Contract

SOLICITATION, OFFER AND AWARD 1. THIS CONTRACT IS A RATED ORDER UNDER DPAS (15 CFR 7900) RATING PAGE OF 1 PAGES 81 2. CONTRACT NUMBER 3. SOLICITATION NUMBER 4. TYPE OF SOLICITATION 5. DATE ISSUED 6. REQUISITION/PURCHASE NUMBER 91003123D0005 91003122R0007 SEALED BID (IFB) NEGOTIATED (RFP) 7. ISSUED BY CODE FSA-ACQ 8. ADDRESS OFFER TO (If other than Item 7) US Department of Education FSA - Acquisitions, 000 Xxxxx Xx XX - Xxxxx 00X0 Xxxxxxxxxx XX 00000 NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder". SOLICITATION 9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in until local time (Hour) (Date) CAUTION - LATE Submissions, Modifications, and Withdrawls: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation. B. TELEPHONE (NO COLLECT CALLS)10. FOR INFORMATION CALL A. NAME AREA CODE NUMBER EXTENSION C. E-MAIL ADDRESS 11. TABLE OF CONTENTS (X) SEC. DESCRIPTION PAGE(S) (X) SEC. DESCRIPTION PAGE(S) PART 1 - THE SCHEDULE PART II - CONTRACT CLAUSES X A SOLICITATION/CONTRACT FORM 1 - 1 I CONTRACT CLAUSES - X B SUPPLIES OR SERVICES AND PRICES/COSTS 81 - 81 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH. C DESCRIPTION/SPECS./WORK STATEMENT - J LIST OF ATTACHMENTS - D PACKAGING AND MARKING - PART IV - REPRESENTATIONS AND INSTRUCTIONS E INSPECTION AND ACCEPTANCE - K REPRESENTATIONS, CERTIFICATIONS AND OTHER - F DELIVERIES OR PERFORMANCE - STATEMENTS OF OFFERORS G CONTRACT ADMINISTRATION DATA - L INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS - H SPECIAL CONTRACT REQUIREMENTS - M EVALUATION FACTORS FOR AWARD - OFFER (Must be fully completed by offeror) NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period. 12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the set opposite each item, delivered at the designated point(s), within the time specified in the schedule. 13. DISCOUNT FOR PROMPT PAYMENT (See Section I, Clause No. 52.232-8) 10 CALENDAR DAYS (%) 20 CALENDAR DAYS (%) 30 CALENDAR DAYS (%) CALENDAR DAYS (%) 14. ACKNOWLEDGMENT OF AMENDMENTS AMENDMENT NO. DATE AMENDMENT NO. DATE (The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated): CODE 87CE3 FACILITY 16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER 15A. NAME AND ADDRESS OF OFFEROR NELNET DIVERSIFIED SOLUTIONS LLC 000 X 00XX XX. STE 201 LINCOLN NE 68508 (Type or print) 15B. TELEPHONE NUMBER 15C. CHECK IF REMITTANCE ADDRESS IS DIFFERENT AREA CODE NUMBER EXTENSION FROM ABOVE - ENTER SUCH ADDRESS IN SCHEDULE. 17. SIGNATURE 18. OFFER DATE AWARD (To be completed by Government) 19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION $0.00 See Schedule 22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION: 10 U.S.C. 2304(c) 41 U.S.C. 3304(a) ( ) 23. SUBMIT INVOICES TO ADDRESS SHOWN IN (4 copies unless otherwise specified) ITEM 24. ADMINISTERED BY (If other than Item 7) FSA-ACQ 25. PAYMENT WILL BE MADE BY CODE FSA-BUD US Department of Education FSA - Acquisitions, 000 Xxxxx Xx XX - Xxxxx 00X0 Xxxxxxxxxx XX 00000 Budget Group/Invoice Admin US Department of Education/FSA/CFO/BG/FSAA 000 Xxxxx Xxxxxx, XX, Xxxxx 00X0 Xxxxxxxxxx XX 00000-0001 26. NAME OF CONTRACTING OFFICER(Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE Xxxxxxx XxXxxx (Signature of Contracting Officer) IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice. AUTHORIZED FOR LOCAL REPRODUCTION Previous edition is unusable STANDARD FORM 33 (REV. 6/2014) Prescribed by GSA - FAR (48 CFR) 53.214(c) PAGE 1 OF 81 91003123D0005 Xxx Xxxxxxx Executive Director 04/24/2023 XXXXXXX XXXXXX Digitally signed by XXXXXXX XXXXXX Date: 2023.04.24 12:39:30 -04'00' Certain information identified by “[***]” has been excluded from this exhibit pursuant to Item 601(b)(10)(iv) of Regulation S-K because it is both not material and is the type that the registrant treats as private or confidential.

Attachment Page PAGE 2 OF 81 91003123D0005 I. Part I: The Schedule (continued) B. Section B: Services & Prices 1. B. 1 Contract Line-Item Number (CLIN) Descriptions The following table describes the available CLINs under the Contract for Task Orders and their associated contract types. General CLIN Descriptions CLIN 1 Title: Servicing System Operations Basic system operations and support, including: servicing system infrastructure (hardware, software, network, data and image storage etc.) maintenance and upgrades and IT staffing (system support, system development and overhead) for normal operations and maintenance and routine system upgrades (i.e. interest rate changes, business rule updates, regulatory changes, etc.) in accordance with the contract requirements. This CLIN is fixed price with economic price adjustment with tiered rates tied to the number of borrower accounts on the USDS Servicer’s system. CLIN 2 Title: Cybersecurity Services Cybersecurity costs including, but not limited to: labor for Cybersecurity requirements, software licensing, 3rd party vendor support, overhead, etc. required to support requirements for cybersecurity operations and maintenance. This CLIN does not include Servicing System Operations (CLIN 1), Website and Mobile Services (CLIN 4) or User Authentication Services (CLIN 5). This CLIN is fixed price with economic price adjustment with tiered rates tied to the number of borrower accounts on the USDS Servicer’s system. CLIN 3 Title: Contact Center and Back-Office Processing Operation & Maintenance Basic contact center and back-office operations, including: staffing, recruiting, equipment, software, training, quality monitoring, overhead, facilities, etc. to perform the requirements of the Contract. This CLIN also includes the requirements for servicing military borrower accounts. This CLIN is fixed price with economic price adjustment with one or more performance incentives and with tiered rates tied to the number of borrower accounts on the USDS Servicer’s system. Performance Incentives Performance Incentive for At-risk Borrowers (Applies to CLIN 3 and includes military borrower accounts) Performance Incentive for SLA/SLO Performance Metrics (Applies to CLIN 3 and includes military borrower accounts) CLIN 4 Title: Website and Mobile Services Website and mobile services including: web and mobile staffing (IT infrastructure, IT design & development and overhead), normal maintenance and routine upgrades (i.e. form revisions, borrower messaging and text changes, business rule updates, regulatory changes, etc.), hardware and software. This CLIN is fixed price with economic price adjustment with tiered rates tied to the number of borrower accounts on the USDS Servicer’s system.

Attachment Page PAGE 3 OF 81 91003123D0005 CLIN 5 Title: User Authentication Services User authentication (will be eliminated upon implementation of FSA Single Sign On) including: staff, software, support for password reset and equipment. This CLIN is fixed price with economic price adjustment and with a fixed price rate tied to the number of borrower accounts on the USDS Servicer’s system. CLIN 6 Title: Fulfillment Services Fulfillment services including, but not limited to: equipment, personnel, postage, paper, printing, mail scanning, other 3rd party vendor tasks. This CLIN is fixed price with economic price adjustment with fixed price unit rates for envelops (letter(s)) sent (which includes postage and labor), scanned documents, and alternate format documents. CLIN 7 Title: Development, Modernization & Enhancements. Development, Modernization & Enhancement including, but not limited to: projects or services to further develop, modernize, or enhance the requirements under this Contract. This CLIN will be firm-fixed price or fixed price with economic price adjustment (prices and contract type determined at Task Order level). This CLIN establishes a table of labor categories and associated labor rates, subject to the economic price adjustment clause, for use in future Task Orders, contract modifications, and Change Requests (CR). CLIN 8 Title: Specialty Task - Image Repository See PWS section 3.3. This CLIN is fixed price with economic price adjustment and with a fixed price rate tied to per image per month on the USDS Servicer’s system. CLIN 9 Title: Specialty Task - Decommissioned Servicer Data and Payment Support See PWS section 3.3. Services in accordance with the Contract. This CLIN is fixed price with economic price adjustment and with fixed price rate tied to the number of borrower accounts on the USDS servicer’s system. CLIN 10 Title: Specialty Task - FFEL Guaranty Agency Rehabilitation Loan Purchases See PWS section 3.3. This CLIN is fixed price with economic price adjustment and with fixed price rate per number of successful rehabilitation deals. CLIN 11 Title: Loan Consolidation Origination and Disbursement See Attachment 01 – Business Operations and Servicing Requirements (section 15000) This CLIN is fixed price with economic price adjustment and with fixed price rates per number of successful consolidation originations and adjustments (different rates for each type) CLIN 12 Title: Specialty Task - Legacy Loan Consolidation Origination and Disbursement Support Functions See PWS section 3.3 This CLIN is fixed price with economic price adjustment and with fixed price rates per number of successful consolidation adjustments (different rates for each type)

Attachment Page PAGE 4 OF 81 91003123D0005 2. CLIN Pricing and Rates Each CLIN contains the prices and/or rates available to be applied with the Task Orders issued under the Contract, for each year of the Contract’s base period and all option periods. The Federal Acquisition Regulations (FAR) clause 52.217-8 Option to Extend Services, is applicable to all CLINs under the Contract for the contract and all Task Orders. In accordance with FAR clause 52.216-22, Indefinite Quantity, the maximum under this Contract is $16,000,000,000 dollars. The minimum under this Contract is the value of the initial Task Order (Initial Task Order) issued against the Contract. CLIN pricing set by negotiation shall be incorporated at award within this section on the next page.

