ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

 3 72 

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

HUGHES HUBBARD & REED LLP

(A) (B) (C) (D) (E) (F)

TOFS-16-D-0002

 CPP-CDCI Transactions - Option Year 1, Fixed Unit

 Prices:

 Fixed Transaction Price: 

 Fixed Redemption/Repurchase Price: 

 Amount: $0.00(Option Line Item)

 01/14/2017

 Delivery: 01/14/2017

 Accounting Info:

 2017-61000001---XXXXXXXXXX-XXXXXXXXXXXX-XXXXXXX-XX

 XXXXXXX-XXXX-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXX-X

 XXXXXXXX

 Funded: $0.00

0003 Legal Support Services - Option Year 2, Fully 0.00

 Burdened Labor Rates:

 Partner: 

 Associate: 

 Paralegal: 

 CPP-CDCI Transactions - Option Year 2, Fixed Unit

 Prices:

 Fixed Transaction Price: 

 Fixed Redemption/Repurchase Price: 

 Amount: $0.00(Option Line Item)

 01/14/2018

 Delivery: 01/14/2018

 Accounting Info:

 2018-61000001---XXXXXXXXXX-XXXXXXXXXXXX-XXXXXXX-XX

 XXXXXXX-XXXX-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXX-X

 XXXXXXXX

 Funded: $0.00

0004 Legal Support Services - Option Year 3, Fully 0.00

 Burdened Labor Rates:

 Partner: 

 Associate: 

 Paralegal: 

 CPP-CDCI Transactions - Option Year 3 Fixed Unit

 Prices:

 Fixed Transaction Price: 

 Fixed Redemption/Repurchase Price: 

 Amount: $0.00(Option Line Item)

 01/14/2019

 Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110
ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

 4 72 

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

HUGHES HUBBARD & REED LLP

(A) (B) (C) (D) (E) (F)

TOFS-16-D-0002

 Delivery: 01/14/2019

 Accounting Info:

 -61000001---XXXXXXXXXX-XXXXXXXXXXXX-XXXXXXX-XXXXXX

 XXX-XXXX-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXX-XXXXX

 XXXX

 Funded: $0.00

0005 Legal Support Services - Option Year 4, Fully 0.00

 Burdened Labor Rates:

 Partner: 

 Associate: 

 Paralegal: 

 CPP-CDCI Transactions - Option Year 4, Fixed Unit

 Prices:

 Fixed Transaction Price: 

 Fixed Redemption/Repurchase Price: 

 Amount: $0.00(Option Line Item)

 01/14/2020

 Delivery: 01/14/2020

 Accounting Info:

 -61000001---XXXXXXXXXX-XXXXXXXXXXXX-XXXXXXX-XXXXXX

 XXX-XXXX-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXX-XXXXX

 XXXX

 Funded: $0.00

 The total amount of award: $0.00. The obligation

 for this award is shown in box 26.

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110
TOFS-16-D-0002

Page 5 of 72

Office of Financial Stability

Troubled Asset Relief Program

SECTION I: Legal Support Services Scope of Work

Background: 

The Emergency Economic Stabilization Act of 2008 (“EESA” or "the Act"), passed by Congress 

and signed by the President on October 3, 2008, was enacted to address a serious financial crisis 

in the United States. The Act provides authority to the Secretary of the Department of the 

Treasury (“Treasury”) to purchase and insure certain types of troubled assets to restore stability 

and liquidity to the financial system of the United States. The Act requires the Secretary to 

establish an Office of Financial Stability (“OFS”) in the Treasury to implement the Troubled 

Assets Relief Program (“TARP”) and other programs under the Act. 

The Treasury Office of the General Counsel (“OGC”) supports OFS in the design, 

implementation and management of programs. OGC provides legal advice to OFS in connection 

with the acquisition, management, insurance, litigation, and disposition of certain types of 

troubled assets to further the Act’s purpose of restoring stability and liquidity to the financial 

system. In addition to existing in-house expertise, OGC requires a broad range of legal services 

from outside counsel to support the activities of OFS and Treasury in support of these efforts.

Current programs for the Office of Financial Stability include the Capital Purchase Program 

(“CPP”), the Community Development Capital Initiative (“CDCI”), the Housing Finance 

Agency Innovation Fund for the Hardest Hit Housing Markets (“HHF”) and the Automotive 

Industry Financing Program (“AIFP”), the Making Home Affordable Program (“MHA”). 

Previous programs still requiring occasional legal support include the American International 

Group, Inc. (“AIG”) Investment Program, the Term Asset-Backed Securities Loan Facility 

(“TALF”) and the Public Private Investment Program (“PPIP”). Information on these programs 

is available on the Treasury web site at: 

http://www.treasury.gov/initiatives/financial-stability/TARP-Programs/Pages/default.aspx

Scope:

This requirement is for legal support for structuring, implementing, managing, litigating, and 

disposing of troubled assets under the Act, and for similar activities with respect to related, as 

well as any future, legislation may impact the TARP programs listed in the Background 

Section above.

Contract Hourly Labor Rates and Fixed Rates:

Fully burdened hourly labor rates and CPP-CDCI Transactions fixed rates are included on pages 

2-4 of this contract.
TOFS-16-D-0002

Page 6 of 72

Period of Performance:

The IDIQ period of performance includes a base year and four option years totaling a five year

potential period of performance. Task Orders will be issued as needed and will state a period of 

performance.

Consistent with FAR Part 16, the Contracting Officer will review the vendor’s performance and 

market pricing prior to the exercise of each option year to determine whether the contract still 

represents the best value.

Legal Services:

Proposed Task Order 0001: CPP & CDCI Restructuring and Board of Directors & Observers

Treasury requires the Contractor to provide expertise and guidance with respect to the 

restructuring or disposition of such investments (i) under circumstances in which third-party 

private equity investors or strategic buyers are concurrently negotiating an investment in the CPP 

or CDCI recipient or (ii) in order to attract third-party private equity investors or strategic buyers 

to invest in the CPP or CDCI recipient. Treasury also requires the Contractor to continue to 

provide services in connection with all aspects of the observation of, and the nomination and 

appointment of, persons to be members of the board of directors of institutions that have received 

EESA funds, including, (i) review, analysis and advice regarding Treasury's rights under various 

EESA contracts; (ii) review, analysis and advice regarding the exercise of those rights including, 

all actions, materials, documents required in connection with the observation of board of 

directors and the nomination and appointment of persons to become members of board of 

directors, (iii) review, analysis and advice regarding corporate, securities, regulatory and other 

bodies of law which govern the operation of board of directors, the duties of observers and 

members of board of directors and the rights and obligations of Treasury when exercising such 

rights; (iv) review, analysis, advise and the production of documents and other materials 

regarding each of the above; and (v) any other service necessary or attendant to providing 

review, analysis and advise in connection with the observation of, and the nomination and 

appointment of persons to be members of, the board of directors of such institutions. These 

institutions primarily include banks, bank holding companies, credit unions, mutual and Scorporations.

Proposed Task Order 0002: CPP and CDCI Transactions

Treasury requires the Contractor to continue to provide assistance with executing transactions 

under CPP and CDCI which include handling all or part of transactions and 

redemptions/repurchases between Treasury and certain financial institutions. The Contractor 

shall also be responsible for reviewing investment agreements provided for Treasury to invest 

funds in such financial institutions in exchange for the issuance of preferred stock and warrants 

to Treasury by publicly traded financial institutions. In addition, the Contractor may also be 
TOFS-16-D-0002

Page 7 of 72

responsible for handling transactions involving privately held financial institutions. The financial 

institutions are located in the U.S. and potentially in U.S. possessions and territories. The 

Contractor will also provide expertise and guidance with respect to the restructuring or 

disposition of such investments (i) under circumstances in which third-party private equity 

investors or strategic buyers are concurrently negotiating an investment in the CPP or CDCI 

recipient or (ii) in order to attract third-party private equity investors or strategic buyers to invest 

in the CPP or CDCI recipient. 

Ordering Procedures

Task Orders will be awarded based upon the technical and pricing proposal dated October 1, 

2015, submitted in response to the Request for Proposal (RFP). Labor rates and unit prices 

submitted with the proposal will be defined by the Treasury OFS, specific to the level of effort 

required for each task order.

Ceiling / Purchase Limitation

The cumulative value of all Orders under this contract shall not exceed $1,500,000.00. 

Task Orders will be funded for the specific work requirements described above. Task Orders will 

provide critical support and address mission needs for the Treasury, OFS and the IRS Office of 

Treasury Procurement Services. 

Places of Performance

Work will be performed primarily in the greater Washington, DC area at the contractor’s offices. 

As a general rule, local travel will not be reimbursed. Examples of local travel which will not be 

subject to reimbursement are: travel to and from normal job site; supervisory personnel traveling 

to a Government site or alternative facility to oversee operations. Personnel temporarily working 

at a Government site or alternative facility will consider such facility his/her normal job site.

Government-Furnished Property

There is no Government-furnished property or equipment.

Travel

If required in the Task Orders, actual costs for travel pre-approved by the COR will be 

reimbursed in accordance with the Federal Travel Regulations and FAR Subpart 31.205-46 

Travel Costs. Receipts or other appropriate documentation must accompany claims for 

reimbursement on travel expenses in excess of $75 in accordance with 41 CFR 301-52.15. Profit 

shall not be applied to travel costs. The total amount paid for travel on Task Orders shall not 

exceed the amount of the task order contract line item for Other Direct Costs.
TOFS-16-D-0002 

Page 8 of 72

Section 508 Compliance 

The contractor shall comply with information technology accessibility requirements mandated by 

Section 508 of the Rehabilitation Act. Reports and documents produced must be accessible to 

persons with disabilities. Reference relevant contract clauses for detailed requirements.

Authority of Personnel

The Contracting Officer, in accordance with Subpart 1.6 of the Federal Acquisition Regulation, 

is the only person authorized to make or approve any changes in any of the requirements of this 

IDIQ contract and corresponding Task Orders. In the event the Contractor makes any changes at 

the direction of any person other than the Contracting Officer, the change will be considered to 

have been made without authority and no adjustment will be made in the Task Order price to 

cover any increase in cost incurred as a result thereof. 

The authority of the COR is designated in DTAR Clause 1052.201-70 Contracting Officer's 

Representative (COR) Appointment and Authority. 

Key Personnel

is responsible for oversight of all work under the proposed Task 

Orders. regularly represents buyers, sellers and all varieties of corporate entities 

in acquisitions and dispositions of securities. 

, the Co-Chair of the firm’s M&A Group; , HHR’s Deputy 

Chair and the Co-Chair of the Corporate Department and M&A Group; , Chair of 

HHR’s Securities and Capital Markets Group; and Corporate Restructuring Group partner 

will provide assistance with the work under the proposed Task Orders. . 

will be assisted by fellow partners and for 

advice in respect of regulatory and tax matters. Other personnel identified in our Final Proposal 

Revision to Provide Omnibus Legal Services, Solicitation Number TOFS-09-S-0011, dated April 

30, 2010, are also available as needed.

Payment

Invoices for work performed on Orders must be submitted electronically through the Invoice 

Processing Platform (IPP). Reference relevant contract clauses for detailed requirements.

Each invoice submitted shall be supported by appropriate documentation. Documentation 

necessary to substantiate an invoice shall include, but is not limited to, project name and number, 

invoice number, period of performance, percentage of work complete, original contract amount, 

modification amounts, retainage amount and percent cumulative, labor categories, labor hours 

worked per labor category, labor rate, value of work in place, contractor's name, and contract 

number. 
TOFS-16-D-0002

Page 9 of 72

For task orders priced on a Time and Materials or Labor Hour basis, the Contractor will be 

reimbursed only for the types of disbursements, expenses and charges designated as 

reimbursable below. Moreover, any reimbursement will be limited to actual costs incurred by 

the Contractor that are necessary to effect the legal actions under this contract and that are not 

accounted for as overhead costs in the Contractor’s fixed labor rates. All invoices shall be fully 

documented by including receipts evidencing payment by the contractor and shall identify the 

action with which the expenditure is connected.

Treasury will reimburse:

• Court costs;

• Filing fees;

• Recording fees;

• To the extent authorized in writing in advance by the COR, charges associated with 

Certified, Express, and related mail costs customary to the nature of the action that are 

required for expedited processing or are required by law; 

• Non-local travel provided it is in accordance with Clause B.3 of the contract and the 

Federal Travel Regulations; 

• Long distance telephone charges and conference calls (for voice, fax or data);

• Photocopy, binding, and printing services;

• Outside messenger services; and

• Westlaw and Lexis charges that are customary to the nature of the action.

Treasury will not pay for markups or surcharges added by a law firm to the items listed 

above.

Treasury will not reimburse:

• Word processing charges;

• Overtime charges;

• Secretarial/clerical charges, except with regard to labor hour charges for hours performed 

under the Legal Assistant labor category in the contract;

• Fax communication charges (except long distance telephone charges);

• Local travel costs, including car service;

• Local telephone charges;

• Local meal costs;

• Entertainment expenses;

• Books or subscription charges;

• Membership fees;

• Costs of office supplies;

• Storage charges; or

• Costs associated with a lease or purchase of equipment or office space.
TOFS-16-D-0002

Page 10 of 72

Contract Type

Task Orders will be issued on a firm-fixed price, time and materials or labor hour basis. CPPCDCI Transactions are reimbursed on a fixed rate basis.

Contractor Security

On-site contractor personnel shall be subject to IRS and/or Treasury contractor security 

procedures depending on the place of performance. Reference relevant contract clauses for 

detailed requirements.

Holidays

The Department of the Treasury observes the following days as federal holidays. 

January 1 - New Year’s Day

January, Third Monday - Martin Luther King Day

February, Third Monday - Washington’s Birthday

May, Last Monday - Memorial Day

July 4 - Independence Day

September, First Monday - Labor Day

October, Second Monday - Columbus Day

November 11 - Veterans Day

November, Fourth Thursday - Thanksgiving Day

December 25 - Christmas Day

Holiday observances of such days by personnel shall not be cause for additional period of 

performance or entitlement to compensation except as set forth in the contract. If the Offeror's 

personnel should work on a holiday, no form of holiday or other premium compensation will be 

reimbursed either as a direct or indirect cost, unless authorized pursuant to an overtime clause 

elsewhere in the contract.

Public-release contract version requirement

This contract action utilizes TARP funds authorized by 110 P.L. 343. The program requires a 

high level of transparency and TARP contract documents are posted publicly at 

http://www.financialstability.gov or at another location designated by Treasury.

The Contractor agrees to submit to the CO and COR, within ten business (10) days from the date 

of award (exclusive of Saturdays, Sundays, and federal holidays), a .pdf file of the fully executed 

contract, blanket purchase agreement, or Order with all proposed necessary redactions, including 

redactions of any trade secrets or any commercial or financial information that it believes to be 

privileged or confidential business information, for the purpose of public disclosure at the sole 

discretion of the Treasury. The .pdf file must have searchable text and generally be compliant 

with the accessibility requirements in Section 508 of the Rehabilitation Act, 29 U.S.C. § 794(d). 

The Contractor agrees to provide a detailed written statement specifying the basis for each of its 

proposed redactions, including the applicable exemption under the Freedom of Information Act 
TOFS-16-D-0002

Page 11 of 72

(FOIA), 5 U.S.C. § 552, and, in the case of FOIA Exemption 4, 5 U.S.C. § 552(b)(4), shall 

demonstrate why the information is considered to be a trade secret or commercial or financial 

information that is privileged or confidential. Information provided by the Contractor in response 

to this requirement may itself be subject to disclosure under the FOIA.

The Treasury will carefully consider the entire Contractor’s proposed redactions and associated 

grounds for nondisclosure prior to making a final determination as to what information in the 

fully executed contract document may be properly withheld.

Deliverables

Monthly Status Report

(a) The Contractor shall provide a report each month, concurrent with submission of its invoice, 

in which the status for all work accomplished as of the end of the previous month is included:

• Hours and dollars spent during the reporting period (month), including cumulative totals 

of each; a forecast of future costs through the next month; total estimated cost at 

completion;

• Current contractor personnel engaged;

• Subcontracts, including socioeconomic category of subcontractor, and hours and dollars 

of work performed in the reporting period; and

• Monthly transactions, accomplishments, challenges and open issues.

DESCRIPTION FREQUENCY

Contractor Monthly Status Report By the 20th day of each month

Monthly Invoice By the 20th day of each month

(b) Legal advice as set forth in the Section Legal Services, in a number of forms, including oral 

and written advice.

(c) Drafting of legal documentation as set forth in the scope of work in the Section Legal 

Services, including reviewing and drafting legal documentation associated with the 

transactions types contemplated therein.

(d) Negotiate with transaction counterparties and facilitate transaction closings of the types 

contemplated in the Section Legal Services.

Inspection and Acceptance Criteria

Final inspection and acceptance of all work, performance, reports and other deliverables under 

this contract shall be performed at contractor locations or as specified in individual work orders 

under this contract. The Contracting Officer Representative (COR) is the individual responsible 

for inspection and acceptance. The COR may rely on assessments of service and work product 
TOFS-16-D-0002

Page 12 of 72

acceptability provided by those receiving the services on individual work orders in reaching a 

determination of acceptability. 

The basis for acceptance shall be in compliance with the requirements set forth in the task and 

work orders and other terms and conditions of the contract. Deliverable items rejected under 

resulting tasks shall be corrected in accordance with the applicable clauses.

SECTION II: CLAUSES AND PROVISIONS

The following provisions are incorporated by full text:

52.204-2 Security Requirements (Aug 1996)

(a) This clause applies to the extent that this contract involves access to information classified 

“Confidential,” “Secret,” or “Top Secret.”

(b) The Contractor shall comply with-

(1) The Security Agreement (DD Form 441), including the National Industrial Security Program 

Operating Manual (DoD 5220.22-M); and 

(2) Any revisions to that manual, notice of which has been furnished to the Contractor.

