order request, to immediately notify the Contracting Officer of any potential conflict of interest which would prevent or limit the Contractor’s ability to perform the work requested.

(6) To immediately notify the Contracting Officer of any conflict of interest discovered during Contractor’s performance of work pursuant to a Government issued task order; provided that the

Contracting Officer shall have the right to impose such restrictions as he/she deems appropriate on Contractor’s performance based on the existence of such a conflict or, if the Contracting Officer determines that such restrictions would not adequately address the conflict of interest at issue, to terminate the Contractor’s performance of work under the task order at no cost to the Government.

(7) As otherwise provided in this Contract, that if the Contractor declines to accept a task order request and subsequently participates (either directly or as a representative of another party) in a Government contracting action that was the subject of the task order request, then the fee which the Contractor would have been entitled to receive for such task order work or the fee actually paid by the Government for the task order’s performance by another contractor, whichever is greater, shall be applied toward the Contractor’s minimum ordering guarantee.

(8) That in the event that Contractor knowingly withholds the existence of a conflict of interest from the Government, that the Contracting Officer may terminate this Contract at no cost to the Government and any minimum guarantee(s) otherwise applicable to the Contractor will be forfeited; provided, that the foregoing shall be in addition to all other remedies and causes of action which the Government may have against the Contractor, including the suspension and/or debarment of the Contractor.

(9) To include this Conflict of Interest clause, including this subparagraph, in all of the Contractor’s subcontracts at all tiers (appropriately modified to preserve the Government’s rights hereunder) which involve the performance of work by subcontractors in support of this Contract.

(10) That, in addition to the remedies enumerated above, the Government may terminate this Contract for cause in the event of the Contractor’s breach of any of the above restrictions.

(e) The prohibition against performing work that “directly relate(s) to the Contractor’s performance of work under this Contract” refers only to work involving the evaluation, assessment, and development of specifications for the automated procurement system provided by Vendor/Contractor Name:

#DBCOL#VENDOR_NAME# Specifically, the fact that an agency procurement is performed using the automated procurement system shall not be used as a basis for excluding Vendor/Contractor Name: *___________________________________________ related entity or affiliate) from participation in the procurement.

**Mark N/A if there are no known conflicts of interest.

H-6 (6012.00) SECURITY AND PRIVACY ACT MATTERS (MAR 2009)

The security classification for work performed under this contract is Public Trust. The documents that shall be reviewed and produced are non-public and sensitive in nature and shall be protected from unauthorized disclosure. Work on this project requires that personnel have access to Privacy Act Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S.

Code, Section 552a and applicable agency rules and regulations.

H-7 (6012.05) PERSONALLY IDENTIFIABLE INFORMATION (PII) (JUN 2013)

A Contractor that designs, develops, or operates a system of records on individuals, or otherwise collects or has access to personally identifiable information (PII) in the performance of this contract shall, prior to taking such action, comply with the following requirements:

(a) The Contractor shall have established policies and procedures in place to safeguard SEC PII. The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding SEC PII and incident management of suspected or confirmed loss of SEC PII in accordance with OMB’s Recommendations for Identity Theft Related Data Breach Notification, September 20, 2006, and OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

(b) The Contractor shall also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 1 and are aligned with the incident categories and timelines referenced in Table J-1 of NIST SP 800-61, as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of SEC data that may contain PII. In support of these requirements, the Contractor shall have:

• policies, procedures, and mechanisms designed to restrict access to SEC data on

Contractor, subcontractor, or SEC inter/intra agency partner systems exclusively to authorized personnel;

• policies, procedures, and mechanisms that prevent transmission or disclosure of SEC data to an unauthorized party;

• policies, procedures, and mechanisms that ensure SEC data on portable devices are encrypted using methods compliant with Federal Information Processing Standard 140-2; and

• policies, procedures, and mechanisms that ensure SEC data transmitted across public networks (i.e., the Internet) by the Contractor, or its employees, agents or subcontractors, are protected using encryption compliant with Federal Information Processing Standard 140-2.

(c) The Contractor shall provide quarterly assessments to the SEC demonstrating that the policies, procedures, and mechanisms required by (b) continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective.

(d) The Contractor shall provide a copy of its privacy policies to the Contracting Officer.

