General Services Administration

Blanket Purchase Agreement for

Credit Monitoring Services

**Experian Consumer Direct**

BPA #: GS-23F-A0015

MAS Contract #: GS-23F-0356P

Date of Award: 14-Aug-06

Size: Large Business

Address: 18500 Von Karman Avenue Suite 900

> Irvine, CA 92612

Primary POC: Timothy R. Olson

> Vice President, Data Breach Rapid Response
>
> 480.962.5300 (office)
>
> 480.962.5307 (fax)
>
> 480.330.1836 (cell)
>
> tim.olson@consumerinfo.com

Alternative POC:

Ozzie Fonseca Chris Eslinger

Director, Data Breach Rapid Response Manager, Data Breach Rapid Response

949.567.3851 (office) 959.567.7690 (office)

949.222.0582 (fax) 949.222.0582 (fax)

949.302.2299 (cell) 714.343.2365 (cell)

ozzie.fonseca@consumerinfo.com chris.eslinger@consumerinfo.com

Ngia Vang

Operations Coordinator

949.567.7662 (office)

949.222.0582 (fax)

714.858.3377 (cell)

ngia.vang@consumerinfo.com

Period of Performance: August 14, 2007- August 13, 2008

**BPA.2.1 Background**

In the past 15 months, corporations, universities, and other
organizations alerted more than 85 million Americans that their personal
or financial data may have been exposed through electronic breaches,
disgruntled employees or other factors. While data leaks do not
automatically result in financial losses or identity theft, experts say
that the chances of becoming a victim depend on how well the individual
knows the rights and how quickly he or she spring into action.

Government files include public record information, social security
numbers, and accounts receivable data from national, regional and local
credit grantors. This information is compiled into credit reports giving
an individual's history of payments on financial obligations. Government
agencies require speedy responses in cases when a data breach or loss
involves a Constituent\'s or personnel's Social Security number, which
thieves can use to open new lines of credit in the name of the victim.

**BPA.2.2 Objective**

The overall objective of the BPAs is to give the Government a fast and
effective way to order commercially available credit monitoring
services, in order to protect the confidentiality of personal credit and
payment information. In this process, the Government is looking for
commercial--of-the-shelf packages, significantly reduced pricing, strong
oversight and reporting, and excellent customer service.

**BPA 2.3 General Description**

For purposes of this BPA, schedule contractors are asked to quote
commercial--of-the-shelf packages for credit monitoring services. The
commercial--of-the-shelf packages of credit monitoring services shall
include basic to comprehensive coverage. Based on the degree of
vulnerability, risk, and protection, agencies will select amongst the
appropriate levels of credit monitoring services.

**BPA 2.4 Scope**

The scope is bound by the FABS Schedule, specifically Special Item
Number (SIN) SIN 520 16 Business Information Services---to obtain
electronic and non-electronic transmission (excluding voice
communication) of credit reports, supplemental credit reference reports,
credit scoring, merged credit files, credit risk assessment and
miscellaneous business information (BIS) services.

The Government is seeking a vendor or vendors to quote and provide
commercially available credit monitoring services. Key features of
commercially available credit monitoring services are:

-   Monitoring all three national credit bureau reports

-   Monitoring a single national credit bureau report

-   Fraud Alerts

-   Monitoring of credit information in order to detect early signs of
    fraudulent activity and identity theft

-   Granting copies of credit reports to employee or constituent

-   Customer care

-   Identity theft insurance

-   Fraud resolution and assistance for constituents

Contractors must be able to provide all services within the MAS program.

**BPA.3 TASKS**

**BPA.3.1 Task Order Types**

Contractors shall perform the services ordered on individual task
orders. Task orders may require the individuals to sign up for credit
monitoring services and may establish additional privacy and reporting
requirements.

Each task order will specify one or more of the credit monitoring
packages covered by this BPA. All task orders will be on Firm-Fixed
Price (FFP) basis, within the confines of the pricing established under
the BPA.

**BPA.4 ORDERING PROCEDURES**

In accordance with Federal Acquisition Regulation (FAR) 8.405-3 GSA, in
partnership with any ordering agency, will establish multiple BPAs with
Federal Supply Schedule (FSS) contract holders.

(a) *General.* Any ordering agency shall use the procedures in this
    subsection when ordering services priced at hourly rates as
    established by the FABS Schedule contracts. The applicable services
    shall be Special Item Numbers (SIN) 520 16 Business Information
    Services.

(b) *Statement of Work (SOW)*. Any ordering agency shall prepare SOWs
    that include, at a minimum, work to be performed, location of work,
    period of performance, deliverable schedule, applicable performance
    standards, and any special requirements.