(c) If, subsequent to the date of this contract, the security classification or security requirements 

under this contract are changed by the Government and if the changes cause an increase or 

decrease in security costs or otherwise affect any other term or condition of this contract, the 

contract shall be subject to an equitable adjustment as if the changes were directed under the 

Changes clause of this contract.

(d) The Contractor agrees to insert terms that conform substantially to the language of this 

clause, including this paragraph (d) but excluding any reference to the Changes clause of this 

contract, in all subcontracts under this contract that involve access to classified information.

(End of clause)

52.204-9 Personal Identity Verification of Contractor Personnel. (Jan 2011) 

(a) The Contractor shall comply with agency personal identity verification procedures identified 

in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office 

of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing 

Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to 

the Contractor employees in connection with performance under this contract. The Contractor 

shall return such identification to the issuing agency at the earliest of any of the following, unless 

otherwise determined by the Government:
TOFS-16-D-0002

Page 13 of 72

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to 

comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all 

subcontracts when the subcontractor’s employees are required to have routine physical access to 

a Federally-controlled facility and/or routine access to a Federally-controlled information 

system. It shall be the responsibility of the prime Contractor to return such identification to the 

issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless 

otherwise approved in writing by the Contracting Officer.

(End of clause)

52.232-40 Providing Accelerated Payments to Small Business Subcontractors. (Dec 2013)

(a) Upon receipt of accelerated payments from the Government, the Contractor shall make 

accelerated payments to its small business subcontractors under this contract, to the maximum 

extent practicable and prior to when such payment is otherwise required under the applicable 

contract or subcontract, after receipt of a proper invoice and all other required documentation 

from the small business subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the 

Prompt Payment Act.

(c) Include the substance of this clause, including this paragraph (c), in all subcontracts with 

small business concerns, including subcontracts with small business concerns for the acquisition 

of commercial items.

(End of clause)

1052.204-9000 Security Screening Requirements for Access to Sensitive but Unclassified

Systems or Information (Mar 1998) 

(a) In addition to complying with any functional and technical security requirements set 

forth in the schedule and elsewhere in this contract, the Contractor shall request 

that the Government initiate personnel screening checks and provide signed user 

nondisclosure agreements, as required by this clause, for each contractor 

employee requiring staff-like access, i.e., unescorted or unsupervised physical 

access or electronic access, to the following limited or controlled areas, systems, 

programs and data: [List areas, systems, programs and data.] 

(b) The Contractor shall submit a properly completed set of investigative request 

processing forms for each such employee in compliance with instructions to be 

furnished by the Contracting Officer or his/her designated representative. 

(c) Depending upon the type of investigation necessary, it may take up to several months 
TOFS-16-D-0002

Page 14 of 72

to complete complex personnel screening investigations. At the discretion of the 

Government, background screening may not be required for employees with 

recent or current favorable Federal Government investigations. To verify the 

acceptability of a non-IRS, favorable investigation, the Contractor shall submit 

the forms or information needed, according to instructions furnished by the 

Contracting Officer. 

(d) When contractor employee access is necessary prior to completion of personnel 

screening, each contractor employee requiring access may be considered for 

escort access. The Contractor shall promptly submit all requests for approval for 

escort access to the Contracting Officer or his/her designated representative so as 

not to endanger timely contract performance. 

(e) The Contractor shall ensure that each contractor employee requiring access executes 

any nondisclosure agreements required by the Government prior to gaining stafflike access. The Contractor shall provide signed copies of the agreements to the 

Site Security Officer (SSO) for inclusion in the employee's security file. The 

name and location of the SSO shall be provided by the Government after contract 

award. Unauthorized access is a violation of law and may be punishable under the 

provisions of Title 5 U.S.C. 552a, Executive Order 12356; Title 5 U.S.C. 7211 

governing disclosures to Congress; Title 10 U.S.C.1034, as amended by the 

Military Whistleblower Protection Act governing disclosure to Congress by 

members of the military; Title 5 U.S.C. 2302(b)(8) as amended by the 

Whistleblower Protection Act governing disclosures of illegality, waste, fraud, 

abuse or public health or safety threats; the Intelligence Identities Protection Act 

of 1982 (50 U.S.C. 421 et seq.) governing disclosures that could expose 

confidential Government agents; and the statutes which protect against disclosure 

that may compromise the national security, including Sections 641, 793, 794, 798, 

and 952 of Title 18, United States Code, and Section 4(b) of the Subversive 

Activities Act of 1950 (50 U.S.C. Section 783(b)) and other applicable statutes. 

(f) The Contractor shall notify the Contracting Officer's Representative (COR) or the Site 

Security Officer no later than the end of the day of the termination for cause of an 

authorized employee's access. The Contractor shall notify the COTR no later than 

ten days after an authorized employee no longer requires access for any other type 

of termination. Verbal notifications shall be confirmed in writing within thirty 

days. 

[End of clause]

1052.204-9001--Identification/Badging Requirement (Mar 1998) 

During the period of this contract, access to IRS facilities for contractor representatives shall be 

granted as deemed necessary by the Government. All contractor employees whose duties under 

this contract require their presence at any Treasury, or Treasury bureau, facility shall be clearly 

identifiable by a distinctive badge furnished by the Government. In addition, corporate 

identification badges shall be worn on the outer garment at all times. It is the sole responsibility 

of the Contractor to provide this corporate identification. Upon the termination of the 

employment of any contractor personnel working on this contract, all Government furnished 

identification shall be returned to the issuing office. All on-site contractor personnel shall abide 

by security regulations applicable to that site. 

[End of clause]
TOFS-16-D-0002

Page 15 of 72

1052.209-71 - Representation by Corporations Regarding an Unpaid Federal Tax Liability 

or Conviction of a Felony Criminal Violation under Federal Law. (Jan 2015)

(a) In accordance with Sections 744 and 745 of Division E, Title VII, of the Consolidated and 

Further Continuing Appropriations Act, 2015 (Public Law 113-235) none of the funds made 

available by this or any other Act may be used to enter into a contract with any corporation

that-

(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and 

administrative remedies have been exhausted or have lapsed, and that is not being paid in a 

timely manner pursuant to an agreement with the authority responsible for collecting the tax 

liability, where the awarding agency is aware of the unpaid tax liability, unless a Federal agency 

has considered suspension or debarment of the corporation and has made a determination that 

this further action is not necessary to protect the interests of the Government; or

(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 

months, where the awarding agency is aware of the conviction, unless a Federal agency has 

considered suspension or debarment of the corporation and has made a determination that this 

further action is not necessary to protect the interests of the Government.

(b) The Offeror represents that-

(1) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been

assessed, for which all judicial and administrative remedies have been exhausted or have lapsed,

and that is not being paid in a timely manner pursuant to an agreement with the authority

responsible for collecting the tax liability.

(2) It is [ ] is not [ ] a corporation that was convicted of a felony criminal violation under

any Federal law within the preceding 24 months.

(End of provision)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive 

Orders-Commercial Items (May 2015)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) 

clauses, which are incorporated in this contract by reference, to implement provisions of law or 

Executive orders applicable to acquisitions of commercial items:

(1) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Dec 2014) 

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553). 

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004)(Public Laws 108-77 and 

108-78 (19 U.S.C. 3805 note)). 

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting 

Officer has indicated as being incorporated in this contract by reference to implement provisions 

of law or Executive orders applicable to acquisitions of commercial items:
TOFS-16-D-0002

Page 16 of 72

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with 

Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402). 

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (41 U.S.C. 

3509)). 

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment 

Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the 

American Recovery and Reinvestment Act of 2009.) 

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jul 

2013) (Pub. L. 109-282) (31 U.S.C. 6101 note). 

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Jan 2014) (Pub. L. 111-117, 

Section 743 of Div. C). 

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts 

(Jan 2014) (Pub. L. 111-117, Section 743 of Div. C). 

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors 

Debarred, Suspended, or Proposed for Debarment. (Aug 2013) (31 U.S.C. 6101 note). 

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters 

(Jul 2013) (41 U.S.C. 2313). 

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 

U.S.C. 657a). 

__ (ii) Alternate I (Nov 2011) of 52.219-3. 

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business 

Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) 

(15 U.S.C. 657a). 

__ (ii) Alternate I (JAN 2011) of 52.219-4. 

__ (13) [Reserved]

__ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644). 

__ (ii) Alternate I (Nov 2011).
TOFS-16-D-0002

Page 17 of 72

__ (iii) Alternate II (Nov 2011).

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644). 

__ (ii) Alternate I (Oct 1995) of 52.219-7. 

__ (iii) Alternate II (Mar 2004) of 52.219-7. 

X (16) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and 

(3)). 

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Oct 2014) (15 U.S.C. 637(d)(4)). 

__ (ii) Alternate I (Oct 2001) of 52.219-9. 

__ (iii) Alternate II (Oct 2001) of 52.219-9. 

__ (iv) Alternate III (Oct 2014) of 52.219-9. 

__ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011)(15 U.S.C. 644(r)). 

X (19) 52.219-14, Limitations on Subcontracting (Nov 2011) (15 U.S.C. 637(a)(14)). 

__ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 

637(d)(4)(F)(i)). 

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 

2011) (15 U.S.C. 657 f). 

__ (22) 52.219-28, Post Award Small Business Program Representation (Jul 2013) (15 U.S.C. 

632(a)(2)). 

__ (23) 52.219-29, Notice of Set-Aside for Economically Disadvantaged Women-Owned Small 

Business (EDWOSB) Concerns (Jul 2013) (15 U.S.C. 637(m)). 

__ (24) 52.219-30, Notice of Set-Aside for Women-Owned Small Business (WOSB) Concerns 

Eligible under the WOSB Program (Jul 2013) (15 U.S.C. 637(m)). 

X (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755). 

X (26) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan 2014) (E.O. 

13126). 

X (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015). 

__ (28) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246). 
TOFS-16-D-0002

Page 18 of 72

__ (29) 52.222-35, Equal Opportunity for Veterans (Jul 2014)(38 U.S.C. 4212). 

X (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793). 

__ (31) 52.222-37, Employment Reports on Veterans (JUL 2014) (38 U.S.C. 4212). 

__ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act 

(Dec 2010) (E.O. 13496). 

__ (33)(i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and 

E.O. 13627). 

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627). 

__ (34) 52.222-54, Employment Eligibility Verification (AUG 2013). (Executive Order 12989). 

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other 

types of commercial items as prescribed in 22.1803.) 

__ (35)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated 

Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of 

commercially available off-the-shelf items.) 

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the 

acquisition of commercially available off-the-shelf items.) 

__ (36)(i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (JUN 2014) (E.O.s 

13423 and 13514). 

__ (ii) Alternate I (Jun 2014) of 52.223-13. 

__ (37)(i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (JUN 2014) (E.O.s 13423 

and 13514). 

__ (ii) Alternate I (Jun 2014) of 52.223-14. 

__ (38) 52.223-15, Energy Efficiency in Energy-Consuming Products (DEC 2007) (42 U.S.C. 

8259b). 

__ (39)(i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (JUN 

2014) (E.O.s 13423 and 13514). 

__ (ii) Alternate I (Jun 2014) of 52.223-16. 

X (40) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (AUG 

2011) (E.O. 13513). 
TOFS-16-D-0002

Page 19 of 72

X (41) 52.225-1, Buy American-Supplies (May 2014) (41 U.S.C. chapter 83). 

__ (42)(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (May 2014) (41 

U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 

4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-

138, 112-41, 112-42, and 112-43. 

__ (ii) Alternate I (May 2014) of 52.225-3. 

__ (iii) Alternate II (May 2014) of 52.225-3. 

__ (iv) Alternate III (May 2014) of 52.225-3. 

__ (43) 52.225-5, Trade Agreements (NOV 2013) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note). 

__ (44) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, 

proclamations, and statutes administered by the Office of Foreign Assets Control of the 

Department of the Treasury). 

__ (45) 52.225-26, Contractors Performing Private Security Functions Outside the United States 

(Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 

2008; 10 U.S.C. 2302 Note). 

__ (46) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 

5150). 

__ (47) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 

2007) (42 U.S.C. 5150). 

__ (48) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 

U.S.C. 4505, 10 U.S.C. 2307(f)). 

__ (49) 52.232-30, Installment Payments for Commercial Items (Oct 1995) (41 U.S.C. 4505, 10 

U.S.C. 2307(f)). 

__ (50) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Jul 

2013) (31 U.S.C. 3332). 

__ (51) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award 

Management (Jul 2013) (31 U.S.C. 3332). 

__ (52) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332). 

__ (53) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a). 
TOFS-16-D-0002

Page 20 of 72

__ (54)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) 

(46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). 

__ (ii) Alternate I (Apr 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to 

commercial services, that the Contracting Officer has indicated as being incorporated in this 

contract by reference to implement provisions of law or Executive Orders applicable to 

acquisitions of commercial items:

__ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014)(E.O. 13495). 

__ (2) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67). 

__ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206

and 41 U.S.C. chapter 67). 

__ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price 

Adjustment (Multiple Year and Option Contracts) (May 2014) (29 U.S.C. 206 and 41 U.S.C. 

chapter 67). 

__ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price 

Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67). 

__ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to 

Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 

2014) (41 U.S.C. chapter 67). 

__ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to 

Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67). 

__ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2014)(E.O. 13658). 

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (May 2014) (42 

U.S.C. 1792). 

__ (10) 52.237-11, Accepting and Dispensing of $1 Coin (Sept 2008) (31 U.S.C. 5112(p)(1)). 

(d) Comptroller General Examination of Record. The Contractor shall comply with the 

provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in 

excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit 

and Records-Negotiation. 

(1) The Comptroller General of the United States, or an authorized representative of the 

Comptroller General, shall have access to and right to examine any of the Contractor’s directly 

pertinent records involving transactions related to this contract.
TOFS-16-D-0002

Page 21 of 72

(2) The Contractor shall make available at its offices at all reasonable times the records, 

materials, and other evidence for examination, audit, or reproduction, until 3 years after final 

payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor 

Records Retention, of the other clauses of this contract. If this contract is completely or partially 

terminated, the records relating to the work terminated shall be made available for 3 years after 

any resulting final termination settlement. Records relating to appeals under the disputes clause 

or to litigation or the settlement of claims arising under or relating to this contract shall be made 

available until such appeals, litigation, or claims are finally resolved. 

(3) As used in this clause, records include books, documents, accounting procedures and 

practices, and other data, regardless of type and regardless of form. This does not require the 

Contractor to create or maintain any record that the Contractor does not maintain in the ordinary 

course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this 

clause, the Contractor is not required to flow down any FAR clause, other than those in this 

paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the 

extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (41 U.S.C. 3509). 

(ii) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)), 

in all subcontracts that offer further subcontracting opportunities. If the subcontract (except 

subcontracts to small business concerns) exceeds $650,000 ($1.5 million for construction of any 

public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer 

subcontracting opportunities. 

(iii) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down 

required in accordance with paragraph (l) of FAR clause 52.222-17. 

(iv) 52.222-21, Prohibition of Segregated Facilities (Apr 2015) 

(v) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246). 

(vi) 52.222-35, Equal Opportunity for Veterans (Jul 2014) (38 U.S.C. 4212). 

(vii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793). 

(viii) 52.222-37, Employment Reports on Veterans (Jul 2014) (38 U.S.C. 4212) 

(ix) 52.222-40, Notification of Employee Rights under the National Labor Relations Act (Dec 

2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 

52.222-40. 

(x) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67). 
TOFS-16-D-0002

Page 22 of 72

(xi) __(A) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and 

E.O 13627). __(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O 13627). 

(xii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to 

Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May

2014) (41 U.S.C. chapter 67). 

(xiii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to 

Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67). 

(xiv) 52.222-54, Employment Eligibility Verification (AUG 2013). 

(xv) 52.222-55, Minimum Wages under Executive Order 13658 (Dec 2014) (Executive Order 

13658). 

(xvi) 52.225-26, Contractors Performing Private Security Functions Outside the United States 

(Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 

2008; 10 U.S.C. 2302 Note). 

(xvii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (May 2014) (42 

U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6. 

(xviii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 

U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph 

(d) of FAR clause 52.247-64. 

(2) While not required, the contractor may include in its subcontracts for commercial items a 

minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

The following clauses are incorporated by full text:

52.216-18 – Ordering (Oct 1995)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of 

task orders by the individuals or activities designated in the Schedule. Such orders may be issued 

from date of contract award through five years following date of contract award. 

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In 

the event of conflict between a delivery order or task order and this contract, the contract shall 

control.

(c) If mailed, a delivery order or task order is considered “issued” when the Government deposits 

the order in the mail. Orders may be issued orally, by facsimile, or by electronic commerce 

methods.
TOFS-16-D-0002

Page 23 of 72

52.216-19 -- Order Limitations (Oct 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract 

in an amount of less than $2,500, the Government is not obligated to purchase, nor is the 

Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor --

(1) Any order for a single item in excess of $1.0M;

(2) Any order for a combination of items in excess of $1.0M; or

(3) A series of orders from the same ordering office within 30 days that together call for 

quantities exceeding the limitation in subparagraph (b)(1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-

21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part 

of any one requirement from the Contractor if that requirement exceeds the maximum-order 

limitations in paragraph (b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order 

exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is 

returned to the ordering office within 30 days after issuance, with written notice stating the 

Contractor’s intent not to ship the item (or items) called for and the reasons. Upon receiving this 

notice, the Government may acquire the supplies or services from another source.

(End of Clause)

52.216-22 -- Indefinite Quantity (Oct 1995)

(a) This is an indefinite-quantity contract for the supplies or services specified and effective for 

the period stated, in the Schedule. The quantities of supplies and services specified in the 

Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance 

with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, 

the supplies or services specified in the Schedule up to and including the quantity designated in 

the Schedule as the “maximum.” The Government shall order at least the quantity of supplies or 

services designated in the Schedule as the “minimum.”

