USCA25R0108 Amendment 0002.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

See Block 16C

4. REQUISITION/PURCHASE REQ. NO.

AUD250003

5. PROJECT NO. (If applicable)

PMDCODE

Arianne M. Downey, 202-502-2399 Procurement Management Division Administrative Office of the United States Courts One Columbus Circle, N.E.

Suite 3-250 Washington, DC 20544-0001

6. ISSUED BY CODE7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

USCA25R0108

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

05/09/2025

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning __1__copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to:

1. Extend this solicitation deadline for proposals and past performance questionnaires to 06/06/2025, at 12:00 PM EST (noon).

All other terms and conditions remain unchanged.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remain unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

USCA25R0108 /0002 - Page 1 of 34

A-1 Appropriations

This is an open market Judiciary contract that will be administered by the Administrative Office of the U.S.

Courts for the Chapter 13 Trustee Audits. The contractor shall be paid directly by the trustee for each audit. No funding is obligated on this contract.

Section B - Supplies or Services and Prices/Costs

CLIN NO. Supplies or Services Quantity Unit of Issue Unit Price Extended Amount

0001 Base Period: Chapter 13 Standing Trustee Audits and Final Reports in accordance with Attachment

1, SOW. Travel is not separately priced.

Original :

Change:

Total: 1

Not-To-

Exceed

Extended Description:Concessionaire Contract - Audits are paid by Trustees. 16 reports estimated per year, which includes up to 2 closeout audits.

Each audit shall not exceed XX price. Each closeout audit shall not exceed XX price. This CLIN shall not exceed XX in total. Labor Hour.

Period of Performance:08/09/2025 - 08/08/2026

CLIN NO. Supplies or Services Quantity Unit of Issue Unit Price Extended Amount

1001 Option Year 1: Chapter 13 Standing Trustee

Audits and Final Reports in accordance with

Attachment 1, SOW. Travel is not separately priced.

Original :

Change:

Total: 1

Not-To-

Exceed

Extended Description:Concessionaire Contract - Audits are paid by Trustees. 16 reports estimated per year, which includes up to 2 closeout audits.

Each audit shall not exceed XX price. Each closeout audit shall not exceed XX price. This CLIN shall not exceed XX in total. Labor Hour.

Period of Performance:08/09/2026 - 08/08/2027

CLIN NO. Supplies or Services Quantity Unit of Issue Unit Price Extended Amount

2001 Option Year 2: Chapter 13 Standing Trustee

Audits and Final Reports in accordance with

Attachment 1, SOW. Travel is not separately priced.

Original :

Change:

Total: 1

Not-To-

Exceed

Extended Description:Concessionaire Contract - Audits are paid by Trustees. 16 reports estimated per year, which includes up to 2 closeout audits.

Each audit shall not exceed XX price. Each closeout audit shall not exceed XX price. This CLIN shall not exceed XX in total. Labor Hour.

Period of Performance:08/09/2027 - 08/08/2028

USCA25R0108 /0002 - Page 2 of 34

CLIN NO. Supplies or Services Quantity Unit of Issue Unit Price Extended Amount

3001 Option Year 3: Chapter 13 Standing Trustee

Audits and Final Reports in accordance with

Attachment 1, SOW. Travel is not separately priced.

Original :

Change:

Total: 1

Not-To-

Exceed

Extended Description:Concessionaire Contract - Audits are paid by Trustees. 16 reports estimated per year, which includes up to 2 closeout audits.

Each audit shall not exceed XX price. Each closeout audit shall not exceed XX price. This CLIN shall not exceed XX in total. Labor Hour.

Period of Performance:08/09/2028 - 08/08/2029

CLIN NO. Supplies or Services Quantity Unit of Issue Unit Price Extended Amount

4001 Option Year 4: Chapter 13 Standing Trustee

Audits and Final Reports in accordance with

Attachment 1, SOW. Travel is not separately priced.

Original :

Change:

Total: 1

Not-To-

Exceed

Extended Description:Concessionaire Contract - Audits are paid by Trustees. 16 reports estimated per year, which includes up to 2 closeout audits.

Each audit shall not exceed XX price. Each closeout audit shall not exceed XX price. This CLIN shall not exceed XX in total. Labor Hour.

