TIB-2021-RFP-0001_final CUI.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 35

PR-2021-STD-0098

TIB-2021-RFP-0001

Denise Roberts-Maynard 2/15/2021 12:00 pm EST

FRTIB

77 K Street NE, Suite 1000 Washington DC 20002

X

561990

Net 30

N/A

77 K Street, NE Suite 1000

202-942-1600

See CONTINUATION Page

This Request for Proposal (RFP) is to provide Executive Coaching Services at FRTIB

The Contractor shall furnish and make available all professional, technical, administrative, and management services, as well as supplies, materials needed to accomplish the task under this contract.

All questions regarding this RFP shall be submitted in writing only using Attachment 004- Q&A Template, to the Contracting Officer at Denise.Roberts-Maynard@FRTIB.Gov no later than 12:00 PM on Monday, January 25, 2021

All quotes shall be submitted no later than 12:00 pm EST on Monday, February 15, 2021.

Contractor must certify FAR Clauses 52.204-24 and 52.204-26 within this document prior to award of contract.

See CONTINUATION Page

X X

X One

Denise Roberts-Maynard

Section A: Solicitation/Contract Form

A.1 Background The Federal Retirement Investment Board (FRTIB) is an independent Federal government agency in the Executive Branch created by the Federal Employees’ Retirement System Act of 1986 (FERSA). The Thrift Savings Plan (TSP) is a retirement savings and investment plan for Federal civilian employees and members of the uniformed services that offers its participants the same type of savings and tax benefits that many private corporations offer their employees under I.R.C.§401(k) plans. The TSP is the largest participant-directed defined contribution plan in the world. The mission of the FRTIB is to administer the TSP solely in the interest of the participants and beneficiaries.

FRTIB is a self-funded agency with independent budgetary authority that receives no annual appropriations from Congress. FRTIB procurements adhere to the FAR, unless doing so would be inconsistent with the Agency’s fiduciary obligations under Federal Employees’ Retirement System Act (FERSA). FRTIB has adopted the FAR as its primary contracting policy and procedures for procuring its goods and services.

The Thrift Federal Acquisition Supplement (T-FAS) specifies when the Agency’s policies and practices deviate from the FAR. See link to T-FAS below.

https://www.frtib.gov/Procurement/DoingBusiness.html

The Office of Resource Management (ORM) supports and manages human resources and administration activities for FRTIB in accordance with Office of Personnel Management (OPM) regulations and other applicable Federal regulations. ORM serves as a strategic partner with FRTIB leadership to drive the design of innovative, effective administrative services and human resource programs that support FRTIB employees and its overall mission.

The Human Resources Division (HRD), Office of Resource Management is responsible for providing cost-effective and coordinated strategies for the delivery of training and employee development programs that support the mission and goals of the agency. The agency has a Coaching Program which attends to the developmental needs of executives, supervisors, and staff. A coaching program enhances the career and professional development of FRTIB executives and employees.

To support agency goals and strategic planning for human capital solutions, succession planning, competency identification and development, the agency is seeking the services of executive and high-level professional coaches.

This Request For Proposals (RFP) contains instructions governing the proposals to be submitted and the material to be included therein; a description of the service to be provided; requirements which must be met to be eligible for consideration; general evaluation criteria; and other requirements to be met by each proposal.

Section B. Supplies or Services

B1. Contract Line Item Number (CLIN) Structure

The proposed duration of contract is for five years, inclusive of one base year period and (4) 12-month option year periods to align with lease of the building and to avoid a lapse of service. These services are to be performed at the Government facility, FRTIB headquarters located at 77 K Street, NE Washington, DC, 20002.

https://www.frtib.gov/Procurement/DoingBusiness.html

This RFP will result in a single award BPA, with one (1) - 12 Month Base Year and four (4) Option Years. The contract period of performance is not to exceed 60 months. The Government is obligated only to the extent of authorized purchases actually made under the BPA.