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, 

there is no limit on the number of orders that may be issued. The Government may issue orders 

requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that 

period shall be completed by the Contractor within the time specified in the order. The contract 

shall govern the Contractor’s and Government’s rights and obligations with respect to that order 

to the same extent as if the order were completed during the contract’s effective period; 

provided, that the Contractor shall not be required to make any deliveries under this contract 

after the expiration of the latest issues Task Order. 

(End of Clause)

52.217-8 -- Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the 

rates specified in the contract. These rates may be adjusted only as a result of revisions to 
TOFS-16-D-0002

Page 24 of 72

prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised 

more than once, but the total extension of performance hereunder shall not exceed 6 months. The 

Contracting Officer may exercise the option by written notice to the Contractor within 30 days of 

expiration.

(End of Clause)

52.217-9 -- Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor 

within 30 days provided that the Government gives the Contractor a preliminary written notice of 

its intent to extend at least 60 days before the contract expires. The preliminary notice does not 

commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include 

this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, 

shall not exceed five years.

(End of Clause)

52.227-14 -- Rights in Data – General (May 2014)

(a) Definitions. As used in this clause--

“Computer database” or “database” means a collection of recorded information in a form capable 

of, and for the purpose of, being stored in, processed, and operated on by a computer. The term 

does not include computer software.

“Computer software”—

(1) Means

(i) Computer programs that comprise a series of instructions, rules, routines, or 

statements, regardless of the media in which recorded, that allow or cause a computer to 

perform a specific operation or series of operations; and

(ii) Recorded information comprising source code listings, design details, algorithms, 

processes, flow charts, formulas, and related material that would enable the computer

program to be produced, created, or compiled.

(2) Does not include computer databases or computer software documentation.

“Computer software documentation” means owner’s manuals, user’s manuals, installation 

instructions, operating instructions, and other similar items, regardless of storage medium, that 

explain the capabilities of the computer software or provide instructions for using the software.

“Data” means recorded information, regardless of form or the media on which it may be 

recorded. The term includes technical data and computer software. The term does not include 

information incidental to contract administration, such as financial, administrative, cost or 

pricing, or management information.

“Form, fit, and function data” means data relating to items, components, or processes that are 

sufficient to enable physical and functional interchangeability, and data identifying source, size, 

configuration, mating, and attachment characteristics, functional characteristics, and performance 

requirements. For computer software it means data identifying source, functional characteristics, 

and performance requirements but specifically excludes the source code, algorithms, processes, 

formulas, and flow charts of the software.
TOFS-16-D-0002

Page 25 of 72

“Limited rights” means the rights of the Government in limited rights data as set forth in the 

Limited Rights Notice of subparagraph (g)(2) if included in this clause.

“Limited rights data” means data, other than computer software, that embody trade secrets or are 

commercial or financial and confidential or privileged, to the extent that such data pertain to 

items, components, or processes developed at private expense, including minor modifications.

”Restricted computer software” means computer software developed at private expense and that 

is a trade secret; is commercial or financial and is confidential or privileged; or is copyrighted 

computer software, including minor modifications of the computer software.

“Restricted rights,” as used in this clause, means the rights of the Government in restricted 

computer software, as set forth in a Restricted Rights Notice of paragraph (g) if included in this 

clause, or as otherwise may be provided in a collateral agreement incorporated in and made part 

of this contract, including minor modifications of such computer software.

“Technical data” means recorded information (regardless of the form or method of the recording) 

of a scientific or technical nature (including computer databases and computer software 

documentation). This term does not include computer software or financial, administrative, cost 

or pricing, or management data or other information incidental to contract administration. The 

term includes recorded information of a scientific or technical nature that is included in computer 

databases (See 41 U.S.C. 116).

“Unlimited rights” means the right of the Government to use, disclose, reproduce, prepare 

derivative works, distribute copies to the public, and perform publicly and display publicly, in 

any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of rights.

(1) Except as provided in paragraph (c) of this clause, the Government shall have 

unlimited rights in—

(i) Data first produced in the performance of this contract;

(ii) Form, fit, and function data delivered under this contract;

(iii) Data delivered under this contract (except for restricted computer software) 

that constitute manuals or instructional and training material for installation, 

operation, or routine maintenance and repair of items, components, or processes 

delivered or furnished for use under this contract; and

(iv) All other data delivered under this contract unless provided otherwise for 

limited rights data or restricted computer software in accordance with paragraph 

(g) of this clause.

(2) The Contractor shall have the right to—

(i) Assert copyright in data first produced in the performance of this contract to 

the extent provided in paragraph (c)(1) of this clause;

(ii) Use, release to others, reproduce, distribute, or publish any data first produced 

or specifically used by the Contractor in the performance of this contract, unless 

provided otherwise in paragraph (d) of this clause;

(iii) Substantiate use of, add or correct limited rights, restricted rights, or 

copyright notices and to take other appropriate action, in accordance with 

paragraphs (e) and (f) of this clause; and

(iv) Protect from unauthorized disclosure and use those data that are limited rights 

data or restricted computer software to the extent provided in paragraph (g) of this 

clause.
TOFS-16-D-0002

Page 26 of 72

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) Unless provided otherwise in paragraph (d) of this clause, the Contractor may 

establish, without prior approval of the Contracting Officer, claim to copyright in 

scientific and technical articles based on or containing data first produced in the 

performance of this contract and published in academic, technical or professional 

journals, symposia proceedings or similar works. The prior, express written 

permission of the Contracting Officer is required to assert copyright in all other 

data first produced in the performance of this contract.

(ii) When authorized to assert copyright to the data, the Contractor shall affix the 

applicable copyright notices of 17 U.S.C. 401 or 402, and acknowledgment of 

Government sponsorship (including contract number).

(iii) For data other than computer software, the Contractor grants to the 

Government and others acting on its behalf, a paid-up, nonexclusive, irrevocable 

worldwide license in such copyrighted data to reproduce, prepare derivative 

works, distribute copies to the public, and perform publicly and display publicly, 

by or on behalf of the Government. For computer software, the Contractor grants 

to the Government and others acting on its behalf, a paid-up nonexclusive, 

irrevocable worldwide license in such copyrighted computer software to 

reproduce, prepare derivative works, and perform publicly and display publicly 

(but not to distribute copies to the public) by or on behalf of the Government.

(2) Data not first produced in the performance of this contract. The Contractor shall not, 

without prior written permission of the Contracting Officer, incorporate in data delivered 

under this contract any data not first produced in the performance of this contract unless 

the Contractor—

(i) Identifies the data; and

(ii) Grants to the Government, or acquires on its behalf, a license of the same 

scope as set forth in subparagraph (c)(1) of this clause or; if such data are 

restricted computer software, the Government shall acquire a copyright license as 

set forth in subparagraph (g)(4) of this clause (if included in this contract) or as 

otherwise provided in a collateral agreement incorporated in or made part of this 

contract.

(3) Removal of copyright notices. The Government will not remove any authorized 

copyright notices placed on data pursuant to this paragraph (c), and will include such 

notices on all reproductions of the data.

(d) Release, publication and use of data. The Contractor shall have the right to use, release to 

others, reproduce, distribute, or publish any data first produced or specifically used by the 

Contractor in the performance of this contract, except—

(1) As prohibited by Federal law or regulation (e.g., export control or national security 

laws or regulations);

(2) As expressly set forth in this contract; or

(3) If the Contractor receives or is given access to data necessary for the performance of 

this contract which contain restrictive markings, the Contractor shall treat the data in 

accordance with such markings unless otherwise specifically authorized otherwise in 

writing by the Contracting Officer.
TOFS-16-D-0002

Page 27 of 72

(e) Unauthorized marking of data.

(1) Notwithstanding any other provisions of this contract concerning inspection or 

acceptance, if any data delivered under this contract are marked with the notices specified 

in paragraph (g)(3) or (g)(4) of this clause and use of the notices is not authorized by this 

clause, or if such data bears any other restrictive or limiting markings not authorized by

this contract, the Contracting Officer may at any time either return the data to the 

Contractor, or cancel or ignore the markings. However, pursuant to 41 U.S.C. 4703, the 

following procedures shall apply prior to canceling or ignoring the markings.

(i) The Contracting Officer will make written inquiry to the Contractor affording 

the Contractor 60 days from receipt of the inquiry to provide written justification 

to substantiate the propriety of the markings;

(ii) If the Contractor fails to respond or fails to provide written justification to 

substantiate the propriety of the markings within the 60-day period (or a longer 

time approved in writing by the Contracting Officer for good cause shown), the 

Government shall have the right to cancel or ignore the markings at any time after 

said period and the data will no longer be made subject to any disclosure 

prohibitions.

(iii) If the Contractor provides written justification to substantiate the propriety of 

the markings within the period set in subdivision (e)(1)(i) of this clause, the 

Contracting Officer will consider such written justification and determine whether 

or not the markings are to be canceled or ignored. If the Contracting Officer 

determines that the markings are authorized, the Contractor will be so notified in 

writing. If the Contracting Officer determines, with concurrence of the head of the 

contracting activity, that the markings are not authorized, the Contracting Officer 

will furnish the Contractor a written determination, which determination shall 

become the final agency decision regarding the appropriateness of the markings 

unless the Contractor files suit in a court of competent jurisdiction within 90 days 

of receipt of the Contracting Officer’s decision. The Government shall continue to 

abide by the markings under this paragraph (e)(1)(iii) until final resolution of the 

matter either by the Contracting Officer’s determination becoming final (in which 

instance the Government will thereafter have the right to cancel or ignore the 

markings at any time and the data will no longer be made subject to any 

disclosure prohibitions), or by final disposition of the matter by court decision if 

suit is filed.

(2) The time limits in the procedures set forth in subparagraph (e)(1) of this clause may 

be modified in accordance with agency regulations implementing the Freedom of 

Information Act (5 U.S.C. 552) if necessary to respond to a request thereunder.

(3) Except to the extent the Government’s action occurs as the result of final disposition 

of the matter by a court of competent jurisdiction, the Contractor is not precluded by 

paragraph (e) of this clause from brining a claim, in accordance with the Disputes clause 

of this contract, that may arise as a result of the Government removing or ignoring 

authorized markings on data delivered under this contract.

(f) Omitted or incorrect markings.
TOFS-16-D-0002

Page 28 of 72

(1) Data delivered to the Government without any restrictive markings shall be deemed to 

have been furnished with unlimited rights. The Government is not liable for the 

disclosure, use, or reproduction of such data.

(2) If the unmarked data has not been disclosed without restriction outside the 

Government, the Contractor may request, within 6 months (or a longer time approved by 

the Contracting Officer in writing for good cause shown) after delivery of such data, 

permission to have authorized notices placed on qualifying data at the Contractor’s 

expense, and the Contracting Officer may agree to do so if the Contractor—

(i) Identifies the data to which the omitted notice is to be applied;

(ii) Demonstrates that the omission of the notice was inadvertent;

(iii) Establishes that the use of the proposed notice is authorized; and

(iv) Acknowledges that the Government has no liability for the disclosure, use, or 

reproduction of any data made prior to the addition of the notice or resulting from 

the omission of the notice.

(3) If data has been marked with an incorrect notice, the Contracting Officer may—

(i) Permit correction of the notice at the Contractor’s expense if the Contractor 

identifies the data and demonstrates that the correct notice is authorized, or

(ii) Correct any incorrect notices.

(g) Protection of limited rights data and restricted computer software.

(1) The Contractor may withhold from delivery qualifying limited rights data or restricted 

computer software that are not data identified in paragraphs (b)(1)(i), (ii), and (iii) of this 

clause. As a condition to this withholding, the Contractor shall—

(i) Identify the data being withheld; and

(ii) Furnish form, fit, and function data instead.

(2) Limited rights data that are formatted as a computer database for delivery to the 

Government shall be treated as limited rights data and not restricted computer software.

(3) [Reserved]

(h) Subcontracting. The Contractor shall obtain from its subcontractors all data and rights therein 

necessary to fulfill the Contractor’s obligations to the Government under this contract. If a 

subcontractor refuses to accept terms affording the Government such rights, the Contractor shall 

promptly notify the Contracting Officer of the refusal and shall not proceed with the subcontract 

award without authorization in writing from the Contracting Officer.

(i) Relationship to patents or other rights. Nothing contained in this clause shall imply a license 

to the Government under any patent or be construed as affecting the scope of any license or other 

right otherwise granted to the Government.

(End of Clause)

1052.201–70 Contracting Officer’s Representative (COR) Appointment and 

Authority (AUG 2011)

(a) The COR is:

Stacey Holland

(202) 622-7384

stacey.holland@treasury.gov
TOFS-16-D-0002

Page 29 of 72

(b) Performance of work under this contract is subject to the technical direction of the COR 

identified above, or a representative designated in writing. The term ‘‘technical direction’’ 

includes, without limitation, direction to the contractor that directs or redirects the labor effort, 

shifts the work between work areas or locations, and/or fills in details and otherwise serves to 

ensure that Tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the contract specification(s)/work statement. 

The COR does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the contract specification(

s)/work statement;

(2) Constitutes a change as defined in the clause entitled ‘‘Changes’’;

(3) In any manner causes an increase or decrease in the contract price, or the time required

for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor’s right to perform under the terms and conditions of the 

contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor’s employees.

(d) Technical direction may be oral or in writing. The COR must confirm oral direction in 

writing within five workdays, with a copy to the Contracting Officer.

(e) The Contractor shall proceed promptly with performance resulting from the technical 

direction issued by the COR. If, in the opinion of the contractor, any direction of the COR or the 

designated representative falls within the limitations of (c) above, the contractor shall 

immediately notify the Contracting Officer no later than the beginning of the next Government 

work day. 

(f) Failure of the Contractor and the Contracting Officer to agree that technical direction is 

within the scope of the contract shall be subject to the terms of the clause entitled ‘‘Disputes.’’

(End of clause)

1052.203-98 Prohibition on Contracting with Entities that Require Certain Internal

Confidentiality Agreements—Representation. (Mar 2015) (Deviation 2015-00003)

(a) In accordance with Section 743 of Division E, Title VII, of the Consolidated and 

Further Continuing Resolution Appropriations Act, 2015 (Pub. L. 113-235), Government 

agencies are not permitted to use funds appropriated (or otherwise made available) under that

or any other Act for contracts with an entity that requires employees or subcontractors of

such entity seeking to report fraud, waste, or abuse to sign internal confidentiality agreements

or statements prohibiting or otherwise restricting such employees or subcontractors from

lawfully reporting such waste, fraud, or abuse to a designated investigative or law

enforcement representative of a Federal department or agency authorized to receive such

information.

(b) The prohibition in paragraph (a) of this provision does not contravene requirements

applicable to Standard Form 312, Form 4414, or any other form issued by a Federal

department or agency governing the nondisclosure of classified information.
TOFS-16-D-0002

Page 30 of 72

(c) Representation. By submission of its offer, the Offeror represents that it does not 

require employees or subcontractors of such entity seeking to report fraud, waste, or abuse to

sign internal confidentiality agreements or statements prohibiting or otherwise restricting such

employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a

designated investigative or law enforcement representative of a Federal department or agency

authorized to receive such information.

(End of provision)

1052.203-99 Prohibition on Contracting with Entities that Require Certain Internal

Confidentiality Agreements. (Deviation 2015-00003)

(a) The Contractor shall not require employees or subcontractors seeking to report 

fraud, waste, or abuse to sign or comply with internal confidentiality agreements or 

statements prohibiting or otherwise restricting such employees or subcontractors from 

lawfully reporting such waste, fraud, or abuse to a designated investigative or law 

enforcement representative of a Federal department or agency authorized to receive such

information.

(b) The contractor shall notify employees that the prohibitions and restrictions of any 

internal confidentiality agreements covered by this clause are no longer in effect.

(c) The prohibition in paragraph (a) of this clause does not contravene requirements 

applicable to Standard Form 312, Form 4414, or any other form issued by a Federal 

department or agency governing the nondisclosure of classified information.

(d)(1) In accordance with Section 743 of Division E, Title VII, of the Consolidated and

Further Continuing Resolution Appropriations Act, 2015 (Pub. L. 113-235), use of funds

appropriated (or otherwise made available) under that or any other Act may be prohibited,

if the Government determines that the Contractor is not in compliance with the provisions

of this clause.

(2) The Government may seek any available remedies in the event the 

contractor fails to comply with the provisions of this clause.

(End of clause)

IR1052.232-7003 Electronic Invoicing and Payment Requirements for the Invoice 

Processing Platform (IPP) (Aug 2012)

(a) Definitions:

"Short payment" as used in this clause means an invoice that includes the cost or price for 

supplies or services delivered or performed, as well as the cost or price for supplies or services 
TOFS-16-D-0002 

Page 31 of 72

not yet tendered to the Government in accordance with the terms of the contract, order or 

agreement.

“Short payment” example: The contract requires the delivery of a set number of items, with the 

price, delivery location, and delivery due date also specified. The vendor delivers 50% of the 

items as specified but invoices for 100% of the items. Before implementation of the IPP, the IRS 

would have paid the vendor for the items delivered and instructed the vendor to re-invoice the 

IRS when the balances of the items were delivered. In other words, the IRS would "short pay" 

the invoice since the IRS did not remit payment for the full invoice amount. With 

implementation of the IPP, the IRS can no longer do this because the IRS cannot accept an 

electronic invoice that includes items not yet received. The IRS will reject the invoice. The 

vendor needs to submit an invoice for only the items received by the IRS (in this case, 50%), 

and, assuming that these items meet all other contract terms and conditions, the IRS will pay the 

invoiced amount. The vendor submits subsequent invoice(s) for items as they are delivered and 

accepted.