Period of Performance:08/09/2029 - 08/08/2030

Section C - Descriptions/Specifications/Statement of Work

C-1 Statement of Work

See Attachment 1 - Statement of Work

Section D - Packaging and Marking No Clauses

Section E - Inspection and Acceptance

Clause(s) Incorporated By Reference, see Clause B-5 Clause Title Date

2-5B Inspection of Services APR 2013

Section F - Deliveries or Performance

USCA25R0108 /0002 - Page 3 of 34

Clause(s) Incorporated By Reference, see Clause B-5 Clause Title Date

2-60 Stop-Work Order JAN 2010

F-1 Deliverables and Deliverable Schedule

The Contractor shall deliver the following items:

Item Description Ref Section of State-ment of Work

Due By Due To

1 Engagement Planning Documents

4.1 30 calendar days after contract award

COR

2 Audit Plan and Draft Audit Program

4.2 30 calendar days after contract award

COR

3 Audit Schedule 4.3 30 calendar days after contract award

COR

4 Exit Conference Summary

17.1 Day of, or 1 day prior

to the Exit Confer-ence

COR

5 Weekly Status Report 20.1 45 calendar days after contract award then Weekly

COR

6 Draft Report (For AO Comment)

18.3 NLT 30 calendar days

after exit conference

COR and AO

7 Draft Report (For BA Comment)

18.3 NLT 7 calendar days

after AO comments

COR and BA

8 Final Report 18.4 7 calendar days after AO comments, but NLT March 1; or as approved by the AO.

COR, AO, and BA

*Bankruptcy Administrator is designated as BA above.

Deliverables must adhere to the standards outlined in the relevant sections of the SOW and the references covered in section 22 of the SOW.

If a due date falls on a weekend or holiday, the item shall be delivered the next business day.

The Contractor shall submit electronic copies of document deliverables to the COR and other government staff, as directed, via email unless otherwise specified. All document deliverables shall be made by close of business (COB) 4:30 PM Eastern Time (ET), Monday through Friday, unless stated otherwise. All deliverables submit-ted in electronic format shall be free of any known computer virus or defects. If a virus or defect is found, the deliverable will not be accepted. The replacement file shall be provided within two (2) business days after noti-fication of the presence of a virus.

Unless otherwise stated in the contract, the review timeframes are as follows: The Government will review and provide comments/approval to the Contractor within 14 days of receipt of each deliverable, and the Contractor shall provide any clarifications/corrections within 7 days for approval.

All deliverables are property of the AO.

F-2 Period of Performance

This contract is for one year with four one year option periods under clause 2-90D as follows:

USCA25R0108 /0002 - Page 4 of 34

Base Year: 8/9/25 - 8/8/26 Option Period 1: 8/9/26 - 8/8/27 Option Period 2: 8/9/27 - 8/8/28 Option Period 3: 8/9/28 - 8/9/29 Option Period 4: 8/9/29 - 8/8/30

F-3 Place of Performance

The Contractor shall provide services at the Standing Trustee’s office and various government’s sites.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer's Representative (COR), the Contractor employees may be required to work at an alternate place of performance (e.g., home, the Contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Ad-ditionally, the Contractor may be required to account for the whereabouts of their personnel should this inform-ation be requested by the COR. The Contractor shall prepare all deliverables and other contract documentation utilizing the Contractor’s resources. To the extent possible, the Contractor shall use best efforts to provide the same level of support as stated in the SOW.

Section G - Contract Administration Data

Clause(s) Incorporated By Reference, see Clause B-5 Clause Title Date

3-305 Payment by Electronic Funds Transfer-System for Award

Management (SAM) Registration

APR 2013

7-1 Contract Administration JAN 2003

7-5 Contracting Officer's Representative APR 2013

7-10 Contractor Representative JAN 2003

(a) The contractor's representative to be contacted for all contract administration matters is as follows (contractor complete the information):

Name: ___________________________________________________________________________ Address: ___________________________________________________________________________ Telephone: ___________________________________________________________________________ Email: ___________________________________________________________________________ Fax: ___________________________________________________________________________

(b) The contractor's representative shall act as the central point of contact with the judiciary, shall be respons-ible for all contract administration issues relative to this contract, and shall have full authority to act for and leg-ally bind the contractor on all such issues.

(END)

7-125 Invoices APR 2011

(a) Invoices shall be submitted to the address (physical or e-mail) specified in this contract and in accordance with any schedule for payments set forth elsewhere under this contract.

(b) The office that will make payments due under this contract will be designated in the contract at the time of contract award.