(c) *Request for Quotation (RFQ) procedures*. Any ordering agency shall
    provide the RFQ to include at a minimum the SOW and evaluation
    criteria.

```{=html}
<!-- -->
```
1)  *Orders at or below the micro purchase threshold*. Any ordering
    agency may place orders at or below the micro-purchase threshold
    with any BPA-holder. Any ordering agency should attempt to
    distribute orders at or below the micro-purchase threshold among all
    BPA holders.

2)  *Orders exceeding the micro-purchase threshold*.

    i.  Any ordering agency shall develop an SOW in accordance with the
        instructions stated in paragraph (b) above.

    ii. Any ordering agency shall provide the RFQ (including SOW and
        evaluation criteria) to at least three BPA-holders.

    iii. Any ordering agency shall request that BPA-holders submit
         firm-fixed prices to perform services identified in the SOW.
         This does not preclude the use of Labor Hour or Time and
         Material (T&M) task orders.

3)  For proposed task orders exceeding the maximum order threshold

> Any ordering agency shall:

(i) Provide the RFQ (including SOW and evaluation criteria) to
    additional BPA-holders. When determining the appropriate number of
    BPA-holders, Any ordering agency may consider, among other factors,
    the following:

    A.  The complexity, scope and estimated value of the requirement.

    B.  The market search results.

```{=html}
<!-- -->
```
(ii) Seek price reductions.

```{=html}
<!-- -->
```
4)  Any ordering agency shall provide the RFQ (including the SOW and
    evaluation criteria) to any BPA-holder that requests a copy of it.

```{=html}
<!-- -->
```
(d) *Evaluation.* Any ordering agency shall evaluate all responses
    received using the evaluation criteria provided to the BPA-holders.
    Any ordering agency is responsible for considering the level of
    effort and the mix of labor proposed to perform specific tasks being
    ordered, and for determining that the total price is reasonable.
    Place the task order with the BPA-holder that represents the best
    value (see FAR 8.404 (d)). After award any ordering agency shall
    provide timely notification to unsuccessful BPA-holders. If an
    unsuccessful BPA-holder requests information on an award that was
    based on factors other than price alone, a brief explanation of the
    basis for the award decision shall be provided.

\(e\) *Minimum documentation*. Any ordering agency shall document:

1.  The BPA-holders considered, noting the BPA-holder from which the
    service was purchased;

2.  A description of the service purchased;

3.  The amount paid;

4.  The evaluation methodology used in selecting the BPA-holder to
    receive the task order;

5.  The rationale for any tradeoffs in making the selection;

6.  The price reasonableness determination required by paragraph (d) of
    this subsection; and

7.  The rationale for using other than---

    i.  A firm-fixed price task order; or

    ii. A performance-based task order.

**[Limited Sources Justification and Approval]{.underline}**

\(a\) Orders placed under Federal Supply Schedules are exempt from the
requirements in Part 6. However, an ordering activity must justify its
action when restricting consideration---

\(1\) Of schedule contractors to fewer than required in 8.405-1 or
8.405-2; or

\(2\) To an item peculiar to one manufacturer (*e.g.*, a particular
brand name, product, or a feature of a product, peculiar to one
manufacturer). A brand name item, whether available on one or more
schedule contracts, is an item peculiar to one manufacturer. Brand name
specifications shall not be used unless the particular brand name,
product, or feature is essential to the Government's requirements, and
market research indicates other companies' similar products, or products
lacking the particular feature, do not meet, or cannot be modified to
meet, the agency's needs.

\(b\) Circumstances that may justify restriction cited in paragraph
(a)(1) of this subsection include---

\(1\) Only one source is capable of responding due to the unique or
specialized nature of the work;

\(2\) The new work is a logical follow-on to an original Federal Supply
Schedule order provided that the original order was placed in accordance
with the applicable Federal Supply Schedule ordering procedures. The
original order must not have been previously issued under sole source or
limited source procedures;

\(3\) An urgent and compelling need exists, and following the ordering
procedures would result in unacceptable delays.

\(c\) Ordering activities shall procure such requirements only if the
need to do so is justified in writing and approved at the levels
specified in paragraphs (f) and (h) of this subsection.

\(d\) Except as provided in paragraph (e) of this subsection, when an
order contains brand name specifications, the ordering activity shall
post the following information along with the Request for Quotation
(RFQ) to e-Buy (*http://www.ebuy.gsa.gov*):

\(1\) For proposed orders exceeding \$25,000, but not exceeding the
simplified acquisition threshold, the documentation required by
paragraph (f) of this subsection.

\(2\) For proposed orders exceeding the simplified acquisition
threshold, the justification required by paragraph (g) of this
subsection.

