Exhibit 10.1

15JPSS26F00001694 Page 1 of 38 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 AND 30. 1. REQUISITION NUMBER 15JA99-26-PR-0098 PAGE 1 OF 38 5. SOLICITATION NUMBER 2. CONTRACT NUMBER 3. AWARD/EFFECTIVE DATE 09/14/2026 4. ORDER NUMBER 6. SOLICITATION ISSUE DATE 7. FOR SOLICITATION INFORMATION CALL: a. NAME b. TELEPHONE NUMBER (No collect calls) 8. OFFER DUE DATE / LOCAL TIME CODE 15JPSS U.S. Department of Justice Procurement Services Staff 145 N St., NE, 8E.300 Washington, DC 20530 9. ISSUED BY UNRESTRICTED OR X SET ASIDE: % FOR X SMALL BUSINESS HUBZONE SMALL BUSINESS SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS (SDVOSB) WOMEN-OWNED SMALL BUSINESS (WOSB) ECONOMICALLY DISADVANTAGED WOMEN-OWNED SMALL BUSINESS (EDWOSB) 8(A) NORTH AMERICAN INDUSTRY CLASSIFICATION STANDARD (NAICS): 541511 SIZE STANDARD: 10. THE ACQUISITION IS SEE SCHEDULE X 11. DELIVERY FOR FREE ON BOARD (FOB) DESTINATION UNLESS BLOCK IS MARKED 12. DISCOUNT TERMS 13a. THIS CONTRACT IS A RATED ORDER UNDER THE DEFENSE PRIORITIES AND ALLOCATIONS SYSTEM - DPAS (15 CFR 700) 13b. RATING X REQUEST FOR QUOTE (RFQ) INVITATION FOR BID (IFB) REQUEST FOR PROPOSAL (RFP) 14. METHOD OF SOLICITATION CODE 15. DELIVER TO CODE 16. ADMINISTERED BY FACILITY CODE CODE TELEPHONE NUMBER 17a. CONTRACTOR/ OFFEROR RANK ONE COMPUTING CORPORATION Doing Business As: ROC 1290 N BROADWAY STE 1200 DENVER, CO 80203-5603 UEI: J957CC5XMTK7 DUNS: 079904709 15JA05 CODE 18a. PAYMENT WILL BE MADE BY Executive Office for United States Attorney 175 N Street NE 6th Floor Washington, DC 20530-0021 17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER SEE ADDENDUM 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED 19. ITEM NUMBER 20. SCHEDULE OF SUPPLIES/SERVICES 21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT Development and support of a Digital Evidence Review Platform (DERP) for ingestion, review, analysis, and production of eDiscovery content, including cell phone and social media data, supporting federal prosecutions. See Continuation Sheet(s) (Use Reverse and/or Attach Additional Sheets as Necessary) 25. ACCOUNTING AND APPROPRIATION DATA USA-2026-0322ADIR-PRGM-EPM-PITCMS-USA-DIR-31031-A167-2026 26. TOTAL AWARD AMOUNT (For Government Use Only) $64,301,418.24 27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED 27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN ____ COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED. 29. AWARD OF CONTRACT: REFERENCE RFQ 15JPSS26Q00000045 OFFER DATED 07/16/2026 . YOUR OFFER ON SOLICITATION (BLOCK 5) INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS: X 30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA SIGNATURE OF CONTRACTING OFFICER 30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED 09/14/2026 AUTHORIZED FOR LOCAL REPRODUCTION PREVIOUS EDITION IS NOT USABLE STANDARD FORM 1449 (REV. 11/2021) Prescribed by GSA - FAR (48 CFR) 53.212

15JPSS26F00001694 Page 2 of 38 19. ITEM NUMBER 20. SCHEDULE OF SUPPLIES/SERVICES 21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT 32a. QUANTITY IN COLUMN 21 HAS BEEN RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE PARTIAL FINAL 33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED CORRECT FOR COMPLETE PARTIAL FINAL 36. PAYMENT 37. CHECK NUMBER 38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY 41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print) 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE 42b. RECEIVED AT (Location) 42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS STANDARD FORM 1449 (REV. 11/2021) BACK

15JPSS26F00001694 Page 3 of 38 Table of Contents Section Description Page Number Solicitation/Contract Form............................................................................................................... 1 1 Commodity or Services Schedule...................................................................................................4 2 Contract Clauses...........................................................................................................................15 52.212-4 (DEV) Terms and Conditions-Commercial Products and Commercial Services (Nov 2023) (DEVIATION NOV 2025)...............................................................................................15 52.203-17 Contractor Employee Whistleblower Rights (Nov 2023).........................................19 52.204-15 (DEV) Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (DEVIATION NOV 2025).......................................................................................19 52.217-8 Option to Extend Services (Nov 1999).....................................................................20 52.217-9 Option to Extend the Term of the Contract (Mar 2000)............................................20 52.219-6 (DEV) Notice of Total Small Business Set-Aside (Nov 2020) (DEVIATION DEC 2025).........................................................................................................................................20 52.232-7 Payments under Time-and-Materials and Labor Hour Contracts (Nov 2021)...........21 52.240-93 (DEV) Basic Safeguarding of Covered Contractor Information Systems (DEVIATION NOV 2025)......................................................................................................... 24 DOJ-01 Whistleblower Information Distribution (Oct 2021)..................................................... 25 DOJ-02 Contractor Privacy Requirements (JAN 2022)........................................................... 26 DOJ-03 Personnel Security Requirements For Contractor Employees (Nov 2021).................31 DOJ-08 Continuing Contract Performance During a Pandemic Influenza or other National Emergency (OCT 2007)...........................................................................................................35 DOJ-09 Large Language Models (MAR 2026)........................................................................36 3 List of Attachments........................................................................................................................38

15JPSS26F00001694 Page 4 of 38 Section 1 - Commodity or Services Schedule SCHEDULE OF SUPPLIES/SERVICES CONTINUATION SHEET ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE MATERIAL COSTS TRAVEL COSTS AMOUNT 0001 Base Period Environment Creation, Customization and Initialization Base Period cost to establish environment, per RFQ Section 4.4.1; T&M with Not-to-Exceed ceiling; Time and Materials PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0003 Base Year License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0003AA Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0003AB Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0003AC Data Stored License Cost: ROC-EV-STOR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge.

15JPSS26F00001694 Page 5 of 38 This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0003AD Data Analyzed License Cost ROC-EV-STOR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0004 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2026 - 09/21/2027 Base Period NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE MATERIAL COSTS TRAVEL COSTS AMOUNT 1001 Option Period 1 Environment Creation, Customization and Initialization Option Period 1 cost to continue environment creation, customization, and initialization, per RFQ Section 4.4.1. Time-and- Materials with Not-to-Exceed ceiling. Time and Materials PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1003 Option Period 1 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1003AA Option Period 1 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option

15JPSS26F00001694 Page 6 of 38 ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1003AB Option Period 1 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1003AC Option Period 1 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1003AD Option Period 1 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 1004 Option Period 1 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2027 - 09/21/2028 Unexercised Option NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2002 Option Period 2 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2, covering the period beginning Option Period 2 consistent with RFQ Section 5.3.2. Priced at award; subject to separate option exercise action under FAR 52.217-9. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option

15JPSS26F00001694 Page 7 of 38 ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2003 Option Period 2 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2003AA Option Period 2 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2003AB Option Period 2 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2003AC Option Period 2 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2003AD Option Period 2 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 2004 Option Period 2 Travel NTE

15JPSS26F00001694 Page 8 of 38 Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2028 - 09/21/2029 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3002 Option Period 3 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2 Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3003 Option Period 3 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3003AA Option Period 3 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3003AB Option Period 3 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3003AC Option Period 3 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs.

15JPSS26F00001694 Page 9 of 38 Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3003AD Option Period 3 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 3004 Option Period 3 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2029 - 09/21/2030 Unexercised Option NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4002 Option Period 4 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2 Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4003 Option Period 4 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4003AA Option Period 4 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4003AB Option Period 4 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT-

15JPSS26F00001694 Page 10 of 38 Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4003AC Option Period 4 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4003AD Option Period 4 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 4004 Option Period 4 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2030 - 09/21/2031 Unexercised Option NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5002 Option Period 5 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2, Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5003 Option Period 5 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price

15JPSS26F00001694 Page 11 of 38 PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5003AA Option Period 5 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5003AB Option Period 5 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5003AC Option Period 5/ Data Stored License Cost: - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5003AD Option Period 5 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 5004 Option Period 5 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2031 - 09/21/2032 Unexercised Option NTE

15JPSS26F00001694 Page 12 of 38 ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6002 Option Period 6 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2 Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6003 Option Period 6 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6003AA Option Period 6 / Fixed Price License Cost ROC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6003AB Option Period 6 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6003AC Option Period 6 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