(c) To constitute a proper invoice, the billing document shall include the following information and/or attached documentation:

USCA25R0108 /0002 - Page 5 of 34

(1) name of business concern and such business's Taxpayer Identification Number;

(2) period(s) covered by invoice and invoice date;

(3) purchase order or contract number or other authorization for delivery of property or services, e.g., delivery/ task order number for orders under indefinite delivery contracts;

(4) for each line item - general description of product delivered or services rendered, measured unit, and associ-ated price;

(5) any applicable payment discount terms;

(6) total amount billed;

(7) a subtotal of any and all fees or credits applied to the invoice;

(8) an amount due (if any) or credit balance;

(9) name (where practicable), title, phone number, fax number, and complete mailing address of the responsible official to whom payment is to be sent. The "remit to" address shall correspond to the remittance address in the contract;

(10) other substantiating documentation or information as required by the purchase/delivery/task order or con-tract;

(11) all follow-up invoices shall be marked "Duplicate of Original." Contractor questions regarding payment in-formation or check identification shall be directed to the relevant paying authority specified in the contract.

(end)

7-125 Alt I Invoices JAN 2003

Substitute the following for paragraph (c)(4) of the basic clause:

(4) All invoices for services under this agreement shall indicate in detail the following:

(i) person performing service each day by hour and part of an hour;

(ii) services performed each day by hour and part of an hour;

(iii) rates and charges for each service so detailed; and

(iv) individual expenses charged, if allowed under this agreement.

Note: Minimum charges for portions of an hour may be allowed, if such a charging practice has been disclosed before award of this agreement.

(END)

G-1 Government Property

No government property will be issued for this contract. The contractor shall not have access to government networks.

G-2 Points of Contact

The points of contact for the administration of this contract is as follows:

Contracting Officer's Represenative (COR):

TBD

Contracting Officer David Kelley David_Kelley@ao.uscourts.gov

G-3 Invoicing Instructions

Invoices shall be submitted, in accordance with clause 7-125 and 7-125 Alt I, after each audit has been com-pleted and accepted.

All invoices shall be emailed directly to the COR and trustee for review and payment. The approval will be with the trustee/unit executive responsible for payment.

USCA25R0108 /0002 - Page 6 of 34

Invoices shall state also the line items being billed on the invoice and show the total price for each audit. The period of performance shall reflect the period of performance of the CLIN or the invoice will be rejected.

Each audit's total price that the contractor invoices for shall not exceed the audit price established on the con-tract.

G-4 Execution and ordering

The contractor shall be contacted by the COR and trustee when an audit is to be executed. The contractor shall not exceed the unit audit ceiling price established on the contract as stated for each year of the contract, which is based on labor hour estimates. The contractor shall only bill for hours actually incurred, which may be less than the established unit audit ceiling price. As an aggregate, the contractor shall not exceed the total not to ex-ceed value established for each year of the contract.

If more hours are required than the established unit audit ceiling price, the contractor shall contact the COR, trustee, and Contracting Officer before incurring any additional costs for approval. See clause 4-30 Alt I.

G-5 Modifications

The Government reserves the right to modify the contract to make modifications if determined necessary during the performance of the contract for modifications that do not fall under clause 7-185 and 7-185, Alt II. Any such changes shall be executed via a negotiated modification signed by the Contracting Officer and Contractor.

Section H - Special Contract Requirements

Clause(s) Incorporated By Reference, see Clause B-5 Clause Title Date

1-1 Employment by the Government JAN 2003

2-65 Key Personnel APR 2013

(a) Individuals identified below as key personnel and accepted for this contract are expected to remain dedicated to this contract. However, in the event that it becomes necessary for the contractor to replace any of the indi-viduals designated as key personnel, the contractor shall request such substitutions in accordance with this clause. Substitution of key personnel will be considered under the following circumstances only:

(1) All substitutes shall have qualifications at least equal to those of the person being replaced.

(2) All appointments of key personnel shall be approved in writing by the contracting officer, and no substitu-tions of such personnel shall be made without the advance written approval of the contracting officer.

(3) Except as provided in paragraph (4) of this clause, at least 30 days (60 days if security clearance is required) in advance of the proposed substitution, all proposed substitutions of key personnel shall be submitted in writ-ing to the contracting officer, including the information required in paragraph (5) of this provision.

(4) The following identifies the requirements for situations where individuals proposed as key personnel be-come unavailable because of sudden illness, death or termination of employment. The contractor shall within 5 work days after the event, notify the contracting officer in writing of such unavailability. If the event happens after award, the contracting officer will determine if there is an immediate need for a temporary substitute and a continuing requirement for a permanent substitute for the key personnel position. The contracting officer will promptly inform the contractor of this determination. If the contracting officer specifies that a temporary substi-tute is required, the contractor shall as soon as is practical identify who will be performing the work as a tem-porary substitute. The temporary substitute will then start performance on a date mutually acceptable to the con-tracting officer and the contractor. Within 15 work days following the event, if the contracting officer specifies that a permanent substitute is required, the contractor shall submit, in writing, for the contracting officer's ap-proval, the information required in (5) and (6) below, for a proposed permanent substitute for the unavailable individual. The approval process will be the same as (7) below.