Attachment Page PAGE 5 OF 81 91003123D0005 CL IN Ra te s: N ot e: M eq ua ls M ill io ns O pt io n O rd er in g Pe rio d 3 (1 Ye ar s) Ra xx xX ow #: CL IN 1 Se rv ic in g Sy st em O pe ra tio ns Co m m on Pr ic in g Q ua nt ity by U ni t bo rr ow er pe rm on th Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts O rd er in g Ye ar 1 O rd er in g Ye ar 2 O rd er in g Ye ar 3 O rd er in g Ye ar 4 O rd er in g Ye ar 5 O rd er in g Ye ar 6 O rd er in g Ye ar 7 O rd er in g Ye ar 8 O rd er in g Ye ar 9 O rd er in g Ye ar 10 1 Ti er 1 U p to 2. 5M $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 $0 .7 62 05 2 2 Ti er 2 2. 5M 5M $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 $0 .5 73 46 3 3 Ti er 3 5M 7. 5M $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 $0 .4 66 71 5 4 Ti er 4 7. 5M 10 M $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 $0 .3 79 97 7 5 Ti er 5 10 M 15 M $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 $0 .2 59 33 0 6 Ti er 6 >1 5M $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 $0 .2 06 81 1 CL IN 2 Cy be rs ec ur ity Se rv ic es Co m m on Pr ic in g Q ua nt ity by U ni t bo rr ow er pe rm on th Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts 7 Ti er 1 U p to 2. 5M $0 .0 90 86 4 $0 .0 92 45 5 $0 .0 94 07 3 $0 .0 95 71 9 $0 .0 97 39 4 $0 .0 99 09 8 $0 .1 00 83 2 $0 .1 02 59 7 $0 .1 04 39 2 $0 .1 06 21 9 8 Ti er 2 > 2. 5M 5M $0 .0 78 71 2 $0 .0 80 08 9 $0 .0 81 49 1 $0 .0 82 91 7 $0 .0 84 36 8 $0 .0 85 84 4 $0 .0 87 34 6 $0 .0 88 87 5 $0 .0 90 43 0 $0 .0 92 01 3 9 Ti er 3 >5 M 7. 5M $0 .0 52 38 2 $0 .0 53 29 8 $0 .0 54 23 1 $0 .0 55 18 0 $0 .0 56 14 6 $0 .0 57 12 8 $0 .0 58 12 8 $0 .0 59 14 5 $0 .0 60 18 0 $0 .0 61 23 4 10 Ti er 4 >7 .5 M 10 M $0 .0 47 04 9 $0 .0 47 87 2 $0 .0 48 71 0 $0 .0 49 56 2 $0 .0 50 43 0 $0 .0 51 31 2 $0 .0 52 21 0 $0 .0 53 12 4 $0 .0 54 05 4 $0 .0 55 00 0 11 Ti er 5 >1 0M 15 M $0 .0 37 99 1 $0 .0 38 65 6 $0 .0 39 33 3 $0 .0 40 02 1 $0 .0 40 72 1 $0 .0 41 43 4 $0 .0 42 15 9 $0 .0 42 89 7 $0 .0 43 64 8 $0 .0 44 41 1 12 Ti er 6 >1 5M $0 .0 33 97 6 $0 .0 34 57 1 $0 .0 35 17 6 $0 .0 35 79 2 $0 .0 36 41 8 $0 .0 37 05 5 $0 .0 37 70 4 $0 .0 38 36 4 $0 .0 39 03 5 $0 .0 39 71 8 CL IN 3 Co nt ac tC en te ra nd Ba ck O ff ic e Pr oc es si ng O pe ra tio n & M ai nt en an ce Co m m on Pr ic in g Q ua nt ity by U ni t bo rr ow er pe rm on th Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts 13 Ti er 1 U p to 2. 5M $1 .3 92 28 1 $1 .4 16 64 6 $1 .4 41 43 7 $1 .4 66 66 2 $1 .4 92 32 9 $1 .5 18 44 4 $1 .5 45 01 7 $1 .5 72 05 5 $1 .5 99 56 6 $1 .6 27 55 8 14 Ti er 2 > 2. 5M 5M $1 .2 53 48 8 $1 .2 75 42 4 $1 .2 97 74 4 $1 .3 20 45 4 $1 .3 43 56 2 $1 .3 67 07 5 $1 .3 90 99 9 $1 .4 15 34 1 $1 .4 40 11 0 $1 .4 65 31 1 15 Ti er 3 >5 M 7. 5M $1 .1 52 30 7 $1 .1 72 47 2 $1 .1 92 99 0 $1 .2 13 86 8 $1 .2 35 11 0 $1 .2 56 72 5 $1 .2 78 71 8 $1 .3 01 09 5 $1 .3 23 86 4 $1 .3 47 03 2 16 Ti er 4 >7 .5 M 10 M $1 .1 24 38 6 $1 .1 44 06 3 $1 .1 64 08 4 $1 .1 84 45 5 $1 .2 05 18 3 $1 .2 26 27 4 $1 .2 47 73 4 $1 .2 69 56 9 $1 .2 91 78 6 $1 .3 14 39 3 17 Ti er 5 >1 0M 15 M $1 .1 17 31 0 $1 .1 36 86 3 $1 .1 56 75 8 $1 .1 77 00 2 $1 .1 97 59 9 $1 .2 18 55 7 $1 .2 39 88 2 $1 .2 61 58 0 $1 .2 83 65 7 $1 .3 06 12 1 18 Ti er 6 >1 5M $1 .0 62 02 7 $1 .0 80 61 2 $1 .0 99 52 3 $1 .1 18 76 5 $1 .1 38 34 3 $1 .1 58 26 4 $1 .1 78 53 4 $1 .1 99 15 8 $1 .2 20 14 3 $1 .2 41 49 6 Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts 19 Ti er 1 U p to 2. 5M $1 .4 25 63 9 $1 .4 50 58 7 $1 .4 75 97 3 $1 .5 01 80 2 $1 .5 28 08 4 $1 .5 54 82 5 $1 .5 82 03 5 $1 .6 09 72 0 $1 .6 37 89 0 $1 .6 66 55 3 20 Ti er 2 > 2. 5M 5M $1 .0 32 50 8 $1 .0 50 57 7 $1 .0 68 96 2 $1 .0 87 66 9 $1 .1 06 70 3 $1 .1 26 07 1 $1 .1 45 77 7 $1 .1 65 82 8 $1 .1 86 23 0 $1 .2 06 98 9 21 Ti er 3 >5 M 7. 5M $1 .0 04 68 7 $1 .0 22 26 9 $1 .0 40 15 8 $1 .0 58 36 1 $1 .0 76 88 2 $1 .0 95 72 8 $1 .1 14 90 3 $1 .1 34 41 4 $1 .1 54 26 6 $1 .1 74 46 6 22 Ti er 4 >7 .5 M 10 M $0 .9 96 94 6 $1 .0 14 39 3 $1 .0 32 14 5 $1 .0 50 20 7 $1 .0 68 58 6 $1 .0 87 28 6 $1 .1 06 31 3 $1 .1 25 67 4 $1 .1 45 37 3 $1 .1 65 41 7 23 Ti er 5 >1 0M 15 M $0 .9 84 45 7 $1 .0 01 68 5 $1 .0 19 21 5 $1 .0 37 05 1 $1 .0 55 20 0 $1 .0 73 66 6 $1 .0 92 45 5 $1 .1 11 57 3 $1 .1 31 02 5 $1 .1 50 81 8 24 Ti er 6 >1 5M $0 .9 76 26 4 $0 .9 93 34 8 $1 .0 10 73 2 $1 .0 28 42 0 $1 .0 46 41 7 $1 .0 64 72 9 $1 .0 83 36 2 $1 .1 02 32 1 $1 .1 21 61 2 $1 .1 41 24 0 Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts 25 Ti er 1 U p to 2. 5M $1 .2 73 53 9 $1 .2 95 82 6 $1 .3 18 50 3 $1 .3 41 57 7 $1 .3 65 05 5 $1 .3 88 94 3 $1 .4 13 25 0 $1 .4 37 98 2 $1 .4 63 14 6 $1 .4 88 75 1 26 Ti er 2 > 2. 5M 5M $1 .0 88 31 7 $1 .1 07 36 3 $1 .1 26 74 1 $1 .1 46 45 9 $1 .1 66 52 2 $1 .1 86 93 7 $1 .2 07 70 8 $1 .2 28 84 3 $1 .2 50 34 8 $1 .2 72 22 9 27 Ti er 3 >5 M 7. 5M $0 .8 96 11 6 $0 .9 11 79 8 $0 .9 27 75 4 $0 .9 43 99 0 $0 .9 60 51 0 $0 .9 77 31 8 $0 .9 94 42 2 $1 .0 11 82 4 $1 .0 29 53 1 $1 .0 47 54 8 28 Ti er 4 >7 .5 M 10 M $0 .8 68 28 0 $0 .8 83 47 5 $0 .8 98 93 6 $0 .9 14 66 7 $0 .9 30 67 4 $0 .9 46 96 0 $0 .9 63 53 2 $0 .9 80 39 4 $0 .9 97 55 1 $1 .0 15 00 8 29 Ti er 5 >1 0M 15 M $0 .8 58 35 0 $0 .8 73 37 2 $0 .8 88 65 6 $0 .9 04 20 7 $0 .9 20 03 1 $0 .9 36 13 1 $0 .9 52 51 4 $0 .9 69 18 3 $0 .9 86 14 3 $1 .0 03 40 1 30 Ti er 6 >1 5M $0 .8 54 30 6 $0 .8 69 25 7 $0 .8 84 46 9 $0 .8 99 94 7 $0 .9 15 69 6 $0 .9 31 72 0 $0 .9 48 02 6 $0 .9 64 61 6 $0 .9 81 49 7 $0 .9 98 67 3 CL IN 4 W eb si te an d M ob ile Se rv ic es Co m m on Pr ic in g Q ua nt ity by U ni t bo rr ow er pe rm on th Pr ic in g Le ve l N um be ro fB or ro w er Ac co un ts 31 U p to 2. 5M $0 .0 20 95 0 $0 .0 21 31 7 $0 .0 21 69 0 $0 .0 22 06 9 $0 .0 22 45 5 $0 .0 22 84 8 $0 .0 23 24 8 $0 .0 23 65 5 $0 .0 24 06 9 $0 .0 24 49 0 32 > 2. 5M 5M $0 .0 15 04 5 $0 .0 15 30 9 $0 .0 15 57 7 $0 .0 15 84 9 $0 .0 16 12 6 $0 .0 16 40 9 $0 .0 16 69 6 $0 .0 16 98 8 $0 .0 17 28 5 $0 .0 17 58 8 33 >5 M 7. 5M $0 .0 10 63 6 $0 .0 10 82 3 $0 .0 11 01 2 $0 .0 11 20 5 $0 .0 11 40 1 $0 .0 11 60 0 $0 .0 11 80 3 $0 .0 12 01 0 $0 .0 12 22 0 $0 .0 12 43 4 34 >7 .5 M 10 M $0 .0 09 93 5 $0 .0 10 10 9 $0 .0 10 28 6 $0 .0 10 46 6 $0 .0 10 64 9 $0 .0 10 83 6 $0 .0 11 02 5 $0 .0 11 21 8 $0 .0 11 41 5 $0 .0 11 61 4 35 >1 0M 15 M $0 .0 09 19 6 $0 .0 09 35 7 $0 .0 09 52 0 $0 .0 09 68 7 $0 .0 09 85 7 $0 .0 10 02 9 $0 .0 10 20 5 $0 .0 10 38 3 $0 .0 10 56 5 $0 .0 10 75 0 36 >1 5M $0 .0 09 64 7 $0 .0 09 81 6 $0 .0 09 98 8 $0 .0 10 16 3 $0 .0 10 34 1 $0 .0 10 52 2 $0 .0 10 70 6 $0 .0 10 89 3 $0 .0 11 08 4 $0 .0 11 27 8 CL IN 5 U se rA ut he nt ic at io n Se rv ic es Co m m on Pr ic in g Q ua nt ity by U ni t bo rr ow er pe rm on th $0 .0 10 81 7 $0 .0 11 00 6 $0 .0 11 19 9 $0 .0 11 39 5 $0 .0 11 59 4 $0 .0 11 79 7 $0 .0 12 00 3 $0 .0 12 21 3 $0 .0 12 42 7 $0 .0 12 64 5 CL IN 6 Fu lfi llm en tS er vi ce s Co m m on Pr ic in g Q ua nt ity by U ni t O rd er in g Ye ar 1 O rd er in g Ye ar 2 O rd er in g Ye ar 3 O rd er in g Ye ar 4 O rd er in g Ye ar 5 O rd er in g Ye ar 6 O rd er in g Ye ar 7 O rd er in g Ye ar 8 O rd er in g Ye ar 9 O rd er in g Ye ar 10 37 En ve lo ps (L et te r( s) )S en t pe re nv el op $0 .7 68 00 8 $0 .7 81 44 8 $0 .7 95 12 3 $0 .8 09 03 8 $0 .8 23 19 6 $0 .8 37 60 2 $0 .8 52 26 0 $0 .8 67 17 4 $0 .8 82 35 0 $0 .8 97 79 1 38 Sc an ne d Do cu m en ts pe rd oc um en t $0 .6 54 49 2 $0 .6 65 94 6 $0 .6 77 60 0 $0 .6 89 45 8 $0 .7 01 52 4 $0 .7 13 80 0 $0 .7 26 29 2 $0 .7 39 00 2 $0 .7 51 93 4 $0 .7 65 09 3 39 Al te rn at iv e Fo rm at Do cu m en ts pe rd oc um en t $5 .3 18 18 1 $5 .4 11 24 9 $5 .5 05 94 6 $5 .6 02 30 0 $5 .7 00 34 0 $5 .8 00 09 6 $5 .9 01 59 8 $6 .0 04 87 6 $6 .1 09 96 1 $6 .2 16 88 5 CL IN 7 D ev el op m en t, M od er ni za tio n, an d En ha nc em en ts O rd er in g Ye ar 1 O rd er in g Ye ar 2 O rd er in g Ye ar 3 O rd er in g Ye ar 4 O rd er in g Ye ar 5 O rd er in g Ye ar 6 O rd er in g Ye ar 7 O rd er in g Ye ar 8 O rd er in g Ye ar 9 O rd er in g Ye ar 10 40 CL IN 8 Sp ec ia lty Ta sk Im ag e Re po si to ry Q ua nt ity by U ni t pe ri m ag e pe rm on th $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 $0 .0 00 8 41 CL IN 9 Sp ec ia lty Ta sk D ec om m is si on ed Se rv ic er D at a an d Pa ym en tS up po rt Q ua nt ity by U ni t bo rr ow er pe rm on th $0 .0 30 0 $0 .0 31 0 $0 .0 32 0 $0 .0 33 1 $0 .0 34 2 $0 .0 35 3 $0 .0 36 5 $0 .0 37 7 $0 .0 39 0 $0 .0 40 3 42 CL IN 10 Sp ec ia lty Ta sk FF EL G ua ra nt y Ag en cy Re ha bi lit at io n Lo an Pu rc ha se s Q ua nt ity by U ni t pe rs uc ce ss fu l re ha bi lit at io n de al $6 08 .0 00 0 $6 28 .4 28 8 $6 49 .5 44 0 $6 71 .3 68 7 $6 93 .9 26 7 $7 17 .2 42 6 $7 41 .3 42 0 $7 66 .2 51 1 $7 91 .9 97 1 $8 18 .6 08 2 43 CL IN 11 Lo an Co ns ol id at io n O rig in at io n an d D is bu rs em en t Q ua nt ity by U ni t pe rs uc ce ss fu l co ns ol id at io n or ig in at io n $3 3. 63 00 $3 4. 76 00 $3 5. 92 80 $3 7. 13 52 $3 8. 38 30 $3 9. 67 27 $4 1. 00 58 $4 2. 38 36 $4 3. 80 77 $4 5. 27 97 Q ua nt ity by U ni t pe rs uc ce ss fu l ad ju st m en ts $2 0. 17 22 $2 0. 85 00 $2 1. 55 06 $2 2. 27 48 $2 3. 02 33 $2 3. 79 69 $2 4. 59 65 $2 5. 42 30 $2 6. 27 73 $2 7. 16 03 44 CL IN 12 Sp ec ia lty Ta sk Le ga cy Lo an Co ns ol id at io n O rig in at io n an d D is bu rs em en tS up po rt Fu nc tio ns Q ua nt ity by U ni t pe rs uc ce ss fu l ad ju st m en ts $2 0. 17 22 $2 0. 85 00 $2 1. 55 06 $2 2. 27 48 $2 3. 02 33 $2 3. 79 69 $2 4. 59 65 $2 5. 42 30 $2 6. 27 73 $2 7. 16 03 Pr ic in g/ Ra te sf or CL IN 7 sh al lb e co m pl et ed on th e La bo rC at eg or y W or ks he et xx x. N at io na lE m er ge nc y Fo rb ea ra nc e (C AR ES Ac t) Se rv ic in g Ba se O rd er in g Pe rio d (5 ye ar s) Se rv ic e M em be r/ M ili ta ry Se rv ic in g O pt io n O rd er in g Pe rio d 1 (2 Ye ar s) O pt io n O rd er in g Pe rio d 2 (2 Ye ar s) St an da rd Lo an Se rv ic in g Pa rt 1 Se ct io n B. 3 CL IN Pr ic in g an d Ra te sT ab le