(b) The Invoice Processing Platform (IPP) is a secure Web-based electronic invoicing and 

payment information service available to all Federal agencies and their suppliers. Effective 

October 1, 2012, invoicing for payment through the IPP will be mandatory for all new contract 

awards. Additional information regarding the IPP may be found at the IPP website address 

https://www.ipp.gov. Contractors must complete the contractor point of contact information 

below, and submit it with their proposal submissions. Contractors may contact the IPP Helpdesk 

for assistance via e-mail at ippgroup@bos.frb.org or via phone at (866) 973-3131. Once a 

contract award has been made, the contractor will be contacted by the IPP via e-mail to set-up an 

account. It will be necessary for contractors to login to their IPP accounts every 90 days to keep 

their IPP accounts active. 

 (c) Contractor Point of Contact Information 

Contractor Name: Hughes Hubbard & Reed LLP 

Contractor IPP Point of Contact Name:

Contractor Phone Number: 

Contractor E-mail Address:

 (d) Electronic Invoicing and Payment Requirements 

Vendor invoices submitted electronically through the IPP should be in the proper format and 

contain the information required for payment processing. In order to be approved for payment, a 

“proper invoice” must list the items specified in FAR 52.232-25 (a)(3)(i) through (a)(3)(x), or in 

the case of a Commercial Item Contract, the items included in 52.212-4(g)(1)(i) through 

(g)(1)(x). 

Under this contract, the following documents are required to be submitted as an attachment to the 
TOFS-16-D-0002

Page 32 of 72

invoice (Contracting Officer fills in additional documentation that must be furnished by the 

contractor (e.g. timesheet)): 

(e) Payment and Invoice Questions

For payment and invoice questions, contact the Beckley Finance Center at (304) 254-3372 or via 

e-mail at cfo.bfc.ipp.customer.support@irs.gov.

(f) Waiver

If the Contractor is unable to use the IPP for submitting payment requests starting on October 1, 

2012, then a waiver form must be completed and submitted with the contractor’s proposal 

submission for review and approval by the Contracting Officer based on one of the conditions 

listed in the waiver form included as Attachment 1 to this clause. The vendor will be notified 

prior to award as to whether their request for waiver has been approved or denied. If the waiver 

is granted, then a copy of the waiver must be submitted with each paper invoice that the vendor 

submits to the payment office or the invoice will be returned.

(g) Short Payment

Short payment on vendor submitted invoices will no longer be processed or paid. If any portion 

of the invoice does not meet the requirements for a proper invoice, the entire invoice shall be 

rejected and returned to the vendor unpaid.

(End of Clause)

DTAR 1052.222–70: Minority and Women Inclusion (April 2014)

Contractor confirms its commitment to equal opportunity in employment and contracting. To 

implement this commitment, the Contractor shall ensure, to the maximum extent possible 

consistent with applicable law, the fair inclusion of minorities and women in its workforce. The 

Contractor shall insert the substance of this clause in all subcontracts awarded under this 

Contract whose dollar value exceeds $150,000. Within ten business days of a written request 

from the contracting officer, or such longer time as the contracting officer determines, and 

without any additional consideration required from the Agency, the Contractor shall provide 

documentation, satisfactory to the Agency, of the actions it (and as applicable, its subcontractors) 

has undertaken to demonstrate its good faith effort to comply with the aforementioned 

provisions. For purposes of this contract, ‘‘good faith effort’’ may include actions by the 

contractor intended to identify and, if present, remove barriers to minority and women 

employment or expansion of employment opportunities for minorities and women within its 

workforce. Efforts to remove such barriers may include, but are not limited to, recruiting 

minorities and women, providing job-related training, or other activity that could lead to those 

results. The documentation requested by the contracting officer to demonstrate ‘‘good faith 

effort’’ may include, but is not limited to, one or more of the following:
TOFS-16-D-0002

Page 33 of 72

1. The total number of Contractor’s employees, and the number of minority and women 

employees, by race, ethnicity, and gender (e.g., an EEO–1);

2. A list of subcontract awards under the Contract that includes: dollar amount, date of 

award, and subcontractor’s race, ethnicity, and/or gender ownership status;

3. Information similar to that required in item 1, above, with respect to each 

subcontractor; and/or 

1. The Contractor’s plan to ensure that minorities and women have appropriate 

opportunities to enter and advance within its workforce, including outreach efforts. 

‘‘Consistent with Section 342(c)(3) of the Dodd-Frank Wall Street Reform and 

Consumer Protection Act (Pub. L. 111–203)(Dodd-Frank Act), a failure to 

demonstrate to the Director of the Agency’s Office of Minority and Women Inclusion 

such good faith efforts to include minorities and women in the Contractor’s 

workforce (and as applicable, the workforce of its subcontractors), may result in 

termination of the Contract for default, other contractual remedies, or referral to the 

Office of Federal Contract Compliance Programs. Compliance with this clause does 

not, however, necessarily satisfy the requirements of Executive Order 11246, as 

amended, nor does it preclude OFCCP compliance evaluations and/or enforcement 

actions undertaken pursuant to that Order. ‘‘For purposes of this clause, the terms 

‘‘minority,’’ ‘‘minority-owned business’’ and ‘‘women-owned business’’ shall have 

the meanings set forth in Section 342(g) of the Dodd-Frank Act.

(End of clause)

IR1052.239-9010 Section 508 Services (Sep 2006)

All contracts, solicitations, Purchase Orders, Delivery Orders and interagency agreements that 

contain a requirement of services which will result in the delivery of a new or updated electronic 

and information technology (EIT) item/product must conform to the applicable provisions of the

appropriate technical standards in 36 CFR 1194, Subpart B, and functional performance criteria 

in 36 CFR 1194.31, Subpart C, unless an agency exception to this requirement exists.

The following technical standards and provisions have been determined to be applicable to this 

contract:

 1194.21, Software applications and operating systems.

x (a) x (b) x (c) x (d) x (e) x (f) x (g) x (h) 

x (i) x (j) x (k) x (l)

 X 1194.22, Web-based intranet and internet information and applications.

 x (a) x (b) x (c) x (d) x (e) x (f) x (g) (h) x (i) x (j) 

 x (k) x (l) x (m) (n) x (o) x (p)

 1194.23, Telecommunications products.

 (a) (b) (c) (d) (e) (f) (g) (h) (i) (j)

 (k:1) (k:2) (k:3) (k:4)

 ___ 1194.24, Video and multimedia products.
TOFS-16-D-0002

Page 34 of 72

 (a) (b) (c) (d) (e)

 ___ 1194.25, Self-contained, closed products.

__(a) __(b) __(c) __(d) __(e) __(f) __(g) __(h) __(i) __(j)

 1194.26, Desktop and portable computers.

 (a) (b) (c) (d)

The standards do not require the installation of specific accessibility-related software or the 

attachment of an assistive technology device, but merely require that the EIT be compatible with 

such software and devices so that it can be made accessible if so required by the agency in the 

future.

The following functional performance criteria (36 CFR 1194.31) apply to this contract.

 X (a) At least one mode of operations and information retrieval that does not require user 

vision shall be provided, or support for assistive technology used by people who are blind or 

visually impaired shall be provided.

 X (b) At least one mode of operation and information retrieval that does not require visual 

acuity greater than 20/70 shall be provided in audio and enlarged print output working together 

or independently, or support for assistive technology used by people who are visually impaired 

shall be provided.

 X (c) At least one mode of operation and information retrieval that does not require user 

hearing shall be provided, or support for assistive technology used by people who are deaf or 

hard of hearing shall be provided.

 X (d) Where audio information is important for the use of a product, at least one mode of 

operation and information retrieval shall be provided in an enhanced auditory fashion, or support 

for assistive hearing devices shall be provided.

 X (e) At least one mode of operation and information retrieval that does not require speech 

shall be provided, or support for assistive technology used by people with disabilities shall be 

provided.

_X_ (f) At least one mode of operation and information retrieval that does not require fine 

motor or simultaneous actions and that is operable with limited reach and strength shall be 

provided. (End of clause)

IR1052.239-9008 Section 508 – Information, Documentation, and Support (Sep 2006)

In accordance with 36 CFR 1194, Subpart D, the electronic information technology (EIT) 

products and product support services furnished in performance of this contract shall be 

documented to indicate the current conformance level with Section 508 of the Rehabilitation Act 
TOFS-16-D-0002

Page 35 of 72

of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers 

Compliance Board’s Electronic and Information Technology Accessibility Standards. At no time 

during the performance of the award shall the level of conformance go below the level of 

conformance in place at the time of award. At no additional cost, the contractor shall provide 

information, documentation, and support relative to the supplies and services as described

in the statement of work. The contractor shall maintain this detailed listing of compliant

products for the full contract term, including forms of extensions, and shall ensure that it is 

current within five calendar days after award and within three calendar days of changes in 

products being utilized as follows:

(a) Product support documentation provided to end-users shall be made available in alternate 

formats upon request, at no additional charge.

(b) End-users shall have access to a description of the accessibility and compatibility features of 

products in alternate formats or alternate methods upon request, at no additional charge.

(c) Support services for products shall accommodate the communication needs of end-users with 

disabilities.

(End of clause)

IR1052.204-9003 - IRS Security Awareness Training Requirements (Jun 2013) 

The Federal Information Security Management Act of 2002 (FISMA) requires each federal 

agency to provide periodic information security awareness training to all employees, including 

contractors, involved in the management, use, or operation of Federal information and 

information systems. In addition, IRS contractors and their employees are subject to the 

Taxpayer Browsing Protection Act of 1997, which prohibits willful unauthorized inspection of 

returns and return information. Violation of the Act could result in civil and criminal penalties. 

(a) The contractor shall ensure all contractor personnel complete one or more Information 

Protection briefings on computer security, disclosure, privacy, physical security, and/or 

unauthorized access to taxpayer accounts (UNAX), as specified by Contractor Security 

Management (CSM). CSM can be reached at CSM@irs.gov. Individually and collectively, these 

briefings make up the IRS Security Awareness Training (SAT) requirements for the Service’s 

information assets. Exception: Contractor personnel performing under IRS contracts with 

Nonprofit Agencies Employing People Who Are Blind or Severely Disabled (as described in 

FAR Subpart 8.7) are exempted from the aforementioned SAT requirements, unless the 

contractor requests SAT, or there is a compelling justification for requiring the training that is 

approved by the Contracting Officer, in consultation with CSM. 

(i) Security Orientation 

All new contractor personnel shall attend a system security orientation within the first 10 

business days following initial assignment to any IRS contract/Order, and additional IT security 

awareness training (commensurate with the individual’s duties and responsibilities) within 5 

business days of being granted access to an IRS facility or system. The Security Orientation will 

also be attended by new contractor personnel, including subcontractor personnel, who are 
TOFS-16-D-0002

Page 36 of 72

authorized under contract to access IRS IT systems, data, and assets from or through contractormanaged facilities, systems, 

and assets, including laptop computers, workstations, servers, and other IT resources. 

(ii) Access to Sensitive but Unclassified (SBU) Information and IT Systems Security Awareness 

Training (SAT) 

Contractor personnel, including subcontractor personnel, required to complete SAT include, but 

are not necessarily limited to, those involved in any of the following activities: 

 Manage, program or maintain IRS information in a production environment; 

 Operate an information system on behalf of the IRS; 

 Conduct testing or development of information or information systems on behalf of the IRS; 

 Provide advisory and assistance (consulting) services, or administrative support; or 

 Handling, processing, access to, development, backup or any services to support IRS. 

(iii) Service Personnel Security Awareness Training 

Contractor personnel providing services in the following categories are required to complete 

Physical Security & Emergency Preparedness Training: 

 Medical; 

 Cafeteria; 

 Landscaping; 

 Janitorial and cleaning (daylight operations); 

 Building maintenance; or 

 Other maintenance and repair. 

(iv) Service Personnel Inadvertent SBU Access Training 

Contractor personnel performing: (i) janitorial and cleaning services (daylight operations), (ii) 

building maintenance, or (iii) other maintenance and repair and need access to IRS facilities and 

building wherein pipeline processing (the processing of paper tax returns) is performed or where 

the facility and building has an exemption to the clean desk policy authorized by PSEP, are 

required to complete Inadvertent SBU Access training. Facilities performing pipeline processing 

and/or have an exemption to the clean desk policy are: 

Clean Desk Waiver Facilities: (Note: The facilities listed below could change annually and are 

only authorized for one year.) 

 KY2032 333 Scott St., Covington, KY 41001 

 KY3005 300 Madison Ave., Covington, KY 41011 

 MI1951 985 Michigan Ave., Detroit, MI 48226 

 MN1600 30 East Seventh St., St. Paul, MN 55101 

 TX2225 2191 Woodward St., Austin, TX 78744 

Pipeline Processing Facilities: 

 CA4664 Fresno Campus, 5045 E. Butler, Fresno, CA 93727 

 CA7370 1950 G Street, Fresno, CA 93706 

 CA6530 1000 N. Mooney St., Tulare, CA 93274 

 KY0085 Covington Campus, 200 West Fourth St., Covington, KY 41011 

 KY3016 7125 Industrial Rd., Florence, KY 41042 

 MO1937 Kansas City Campus, 33 W. Pershing Rd., Kansas City, MO 64108 

 TX2038 Austin Campus, 3651 S IH-35, Austin TX 78741 
TOFS-16-D-0002

Page 37 of 72

 TX2746 5015 S IH-35, Austin TX 78741 

 UT0036 Ogden Campus, 1160 W 1200 S, Ogden, UT 84409 

 UT1430 1973 North Rulon White Blvd., Ogden, UT 84404 

 UT1476 1125 W 12th St., Ogden, UT 84201 

(v) Training Certificate/Notice 

The contractor shall submit confirmation of completed SAT (using the form at the Mandatory 

Briefing web site) or via a confirmation email to CSM at CSM@irs.gov for each employee 

assigned to a contract/Order subject to this clause, with a copy to the Contracting Officer and 

Contracting Officer’s Representative (COR), upon completion, but not later than 10 business 

days after starting performance under the contract/Order. If required by the COR, the contractor 

may be required to input data into a system, to be defined by the IRS, to describe the security 

controls being used to protect information, including confirmation of security awareness training. 

(vi) Annual Training 

For contracts/Orders exceeding one year in length, either on a multiyear or multiple year basis, 

contractor must ensure that personnel complete SAT annually not later than April 30th of each 

year. The contractor shall submit confirmation of completed annual SAT on all personnel 

assigned to this contract/Order, via email, to the CO, COR, and CSM upon completion, but not 

later than May 12th of the then current calendar year or as requested by CSM (whichever date is 

earlier). 

b. SAT is available on the Mandatory Briefing web site or if this site is not accessible, SAT 

materials will be made available by CSM at CSM@irs.gov. 

c. Contractor’s failure to comply with IRS security policy (to include completion and 

certification of SAT requirements within the timeframe specified) may be subject to having 

access to IRS IT systems and facilities suspended, revoked or terminated (temporarily or 

permanently). 

(End of clause)

IR1052.204-9005 Submission of Security Forms and Related Materials (Jun 2013) 

As described in Department of the Treasury Security Manual (TD P 15-71), Chapter I, Section 1, 

Position Sensitivity and Risk Designation, Contractor personnel assigned to perform work under 

an IRS contract/Order must undergo security investigative processing appropriate to the position 

sensitivity and risk level designation associated to determine whether the Contractor personnel 

should be permitted to work in the identified position. For security requirements at contractor 

facilities using contractor managed resources, please reference Publication 4812, Contractor 

Security Controls. 

a. Contractor personnel performing under an agreement that authorizes unescorted access to and 

in IRS facilities, and access to Sensitive But Unclassified (SBU) information or information 

systems are subject to (and must receive a favorable adjudication or affirmative results with 

respect to) the following eligibility/suitability pre-screening criteria, as applicable: 

(1) IRS account history for tax compliance; 
TOFS-16-D-0002

Page 38 of 72

(2) Selective Service registration compliance; 

(3) U.S. citizenship/residency compliance; 

(4) Background investigation forms; 

(5) Credit report results (moderate and high risk investigations only); 

(6) Federal Bureau of Investigation fingerprint results; and 

(7) If applicable, prior background investigations. 

In this regard, Contractor shall furnish the following electronic documents to the Contractor 

Security Management (CSM) at CSM@irs.gov or CSLP@irs.gov within 10 business days of 

assigning (or reassigning) an employee to this contract/Order and prior to the contract employee 

performing any work thereunder: 

 The IRS provided Risk Assessment Checklist (RAC), and 

 All required security forms (for new contractor employees), are available through the publicly 

accessible website for IRS Procurement. 

b. Tax Compliance, Credit Checks and Fingerprinting: 

(1) Contractor personnel whose contract/Order exceeds 180 days must be eligible for access, per 

certification of tax compliance, and shall undergo, at a minimum a National Agency Check and 

Inquiries as a condition of work under the contract/Order, to include a credit check and 

fingerprinting. 

(2) If the duration of employment is less than 180 days or access is infrequent (e.g., 2-3 days per 

month) and the contractor requires unescorted access, the contractor employee must be eligible 

for access, per certification of tax compliance, and require at a minimum a fingerprint check 

(Special Agreement Check). 

(3) With the exception of contractors who need access to IT systems, no background 

investigation or tax check is necessary if the duration of employment is less than 180 days or 

access is infrequent when there is escort provided by an IRS employee or an approved contractor 

employee at the same or higher position risk level. 

The contractor employee will be permitted to perform under the contract and have access to IRS 

facilities only upon notice of an interim or final approval, as defined in Internal Revenue Manual 

(IRM) 10.23.2 – Contractor Investigations, and is otherwise consistent with IRS security 

practices and related IRMs, to include, but not limited to, IRM 1.4.6 – Managers Security 

Handbook, IRM 10.2.14 – Methods of Providing Protection, and IRM 10.8.1 - Policy and 

Guidance. 