(5) Request for substitution of key personnel shall provide a detailed explanation of the circumstances necessit-

USCA25R0108 /0002 - Page 7 of 34 ating substitution, a resume of the proposed substitute, and any other information requested by the contracting officer to make a determination as to the appropriateness of the proposed substitute's qualifications. All resumes shall be signed by the proposed substitute and his/her formal (per company accepted organizational chart) direct supervisor or higher authority.

(6) As a minimum (or as otherwise specified in the solicitation), resumes shall include the following:

(a) name of person;

(b) functional responsibility;

(c) education (including, in reverse chronological order, colleges and/or technical schools attended (with dates), degree(s)/certification(s) received, major field(s) of study, and approximate number of total class hours);

(d) citizenship status;

(e) experience including, in reverse chronological order for up to ten years, area(s) or work in which a person is qualified, company and title of position, approximate starting and ending dates (month/year), concise descrip-tions of experience for each position held including specific experience related to the requirements of this con-tract; and

(f) certification that the information contained in the resume is correct and accurate (signature of key person and date signed, and signature of the supervisor or higher authority and date signed will be accepted as certifica-tion).

(7) The contracting officer will promptly notify the contractor in writing of his/her approval or disapproval of all requests for substitution of key personnel. All disapprovals will require re-submission of another proposed substitution within 15 days by the contractor.

(b) The following individuals are designated as key personnel under this contract:

Partner/Principal, Concurring Review Partner, Senior Audit Manager, Audit Manager, Auditor Senior

(END)

7-45 Travel APR 2013

The contractor may propose travel costs if travel is required for performance of the contract and is an authorized reimbursable expense under the contract. The extent of reimbursement for incurred travel costs will be subject to the limitations set forth in the Guide, Vol 19, Ch 4 (Judiciary Staff Travel Regulations).

(end)

H-1 Key Personnel - Labor Categories/Responsibilities/Qualifications

The Contractor shall provide the necessary personnel to accomplish the audit in accordance with the Contract.

At a minimum, the Contractor shall provide the following labor categories to perform services in accordance with this Contract. All of these labor categories are key personnel.

Partner/Principal (Key Personnel). The minimum qualifications are:

• Must be partners, members, or principals in the Contractor's organization,

• Must have a minimum of eight years of audit experience,

• Must have five years of experience in auditing in accordance with GAGAS, and

• Must be a Certified Public Accountant (CPA) in good standing.

Concurring Review Partner (Key Personnel)

• Must be partners, members, or principals in the Contractor's organization,

• Must have a minimum of eight years of audit experience,

• Must have five years of experience in auditing in accordance with GAGAS, and

• Must be a Certified Public Accountant (CPA) in good standing.

Senior Audit Manager (Key Personnel). The minimum qualifications are:

• Must be at least a manager in the Contractor's organization, USCA25R0108 /0002 - Page 8 of 34

• Must have a minimum of six years of audit experience (one year of which shall be supervisory audit experi-ence),

• Must have four years of experience in auditing in accordance with GAGAS (experience in auditing entities similar in size and complexity as the Judiciary is desirable), and

• Must maintain a relevant industry standard certification, which must include one or more of the following:

CPA (desirable), CISA, CIA, or CGFM.

Audit Manager (Key Personnel) - The minimum qualifications are:

• Must be a manager in the Contractor's organization,

• Must have a minimum of four years of audit experience,

• Must have a minimum of three years of experience in auditing in accordance with GAGAS (experience in auditing entities similar in size and complexity as the Judiciary is desirable),

• Maintaining a relevant industry standard certification (e.g., CPA, CISA, CIA, CGFM) is desirable, but not required.

Auditor Senior (Key Personnel) - The minimum qualifications are:

• Must be a senior auditor in the Contractor's organization,

• Must have a four-year college degree (BA or BS) with 24 semester hours in accounting,

• Must have a minimum of three years audit experience (one of which shall be auditor-in-charge experience), and

• Must have one-year experience in auditing in accordance with GAGAS.

H-2 Travel

The Contractor shall travel during the performance of the Contract. Travel is not separately priced as a CLIN on this contract, but is reimbursable. All receipts for travel shall be provided to the COR and trustee for review.

The trustee is responsible for travel reimbursement and approvals. Travel to Trustee’s locations, within the states of North Carolina and Alabama, is required in the performance of these audits.