Attachment Page PAGE 6 OF 81 91003123D0005 L ab or C at eg or y L ab or C at eg or y D es cr i p tio n W or k Pe rf or m ed b y L ab or c at eg or y L oc al ity (C ity , S ta te ) O rd er in g Y ea r 1 O rd er in g Y ea r 2 O rd er in g Y ea r 3 O rd er in g Y ea r 4 O rd er in g Y ea r 5 O rd er in g Y ea r 6 O rd er in g Y ea r 7 O rd er in g Y ea r 8 O rd er in g Y ea r 9 O rd er in g Y ea r 10 Di re ct Ca ll  Ce nt er  A dv iso r Th e  Ca ll  Ce nt er  A dv iso r p ro vi de s p ro fe ss io na l,  qu al ity , a nd  " be st  in  c la ss "  se rv ic e  fo r  ex ist in g  an d  pr os pe ct iv e  cu st om er s b y  us in g  a  co ns ul ta tiv e  ap pr oa ch . T hi s r ol e  in xx xx es   ac tiv iti es  in cl ud in g,  b ut  n ot  li m ite d  to , i nb ou nd  a nd  o ut bo un d  ph on e  ca lls , e m ai l,  liv e  ch at , l et te r,  fa x,  a nd  d at a  en tr y.  T hi s r ol e  is  re sp on sib le  fo r f ac ili ta tin g,  a na ly zin g,  a nd   re so lv in g  cu st om er  is su es , a s w el l a s p ro vi di ng  p ro du ct  su pp or t a nd  fo llo w ‐u p  to  re so lv e  co nc er ns  in  a n  ac cu ra te  a nd  ti m el y  m an ne r. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ]  [* ** ]  [* ** ]  [* ** ]  [* ** ]  [* ** ]  [* ** ]  [* ** ]  [* ** ]  Di re ct Cy be rs ec ur ity  A na ly st Th e  Cy be rs ec ur ity  A na ly st  p ar tic ip at es  in  se cu rit y  in ve st ig at io ns , a nd  m on ito rs ,  re se ar ch es , c la ss ifi es , a nd  a na ly ze s s ec ur ity  e ve nt s t ha t o cc ur  o n  th e  ne tw or k  or  e nd po in t  w ith  a  fo cu s o n  th e  de te rm in at io n  of  w he th er  e ve nt s c on st itu te  se cu rit y  in ci de nt s. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ]  [* ** ]                      [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct Cy be rs ec ur ity  A rc hi te ct Th e  Cy be rs ec ur ity  A rc hi te ct  h as  a  st ro ng  u nd er st an di ng  o f t he  b us in es s,  it s g oa ls,   in fo rm at io n  te ch no lo gy  (I T) , a nd  se cu rit y.  T hi s r ol e  w or ks  c lo se ly  w ith  v ar io us  b us in xx x  xxx es  a nd  te ch no lo gy  te am s t o  he lp  sh ap e,  d ef in e,  im pl em en t,  an d  bu ild  n et w or k  in fr as tr uc tu re  se cu re ly . 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct Cy be rs ec ur ity  E ng in ee r Th e  Cy be rs ec ur ity  E ng in ee r i de nt ifi es  ri sk s a nd  th re at s t o  th e  po te nt ia l d isc lo su re ,  m od ifi ca tio n,  o r l os s o f d at a.  T hi s r ol e  re co m m en ds  c ou nt er m ea su re s a nd  sa fe gu ar ds  to   m iti ga te  ri sk , i nc xx xx xx  m on ito rin g  an d  re vi ew in g  te ch no lo gy  in iti at iv es  to  p ro vi de   se cu rit y  as su ra nc e.  T hi s r ol e  m an ag es  a nd  m ai nt ai ns  se cu rit y‐ re la te d  te ch no lo gi es , a nd   al so  e st ab lis he s c or po ra te  b as el in e  se cu rit y  po lic ie s a nd  st an da rd s. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct IT  A rc hi te ct Th e  In fo rm at io n  Te ch no lo gy  (I T)  A rc hi te ct  d es ig ns  e nt er pr ise ‐w id e,  c ro ss ‐fu nc tio na l  so lu tio ns  a nd  p ro vi de s g ui da nc e  an d  le ad er sh ip  to  te ch no lo gy  te am s.  T hi s l ab or  c at eg or y  in cl ud es  S of tw ar e  Ar ch ite ct s,  In fr as tr uc tu re  A rc hi te ct s,  a nd  C yb er se cu rit y  Ar ch ite ct s. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct IT  B us in es s A na ly st Th e  In fo rm at io n  Te ch no lo gy  (I T)  B us in es s A na ly st  fo rm ul at es  a nd  d ef in es  sy st em  sc op e  an d  ob je ct iv es  th ro ug h  re se ar ch  a nd  fa ct ‐fi nd in g,  c om bi ne d  w ith  a n  un de rs ta nd in g  of   ap pl ic ab le  b us in es s s ys te m s a nd  in du st ry  re qu ire m en ts . T hi s r ol e  de ve lo ps  o r m od ifi es   m od er at el y  co m pl ex  in fo rm at io n  sy st xx x. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct IT  E ng in ee r Th e  In fo rm at io n  Te ch no lo gy  (I T)  E ng in ee r i s r es po ns ib le  fo r d ev el op in g  en te rp ris e‐ w id e,   cr os s‐ fu nc tio na l s of tw ar e  so lu tio ns , w or ki ng  c lo se ly  w ith  IT  A rc hi te ct s a nd  IT  B us in es s  An al ys t t ec hn ic al  te am s.  T hi s l ab or  c at eg or y  in cl ud es  S of tw ar e  En gi ne er s,  In fr as tr uc tu re   En gi ne er s,  a nd  C yb er se cu rit y  En gi ne xx x. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct O pe ra tio na l A na ly st Th e  O pe ra tio na l A na ly st  sp ec ia liz es  in  st re am lin in g  pr oc es se s f or  a dj us tm en t  pr oc es sin g,  in ve nt or y  m an ag em en t,  an d  re se ar ch  in  th e  ba ck  o ffi ce . T he  O pe ra tio na l  An al ys t u se s a na ly tic al  to ol s,  c rit ic al  th in ki ng , a nd  p ro bl em  so lv in g  to  h el p  so lv e  co m pl ex   ta sk s f or  th e  ba ck ‐o ffi ce  te am s.  T hi s r ol e  pr ov id es  xx xx ec t m at te r e xp er tis e  on  p ro je ct s  an d  co m pl ex  re se ar ch  a nd  in iti at iv es . 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] Di re ct O pe ra tio ns  S pe ci al ist Th e  O pe ra tio ns  S pe ci al ist  p er fo rm s m ul tip le  c om pl ex  d ut ie s t ha t i nc lu de , b ut  a re  n ot   lim ite d  to , p ro ce ss in g  fin an ci al  a dj us tm en ts /r et ro ac tiv e  ad ju st m en ts  o r a cc ou nt in g  du tie s,  in ve nt or y  m an ag em en t,  w or ki ng  o n  sp ec ia l p ro je ct s,  a ss ist in g  op er at io na l  m an ag em en t,  an d  re se ar ch in g,  m on ito rin g,  o r r es ol vi ng  u ni qu e  or  e sc al at ed  a cc ou nt s a nd   re po rt in g  di sc re pa nc ie s w ith /o r c or re ct in g  N at io na l S tu de nt  L oa n  Da ta  S ys te m  (N SL DS )  er ro r r ep or ts . T hi s r ol e  co m m un ic at es  p er fo rm an ce  d at a,  c oa ch es /m en to rs  n ew  h ire s,   ev al ua te s t he  re su lts  o f n ew ‐h ire  w or k  to  id en tif y  tr en ds  o r t he  n ee d  fo r a dd iti on al   tr ai ni ng , a nd  a ss ist s l ea de rs hi p  w ith  m ai nt ai ni ng  te am  c om pl ia nc e.  T hi s r ol e  tr ac ks ,  ad m in ist er s,  a nd  a na ly ze s w or k  flo w . T he  O pe ra tio ns  S pe ci al ist  re sp on ds  to   ex te rn al /in te rn al  c us to m er  in qu iri es  a nd  p ro vi de s a ss ist an ce  to  h ig h‐ pr io rit y  ac co un ts . 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I  4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] In di re ct Pr od uc t O w ne r Th e  Pr od uc t O w ne r c re at es  a  c ol la bo ra tiv e  an d  tr an sp ar en t e nv iro nm en t t ha t h el ps   de liv er  b us in es s v al ue  in  a  q ui ck  a nd  it er at iv e  fa sh io n.  C ol la bo ra tio n,  re la tio ns hi p‐ bu ild in g,  c om m un ic at io n,  a nd  le ad er sh ip  a re  k ey  a sp ec ts  o f t he  ro le . T he  u lti m at e  pu rp os e  of  th e  Pr od uc t O w ne r i s t o  un de rs ta nd  th e  st ak eh ol de r n ee ds , p rio rit ize  th os e  ne ed s b as ed  o n  bu sin es s v al ue , a nd  c om m un ic at e  th os e  to  th e  te ch no lo gy  te am  so  th ey   ca n  co nt in uo us ly  im pr ov e  th e  pr od uc t. 1)  L in co ln , N E 2)  C en te nn ia l,  CO 3)  M ad iso n,  W I 4)  R em ot e [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ] [* ** ]   [* ** ] Fu ll  Ti m e  Eq ui va le nt  (F TE ) H ou rly  F ul ly  B ur de ne d  La bo r R at es Pa rt  1  S ec tio n  B.  3  C LI N  7  L ab or  C at eg or y  Ra te s T ab le Th es e  la bo r c at eg or ie s a nd  ra te s s ha ll  be  u se d  fo r t he  p ric in g  of  th e  la bo r p or tio n  of  w or k  un de r C LI N  7  D ev el op m en t,  M od er ni za tio n  an d  En ha nc em en ts  a nd  c xx xx es  to  th e  co nt ra ct  o r T as k  O rd xx x.  

Attachment Page PAGE 7 OF 81 91003123D0005 C. Section C: Performance Work Statement (PWS) 1. Introduction The U.S Department of Education (Department) Office of Federal Student Aid (FSA) issued Solicitation No. 91003122R0007 (Solicitation) seeking servicers to provide continued servicing capabilities for FSA’s student aid recipients using the requirements applicable under Title IV Additional Servicers (TIVAS) and Not-For-Profit (NFP) servicers (collectively, Legacy Servicers) resulting Unified Servicing and Data Solution (USDS) contract (Contract) which will replace the existing, Legacy Servicers’ contracts, and provide the following: • Complete Student Loan Servicing; • Student Loan Consolidation Origination and Disbursement; • Financial Reporting; • Processing of Specialty Claims (discharge, forgiveness, and cancellation); • Complete Fulfillment; • Operational Reporting; • Compliance Monitoring; and • Data Integrations with other FSA Systems. 2. BACKGROUND AND GOALS FSA administers all phases of the Federal student financial aid programs from a student’s submission of the Free Application for Federal Student Aid (FAFSA®) through retirement of student loan debt. Federal Student loans have become a core component of postsecondary education financing. FSA directly manages servicing for more than 35 million non-defaulted Federal student loan borrowers with a total value over $1.25 trillion. This contract supports the following FSA goals: Provide all federally managed borrowers with complete account management capabilities on XxxxxxxXxx.xxx; Reduce the disruption of account transfers; and Increase accountability for servicers via clear, measurable service-level agreements. 3. REQUIREMENTS, MILESTONES, AND DELIVERABLES 1) General Operating Requirements The USDS Servicer shall provide services as more fully described in Attachment 01 - Business Operations Servicing Requirements (Attachment 1), Attachment 02 – Financial Technical Requirements (Attachment 2) and associated attachments; and Attachment 03 – IT Requirements Repository (Attachment 3). As fully described in Attachments 1, 2, and 3, the services and related requirements provided by the USDS Servicer include but are not limited to: a. Integration: USDS Servicer shall integrate with existing FSA or third-party solutions, and Next Gen solutions, as necessary. Post-award integration requirements will be managed by the Change Management Process, as described in Attachment 05 – Business Change Management Plan (Attachment 5 or Change Management). b. Adaptability, Flexibility, and Ongoing Performance: USDS Servicer shall adapt and adhere to changes in FSA’s operating environment. USDS Servicer shall adhere to FSA’s Change Management Process. The USDS

Attachment Page PAGE 8 OF 81 91003123D0005 Servicer’s solution shall have the ability to efficiently scale to changes in borrower account and transaction volumes. Performance testing results are a requirement of this effort. c. Customer Experience Focus: USDS Servicer shall prioritize borrower needs and preferences to deliver an improved borrower experience. USDS Servicer shall implement an approach that minimizes risk and disruption to borrowers while deploying more efficient and effective solutions. d. Monitoring and Adhering to Changes in Laws, Regulations, and other Policies: USDS Servicer shall comply with all applicable Federal and State rules, laws, regulations, and Department guidelines applicable to the USDS Program (including all accessibility elements such as 504/508 compliance). USDS Servicer shall establish a process to monitor changes to applicable laws and regulations to ensure compliance. If the USDS Servicer identifies a change in applicable law, the USDS Servicer must notify FSA by email to the Contracting Officer (CO) to determine the implications of such change to the Contract, the technical design, and/or operational procedures. This includes any scope changes to the Contract to ensure compliance with applicable Federal and State laws and regulations. e. Cybersecurity, Hosting, and Middleware: USDS Servicer shall ensure the USDS solution meets Federal Information Security Management Act (FISMA) and National Institute of Standards and Technology (NIST) standards. See Cybersecurity and IT Requirements as fully described in Department of Education Security and Privacy Requirements for IT Procurements within Attachment 3 and referenced under section C.5 of this document. f. Financial Accuracy and Compliance: USDS Servicer shall adhere to the requirements listed in Attachment 2, and associated Financial Technical Requirements, and provide measures for ensuring the compliance and accuracy of financial transactions and reporting. g. Requirements Changes: Changes to the business operations, finance, technical, and/or cybersecurity requirements delivered under this Contract must follow the change management process as described in Attachment 5. h. Specialty Servicing Programs: The specialty servicing programs (e.g., PSLF, TEACH, TPD) require the USDS Servicer to strictly adhere to the requirements in Attachment 1. USDS Servicer is responsible for the following: providing borrowers with basic information about these programs; connecting borrowers to resources on XxxxxxxXxx.xxx and at 1-800-4-FEDAID: and processing borrower account status changes, discharges, and forgiveness based on information transmitted by FSA. i. Specialty Servicing Tasks. There are discrete specialty tasks that FSA intends to award to USDS Servicer(s) via task orders (Task Orders) under the Contract. Task Orders may include, but are not limited to: FSA Image Repository; Decommissioned Servicer Data Support and Payment Support; Legacy Loan Consolidation Adjustments (work contained within CLIN 12); and FFEL Guaranty Agency Rehabilitation Loan Purchases. These anticipated Task Orders are further described in Section C.3. Specialty Servicing Tasks. j. Trained Personnel: USDS Servicer shall ensure personnel are trained and aware of pertinent, applicable laws, regulations, programs, and FSA’s performance expectations. Development of training content and material shall be done in coordination with FSA and/or FSA’s designees, as required.