\(e\) The posting requirement of paragraph (d) of this subsection does
not apply when---

\(1\) Disclosure would compromise the national security (*e.g.*, would
result in disclosure of classified information) or create other security
risks. The fact that access to classified matter may be necessary to
submit a proposal or perform the contract does not, in itself, justify
use of this exception;

\(2\) The nature of the file (*e.g.*, size, format) does not make it
cost-effective or practicable for contracting officers to provide access
through e-Buy; or

\(3\) The agency's senior procurement executive makes a written
determination that access through e-Buy is not in the Government's
interest.

\(f\) *Orders exceeding the micro-purchase threshold, but not exceeding
the simplified acquisition threshold as defined in 2.101*. For proposed
orders exceeding the micro-purchase threshold, but not exceeding the
simplified acquisition threshold, the ordering activity contracting
officer shall document the circumstances when restricting consideration.

\(g\) Orders exceeding the simplified acquisition threshold.

\(1\) For proposed orders exceeding the simplified acquisition
threshold, the requiring activity shall assist the ordering activity
contracting officer in the preparation of the justification. The
justification shall cite that the acquisition is conducted under the
authority of the Multiple Award Schedule Program (see 8.401).

\(2\) As a minimum, each justification shall include the following
information:

\(i\) Identification of the agency and the contracting activity, and
specific identification of the document as a "Limited Source
Justification."

\(ii\) Nature and/or description of the action being approved.

\(iii\) A description of the supplies or services required to meet the
agency's needs (including the estimated value).

\(iv\) Identification of the justification rationale (see 8.405-6(a) and
(b)) and, if applicable, a demonstration of the proposed contractor's
unique qualifications to provide the required supply or service.

\(v\) A determination by the ordering activity contracting officer that
the order represents the best value consistent with 8.404(d).

\(vi\) A description of the market research conducted among schedule
holders and the results or a statement of the reason market research was
not conducted.

\(vii\) Any other facts supporting the justification.

\(viii\) A statement of the actions, if any, the agency may take to
remove or overcome any barriers that led to the restricted consideration
before any subsequent acquisition for the supplies or services is made.

\(ix\) The ordering activity contracting officer's certification that
the justification is accurate and complete to the best of the
contracting officer's knowledge and belief.

\(x\) Evidence that any supporting data that is the responsibility of
technical or requirements personnel (*e.g.*, verifying the Government's
minimum needs or requirements or other rationale for limited sources)
and which form a basis for the justification have been certified as
complete and accurate by the technical or requirements personnel.

\(h\) Justification approvals.

\(1\) For proposed orders exceeding the simplified acquisition
threshold, but not exceeding \$550,000, the ordering activity
contracting officer's certification that the justification is accurate
and complete to the best of the ordering activity contracting officer's
knowledge and belief will serve as approval, unless a higher approval
level is established in accordance with agency procedures.

\(2\) For a proposed order exceeding \$550,000, but not exceeding \$11.5
million, the justification must be approved by the competition advocate
of the activity placing the order, or by an official named in paragraph
(h)(3) or (h)(4) of this subsection. This authority is not delegable.

\(3\) For a proposed order exceeding \$11.5 million, but not exceeding
\$57 million (or, for DoD, NASA, and the Coast Guard, not exceeding
\$78.5 million), the justification must be approved by---

\(i\) The head of the procuring activity placing the order;

\(ii\) A designee who---

\(A\) If a member of the armed forces, is a general or flag officer;

\(B\) If a civilian, is serving in a position in a grade above GS-15
under the General Schedule (or in a comparable or higher position under
another schedule); or

\(iii\) An official named in paragraph (h)(4) of this subsection.

\(4\) For a proposed order exceeding \$57 million (or, for DoD, NASA,
and the Coast Guard, over \$78.5 million), the justification must be
approved by the senior procurement executive of the agency placing the
order. This authority is not delegable, except in the case of the Under
Secretary of Defense for Acquisition, Technology, and Logistics, acting
as the senior procurement executive for the Department of Defense.

**BPA.5 POST AWARD CONSIDERATIONS**

**BPA.5.1 Funding**

BPAs do not obligate funds. The Government is obligated only to the
extent of authorized orders made under the BPA. There is no limit on the
dollar value of task order purchases made under the BPA. The maximum
order limitation in the GSA FABS Schedule is for discount purposes and
does not limit the dollar value of an order.

**BPA.5.2 Period of Performance**

BPAs generally should not exceed five years in length, but may do so to
meet program requirements. Contractors may be awarded BPAs that extend
beyond the current term of their GSA Schedule contract, so long as there
are option periods in their GSA Schedule contract that, if exercised,
will cover the BPA's period of performance.

Review of BPAs:

\(1\) The ordering activity that established the BPA shall review it at
least once a year to determine whether---

\(i\) The schedule contract, upon which the BPA was established, is
still in effect;

\(ii\) The BPA still represents the best value (see FAR Subpart
8.404(d)); and

\(iii\) Estimated quantities/amounts have been exceeded and additional
price reductions can be obtained.