Base Year Contract Line Item Numbers (CLINs)

CLIN Service Quantity Rate NTE Price

0001 Coaching Sessions at 90min each $ $

0002 Monthly Status Report $ $

0003 Monthly COR Meetings $ $

0004 Coaching Progress Reports $ $

0005 Closeout Coaching Progress Reports $ $

BASE YEAR TOTAL $ $

Option Year One (1) Contract Line Item Numbers (CLINs)

1001 Coaching Sessions at 90min each $ $

1002 Monthly Status Report $ $

1003 Monthly COR Meetings $ $

1004 Coaching Progress Reports $ $

1005 Closeout Coaching Progress Reports $ $

OPTION YEAR 1 TOTAL $

Option Year Two (2) Contract Line Item Numbers (CLINs)

2001 Coaching Sessions at 90min each $ $

2001 Monthly Status Report $ $

2003 Monthly COR Meetings $ $

2004 Coaching Progress Reports $ $

2005 Closeout Coaching Progress Reports $ $

OPTION YEAR 2 TOTAL $

Option Year Three (3) Contract Line Item Numbers (CLINs)

3001 Coaching Sessions at 90min each $ $

3002 Monthly Status Report $ $

3003 Monthly COR Meetings $ $

3004 Coaching Progress Reports $ $

3005 Closeout Coaching Progress Reports $ $

OPTION YEAR 3 TOTAL $

Option Year Four (4) Contract Line Item Numbers (CLINs)

4001 Coaching Sessions at 90min each $ $

4002 Monthly Status Report $ $

4003 Monthly COR Meetings $ $

4004 Coaching Progress Reports $ $

4005 Closeout Coaching Progress Reports $ $

TOTAL $

GRAND TOTAL

Section C: Statement of Work Description and Specifications

C1. Services FRTIB requires the assistance of executive and high-level coaches for the main objective of increasing leadership capacity within the Agency. Specifically, the contractor shall provide leadership coaching for approximately 25 FRTIB Senior Executives and supervisors at the SES, GS-15, and GS-14 pay grade according to their individual coaching needs and goals. In addition, the contractor shall provide coaching for approximately 10 employees at the GS-14 and GS-13 pay grade who are interested in becoming supervisors or managers. The number of FRTIB employees may fluctuate with FRTIB staff increases and participation.

Coaching is voluntary and confidential at FRTIB. The contractor shall provide coaching based primarily on leading oneself by:

• Developing self-awareness of fundamental leadership dimensions

• Gaining better understanding of one’s impact on others; and

• Improving and enhancing personal effectiveness

FRTIB anticipates that each coaching engagement will last for approximately 12 months. The contractor shall provide 12 sessions of 1.5 hours each, distributed according to the developmental needs of each coaching client. The contractor shall provide coaching in person or, as approved by the COR, over the phone. Depending on the developmental needs of the coaching client, multiple coaching engagements for the same client may be required.

HRD will receive and discuss coaching requests from FRTIB prospective coaching clients, check on the readiness of each prospective coaching client, and match the suitable coach with the client. Therefore, it is essential that the contractor shall provide leadership coaches to work closely with HRD to ensure the success of each coaching engagement.

The contractor shall provide each coaching client identified by FRTIB with an assigned leadership coach who will develop the individual coaching development plan collaboratively with the coaching client. The contractor’s leadership coach and the coaching client will focus on measurable objectives in the development plan to check progress towards coaching goals in the development plan. The contractor’s leadership coaches shall complete these required tasks at the beginning of each coaching engagement:

1) development of the individual coaching development plan; and

2) establishment of regular meetings, as determined by the coach and the coaching client, to achieve measurable objectives in the development plan.

C2. Tasks and Deliverables

C2.1 Attend a Kick-Off Meeting 5 days after BPA award.

C2.2 Each coach will be required to sign a confidentiality agreement prior to the commencement of work.

C2.3 Participate in brief information sessions with coaching clients to which they are matched, in order to orient the leadership coach to the FRTIB culture. These information sessions will be part of an individual’s coaching session.

C2.4 Deliver 12 coaching sessions of 90 minutes each per coaching engagement. A coaching engagement is defined as 12 individual 90-minute sessions. Coaching sessions shall not exceed 90 minutes. If a session exceeds 90 minutes no cost will be incurred by the Government.

C2.4.1 The 12 coaching sessions should be completed no later than 12 months after award of the call order for the individual engagement, unless an extension is approved by HRD.

C2.4.2 Coaching sessions will be on-site at FRTIB unless specified otherwise.

C2.4.3 If the client believes the coaching is not working as desired, the offeror will provide a replacement coach. All replacements must be pre-approved by HRD.

C2.5 Complete and submit a coaching agreement for each coaching engagement no later than the second coaching session. Coaching Agreements will be provided by HRD.

C2.6 Work closely with each coaching client to complete and submit an Individual Coaching Development Plan no later than the third coaching session.