Attachment Page PAGE 9 OF 81 91003123D0005 k. Performance Management: USDS Servicer shall adhere to FSA’s Service Level Agreements (SLAs)/Service Level Objectives (SLOs) and shall include performance management mechanisms that enable improved and ongoing achievement of metrics. FSA will utilize the performance management framework and methodology in Attachment 08 – Service Level Methodology Performance Metrics (Attachment 8) and Attachment 09 – SLA and Future Borrower Allocation Calculator (Attachment 9) to support USDS performance management and to document achievement of the established SLAs and SLOs. Attachment 9 explains the process by which the SLAs and SLOs will be measured. In order to strengthen transparency, FSA reserves the right to publicly release data related to USDS Servicer’s performance including, but not limited to, call center performance and timeliness. See also “Service Level Agreements & Objectives Performance Incentive” under Part II Contract Clauses, Section I, Subsection 3 Additional Clauses, of the Contract for the functioning of these requirements as a performance incentive. l. Quality Control and Compliance Management: USDS Servicer shall document, provide policies and procedures, and adhere to its quality management system to ensure quality is measured and managed on a consistent basis. USDS Servicer shall maintain a sound compliance management system (CMS) that is integrated into the overall framework for product design, delivery, and administration across the entire product and service lifecycle. Compliance must be part of the day-to-day responsibilities of management and the employees; issues should be self-identified; and corrective action(s) must be initiated by the USDS Servicer. USDS Servicer must manage relationships with USDS subcontractors and service providers to ensure such subcontractors and service providers effectively manage compliance with applicable statutory, regulatory, and contractual requirements. m. Allocation of Current Borrower Accounts: FSA reserves the right to unilaterally shift current borrower accounts among USDS Servicers at the CO’s direction when it is in the best interest of FSA or its borrowers, at no additional cost to FSA. It is anticipated that the movement of borrower accounts will be done with reasonable and prudent cause. n. Allocation of New Borrower Accounts: The allocation of new borrower account volume during Task Order performance will be determined based on the performance of each USDS Servicer in relation to the other USDS Servicers awarded as further described in Attachment 21 and Attachment 9. o. Non-Compliance and Invoicing: For any borrower accounts that the USDS Servicer caused or substantially contributed to non-compliant servicing of such borrower accounts, the servicing of such shall not be billable to FSA from the initial point of occurrence. Such non-compliant servicing includes borrower accounts not being serviced in compliance with any applicable statutory requirements, regulatory requirements, the terms and conditions of the Contract, or FSA guidance. FSA guidance is written operational or technical direction necessary to accomplish contractual requirements. For example, the USDS Servicer properly using the FSA provided parameters for an outreach call campaign as per the Business Operations Servicing Requirements number 33003.020. Examples of non-compliant servicing of borrower accounts include, but are not limited to: inaccurate payment counts towards forgiveness, incorrect interest calculations, incorrect balances, incorrect interest determination and calculations, notices not being sent properly or not adhering to due diligence requirements. FSA reserves the right to request reimbursement of fees that have been invoiced and paid to the USDS Servicer for improper servicing, in a manner determined by FSA, and all other remedies available to FSA under the Contract and law.

Attachment Page PAGE 10 OF 81 91003123D0005 p. Borrower Account Data Ownership: FSA has exclusive ownership of all information created, received, stored, retrieved, modified, handled, and/or archived as part of this Contract. The USDS Servicer shall have no rights in such information and no rights to such information shall vest in the USDS Servicer by virtue of its performance of this Contract. The USDS Servicer shall not use borrower account data in any manner other than as authorized under the Contract and necessary for performance in accordance with applicable laws and regulations. q. Contractor Acknowledgement: USDS Servicer acknowledges that it is not the U.S. Department of Education, and is not acting as the U.S. Government under this Contract. As such the USDS Servicer acknowledges that any claim or defense of Sovereign Immunity or Qualified Immunity is not applicable to work performed under the Contract and any Task Order issued under the Contract. r. Personnel Security Requirements: The USDS Servicer shall comply with the Department of Education Acquisition Regulation (EDAR) clause 3452.204-72 Contractor Vetting Security Requirements and the Contractor Vetting Security Requirements document contained in Attachment 3. s. Identity, Credential, and Access Management (ICAM) Requirements: i. General ICAM Requirements: 1. All contractors accessing Department and FSA networks and/or data centers who are classified as Privileged Users (PU) are required to use Government furnished Personal Identity Verification (PIV) cards for authentication and access. Note: FSA prohibits contractors from granting access to FSA systems without approval by the Department. 2. The USDS Servicer shall not issue the PIV-I card to the PUs of the FSA system until FSA has approved access for these PUs. 3. The USDS Servicer shall ensure that both PUs and non-Privileged Users, who work on IT resources and applications (for example, the USDS Servicer systems) containing or accessing FSA’s data, utilize PIV/PIV-I cards. The USDS Servicer shall provide card readers and require PUs and non-Privileged Users to use the PIV/PIV-I card for authentication and access to IT resources and applications containing or accessing FSA’s data satisfying an Identity Assurance Level (IAL3) and Authentication Assurance Level 3 (AAL3) as defined in NIST SP 800-63-3. 4. The USDS Servicer shall ensure that a Privileged Access Management (XXX) system is utilized for all PU access to information systems. The XXX solution will manage access and log user activity. USDS Servicer must provide monthly access logs to FSA. 5. The USDS Servicer shall ensure that websites require multi-factor authentication when providing access to PII and other sensitive information. 6. The USDS Servicer shall request xx.xxx accounts, and ensure PIV cards are issued, for all individuals that require access to Department and/or FSA business information systems, networks, or email accounts. 7. For a USDS Servicer(s) using a Government furnished equipment (GFE) Laptop, the user shall use the Department provided Virtual Private Network (VPN) solution(s).

Attachment Page PAGE 11 OF 81 91003123D0005 ii. ICAM Reporting Requirements: 1. The USDS Servicer shall provide a monthly PIV Card report to FSA including: a) Number of PUs with PIV cards disabled in the last 30 calendar days. b) Number of PUs with PIV cards enabled in the last 30 calendar days. c) Total number of PUs with PIV cards. 2. The USDS Servicer shall track and retain records of everyone who has approved access (user ID) to the servicing system, including clearances, training, and signed security documents; ensure that necessary clearances do not lapse; and suspend FSA access for anyone not in compliance. 3. The USDS Servicer shall provide a monthly PIV and/or PIV Card report(s) to FSA including: a) Number of PUs with PIV cards disabled in the last 30 calendar days. b) Number of PUs with PIV cards enabled in the last 30 calendar days. c) Total number of PUs with PIV cards. 4. The USDS Servicer shall send an email to all FSA System Security Officers at any time a user is no longer employed or no longer requires access to FSA systems, advising the FSA System Security Officers that the status of the person(s) identified is "no longer employed" or "no longer requires access to FSA systems." This email shall be sent at least 5 calendar days prior to an employee's removal from the Contract or immediately in cases that require immediate removal of an individual for security or suitability reasons. t. USDS Servicer shall submit its Background Investigation Requests electronically. USDS Servicer shall: i. Upload the documents into Electronic Questionnaires for Investigation Process (E-QIP) and release the Investigation Request Packet to the Contracting Officer’s Representative (COR) in E-QIP. ii. Send an electronic copy of the completed coversheet to the COR and system Information System Security Officer (ISSO(s)). If USDS Servicer requires a blank coversheet, contact the COR. When transmitting the cover sheet, please use the following subject in the header of the Microsoft Outlook Message: Subject: [Name of Prime Contractor-Company Name (Name of Sub-Contractor- Company Name, if applicable)]: [Background Investigation (BI) Type] [BI Level] [Date of Submission] [Name of Company Official Responsible for Background applications] iii. Ensure that each coversheet is encrypted, and password protected with a unique password. Do not send the password with the coversheet; instead send a separate email with the exact same subject line with the password in the body of the email. The password should include upper- and lower-case letters, numbers and special characters. iv. Other than entering the requested data, do not modify the cover sheet format, structure or any other part of the spreadsheet. Any such change may result in the return of the cover sheet and background investigation paperwork for corrections and delay the processing of the packages.

Attachment Page PAGE 12 OF 81 91003123D0005 v. Do not submit System Access Requests (SARs) with the background investigation paperwork. SARs are to be submitted to the ISSO that is responsible for your system. Please contact the ISSO(s) for specific information regarding the delivery (email, etc.) of the SARs. vi. Contact XXXXxxxxxxxxXxxxxxxx@XX.xxx or your assigned Personnel Security Specialist or by phone (000-000-0000) with questions. 2) Operating Elements and Related Requirements The USDS Servicer shall provide operating elements and related requirements as more fully described in Attachment 1. Such requirements include: a. Customer Accounts Migration: i. USDS Servicer shall receive historical and current customer borrower accounts from Legacy Servicers. This includes both active and non-active borrower accounts. USDS Servicer shall cooperate with Legacy Servicers in transferring borrower accounts to the USDS Servicer. USDS Servicer should expect reasonable cooperation from Legacy Servicers. USDS Servicer shall promptly report to FSA any issues or disputes regarding the transfer of borrower accounts. ii. USDS Servicer shall ensure that borrower accounts successfully transfer. Transfer data includes: borrower account’s historical record of balances and transactions, loan consolidation, origination and disbursement records (e.g., underlying loan pay-off, lender detail, funding histories), auto-pay preferences, complete payment history, deferment and forbearance history, repayment plan history, contact preferences, and prior loan transfer imaged records. Additional borrower data types may be added through contract modification, Task Order modification or through the Change Management Process over the life of the Contract. iii. USDS Servicer shall transfer loan data and images from closed/inactive borrower accounts from each non-default retiring Legacy Servicer. USDS Servicer must be able to reopen/ rebuild loans and return the borrower accounts to active servicing. iv. USDS Servicer shall send and support the development and delivery of customer communications about the migration of borrower accounts before, during, and after the migration per FSA instructions. Communications under this Contract to customers being transferred cannot start until after Authorization to Operate (ATO) has been granted. v. USDS Servicer shall convert Loan Consolidation Origination and Disbursement data. USDS Servicer shall convert all underlying loan detail and payoff information including all loan verification detail, loan summary statements, initial payoff information (including all financial and non-financial transactions), and under and over payment detail from active consolidation origination and disbursement systems. USDS Servicer shall ensure the solution is able to process all under- and over-payment adjustments. vi. Upon decommissioning as a Federal Loan Servicer, the USDS Servicer shall support the offloading and transfer of all historical borrower account data in accordance with the Phase-Out Plan, reviewed and approved by FSA, as further described in paragraph C.4.c below and in the records retention section of Attachment 1. b. General Borrower Account Servicing Requirements:

Attachment Page PAGE 13 OF 81 91003123D0005 i. USDS Servicer shall ensure the solution can execute the full range of servicing functions as fully described in Attachments 1, 2, and 3. The services provided by the USDS Servicer and associated requirements include, but are not limited to: 1. Provide staff, either in-house or through subcontracting, who perform front-end contact center agent and back- office agent work necessary to deliver all requirements. 2. Establish the Contact Center with the following hours of operation: : Monday 8 AM to 11 PM EST, Tuesday through Friday 8 AM to 8 PM EST, and Saturday 10 AM to 2 PM EST. This excludes Federal holidays. 3. Have a Call Management System that will be used to handle all inbound and outbound calls including required recording and reporting, as well as Interactive Voice Response capabilities. 4. Provide the migration of all physical documentation, for borrower accounts assigned to them, from the existing Legacy Servicers. USDS Servicer is required to cooperate with existing Legacy Servicers in transferring physical documentation to the USDS Servicer. USDS Servicer should expect reasonable cooperation from Legacy Servicers. USDS Servicer must report disputes regarding transfer of physical documentation to FSA without delay. 5. Provide Loan servicing for all borrowers in all loan statuses and monitor borrowers as they move through those statuses. 6. Establish repayment plans for borrowers across FSA-held Title IV Loans. 7. Determine and execute eligibility determination, annual recertification, and payment recalculation for Income- Driven Repayment (IDR) plans tied to a borrower’s income, family situation, and other characteristics that may fluctuate. IDR plans include, but are not limited to Income-Contingent, Income-Based, Pay-As-You-Earn, and Revised-Pay-As-You-Earn. 8. Process, predetermine, and/or execute discharge/forgiveness under various Title IV programs (e.g., Income- Driven Repayment, Closed School, Automatic Closed School, Death, False Certification). 9. Execution, discharge and forgiveness for Public Service Loan Forgiveness, Teacher Loan Forgiveness, Total Permanent Disability, and Borrower Defense. 10. Determination, execution, and implementation of eligibility for various forbearance/deferment programs. 11. Engage in delinquency management and default prevention to assist borrowers in staying current with their repayment plans. 12. Accurately report the status of borrower accounts to the national Credit Reporting Agencies (CRAs) in compliance with the Fair Credit Reporting Act (FCRA) and respond timely to borrower disputes. 13. Process loan consolidation origination and disbursement, including application, pay off, booking new loans, maintaining borrower account histories, performing all reconciliation and financial reporting, and other activities. o This includes the processing of under/over payment adjustments for legacy consolidation loans and any future decommissioned consolidation origination systems.