As prescribed in IRM 10.23.2, escorting in lieu of staff-like access for IT systems will not be 

allowed. 

(End of clause)

IR1052.204-9006 Notification of Change in Contractor Employee Employment Status, 

Assignment, or Standing (Jun 2013) 

The contractor shall notify the Contracting Officer's Representative (COR) and the Contractor 

Security Management (CSM), via email to CSM@irs.gov, within 1 business day of the 

contractor becoming aware of any change in the employment status, assignment, or standing of a 
TOFS-16-D-0002

Page 39 of 72

contractor employee to this contract/Order –to include, but not limited to, the following 

conditions: 

 Receipt of the employee’s notice of intent to separate from employment or discontinue work 

under this IRS contract/Task Order; 

 Knowledge of the employee’s voluntary separation from employment or performance on this 

contract/Task Order (if no prior notice was given); 

 Transfer or reassignment of the employee and performance of duties under this contract/Task

Order, in whole or in part, to another IRS contract/Task Order (and identify the gaining contract 

and representative duties/responsibilities to allow for an assessment of suitability based on 

position sensitivity/risk level designation); 

 Separation, furlough or release from employment; 

 Anticipated extended absence of more than 45 days; 

 Change of legal name;

 Change to citizenship or lawful permanent resident status, or employment eligibility; 

 Change in gender or other distinction when physical attributes figure prominently in the 

biography of an individual; 

 Actual or perceived conflict of interest incontinued performance under this contract/Task

Order (provide explanation); 

 Death. 

When required by the COR, the contractor may be required to provide the information required 

by this clause to the IRS using the Archer application or similar application that will be used 

also to track security performance. 

The notice shall include the following minimum information: 

 Name of contractor employee 

 Nature of the change in status, assignment or standing (i.e., provide a brief non-personal, 

broad-based explanation) 

 Affected contract/Task Order number(s) 

 Actual or anticipated date of departure or separation 

 When applicable, the name of the IRS facility(s) this individual routinely works from or has 

access to when performing work under this contract/Order

 When applicable, contractors using contractor owned systems for IRS work must ensure that 

their systems are updated to ensure employees no longer have continued access to IRS work, 

either for systems administration or processing functions. 

Identification of any Government Furnished Property (GFP), Government Furnished 

Equipment (GFE), or Government Furnished Information (GFI) (to include Personal Identity 

Verification (PIV) credentials or badges) provided to the contractor employee and its 

whereabouts or status. 

In the event the subject contractor employee is working on multiple contracts/Orders, 

notification shall be combined, and the cognizant COR for each affected contract/Order shall be 

included in the joint notification along with the CSM. These documents (the RAC and security 

forms) are also available by email request to CSM.) 

As a general rule, the change in the employment status, assignment, or standing of a contractor 

personnel to this contract/Order would not form the basis for an excusable delay for failure to 

perform this contract under its terms. 

(End of clause)
TOFS-16-D-0002

Page 40 of 72

IR1052.239-9007 Access, Use or Operation of IRS Information Technology (IT) Systems by 

Contractors (Jun 2013) 

In performance of this contract, the contractor agrees to comply with the following requirements 

and assumes responsibility for compliance by its employees: 

1. IRS Information Technology Security Policy and Guidance. All current and new IRS 

contractor employees authorized staff-like (unescorted) access to Treasury/IRS owned or 

controlled facilities and information systems, or work, wherever located, on those contracts 

which involve the design, operation, repair or maintenance of information systems and access to 

sensitive but unclassified information shall comply with the IRS Information Technology 

Security Policy and Guidance, Internal Revenue Manual (IRM) 10.8.1 and IRS Publication 4812. 

A copy of IRM 10.8.1 is available at http://www.irs.gov/irm/. This requirement applies to 

contractors who are performing under contract using contractor-managed systems, including 

laptop computers, workstations, servers, and other IT resources) at contractor managed facilities. 

A copy of Publication 4812 is available at http://www.irs.gov/uac/Procurement. 

2. Access Request and Authorization. Within ten (10) business days after contract award or 

issuance of an Order, the contractor shall provide the COR and the Contractor Security 

Management (CSM), via email to CSM@irs.gov, a list of names of all applicable contractor and 

subcontractor employees and the IRS location(s) identified in the contract for which access is 

requested. A security screening, if determined appropriate by the IRS and in accordance with 

IRM 10.23.2, Contractor Investigations, and Department of the Treasury Security Manual (TD P) 

15-71, Chapter II, Section 2, will be conducted by CSM. Upon notification of a favorable 

adjudication of a security screening, the COR will complete an Online 5081 (OL 5081), 

Automated Information System (AIS) User Registration/Change Request, for each prime or 

subcontractor employee and require an electronic signature from each such employee indicating 

the contractor employee has read and fully understands the security requirements governing 

access to the Service’s IT systems. 

3. Remote Access. If the contract authorizes access to IRS IT systems, information, or assets 

remotely; that is, from the contractor or other facility, office, or site, the requirements of this 

clause governs, as well as the general guidance and specific security control standards in IRS 

Publication 4812, Contractor Security Controls. The contractor will be required to input data into 

a system, to be defined by the IRS, to describe the security controls being used to protect 

information. 

4. Contractor Acknowledgement. The contractor also acknowledges and agrees: (a) That 

employees must comply with all laws, IRS system security rules and security policies, standards, 

and procedures, and (b) That any one of its employees unsanctioned, negligent, or willful 

violation of the laws, system security rules, and security policies, standards, and procedures may 

result in the revocation of access to IRS information technology systems, immediate removal 

from IRS premises and the contract, and may be subject to arrest by Federal law enforcement 

agents. 

5. Limited Personal Use of Government IT Resources. 

a. Contractors, like Federal employees, have no inherent right to use Government IT resources 

and this policy does not create the right to use Government IT resources for nongovernmental
TOFS-16-D-0002

Page 41 of 72

purposes. See RM 10.8.27, Exhibit 10.8.27-1, Prohibited Uses of Government IT Resources, for 

specific examples of prohibited uses. See Title 5 - Code of Federal Regulations (CFR) - Part 734 

– Political Activities of Federal Employees, for specific examples of prohibited political 

activities. 

b. Any unauthorized use must be reported –within the first hour that it becomes known that an 

incident has occurred—to the COR, the Contracting Officer, and Situation Awareness 

Management Center (SAMC). SAMC shall be contacted by telephone at (866) 216-4802) or 

TTY at 800-877-8339. 

 Information about unclassified cyber security incidents of a sensitive nature shall be 

transmitted using secure messaging or alternative forms of encryption. 

 If the incident involves the loss, misuse, or unauthorized inspection of Sensitive but 

Unclassified (SBU) information, the contractor shall also report the incident/situation to the 

Treasury Inspector General for Tax Administration (TIGTA) hotline at 800-366-4484. 

6. Replacement Personnel. 

The CO, at his/her discretion, may require removal of the employee from performance under this 

or any IRS contract and may require replacement personnel with similar credentials within 5 

days of the notice to remove. Replacement personnel must be acceptable to the CO, in 

consultation with the COR. 

7. Monitoring Notification. 

IRS management retains the right to monitor both the content and the level of access of 

contractor employees’ use of IRS IT systems. Contractor employees do not have a right, nor 

should they have an expectation, of privacy while using any IRS information technology system 

at any time, including accessing the Internet or using e-mail. 

8. Security Reports and Information. 

If any reports are required, the COR may direct the submission of such reports and information 

through a specific IRS application, to be determined, or the entry of specific information into the 

application or system. 

9. Subcontracts. 

The Contractor shall incorporate this clause in all subcontracts, subcontract Task or delivery 

Orders or other subcontract performance instrument where the subcontractor employees will 

require access, use or operation of IRS information technology systems. 

(End of clause)

IR1052.224-9008 – Safeguards Against Unauthorized Disclosure of Sensitive but 

Unclassified Information (Oct 2012)

In performance of this contract, the contractor agrees to comply with the following requirements 

and assumes responsibility for compliance by its employees and subcontractors, as applicable:

(a) Definitions. As used in this clause—

“Information,” as defined by OMB Circular A-130 – Management of Federal Information 

Resources, means “any communication or representation of knowledge such as facts, data, 
TOFS-16-D-0002

Page 42 of 72

or opinions in any medium or form, including textual, numerical, graphic, cartographic, 

narrative, or audiovisual forms.” 

“Sensitive But Unclassified,” as described in the Department of the Treasury Security 

Manual (Treasury Directive Publication 15-71 (TD P 15-71), Chapter III – Information 

Security, Section 24 – Sensitive But Unclassified Information), is a term that “. . . originated 

with the Computer Security Act of 1987. It defined SBU as ‘any information, the loss, 

misuse, or unauthorized access to or modification of which could adversely affect the 

national interest or the conduct of Federal programs, or the privacy to which individuals are 

entitled under Section 552a of Title 5, United States Code (USC) (the Privacy Act) but 

which has not been specifically authorized under criteria established by an executive Order

or an act of Congress to be kept secret in the interest of national defense or foreign policy.’” 

Furthermore, “SBU shall be the primary term used to mark sensitive information 

originating in the Departmental Offices (DO)/bureaus. . . . Access to SBU shall be based 

on a determination that an employee, contractor personnel or consultant requires access to 

specific SBU information in Order to perform or assist in lawful, authorized DO/bureau 

Governmental functions . . .”1

 

SBU information may be categorized in one or more of the following groups—

(1) Returns and Return Information

Includes all information protected by § 6103 of the Internal Revenue Code (IRC), 26 

U.S.C. § 6103. 

(2) Sensitive Law Enforcement Information

Includes grand jury, informant, and undercover operations information.

(3) Employee Information

Includes all employee information covered by the Privacy Act of 1974 (5 U.S.C. 

552A (g)(1), as amended Examples include personnel, payroll, job applications, 

disciplinary actions, performance appraisals, drug tests, health exams and evaluation 

data. 

(4) Personally Identifiable Information (PII)

Includes the uniquely identifiable personal information of taxpayers, employees, 

contractors, applicants, and visitors to the IRS. However, names of federal 

employees when used for business purposes, along with employee business phone 

 1 For any pertinent Government publication or document that uses the term “Controlled Unclassified Information 

(CUI),” or the term “sensitive information,” either term, for the purposes of this clause, may be considered 

equivalent to and have the same meaning as “SBU information.” 
TOFS-16-D-0002

Page 43 of 72

numbers and business addresses are all considered publicly available information. 

Examples of PII include, but are not limited to—

• Name;

• Home address;

• Social Security Number;

• Date of birth;

• Home telephone number;

• Biometric data (e.g., height, weight, eye color, fingerprints, etc.); and

• Other numbers or information that alone or in combination with other data can 

identify an individual, or other personal information which is linked or linkable 

to an individual and can be used to distinguish or trace an individual's identity.

(5) Other Protected Information

Includes all information covered by the Trade Secrets Act (18 U.S.C. 1905), the 

Procurement Integrity Act (41 U.S.C. 423) (P.L. 111-350), and similar statues. 

Examples include, but are not limited to—

• Information considered procurement sensitive;

• Information marked Limited Official Use (LOU);

• Information marked Official Use Only (OUO);

• Law Enforcement Manuals (LEM)

• Records about individuals requiring protection under the Privacy Act;

• Information that is not releasable under the Freedom of Information Act (FOIA);

• Proprietary data (business information that does not belong to the IRS);

• Procurement sensitive data, such as contract proposals;

• Information which if modified, destroyed or disclosed in an unauthorized 

manner could cause: loss of life, loss of property or funds by unlawful means, 

violation of personal privacy or civil rights, gaining of an unfair procurement 

advantage by contractors bidding on Government contracts, or disclosure of 

proprietary information entrusted to the Government; or

• Security information containing details of serious weaknesses and vulnerabilities 

associated with specific systems and facilities; and 

• Other protected information includes information, which if improperly used or 

disclosed could adversely affect the ability of the agency to accomplish its 

mission. For contracting organizations providing IT support to the IRS, this 

includes specific IT configurations, where the system security configurations 

could identify the state of security of that system; IP addresses that allow the 

workstations and servers to be potentially targeted and exploited; and source 

code that reveals IRS processes that could be exploited to harm IRS programs, 

employees or taxpayers. 

“Live Data” is another form of Other Protected SBU information. It is primarily 

unmodified, non-sanitized data extracted from taxpayer files which identities specific 

individuals or corporate taxpayers. It includes taxpayer information, tax return 
TOFS-16-D-0002

Page 44 of 72

information, live employee data, PII, and other SBU information that is used outside of the 

authorized IRS production environment. The use of live data in testing environments is 

limited to tax administration or other authorized IRS purposes and may be disclosed only 

to those individuals with a need to know. The use of live data is strictly prohibited without 

approval from Privacy, Governmental Liaison and Disclosure (PGLD), Privacy and 

Information Protection, Privacy, Privacy Compliance and shall only be considered when it 

is impossible to create effective synthetic data, and then only in strict compliance with 

IRM 10.8.8 – Information Technology (IT) Security, Live Data Protection.

“IRS records or information” (or simply IRS information), as described in IRM 11.3.35 –

Requests and Demands for Testimony and Production of Documents, mean “any material 

(including copies thereof) contained in the files (including paper, electronic, or other 

media files) of the IRS, any information relating to material contained in the files of the 

IRS, or any information acquired by a current or former IRS officer, employee, or 

contractor, while an IRS officer, employee, or contractor as a part of the performance of 

official duties or because of that IRS officer’s, employee’s, or contractor’s official status 

with respect to the administration of the internal revenue laws or any other laws 

administered by or concerning the IRS.”

(b) Conditional or Controlled Release. 

(1) For solicitations— When the disclosure or release of returns, return information, or 

other SBU information is required to enable prospective offerors to fully evaluate 

the parameters of the work involved for a specific requirement, as allowed under 

IRM 11.3.24.5 (and such release has been pre-approved by the Business Operating 

Division (the Requisitioner) and concurred upon one level above the Contracting 

Officer (in consultation with Personnel Security, or the PGLD, Office of Privacy, or 

other appropriate organizational units)), prospective offerors shall be subject to this 

and any related Safeguard or Privacy Act clauses or provisions of the solicitation, 

and any related security controls or security restrictions and limitations described in 

the solicitation. Before or at the time of disclosure or release of returns, return 

information, or other SBU information during the solicitation phase of the 

acquisition, the IRS may determine that a pre-award on-site security inspection 

needs to be performed as a condition for disclosure or release. The solicitation will 

describe the steps to be taken if and when such an on-site security inspection is to be 

performed. 

When the IRS intends to issue a solicitation containing SBU information (and 

approved for release), it will usually accomplish this through the Government wide

Point of Entry (GPE) as transmitted via Federal Business Opportunities (also 

referred to as FedBizOpps or FBO). At FedBizOpps, a solicitation that does not 

contain sensitive information (and that is customarily available to the general public) 

is, in effect, a “FBO Solicitation.” Whereas, a solicitation that contains SBU 

information or controlled, unclassified documents (and is available only to 

authorized, registered users) is referred to by FedBizOpps as a “Non-FBO 

Solicitation.” Agency “buyers” can upload non-sensitive documents (and attach 
TOFS-16-D-0002

Page 45 of 72

existing controlled, unclassified documents to notices) and create Non-FBO 

solicitation links that create document packages that are not tied to FBO solicitations 

(parallels functionality previously found in the FedTeDS (Federal Technical Data 

Solutions), a defunct password-protected, web-based tool designed to safeguard the 

distribution of sensitive, unclassified, acquisition-related information for all federal 

agencies). The link then takes the vendor to a system interface where their 

authorization to review materials (explicit access / export controlled) is vetted prior 

to letting the vendor access the materials. A Government user can pro-actively 

select a vendor user for access, or a vendor can request, and be granted access, 

through this system. Before a vendor registers in FBO, it will need to obtain a Data 

Universal Numbering System (DUNS) Number. The DUNS Number is assigned by 

Dun & Bradstreet, Inc. (D&B) to identify unique business entities, and is obtained 

via the Central Contractor Registration (CCR) system accessed through the System 

for Award Management (SAM). When an explicit access or export control request 

is initiated, the Non-FBO system retrieves a vendor’s profile information directly 

from CCR/SAM. Once the vendor is given explicit access to review the package, 

they are an “authorized” party. 

In addition to (or as an alternative to) the use of Non-FBO solicitation, the IRS may 

choose to set up a “reading room” (or equivalent web site). In such instances, 

vendors will generally be required to go through a registration process with IRS and 

complete a Non-Disclosure Agreement (NDA), as conditions for being granted 

access to the reading room or site. The Contracting Officer and Contracting 

Officer’s Representative (COR) will monitor the full recovery of all returns, return 

information, or other SBU information disclosed or released to vendors/prospective 

offerors.

(2) For awarded contracting vehicles— SBU information shall only be released or 

accessible to those individuals who have been approved, by Personnel Security, for 

interim or final staff-like access2 (commensurate with their position sensitivity 

level), and have a bona-fide “need to know” in Order to perform the work required 

under the contract for which they have been granted access to such information. 

(c) Fitness and Suitability. The IRS reserves the right to determine the fitness or suitability of 

a contractor employee to receive or be assigned staff-like access under a contract, (or 

 2 “Staff-like access,” refers to unescorted physical or electronic access to IRS owned or controlled facilities, 

SBU information, or information systems, regardless of location, by contractor employees that have a 

completed, favorably adjudicated background investigation and whose duration of employee under the contract 

exceeds 180 days. This access is not unlimited however, and should only be given for the work in which the 

contract was awarded. “Interim staff-like access,” refers to staff-like access privileges that may be granted 

prior to the completion of the required background investigation. Due to the risk associated with granting stafflike access prior to the completion of the required background investigation, interim staff-like access may only 

be granted in cases where it has been determined that the risk is acceptable, and approval is granted by IRS, 

Personnel Security. 
TOFS-16-D-0002

Page 46 of 72

continue to have such privileges over the life of the contract) and to have access to SBU 

information and be permitted to perform (or continue to perform) under the contract if and 

when it is determined that the contractor employee poses a security risk or otherwise 

endangers performance. 