\(2\) The ordering activity shall document the results of its review.

**BPA.5.3 Task Orders**

The Contractor shall furnish all services in accordance with the
specific requirements outlined in the Task Order issued by the
individual ordering agency.

**BPA.5.4 Orientation Briefing**

Within two (2) weeks of award, the contractor shall conduct an
orientation briefing for the Government. The Government does not want an
elaborate orientation briefing nor does it expect the contractor to
expend significant resources in preparation for this briefing. The
intent of the briefing is to initiate the communication process between
the Government and contractor by introducing key task participants and
explaining their roles, reviewing communication ground rules, and
assuring a common understanding of BPA objectives.

The Orientation Briefing will be held at the Government's facility and
the date and time will be mutually agreed upon by both parties.

The completion of this briefing will result in the following:

a)  Introduction of both contractor and Government personnel.

b)  The contractor will demonstrate confirmation of their understanding
    of the work to be accomplished under this SOW.

    **BPA.5.5 Security**

Homeland Security Presidential Directive (HSPD-12) mandates the issuance
of a common form of identification for all federal employees and
contractors for use in accessing government-controlled facilities and
information systems. **HSPD-12, *Policy for a Common Identification
Standard for Federal Employees and Contractors*,** was signed by
President Bush on August 27, 2004. HSPD-12 mandates the issuance of a
common form of identification for all federal employees and contractors
for use in accessing government-controlled facilities and information
systems. Personal Identity Verification (PIV) standards were published
on February 25, 2005 in response to HSPD-12. To be compliant with this
Directive, new PIV processes for issuing identification cards to new
employees and contractors will be implemented effective October 27,
2006.

**BPA.5.6 Government Furnished Equipment and Information**

The Government may provide the contractor with some of the necessary
equipment and information to perform the credit monitoring services
outlined. The contractor shall at all times protect and preserve from
loss, damage or harm, all materials, information and data, supplies and
equipment of every description, including that which may be Government
furnished or Government owned.

**BPA.5.7 Deliverables**

All deliverables must meet professional standards and meet the
requirements set forth in subsequent RFQs. Contractors will be
responsible for delivering all end items specified. Monthly status
reports will be delivered to the GSA BPA Contracting Officer by the 10th
day of the subsequent month. The Contractor will provide progress
reports or ad hoc reports as requested.

On a monthly basis, the vendor shall provide to the GSA Contracting
Officer the following:

By ordering agency and task order:

-   Number of individuals notified

-   Number of individuals enrolled at the end of each month during the
    enrollment period

-   Number of enrolled individuals who requested Fraud Resolution
    Services.

-   Prices for each level of service.

Other reports may be required by the Government at cost to be
determined.

**BPA.5.8 Post Award Evaluation of Contractor Performance at the Task
Order Level**

Interim and final evaluations of contractor performance will be prepared
in accordance with FAR Subpart 42.1500. Final performance evaluations
will be prepared by COTRs, at the time of completion of work. In
addition to the final evaluation, interim evaluations may be prepared,
by COTRs, annually to coincide with the anniversary date of
requirements.

Interim and final evaluations will be provided to the contractor as soon
as practicable after completion of the evaluation. The contractor will
be permitted thirty (30) calendar days to review the document and to
submit additional information or a rebutting statement. Any disagreement
between the parties regarding an evaluation will be referred to an
individual one level above the Contracting Officer, whose decision will
be final.

Copies of evaluations, contractor responses, and review comments, if
any, will be retained as part of the contract file, and may be used to
support future award decisions.

**BPA.5.9 Administrative Considerations**

All questions concerning BPAs will be directed to the GSA Contracting
Officers (contact information identified in section RFQ.5). [The GSA
Contracting Officer and the Alternate Contracting Officer are the only
individuals with the authority to amend BPAs]{.underline}.

**BPA.5.10 Correspondence**

To promote timely and effective administration, correspondence shall be
subject to the following procedures:

All correspondence, including invoices (that proposes or otherwise
involves waivers, deviations or modifications to requirements) shall be
addressed to the Contracting Officer issuing the requirement with an
information copy to the COTR.

**BPA.5.11 Contracting Officer's Technical Representative (COTR)**

The COTR is the individual within a program management function who has
overall technical responsibility for efforts. The COTR supports the CO
during administration of this effort by:

1)  Making final decisions regarding any recommended rejection of
    deliverables;

2)  Providing technical clarification relative to overall workload
    matters;

3)  Providing advice and guidance to the contractor in the preparation
    of deliverables and services;

4)  Providing acceptance of deliverable products to assure compliance
    with requirements.