Travel shall be reimbursed in accordance with clause 7-45. Local travel will not be considered a reimbursable travel cost. The contractor shall not include general and administrative (G&A) or other indirect costs in the in-voicing of travel.

H-3 Subcontractors

In accordance with clause 7-75, Identification of subcontractors - Pre-award information that the contractor provided concerning the use and identity of subcontractors is made part of this contract. Contractors must noti-fy the contracting officer in writing within ten days of any changes including the addition of any subcontracts after award. This applies for all "major" subcontracts in which "major" subcontractor is defined as one with a subcontract value equal to or greater than 10% of the contracts total value inclusive of all options.

Section I - Contract Clauses

Clause(s) Incorporated By Reference, see Clause B-5 Clause Title Date

1-10 Gratuities or Gifts JAN 2010

1-15 Disclosure of Contractor Information to the Public AUG 2004

1-5 Conflict of Interest AUG 2004

USCA25R0108 /0002 - Page 9 of 34

Clause Title Date

3-105 Audit and Records APR 2011

3-120 Order of Precedence JAN 2003

3-205 Protest after Award JAN 2003

3-25 Protecting the Judiciary's Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment

JUN 2014

3-300 Registration in the System for Award Management (SAM)

(OCT 2023)

APR 2013

3-35 Covenant Against Contingent Fees JAN 2003

3-40 Restrictions on Subcontractor Sales to the Judiciary JUN 2014

3-45 Anti-Kickback Procedures JUN 2012

3-50 Cancellation, Rescission, and Recovery of Funds for Illegal or

Improper Activity

JUN 2012

3-55 Price or Fee Adjustment for Illegal or Improper Activity JUN 2012

6-60 Rights in Data - General JUN 2012

7-100B Limitation of Liability (Services) JAN 2003

7-110 Bankruptcy JAN 2003

7-15 Observance of Regulations/Standards of Conduct JAN 2003

7-150 Extras JAN 2003

7-20 Security Requirements APR 2013

7-205 Payment for Judiciary Holidays (OCT 2023) APR 2013

7-210 Payment for Emergency Closures APR 2013

7-215 Notification of Ownership Changes JAN 2003

7-225 Termination (Cost-Reimbursement) MAR 2019

7-225 Alt I Termination (Cost-Reimbursement) APR 2013

7-235 Disputes JAN 2003

7-25 Indemnification AUG 2004

7-30 Public Use of the Name of the Federal Judiciary JUN 2014

7-35 Disclosure or Use of Information APR 2013

7-40 Judiciary-Contractor Relationships JAN 2003

7-85 Examination of Records JAN 2003

B-20 Computer Generated Forms JAN 2003

7-130 Interest (Prompt Payment) JAN 2003

USCA25R0108 /0002 - Page 10 of 34

7-185 Changes APR 2013

(a)The contracting officer may at any time, by written order, and without notice to the sureties, if any, make changes within the general scope of this contract in any one or more of the following:

(1) drawings, designs, or specifications when the products to be furnished are to be specially manufactured for the judiciary in accordance with the drawings, designs, or specifications;

(2) statement of work or description of services to be performed;

(3) method of shipment or packing of products;

(4) place of delivery of products or place of performance;

(5) delivery or performance schedule, time (i.e. hours of the day, days of the week, etc.) or place of delivery or performance of services;

(6) judiciary-furnished property or facilities.

(b) If any such change causes an increase or decrease in the cost of, or the time required for, performance of any part of the work under this contract, whether or not changed by the order, the contracting officer will make an equitable adjustment in the contract price, the delivery schedule, or both, and will modify the contract.

(c) The contractor shall assert its right to an adjustment within 30 days from the date of receipt of the written or-der. However, if the contracting officer decides that the facts justify it, the contracting officer may receive and act upon an offer submitted before final payment of the contract.

(d) If the contractor's offer includes the cost of property made obsolete or excess by the change, the contracting officer will have the right to prescribe the manner of the disposition of the property.

(e) Failure to agree to any adjustment is a dispute under the Disputes clause. However, nothing in this clause will excuse the contractor from proceeding with the contract as changed.

(end)

2-57 Protecting, Reporting, and Responding to Incidents Involving Sensitive Information (JUN 2024)

JUL 2024

Protecting, Reporting, and Responding to Incidents Involving Sensitive Information (JUN 2024)

(a) Definitions. As used in this clause— “Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any sim-ilar occurrence where an unauthorized person accesses or potentially accesses Sensitive Information, or an au-thorized user accesses Sensitive Information for an unauthorized purpose.