C2.7 Evaluate the progress of each coaching engagement midway and at the end. Prepare a report and discuss findings with HRD upon request. The report will provide a synopsis of the progress made during the coaching engagement, including progress made by the individual being coached towards the goals identified in the Coaching Development Plan.

C2.8 Submit a monthly status report on all coaching requirements and discuss findings with HRD upon request.

At a minimum, this report will include the name of the individual being coached, the name of the coach, and the number of coaching engagements completed.

C3 Key Personnel C3.1 The contractor shall provide key personnel on this contract that have the following qualifications:

C3.1.1 Has a graduate degree (MS, MA, Ph.D.) preferably in relevant behavioral/applied behavioral science such as psychology, organization development, or organizational behavior.

C3.1.2 Certified through the International Coach Federation as Master Coaches (MCC).

C3.1.3 Demonstrates continuous formal learning.

C3.1.4 Completed advanced coaching training and has attained a professional certification in coaching.

C3.1.5 Certification(s) and experience in conducting and interpreting results of 360-degree assessments.

C3.1.6 Certification/qualification in administering other than 360 assessments such as the Myers Briggs Type Indicator.

C3.1.7 Has earned public recognition and awards for his/her coaching role in improving organizational culture.

C3.1.8 All replacement coaches must be pre-approved by HRD

C3.1.8 At least five (5) years of experience coaching executives, mid-level managers and professionals in a large organizational setting such as government. Experience in coaching executives, mid-level managers and professional clients in the financial services industry is preferred.

C3.1.9 Resides or regularly does business in the DC/Maryland/Virginia metropolitan area.

The following qualifications are not essential to the requirement but are preferred attributes for key personnel:

C3.1.10 Formal education, knowledge and experience in organization development is desired.

C3.1.11 Formal education, knowledge and experience in adult development theory, methods and practices is desired.

C3.1.12 Experience in conducting and interpreting results of 360 assessment tools offered by the Center for Creative Leadership.

C4. Non-Disclosure and Conflicts of Interest The Agency will ensure that all individuals assigned to performance service on this contract sign Non- Disclosure Agreements, and applicable Ethic Agreements prior to beginning work on the contract. (see Attachments 001 and002)

Section D: Packaging and Marketing Not Applicable

Section E: Inspections and Acceptance The basis for acceptance shall be in compliance with the requirements set forth in the award resulting from this

RFP. The Contracting Officer Representative (COR) will have the right to reject or require correction of any deficiencies found in deliverables. In the event of rejection of any deliverable, the Contractor will be notified in writing by the COR of the specific reasons the deliverable was rejected. If no comments from the COR are provided within 10 business days of receipt, the deliverable will be deemed to have been accepted by the Agency. Documents not approved by the FRTIB must be resubmitted with changes within 10 business days and the FRTIB will have another 10 business-day review period. If after the third submission the deliverable is unacceptable to FRTIB, the Program Manager, COR, and Contracting Officer will meet to discuss corrective actions.

Section F: Performance / Deliverables F1. Period of Performance The period of performance on this contract consists of a 12-month base period and four (4) 12-month option periods. The total period of performance on this contract shall not exceed 60 months.

• Base Period – Twelve (12) months from contract award

• Option Period 1 – Twelve (12) months from the end of Base Period

• Option Period 2 – Twelve (12) months from the end of Option Period 1

• Option Period 3 – Twelve (12) months from the end of Option Period 2

• Option Period 4 – Twelve (12) months from the end of Option Period 3

F2. Contract Performance Location

All meetings will take place at FRTIB offices located at 77 K Street, NE, Washington, DC 20002. Off-site meeting by phone will be permitted upon agreement from the COR. Coaching sessions are flexible in terms of time of day and are based on an explicit agreement between the coach and his/her coaching client.