15JPSS26F00001694 Page 13 of 38 6003AD Option Period 6 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 6004 Option Period 6 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2032 - 09/21/2033 Unexercised Option NTE ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7002 Option Period 7 Environment Operations, Maintenance and Support Firm-Fixed-Price for environment operations, maintenance, and development support, per RFQ Section 4.4.2 Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7003 Option Period 7 License Costs Firm-Fixed-Price unit license costs per RFQ Section 4.4.3, evaluated against Government-provided annual quantity estimates Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7003AA Option Period 7 / Fixed Price License Cost OC-EV-BASELIC Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7003AB Option Period 7 / Per Device License Cost: ROC-EV-PROC-DEVICE, ROC-EV-ANLYT- Quantity basis: Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034

15JPSS26F00001694 Page 14 of 38 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7003AC Option Period 7 / Data Stored License Cost: R - - OR- -COLD-ADV Data Stored is an annual recurring charge against total stored volume per 12-month period, not a one-time or perpetual charge. This is a software licensing fee for cold-tier review and archival features, independent of and in addition to the Government's direct-billed Azure storage costs. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7003AD Option Period 7 / Data Analyzed License Cost R - - OR- -HOT Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 7004 Option Period 7 Travel Travel costs per RFQ Section 4.4.4, not to exceed per period of performance. Firm Fixed Price PSC: DA01 Line Period of Performance: 09/22/2033 - 09/21/2034 Unexercised Option NTE Base Total: $7,414,143.80 Exercised Options Total: $0.00 Unexercised Options Total: $56,887,274.44 Base and Options Total: $64,301,418.24 FUNDING DETAILS: ITEM NO. FUNDING LINE OBLIGATED AMOUNT ACCOUNTING CODES N/A 1 $7,414,143.80 USA-2026-0322ADIR-PRGM-EPM-PITCMS-USA-DIR-31031-A167-2026 TOTAL: $7,414,143.80

15JPSS26F00001694 Page 15 of 38 Section 2 - Contract Clauses 52.212-4 (DEV) Terms and Conditions-Commercial Products and Commercial Services (Nov 2023) (DEVIATION NOV 2025) (a) Definitions. The clause at Federal Acquisition Regulation (FAR) 52.202-1, Definitions, is incorporated by reference. (b) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post acceptance rights— (1) Within a reasonable time after the defect was discovered or should have been discovered; and (2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item. (c) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract. (d) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties. (e) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal, or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause FAR 52.233-1, Disputes, which is incorporated in this contract by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract. (f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence. Examples of occurrences include acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. When an excusable delay occurs, the Contractor shall— (1) Notify the Contracting Officer in writing as soon as possible; (2) Remedy the delay as quickly as possible; and (3) Notify the Contracting Officer when the occurrence is over. (g) Invoice. The Government will handle invoices according to the Prompt Payment Act (31 U.S.C. 3903) and 5 CFR part 1315. The Contractor shall submit invoices to the address designated in the contract to receive invoices. An invoice must include the information required by 5 CFR part 1315.9(b). (h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees, and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark, or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings. (i) Payment—

15JPSS26F00001694 Page 16 of 38 (1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract. (2) Prompt payment. The Government will make payment in accordance with the Prompt Payment Act ( 31 U.S.C. 3903) and prompt payment regulations at 5 CFR part 1315. (3) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, payment shall be considered to have been made on the date that appears on the payment check or the specified payment date if an electronic funds transfer payment is made. (4) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall— (i) Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment including the— (A) Circumstances of the overpayment (e.g., duplicate payment, erroneous payment, liquidation errors, date(s) of overpayment); (B) Affected contract number and delivery order number, if applicable; (C) Affected line item or subline item, if applicable; (D) Contractor point of contact; and (ii) Provide a copy of the remittance and supporting documentation to the Contracting Officer. (5) Interest. (i) All amounts that become payable by the Contractor to the Government under this contract shall bear simple interest from the date due until paid unless paid within 30 days of becoming due. The interest rate shall be the interest rate established by the Secretary of the Treasury as provided in 41 U.S.C. 7109, which is applicable to the period in which the amount becomes due, as provided in (i)(6)(v) of this clause, and then at the rate applicable for each six-month period as fixed by the Secretary until the amount is paid. (ii) The Government may issue a demand for payment to the Contractor upon finding a debt is due under the contract. (iii) Final decisions. The Contracting Officer will issue a final decision as required by FAR part 33 if– (A) The Contracting Officer and the Contractor are unable to reach agreement on the existence or amount of a debt within 30 days; (B) The Contractor fails to liquidate a debt previously demanded by the Contracting Officer within the timeline specified in the demand for payment unless the amounts were not repaid because the Contractor has requested an installment payment agreement; or (C) The Contractor requests a deferment of collection on a debt previously demanded by the Contracting Officer (see FAR part 32). (iv) If a demand for payment was previously issued for the debt, the demand for payment included in the final decision shall identify the same due date as the original demand for payment. (v) Amounts shall be due at the earliest of the following dates: (A) The date fixed under this contract. (B) The date of the first written demand for payment, including any demand for payment resulting from a termination for cause.

15JPSS26F00001694 Page 17 of 38 (vi) The interest charge shall be computed for the actual number of calendar days involved beginning on the due date and ending on- (A) The date on which the designated office receives payment from the Contractor; (B) The date of issuance of a Government check to the Contractor from which an amount otherwise payable has been withheld as a credit against the contract debt; or (C) The date on which an amount withheld and applied to the contract debt would otherwise have become payable to the Contractor. (vii) The interest charge made under this clause may be reduced under the procedures for interest credits prescribed in FAR part 32 in effect on the date of this contract. (j) Risk of loss. Unless the contract specifically provides otherwise, risk of loss or damage to the supplies provided under this contract shall remain with the Contractor until, and shall pass to the Government upon— (1) Delivery of the supplies to a carrier, if transportation is f.o.b. origin; or (2) Delivery of the supplies to the Government at the destination specified in the contract, if transportation is f.o.b. destination. (k) Taxes. The contract price includes all applicable Federal, State, and local taxes and duties. (l) Termination for the Government's convenience. The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience. In the event of such termination, the Contractor shall immediately stop all work and shall immediately cause any and all of its suppliers and subcontractors to cease work. Subject to the terms of this contract, the Contractor shall be paid a percentage of the contract price reflecting the percentage of the work performed prior to the notice of termination, plus reasonable charges the Contractor can demonstrate to the satisfaction of the Government using its standard record keeping system, have resulted from the termination. The Contractor shall not be required to comply with the cost accounting standards or contract cost principles for this purpose. This paragraph does not give the Government any right to audit the Contractor's records. The Contractor shall not be paid for any work performed or costs incurred which reasonably could have been avoided. (m) Termination for cause. The Government may terminate this contract, or any part hereof, for cause in the event of any default by the Contractor, or if the Contractor fails to comply with any contract terms and conditions, or fails to provide the Government, upon request, with adequate assurances of future performance. The Government will send a cure notice to the Contractor, unless the reason for the termination is late delivery. In the event of termination for cause, the Government shall not be liable to the Contractor for any amount for supplies or services not accepted, and the Contractor shall be liable to the Government for any and all rights and remedies provided by law. If it is determined that the Government improperly terminated this contract for default, such termination shall be deemed a termination for convenience. (n) Title. Unless specified elsewhere in this contract, title to items furnished under this contract shall pass to the Government upon acceptance, regardless of when or where the Government takes physical possession. (o) Warranty. The Contractor warrants and implies that the items delivered under this contract are merchantable and fit for use for the particular purpose described in this contract. (p) Limitation of liability. Except as otherwise provided by an express warranty, the Contractor will not be liable to the Government for consequential damages resulting from any defect or deficiencies in accepted items. (q) Compliance with laws unique to Government contracts. The Contractor agrees to comply with 31 U.S.C. 1352 relating to limitations on the use of appropriated funds to influence certain Federal contracts; 40 U.S.C. chapter 37, Contract Work Hours and Safety Standards; 41 U.S.C. chapter 87, Kickbacks; 49 U.S.C. 40118, Government-financed air transportation; and 41 U.S.C. chapter 21 relating to procurement integrity. (r) Order of precedence. Any inconsistencies in this solicitation or contract shall be resolved by giving precedence in the following order:

15JPSS26F00001694 Page 18 of 38 (1) The schedule of supplies/services; (2) The Disputes, Payments, Invoice, Compliance with Laws Unique to Government Contracts, and Unauthorized Obligations paragraphs of this clause; (3) Other contract clauses incorporated in the solicitation or contract; (4) Addenda to this solicitation or contract; (5) Solicitation provisions incorporated in the solicitation; (6) Other paragraphs of this clause; (7) Other documents, exhibits, and attachments; and (8) The specification. (s) Unauthorized obligations. (1) Except as stated in paragraph (s)(2) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation (31 U.S.C. 1341), the following shall govern: (i) Any such clause is unenforceable against the Government. (ii) Neither the Government nor any Government-authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an "I agree" click box or other comparable mechanism (e.g., "click-wrap" or "browse-wrap" agreements), execution does not bind the Government or any Government authorized end user to such clause. (iii) Any such clause is deemed to be stricken from the EULA, TOS, or similar legal instrument or agreement. (2) Paragraph (s)(1) of this clause does not apply to indemnification by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures. (t) Comptroller General examination of record. This paragraph applies if this contract was awarded using other than sealed bid procedures and is in excess of the simplified acquisition threshold on the date of award of this contract. (1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract. (2) The Contractor shall make available at its offices, at all reasonable times, the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR part 4, longer period required by statute, or periods specified in other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved. (3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This clause does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