Attachment Page PAGE 14 OF 81 91003123D0005 14. Accommodate changes in repayment plan options, in accordance with Attachment 5. 15. Accurately complete retroactive adjustment processing (e.g., retroactive application of deferments, forbearances, payments, and manual adjustments). 16. Respond to control mail, congressional mail, FSA escalations, FSA feedback, borrower complaints and borrower account disputes. 17. Comply with all applicable Federal, and State laws, rules, and regulations applicable to its performance under the Contract (e.g., the Fair Credit Reporting Act, the Fair Debt Collections Practices Act, the Truth in Lending Act, etc.) and shall maintain a sound compliance management system (CMS) that is integrated into the overall framework for product design, delivery, and administration across their entire product and service lifecycle. 18. Execute internal quality control on all operational activities, submit operational and performance reports to facilitate transparency, oversight, and accountability, promptly notify FSA of any issue or instances of non- compliance, and support monitoring and oversight. c. Financial Functions: i. USDS Servicer shall perform all financial functions as outlined in Attachment 2 and associated attachments. This includes, but is not limited to: 1. Process specific financial and non-financial activity/transactions to correctly record all transactions processed to the servicing system and sending equivalent summary transactions to FSA’s general ledger (FMS). Perform various accounting process flows for loan account types unique to the Government sector. 2. Utilize specific file transmission mechanisms and processing channels for various system integration processes associated with the Oracle FMS used by FSA. 3. Utilize specific financial report and reconciliation file layouts to complete accurate financial deliverables that comply with all associated requirements by the required due date as indicated in the Finance Requirements. Generate various reports and reconciliations to demonstrate that the underlying servicing system data and process flows incorporated in the various reports and ensure reconciliations generated are accurate. 4. Incorporate a system of internal controls consistent with requirements derived from applicable Federal laws, regulations, policies and authoritative guidance. These laws, regulations, and guidance include, but are not limited to: Federal Financial Management Improvement Act (FFMIA); Federal Managers' Financial Integrity Act (FMFIA); CFO Act; Government Performance and Results Act (GPRA); GAO's Standards for Internal Control (i.e., the "Green Book"); OMB Circulars A-123 and A- 130; FISMA; NIST Special Publications; the Treasury Financial Manual (TFM); GAO's Financial Audit Manual (FAM); and GAO's Federal Information System Controls Audit Manual (FISCAM). ii. USDS Servicer shall conduct error and dispute resolution investigation and processing, including, but not limited to: 1. Borrower account maintenance, including manual correction of errors identified through data integrity scans and manual adjustments as identified by FSA.

Attachment Page PAGE 15 OF 81 91003123D0005 2. Payment and refund processing, including researching lost or misapplied payments and payment reapplication at the request of borrowers or FSA. iii. USDS Servicer shall maintain data history, including retroactive processing (e.g., “as-was” vs “as-is”), and tracing loans through consolidation payoff (initial payoff, under and over payments) transactions. This data shall be available and shared with other solutions and systems as directed by FSA. iv. USDS Servicer shall provide timely support for FSA’s future-state processing solution from requirements gathering through development, including access to the USDS Servicer’s Subject Matter Experts and solution set (e.g., system code, workflows, processing tools and infrastructure/environment, etc.). d. FSA Branding: i. FSA requires that all public-facing, USDS Servicer products shall follow the FSA Servicer Brand Guidelines, as more fully described in Attachment 11 (FSA Servicer Brand Guidelines). The FSA Brand Guidelines include the FSA Writing Style Guide and co-branding elements for all public-facing products. In addition, when directly presenting FSA brand elements such as the FSA logo, the USDS Servicer shall follow the FSA Brand Style guide and FSA Design System (collectively, Style Guide and Design) attached hereto as Attachment 10. ii. As further described in the FSA Servicer Brand Guidelines and Style Guide and Design, the USDS Servicer shall comply with the following FSA brand requirements when creating, designing, developing, writing, updating, and maintaining both information technology products and document products: 1. FSA Servicer Brand Guideline and Style Guide and Design requirements apply to all websites and mobile apps, all configured screens within information systems, all mobile application screens, all social media, and all customer-facing documentation/content that is intended for use by students, parents, borrowers, or schools. 2. The FSA Servicer Brand Guidelines and Style Guide and Design requirements apply to all new or edited content and does not imply the need to audit all past content for compliance. 3. Documentation that is purely internal in nature for use by FSA staff and contractors, such as project management documentation and documentation used to manage information systems, shall not be subject to the branding requirements. Information technology that is purely back-end in nature (the user base consists of system administrators or only IT-personnel) shall not be subject to the branding requirements. 4. USDS Servicer shall submit brand layouts or plans, appropriate to the product they are producing and specified by the FSA Servicer Brand Guidelines and Style Guide and Design prior to work on co- branded or FSA branded elements of the product(s). FSA may require changes to conform with the FSA Servicer Brand Guidelines and Style Guide and Design. FSA will work with the USDS Servicer to provide additional design elements when needed. a) Screen mock-ups showing planned FSA servicer co-branding for websites, configured screens within information systems, mobile applications, and social media shall be submitted for Department approval.

Attachment Page PAGE 16 OF 81 91003123D0005 b) Templates and layouts customer-facing documentation shall be submitted for Department approval. 5. FSA may modify or update the FSA Servicer Brand Guidelines and Style Guide and Design at any time through modification of the Task Order and/or Contract. When such modifications occur, the USDS Servicer shall incorporate relevant updates into the next major product release or at another time as agreed to by FSA. 6. The USDS Servicer may request a waiver from specific elements of the FSA Servicer Brand Guidelines and Style Guide and Design. FSA will consider such requests and may also work with the USDS Servicer to achieve an alternative solution to the specific branding element(s) at issue in the waiver request. The final decision on specific elements waived and any potential consideration or reduction in price due to a reduction in requirements must be accomplished through modification of the Contract and/or applicable Task Order. e. Imaging, Printing, and Mailing: i. USDS Servicer shall receive, image, index, and process physical mail. USDS Servicer shall also provide tracking of and reporting on outbound mail items. USDS Servicer shall identify cost efficiency opportunities and work with FSA to implement changes to processes and practices (e.g., statement or envelope design). Changes effecting requirements and/or prices must be accomplished through modification of the Contract and/or applicable Task Order. ii. USDS Servicer shall generate and send all communications necessary for servicing all assigned borrower accounts under the terms of the Contract (physical and electronic). iii. USDS Servicer shall enable borrowers, customers, partners, and other relevant third parties to be able to fax materials and tag the faxes upon receipt for tracking. iv. USDS Servicer shall image and index inbound correspondence, including physical checks, as well as materials received via fax. USDS Servicer shall then provide access or visibility to the images to FSA. v. USDS Servicer shall provide skip tracing capability to identify updated contact information for invalid postal mail and invalid phone numbers. f. Digital Engagement Layer: i. USDS Servicer shall provide a digital engagement and mobile responsive website solution for borrowers, customers and partners to interact with FSA and complete customer tasks (e.g., view statements and make payments) and partner tasks (e.g., view student loan history and download resources for students). ii. USDS Servicer shall provide an access portal to Title IV partners (e.g., schools, FSA, etc.) as described below: 1. The access shall provide customer account access to FSA, schools, and other partners as approved by FSA. The portal shall display, at a minimum, customer demographic detail, loan detail, loan disbursement detail, and access to images (bills, repayment plans, applications,

Attachment Page PAGE 17 OF 81 91003123D0005 communications etc.). The portal shall allow for downloading and printing of information displayed. 2. The portal shall include a Loan Holder Services website that Guarantee Agencies (GA) and Lenders will use for loan consolidation application processing. 3. The portal shall allow FSA and other trading partners (schools will not access this data) access to the FSA Image Repository, Decommissioned Servicer data, and Legacy Consolidation Support data as outlined in Section C.3 Specialty Servicing Tasks, below. 3) Specialty Servicing Tasks FSA anticipates awarding Specialty Servicing Tasks to one (1) or more USDS Servicers. As further described in Attachment 1, USDS Servicer is required to have a plan to provide the following Specialty Servicing Tasks: a. Specialty Servicing Task 1 – FSA Image Repository: USDS Servicer shall transfer in, maintain, and provide access to an FSA image repository (FSA Image Repository). The FSA Image Repository maintains all historical images from previously decommissioned servicing systems and ancillary systems. All images shall be accessed via the partner portal. b. Specialty Servicing Task 2 – Decommissioned Servicer Data Support and Payment Support Servicing Functions: Decommissioned servicer data includes archived data that is stored from decommissioned servicers including but not limited to ACS Education Servicing System (ACES) and Direct Loan Servicing System (DLSS), decommissioned NFP servicers and future decommissioned TIVAS servicers. The USDS Servicers shall: i. Provide FSA the ability to access pre-defined queries, which will be provided during Contract performance, as well as perform ad-hoc queries of the data. ii. Provide payment support services such as processing refunds, researching missing payments, providing check copies. c. Specialty Servicing Task 3 – Legacy Loan Consolidation Origination and Disbursement Support Functions: Legacy loan consolidation origination and support functions include performing all manual adjustments received for underlying loans held by FEEL Lenders, Guaranty Agencies, the Debt Management and Collection System (DMCS), and Direct Loans that were previously consolidated by decommissioned consolidation vendors (e.g. ACES, Title IV Additional Servicer (TIVAS), or other Title IV servicers), (collectively, Legacy Consolidation Vendors). USDS Servicer shall: i. Process all under/over payments received on legacy consolidation loans. ii. Convert all data for all under/over payment adjustments that have been processed since the Legacy Consolidation Vendor was decommissioned. iii. Create updated Consolidation Origination Loan History Records for each adjustment processed and upload such records to the FSA Image Repository. iv. Create adjustment spreadsheets needed to complete the adjustment processing.

Attachment Page PAGE 18 OF 81 91003123D0005 d. Specialty Servicing Task 4 – FFEL Guaranty Agency Rehabilitation Loan Purchases: USDS Servicer shall support rehabilitation loan purchases from participating FFEL guarantors. This support function includes: i. Acceptance of rehabilitated loan assignments from guaranty agencies. ii. Creation and transmittal of purchase funding request files to FMS and loan purchase detail and summary files to FSA. iii. Full reconciliation of loan purchases and transferred of data. iv. Support for overpayments and underpayments of the purchase amount v. Inclusion of rehabilitated loan purchases in default management processes 4) USDS Servicing IT Requirements As fully described in Attachment 3, USDS Servicer is required to provide the following IT Requirements as part of the Contract: a. FSA System Development Lifecycle (SDLC): The USDS Servicer shall comply with the FSA System Development Lifecycle process (FSA-SDLC), currently named the Lifecycle Management Methodology (LMM) as fully described in Attachment 06 - Lifecycle Management Methodology Process Guide (Attachment 6), during the term of the Contract. Document templates for compliance are provided within Attachment 04 - IT Deliverable Repository (Attachment 4). b. Collaboration Requirement: In carrying out the scope of work under the Contract, the USDS Servicer shall collaborate with and share technical information with FSA and other contractor support staff in the holistic delivery of solutions, services, and results to FSA. This collaboration may be required in specific situations at the direction of the CO or as may be delegated to the COR. The USDS Servicer is responsible for coordinating any necessary non-disclosure agreements between the USDS Servicer and collaborating support contractors. See EDAR 3452.227-72 Use and Non-Disclosure Agreement and EDAR 3452.227-73 Limitations on the use or disclosure of Government-furnished information marked with restrictive legends for more information. c. Transition Support: In accordance with FAR Part 52.237-3, the services provided under the Contract are vital to the Government and must be continued without interruption. The USDS Servicer shall provide phase-in and phase-out services as further described below. i. Transition Support Instructions: To ensure a smooth transition, and support of such continuity of service requirements as may be stipulated in the Contract; the USDS Servicer shall submit a Phase-In Plan as a part of the Contract. ii. The USDS Servicer shall establish and implement plans for an orderly phase-out of the contracted operations at the termination of the Contract (Phase-Out Plan), as further described below. The USDS Servicer shall submit a Phase-Out Plan to the CO for evaluation and approval six (6) months after Contract award. The USDS Servicer’s phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business. The USDS Servicer shall maintain the Phase-Out Plan as Contract changes are made and provide the CO with the copies of changes and revisions for review and

Attachment Page PAGE 19 OF 81 91003123D0005 approval prior to finalizing the updated Phase-Out Plan. The USDS Servicer will use this plan to ensure the smooth transition of services to a successor contractor in accordance with FAR 52.237-3. iii. Transition Support (Phase-In): The USDS Servicer shall develop comprehensive procedures for phasing- in its performance to the level required and within the time allowed under the terms of the Contract and, if required, by a Task Order. 1. The period between Initial Task Order award date and Go Live date will constitute the phase-in period (Phase-In Period). During the Phase-In-Period, the USDS Servicer shall prepare to assume full responsibility for all areas of operation in accordance with the terms and conditions of the Contract. The USDS Servicer shall take all actions necessary for a smooth transition of the USDS operations. 2. FSA will make all applicable GFE and Government Furnished Information (GFI) available to the USDS Servicer during the Phase-In-Period. 3. During the Phase-In-Period, the USDS Servicer shall ensure it is ready to fully perform the Contract without assistance from the Legacy Servicers or the Government by the Go-Live date. Phase-In tasks include but are not limited to: a) Establish a USDS Servicer’s Project Management Office to coordinate phase-in tasks and to be the single point of contact for the Government during the Phase-In-Period. b) Recruit and hire necessary personnel. c) Obtain all required certifications and clearances, including personnel security clearances. d) Participate in development of joint inventories (e.g., borrower account and Federal records) and sign for Government furnished property/ equipment/information. e) Develop and submit any required deliverables. f) Attend post-award meetings as required. g) Accomplish necessary training to support the operations and maintenance functions of the USDS program. iv. Transition Support (Phase-Out): The USDS Servicer shall develop a Phase-Out Plan (Phase-Out Plan) to affect a smooth and orderly transfer of contract responsibility to a successor. The Phase-Out Plan shall fully describe how the USDS Servicer will approach project Phase-Out including but not limited to the following issues: employee notification; retention of key personnel; turn-over of work-in-progress, inventories (e.g. Federal records including borrower accounts, Standard Operating Procedures (SOPs), software licenses, telephone lines), Government property; GFE, GFI, removal of USDS Servicer property form Government facilities; data and information transfer; surrender of Federal records, and any other actions required to ensure continuity of operations. 1. The USDS Servicer’s Phase-Out Plan shall require that the USDS Servicer and the Government to conduct an inventory of all systems, GFE, Federal records, contract deliverables, work in progress, and other items required for the support of the USDS Solution. Following such inventory, the USDS Servicer will conduct a joint inventory with the successor contractor and/or FSA to ensure a smooth transition of all applicable services.