“Incident” means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation, or imminent threat of violation, of law, security policies, security procedures, or acceptable use policies.

“Information System” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Personally Identifiable Information (PII)” means information that can identify an individual, when used alone or with other relevant data. PII may contain direct identifiers (e.g., Social Security numbers) that can identify a person uniquely or quasi-identifiers (e.g., date of birth) that can be combined with other quasi-identifiers to suc-cessfully recognize an individual. The definition of PII is not anchored to any single category of information or technology. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial ac-count numbers, and biometric identifiers.

“Privacy Information” means both PII and Sensitive Personally Identifiable Information (SPII).

“Sensitive Information” means any data or other information for which public disclosure, or disclosure to users without a need to know to perform their jobs, can harm individuals, the U.S. government, or private organiza-tions. Sensitive Information includes Privacy Information and the following types of information:

(1) Agreement Information. Information received by judiciary organizations, according to agreements with other federal, state, local, tribal, territorial, or private sector partners, that is required to be protected under the agreement with that partner or other applicable laws.

(2) Procurement Information. Information related to procurements that is considered sensitive and is not

USCA25R0108 /0002 - Page 11 of 34 normally shared with the public outside official processes. This includes internal information and documents related to procurements, source selection information, vendor proposals, and submitted information marked as proprietary or sensitive. This does not include the contractor’s own proposal(s) or contract(s) with the judiciary.

(3) Information Systems Vulnerability Information (ISVI).

(A) Information technology (IT) systems data (e.g., systems inventories, enterprise architecture models) that reveal infrastructure used for servers, desktops, and networks; application name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use or need.

(B) Information about developing or current technology, the release of which could hinder judiciary object-ives, compromise a technological advantage or countermeasure, cause a denial of service, or provide an ad-versary with sufficient information to clone, counterfeit, or circumvent a process or system.

(C) System vulnerability or weakness information that could be used to compromise the confidentiality, in-tegrity, or availability of an information system.

(4) Personnel Security Information. Information that could result in physical risk to judiciary personnel.

(5) Physical Security Information. Information related to the protection of judiciary buildings, grounds, or property, including reviews or reports that illustrate or disclose facility infrastructure or security vulnerabilities.

Examples include threat assessments, system security plans, security diagrams for judiciary buildings, contin-gency plans, risk management plans, business impact analysis studies, and certification and accreditation docu-mentation.

(6) Court Related Information. Sealed cases, sealed documents or other information marked as sensitive by a court. This includes Highly Sensitive Documents (HSD), which are documents or other materials that contain sensitive, but unclassified, information that warrants exceptional handling and storage procedures to prevent significant consequences from unauthorized access or disclosure.

(7) Privileged/confidential Information. Information protected through recognized confidential relationships.

(8) Official Business Information. Proposed budgets, draft plans or policies, other information intended only for consideration by internal decision makers or other confidential audiences.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII that if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an indi-vidual.

(1) Multiple pieces of information, when combined, may pose an increased risk of harm to the individual.

SPII may consist of any grouping of information that contains an individual's name or other unique identifier, plus one or more of the following elements:

(A) Truncated SSN (e.g., last four digits);

(B) Birthdate (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information (e.g., mother's birth name, account passwords, personal identification numbers (PINs)).

(2) Other PII (e.g., list of employees and their performance ratings, unlisted home address, unlisted phone number) that may present an increased risk of harm to the individual depending on its context. The context in-cludes the purpose for which the PII was collected, maintained, and used. The same information in different contexts can reveal additional information about the impacted individual.

(b) Accessing and Protecting Sensitive Information

(1) Contractor roles and responsibilities regarding Sensitive Information. Before the contractor shall have access to Sensitive Information, the contractor shall coordinate with the contracting officer’s representative (COR) about the contractor’s roles and responsibilities regarding the Sensitive Information, and how an incident or suspected incident will be handled consistent with this clause and judiciary policies and procedures. Before they may access the Sensitive Information, the contractor and their staff and subcontractors shall complete all forms, trainings, and briefings as may be necessary for security or other reasons.

(2) Training. Contractors that have access to Sensitive Information as part of this contract shall provide their staff with training before they access Sensitive Information, and then at least annually thereafter. The training shall comply with this clause and the training shall cover how to properly handle and safeguard judiciary Sensit-

USCA25R0108 /0002 - Page 12 of 34 ive Information and how to identify and report incidents or suspected incidents regarding judiciary Sensitive In-formation consistent with this clause. The contractor shall provide an initial report, and then an annual report each year after that, to the COR that shows that contractor staff and any subcontractor staff working on the con-tract have all successfully completed such training. The Contractor shall also provide the COR confirmation that any new staff or subcontractor staff that join the contract after the contract has begun have also successfully completed such training.