15JPSS26F00001694 Page 19 of 38 (u) Incorporation by reference. The Contractor's representations and certifications, including those completed electronically via the System for Award Management (SAM), are incorporated by reference into the contract. (End of clause) A.1 ADDENDUM TO FAR 52.212-4, Terms and Conditions-Commercial Products and Commercial Services (Nov 2023) (DEVIATION NOV 2025) The terms and conditions for the following clauses are hereby incorporated into this solicitation and resulting contract as an addendum to FAR clause 52.212-4. Clauses By Full Text 52.203-17 Contractor Employee Whistleblower Rights (Nov 2023) (a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 41 U.S.C. 4712 and Federal Acquisition Regulation (FAR) 3.900 through 3.905. (b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in FAR 3.900 through 3.905. (c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts. (End of clause) 52.204-15 (DEV) Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (DEVIATION NOV 2025) (a) Definition. As used in this clause— First-tier subcontract means a subcontract awarded directly by the Contractor to acquire supplies or services (including construction) for performing a prime contract. It does not include the Contractor's supplier agreements with vendors, such as long-term arrangements for materials or supplies that benefit multiple contracts and/or the costs of which are normally applied to a contractor's general and administrative expenses or indirect costs. (b) Requirement. The Contractor shall report, according to paragraphs (c) and (d) of this clause, annually by October 31, for services performed during the preceding Government fiscal year (October 1-September 30) under this contract for orders that exceed the thresholds established in 4.303(b). (c) Report elements. The Contractor shall report the following information: (1) Contract number and order number. (2) The total dollar amount invoiced for services performed during the previous Government fiscal year under the order. (3) The number of Contractor direct labor hours expended on the services performed during the previous Government fiscal year. (4) Data reported by subcontractors under paragraph (f) of this clause. (d) Remedies. The Contractor shall submit the information required in paragraph (c) of this clause in the System for Award Management (SAM) at https://www.sam.gov (see SAM User Guide). If the Contractor fails to submit the report in a timely

15JPSS26F00001694 Page 20 of 38 manner, the Contracting Officer will exercise appropriate contractual remedies. In addition, the Contracting Officer will make the Contractor's failure to comply with the reporting requirements a part of the Contractor's performance information under the Federal Acquisition Regulation part 42. (e) Review. Agencies will review Contractor-reported information for reasonableness and consistency with available contract information. If the agency believes that revisions to the Contractor's reported information are warranted, the agency will notify the Contractor no later than November 15. By November 30, the Contractor shall revise the report, or put its reason in writing for the agency. (f) First-tier subcontracts. (1) The Contractor shall require each first-tier subcontractor providing services under this contract, with subcontract(s) each valued at or above the thresholds set forth in 4.303(b), to provide the following detailed information to the Contractor in sufficient time to submit the report: (i) Subcontract number (including subcontractor name and unique entity identifier); and (ii) The number of first-tier subcontractor direct-labor hours expended on the services performed during the previous Government fiscal year. (2) The Contractor shall tell the subcontractor that the information will be made available to the public as required by section 743 of Division C of the Consolidated Appropriations Act, 2010. (End of clause) 52.217-8 Option to Extend Services (Nov 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor at any time prior to contract expiration (End of clause) 52.217-9 Option to Extend the Term of the Contract (Mar 2000) (a) The Government may extend the term of this contract by written notice to the Contractor within at any time prior to contract expiration ; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension. (b) If the Government exercises this option, the extended contract shall be considered to include this option clause. (c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 8 (months) (years). (End of clause) 52.219-6 (DEV) Notice of Total Small Business Set-Aside (Nov 2020) (DEVIATION DEC 2025) (a) Definition. Small business concern, as used in this clause— (1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in the field of operation in which it is bidding on Government contracts, and qualified as a small business under the size standards in this solicitation. (2) Affiliates, as used in paragraph (a)(1) of this clause, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors

15JPSS26F00001694 Page 21 of 38 including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103. (b) Applicability. This clause applies only to- (1) Contracts that have been set aside for small business concerns; and (2) Orders set aside for small business concerns under multiple-award contracts as described in 8.4 and 16.5. (c) General. (1) Offers are solicited only from small business concerns. Offers received from concerns that are not small business concerns shall be considered nonresponsive and will be rejected. (2) Any award resulting from this solicitation will be made to a small business concern. (End of clause) 52.232-7 Payments under Time-and-Materials and Labor Hour Contracts (Nov 2021) The Government will pay the Contractor as follows upon the submission of vouchers approved by the Contracting Officer or the authorized representative: (a) Hourly rate. (1) Hourly rate means the rate(s) prescribed in the contract for payment for labor that meets the labor category qualifications of a labor category specified in the contract that are-- (i) Performed by the Contractor; (ii) Performed by the subcontractors; or (iii) Transferred between divisions, subsidiaries, or affiliates of the Contractor under a common control. (2) The amounts shall be computed by multiplying the appropriate hourly rates prescribed in the Schedule by the number of direct labor hours performed. (3) The hourly rates shall be paid for all labor performed on the contract that meets the labor qualifications specified in the contract. Labor hours incurred to perform tasks for which labor qualifications were specified in the contract will not be paid to the extent the work is performed by employees that do not meet the qualifications specified in the contract, unless specifically authorized by the Contracting Officer. (4) The hourly rates shall include wages, indirect costs, general and administrative expense, and profit. Fractional parts of an hour shall be payable on a prorated basis. (5) Vouchers may be submitted not more than once every two weeks, to the Contracting Officer or authorized representative. A small business concern may receive more frequent payments than every two weeks. The Contractor shall substantiate vouchers (including any subcontractor hours reimbursed at the hourly rate in the schedule) by evidence of actual payment and by-- (i) Individual daily job timekeeping records; (ii) Records that verify the employees meet the qualifications for the labor categories specified in the contract; or (iii) Other substantiation approved by the Contracting Officer. (6) Promptly after receipt of each substantiated voucher, the Government shall, except as otherwise provided in this contract, and subject to the terms of paragraph (e) of this clause, pay the voucher as approved by the Contracting Officer or authorized representative.

15JPSS26F00001694 Page 22 of 38 (7) Unless otherwise prescribed in the Schedule, the Contracting Officer may unilaterally issue a contract modification requiring the Contractor to withhold amounts from its billings until a reserve is set aside in an amount that the Contracting Officer considers necessary to protect the Government's interests. The Contracting Officer may require a withhold of 5 percent of the amounts due under paragraph (a) of this clause, but the total amount withheld for the contract shall not exceed $50,000. The amounts withheld shall be retained until the Contractor executes and delivers the release required by paragraph (g) of this clause. (8) Unless the Schedule prescribes otherwise, the hourly rates in the Schedule shall not be varied by virtue of the Contractor having performed work on an overtime basis. If no overtime rates are provided in the Schedule and overtime work is approved in advance by the Contracting Officer, overtime rates shall be negotiated. Failure to agree upon these overtime rates shall be treated as a dispute under the Disputes clause of this contract. If the Schedule provides rates for overtime, the premium portion of those rates will be reimbursable only to the extent the overtime is approved by the Contracting Officer. (b) Materials. (1) For the purpose of this clause-- (i) Direct materials means those materials that enter directly into the end product, or that are used or consumed directly in connection with the furnishing of the end product or service. (ii) Materials means-- (A) Direct materials, including supplies transferred between divisions, subsidiaries, or affiliates of the Contractor under a common control; (B) Subcontracts for supplies and incidental services for which there is not a labor category specified in the contract; (C) Other direct costs (e.g., incidental services for which there is not a labor category specified in the contract, travel, computer usage charges, etc.); and (D) Applicable indirect costs. (2) If the Contractor furnishes its own materials that meet the definition of a commercial product or commercial service in Federal Acquisition Regulation (FAR) 2.101, the price to be paid for such materials shall not exceed the Contractor's established catalog or market price, adjusted to reflect the-- (i) Quantities being acquired; and (ii) Actual cost of any modifications necessary because of contract requirements. (3) Except as provided for in paragraph (b)(2) of this clause, the Government will reimburse the Contractor for allowable cost of materials provided the Contractor-- (i) Has made payments for materials in accordance with the terms and conditions of the agreement or invoice; or (ii) Ordinarily makes these payments within 30 days of the submission of the Contractor's payment request to the Government and such payment is in accordance with the terms and conditions of the agreement or invoice. (4) Payment for materials is subject to the Allowable Cost and Payment clause of this contract. The Contracting Officer will determine allowable costs of materials in accordance with FAR subpart 31.2 in effect on the date of this contract. (5) The Contractor may include allocable indirect costs and other direct costs to the extent they are-- (i) Comprised only of costs that are clearly excluded from the hourly rate; (ii) Allocated in accordance with the Contractor's written or established accounting practices; and (iii) Indirect costs are not applied to subcontracts that are paid at the hourly rates. (6) To the extent able, the Contractor shall--