The COTR also provides technical direction to the contractor, i.e.,
shifting work emphasis between areas of work; fills in details, or
otherwise serves to accomplish tasks. Technical direction shall be
within the general statements of work. COTRs do NOT have the authority
to and may NOT issue any technical direction which:

1)  Constitutes an assignment of work outside the general scope of
    efforts;

2)  Constitutes change as defined in the "Changes" clause;

3)  In any way causes an increase or decrease in cost or the time
    required for performance;

4)  Changes any of the terms, conditions, or other requirements; and

5)  Suspends or terminates any portion of efforts.

All technical direction that affects the scope of tasks shall be issued
in writing by the COTR or will be confirmed by the COTR. A copy of the
written direction shall be furnished to the CO.

In addition to providing technical direction, the COTR will:

1)  Monitor contractor's technical progress, including surveillance and
    assessment of performance, and recommend to the CO and CA, any
    changes in requirements;

2)  Assist contractors in the resolution of technical problems
    encountered during performance; and

3)  Perform inspections and acceptance or recommendations for rejection
    of contractor deliverables and identify deficiencies in delivered
    items. This does not replace any other quality assurance inspection
    requirements that may be specified.

If in the opinion of the contractor, any instruction or direction issued
by a COTR is outside of their specific authority, the contractor shall
not proceed but shall notify the CO in writing within five (5) working
days after receipt of any instruction or direction.

**BPA.5.12 Special Instructions**

Section 508 Compliance Specification. (1) Section 508 of the
Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies
acquiring Electronic and Information Technology (EIT) to ensure that
Federal employees with disabilities have access to and use of
information and data that is comparable to the access and use by Federal
employees who are not individuals with disabilities.

\(2\) All EIT procured for under the resulting BPAs must meet the
following 36 CFR 1194 accessibility standards. The full text of the
accessibility standards is available at:
<http://www.access-board.gov/sec508/508standards.htm>.

\_\_\_1194.21 - Software Applications and Operating Systems\
\_\_\_1194.22 - Web Based Intranet and Internet Information and
Applications\
\_\_\_1194.23 - Telecommunications Products\
\_\_\_1194.24 - Video and Multimedia Products\
\_\_\_1194.25 - Self-contained, Closed Products\
\_\_\_1194.26 - Desktop and Portable Computers\
\_\_\_1194.31 - Functional Performance Criteria

\(3\) The standards do not require the installation of specific
accessibility-related software or the attachment of an assistive
technology devise(s), but merely require that the EIT be compatible with
such software and device(s) so that it can be made accessible if so
required in the future.

**BPA.5.13 Privacy Act**

Anticipated work under the resulting BPAs may require that contractor
personnel have access to Privacy Information. Contractor personnel shall
adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and
applicable agency rules and regulations.

**BPA.5.14 Most Favored Customer Pricing**

The prices under this Agreement shall be at least as low as the prices
under any other contract instrument under like terms and conditions. If
at any time the prices under any other contract instrument become lower
than the prices in this Agreement, this Agreement shall be modified to
include the lower prices.

**BPA.5.15 Clauses**

In addition to the terms and conditions and pricing established in the
resulting BPA, all terms and conditions of the awarded FABS
Contract---see ATTACHMENT 3\--shall apply to this BPA and task orders
issued against the BPA by ordering agencies. The terms and conditions of
the Contractor's FABS Schedule Contract shall prevail over the BPA and
task order.

The Fair Credit Reporting Act (FCRA) is hereby incorporated by
reference. Also, the following clauses shall be incorporated in
full-text:

**52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL
(JAN 2006)**

\(a\) The Contractor shall comply with agency personal identity
verification procedures identified in the contract that implement
Homeland Security Presidential Directive-12 (HSPD-12), Office of
Management and Budget (OMB) guidance M-05-24, and Federal Information
Processing Standards Publication (FIPS PUB) Number 201.

\(b\) The Contractor shall insert this clause in all subcontracts when
the subcontractor is required to have physical access to a
federally-controlled facility or access to a Federal information system.

#### 52.224-1 PRIVACY ACT NOTIFICATION (APR 1984) 

The Contractor will be required to design, develop, or operate a system
of records on individuals, to accomplish an agency function subject to
the Privacy Act of 1974, Public Law 93‑579, December 31, 1974 (5 U.S.C.
552a) and applicable agency regulations. Violation of the Act may
involve the imposition of criminal penalties.

#### 52.224-2 PRIVACY ACT (APR 1984) 

\(a\) The Contractor agrees to---

\(1\) Comply with the Privacy Act of 1974 (the Act) and the agency rules
and regulations issued under the Act in the design, development, or
operation of any system of records on individuals to accomplish an
agency function when the contract specifically identifies---

\(i\) The systems of records; and

\(ii\) The design, development, or operation work that the Contractor is
to perform;

\(2\) Include the Privacy Act notification contained in this contract in
every solicitation and resulting subcontract and in every subcontract
awarded without a solicitation, when the work statement in the proposed
subcontract requires the redesign, development, or operation of a system
of records on individuals that is subject to the Act; and

\(3\) Include this clause, including this subparagraph (3), in all
subcontracts awarded under this contract which requires the design,
development, or operation of such a system of records.