(3) Access. Contractor shall have access only to those areas of judiciary Sensitive Information resources ex-plicitly stated in this contract or approved by the contracting officer or COR in writing, as necessary for per-formance of the work under this contract. Any attempts by contractor personnel to gain access to any informa-tion resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the contracting officer or COR, are strictly prohibited. If this clause is violated, the judiciary will take appropri-ate actions regarding the contract and the individual(s) involved.

(4) Protection Requirements

(A) Contractor shall safeguard all Sensitive Information and shall take reasonable measures to prevent the unauthorized use, disclosure, or loss of Sensitive Information. This includes Sensitive Information in any medi-um or form, including electronic, oral, or paper.

(B) Contractor and their subcontractors shall safeguard Sensitive Information whether it resides on judiciary owned and operated information systems, judiciary owned and contractor-operated information systems, con-tractor-owned and/or operated information systems operating on behalf of the judiciary, and any situation where contractor and/or subcontractor employees may have access to Sensitive Information because of their relation-ship with the judiciary.

(C) Sensitive Information shall not be stored on a mobile device or portable electronic media and shall be handled with awareness of the surroundings, so that the Sensitive Information is not disclosed to unauthorized individuals. Sensitive Information shall be secured when unattended or not in use. If performance of the con-tract requires the contractor to access Sensitive Information on a mobile device or portable electronic media, they shall notify the contracting officer and COR and provide details on the use case required and how such use will comply with this clause and all other applicable policies and guidelines. The COR will work with the con-tractor and determine if such a use case is acceptable. The contractor shall not use or store Sensitive Informa-tion on a mobile device or portable electronic media until the contracting officer provides acceptance of the use case.

(D) Contractor shall encrypt Sensitive Information if the Sensitive Information is in transit or is stored out-side of judiciary networks. This includes any Sensitive Information that may reside on, or transit contractor-owned or operated information systems.

(E) All Sensitive Information must be appropriately labeled, secured, and be properly returned, disposed of, or sanitized when no longer needed or at the end of the contract. See section (e) of this clause for more guid-ance on returning, sanitizing, and disposing of judiciary Sensitive Information.

(F) Removal. The contracting officer may require the contractor to prohibit individuals from working on the contract if the judiciary deems their initial or continued employment on the contract contrary to the public in-terest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security con-cerns.

(c) Incident Reporting Requirements

(1) Contractors and subcontractors shall report all known or suspected incidents to the Security Operations Center (SOC), which is staffed 24 hours per day, seven days per week.

(A) When reporting incidents to the SOC, contractors and subcontractors shall submit the report by:

(i) email to soc@ao.uscourts.gov with courtesy copy to the contracting officer and COR using the contact information identified in the contract, or

(ii) phone call to 202-502-4370, in which case the contractor must notify the contracting officer and COR immediately after reporting to the SOC.

(B) Contractors and subcontractors shall report all known or suspected incidents involving PII or SPII within one hour of discovery. All other incidents shall be reported within eight hours of discovery.

(C) Subcontractors shall notify the prime contractor if they have reported a known or suspected incident to the SOC. Lower tier subcontractors shall also notify their higher tier subcontractor, until the prime contractor is reached.

(2) The judiciary will determine whether information exposed in an unauthorized disclosure or security

USCA25R0108 /0002 - Page 13 of 34 breach of information under the contractor’s control or in an information system under the contractor’s control at the time of the incident is Sensitive Information, PII, or SPII by performing an assessment of the specific risk that an individual could be identified using the exposed information with other information that is linked or linkable to the individual. Information that is not PII when considered alone can become PII or SPII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to an individual. Final determination of the categorization of exposed information as Sensitive Inform-ation, PII, or SPII will be made in writing by the contracting officer.

(3) Sensitive Information transmitted via email shall be protected by encryption. When using regular email channels, contractors and subcontractors shall not include any Sensitive Information in the subject or body of any email. The Sensitive Information shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of Sensitive Information shall comply with any email restrictions imposed by the originator.