15JPSS26F00001694 Page 23 of 38 (i) Obtain materials at the most advantageous prices available with due regard to securing prompt delivery of satisfactory materials; and (ii) Take all cash and trade discounts, rebates, allowances, credits, salvage, commissions, and other benefits. When unable to take advantage of the benefits, the Contractor shall promptly notify the Contracting Officer and give the reasons. The Contractor shall give credit to the Government for cash and trade discounts, rebates, scrap, commissions, and other amounts that have accrued to the benefit of the Contractor, or would have accrued except for the fault or neglect of the Contractor. The Contractor shall not deduct from gross costs the benefits lost without fault or neglect on the part of the Contractor, or lost through fault of the Government. (7) Except as provided for in 31.205-26(e) and (f), the Government will not pay profit or fee to the prime Contractor on materials. (c) If the Contractor enters into any subcontract that requires consent under the clause at 52.244-2, Subcontracts, without obtaining such consent, the Government is not required to reimburse the Contractor for any costs incurred under the subcontract prior to the date the Contractor obtains the required consent. Any reimbursement of subcontract costs incurred prior to the date the consent was obtained shall be at the sole discretion of the Government. (d) Total cost. It is estimated that the total cost to the Government for the performance of this contract shall not exceed the ceiling price set forth in the Schedule, and the Contractor agrees to use its best efforts to perform the work specified in the Schedule and all obligations under this contract within such ceiling price. If at any time the Contractor has reason to believe that the hourly rate payments and material costs that will accrue in performing this contract in the next succeeding 30 days, if added to all other payments and costs previously accrued, will exceed 85 percent of the ceiling price in the Schedule, the Contractor shall notify the Contracting Officer giving a revised estimate of the total price to the Government for performing this contract with supporting reasons and documentation. If at any time during performing this contract, the Contractor has reason to believe that the total price to the Government for performing this contract will be substantially greater or less than the then stated ceiling price, the Contractor shall so notify the Contracting Officer, giving a revised estimate of the total price for performing this contract, with supporting reasons and documentation. If at any time during performing this contract, the Government has reason to believe that the work to be required in performing this contract will be substantially greater or less than the stated ceiling price, the Contracting Officer will so advise the Contractor, giving the then revised estimate of the total amount of effort to be required under the contract. (e) Ceiling price. The Government will not be obligated to pay the Contractor any amount in excess of the ceiling price in the Schedule, and the Contractor shall not be obligated to continue performance if to do so would exceed the ceiling price set forth in the Schedule, unless and until the Contracting Officer notifies the Contractor in writing that the ceiling price has been increased and specifies in the notice a revised ceiling that shall constitute the ceiling price for performance under this contract. When and to the extent that the ceiling price set forth in the Schedule has been increased, any hours expended and material costs incurred by the Contractor in excess of the ceiling price before the increase shall be allowable to the same extent as if the hours expended and material costs had been incurred after the increase in the ceiling price. (f) Audit. At any time before final payment under this contract, the Contracting Officer may request audit of the vouchers and supporting documentation. Each payment previously made shall be subject to reduction to the extent of amounts, on preceding vouchers, that are found by the Contracting Officer or authorized representative not to have been properly payable and shall also be subject to reduction for overpayments or to increase for underpayments. Upon receipt and approval of the voucher designated by the Contractor as the "completion voucher" and supporting documentation, and upon compliance by the Contractor with all terms of this contract (including, without limitation, terms relating to patents and the terms of paragraph (g) of this clause), the Government shall promptly pay any balance due the Contractor. The completion voucher, and supporting documentation, shall be submitted by the Contractor as promptly as practicable following completion of the work under this contract, but in no event later than 120 days (or such longer period as the Contracting Officer may approve in writing) from the date of completion. (g) Assignment and Release of Claims. The Contractor, and each assignee under an assignment entered into under this contract and in effect at the time of final payment under this contract, shall execute and deliver, at the time of and as a condition precedent to final payment under this contract, a release discharging the Government, its officers, agents, and employees of and from all liabilities, obligations, and claims arising out of or under this contract, subject only to the following exceptions: (1) Specified claims in stated amounts, or in estimated amounts if the amounts are not susceptible of exact statement by the Contractor.

15JPSS26F00001694 Page 24 of 38 (2) Claims, together with reasonable incidental expenses, based upon the liabilities of the Contractor to third parties arising out of performing this contract, that are not known to the Contractor on the date of the execution of the release, and of which the Contractor gives notice in writing to the Contracting Officer not more than 6 years after the date of the release or the date of any notice to the Contractor that the Government is prepared to make final payment, whichever is earlier. (3) Claims for reimbursement of costs (other than expenses of the Contractor by reason of its indemnification of the Government against patent liability), including reasonable incidental expenses, incurred by the Contractor under the terms of this contract relating to patents. (h) Interim payments on contracts for other than services. (1) Interim payments made prior to the final payment under the contract are contract financing payments. Contract financing payments are not subject to the interest penalty provisions of the Prompt Payment Act. (2) The designated payment office will make interim payments for contract financing on the 30th day after the designated billing office receives a proper payment request. In the event that the Government requires an audit or other review of a specific payment request to ensure compliance with the terms and conditions of the contract, the designated payment office is not compelled to make payment by the specified due date. (i) Interim payments on contracts for services. For interim payments made prior to the final payment under this contract, the Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR part 1315. (End of clause) 52.240-93 (DEV) Basic Safeguarding of Covered Contractor Information Systems (DEVIATION NOV 2025) (a) Definitions. As used in this clause— Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information. Federal contract information— (1) Means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government; but (2) Does not include information provided by the Government to the public (such as on public websites) or simple transactional information (such as information necessary to process payments). Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009). Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502). Safeguarding means measures or controls that are prescribed to protect information systems. (b) Safeguarding requirements. (1) Basic requirements. The Contractor shall safeguard its covered contractor information systems by implementing, at minimum, the following security controls: (i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

15JPSS26F00001694 Page 25 of 38 (ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute. (iii) Verify and control/limit connections to and use of external information systems. (iv) Control information posted or processed on publicly accessible information systems. (v) Identify information system users, processes acting on behalf of users, or devices. (vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. (vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. (viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. (ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. (x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. (xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. (xii) Identify, report, and correct information and information system flaws in a timely manner. (xiii) Provide protection from malicious code at appropriate locations within organizational information systems. (xiv) Update malicious code protection mechanisms when new releases are available. (xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. (2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal departments and agencies relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556. (c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system. (End of clause) DOJ-01 Whistleblower Information Distribution (Oct 2021) Within 30 days of contract award, the contractor and its subcontractors must distribute the "Whistleblower Information for Employees of DOJ Contractors, Subcontractors, Grantees, or Sub-Grantees or Personal Services Contractors" ("Whistleblower Information") document to their employees performing work in support of the products and services delivered under this contract (https://oig.justice.gov/sites/default/files/2020-04/NDAA-brochure.pdf). By agreeing to the terms and conditions of this contract, the prime contractor acknowledges receipt of this requirement, in accordance with 41 U.S.C. § 4712 and FAR

15JPSS26F00001694 Page 26 of 38 3.906 & 52.203-17, and commits to distribution. Within 45 days of award, the contractor must provide confirmation to the contracting officer verifying that it has distributed the whistleblower information as required. (End of Clause) DOJ-02 Contractor Privacy Requirements (JAN 2022) A. Limiting Access to Privacy Act and Other Sensitive Information (1) Privacy Act Information In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984) and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires Contractor personnel to have access to information protected by the Privacy Act of 1974, the contractor is advised that the relevant DOJ system of records notices (SORNs) applicable to this Privacy Act information may be found at https://www.justice.gov/opcl/doj-systems-records.[1] Applicable SORNs published by other agencies may be accessed through those agencies' websites or by searching the Federal Digital System (FDsys) available at http://www.gpo.gov/fdsys/. SORNs may be updated at any time. (2) Prohibition on Performing Work Outside a Government Facility/Network/Equipment Except where use of Contractor networks, IT, other equipment, or Workplace as a Service (WaaS) is specifically authorized within this contract, the Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or WaaS and Government information shall remain within the confines of authorized Government networks at all times. Any handling of Government information on Contractor networks or IT must be approved by the Senior Component Official for Privacy of the component entering into this contract. Except where remote work is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of remote work authorizations. (3) Prior Approval Required to Hire Subcontractors The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information. (4) Separation Checklist for Contractor Employees The Contractor shall complete and submit an appropriate separation checklist to the Contracting Officer before any employee or Subcontractor employee terminates working on the contract. The Contractor must submit the separation checklist on or before the last day of employment or work on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposition of personally identifiable information (PII)[2], in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor's facilities or systems that would permit the terminated employee's access to PII or other sensitive information. In the event of adverse job actions resulting in the dismissal of a Contractor or Subcontractor employee before the separation checklist can be completed, the Prime Contractor must notify the Contracting Officer within 24 hours and confirm receipt of the notification. In the case the Contractor is unable to notify the Contracting Officer, then the Contractor should notify the Contract Officer's Representative (COR). Contractors must complete the separation checklist with the Contracting Officer or COR by returning all Government-furnished property including, but not limited to, computer equipment, media, credentials and passports, smart cards, mobile devices, Personal Identity Verification (PIV) cards, calling cards, and keys and terminating access to all user accounts and systems. Unless the Contracting Officer requests otherwise, the