\(b\) In the event of violations of the Act, a civil action may be
brought against the agency involved when the violation concerns the
design, development, or operation of a system of records on individuals
to accomplish an agency function, and criminal penalties may be imposed
upon the officers or employees of the agency when the violation concerns
the operation of a system of records on individuals to accomplish an
agency function. For purposes of the Act, when the contract is for the
operation of a system of records on individuals to accomplish an agency
function, the Contractor is considered to be an employee of the agency.

\(c\) (1) \"*Operation of a system of records*,\" as used in this
clause, means performance of any of the activities associated with
maintaining the system of records, including the collection, use, and
dissemination of records.

\(2\) \"*Record*,\" as used in this clause, means any item, collection,
or grouping of information about an individual that is maintained by an
agency, including, but not limited to, education, financial
transactions, medical history, and criminal or employment history and
that contains the person\'s name, or the identifying number, symbol, or
other identifying particular assigned to the individual, such as a
fingerprint or voiceprint or a photograph.

\(3\) \"*System of records on individuals*,\" as used in this clause,
means a group of any records under the control of any agency from which
information is retrieved by the name of the individual or by some
identifying number, symbol, or other identifying particular assigned to
the individual.

#### 52.239-1 PRIVACY OR SECURITY SAFEGUARDS (AUG 1996) 

\(a\) The Contractor shall not publish or disclose in any manner,
without the Contracting Officer\'s written consent, the details of any
safeguards either designed or developed by the Contractor under this
contract or otherwise provided by the Government.

\(b\) To the extent required to carry out a program of inspection to
safeguard against threats and hazards to the security, integrity, and
confidentiality of Government data, the Contractor shall afford the
Government access to the Contractor\'s facilities, installations,
technical capabilities, operations, documentation, records, and
databases.

\(c\) If new or unanticipated threats or hazards are discovered by
either the Government or the Contractor, or if existing safeguards have
ceased to function, the discoverer shall immediately bring the situation
to the attention of the other party.

**BPA.6. OTHER PERFORMANCE REQUIREMENTS**

**BPA.6. 1 Professional Conduct-Confidential Treatment of Sensitive
Information**

Contractors shall guarantee strict confidentiality of the
information/data that is provided by the Government during the
performance of the contract. The Government has determined that the
information/data that the contractor will be provided during the
performance of this effort is of a sensitive nature and cannot be
disclosed in any manner.

The contractor, in whole or in part, can only make disclosure of the
information/data, after the contractor receives prior written approval
from the CO. Whenever the contractor is uncertain with regard to the
proper handling of information/data under this effort, the contractor
shall obtain a written determination from the CO.

Contractor personnel assigned to the performance work must be acceptable
to the Government in terms of personal and professional conduct. If at
any time during performance of this contract, contractor personnel are
deemed a security risk, the contractor Project Manager will be
responsible for immediate removal from this contract and replaced with
acceptable personnel. Upon removal or completion, contractor personnel
shall immediately return any facility access materials/passes to the
COTR.

**BPA.6. 2 Disclosure of Information**

Information made available to the contractor by the Government for the
performance or administration of this effort shall be used only for
those purposes and shall not be used in any other way without the
written agreement of the CO.

The contractor agrees to assume responsibility for protecting the
confidentiality of Government records, which are not public information.
Each contractor or employee of the contractor to whom information may be
made available or disclosed shall be notified in writing by the
contractor that such information may be disclosed only for a purpose and
to the extent authorized herein.

If the constituent or Government personnel is at risk from fraudulent
actions, the Government does not get access to the constituent's or
Government personnel's personal information. Any request for
Inter-agency sharing of information about individuals shall comply with
Office of Management and Budget Memorandum M-01-05,
<http://www.whitehouse.gov/omb/memoranda/m01-05.html> (Attachment 1).

The contractor shall keep the information confidential, use appropriate
safeguards to maintain its security in accordance with minimum Federal
standards. The contractor must also explain and certify that its
subcontractor(s) will adhere to the same minimum Federal standards when
working with sensitive data.

Additionally, the contractor shall not use the information for any
purpose other than contacting the affected individual. Any type of
marketing, up-selling, after marketing, or soliciting of any individuals
shall not be prohibited.