(4) No incident may, by itself, be interpreted as evidence that the contractor or subcontractor has failed to provide adequate information security safeguards for Sensitive Information or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, contractors and subcontractors shall also provide as many of the fol-lowing data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(A) Unique Entity Identifier (UEI);

(B) Contract numbers affected, unless all contracts by the company are affected;

(C) Facility CAGE code, if the location of the event is different than the prime contractor location;

(D) Point of contact (POC), if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(E) Contracting officer POC (address, telephone, and email);

(F) Contract clearance level;

(G) Name of subcontractor and CAGE code, if this was an incident on a subcontractor network;

(H) Government programs, platforms, or systems involved;

(I) Location(s) of incident;

(J) Date and time the incident was discovered;

(K) Server names where Privacy Information resided at the time of the incident, both at the contractor and subcontractor level;

(L) Description of the government PII or SPII contained within the system; and

(M) Any additional information relevant to the incident.

(d) Incident Response Requirements

(1) All determinations by the judiciary related to incidents, including response activities, will be made in writing by the contracting officer.

(2) The contractor shall provide full access and cooperation for all activities determined by the government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the government may include, but are not limited to, the following:

(A) Inspections;

(B) Investigations;

(C) Forensic reviews;

(D) Data analyses and processing; and

(E) Revocation of the Authority to Operate (ATO), if applicable.

(4) The contractor shall immediately preserve and protect images of known affected information systems and all available monitoring or packet capture data. The monitoring or packet capture data shall be retained for at least 180 days from submission of the incident report to allow the judiciary to request the media or decline in-terest.

(5) The judiciary, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information

USCA25R0108 /0002 - Page 14 of 34

Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the contractor shall return all Sensitive Information to the judiciary and/or destroy it physically and/or logically as identified in the contract, unless the contract states that return and/or destruction of Sensitive In-formation is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The contractor shall submit the certification to the COR and contracting officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements Incident reporting required by this clause does not rescind the contractor's responsibility for other incident re-porting pertaining to its information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other government requirements.

(g) PII and SPII Incident Notification Requirements

(1) All determinations by the judiciary related to notifications to affected individuals and/or federal agencies and related services (e.g., credit monitoring) will be made in writing by the contracting officer.

(2) No later than five business days after being directed by the contracting officer, or as otherwise required by applicable law, the contractor shall notify any individual whose PII or SPII was either under the control of the contractor or resided in an information system under control of the contractor at the time the incident oc-curred. The method and content of any notification by the contractor shall be coordinated with, and subject to prior written approval by, the contracting officer. The contractor shall not proceed with notification unless dir-ected in writing by the contracting officer.

(3) Subject to government analysis of the incident and direction to the contractor regarding any resulting no-tification, the notification method may consist of letters to affected individuals sent by first-class mail, electron-ic means, or general public notice, as approved by the contracting officer. Notification may require the con-tractor's use of address verification and/or address location services. At a minimum, the notification shall in-clude:

(A) A brief description of the incident;

(B) A description of the types of PII or SPII involved;

(C) A statement as to whether the PII or SPII was encrypted or protected by other means;

(D) Steps individuals may take to protect themselves;

(E) What the contractor and/or the government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and

(F) Information identifying who individuals may contact for additional information.

(h) Credit Monitoring Requirements The contracting officer may direct the contractor to:

(1) Provide notification to affected individuals, as described in paragraph (g)(2).

(2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the contract-or or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the contractor has no affiliation. At a minimum, credit monitoring ser-vices shall include:

(A) Triple credit bureau monitoring;

(B) Daily customer service;

(C) Alerts provided to the individual for changes and fraud; and

(D) Assistance to the individual with enrollment in the services and the use of fraud alerts.

(3) Establish a dedicated call center. Call center services shall include:

(A) A dedicated telephone number to contact customer service within a fixed period;

(B) Information necessary for enrollees to access credit reports and credit scores;

(C) Escalation of calls that cannot be handled by call center staff, to call center management or AOUSC, as appropriate;

(D) Weekly reports on call center volume, issue escalation, and other key metrics;

(E) Customized frequently asked questions, approved in writing by the contracting officer in coordination with the Judiciary Breach Response Team (BRT); and

(F) Information for enrollees to contact customer service and fraud resolution representatives for credit mon-

USCA25R0108 /0002 - Page 15 of 34 itoring assistance.

(i) Subcontracts

(1) The contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will:

(A) have access to Sensitive Information;

(B) have access to or handle systems containing Sensitive Information;

(C) collect or maintain Sensitive Information on behalf of the Judiciary; or

(D) use a subcontractor information system(s) to process, store, or transmit Sensitive Information.

(2) Any violation by a subcontractor of any of the provisions established in this clause will be attributed to the contractor.

(3) Any breach or incident, as defined in paragraph (a) Definitions of this clause, experienced by a subcon-tractor will be attributed to the contractor for the purpose of triggering contractor compliance with the require-ments in paragraphs (c) Incident Reporting Requirements, (d) Incident…