Attachment Page PAGE 20 OF 81 91003123D0005 2. The Phase-Out Plan must also include the following: reconciliation of all property accounts, requisitions, work-in-progress; turn-in of excess property; USDS Servicers’ work areas clean-up; plan for training successor contractor, specialized equipment, utilities systems, and ongoing work that the successor would be required to complete; transfer of Federal records, sanitizing USDS Servicer equipment and systems of all Federal records, and, security debriefings in accordance with FSA security procedures for incumbent personnel holding security clearances. v. The Phase-Out Plan must address the phase-in activities required under FAR 52.237-3 including a training program for the incoming contractor, transition dates for work described in the plan observation periods, access to employees of on-site interviews etc. The Phase-Out Plan must include an observation period at which time management personnel of the incoming workforce can observe operations and performance methods of the USDS Servicer. This will allow for orderly turnover of facilities, equipment, and Federal records and will help to ensure continuity of service. The USDS Servicer shall not defer any requirements of the Transition-Out plan for the purpose of avoiding responsibility or of transferring services to the succeeding contractor. The USDS Servicer shall fully cooperate with the succeeding contractor and the Government so as not to interfere with their work or duties. vi. Decommissioning Plan: The USDS Servicer shall provide an IT Decommissioning Plan in compliance with NIST SP 800-14, "Generally Accepted Principles and Practices for Securing Information Technology Systems", NIST SP 800-53 "Recommended Security Controls for Federal Information Systems", NIST SP 800-64 "Security Considerations in the System Development Life Cycle", and NIST SP 800-88 "Guidelines for Media Sanitization". The Decommissioning Plan is to address decommissioning in connection with any expiration/termination of the Contract and/or the removal/retirement of USDS Servicer’s equipment used in performance of the Contract. Such decommissioning of USDS Servicer’s equipment and systems shall be at no additional cost to FSA. d. Intellectual Property: Unless specified in a Task Order, FSA’s interest in Intellectual property is defined in the Clauses of the Contract. e. Software Licensing: i. The USDS Servicer shall provide a listing of all required commercial off the shelf (COTS) software to include product descriptions and quantities with itemized unit and extended costs for each product. ii. If FSA procures or funds any software through the USDS Servicer, the USDS Servicers shall provide FSA visibility and access to license oversight, including real-time distribution (even if being distributed by the USDS Servicer) and usage at time of procurement. iii. For any COTS software not procured through the USDS Servicer, software will be distributed by FSA as needed. Administrator and support access will be shared with USDS Servicer for software management, maintenance, support, deployment and/or distribution so long as FSA retains required visibility. f. Contractor Support of Technology Refreshment: As part of its standard technology refreshment program, FSA requires regularly scheduled and periodic upgrades of the underlying infrastructure,

Attachment Page PAGE 21 OF 81 91003123D0005 support software, and enabling frameworks to (at minimum) N-1 versions (where N is the latest version and N-1 is the second latest version). i. SaaS, PaaS, and/or IaaS Solutions: The USDS Servicer performing integration services for FSA in connection with FISMA-approved cloud computing services (SaaS, PaaS, IaaS) shall ensure the infrastructure, support software, and enabling components and frameworks are maintained to (at minimum) N-1 versions as part of a standard technology refreshment program. ii. Infrastructure and COTS Software: The USDS Servicer shall support refreshment activities, including infrastructure and software upgrades and patches led by FSA’s infrastructure and middleware vendors. As needed, the USDS Servicer shall support planning and scheduling, impact analysis, changes to the application, and testing. iii. Applications and Enabling Components and Frameworks: The USDS Servicer shall ensure that functionality and application design are optimized; maintenance is cost efficient; the enabling technology remains under support by third party vendors (e.g., IBM, Oracle, or Microsoft); the application code and its underlying frameworks are maintained at the N-1 or N version. USDS Servicer must comply with the Attachment 19 - Technology Standards and Products Guide (Attachment 19). g. Cybersecurity Requirements: The USDS Servicer shall comply with the cybersecurity and privacy requirements as described in the 2022 Security and Privacy Requirements for Information Technology Procurements document within Attachment 3. Any solution making use of cloud services must use FedRAMP certified cloud packages and be approved by the Department for use. h. FSA Cybersecurity Requirements: The following sub-sections describe FSA Cybersecurity requirements that supplement Attachment 3. i. FSA General Cybersecurity Requirements: 1. The USDS Servicer shall ensure the solution is defined, designed, developed, and maintained in a manner such that it implements the cybersecurity requirements and standards. FSA and the Department have implemented a risk-based approach and measurement methodology for each system and the information system’s cybersecurity performance under FSA contracts. The USDS Servicer shall ensure that the USDS systems and associated technologies meets all requirements for cybersecurity including but not limited to the cybersecurity scorecard. 2. The USDS Servicer shall ensure that it fully participates, and enters in the appropriate agreements, with the FSA and Department of Homeland Security (DHS) Cyber Hygiene programs. 3. The USDS Servicer shall designate a Security Manager, who shall serve as a primary contact point regarding security related issues. The Security Manager shall work with the designated Information System Security Officer (ISSO) to ensure that the USDS information system(s) used

Attachment Page PAGE 22 OF 81 91003123D0005 for performance of the Contract remains secure, vulnerabilities are addressed, and that all required security documentation and reporting is maintained. 4. The USDS Servicer shall allow FSA access to FSA information including data schemas, meta data, and other associated data artifacts on USDS Servicer’s systems. USDS Servicer is required to ensure FSA can fully and appropriately retrieve FSA information from USDS Servicer’s systems. USDS Servicer must ensure FSA has the ability to store, read, and process such information. This requirement includes, but is not limited to data stored on recovery media, tape backups, images, etc. 5. The USDS Servicer shall provide data loss prevention capability to ensure that Controlled Unclassified Information (CUI) and privacy data are monitored and protected. 6. The USDS Servicer’s designated security personnel must obtain an xx.xxx account (network/e- mail) and PIV Badge. 7. The USDS Servicer’s security personnel must obtain access to the Government’s Cyber Security Assessment and Management (CSAM) system to provide reporting for the USDS Servicer’s systems associated with the scope of the Contract. The USDS Servicer’s security personnel shall be responsible for maintaining all system security artifacts in CSAM, including, but not limited to, the System Security Plan (SSP). 8. The USDS Servicer’s security personnel must obtain access to the Department’s PowerBI system where system scorecards are stored for the applicable USDS system(s) that has an ATO. 9. The USDS Servicer shall be liable for breaches of security resulting from failure to follow applicable Federal, NIST, DHS, Department and FSA security processes and/or Federal law, guidance documents, and security standards. 10. Machine to Machine Communication (MTM). USDS Servicer must be capable of sending log data in real time via machine-to-machine communication over encrypted sessions to FSA’s SOC SIEM, which is in a FedRAMP GovCloud. The log types are defined in OMB-M-21-31, Appendix C and Executive Order (EO) 14028. 11. Continuous Diagnostics and Mitigation Program (CDM). Immediately following successful completion of a security authorization, the USDS Servicer shall implement continuous security monitoring in accordance with NIST SP 800-137 and CISA’s latest release of “Continuous Diagnostics and Mitigation Program, Technical Capabilities, Volume Two: Requirements Catalog”. The CDM capabilities shall be capable of satisfying an ongoing security authorization. The USDS Servicer's Continuous Monitoring must feed into the Department and FSA continuous monitoring programs via machine-to-machine near-real-time updates and static frequency- based updates. The USDS Servicer shall ensure all information is entered into the Department's FISMA management tool and kept current with all changes. USDS Servicer must adhere to the DHS deployment phases as required by DHS. See Attachment 3 for additional CDM requirements documents.

Attachment Page PAGE 23 OF 81 91003123D0005 12. End Point Detection and Response (EDR). USDS Servicer must provide end point detection and response (EDR) in accordance with DHS requirements. The EDR solution must be able to integrate with DHS. See Attachment 3 for additional EDR requirements documents. 13. IPv6. Compliance with networks operating only at Internet Protocol Version 6 (IPv6) must be in accordance with OMB 21-07 timelines. See also Attachment 3 (Security and Privacy Requirements for Information Technology Procurements). ii. FSA Data Segregation Requirements: 1. Physical Separation: a) USDS Servicer shall provide and maintain a physically segregated network. b) USDS Servicer shall ensure separate hardware for each landing zone to include, but not limited to network devices, routers, switches, firewalls, and load balancers. c) In non-cloud environments, the USDS Servicer shall ensure virtual machines exist on physically separate equipment for each landing zone including virtual routers and switches. 2. Logical Separation: a) FSA data and transactions on mainframes shall be hosted in separate partitions that do not share resources with other IT users of the mainframe. b) For virtual and cloud environments, the USDS Servicer shall ensure FSA systems are hosted in separate instances, also may be referred to as containers, or tenants. 3. Monitoring and reporting segregation: a) The USDS Servicer shall provide a quarterly report that identifies systems by name and IP address to identify potential problems in maintaining segregation of USDS systems. b) The USDS Servicer shall monitor, track, and report monthly on physical segregation to ensure it is maintained. c) The USDS Servicer shall follow an FSA approved process for changes to network configurations. d) The USDS Servicer shall provide a report to validate that moves, additions, and changes have been appropriately requested and implemented. e) The USDS Servicer shall use the change-management process to identify potential security gaps in segregation maintenance and shall report status and findings quarterly. iii. FSA Cybersecurity References: 1. The USDS Servicer shall use the current versions and current revisions for applicable Federal Cybersecurity Laws and Regulations, OMB Memorandums, NIST guidance documents, Department of Homeland Security Guidance documents, Department of Education policy and guidance documents, and Federal Student Aid policy, procedures, and guidance documents.

Attachment Page PAGE 24 OF 81 91003123D0005 2. On a quarterly basis, FSA will provide the USDS Servicer with a list of updated Cybersecurity References. Any work required to comply with the updated references shall be coordinated through the Information System Owner, ISSO, Program Manager, COR, and CO. 3. The USDS Servicer understands and agrees that (i) any list of updated Cybersecurity References provided by FSA is provided purely as a courtesy; (ii) FSA does not provide any warranties, including but not limited to those of accuracy and currency, related to such lists; (iii) nothing in the lists, nor any other information provided by FSA shall be interpreted as legal advice and (iv) the USDS Servicer is required to perform independent due diligence and seek the advice of its legal counsel on all questions of compliance, including those related the Cybersecurity References. i. FSA IT Retirement Requirements: i. When an Information Resource, as defined in OMB A-130 and 44 USC 3502, reaches the end of its life cycle, and access to the resource by all users has been terminated, data resident on the resources shall be protected and transferred to the Department in a usable form within 120 days after resource retirement and in a format that ensuring the data is available for future use, and other assets shall be disposed of in accordance with NIST publication 800-88. ii. The USDS Servicer shall complete the destruction of all copies of Federal records on the USDS Servicer systems, as directed by the CO, within an agreed upon timeframe, after the end of the Contract performance period or after the Contract is suspended or terminated by FSA for any reason. j. FSA Information Data Exchange: i. The USDS Servicer shall provide cybersecurity relevant date, to support Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, in a machine-to- machine manner to the FSA Security Operations Center. ii. The USDS Servicer shall implement Internet access via TIC or MTIPS in accordance OMB Memorandum M-19-26, "Update to the Trusted Internet Connections (TIC) Initiative”, September 12, 2019. k. Capacity Planning and Management: i. The USDS Servicer shall provide capacity planning and management information to the Department, including, but not limited to: capacity planning reports and recommendations; annual forecast and recommendations it proposes to adopt in fulfillment of the Contract with specific sizes, quantities, specifications and timing. ii. The USDS Servicer shall support FSA’s capacity planning schedule and process. The USDS Servicer will provide input relative to the performance of the application/tool and its supporting infrastructure. This will, include but not be limited to system response time and/or latency, system capacity, storage requirements, utilization, performance, etc. iii. The USDS Servicer shall monitor and manage capacity to ensure that information technology resources are being operated within minimum and maximum thresholds. iv. The USDS Servicer shall produce written capacity management reports at intervals defined in Attachment 04a – Deliverable Table of Attachment 4 (Attachment 4a) . The capacity management