F3. Deliverables

Deliverable Format Due Date or Occurrence Distribution

Kick-Off Meeting 60-Minute Session 5 days after BPA Award One-time occurrence in person or via teleconference

Submit Signed Confidentiality Agreement

PDF

5 days after BPA award Email

Submit a Coaching Agreement

PDF or Word No later than the second coaching session

Email

Submit Individual Coaching Development Plan

PDF or Word No later than the third coaching session

Email

Submit Coaching Progress Report

PDF or Word After completion of 6 individual coaching sessions

Email

Submit Close-Out Coaching Progress Report

PDF or Word After completion of 12 individual coaching sessions

Email

Meeting with COR to Discuss 6-Month Progress Report

30-Minute Session As requested Via phone

Meeting with COR to Discuss Close-Out Progress Report

30-Minute Session As requested Via phone

Monthly Status Report on all Engagements

PDF or Word 5th day of Month Email

Meeting the COR to Discuss Monthly Status Report

30-Minute Session As requested Via Phone

Section G: Contract Administration Data G1. Contracting Officer (CO)

Responsibility for contracting activities rests solely with the Agency’s CO. No conversation, recommendations, or direction, whether given directly by, or implied by Agency personnel, that will affect the scope, schedule, or price of the program, shall be acted upon by the Contractor unless specifically approved by the Agency CO. In the event that the Contractor implements changes to the contract at the direction of any person other than the CO, the Contractor will not receive reimbursement for the work performed pursuant to those unauthorized changes. Contractual interpretation and assistance may be obtained by contacting the CO.

G1.1 Contracting Officer Contact Information

Name: Denise Roberts-Maynard Phone Number: 202.864.8771 or 202.841.7795 (cell) Email Address: Denise.Roberts-Maynard@FRTIB.gov

G2. Contracting Officer Representative (COR)

The CO shall designate a COR, who is responsible for administering the performance of work under this contract by:

(1) Monitoring the Offeror’s progress

(2) Assessing performance

(3) Recommending to the CO changes in requirements

(4) Interpreting the scope of work

(5) Performing inspections and acceptances of data items required by this order, and

(6) Assisting the Offeror in the resolution of technical problems encountered during the performance of the contract.

G2.1 Contracting Officer Representative Contact Information Name: TBD Phone: TBD Email: TBD

G3. Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP)

Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice Processing Platform (IPP) system using the “Bill to Agency” of Interior Business Center – FMD. “Payment request” means any request for contract financing payment or invoice payment by the Contractor. Any changes to submitted invoice (short‐pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212‐4 Contract Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. The Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production mailto:Denise.Roberts-Maynard@FRTIB.gov http://www.ipp.gov/ http://www.ipp.gov/

Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

G4. Oracle Supplier Request Form

All contractors who have not previously provided the “Oracle Supplier Request Form” (Attachment 003) to the FRTIB must fill in the highlighted items on the form and submit it to the Contracting Officer within 3 business days after Contract Award.

G5. FRTIB Hours and Legal Holidays Normal business hours for FRTIB personnel are 8:00 AM to 5:00 PM Eastern Standard Time, Monday through Friday, excluding Federal holidays and official Federal Government closures in the Metropolitan DC area. The following Federal holidays are observed by the

FRTIB:

Section H: Special Contract Requirements

H.1 Safeguarding Controlled Unclassified Information (CUI)

(a) Definitions. As used in this clause— “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Holiday Date

New Year’s Day January 1

Inauguration Day – National Capital Region only

January 20, as observed

Martin Luther King’s Birthday Third Monday in January

President’s Day Third Monday in February

Memorial Day Last Monday in May

Independence Day July 4, as observed

Labor Day First Monday in September

Columbus Day Second Monday in October

Veteran’s Day November 11, as observed

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25 mailto:IPPCustomerSupport@fiscal.treasury.gov

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information.

“Controlled Unclassified Information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract;

or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contract.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Technical information” means technical data or computer software, as those terms are defined in this clauses--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of and Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the Cloud Computing Services clause of this contract.

http://www.archives.gov/cui/registry/category-list.html

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)

(A) The Contractor shall notify the FRTIB Chief Information Security Officer (CISO), via email, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the FRTIB Chief Technology Officer (CTO) or CISO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the FRTIB CTO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the time of the execution of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Reporting, including malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final https://www.fedramp.gov/resources/documents/

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(d) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(e) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause.

(End of Clause)

H.2 Compliance with Controls for Safeguarding Controlled Unclassified Information (CUI)

(a) Definitions. As used in this provision—

“Controlled Unclassified Information (CUI),” “covered contractor information system,” “cyber incident,” “information system,” and “technical information” are defined in clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6, Cyber Incident Reporting.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled Unclassified Information (CUI) and Cyber Incident Reporting, shall be implemented for all Controlled Unclassified Information (CUI) on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see (b)(2) of clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6 - Cyber Incident Reporting.

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer.