(d) Security Screening Precursor. All contractor employees that require staff-like access to 

SBU information or information systems in the performance of this contract (regardless of 

workplace or location), shall be subject to security screening and investigative processing, 

commensurate with the position sensitivity level, and in accordance with IRM 10.23.2, 

Contractor Investigations, and Department of the Treasury Security Manual (TD P) 15-71, 

Chapter II, Section 2. Contractor employees must be favorably adjudicated prior to starting 

work on the contract or before being granted staff-like access (or interim staff-like access, 

if approved by PS) to IRS information systems or SBU information. 

Pursuant to IR1052.204-9005 – Submission of Security Forms and Related Materials, the 

contractor shall coordinate security screening and related submissions with Contractor 

Security Management (CSM) (e.g., the Contradictor Risk Assessment Checklist), as 

described in P&P No. 39.1(C) – Managing Contractor Employee Access to IRS Owned or 

Controlled Facilities, Information Systems, or Sensitive But Unclassified (SBU) 

Information.

(e) Security Controls and Safeguards. The contractor shall employ effective technical, 

operational, and management safeguards or countermeasures to protect the confidentiality, 

integrity, and availability of SBU information and information systems, consistent with the 

requirements and objectives of the following statutory and regulatory requirements, and 

related Treasury or IRS directives, policy and guidance, to include, but not limited to, as 

applicable—

• E-Government Act of 2002 (P.L. 107-347) Title III, Federal Information Security Act 

of 2002 (FISMA); 

• Privacy Act of 1974 (5 U.S.C. 552A (g)(1), as amended;

• Internal Revenue Code, 26 U.S.C. § 6103; 

• 26 C.F.R., § 301.6103(n)-1Disclosure of returns and return information in connection 

with written contracts or agreements; 

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-

53 – Recommended Security Controls for Federal Information Systems and 

Organizations (as amended); 

• Federal Acquisition Regulation (FAR) (to include, but not limited to Part 24 –

Protection of Privacy and Freedom of Information and Part 39 – Acquisition of 

Information Technology);

• Department of the Treasury Security Manual (TD P 15-71);

• Department of Treasury Regulation (DTAR);

• Department of the Treasury Acquisition Procedures (DTAP); 

• Internal Revenue Manual (IRM) 10.2.13 – Information Protection; 

• IRM 10.8.1 – Information Technology (IT) Security, Policy and Guidance, 

• IRM 10.8.2 – IT Security Roles and Responsibilities,
TOFS-16-D-0002

Page 47 of 72

• Publication 4812 – Contractor Security Controls; 

• Internal Revenue Service Acquisition Procedure (IRSAP); and 

• Applicable FAR clauses or provisions, and local clauses or provisions contained in (or 

associated with) the IRSAP or IRS Policy and Procedures Memoranda. 

Safeguards should be proportional to the sensitivity of the information, and the context in 

which it is held, and the likelihood and severity of the harm threatened (which, on 

occasion, may vary in intensity (as will the response) according to the situation or 

circumstances). Safeguards shall be subject to periodic review and reassessment, and 

adjustment, as required or warranted, as determined by the IRS. 

(f) General Conditions for Allowed Disclosure. Any SBU information, in any format, made 

available to contractor personnel authorized and cleared to receive such information that is 

marked or that fits the definition and could be marked as SBU information (e.g., using 

identifying page markers or footers such as OUO or LUO, etc.), shall be used only for the 

purposes of carrying out the requirements of this contract. SBU information shall be 

treated as confidential and shall not be divulged or made known in any manner to any 

person except as may be necessary and allowed in the performance of the contract and then 

only to those who have also received a favorably adjudicated security screening and whose 

duties or responsibilities require logical and/or physical access to the SBU information in 

Order to perform under the contract and are authorized by law to have access to the SBU 

information. Inspection by or disclosure to anyone other than a duly authorized officer or 

employee of the contractor shall require prior written approval of the IRS. Requests to 

make such inspections or disclosures should be addressed to the cognizant Contracting 

Officer.

(g) Authority for Disclosure of Returns and Return Information. As allowed under 26 CFR 

301.6103(n)-1 (pursuant to the Internal Revenue Code (26 U.S.C. 6103(n)) and subject to 

the conditions and limitations set forth therein, for the SBU information category of 

Returns and Return Information—

(1) Officers and employees of the Treasury Department (and when applicable, a State 

tax agency, the Social Security Administration, or the Department of Justice) are 

authorized to disclose returns and return information (as defined in 26 U.S.C. 

§ 6103(b)), for the purposes of tax administration, to any person (i.e., which, for the 

purposes of this clause, is the contractor), to the extent necessary in connection with 

a written contract or agreement for the acquisition of—

(i) Equipment or other property; or

(ii) Services relating to the processing, storage, transmission, or reproduction of 

returns or return information, the programming, maintenance, repair, or 

testing of equipment or other property, or the providing of other services. 

(2) Any person, or officer or employee of the person who receives returns or return 

information (i.e., the contractor), may—
TOFS-16-D-0002

Page 48 of 72

(i) Further disclose the returns or return information to another officer or 

employee of the person whose duties or responsibilities require the returns or 

return information for a purpose described in the preceding paragraph; or 

(ii) Further disclose the returns or return information (e.g., to a subcontractor), 

when authorized in writing by the IRS, to the extent necessary to carry out the 

purposes described in the preceding paragraphs and as authorized by law. 

Disclosures may include disclosures to an agent or subcontractor of the 

person, or officer or employee of the agent or subcontractor.

(3) Pursuant to 26 CFR 301.6103(n)-1 (e) (1)), before a contractor can disclose return or 

return information to a subcontractor, the subcontractor must agree to permit an 

inspection by the IRS of its site or facilities, if the agency, at its discretion, makes 

such a request.

(4) Except as may be provided elsewhere in the contract, the contractor shall neither 

disclose the identity of the taxpayer (living or deceased) nor any element or aspect 

of said taxpayer’s return or return information, at any time, unless authorized in 

writing by the IRS –subject to the contractor clearly showing that such disclosure of 

such information is essential to successful performance of the contract. Requests to 

disclose the identity of the taxpayer, or any element or aspect of said taxpayer’s 

return or return information shall be addressed to the cognizant Contracting Officer. 

(h) Requests and Demands for Testimony and Production of Documents. Pursuant to 26 CFR 

301.9000-1 through 301.9000-7, IRS officers and employees, as well as contractors, are 

required to obtain prior approval before they may produce IRS records or information or 

testify in judicial or administrative proceedings in response to a demand (subpoena, notice 

of deposition, court Order, etc.). Delegation Order 11-2 (formerly DO-156. Rev. 17) –

Authority to Permit Disclosure of Tax Information and to Permit Testimony or the 

Production of Documents (IRM 1.2.49.3) sets forth the IRS officials who may authorize 

testimony or disclosure of IRS records or information in response to certain requests and 

demands for such information in accordance with applicable disclosure laws (e.g., IRC 

§6103, IRC §6104, IRC §6105, IRC §6110, IRC §4424, and the Privacy Act).

The contractor shall alert the COR to any requests or demands for IRS information and (in 

coordination with the COR) seek advice from the IRS Disclosure Office (headquarters or 

field office, as appropriate) or contact Ask Disclosure. The IRS Office of Disclosure, in 

consultation with and on the advice of IRS Office of Chief Counsel or other functional 

offices, as appropriate, or as specified in Delegation Order 11-2, will provide guidance –to 

include, whether the judicial or administrative proceedings will or will not require testimony 

authorizations, and what additional steps, if any, are necessary. IRM 11.3.35 – Requests 

and Demands for Testimony and Production of Documents provides additional guidance –to 

include when no testimony authorization is required in an IRS matter (e.g., when testimony 

or production of records is requested by Government counsel representing the IRS in an IRS 

matter).
TOFS-16-D-0002

Page 49 of 72

(i) Supervision. All work shall be performed under the supervision of the contractor or the 

contractor's responsible employees.

The contractor employee may commence work only upon notice of an interim or final 

approval for staff-like access, notice of revalidation of staff-like access for contractor 

employee transfers from one IRS contract/Order to another, or when escorted access is 

approved by an IRS official authorized to grant such access, and the escort will be provided 

by a qualified escort, as defined in IRM10.23.2 – Contractor Investigations, and is 

otherwise consistent with IRS security practices and related IRMs, to include, but not

limited to, IRM 1.4.6 – Managers Security Handbook, IRM 10.2.14 – Methods of 

Providing Protection, and IRM 10.8.1 - Policy and Guidance. As prescribed in IRM 

10.23.2, escorting in lieu of staff-like access for IT systems is not allowed. 

(j) Subcontractors. Subcontractors of the contractor are held to the same provisions, 

investigative requirements, and standards of conduct for handling and protecting SBU 

information as employees of the prime contractor. For the purposes of this clause (and the 

security and safeguard measures to be employed), the term “subcontractor” (and references 

to “subcontract”) shall include—

• Those in a traditional prime contractor-subcontractor relationship;

• Any person or agent of the prime contractor that has a role in providing services in 

performance or in direct support of the immediate contract; and 

• Any person or third-party service provider that while not necessarily providing 

services in performance or in direct support of the immediate contract, does otherwise 

provide services to the prime contract for daily operations or multiple activities that 

would give that individual(s) insight into or access to IRS information, or IRS or 

contractor information systems (at any level) that store or use IRS information (e.g., 

IT infrastructure support personnel). 

Any subcontract (or arrangement or outsourced service) that entails access to SBU 

information by the subcontractor shall include and flow down the substantially same 

provisions of this clause. No SBU information or work involving SBU information 

furnished under this contract shall be released to a subcontractor or subcontracted out 

without the specific approval of the Contracting Officer (which, for returns and return 

information, must be in writing), and the completion of appropriate background 

investigations and clearances for all subcontractor employees to be given access to such 

information. 

In addition, for return and return information, pursuant to 26 CFR 301.6103(n)-1 (e) 

(3), the contractor shall make the proposed contract or agreement with the subcontractor 

available to the IRS before execution of any new contract or agreement. And shall make 

any existing contract or agreement that incorporates this clause, by modification, available 

upon request.

(k) Accounting for SBU Information. The contractor shall ensure adequate security (that which 

is necessary to ensure the security objectives of confidentiality, integrity and availability 

are met) is provided for all IRS information that is collected, processed, transmitted, stored, 
TOFS-16-D-0002

Page 50 of 72

or disseminated –irrespective of ownership of the information system or infrastructure in 

use—and that the security is commensurate with the risk and magnitude of harm that could 

result from the loss, misuse, or unauthorized access to or modification of such information. 

All SBU information, regardless of form or format, shall be accounted for upon receipt and 

properly stored before, during, and after use, handling or processing. This shall include 

accounting for and maintaining inventories on all registers, ledgers, software, programs, 

online tools, hardware, peripherals, copiers or other “electronic and information technology 

(EIT)” as defined in FAR Part 2 that are used to (or can) log, store, deposit, record, cache, 

retain, or preserve SBU information. In addition, all related output, deliverables, or 

secondary or incidental by-products generated directly or indirectly from the source 

material shall be given the same level of protection as required for the source material. 

(l) Internal Revenue Code Confidentiality and Penalty Provisions. Confidentiality 

requirements for tax returns and return information are established by Section 6103 of the 

Internal Revenue Code (26 U.S.C. 6103) and the penalties for unauthorized access and 

disclosure of returns and return information are found in Sections 7213, 7213A and 7431 of 

the Internal Revenue Code (26 U.S.C. 7213, 7213A and 7431). The willful unauthorized 

access (commonly referred to as UNAX) or inspection of any taxpayer records including 

hard copies of returns and return information as well as taxpayer information maintained 

on a computer is covered by all of these statutes collectively. Unauthorized access or 

inspection of taxpayer returns and return information (even if the information is not 

disclosed) is unlawful. 

(m) The Privacy Act. The general purpose of the Privacy Act of 1974, as amended (5 U.S.C. § 

552a) is to balance the Government's need to maintain information about individuals with 

the rights of the individuals to be protected against unwarranted invasions of their privacy. 

The Privacy Act establishes special requirements for the Executive Branch of Government

when collecting, creating, maintaining, and distributing records that can be retrieved by the 

name of an individual or other identifier (whether in paper or electronic form). It applies to 

information on individuals. 

(n) Training. Contractor employees who require staff-like access to SBU information or 

information systems to perform their job duties and responsibilities under the contract, 

regardless of their physical location or workplace, must have received a favorably 

adjudicated IRS background investigation, and thereafter, shall complete one or more 

Information Protection briefings (on an annual basis) on computer security, disclosure, 

privacy, physical security, and/or UNAX, as specified by CSM –commensurate with the 

assigned risk designations of the position for the work being performed and the category of 

SBU information to which the employee has access. Individually and collectively, these 

briefings make up the IRS Security Awareness Training (SAT) requirements for the 

Service’s information assets, as described in IRSAP clause 1052.204-9003 – IRS Security 

Awareness Training –which must be completed when first assigned, and annually 

thereafter. 

Contractor employees performing in trusted roles that entail significant responsibility for 

information security, as described in NIST SP 800-53 – Recommended Security Controls 
TOFS-16-D-0002

Page 51 of 72

for Federal Information Systems and Organizations (Revision 3 (AUG 2009)) (*Errata as 

of May 1, 2010*), NIST Special Publication 800-16 (Rev1), Information Technology 

Security Training Requirements: A Role- and Performance-Based Model, Treasury 

Directive Publication (TD P) 85-01 –Treasury Information Technology Security Program 

(Volume 1), Appendix H, IRM 10.8.1 – Information Technology (IT) Security, Policy and 

Guidance, and IRM 10.8.2 – IT Security Roles and Responsibilities, (e.g., CIO, CISO, 

System Administrator, etc.) may be subject to additional, annual requirements for 

completion of specialized/role-based training, as may be established by IT, Cybersecurity, 

Security Risk Management. 

(o) Non-Disclosure Agreement (NDA). Consistent with TD P 15-71, Chapter II, Section 2, 

and IRM 10.23.2, each contractor employee who requires access to SBU information shall 

complete, sign and submit to Personnel Security –through the CO (or COR, if assigned)—

an approved NDA. Only contractor employees that have completed NDA and SAT 

requirements, and have a “bona fide need to know,” shall be assigned to and permitted to 

perform work on contracts/Orders that entail contractor access to SBU information or IRS 

information systems. Furthermore, the IRS reserves the right to revoke access privilege 

when the disclosure of the information may compromise the interest of the agency or if the 

Service determines that such disclosure would identify a confidential informant or 

seriously impair a civil or criminal tax investigation.

(p) Encryption. All SBU information must be protected at rest, in transit, and in exchanges 

(i.e., internal and external communications). The contractor shall employ encryption 

concepts to ensure the confidentiality and integrity of the SBU information. Unless more 

stringent or specific, minimum security requirements are required elsewhere under the 

contract, the following safeguards and standards, consistent with security controls under 

NIST SP 800-53 (or IRM 10.8.1 or Publication 4812, as applicable), are indicative of the 

level and type of encryption safeguards and protective measures to be employed—

• Ensure all disk areas for all computers containing SBU information are encrypted (e.g., 

by using an Encrypted File System (EFS)).

• Store SBU information on hard disks, but only if contractor-approved security access 

control devices (hardware/software) have been installed, are receiving regularly 

scheduled maintenance, including upgrades, and are being used. 

• Access control to SBU information stored on systems shall include password security, 

an audit trail, encryption, virus detection, and, as appropriate, information overwriting 

capabilities.

• Identify an alternate storage site to retain backup media, in the event the information 

must be recovered. All backup data that contains SBU information must be encrypted.

• All mobile computing devices shall require and have full disk encryption. This 

includes, but is not limited to, IT resources, including computers, servers, laptop 

computers, removable Compact Disk (CD) and Digital Video Device (DVD) media, 
TOFS-16-D-0002

Page 52 of 72

thumb drives, or any media that can be used to house IRS data that can be easily 

transported by an individual. All data that resides on removable media must be 

encrypted to comply with Federal Information Processing Standards Publication (FIPS 

Pub) 140-2 – Security Requirements For Cryptographic Modules.

• Electronic, optical and other removable media shall be kept in a secured area under the 

immediate protection and control of an authorized employee or locked up. When not 

in use, the media shall be promptly returned to a proper storage area/container.

• Protect and control information system media during transport outside of controlled 

areas and restrict the activities associated with transport of such media to employees 

with an IRS approved interim or final background investigation. 

• The contractor must sanitize information, digital, optic, and paper, prior to disposal or 

release for reuse. Optical mass storage media, including compact disks (CD, CD-RW, 

CD-R, and CD-ROM), optical disks (DVD) and magnetic-optic (MO) disks must be 

destroyed by pulverizing, cross-cut shredding or burning. Destruction of media must 

be conducted only by trained authorized personnel. A log must be maintained to 

provide a record of media destroyed. The log must include, at a minimum, (i) the date 

of destruction; (ii) content of media; (iii) identifying serial number or other tracking 

number, if applicable; (iv) type of media (CD, cartridge, etc.); (v) media destruction 

performed; (vi) personnel performing the destruction; (vii) and witness(es) to the 

destruction. 

• When SBU information is transmitted across internal and external networks, 

cryptography (symmetrical or asymmetrical key encryption) should be employed 

(unless otherwise protected by alternative physical measures (e.g., protected 

distribution systems)), or in the case where the contractor is relying on a commercial 

service provider for transmission services as a commodity rather than a fully dedicated 

service, the contractor shall employ appropriate compensating security controls. The 

information system must perform all cryptographic operations using FIPS Pub 140-2

validated cryptographic modules with approved modes of operation. A list of NIST 

validated modules is available at the following link: 

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm#765. 