15JPSS26F00001694 Page 27 of 38 relevant Program Manager or other Key Personnel designated by the Contracting Officer or COR may facilitate the return of equipment. B. Privacy Training, Safeguarding, and Remediation (1) Required Security and Privacy Training for Contractors The Contractor must ensure that all employees take appropriate privacy training, including Subcontractors who have access to PII as well as the creation, use, dissemination and/or destruction of PII at the outset of the employee's work on the contract and every year thereafter. Training must include procedures on how to properly handle PII, including heightened security requirements for the transporting or transmission of sensitive PII, and reporting requirements for a suspected breach or loss of PII. These courses, along with more information about DOJ security and training requirements for Contractors, are available at https://www.justice.gov/jmd/learndoj. The Federal Information Security Modernization Act of 2014 (FISMA) requires all individuals accessing DOJ information to complete training on records management, cybersecurity awareness, and information system privacy awareness. Contractor employees are required to sign the "Privacy Rules of Behavior," acknowledging and agreeing to abide by privacy law, policy, and certain privacy safeguards, prior to accessing DOJ information. These Rules of Behavior are made available to all new users of DOJ's computer network and to trainees at the conclusion of DOJ-OPCL-CS-0005. The Contractor should maintain copies of certificates as a record of compliance and must submit an email notification annually to the COR verifying that all employees working under this contract have completed the required privacy and cybersecurity training. (2) Safeguarding PII Requirements Contractor employees must comply with DOJ Order 0904 and other guidance published to the publicly-available Office of Privacy and Civil Liberties (OPCL) Resources page[3] relating to the safeguarding of PII, including the use of additional controls to safeguard sensitive PII (e.g., the encryption of sensitive PII). This requirement flows down from the Prime Contractor to all Subcontractors and lower tiered subcontracts. (3) Non-Disclosure Agreement Requirement Prior to commencing work, all Contractor personnel that may have access to PII or other sensitive information shall be required to sign a Non-Disclosure Agreement (NDA) and the DOJ IT Rules of Behavior. The Non-Disclosure Agreement: (a) prohibits the Contractor from retaining or divulging any PII or other sensitive information, or derivatives therefrom, furnished by the Government or to which they may otherwise come in contact as a result of their performance of work under the contract/task order that is otherwise not publicly available, whether or not such information has been reduced to writing; and (b) requires the Contractor to report any loss of control, compromise, unauthorized disclosure, or unauthorized acquisition of PII or other sensitive information to the component-level or headquarters Security Operations Center within one (1) hour of discovery. The Contractor should maintain signed copies of the NDA for all employees as a record of compliance. The Contractor should also provide copies of each employee's signed NDA to the Contracting Officer before the employee may commence work under the contract/task order. (4) Prohibition on Use of PII in Vendor Billing and Administrative Records The Contractor's invoicing, billing, and other financial or administrative records or databases is not authorized to regularly store or include any sensitive PII or other confidential government information that is created, obtained, or provided during the performance of the contract without the written permission of the Senior Component Official for Privacy (SCOP). It is acceptable to list the names, titles and contact information for the Contracting Officer, COR, or other personnel associated with the administration of the contract in the invoices as needed. (5) Reporting Actual or Suspected Data Breach

15JPSS26F00001694 Page 28 of 38 Contractors must report any actual or suspected breach of PII within one hour of discovery.[4] A "breach" is an incident or occurrence that involves the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where: (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose. The report of a breach must be made to DOJ. The Contractor must cooperate with DOJ's inquiry into the incident and efforts to minimize risks to DOJ or individuals, including remediating any harm to potential victims. (a) The Contractor must develop and maintain an internal process by which its employees and Subcontractors are trained to identify and report the breach, consistent with DOJ Instruction 0900.00.01[5], Reporting and Response Procedures for a Breach of Personally Identifiable Information. (b) The Contractor must report any such breach by its employees or Subcontractors to the DOJ Security Operations Center (dojcert@usdoj.gov, 202-357-7000); Component-level Security Operations Center and Component-level Management Team, where appropriate; the COR; and the Contracting Officer within one (1) hour of the initial discovery. (c) The Contractor must provide a written report to the DOJ Security Operations Center (dojcert@usdoj.gov, 202-357-7000) within 24 hours of discovery of the breach by its employees or Subcontractors. The report must contain the following information: (i) Narrative or detailed description of the events surrounding the suspected loss or compromise of information.[6] Date, time, and location of the incident. (ii) Amount, type, and sensitivity of information that may have been lost or compromised, accessed without authorization, etc. (iii) Contractor's assessment of the likelihood that the information was compromised or lost and the reasons behind the assessment.[7] (iv) Names and classification of person(s) involved, including victim, Contractor employee/Subcontractor and any witnesses. (v) Cause of the incident and whether the company's security plan was followed and, if not, which specific provisions were not followed.[8] (vi) Actions that have been or will be taken to minimize damage and/or mitigate further compromise. (vii) Recommendations to prevent similar situations in the future, including whether the security plan needs to be modified in any way and whether additional training may be required. (d) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. (e) At the Government's discretion, Contractor employees or Subcontractor employees may be identified as no longer eligible to access PII or to work on that contract based on their actions related to the loss or compromise of PII. (6) Victim Remediation At DOJ's request, the Contractor is responsible for notifying victims and providing victim remediation services in the event of a breach of PII held by the Contractor, its agents, or its Subcontractors, under this contract. Victim remediation services shall include at least 18 months of credit monitoring and, for serious or large incidents as determined by the Government, call center help desk services for the individuals whose PII was lost or compromised. When DOJ requests notification, the Department Chief Privacy and Civil Liberties Officer and SCOP will direct the Contractor on the method and content of such notification to be sent to individuals whose PII was breached. By performing this work, the Contractor agrees to full cooperation in the event of a breach. The Contractor should be self-insured to the extent necessary to handle any reasonably foreseeable breach, with another source of income, to fully cover the costs of breach response, including but not limited to victim remediation. C. Government Records Training, Ownership, and Management (1) Records Management Training and Compliance

15JPSS26F00001694 Page 29 of 38 (a) The Contractor must ensure that all employees and Subcontractors that have access to PII as well as to those involved in the creation, use, dissemination and/or destruction of PII take the DOJ Records and Information Training for New Employees (RIM) training course or another training approved by the Contracting Officer or COR. This training will be provided at the outset of the Subcontractor's/employee's work on the contract and every year thereafter. The Contractor shall maintain copies of certificates as a record of compliance and must submit an email notification annually to the COR verifying that all employees working under this contract have completed the required records management training. (b) The Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records containing PII and those covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format, mode of transmission, or state of completion. (2) Records Creation, Ownership, and Disposition (a) The Contractor shall not create or maintain any records not specifically tied to or authorized by the contract using Government IT equipment and/or Government records or that contain Government Agency information. The Contractor shall certify, in writing, the appropriate disposition or return of all Government information at the conclusion of the contract or at a time otherwise specified in the contract. In accordance with 36 CFR 1222.32, the Contractor shall maintain and manage all Federal records created in the course of performing the contract in accordance with Federal law. Records may not be removed from the legal custody of DOJ or destroyed except in accordance with the provisions of the agency records schedules. (b) Except as stated in the Performance Work Statement and, where applicable, the Contractor's Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and may be considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data. (c) The Contractor shall not retain, use, sell, disseminate, or dispose of any government data/records or deliverables without the express written permission of the Contracting Officer or Contracting Officer's Representative. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. § 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the Agency records schedules. D. Data Privacy and Oversight (1) Restrictions on Testing or Training Using Real Data Containing PII The use of real data containing PII from any source for testing or training purposes is generally prohibited. The Contractor shall use synthetic or de-identified real data for testing or training whenever feasible. (2) Requirements for Contractor IT Systems Hosting Government Data The Contractor is required to obtain an Authority To Operate (ATO) for any IT environment owned or controlled by the Contractor or any Subcontractor on which Government data shall reside for the purposes of IT system development, design, data migration, testing, training, maintenance, use, or disposal. (3) Requirement to Support Privacy Compliance (a) If this contract requires the development, maintenance or administration of information technology[9], the Contractor shall support the completion of the Initial Privacy Assessment (IPA) document, if requested by Department personnel. An IPA is the first step in a process to identify potential privacy issues and mitigate privacy risks. The IPA asks basic questions to help components assess whether additional privacy protections may be needed in designing or implementing a project[10] to mitigate privacy risks, and whether compliance work may be needed. Upon review of the IPA, the OPCL determines whether a Privacy Impact Assessment (PIA) document