The Contractor shall also provide a copy of the policies and procedures (or otherwise make such policies and procedures available) to all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract.

(e) The Contractor shall ensure that those individuals adhere to the Contractor’s policies and procedures relating to PII and to SEC-prescribed policies and procedures for the safe handling of SEC PII, including privacy and security training requirements and privacy incident management.

(f) The Contractor’s employees, agents, and subcontractors shall immediately alert the

SEC of any event, including the suspected or confirmed loss of SEC PII, that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST 800-122 by contacting the SEC Information Systems Security point of contact, the SEC OIT Service Desk at

(202) 551-4357, and the SEC OIG. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of SEC PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Clause, a “suspected loss of PII” shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

H-8 (6017.00) COMMUNICATING NON-PUBLIC OR SENSITIVE INFORMATION

(MAY 2013)

When communicating “Non-public or Sensitive information” via e-mail, during the period of this contract, the Contractor shall submit all such communications using Zixmail. ZixMail encrypts outgoing messages, decrypts and validates incoming messages, and authenticates both the sender's and recipient's e-mail identities. The Contractor shall use the following instructions for using Zixmail:*

Login at U.S. Securities and Exchange Commission Secure E-mail Password Authorization View message under the “Inbox” tab or create and send new messages from the “Compose” tab. Messages are created and sent similar to a typical e-mail messaging system and include:

Recipients, CC, subject line, body and attachments.

*Notes: The Contractor must register a new account first at U.S. Securities and Exchange Commission Secure E-mail Password Authorization prior to reading or sending encrypted messages. The Contractor will be provided with a link to create an account the first time you send them an encrypted message. This link will also be used by the Contractor subsequently to read and compose messages. The Contractor can only send encrypted e-mail messages from the ZixMail portal to when sent using this method.”

H-9 (6020.00) - CONTRACTOR WORKFORCE INCLUSION (AUG 2015)

The Contractor confirms its commitment to equal opportunity in employment and contracting, and that it shall ensure, to the maximum extent possible and consistent with applicable law, the fair inclusion of minorities and women in its workforce.

https://web1.zixmail.net/s/login?b=sec

The Contractor shall insert the substance of this contract standard in each subcontract for services awarded for performance of this contract with a dollar value of $100,000 or more.

Within ten (10) business days of a written request from the Director of the Commission’s Office of Minority and Women Inclusion (OMWI Director) or designee, or such longer time as the OMWI Director or designee determines, and without any additional consideration, action or authorization required from the OMWI Director, the Contractor shall provide documentation, satisfactory to the OMWI Director, of the actions it has undertaken (and as applicable, the actions each covered subcontractor under the contract has undertaken) to demonstrate its good faith efforts to comply with the aforementioned provisions.

For purposes of this contract, “good faith efforts” shall include actions by the Contractor (and as applicable, actions by each covered subcontractor under the Service Contract) to identify and, if present, remove barriers to minority and women employment or expansion of employment opportunities for minorities and women within its workforce. Efforts to remove such barriers may include, but are not limited to, recruiting to ensure that applicant pools include minorities and women, providing job-related training, or other activity that could lead to removing such barriers.

The documentation requested by the OMWI Director or designee to demonstrate good faith efforts may include, but is not limited to, one or more of the following:

• The total number of Contractor’s employees, and the number of employees by race, ethnicity, gender, and job title or EEO-1 Report job category (e.g., EEO-1 Report(s));

• A list of covered subcontract awards for services under the contract, and for each covered subcontract award, the dollar amount, date of award, and the subcontractor’s race, ethnicity, and/or gender ownership status;

• The contractor’s plan for ensuring the fair inclusion of minorities and women in its workforce, including outreach efforts; and

• For each covered subcontractor, the documentation specified in paragraphs a. and c.

above.

Consistent with Section 342(c)(3) of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), 12 U.S.C. 5452(c)(3), a Contractor’s failure to demonstrate to the OMWI Director that it has made good faith efforts to include minorities and women in its workforce (and as applicable, failure to demonstrate that its subcontractor(s) has made such good faith efforts) may result in termination of the contract for default after the contractor is provided written notice and an opportunity to cure the failure in accordance with the procedures set forth in FAR Subpart 49.402-3(d), other contractual remedies, referral to the Office of Federal Contract Compliance Programs (OFCCP), or other appropriate action.