• When exchanging SBU information through email or network protocols, encryption 

shall be used. For routine email with IRS, contractors with access to IRS systems shall 

apply for access privileges to and use Secure Registration Based Email (SRBE); and 

contractors without access to SRBE shall use an approved application for digitally 

encrypting e-mail messages and attachments for transmission. File compression 

products must be FIP140-2 compliant (e.g., SecureZip). For those contracts that 

routinely require bulk computer-to-computer file transfers, the contractor shall 

coordinate with the COR and the IT, Enterprise Operations, Enterprise Computing 

Center, Mainframe Operations Branch, File Transfer Section on a Secure Data 

Transfer (SDT) solution. 
TOFS-16-D-0002

Page 53 of 72

• The physical environment and the security of that environment must also be addressed 

to ensure adequate protection of both paper based SBU information and SBU 

information in electronic form. Whenever possible, computer operations must be in a 

secure area with restricted access. In situations such as home work sites, remote 

terminals, or office work sites where all of the requirements of a secure area with 

restricted access cannot be maintained, the equipment shall receive the highest level of 

protection that is practical. Minimum physical security requirements must be met, 

such as keeping SBU information locked up when not in use. Removable media also 

must be encrypted and labeled SBU information when it contains such information.

(q) Use of Personally-Owned and Other Non-Government Furnished Equipment. In 

accordance with IRM 10.8.1.5.2.8 – Personally-Owned and Other Non-Government

Furnished Equipment, non-Government furnished IT equipment includes personally owned 

and contractor-owned IT equipment (e.g., laptops, PDAs, workstations, digital media, 

monitors, servers, routers, firewalls).; and personally owned equipment shall include all 

individually owned systems, devices, software, and media (e.g., thumb drive, CD, 

removable hard drive). 

Information that has been determined to have a potential impact –on organizations or 

individuals— rating of High for any security objective (confidentiality, integrity, or 

availability), as described in FIPS 199 – Standards for Security Categorization of Federal 

Information and Information Systems, shall not be stored, processed, accessed, or 

transmitted using personally-owned equipment.

Personally owned equipment shall not be used to process, access, or store 

sensitive/classified information, nor shall it be connected to IRS systems and networks 

directly or via Virtual Private Network (VPN). 

Contractors and vendors of the IRS using contractor-furnished IT equipment shall ensure 

the equipment meets the minimum security requirements detailed in the IRS 

contract/statement of work. Refer to the Contractors and Outsourced Operations section of 

IRM 10.8.1 and IRM 10.8.2 for additional detailed information. 

Government-furnished equipment (e.g., thumb drives, laptop, printer) shall not be 

connected to non-Government furnished equipment.

Approvals by the Senior Agency Information Security Officer (SAISO)/Chief Information 

Security Officer (CISO) and Authorizing Official (AO) are required for connection of 

personally-owned or contractor-owned IT devices to IRS systems or networks.

Refer to IRM 10.8.1.5.2.8 for additional guidance on use or exceptions on use of 

Personally-Owned and Other Non-Government Furnished Equipment. and IRM 10.8.26 –

Laptop Computer Security Policy for guidance on minimum security controls to safeguard 

laptops. 
TOFS-16-D-0002

Page 54 of 72

(r) Special Handling or Delivery of SBU information or Work Products Containing SBU 

Information. Reserved. 

(s) Notification Requirement on Prohibitions and Penalties for Unauthorized Disclosure or 

Misappropriation of SBU Information (in general), Unauthorized Inspection or Disclosure 

Specifically for Returns and Return Information, and Improper Disclosure of Information 

Subject to the Privacy Act. 

(1) Each officer or employee of the contractor or subcontractor at any tier to whom SBU 

information may be made available or disclosed shall be notified in writing by the 

contractor that SBU information disclosed to such officer or employee can be used 

only for a purpose and to the extent authorized herein, and that further disclosure of 

any such SBU information, by any means, for a purpose or to an extent unauthorized 

herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. 

Sections 641 and 3571. Section 641 of 18 U.S.C. provides, in pertinent part, that 

whoever knowingly converts to his use or the use of another, or without authority 

sells, conveys, or disposes of any record of the United States or whoever receives 

the same with the intent to convert it to his use or gain, knowing it to have been 

converted, shall be guilty of a crime punishable by a fine or imprisoned up to ten 

years or both.

(2) Each officer or employee of any person (contractor or subcontractor) at any tier to 

whom returns or return information is or may be disclosed shall be notified in 

writing by the person (contractor or subcontractor) that returns or return information 

in any format disclosed to such officer or employee can be used only for a purpose 

and to the extent authorized herein, and that further disclosure of any such returns or 

return information for a purpose or to an extent unauthorized herein constitutes a 

felony punishable upon conviction by a fine of as much as $5,000 or imprisonment 

for as long as five years, or both, together with the costs of prosecution. Such 

person (contractor or subcontractor) shall also notify each such officer and employee 

that any such unauthorized future disclosure of returns or return information may 

also result in an award of civil damages against the officer or employee in an 

amount not less than $1,000 with respect to each instance of unauthorized 

disclosure, and, in the case of willful disclosure or a disclosure which is the result of 

gross negligence, punitive damages, plus the cost of the action. These penalties are 

prescribed by IRC Sections 7213 and 7431 and set forth at 26 CFR 301.6103(n)-1.

(3) Each officer or employee of any person (contractor or subcontractor) to whom 

returns or return information is or may be disclosed shall be notified in writing by 

such person that any return or return information made available in any format shall 

be used only for the purpose of carrying out the provisions of this contract and that 

inspection of any such returns or return information for a purpose or to an extent not 

authorized herein constitutes a criminal misdemeanor punishable upon conviction by 

a fine of as much as $1,000.00 or imprisonment for as long as 1 year, or both, 

together with the costs of prosecution. Such person (contractor or subcontractor) 

shall also notify each such officer and employee that any such unauthorized 
TOFS-16-D-0002

Page 55 of 72

inspection of returns or return information may also result in an award of civil 

damages against the officer or employee in an amount equal to the sum of the 

greater of $1,000.00 for each act of unauthorized inspection with respect to which 

such defendant is found liable or the sum of the actual damages sustained by the 

plaintiff as a result of such unauthorized inspection plus in the case of a willful 

inspection or an inspection which is the result of gross negligence, punitive 

damages, plus the costs of the action. The penalties are prescribed by IRC Sections 

7213A and 7431.

(4) Additionally, it is incumbent upon the contractor to inform its officers and 

employees of the penalties for improper disclosure imposed by the Privacy Act of 

1974, 5 U.S.C. 552a. Specifically, 5 U.S.C. 552a(I)(1), which is made applicable to 

contractors by 5 U.S.C. 552a(m)(1), provides that any officer or employee of a 

contractor, who by virtue of his/her employment or official position, has possession 

of or access to agency records which contain individually identifiable information, 

the disclosure of which is prohibited by the Privacy Act or regulations established 

there under, and who knowing that disclosure of the specific material is so 

prohibited, willfully discloses the material in any manner to any person or agency 

not entitled to receive it, shall be guilty of a misdemeanor and fined not more than 

$5,000.

Note: Contractors must make employees aware that disclosure restrictions and penalties 

apply even after the contract is completed, as well as after employment with the contractor 

has ended. 

(t) Incident 3 and Situation Reporting. Contractor employees should be advised to contact 

their manager, supervisor or contractor-designated person or office within the first hour

that it becomes known, that an information system or SBU information has been 

compromised (e.g., inspected or disclosed without authorization or disclosed to an 

unauthorized party, loss or stolen, misdirected, intercepted, hacked, etc.) or other situation 

has taken place that poses an imminent threat (or resulted in actual harm) to persons or 

property. Within the first hour, the contractor shall report the incident/situation to 

the COR (or the CO or other backup when the COR is unavailable). A key aspect of 

incident management is the timely reporting of significant conditions or situations. Prompt 

reporting is essential in Order to advise all levels of management of conditions that affect 

the operation of the Service as well as to allow analysis of current information. 

Concurrent with its reporting it to the COR, the contractor shall report 

incidents/situations as follows 24x7x365—

• All physical security incidents or situations that pose an imminent danger or threat to 

persons or property (e.g., situations that may require evaluation, containment or shelter-

 3 An “incident,” as defined by NIST Special Publication 800-61, Computer Security Incident Handling Guide, 

Revision 1, March 2008, “is a violation or imminent threat of violation of computer security policies, acceptable use 

policies, or standard security practices.” Adverse events may include the loss of data confidentiality, disruption of 

data or system integrity, disruption or denial of availability, loss of accountability, or damage to any part of the 

system. 
TOFS-16-D-0002

Page 56 of 72

in-place, or medical attention) should be reported to the Situation Awareness 

Management Center (SAMC) through any of the following methods: 

o Telephone: (202) 283-4809 (local) or toll free hotline at (866) 216-4809 

o Fax: (202) 283-0345

o E-mail: samc@cirsc.irs.gov ,

As appropriate, also contact local emergency personnel or authorities (e.g., police, fire 

department, EMT, or on-site personnel with related training or responsibilities). 

• All cyber security incidents or losses of CIA shall be reported to the Computer Security 

Incident Response Center (CSIRC) through any of the following methods:

o Telephone: (202) 283-4809 (local) or toll free hotline at 866-216-4809 (or (or 

TTY access (Federal Relay Services) 1-800-877-8339)

o Fax: (202) 283-0345 

o Online: https://www.csirc.web.irs.gov/incident/ 

o E-mail: csirc@csirc.irs.gov 

Information about unclassified cyber security incidents of a sensitive nature shall be 

transmitted using secure messaging or alternative forms of encryption. 

• In addition, if the SBU information is or involves returns or return information, or 

threatens the safety or security of personnel or information systems, the contractor shall 

report the incident/situation to the Treasury Inspector General for Tax Administration 

(TIGTA) hotline at 800-366-4484. 

The contractor shall also take action to minimize damage or neutralize the potential for 

further compromise, and thereafter take appropriate, prudent steps to prevent recurrence, or 

protect the safety of others. 

(u) Administrative Remedies. Unauthorized inspection(s) or disclosure(s) of SBU by the 

contractor or its employees, agents or subcontractors, may be considered a breach of the 

contract. In the event such incidents occur, or when it is determined the contractor has 

failed to satisfy the safeguard or privacy provisions of the contract and immediate remedial 

or corrective action cannot be taken by the contractor (or the remedial or corrective action 

is inadequate or ineffectual), the Contracting Officer may suspend further disclosures of 

SBU information, invoke the Default clause of the contract (e.g., FAR clause 52.249-8 -

Default (Fixed-Price Supply and Service)), incorporated into the contract by reference, or if 

a termination for default or cause is not in the best interest or the Government, may elect to 

pursue a termination for convenience (under the clause of that class incorporated into the 

contract by reference), or employ other administrative remedies available to the 

Government. 

(v) Dispositioning SBU Information. As a general rule, it is contrary to the Internal Revenue 

Code and the general operating policies of the IRS to allow a contractor to retain returns or 

return information or other categories of SBU information, or federal records released to 

the contractor in performance of the contract (or created as a result of the contract), after 
TOFS-16-D-0002

Page 57 of 72

the purposes of (or objectives and service requirements under) the contract have been 

satisfied, or its term complete. 

All SBU information processed during the performance of this contract, or to which the 

contractor was given access (as well as all related output, deliverables, or secondary or 

incidental by-products, information or data generated by the contractor or others directly or 

indirectly from the source material), regardless of form or format,4 shall be completely 

purged from all data storage components of the contractor’s facility(s) and computer 

systems, and no SBU information will be retained by the contractor either—

(i) when it has served its useful, contractual purpose, and is no longer needed to meet the 

contractors contractual obligations to the IRS, 

(ii) at the time the IRS work is completed or when the contract expires (whichever comes 

first), or 

(iii) if and when the contract is terminated (for convenience, default, or cause). 

Similarly, any mobile computing devices, EIT equipment and devices, removable storage 

devices, and optical storage devices shall be purged of SBU information, and any [partial 

or complete] hard copy printouts, duplications or transcriptions of SBU information shall 

be given to the IRS Contracting Officer or his/her designee (e.g., COR), or destroyed, as 

provided in the contract or instructed by the Contracting Officer. 

The contractor shall maintain records on the methods, times and places of disposal or 

destruction of SBU information. 

Typically, exemptions to retain information/data/records beyond the term of the contract 

are limited to situations in which certain data elements cannot be immediately and 

completely expunged as a result of technical difficulties. 

(Note: Exemptions would not include conditions such as a contractor’s needs to retain 

information/data/records in Order to comply with industry protocols or standards, or state 

licensing or practitioner requirements.) 

If immediate purging of all data storage components is not possible, the contractor shall 

make application to the Contracting Officer to retain the SBU information for an additional 

period and provide the following (for the initial and any subsequent applications)—

(i) The basis for why the SBU information cannot (or should not) be purged at the 

conclusion of the contract and needs to be retained for the projected retention period 

(which, for approval purposes, is typically limited to technical difficulties 

experienced or anticipated with immediate expunging/dispositioning);

 4 In accordance with IRM 1.15.1.1, “. . . under the statutory definition of ‘Federal Records.’ Records are considered 

media (or format) neutral. Consequently, procedures for records and information management apply to official 

IRS recorded information in all format types. See Title 44 U.S.C. §2901(2) for a definition of ‘Records 

Management,’ and §3301 for a definition of ‘Federal Records.’"
TOFS-16-D-0002

Page 58 of 72

(ii) Written assurances to the Contracting Officer that any SBU information remaining in 

any storage component will be safeguarded to prevent unauthorized inspection or 

disclosure, and the protective measures that will be implemented to safeguard SBU 

information (e.g., locked containers, encrypted files, limited role-based access, etc.);

(iii) A projected retention period or timeline on how long the information may need to be 

retained; and

(iv) If and when requested, any additional information the IRS may need to make its 

determination to allow (or not allow) the contactor to retain the SBU information at 

issue.

The Contracting Officer, in consultation and coordination with the end user (originating 

office)/Business Operating Division, Privacy, Disclosure and appropriate Service 

components with security related functions or responsibilities, will advise the contractor of 

the agency’s decision. Approval to retain SBU information beyond the period when it 

should normally have been returned, purged, destroyed, or otherwise disposed or 

dispositioned, as instructed, shall be at the sole discretion of the IRS. Approval, if given, 

may be affected by the parties, as determined appropriate, under the existing contracting 

vehicle, or by entering into a separate, written Memorandum of Understanding or 

Agreement that will establish the period of the hold/retention (forbearance on the 

immediate return of SBU information), and the terms and conditions of such an agreement 

(to include elements presumably similar to those in the subject contract with respect to 

safeguarding SBU information, and the criminal or civil sanctions the vendor may be 

subject to for unauthorized disclosure or inspection of the held/retained SBU information, 

or for its loss, theft, or alteration without proper IRS authorization). 

Even in those rare instances when an exemption is allowed, the Service’s limits of patience 

in the time and effort necessary for expunging (or otherwise properly disposing of) its 

data/information should not be tested, and its insistence on full, complete and timely 

compliance is not subject to negotiation. 

Failure to return all SBU information to the IRS–to include derivative works produced in 

performance of the contract—or provide verification, to the satisfaction of the IRS, of the 

comprehensive removal of SBU information and successful purging of said SBU 

information from the contractor’s information systems and equipment (at either the end of 

the contract or any subsequent period allowed for) as requested or demanded by the 

Government, may subject the contractor to the full extent of rights and remedies available 

to the Government under the contract still in effect, or if appropriate, penalties or 

punishments provided by law. For example, the Contracting Office may explore 

withholding or delaying final payment, as may be allowed under payment-related contract 

clauses, as one administrative remedy to ensure compliance; or as appropriate, rate past 

performance assessments to reflect any failure to comply; or, when justified, pursue 

criminal or civil penalties provided by law for unauthorized inspection or disclosure of 

SBU information or violations of Privacy Act protections or requirements for handling 

federal records. 
TOFS-16-D-0002

Page 59 of 72

(w) Other Safeguards. [Insert any additional disclosure safeguards provided by the 

requisitioner or that the Contracting Officer determines are necessary and in the best 

interest of the Government and not addressed elsewhere in the contract.]

(End of Clause)

IR1052.224-9009 – IRS Information Protection and Security Awareness Training

Requirements (Jun 2013)

The Federal Information Security Management Act of 2002 (FISMA) requires each federal 

agency to provide periodic information security awareness training to all employees

(including contractor and subcontractor) involved in the management, use, or operation of

Federal information and information systems. In addition, contractors (including

subcontractor) and their employees are subject to the Taxpayer Browsing Protection Act of

1997, which prohibits willful unauthorized inspection of returns and return information.

Violation of the Act could result in civil and criminal penalties.

(a) The contractor must ensure all contractor (including subcontractor) personnel complete

one or more Information Protection briefings on computer security, disclosure, privacy,

physical security, and/or unauthorized access to taxpayer accounts (UNAX), as specified by

Contractor Security Management (CSM). CSM can be reached at 

awss.csm.training@irs.gov. Individually and collectively, these briefings make up the IRS

Security Awareness Training (SAT) requirements for the Service’s information assets. 

Exception: Contractor personnel (including subcontractors) performing under IRS

contracts with Nonprofit Agencies Employing People Who Are Blind or Severely Disabled

(as described in FAR Subpart 8.7) are exempted from the aforementioned SAT

requirements, unless the contractor requests SAT, or there is a compelling justification for 

requiring the training that is approved by the Contracting Officer (CO), in consultation with

CSM. An example of this would be in an instance where a visually impaired employee is 

assigned to perform systems development and has potential staff-like access to IRS 

information.