15JPSS26F00001694 Page 30 of 38 and/or SORN, or modifications thereto, are required. The Contractor shall provide adequate support to complete the applicable risk assessment and PIA document in a timely manner, and shall ensure that project management plans and schedules include the IPA, PIA, and SORN (to the extent required) as milestones. Additional information on the privacy compliance process at DOJ, including IPAs, PIAs, and SORNs, is located on the DOJ OPCL website (https://dojnet.doj.gov/privacy/), including DOJ Order 0601, Privacy and Civil Liberties. The Privacy Impact Assessment Guidance and Template outline the requirements and format for the PIA. (b) If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy risk assessment and documentation, the Contractor shall provide adequate support to DOJ to ensure DOJ can complete any required assessment, and IPA, PIA, SORN, or other supporting documentation to support privacy compliance. The Contractor shall work with personnel from the program office, OPCL, the Office of the Chief Information Officer (OCIO), and the Office of Records Management and Policy to ensure that the privacy assessments and documentation are kept on schedule, that the answers to questions in the documents are thorough and complete, and that questions asked by the OPCL and other offices are answered in a timely fashion. The Contractor must ensure the completion of required PIAs and documentation of privacy controls consistent with federal law and standards, e.g. NIST 800-53, Rev. 5; and compliance with the Privacy Act of 1974, E-Government Act of 2002, Federal Information Security Modernization Act of 2014, and key OMB guidelines, e.g., OMB Circular A-130. [1] "[T]he term 'record' means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." 5 U.S.C. § 552a(a)(4). "[T]he term 'system of records' means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5). [2] As stated in FAR 52.224-3 and Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource (2016), "'personally identifiable information' means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Regarding "sensitive PII," "[t]he sensitivity level of the PII will depend on the context, including the purpose for which the PII is created, collected, used, processed, stored, maintained, disseminated, disclosed, or disposed. For example, the sensitivity level of a list of individuals' names may depend on the source of the information, the other information associated with the list, the intended use of the information, the ways in which the information will be processed and shared, and the ability to access the information." OMB Circular A-130, at App. II-2. [3] The DOJ OPCL Resources page is available at https://www.justice.gov/opcl/resources. [4] As stated in DOJ Instruction 0900, "Contractors must notify the Contracting Officer, the Contracting Officer's Representative, and JSOC (or component-level SOC) within 1 hour of discovering any incidents, including breaches, consistent with this Instruction, guidance issued by the CPCLO, NIST standards and guidelines, and the US-CERT notification guidelines." [5] https://www.justice.gov/file/4336/download [6] As stated in DOJ Instruction 0900, the description should include the type of information that constitutes PII; purpose for which PII is collected, maintained, and used; extent to which PII identifies a peculiarly vulnerable population; the determination of whether the information was properly encrypted or rendered partially or completely inaccessible by other means; format of PII (e.g., whether PII was structured or unstructured); length of time PII was exposed; any evidence confirming that PII is being misused or that it was never accessed. [7] As stated in DOJ Instruction 0900, the report should include the nature of the cyber threat (e.g., Advanced Persistent Threat, Zero Day Threat, data exfiltration) for cyber incidents. [8] As stated in DOJ Instruction 0900, the report should include analysis on whether the data is accessible, usable, and intentionally targeted. [9] As defined in 40 U.S.C. § 11101, the term "information technology" means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use (i) of that equipment or (ii) of that equipment to a significant extent in the performance of a service or the furnishing of a product; includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but does not include any equipment acquired by a federal contractor incidental to a federal contract. [10] In this instance, the term "project" is used to scope the activities (e.g., creating, collecting, using, processing, storing, maintaining, disseminating, disclosing, or disposing of information) covered by an IPA. A project is intended to be

15JPSS26F00001694 Page 31 of 38 technology-neutral, and may include an information system, a digital service, an information technology, a combination thereof, or some other activity that may create potential privacy issues or privacy risks that would benefit from an IPA. The scope of a project covered by an IPA is discretionary, but components should work with their SCOP and OPCL. (End of Clause) DOJ-03 Personnel Security Requirements For Contractor Employees (Nov 2021) Work performed under this contract will involve any one or more of the following: access to DOJ Information, which may include Controlled Unclassified Information (CUI), i.e., unclassified, sensitive DOJ information, and/or access to DOJ Information Technology (IT) systems, and/or unescorted access to DOJ space or facilities. Contractor employees will occupy Public Trust Positions, unless clause alternates are applied. 1. General Requirements (a) (1) All references to "contract(or) personnel" and "contract(or) employee" in this clause means all individuals, without limitation, to include individuals employed by the contractor, team member, subcontractor, consultant, and/or independent contractor, who will have access to information of the Department of Justice (DOJ) or information that is within the custody and control of the DOJ, access to DOJ IT systems, and/or unescorted access to DOJ facilities/space in connection with the performance of this contract. "Employment" as used herein does not create nor imply an employer/employee relationship between the DOJ and contractor employees. (b) (1) The type of security investigation required for each contractor employee will be governed by the type and risk level of information made available to the contractor employee. The contractor will not be permitted to commence performance under this contract until a sufficient number of its personnel, as determined by the Security Programs Manager (SPM), in consultation with the Contracting Officer's Representative if one is appointed, have received the requisite security approval. (c) Except where specifically noted otherwise, the federal government will be responsible for the cost and conduct of the investigation. (d) The contractor shall ensure that no contractor employee commences performance prior to receipt of a written authorization from the contracting officer, COR, or the SPM that performance by the respective contractor employee is authorized. (e) The data and other information to which the contractor may have access as a result of this contract is the property of, and/or within the custody and control of, the Department, and its disclosure to third parties is governed by various statutes and regulations, the violation of which may subject the discloser to criminal penalties. 2. Citizenship and Residency Requirements (a) Residency Requirement. (1) Contractor employees in Public Trust positions, both U.S. citizens and non-U.S. citizens, must meet the Department's residency requirement if they will require access to DOJ information, IT systems, or unescorted access to facilities. For three years (not necessarily consecutive years) out of the last five years immediately prior to employment under the Department contract the contractor employee must have: (i) resided in the U.S.; (ii) worked for the U.S. in a foreign country as either an employee or contractor in a federal civilian or military capacity; or, (iii) been a dependent of a federal civilian or military employee or contractor working for the U.S. in a foreign country. At the Department's sole discretion, the residency requirement may be waived by the Department Security Officer (DSO) for contractor employees on a case-by-case basis where justified by extenuating circumstances. The residency requirement does not apply to contractor employees residing in foreign countries that are hired to work in American embassies/ consulates/missions located outside of the United States and who require access to DOJ information, IT systems, or unescorted access provided that an adequate background investigation can be conducted, with favorable adjudication, as determined by the DSO. (b) Citizenship. (1) Aside from the specific exceptions set forth in Section 1.2(b)(2), for Public Trust positions, the DOJ requires that contractor employees be U.S. citizens and nationals, or lawful permanent residents seeking U.S. citizenship. Any prospective non-U.S. citizen contractor employee who requires access to DOJ information systems, DOJ information, and/or unescorted facilities access must also have been granted a waiver as described below in paragraphs 1.2(d) and/or

15JPSS26F00001694 Page 32 of 38 (e). The contractor is responsible for verifying that the non-U.S. citizens working under this contract are lawful permanent residents seeking U.S. citizenship. (2) Exception for Certain Non-U.S. Citizen Contractor Employees: (i) Non-U.S. citizen expert witnesses, litigative consultants, and interpreters in rare foreign languages are not required to be lawful permanent residents seeking U.S. citizenship. However, they must be granted a waiver for access to unclassified DOJ information, whether CUI or not, DOJ IT systems, and/or unescorted facility access, as described below in paragraph 1.2(d) and (e), regardless of the duration of their duties. (ii) Non-U.S. Citizen contractor employees residing in foreign countries who are hired to work for the Department of Justice in American embassies/consulates/missions outside of the United States are not required to be lawful permanent residents seeking U.S. citizenship. (c) Dual Citizenship. (1) U.S. citizens who hold dual citizenship with a foreign country are considered U.S. citizens within the meaning of this clause, and may be considered for, but are not entitled to, contract employment as U.S. citizens consistent with this clause. The means by which the contractor employee obtained or exercises his or her dual citizenship status will be a consideration in the Public Trust Investigation (PTI) adjudication, and/or waiver approval processes discussed in this clause. (d) Access to DOJ Information Technology Systems. Non-U.S citizens are not authorized to access DOJ information technology (IT) systems or assist in the development, operation, management, or maintenance of DOJ IT systems, including providing IT system support, unless a waiver has been granted by the Head of the DOJ component or designee, with the prior concurrence of both the DSO and the DOJ Chief Information Officer, allowing computer access by the non- U.S. citizen. Such a waiver will be granted only in exceptional and unique circumstances on a case-by-case basis. It should be noted that the Justice Consolidated Office Network (JCON) is a sensitive DOJ IT system and any contractor employee who will need access to JCON must be a U.S. citizen or have received a waiver. In order for a waiver to be considered for approval: (1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; (2) The type of personnel security vetting that has been conducted on the individual, and vetting results, that would mitigate risk; and (3) The waiver must be in the best interest of the federal government. (e) Access to Unclassified DOJ Information and Unescorted Access to DOJ Facilities or Space. (1) Except as provided under 1.2(b)(2), non-U.S. citizens are not authorized to access DOJ information and/or unescorted access to DOJ facilities or space, unless a waiver has been granted by the DSO, allowing access by the non-U.S. citizen. Such a waiver will be granted on a case-by-case basis where justified at the discretion of the DSO. 3. Background Investigation Requirements (a) (1) Unless otherwise stated below, all contractor personnel are subject to a Public Trust Investigation (PTI). The SPM will determine the type of investigation for each contractor employee based on the risk category (i.e., the nature of the position and degree of harm that could be caused by the individual in that position) and whether the position is long- term or short-term. The PTI risk categories are listed below. (i) High Risk Positions. The minimum background investigation required is a Tier 4 (T4) investigation, and the five-year reinvestigation required is a Tier 4R (T4R) investigation. The 2017 version of the Standard Form (SF) 85P, Questionnaire for Public Trust Positions, is required. (ii) Moderate Risk Positions. The minimum background investigation required is a Tier 2 (T2) investigation. The five-year reinvestigation required is a Tier 2R (T2R) investigation. The 2017 version of the SF-85P is required. (iii) Low Risk/Non-Sensitive Positions. The minimum background investigation required for Low Risk/Non- Sensitive positions is a Tier 1 (T1) investigation and the required five-year reinvestigation is also a Tier 1 (T1) investigation. The SF 85, Questionnaire for Non-Sensitive Positions, is required. (b) Exception for Expert Witnesses. Expert Witnesses, litigative consultants, and interpreters in rare foreign languages may not be subject to full background investigation requirements if alternative security requirements are approved by the DSO. (c) Short-Term U.S. Citizen Contractor Employees. Other than the exception in Section 1.3(b), short-term contractor employees (6 months or less) who are U.S. citizens are not subject to a full background investigation, however, must receive an approved pre-employment background investigation waiver. The required forms to complete and submit are listed in Section 1.4(b) and (c)(2).