**BPA.6. 3 Standards of Conduct**

\(a\) The contractor will be responsible for maintaining satisfactory
standards of employee competency, conduct, appearance, and integrity.
The contractor is also responsible for ensuring that its employees and
those of its subcontractor(s) do not disturb papers on desks, open desk
drawers or cabinets, use Government telephones, except as authorized, or
otherwise jeopardize the security and the privacy of Government
employees, its clientele, and the contents and property of the federal
building(s) in which task order work may be performed. Each employee or
supervisor of the contractor is expected to adhere to standards of
behavior that reflect credit on themselves, their employer, and the
Federal Government.

\(b\) The contractor will be responsible for taking such disciplinary
action, including suspension without pay or removal from the worksite,
with respect to its employees, as may be necessary to enforce those
standards.

\(c\) Where applicable, the standards of conduct requirements must be
expressly incorporated into subcontract(s) and must be applicable to all
subcontractor employees who may perform recurring services or work at
the federal building and grounds

.

\(d\) The Government retains the right to permanently remove any
employee of the contractor from performing duties assigned at the
federal building should the employee\'s performance so warrant. The
Government will request the contractor to immediately remove any
employee of the from the federal building/work-site should it be
determined by the Contracting Officer that the individual employee of
the contractor is \"unsuitable\" for security reasons or for otherwise
being found to be unfit for performing his assigned duty at a federal
building. The following areas (not all-inclusive) are considered
justification for requesting the contractor to immediately remove an
employee from a federal building/work site:

\(i\) Neglect of assigned duty and refusing to render assistance or
cooperate in upholding the integrity of the security programs at the
worksite;

\(ii\) Falsification or unlawful concealment, removal, mutilation, or
destruction of any official documents or records, or concealment of
material facts by willful omissions from official documents or records;

\(iii\) Disorderly conduct, use of abusive or offensive language,
quarreling, intimidation by words or actions, or fighting; participation
in disruptive activities which interfere with the normal and efficient
operations of the Government;

\(iv\) Theft, vandalism, immoral conduct, or any other criminal actions;

\(v\) Selling, consuming, or being under the influence of intoxicants,
drugs, or controlled substances which produce similar effects;

\(vi\) Improper use of official authority or credentials, as a
supervisor or employee of the Contractor;

\(vii\) Violation of agency and Contractor security procedures and
regulations; and

\(viii\) Violation of the rules and regulations governing federal public
buildings and grounds, set forth in 41 CFR Subpart 101-20.3 *Conduct on
Federal Property*.

\(e\) Following a recommendation from an agency program official or
security officer, the Contracting Officer will make all determinations
regarding the removal of any employee of the contractor from and
denial/termination of clearance and access to the federal building
worksite for non-performance, misconduct, or failure to abide by all
laws and regulations. The Contracting Officer will verbally inform the
contractor about the employee, followed by a written confirmation or
determination. Specific reasons for the removal of an employee will be
provided to the contractor in writing. In the event of a dispute, the
Contracting Officer will make a final determination.

\(f\) Upon a determination of the Government that an employee of the
contractor be removed from or denied access to a federal building
worksite, the employee\'s clearance and access to the federal building
must be immediately revoked or otherwise terminated. Furthermore, if
applicable, the building pass and/or other access device(s) previously
given to the employee must be immediately surrendered, returned, or
delivered to the security officer of the federal building.

**BPA.7 AUTHORIZED USER**

Each ordering agency will provide a list of individuals and offices
authorized to purchase under the BPA. The ordering agency's Point of
Contact will be specified on each order.

**BPA.8 GOVERNMENT POINTS OF CONTACT**

**BPA Contracting Officer**

Houston Taylor

U.S. General Services Administration

Crystal Plaza 4

2200 Crystal Drive, 7^th^ Floor

Arlington, VA 22202

E-mail: houston.taylor@gsa.gov

**BPA Alternate Contracting Officer**

Dennis Harrison

U.S. General Services Administration

Crystal Plaza 4

2200 Crystal Drive, 7^th^ Floor

Arlington, VA 22202

E-mail: dennis.harrison@gsa.gov

Experian Consumer Direct

***[Triple Alert^SM^ Monitoring]{.underline}*** -- (This product is
delivered to qualified\* Individuals using an online or offline
application process and a single-use, Access Code). Description of
Triple Alert benefits, which are subject to change:

a)  **Automatic daily monitoring of credit reports from all three
    national credit reporting companies: Experian, Equifax
    and TransUnion**

b)  **Email or US mail monitoring alerts to inform the Individual of key
    changes to their credit reports, including new inquiries, newly
    opened accounts, delinquencies, address changes and public record
    items**

c)  **Monthly "no hit" alerts, if there have been no important changes
    to the Individual's credit report**

d)  **Informative credit related articles**

e)  **Toll-free Customer Service**

f)  **Toll-free access to fraud resolution representatives and support
    should the Individual become a victim of Identity Theft after s/he
    enrolls in Triple Alert**

g)  **Assistance from fraud resolution representatives who will walk the
    Individual step-by-step through the process of resolving problems
    associated with credit fraud or Identity Theft and: (i) assist with
    understanding credit reports and alerts (ii) assist in contacting
    law enforcement officials, (iii) receive and make calls with the
    Individual, and (iv) contact financial institutions and creditors as
    required. All assistance is provided as appropriate on a case by
    case basis**

h)  **\$10,000 or \$25,000 identity theft insurance coverage provided by
    a designated third party insurer**