Compliance with this standard does not necessarily satisfy the requirements of EO 11246, as amended, nor does it preclude OFCCP compliance evaluations and/or enforcement actions http://www.gpo.gov/fdsys/granule/USCODE-2011-title12/USCODE-2011-title12-chap53-subchapIII-partC-sec5452 https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2049_4.html%23wp1083185 http://www.dol.gov/ofccp/ http://www.dol.gov/compliance/laws/comp-eeo.htm undertaken pursuant to that Executive Order, or demonstrate compliance with other FAR clauses that may be included in this contract.

H-10 (6021.00 - Records Management Information Technology Requirements (Oct 2015)

The following is applicable to information technology services to include public and/or private cloud computing based services.

The contractor must manage Federal records in accordance with all applicable laws, regulations, and standard items. The management of records includes, but is not limited to; secure storage, retrievability, and proper disposition of all federal records including transfer of permanently valuable records to the National Archives and Records Administration (NARA) in a format and manner acceptable to NARA at the time of transfer.

The Federal Records Act, 44 U.S.C. 3101 et seq., requires all federal agencies to create and preserve records of essential functions, activities, and transactions. Other statutory and regulatory requirements that govern federal agency recordkeeping include, but are not limited to:

• Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33)

• Public Law 113-187

• National Archives and Records Administration (NARA) regulations at 36 CFR Chapter XII Subchapter B)

• SEC Regulation (SECR) 7-1

• Freedom of Information Act (5 U.S.C. 552)

• Privacy Act (5 U.S.C. 552a)

• 44 U.S.C. 3506

• 36 CFR Chapter XII, Subchapter B

• 36 CFR Part 1222

• 36 CFR Part 1228

• 36 CFR 1236 Subparts (B)(C)

• 36 CFR 1236.14(3) – Metadata Preservation

• 36 CFR 1236.20(B) – Functionalities necessary for electronic recordkeeping

• 36 CFR 1236.22 – E-mail preservation requirements

• OMB Circular A-130, par. 8a1(j) and (k) and 8a4 – Information system design, development, and implementation

The following standard items relate to Federal records and information generated during the performance of a contract:

• The Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

• The Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

• The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

• The Contractor shall not create or maintain any records or information containing any Government Agency records that are not specifically tied to or authorized by the contract.

• The Government Agency owns the rights to all data/records produced as part of this contract.

• The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

• The Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

• No disposition of documents will be allowed without the prior written consent of the Contracting Officer and the SEC Records Liaison. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules, litigation/document preservations holds, and open FOIA cases.

SECTION I - CLAUSES INCORPORATED

Contract Clauses incorporated by reference:

52.202-1 – Definitions (Jan 2017) 52.203-5 – Covenant Against Contingent Fees (Apr 1984) 52.203-6 – Restrictions on Subcontractor Sales to the Government (Sep 2006) 52.203-7 – Anti-Kickback Procedures (May 2014) 52.203-17 – Contractor Employee Whistleblower Rights and Requirement To Inform Employees (Apr 2014) 52.204-7 - System for Award Management (Oct 2016) 52.204-13 - System for Award Management Maintenance (Oct 2016) 52.204-16 – Commercial and Government Entity Code Reporting (Jul 2016) 52.204-18 – Commercial and Government Entity Code Maintenance (Jul 2016) 52.204-19 – Incorporation by Reference of Representation and Certifications (Dec 2014) 52.217-5 – Evaluation of Options (Jul 1990) 52.217-8 – Option to Extend Services (Nov 1999) 52.232-17 – Interest (May 2014) 52.232-39 – Unenforceability of Unauthorized Obligations (Jun 2013) 52.232-40 – Providing Accelerated Payments to Small Business Subcontractors (Dec 2013) 52.233-1 – Disputes (May 2014)

52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (JAN

2017).

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items (Nov 2017).

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(3) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20

(4) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004)(Public Laws 108- 77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15

U.S.C. 657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (JAN 2011) of 52.219-4.

__ (13) [Reserved] _X_ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C.

644).

__ (ii) Alternate I (Nov 2011).

http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20…