(2) If the Offeror proposes to vary from any of the security requirements specified by NIST SP

800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the CISO, a written explanation of —

(i) Why a particular security requirement is not applicable; or

(ii) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

(End of Clause)

H.3 RESERVED

H.4 RESERVED

H.5 RESERVED

H.6 Cyber Incident Reporting

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would http://dx.doi.org/10.6028/NIST.SP.800-171 enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which controlled unclassified Information is recorded, stored, or printed within a covered contractor information system.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a Breach or within one (1) hour of determining with reasonable certainty that there has been an incident or a Breach involving FRTIB data."

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor information system or the controlled unclassified information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to identify and report an incident or breach;

(iii) Conduct a review for evidence of compromise of Controlled Unclassified Information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts, in identifying what information was or may have been accessed and by whom, creating timelines of user activity, determining methods and techniques used to access federal information, and identifying the attack vector. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident or breach, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised Controlled Unclassified Information, or that affect the Contractor’s ability to provide operationally critical support.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for FRTIB and shall include, at a minimum, the required elements in accordance with FRTIB Cyber Incident Response Policy and Procedures.

(c) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to FRTIB CIO in accordance with instructions provided by the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(d) Media preservation and protection. When a Contractor discovers a cyber incident or breach has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (b)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(e) Cyber incident damage assessment activities. The Contracting Officer will request that the

Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(f) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(g) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(h) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to provide the incident report number assigned by the Security Operations Center or Computer Security Incident Response Team (CSIRT), to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber-incident to FRTIB as required in paragraph (b) of this clause.

H.7 RESERVED

H.8 Recordkeeping & Proprietary Information

“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

(b) The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract:

(1) The Contractor shall protect the information against unauthorized access, modification, release, or disclosure.

(2) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.

(3) All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take FRTIB provided Controlled Unclassified Information training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

(c) If contractor’s performance of services results in a Breach of FRTIB data, as defined in Section H.1, the Contractor shall bear the losses and expenses (including attorneys’ fees) associated with the breach including costs associated with (1) providing notice of the breach to affected individuals and to applicable regulatory bodies; (2) establishing call centers for affected individuals; and (3) providing individuals with credit and identity monitoring and credit and identity restoration services on an opt-in basis. The necessary remediation measures will be determined by FRTIB in accordance with FRTIB’s Breach Response policy and procedures.

(d) FRTIB safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with the Cyber Incident Reporting clause. To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information.

In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(e) Use and release of contractor attributional/proprietary information not created by or for FRTIB.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for FRTIB is authorized to be released outside of FRTIB—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes;

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract.

(f) Use and release of contractor attributional/proprietary information created by or for FRTIB.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for FRTIB is authorized to be used and released outside of FRTIB for purposes and activities authorized by paragraph (f) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

H.9 RESERVED

Section I. Contract Clauses FAR 52.252-2 Clauses Incorporated by Reference (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Procuring Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at these addresses:

https://acquisition.gov/far/index.html https://acquisition.gov/gsam/gsam.html

The following clauses will be incorporated by reference:

FAR Clause Date 52.202-1 Definitions Nov 2013 52.203-13 Contractor Code of Business Ethics and Conduct Oct 2015 52.203-17 Contractor Employee Whistleblower Rights and Requirement to

Inform Employees of Whistleblower Rights Apr 2014 file://Fileshare/users/Drogers/1st%20Command file://Fileshare/users/Drogers/1st%20Command

52.203-3 Gratuities Apr 1984 52.204-7 System for Award Management Oct 2018 52.212-1 Instructions to Offerors-Commercial Items June 2020 52.212-3 Offeror Representations and Certifications-Commercial Items Nov 2020 52.212-4 Contract Terms and Conditions – Commercial Items Oct 2018 52.215-19 Notification of Ownership Changes Oct 1997 52.504-25 Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment Aug 2020

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders – Commercial Items (NOV2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115- 91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AUG 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUNE 2020), with Alternate I (OCT 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (JUN 2020) (41 U.S.C. 3509)).

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3

X (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

X (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

X (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (JUN 2020) (31 U.S.C. 6101 note).

X (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)

(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (MAR 2020) (15 U.S.C. 657a).

__ (ii) Alternate I (MAR 2020) of 52.219-3.

__ (12)

(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (MAR 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (MAR 2020) of 52.219-4.

__ (13) [Reserved]

__ (14)

(i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

https://www.acquisition.gov/far/52.203-15#FAR_52_203_15 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.204-15#FAR_52_204_15 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.209-9#FAR_52_209_9…