15JPSS26F00001694 Page 33 of 38 (d) Long-Term U.S. Citizen Contractor Employees. Other than the exception in Section 1.3(b), all long-term U.S. citizen employees (longer than 6 months) are subject to a full background investigation in the risk category appropriate to the position they will hold. (e) Non-U.S. Citizen Contractor Employees. Other than the exception in 1.3(b), all non-U.S. citizen contractor employees regardless of performance duration (short or long term) are subject to a full background investigation in the risk category appropriate to the position they will hold. (f) Reciprocity. (1) A Public Trust Investigation will be accepted under reciprocity if it meets the following guidelines: (i) the investigation is current (investigations are considered current if completed within the last five years) and favorably adjudicated, or the reinvestigation has been deferred; (ii) the investigation meets or exceeds the level of investigation required for the DOJ contractual instrument; (iii) there has been no continuous (not cumulative) break in federal contract/ service employment of two years or more; (iv) there is no derogatory information since the favorable fitness determination or adjudication that calls into question the individual's fitness based on character or conduct; and (v) the investigative record does not show conduct that is incompatible with the core duties of the new contract position. A "core duty" is a continuing responsibility that is of particular importance to the relevant covered position or the achievement of an agency's mission. Core duties will vary from position to position. 4. Background Investigation Process (a) e-QIP (or its successor). Public Trust background investigations/reinvestigations of contractor employees will be performed by the DCSA. The investigative process requires contractor employees to complete the Electronic Questionnaires for Investigations Processing (e-QIP) and provide additional information as specified in paragraph 1.4(b) below. Immediately after contract award, the contractor shall designate an employee as its "e-QIP Initiator" and provide the name of this person to the SPM. The e-QIP Initiator must have, at a minimum, a favorably adjudicated Tier 1 investigation and the appropriate DOJ security approval before being given access to e-QIP. After the e-QIP Initiator's security approval is granted, the Contractor will be configured in e-QIP as a sub-agency to DOJ. The contractor will then be responsible for initiating investigations for all contract personnel, whose previous investigation does not meet reciprocity, in e-QIP for completion of the security questionnaire form and forwarding the electronic form with the remainder of the security package to the SPM. Subject to the prior written approval of the SPM, the contractor may designate an e-QIP Initiator for each subcontractor. Subcontractor e-QIP Initiators must have, at a minimum, a favorably adjudicated Tier 1 investigation and the appropriate DOJ security approval before being provided access to e-QIP. (b) Additional Documentation. (1) In addition to completing the e-QIP questionnaire (see 1.4(a), above), the contractor shall ensure that each contractor employee occupying Public Trust Positions, including short-term employees, completes and submits the following information through the contractor's Corporate Security Officer: (i) Digital Fingerprinting/FD-258 Applicant Fingerprint Card. Two sets are required per applicant. The contractor may schedule appointments with the SPM to be digitally fingerprinted; otherwise, fingerprinting by the FBI or other law enforcement entity, as approved by the SPM, is required to ensure the identity of the person being fingerprinted and for printing quality. All pertinent information must be completed by the individual taking the fingerprints (FBI or other). Use of the physical FD-258 Applicant Fingerprint Card should only be used in extenuating circumstances. (ii) DOJ-555 Fair Credit Reporting Act Disclosure. Authorizes DOJ to obtain one or more consumer/credit reports on the individual. This form will be required if the Component SPM determines a credit check is necessary for its Low Risk Level 1 contractor positions. (iii) OF-306, Declaration for Federal Employment. (iv) Foreign National Relatives or Associates Statement. This is only required if foreign national relatives or associates were not disclosed on the security questionnaire form. (v) Self-Reporting Requirements for All Contractor Personnel. This is an acknowledgement and acceptance statement that every contractor must sign. (vi) Additional information as may be required based on the review of the security questionnaire form. The contractor shall review all forms/documents to ensure each is complete, accurate and meets all DOJ requirements, including applicable residency and citizenship requirements. The contractor shall resolve any issues or discrepancies with the contractor employee, including resubmission of corrected forms or documentation. Completed forms/documents shall be submitted to the SPM (or designee, which may include the COR) within five (5) calendar days after being finalized. (c) Adjudication and Pre-Employment Background Investigation Waivers

15JPSS26F00001694 Page 34 of 38 (1) Except as set forth in this section, background investigations must be conducted and favorably adjudicated for each contractor employee prior to commencing their work on this contract. Where programmatic needs do not permit the federal government to wait for completion of the entire background investigation, a pre-employment background investigation waiver for public trust contractors can be granted by the SPM, in consultation with the cognizant COR. Pre- employment waivers cannot be used to circumvent delays in clearing classified contractors through the DCSA, if access to classified information is required. (2) As directed by the SPM, the contractor shall initiate pre-employment waivers for Public Trust Positions when necessary. This may entail performing credit history checks and submission of these checks as part of the security package, including satisfactory resolution of any issues prior to submission to the federal government. A waiver will be disapproved if it develops derogatory information that cannot be resolved in the contractor employee's favor. When a waiver has been disapproved, the CO, in consultation with the SPM and COR, will determine (i) whether the contractor employee will no longer be considered for work on a DOJ contract or (ii) whether to wait for the completion and favorable adjudication of the background investigation before the contractor employee commences work on a Department contract. The pre-employment background investigation waiver requirements include: 1. Verification of citizenship (copy of a birth certificate, naturalization certificate, or U.S. passport); 2. Verification of compliance with the DOJ Residency Requirement of this Clause; 3. Favorable review of the security questionnaire form; 4. Favorable FBI fingerprint results; 5. Favorable credit report; 6. Favorable review of the OF-306 form, Declaration for Federal Employment; 7. Verification of the initiation of the appropriate background investigation (for long-term personnel); and 8. Receipt of the signed DOJ Self-Reporting Requirements for All Contractor Personnel (see Section 6, below). (3) The investigating agency (DCSA) will provide the SPM with the results of each proposed contractor employee's Public Trust investigation. Upon receipt of the investigation and any other pertinent documents from the investigating agency, the SPM will determine whether each proposed contractor employee should be granted employment security approval. (4) The COR will notify the contractor of the results of Public Trust background investigations as they are completed and adjudicated, including any individual who is found ineligible for employment security approval. For any individual found ineligible for employment on a Department contract, the contractor shall propose a replacement and initiate the background investigation process consistent with this clause. 5. Identity Proofing and Badging (a) Access to DOJ Information, federally-controlled IT systems, and/or unescorted access to federally-controlled facilities or space (regardless of whether the contractor employee will be issued a DOJ PIV card or building access badge) shall be made available after each respective contractor employee has (1) met the identity proofing requirements outlined below, and (2) completed all other security requirements stated elsewhere in this contract. (b) (1) Public Trust contractor employees must appear in person at least once before a DOJ official or an official of a trusted contract company (i.e., has a facility security clearance) who is responsible for checking two forms of identification in original form prior to commencement of work by the contractor employee and PIV card or building access badge issuance (as applicable). Approval will be documented by the DOJ official or an official of a trusted contract company. (Acceptable documents are listed in Form I 9, Employment Eligibility Verification, and at least one document must be a valid state or federal government issued picture ID). (c) [Reserved] (d) All contractor employees requiring unescorted access to a DOJ controlled facility or space shall comply with the PIV card or building access badge requirements outlined below: (i) When any contractor employee enters a DOJ building for the first time, he/she shall allow one hour for security processing and the creation and issuance of a building access badge. PIV cards require additional processing time and will not likely be issued on the same day.