Pricing:

+-----------------------------------+----------------------------------+
| Number of Credit Monitoring       | **Triple Alert**                 |
| Enrollments                       |                                  |
|                                   | (Per Enrollment/Per Redemption)  |
+-----------------------------------+----------------------------------+
|                                   | Years 1-5                        |
+-----------------------------------+----------------------------------+
| 1-5,000                           | 11.95                            |
+-----------------------------------+----------------------------------+
| 5,001-10,000                      | 11.75                            |
+-----------------------------------+----------------------------------+
| 10,001-25,000                     | 11.45                            |
+-----------------------------------+----------------------------------+
| 25,001-50,000                     | 10.95                            |
+-----------------------------------+----------------------------------+
| 50,001-100,000                    | 10.45                            |
+-----------------------------------+----------------------------------+
| 100,001-250,000                   | 10.05                            |
+-----------------------------------+----------------------------------+

**"Per Redemption" \-- The fees are due [with]{.underline} regard to the
actual number of Access Codes redeemed by Individuals.**

***The amount of insurance coverage provided to individuals is subject
to change at any time and insurance will not be provided to any resident
of any state where prohibited by applicable law. Customer agencies shall
verify, at the task order level, the applicability of identity theft
insurance in accordance with existing state laws.***

[Triple Advantage^SM^ Monitoring (Premium]{.underline}) -- (This product
is delivered to qualified\* Individuals using an online or offline
application process and a single-use, Access Code). Description of
Triple Advantage benefits, which are subject to change:

a)  **Automatic daily monitoring of credit reports from all three
    national credit reporting companies: Experian, Equifax
    and TransUnion**

b)  **Email or US mail monitoring alerts to inform the Individual of key
    changes to their credit reports, including new inquiries, newly
    opened accounts, delinquencies, address changes and public record
    items**

c)  **Monthly "no hit" alerts, if there has been no important changes to
    the Individual's credit report**

d)  **Unlimited online and offline access to the Individual's Experian®
    Credit Report and Score for the duration of the membership**

e)  **Score Simulator - helps Individuals understand how factors on
    their credit report impact their credit score**

f)  **Consumer-friendly credit report with detailed explanations and
    descriptions**

g)  **Monthly Score Trending of the Individual's Experian score**

h)  **Informative credit related articles**

i)  **One free 3 bureau Credit Report and score upon enrollment**

j)  **Toll-free Customer Service**

k)  **Toll-free access to fraud resolution representatives and support
    should the Individual become a victim of Identity Theft after s/he
    enrolls in Triple Advantage**

l)  **Assistance from fraud resolution representatives who will walk the
    Individual step-by-step through the process of resolving problems
    associated with credit fraud or Identity Theft and: (i) assist with
    understanding credit reports and alerts (ii) assist in contacting
    law enforcement officials, (iii) receive and make calls with the
    Individual, and (iv) contact financial institutions and creditors as
    required. All assistance is provided as appropriate on a case by
    case basis**

m)  **\$10,000 or \$25,000 identity theft insurance coverage provided by
    a designated third party insurer**

Pricing:

+-----------------------------------+----------------------------------+
| Number of Credit Monitoring       | **Triple Advantage (Premium)**   |
| Enrollments                       |                                  |
|                                   | (Per Enrollment/Per Redemption)  |
+-----------------------------------+----------------------------------+
|                                   | Years 1-5                        |
+-----------------------------------+----------------------------------+
| 1-5,000                           | 31.95                            |
+-----------------------------------+----------------------------------+
| 5,001-10,000                      | 31.45                            |
+-----------------------------------+----------------------------------+
| 10,001-25,000                     | 30.95                            |
+-----------------------------------+----------------------------------+
| 25,001-50,000                     | 29.95                            |
+-----------------------------------+----------------------------------+
| 50,001-100,000                    | 28.95                            |
+-----------------------------------+----------------------------------+
| 100,001-250,000                   | 27.95                            |
+-----------------------------------+----------------------------------+

**"Per Redemption" \-- The fees are due [with]{.underline} regard to the
actual number of Access Codes redeemed by Individuals.**

***The amount of insurance coverage provided to individuals is subject
to change at any time and insurance will not be provided to any resident
of any state where prohibited by applicable law. Customer agencies shall
verify, at the task order level, the applicability of identity theft
insurance in accordance with existing state laws.***