(i) Security Orientation

All new contractor personnel must attend a system security orientation within the first 10

business days following initial assignment to any IRS contract, order, or agreement, and

any additional IT SAT (commensurate with the individual’s duties and responsibilities)

within five business days of being granted access to an IRS, contractor, or subcontractor

facility or system that processes IRS sensitive but unclassified (SBU) information. The

Security Orientation will also be attended by new contractor personnel, including:

o Subcontractor personnel, who are authorized under contract to access IRS SBU 

information, IT systems, data; and

o Subcontractor personnel, who are authorized under contract to handle or access 

IRS SBU, contractor managed IT systems or IT assets used for the purpose of

performing IRS work, regardless of where work is performed.

(ii) Access to SBU Information and IT Systems SAT
TOFS-16-D-0002

Page 60 of 72

Contractor personnel, including subcontractor personnel, required to complete SAT include,

but are not necessarily limited to, those involved in any of the following activities:

 Manage, program or maintain IRS information in a production environment;

 Manage, program, or maintain IRS information in a development 

environment, either IRS owned or contractor owned/managed;

 Perform systems administration for either IRS systems or contractor managed 

resources, regardless of where IRS work is being performed;

 Operate an information system on behalf of the IRS on IRS systems or 

contractor (including subcontractor) managed systems;

 Conduct testing or development of information or information systems on 

behalf of the IRS on IRS systems or contractor (including subcontractor) managed

systems;

 Provide advisory and assistance (consulting) services, or administrative 

support; or

 Handling, processing, access to, development, backup or any services to 

support IRS.

(iii) Service Personnel Security Awareness Training

Contractor personnel providing services in the following categories are required to complete

Physical Security & Emergency Preparedness (PSEP) Training:

 Medical;

 Cafeteria;

 Landscaping;

 Janitorial and cleaning (daylight operations);

 Building maintenance; or

 Other maintenance and repair.

(iv)Service Personnel Inadvertent SBU Access Training

Contractor personnel performing: (i) janitorial and cleaning services (daylight operations), (ii) 

building maintenance, or (iii) other maintenance and repair and need access to IRS facilities

and building wherein pipeline processing (the processing of paper tax returns) is performed or 

where the facility and building has an exemption to the clean desk policy authorized by PSEP,

are required to complete Inadvertent SBU Access training. Facilities performing pipeline

processing and/or have an exemption to the clean desk policy are:

Clean Desk Waiver Facilities

Facilities Address

KY2032 333 Scott St., Covington, KY 41001

KY3005 300 Madison Ave., Covington, KY

MI1951 985 Michigan Ave., Detroit, MI 48226

MN160 30 East Seventh St., St. Paul, MN

TX2225 2191 WWoodward St., Austin, TX
TOFS-16-D-0002

Page 61 of 72

Pipeline Processing Facilities:

Facilities Address

CA4664 Fresno Campus, 5045 E. Butler, Fresno, CA 93727

CA7370 1950 G Street, Fresno, CA 93706

CA6530 1000 N. Mooney St., Tulare, CA 93274

KY0085 Covington Campus, 200 West Fourth St., Covington, KY

KY3016 7125 Industrial Rd., Florence, KY 41042

MO1937 Kansas City Campus, 33 W. Pershing Rd., Kansas City, MO

TX2038 Austin Campus, 3651 S IH-35, Austin TX 78741

TX2746 5015 S IH-35, Austin TX 78741

UT0036 Ogden Campus, 1160 W 1200 S, Ogden, UT 84409

UT1430 1973 North Rulon White Blvd., Ogden, UT 84404

UT1476 1125 W 12th St., Ogden, UT 84201

(Note: The facilities listed above can change annually and are only authorized for one

year.)

(v) Training Certificate/Notice

The contractor must submit confirmation of completed SAT by either: A)

Using form 14616 located at:

http://core.publish.no.irs.gov/forms/internal/pdf/66610g14.pdf for 

those who take training other than online; or

B) Certifying online at the Mandatory Briefing website awss.csm.training@irs.gov,

with a copy to the CO and Contracting Officer’s Representative (COR), upon

completion, but not later than 10 business days after starting performance under the

contract/order. If required by the COR, the contractor may be required to input data

into a system, to be defined by the IRS, to describe the security controls being used to

protect information, including confirmation of security awareness training.

(vi) Annual Training

For contracts/orders/agreement exceeding one year in length, either on a multiyear or on 

multiple year basis, contractor must ensure that personnel complete SAT annually no later

than October 31st of the current calendar year. The contractor must submit confirmation

of completed annual SAT on all personnel assigned to this contract/order/agreement, via

email, to the CO, COR, and CSM upon completion,

but no later than November 15thof the current calendar year or as requested by

CSM (whichever date is earlier).

(b) SAT is available on the Mandatory Briefing web site http://elearning.web.irs.gov/Briefings/Contractors/contractor.html; or if this site is not 

accessible, SAT materials will be made available by CSM at 

awss.csm.training@irs.gov.

(c) Contractor’s failure to comply with IRS security policy (to include completion and 

certification of SAT requirements within the timeframe specified) may be subject to 
TOFS-16-D-0002

Page 62 of 72

having access to IRS IT systems and facilities suspended, revoked or terminated 

(temporarily or permanently).

[End of Clause]

IR1052.239-9014 Information Systems and Information Security Controls for Contracting 

Actions Subject to Internal Revenue Manual (IRM) 10.8.1 (Jun 2013) 

In performance of this contract, the contractor agrees to comply with the following requirements 

and assumes responsibility for compliance by its employees and subcontractors (and their 

employees): 

(a) General. The contractor shall ensure IRS information and information systems are protected 

at all times. The contractor shall develop, implement, and maintain effective controls and 

methodologies in its business processes, physical environments, and human capital or personnel 

practices that meet or otherwise adhere to the security controls, requirements, and objectives 

described in applicable security control guidelines, and their respective contracts. 

(b) IRM 10.8.1 Applicability. (b) IRM 10.8.1 Applicability. This contract action is subject to 

Internal Revenue Manual (IRM) Part 10.8.1 – Information Technology (IT) Security, Policy and 

Guidance. The contractor shall adhere to the general guidance and specific security control 

standards or requirements contained in IRM 10.8.1. While the IRM 10.8.1 shall apply to the 

requirements to access systems, IRS Publication 4812, Contractor Security Controls, shall also 

govern. It will address the requirements related to physical and personnel security that must 

continue to be maintained at contractor sites. 

(c) Based on Title III of the E-Government Act of 2002 (Public Law 107-347), also known as the 

Federal Information Security Management Act of 2002 (FISMA), and standards and guidelines 

developed by the National Institute of Standards and Technology (NIST), IRM 10.8.1 provides 

overall security control guidance for the IRS, and uniform policies and guidance to be used by 

each office, or business, operating, and functional unit within the IRS that uses IRS information 

systems to accomplish the IRS mission. 

(d) Contractor Security Representative. The contractor shall assign and identify, in its offer, a 

Contractor Security Representative (CSR) and alternate CSR to all contracts requiring access to 

IRS information, information technology and systems, facilities, and/or assets. The CSR is the 

contractor’s primary point for the Government on all security-related matters and the person 

responsible for ensuring the security of information and information systems in accordance with 

the terms and conditions of the contract and all applicable security controls. If required by the 

COR, the contractor will be required to input data into a system, to be defined by the IRS, to 

describe the security controls being used to protect information. 

(e) Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or 

arrangements or outsourced service agreements) that entail access to SBU information by a 

subcontractor or agent, at any tier, the substantially same Federal Acquisition Regulation (FAR) 

and local security or safeguard clauses or provisions for protecting SBU information or 

information systems that apply to and are incorporated in its prime contract with IRS. 
TOFS-16-D-0002

Page 63 of 72

(End of clause)

IR1052.239-9015 Information Systems and Information Security Controls for Contracting 

Actions Subject to Publication 4812 (Jun 2013) 

In performance of this contract, the contractor agrees to comply with the following requirements 

and assumes responsibility for compliance by its employees and subcontractors (and their 

employees): 

(a) General. The contractor shall ensure IRS information and information systems (those of the 

IRS and/or the contractor, as appropriate) are protected at all times. In order to do so, the 

contractor shall develop, implement, and maintain effective controls and methodologies in its 

business processes, physical environments, and human capital or personnel practices that meet or 

otherwise adhere to the security controls, requirements, and objectives described in applicable 

security control guidelines, and their respective contracts. 

(b) The contractor will be required to input data into a system, to be defined by the IRS, to 

describe the security controls being used to protect information. 

(c) Publication (PUB) 4812 Applicability. This contracting action is subject to Publication 4812 

– Contractor Security Controls. PUB 4812 is available at: http://www.irs.gov/uac/Procurement. 

The contractor shall adhere to the general guidance and specific security control standards or 

requirements contained in PUB 4812. By inclusion of this clause in the contract, PUB 4812 is 

incorporated into the contract and has the same force and effect as if included in the main body 

of the immediate contract. Flowing down from Title III of the E-Government Act of 2002 

(Public Law 107-347), also known as the Federal Information Security Management Act of 2002 

(FISMA), and standards and guidelines developed by the National Institute of Standards and 

Technology (NIST), PUB 4812 identifies basic technical, operational, and management (TOM) 

security controls and standards required of under contracts for services that have a total value 

(inclusive of any options) greater than the micro-purchase threshold (for services), and in which 

contractors and contractor employees (or subcontractors (and subcontractor employees)) will 

either—

 Have access to, develop, operate, or maintain IRS information or information systems on 

behalf of the IRS (or provide related services) outside of IRS facilities or the direct control of the 

Service, and/or 

 Have access to, compile, process, or store IRS SBU information on their own information 

systems/Information Technology (IT) assets or that of a subcontractor or third-party Service 

Provider, or when using their own information systems (or that of others) and on IT, or 

Electronic Information and Technology (EIT) (as defined in FAR Part 2) other than that owned 

or controlled by the IRS. Unless the manual specifies otherwise, the IRS-specific requirements in 

PUB 4812 meet the standard for NIST Special Publication (SP) 800-53 – Federal Information 

Systems and Organizations (Revision 3 (AUG 2009)) (*Errata as of May 1, 2010*), and the 

security controls, requirements, and standards described therein are to be used in lieu of the 

common, at-large security control standards enumerated in NIST SP 800-53 (Rev. 3). PUB 4812 

also describes the framework and general processes for conducting contractor security reviews –

performed by IT Cybersecurity—to monitor compliance and assess the effectiveness of security 

controls applicable to any given contracting action subject to PUB 4812. Upon completion of 
TOFS-16-D-0002

Page 64 of 72

any IT Cybersecurity review, the contractor must submit a plan within fifteen (15) work days 

after notification of the results of the review to the CO, with a copy to the COR and IT 

Cybersecurity, that addresses the correction and mitigation of all identified weaknesses, to 

include a timeline for completion .

(d) Contractor Security Representative. The contractor shall assign and identify, upon award, a 

Contractor Security Representative (CSR) and alternate CSR to all contracts requiring access to 

Treasury/bureau information, information technology and systems, facilities, and/or assets. The 

CSR is the contractor’s primary point for the Government on all security-related matters and the 

person responsible for ensuring the security of information and information systems in 

accordance with the terms and conditions of the contract and all applicable security controls. 

(e) Flow down of clauses. The contractor shall include and flow down, in its subcontracts (or 

arrangements or outsourced service agreements) that entails access to SBU information by a 

subcontractor, at any tier, the substantially same FAR and local security or safeguard clauses or 

provisions for protecting SBU information or information systems that apply to and are 

incorporated in its prime contract with IRS. 

(End of clause)

CONFLICTS OF INTEREST

In addition to complying with COI Provisions in the IDIQ contract regarding Conflicts of 

Interest, the Contractor has signed a Task Order Certification and the Non-Disclosure 

Agreement, on the forms provided in the Request for Proposal and has delivered them to OTPS 

with its contract/task order proposal. 

Attachment 1 includes the Annual Certifications with appendices.
TOFS-16-D-0002

Page 65 of 72

Attachment 1

TARP CONFLICTS OF INTEREST REGULATIONS

ANNUAL CERTIFICATION FORMAT

Open contract: TOFS-16-D-0002

I, [Name of Authorized Official], am a duly authorized official of [Name of Contractor]

(“Retained Entity”). The Retained Entity has performed an internal review to examine the 

effectiveness of the existing conflicts of interest mitigation plan agreed to by Treasury and the 

Retained Entity on [Month/Day/Year]. This annual certification is for the period from 

[Month/Day/Year] to [Month/Day/Year].

The Retained Entity has implemented processes to identify and mitigate (unless detailed as 

prescribed below) all organizational and personal conflicts of interest as required pursuant to 31 

C.F.R. Part 31. In addition, the narrative in Appendix A describes the activities performed to 

reasonably ensure the effectiveness of our mitigation plan and associated processes to support 

this certification. Based on our review of the processes described in Appendix A, I certify that:

• During the period of the certification, the existing mitigation plan and associated 

processes [select one that applies]:

______ Were effective, and did not require any revisions to identify, disclose and 

mitigate any actual or potential organizational conflicts of interest, unless 

specific organizational conflict(s) has been waived by Treasury as required under 

31 C.F.R. § 31.211(a) (Please provide a listing of all waived organizational 

conflicts including the date of the waiver in Appendix B), or

______ Were effective, and did not require any revisions to mitigate actual or potential 

organizational conflicts of interest that have been discovered before or during the 

certification period, except for any organizational conflicts of interest listed in

Appendix C. The Mitigation Plan and associated processes to mitigate 

organizational conflicts of interest have been or will be revised (based on 

management’s assessment and with the Treasury's approval) to mitigate the 

organizational conflicts listed in Appendix C. (Please provide in Appendix C a 

detailed description of discovered organizational conflicts, together with any 

Treasury-approved revision to the Mitigation Plan,).

• Key individuals (including members of the Financial Agent Group, where applicable) 

performing work for the Treasury, as listed in Appendix D, have provided information as 

required in 31 C.F.R. § 31.212(b), for the above period, regarding their personal, business 

and financial relationships, as well as those of their spouses, minor children and close 

family members and [select one that applies]:

______ Do not have personal conflicts of interest, or 

______ Identified personal conflicts of interest have been mitigated by the existing plan 

or the existing mitigation plan has been or will be revised to mitigate identified 

personal conflicts based on management’s assessment (Please provide a detailed 
TOFS-16-D-0002

Page 66 of 72

description of identified personal conflicts and attach the revised mitigation plan 

in Appendix E), or

______ Identified specific personal conflict(s) which have been waived by Treasury 

(Please provide a listing of all waived personal conflicts including the date of the 

waiver in Appendix F).

• During the period of the certification, the Retained Entity certifies that: 

1. The Retained Entity, along with each contractor or consultant and all aforementioned 

officers, employees and representatives, are aware of the prohibitions set forth in 31 C.F.R. § 

31.216(a);

2. The Retained Entity, along with each contractor or consultant, to the best of their knowledge 

after making a reasonable inquiry, have no information concerning a violation or possible 

violation of 31 C.F.R. § 31.216(a);

3. No officer, employee and representative who participated personally and substantially in 

preparing and submitting a bid, offer, proposal, or request for modification of the 

arrangement has information concerning a violation or possible violation of 31 C.F.R. § 

31.216(a); and 

4. Each officer, employee, and representative who participates personally and substantially in 

preparing and submitting a bid, offer, proposal, or request for modification of the 

arrangement will comply with the requirements of 31 C.F.R. § 31.216(a) and will report 

immediately to the Retained Entity any information that is gained subsequent to the 

execution of his/her certification, which concerns a violation or possible violation of 31 

C.F.R. § 31.216(a).

I confirm that the Retained Entity will make information supporting this Certification available 

to Treasury upon request, and retain this information for three years following the termination or 

expiration of the Contract.

By: _____________________

Name: ___________________

Title: ____________________

Date: ____________________ Revised: 6/15/2012
TOFS-16-D-0002

Page 67 of 72

APPENDIX A

Please describe below the activities performed to reasonably ensure the effectiveness of your 

mitigation plan and associated processes to support this certification.
TOFS-16-D-0002

Page 68 of 72

Appendix B

Please provide the nature of any organizational conflicts waived by Treasury, and the date the 

Treasury waived the conflict(s), in the following table. If not applicable, please indicate with 

“N/A” in the table.

Nature of Waived Organizational Conflict Date of Waiver
TOFS-16-D-0002

Page 69 of 72

Appendix C

Please provide a detailed description of any actual or potential organizational conflicts identified 

during management’s assessment along with failures of conflicts-related controls or their 

associated processes, in the following table. Attach the revised mitigation plan for the identified

organizational conflict(s). If not applicable, please indicate with “N/A” in the table.

Detailed Description of Identified Organizational Conflicts
TOFS-16-D-0002

Page 70 of 72

APPENDIX D

Please list the names, titles and responsibilities of all key individuals, including subcontractors 

and members of the Retained Entity, if applicable, and indicate whether there have been any 

changes to this list during this annual certification period. Please indicate when the subcontractors were on-boarded and exited the contract.
TOFS-16-D-0002

Page 71 of 72

Appendix E

Please provide a detailed description of any additional personal conflicts identified upon review 

of information obtained from key individuals, including members of the Retained Entity if 

applicable, performing work for Treasury in the following table. Attach the revised mitigation 

plan for the identified personal conflicts. If not applicable, please indicate with “N/A” in the 

table.

Detailed Description of Identified Personal Conflicts
TOFS-16-D-0002

Page 72 of 72

Appendix F

Please provide below the nature of any personal conflict waived by the Treasury, and the date the 

Treasury waived the conflict, in the following table. If none, please indicate “N/A” in the table.

Nature of Waived Personal Conflict Date of Waiver