15JPSS26F00001694 Page 35 of 38 (ii) Building access badges shall be subject to periodic review by the contractor employee's supervisor and checked against his/her personal identification. The contractor employees shall present themselves for the issuance of renewed badges when required by the government as scheduled by the COR or his/her designee. The contractor shall notify the COR when contractor employee badges are lost, and must immediately apply for reissuance of a replacement badge. The contractor shall pay for reissued building access badges at no cost to the government. It is the contractor employee's responsibility to return badges to the COR or his/her designee when a contractor employee is dismissed, terminated or assigned to duties not within the scope of this contract. 6. Employee Reporting Requirements (a) All contractor employees must sign the DOJ Self-Reporting Requirements for All Contractor Personnel statement acknowledging and accepting the DOJ requirement that they immediately self-report certain information using the Department's iReport system. The COR or SPM will provide the Self-Reporting statement as well as a list of reportable information, which varies by position sensitivity designation, to the contractor employee before commencing work under the contract. If the contractor employee does not have access to the DOJ iReport System, the COR or SPM will provide a fillable form for the contractor employee to complete and submit. (b) The COR and SPM will review the written report and documentation and make a determination regarding continued employment on a DOJ contract. (c) DOJ reporting requirements are in addition to the DCSA reporting requirements and the contractor's internal reporting requirements. 7. Replacement Personnel (a) The contractor shall make every effort to avoid costs to the government for security investigations for replacement of contractor employees, and in so doing shall ensure that otherwise satisfactorily performing and physically able contractor employees remain in contract performance for the duration of the contract. The contractor shall take all necessary steps to ensure that contractor personnel who are selected for assignment to this contract are professionally qualified and personally reliable, of reputable background and sound character, and able to meet all other requirements stipulated in the contract. (b) The fact that the government performs security investigations shall not in any manner relieve the contractor of its responsibility to ensure that all contract personnel are reliable and of reputable background and sound character. Should a security investigation conducted by the government and/or a contractor's self-report or failure to self-report render ineligible a contractor employee, the contracting officer will determine whether the contractor has violated this clause. The contracting officer may direct the contractor, at its own expense, to remove and replace any contractor personnel who fails to comply with or violates applicable requirements of this contract. Such action may be taken at the government's direction without prejudice to its rights under any other provision of this contract, including termination for default, and the contractor may be held liable, at a minimum, for all reasonable and necessary costs incurred by the government to (i) provide coverage (performance) through assignment of individuals employed by the government or third parties in those cases where absence of contractor personnel would cause either a security threat or DOJ program disruption and (ii) conduct security investigations in excess of those which would otherwise be required. (c) Nothing in this clause shall require the contractor to bear costs involved in the conduct of security investigations for replacement of a contractor employee who separates from the contractor of his/her own accord, is incapacitated, or is deceased. (d) The contractor shall comply with the terms and conditions set forth under this clause and assumes all liability for failure to comply. The rights and remedies conferred upon the government by this clause are in addition to all and other rights and remedies pursuant to the contract and as established by law. (End of Clause) DOJ-08 Continuing Contract Performance During a Pandemic Influenza or other National Emergency (OCT 2007) During a Pandemic or other emergency we understand that our contractor workforce will experience the same high levels of absenteeism as our federal employees. Although the Excusable Delays and Termination for Default clauses used in government contracts list epidemics and quarantine restrictions among the reasons to excuse delays in contract

15JPSS26F00001694 Page 36 of 38 performance, we expect our contractors to make a reasonable effort to keep performance at an acceptable level during emergency periods. The Office of Personnel Management (OPM) has provided guidance to federal managers and employees on the kinds of actions to be taken to ensure the continuity of operations during emergency periods. This guidance is also applicable to our contract workforce. Contractors are expected to have reasonable policies in place for continuing work performance, particularly those performing mission critical services, during a pandemic influenza or other emergency situation. The types of actions a federal contractor should reasonably take to help ensure performance are: • Encourage employees to get inoculations or follow other preventive measures as advised by the public health service. • Contractors should cross-train workers as backup for all positions performing critical services. This is particularly important for work such as guard services where telework is not an option. • Implement telework to the greatest extent possible in the workgroup so systems are in place to support successful remote work in an emergency. • Communicate expectations to all employees regarding their roles and responsibilities in relation to remote work in the event of a pandemic health crisis or other emergency. • Establish communication processes to notify employees of activation of this plan. • Integrate pandemic health crisis response expectations into telework agreements. • With the employee, assess requirements for working at home (supplies and equipment needed for an extended telework period). Security concerns should be considered in making equipment choices; agencies or contractors may wish to avoid use of employees' personal computers and provide them with PCs or laptops as appropriate. • Determine how all employees who may telework will communicate with one another and with management to accomplish work. • Practice telework regularly to ensure effectiveness. • Make it clear that in emergency situations, employees must perform all duties assigned by management, even if they are outside usual or customary duties. • Identify how time and attendance will be maintained. It is the contractor's responsibility to advise the government contracting officer if they anticipate not being able to perform and to work with the Department to fill gaps as necessary. This means direct communication with the contracting officer or in his/her absence, another responsible person in the contracting office via telephone or email messages acknowledging the contractor's notification. The incumbent contractor is responsible for assisting the Department in estimating the adverse impacts of nonperformance and to work diligently with the Department to develop a strategy for maintaining the continuity of operations. The Department does reserve the right in such emergency situations to use federal employees. employees of other agencies, contract support from other existing contractors, or to enter into new contracts for critical support services. Any new contracting efforts would be acquired following the guidance in the Office of federal Procurement Policy issuance "Emergency Acquisitions", May, 2007 and Subpart 18.2. Emergency Acquisition Flexibilities, of the Federal Acquisition Regulations. (End of Clause) DOJ-09 Large Language Models (MAR 2026) (a) Definitions.

15JPSS26F00001694 Page 37 of 38 1. "Large language model" (LLM) means a generative Artificial Intelligence (AI) model trained on vast, diverse datasets that enable the model to generate natural-language responses to user prompts. 2. "Restricted Intellectual Property" means computer code (whether machine readable or written in a programming language) and model weighting information. (b) Compliance with Unbiased AI Principles. Any LLM provided under this contract, including an LLM integrated into another software product or service, must adhere to the Unbiased AI Principles, truth-seeking and ideological neutrality, as set forth in Executive Order 14319, Preventing Woke AI in the Federal Government (July 23, 2025). (c) End-User Feedback. LLMs provided under this contract must provide a meaningful option for an end-user to submit feedback and provide notice on outputs, including those that violate the Unbiased AI Principles (such as a general inbox, specific product point of contact, or similar mechanism). (d) Disclosure Obligations. The Offeror (or, in the event of an existing contract, the Contractor) must clearly disclose any planned or potential provision of an LLM as part of the Offer (or, in the event of an existing contract, in a separate disclosure provided within ten days of the date on which this clause is incorporated into the contract). This disclosure must include the following information: 1. The LLM acceptable use policy; 2. LLM model, system, and/or data cards, ordinarily including summaries of the training process, identified risks and mitigations, and model evaluation scores on LLM benchmarks; 3. Architecture decision records, application programming interface documentation and specifications, data lineage and dataset descriptions; 4. Development artifacts including contextual documentation, project blueprints and boilerplates; 5. Process and governance artifacts including product requirements documents, traceability reports, security checklists and risk assessments, and evaluation and test results; 6. Explanation of the proposed user-interface and user-experience (human-centered) design approach, 7. If the proposed LLM utilizes model merging or model blending, documentation of details on this process, 8. Key characteristics including format, version control, purpose, and proposed evaluation and quality assurance plans; 9. Recommended architectural and data workflow diagrams on where the proposed model would reside, how the model would address data inputs and outputs, and what connections and safeguards it hosts in relation to other versions, models, or iterations external to the proposed model residence; 10.End-user resources for the LLM (e.g., product tutorials, developer guides, or other best tools to help customers ensure proper use of the LLM and maximize utility); 11.Details regarding the mechanism(s) for end user feedback; and 12.Any additional information identified as necessary to assess compliance with the Unbiased Principles either explicitly required in the solicitation or, for existing contracts, in an agency request. Nothing in this paragraph shall require the Offeror to disclose Restricted Intellectual Property. (e) Materiality of Performance. The requirements stated in this section are material to eligibility, performance, and payment under the contract. In the event that the Contracting Officer notifies the Contractor that an LLM provided under this contract fails to comply with the provisions of this section, and the Contractor fails to cure the violation within a reasonable period, the Department shall be entitled to terminate the contract for default (or in the case of a commercial contract, for cause) and the Contractor shall be responsible for all resulting costs and other damages, including those associated with decommissioning the LLM. (f) Subcontractor Obligations. The requirements in this section shall be flowed-down to and shall apply to LLMs provided by subcontractors at all tiers. (End of Clause) [END OF ADDENDUM TO FAR 52.212-4]

15JPSS26F00001694 Page 38 of 38 Section 3 - List of Attachments Identifier Title Number of Pages 1 Statement of Work (SOW) DERP 1 USA186_1012896 2 DERP DOJ Cybersecurity Program Order 2 USA186_1100165 3 DERP DOJ Incremental IT Methodology 3 USA186_1101081