Attachment Page PAGE 25 OF 81 91003123D0005 report must summarize actions taken since the last report and which provide prescriptive recommendations to minimize cost and maximize efficiency. v. The USDS Servicer shall keep the USDS system(s)’s average annual uptime at 99.99% excluding scheduled maintenance. l. Data Planning and Management: i. Data Planning: The USDS Servicer shall provide a Data Migration Plan for solutions that involve the movement, creation, modification, or decommissioning of operations data supporting any FSA information system in accordance with the approved Federal records schedule in Attachment 1 and paragraph m of this section, Federal Records and Controlled Unclassified Information (CUI), below. Refer to the FSA System Development Lifecycle (FSA SDLC)/Lifecycle Management Methodology (LMM) section of the Federal Student Aid Technology Office IT Standards Library for additional information. xxxxx://xxxxxxxxxx.xx.xxx/xxxxx/xxxxxxxxxxx-xxxx/xx-xxxxxxxxx ii. Data Management: The USDS Servicer shall provide detailed file layouts for all production data files, loads, and extracts comprising or supporting any USDS Servicer information system(s) per the guidance provided in the current Federal Student Aid Data Standardization Policies and Procedures within Attachment 4. Additionally, the USDS Servicer shall include detailed source target mapping, conceptual (where applicable), logical and physical data models, and detailed data dictionaries for all production database structures per the guidance provided in Federal Student Aid Data Model Standards and Guidelines, Registration Policies and Procedures, and Federal Student Aid Enterprise Data Dictionary Standards within Attachment 4. The USDS Servicer shall provide this information on an as-needed basis when requested by FSA. m. Federal Records and Controlled Unclassified Information (CUI): i. "Federal record" as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by the Department under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by the Department or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the U. S. Government or because of the informational value of data in them. ii. The term Federal record: 1. Includes Department Records. 2. Does not include personal materials. 3. Applies to records created, received, or maintained by the USDS Servicer pursuant to the Contract. 4. May include deliverables and documentation associated with deliverables, as described in the Contract. iii. The USDS Servicer shall comply with all applicable Federal records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to, the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B,

Attachment Page PAGE 26 OF 81 91003123D0005 including 36 CFR part 1236, and those policies associated with the safeguarding of Federal records covered by the Privacy Act of 1974, as amended (5 U.S.C. 552a). These Federal laws, regulations, and policies include the appropriate preservation of all Federal records, regardless of form or characteristics, mode of transmission, or state of completion. iv. In accordance with 36 CFR 1222.32, all data created for U.S. Government use and delivered to, or falling under the legal control of the U. S. Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by Federal statute or regulation. v. In accordance with 36 CFR 1222.32, USDS Servicer shall maintain all Federal records created for U.S. Government use, created during Contract performance, and/or delivered to, or under the legal control of the U.S. Government in accordance with Federal law. Electronic Federal records and associated metadata must be accompanied by sufficient technical documentation to facilitate their understanding and use. vi. USDS Servicer must additionally manage Federal records which contain CUI in accordance with all applicable laws, regulations, and U.S. Government-wide policies (LRGWP) to include Executive Order EO 13556, 32 CFR Part 2002, ED Directive OCIO 3-113, and NIST-800-171 Revision 2 (or current version). vii. The USDS Servicer is responsible for preventing the alienation or unauthorized destruction of Federal records, under the Contract, including all forms of mutilation. Federal records may not be removed from the legal custody of the Department or destroyed except in accordance with the provisions of the Contract and Federal Records Act. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. The USDS Servicer shall immediately report any unlawful or accidental removal, defacing, alteration, or destruction of Federal records to the CO. viii. The USDS Servicer shall immediately notify the CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. The USDS Servicer shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of all Federal records in accordance with applicable law. ix. The USDS Servicer shall not remove material from U.S. Government facilities or systems, or facilities or systems operated or maintained on the U.S. Government's behalf, without the express written permission of the Department’s Records Officer. x. Under no circumstances shall the USDS Servicer retain possession of, nor access to, Federal records, or any copies thereof, after the expiration or termination of the Contract. Under no circumstances shall the USDS Servicer destroy Federal records except in accordance with the provisions of the Contract and the Federal Records Act. xi. The USDS Servicer is required to obtain the CO's approval prior to engaging in any contractual relationship (sub-contractor) in support of the Contract requiring the disclosure to the subcontractor of information, documentary material and/or Federal records generated under, or relating to, the performance of the Contract. The USDS Servicer (and any sub-contractor) is required to abide by U.S. Government and Department guidance for protecting sensitive, proprietary information, classified, and CUI. The U.S.

Attachment Page PAGE 27 OF 81 91003123D0005 Government reserves the right to inspect, at any time, USDS Servicer and subcontractor policies, procedures, and strategies for ensuring that Federal records are appropriately preserved. xii. The USDS Servicer’s use of U.S. Government IT equipment is limited to Contract performance or any purposes otherwise authorized by the Contract and in accordance with Department policy. xiii. The USDS Servicer shall not create or maintain any Federal records containing any non-public Department information not specified or authorized by the Contract. xiv. The USDS Servicer shall not retain, use, sell, or disseminate copies of any Federal record or deliverable that contains information covered by the Privacy Act of 1974, as amended (5 U.S.C. 552a), or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act, as amended (5 U.S.C. 552). xv. The Department owns the rights to all data and Federal records produced as part of the Contract. All deliverables under the Contract are the property of the U.S. Government for which the Department shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any of the Contractor’s rights in the data or deliverables must be identified, as required by FAR 52.227-11 through FAR 52.227-20. xvi. The USDS Servicer shall incorporate the substance of this Federal Records and Controlled Unclassified Information (CUI) section, its terms and requirements including this paragraph, in all subcontracts requiring the disclosure to a subcontractor of information, documentary material, and/or Federal records generated under, or relating to, the performance of the Contract, and require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the USDS Servicer. xvii. All USDS Servicer employees assigned to the Contract who create, work with, or otherwise handle Federal records are required to complete Department-provided records management training. The USDS Servicer is responsible for confirming training has been completed according to Department policies, including initial training and any annual or refresher training. USDS Servicer must confirm the applicable individuals complete the training as follows: 1. All USDS Servicer personnel with Department email accounts or access to Department IT networks or networks with Department data must complete records management training within 60 calendar days of employment and must complete annual refresher training. 2. All USDS Servicer personnel that create, receive, access, or use Federal records on behalf of the Department, regardless of whether those individuals have Department email accounts or IT network access. 3. USDS Servicer is required to take the annual Information Management Requirements training, because the Contract includes CUI and the CUI Identification and Marking Training is required. Additional Category or POC specific trainings may be assigned. USDS Servicer will maintain completion certificates and provide them to FSA upon request. 4. Annual training must be completed within 60 calendar days of receiving the training materials. 5. Attestation that all applicable staff have completed training will be sent by email to the CO or COR with a cc to the CO, from an official authorized to communicate on behalf of the USDS Servicer.

Attachment Page PAGE 28 OF 81 91003123D0005 xviii. Electronic Information System Requirements: Any electronic information system should address, at minimum, the regulations in 36 CFR 1236.10. Information systems that process, store, or transmit CUI must fulfill the requirements outlined in 32 CFR 2002.14(g). xix. Marking Requirements: The USDS Servicer shall xxxx XXX as outlined in Department training. xx. Handling and Safeguarding Requirements: The USDS Servicer will ensure that CUI is managed appropriately. The requirements include safeguarding, controlled environments, shipping and mailing or transporting protections, and reproduction protections (see 32 CFR 2002.14(a-e)). xxi. Information Security Incidents (ISI) Requirements: USDS Servicer must immediately report all suspected security incidents, breaches, and events involving Department information to the Department’s Computer Incident Response Center (EDCIRC) email: xxxxxx@xx.xxx, and ED’s Security Operations Center (EDSOC) email: xxxxx@xx.xxx; voice: 000-000-0000, regardless of whether the ISI is suspected, known, or determined to involve IT systems operated in support of the Contract. In the event of an ISI, the Department must be provided immediate access to all USDS Servicer and/or subcontractor IT systems used in support of the Contract for inspection and analysis. n. IT Accessibility Requirements (Section 508 of the Rehabilitation Act) Please note that a hyperlink included provides guidance on the following statements except for the last bullet relating to acceptance criteria. i. Section 508 of the Rehabilitation Act, as amended by P.L. 105-220, requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Products, platforms and services delivered as part of this work statement that are or contain ICT, must conform to the Revised 508 Standards, at 36 C.F.R. § 1194.1 & Apps. A, C & D (found at xxxxx://xxx.xxxxxx-xxxxx.xxx/xxxxxxxxxx-xxx-xxxxxxxxx/xxxxxxxxxxxxxx-xxx-xx/xxxxx-xxx-xxx- refresh/final-rule/text-of-the-standards-and-guidelines). ii. Applicable requirements for software features and components: Where the USDS Servicer provides client server software (installed on a computer), the WCAG Level AA Success Criteria, 502 Interoperability with Assistive Technology, 503 Application applies. iii. Applicable requirements to Webpage and Web Applications: Where the USDS Servicer provides web-based application (browser based), the WCAG Level AA Success Criteria applies (found at: xxxxx://xxx.x0.xxx/XX/XXXX00/). iv. Applicable requirements for hardware features and components: Where the USDS Servicer provides hardware (e.g., Copiers, fax machines, phones, scanner etc.), the requirements for hardware features and comments applies (found at xxxxx://xxx.xxxxxx-xxxxx.xxx/xxx/#X000-xxxxxxxx). v. Applicable support services and documentation: Where the USDS Servicer provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6 (found at xxxxx://xxx.xxxxxx-xxxxx.xxx/xxxxxxxxxx-xxx-xxxxxxxxx/xxxxxxxxxxxxxx-xxx-xx/xxxxx-xxx-xxx- refresh/final-rule/text-of-the-standards-and-guidelines#602-support-documentation). vi. Section 508 Compliance Criteria: Prior to acceptance, the Government reserves the right to perform testing on required ICT items to validate the USDS Servicer’s Section 508 conformance claims.

Attachment Page PAGE 29 OF 81 91003123D0005 1. If Department OCIO testing of ICT implementations and enhancements determines such enhancements fail to meet Section 508 requirements, then final payment for the implementation may be withheld by the Government until the product is updated to pass 508 compliance testing by Department OCIO. 2. If FSA determines that Section 508 conformance claims for COTS software products provided by the USDS Servicer represents a higher level of conformance than what is provided to FSA, then the Government may, at its option: a) Require the USDS Servicer to remediate the item to align with the USDS Servicer’s original accessibility (Section 508) conformance claims prior to acceptance; and b) Require the USDS Servicer to substitute a compliant product. o. Technology Business Management Data Reporting i. The Technology Business Management (TBM) Data Report – The USDS Servicer must submit the TBM Data Report. The TBM Data Report Template is included within Attachment 4. The USDS Servicer shall submit the TBM Data Report as an annual deliverable, as requested by the Department, and as-need when the distribution percentages need to be changed. The USDS Servicer shall complete all pertinent fields of the TBM Data Report and provide timely delivery consistent with the due date for the annual Capital Planning and Investment Control (CPIC) submission. The specific deliverable descriptions for the TBM IT Towers and IT Cost Pools are provided within Attachment 4. ii. The USDS Servicer shall review all of the provided informational materials and select the IT Towers and IT Cost Pools that pertain to the Contract. Not all IT Towers nor all of the IT Cost Pools may apply to the Contract. The USDS Servicer shall enter the appropriate amounts into each cell for each pertinent fiscal year. The USDS Servicer shall ignore the first IT Cost Pool for Internal Labor which pertains to Government FTE costs which will be provided by FSA before the initial deliverable due date in August 2023. p. Contractor Qualifications – Capability Maturity Model Integration (CMMI) The USDS Servicer shall maintain mature IT management processes and a mature System Development Life Cycle (SDLC) methodology. This can be demonstrated through a minimum of a Capability Maturity Model Integration (CMMI) Level 2 assessment. FSA accepts either CMMI-Dev or CMMI-Services. Self-certification of CMMI Level 2 is adequate only if followed up with achievement of full certification within a year of Contract award. FSA has a strong preference for CMMI Level 3. CMMI is desired; however, a similar rating like ISO 9001 or equivalent in the commercial space may also be taken under consideration. For example, FSA will accept a combination of ISO 9001 and ISO 27001 certifications, with a list of CMMI attributes they conform to. Personnel assigned to the Contract must comply with the USDS Servicer’s CMMI Level 2 or equivalent processes and be familiar with the CMMI or equivalent requirements that apply to their role. q. Network Management For all telecommunication requirement changes, the USDS Servicer shall submit a written request through the Federal Student Aid Enterprise Change Management (ECM) process. All such changes, new or existing, shall conform to Federal Student Aid Security standards and shall undergo security reviews.

Attachment Page PAGE 30 OF 81 91003123D0005 r. IT Incident Management The USDS Servicer shall use the FSA data center services and the Department’s Help Desk to report all incidents (Incidents). Incidents include those occurring inside the FSA data center environment, and those Incidents occurring in USDS Servicer’s applications outside of the FSA data center environment. Until service is restored, the USDS Servicer shall assist in timely notification, within 30 minutes of the Incident occurrence and within 24 hours of follow up issues, escalation and resolution of any Incidents that impact application degradation or outages. The USDS Servicer shall collaboratively participate in identifying the root cause of Incident. The USDS Servicer shall also, develop solutions that resolve the issues, implement, and test any corrective actions. In matters relevant to FSA systems impacted by the USDS Servicer’s work effort, the USDS Servicer shall provide FSA and the FSA data center support and input into root-cause analysis. 5) Milestones a. ATO & Security Requirements: USDS Servicer shall be able to meet Security and Privacy Requirements as described within Attachment 3 prior to Code Freeze date; and be ready to provide services in compliance with Requirements by the Go Live date. b. Business Operations Servicing Requirements: USDS Servicer shall provide services in support of FSA’s Business Operations Servicing Requirements as fully described in Attachment 1 and associated attachments. As part of the Initial Task Order awarded under the Contract, all system development work in support of these requirements must be completed by the Code Freeze date and any other efforts to implement these requirements (e.g., system deployments, procedure development, staffing, training, etc.) must be ready by the Go Live date. c. Financial Technical Requirements: USDS Servicer shall provide services in support of FSA’s Financial Technical Requirements as fully defined in Attachment 2 and associated attachments. As part of the Initial Task Order awarded under the Contract, all system development work in support of these requirements must be completed by the Code Freeze date and any other efforts to implement these requirements (e.g., system deployments, procedure development, staffing, training, etc.) must be ready by the Go Live date. d. Specialty Program Servicing Requirements: USDS Servicer shall provide all Specialty Program Servicing Requirements as fully described in Attachment 1. As part of the Initial Task Order awarded under the Contract, all system development work in support of these requirements must be completed by the Code Freeze date and any other efforts to implement these requirements (e.g., system deployments, procedure development, staffing, training, etc.) must be ready by the Go Live date e. Specialty Task Servicing Requirements: USDS Servicer shall provide all Specialty Servicing Task Requirements as more fully described in Attachment 1. As part of the Initial Task Order awarded under the Contract, all system development work in support of these requirements must be completed by the Code Freeze date and any other efforts to implement these requirements (e.g., system deployments, procedure development, staffing, training, etc.) must be ready by the Go Live date f. Unmet Requirements: For any of the requirements that the USDS Servicer will not meet upon award, the USDS Servicer has identified the unmet requirements. Such unmet requirements and the planned completion dates to meet those requirements are provided in Attachment 23 - Requirements Development and Costs Template (Attachment 23). The associated costs (if applicable) to meet these requirements are incorporated in the Initial Task Order.

Attachment Page PAGE 31 OF 81 91003123D0005 6) Deliverables: A complete list of contract deliverables can be found in the following 3 attachments: Attachment 1a Business Operations Deliverable Table (Attachment 1a), Attachment 2a Financial Deliverables Table (Attachment 2a), and Attachment 4a IT Deliverables Table (Attachment 4a). a. Format: Deliverables shall be provided electronically whenever possible. Electronic delivery via e-mail is acceptable, with the files delivered in both Acrobat (.pdf) and a current Microsoft Office format suitable for the report (Word or Excel) unless otherwise directed by the CO to provide in a different format. b. Delivery Points of Contact: Deliverables shall be submitted to the CO, the COR, Program Manager, and Project Manager. c. Review Period: i. Unless specified differently in Attachments 1a, 2a, or 4a, or at the Task Order level, FSA shall review each deliverable and provide written notice of acceptance or rejection within fifteen (15) business days upon receipt. ii. Changes and Comments: 1. Upon notice of formal written rejection of a deliverable from FSA’s CO, USDS Servicer shall address all comments/changes and submit a revised deliverable within five (5) business days if the comments/changes can be easily addressed and understood by both FSA and USDS Servicer. 2. If the deliverable is rejected and/or requires significant revision to address all FSA comments/changes, USDS Servicer will have seven (7) business days from date of FSA’s written rejection to submit the revised deliverable. d. Deliverable Due Date: USDS Servicer shall furnish deliverables specified herein in accordance with the delivery schedule and requirements, to the delivery point(s) specified in paragraph b of this section and as further described in Attachments 1a, 2a, and/or 4a or at the Task Order level. i. If a deliverable is due on a calendar day that falls on a weekend day or on a Federal Government holiday, the deliverable is due on the following business day. ii. Unless otherwise specified, deliverables shall be submitted by noon (12:00 PM EST) on the deliverable due date. e. General Deliverable Acceptance Criteria: The acceptance criteria for each deliverable is included in Attachments 1a, 2a, and 4a. Such acceptance criteria include, but is not limited to, the following: i. The CO, the COR, Program Manager, and Project Manager will review the deliverable to determine that: 1. The deliverable is organized appropriately and written clearly. 2. The information in the deliverable is accurate and relevant. 3. The deliverable adheres to FSA documentation standards, including technical quality. ii. Documentation created by the USDS Servicer as part of the Contract shall comply with the templates contained within FSA’s LMM, Attachment 6. These templates may be modified by mutual agreement of the parties, to address the needs of the Contract, contract modification, or Task Order under the Contract.

Attachment Page PAGE 32 OF 81 91003123D0005 iii. A deliverable that is poorly organized, incomplete, unclear, inaccurate, or contains grammar/spelling errors will be deemed unacceptable. As further described in paragraph c of this section, the CO will provide written rejection to the USDS Servicer. f. Single Points of Contact (SPOCs): The USDS Servicer shall provide Single-Points-of-Contact (SPOCs) for all USDS products and services. The USDS Servicer shall use SPOCs to ensure effective and consistent communication with the Government. 4. Initial USDS Servicer Task Order: a. The Initial Task Order is a firm-fixed price task order for the tasks and deliverables required for the USDS Servicer to become performance ready. b. The period of performance for the Initial Task Order is anticipated to be the date of Contract award thru resolution of all issues discovered during the ATO process. c. USDS Servicer shall provide the tasks required to achieve ATO and go-live of the servicing system (Go-Live) according to the schedule in the table below. The requirements are as fully described in Attachments 1, 2, and 3. d. The Initial Task Order Milestones/Deliverables and associated due dates are contained in the table below. If a due date falls on a holiday or weekend, then the due date will move to the next business day (Monday – Friday). Additional Initial Task Order deliverables are marked and contained in the deliverable table and Attachments 1a, 2a, and 4a. i. The USDS Servicer shall enhance its IT/Cybersecurity posture to meet all requirements in Attachment 3 by the start of the ATO process. ii. The ATO assessment may result in required Plan of Action and Milestones (POA&M) that the Government may accept remediation over an FSA defined period. iii. The Department Authorizing Official (AO) shall have final authority to accept or reject the ATO. e. The Department may withhold final payment under the Initial Task Order until ATO is met and FSA accepts all deliverables under the Initial Task Order and any POA&M remediations. f. USDS Servicer shall coordinate with FSA to ensure all personnel have completed all required training and security requirements to perform under the Contract. Table 2 Initial Task Order Deliverables/Milestones Activity Due Date FSA Circuit Pre-Order Questionnaire Due within five (5) business days of Initial Task Order award Personnel Security Package for “Implementation” Personnel Due no later than fourteen (14) calendar days after Initial Task Order award Code Freeze Due no later than 199 calendar days after Initial Task Order award

Attachment Page PAGE 33 OF 81 91003123D0005 ATO Process Begins Due no later than 199 calendar days after Initial Task Order award ATO Approval Decision Due no later than 287 calendar days after Initial Task Order award Submit Completed Personnel Security Package for “On-boarding” CSRs Due no later than 264 calendar days after Initial Task Order award Production Readiness Review Due no later than 309 calendar days after Initial Task Order award System Go-Live Due no later than 324 calendar days after Initial Task Order award D. Packaging and Marking Reference Part I Section C PWS, Section H, Part II Section I, and Part III Section J for specific requirements regarding packaging, marking, and preservation. E. Inspection and Acceptance Outside any specific requirements of this section, reference Part I Section C PWS, Section H, Part II Section I, and Part III Section J for specific requirements regarding inspection and acceptance 52.246-4 INSPECTION OF SERVICES-FIXED-PRICE (AUG 1996) (a) Definition. "Services," as used in this clause, includes services performed, workmanship, and material furnished or utilized in the performance of services. (b) The Contractor shall provide and maintain an inspection system acceptable to the Government covering the services under this contract. Complete records of all inspection work performed by the Contractor shall be maintained and made available to the Government during contract performance and for as long afterwards as the contract requires. (c) The Government has the right to inspect and test all services called for by the contract, to the extent practicable at all times and places during the term of the contract. The Government shall perform inspections and tests in a manner that will not unduly delay the work. (d) If the Government performs inspections or tests on the premises of the Contractor or a subcontractor, the Contractor shall furnish, and shall require subcontractors to furnish, at no increase in contract price, all reasonable facilities and assistance for the safe and convenient performance of these duties. (e) If any of the services do not conform with contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by reperformance, the Government may- (1) Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and (2) Reduce the contract price to reflect the reduced value of the services performed.

Attachment Page PAGE 34 OF 81 91003123D0005 (f) If the Contractor fails to promptly perform the services again or to take the necessary action to ensure future performance in conformity with contract requirements, the Government may- (1) By contract or otherwise, perform the services and charge to the Contractor any cost incurred by the Government that is directly related to the performance of such service; or (2) Terminate the contract for default. (End of clause) F. Deliveries or Performance Reference Part I Section C PWS, Section H, Part II Section I, and Part III Section J for specific requirements regarding deliveries and/or performance. G. Contract Administrative Data A. CLAUSES 52.216-32 TASK-ORDER AND DELIVERY-ORDER OMBUDSMAN (SEPT 2019) (a) In accordance with 41 U.S.C. 4106(g), the Agency has designated the following task-order and delivery-order Ombudsman for this contract. The Ombudsman must review complaints from the Contractor concerning all task-order and delivery-order actions for this contract and ensure the Contractor is afforded a fair opportunity for consideration in the award of orders, consistent with the procedures in the contract. Xxxxxxxxxxx X. Xxxxxx, 000 Xxxxxxxx Xxx XX, Xxxxxxxxxx, XX 00000/(202) 000-0000/Xxxxx.Xxxxxx@xx.xxx (b) Consulting an ombudsman does not alter or postpone the timeline for any other process (e.g., protests). (c) Before consulting with the Ombudsman, the Contractor is encouraged to first address complaints with the Contracting Officer for resolution. When requested by the Contractor, the Ombudsman may keep the identity of the concerned party or entity confidential, unless prohibited by law or agency procedure. (End of clause) B. TYPE OF CONTRACT AND TASK ORDERS The Contract is a Multiple Award, Indefinite Delivery, Indefinite Quantity (IDIQ) Contract with the ability to issue Task Orders with multiple or singular contract types. The contract types available are Fixed Price with Economic Price Adjustment (FP-EPA), Fixed Price with Economic Price Adjustment and with Performance Incentives (FP-EPA-PI), and Firm-Fixed Price (FFP). C. TASK ORDERS Task Orders: Task Orders shall be issued based on the terms and conditions of the Contract. FSA will implement servicing solution through the issuance of Task Orders. These Task Orders will be priced based upon the terms and conditions of the Contract including the established common pricing and pricing for Initial Task Order. See subsection D, Pricing and Payment below.

Attachment Page PAGE 35 OF 81 91003123D0005 D. PRICING AND PAYMENT a. Progressive Fixed-Price Rates Explanation: i. Progressive Fixed-Price Rate. A progressive fixed-price rate means the USDS Servicer will invoice FSA for different rates depending on the number of borrower accounts with a remaining balance on the USDS Servicer’s system. For example, if the USDS Servicer has 7.5 million borrowers, FSA will pay one rate (A) for the first 5 million borrowers and a different rate (B) for the next 2.5 million borrowers. The monthly billing for this CLIN would = (5 million x Rate A) + (2.5 million x Rate B). See Attachment 22 - Progressive Fixed- Price Calculator (Attachment 22) for an example of how to calculate or estimate using the methodology described in this section. ii. Borrower Accounts Pending Discharge. For billing purposes, borrower accounts pending discharge, which include but are not limited to: conditional disability, death, or bankruptcy, shall be counted in the deliverable status at the time of the discharge request. iii. Borrower Accounts in Default. Borrower accounts in default status will be transferred from the USDS Servicer to DMCS, FSA’s system for managing defaulted borrower accounts. Upon borrower account transfer to DMCS, USDS Servicer will no longer invoice FSA for that account. iv. Last Day of Billing Period. The last day of the billing period for services provided by the USDS Servicer is defined as the last day of FSA’s monthly billing period. b. CLIN 1 Servicing System Operations: USDS Servicer will invoice FSA on a monthly basis for the services provided under CLIN 1 Servicing System Operations. Monthly billing will be on a progressive fixed-price basis tied to the number of borrower accounts with a remaining balance on the USDS Servicer’s system as of the last day of the month for which the invoice is submitted. Pricing will be in accordance with Contract Section B.2 CLIN Pricing and Rates. c. CLIN 2 Cybersecurity Services: USDS Servicer will invoice FSA on a monthly basis for the services provided under CLIN 2 Cybersecurity Services. Monthly billing will be on a progressive fixed-price basis tied to the number of borrower accounts with a remaining balance on the USDS Servicer’s system as of the last day of the month for which the invoice is submitted. Pricing will be in accordance with Contract Section B.2 CLIN Pricing and Rates. d. CLIN 3 Contact Center and Back-Office Processing Operation & Maintenance: USDS Servicer will invoice FSA for services provided under CLIN 3 Contact Center and Back-Office Processing Operation & Maintenance for up to 80% of the total value of services provided. The remaining 20% may be billed after receipt and application of the amount of the Service Level Agreements and Objectives Performance Incentive. Billing will be on a progressive fixed-price basis tied to the number of borrower accounts with a remaining balance on the USDS Servicer’s system as of the last day of the month for which the services were provided. Pricing will be in accordance with Contract Section B.2 CLIN Pricing and Rates. Types of CLIN 3 Servicing Rates:

Attachment Page PAGE 36 OF 81 91003123D0005 Standard Loan Servicing: Borrower accounts serviced following the standard requirements of the Contract and who do not fit into the two servicing rate types below. Service Member / Military Servicing: Borrowers identified by unique borrower social security numbers (SSNs) with balance not equal to $0.00 currently serviced using the Servicemembers Civil Relief Act (SCRA) 6% interest limit (borrower has one or more loans with rate reduced to 6% or SCRA Eligible loans already at or under 6%). These borrowers are: • In a Military Service Deferment; • In a Post Active Duty Deferment; OR • Using the 0% interest while serving in a hostile area (borrower has one or more loans with rate reduced to 0%). National Emergency Forbearance (CARES Act) Servicing: These are the borrowers that qualify under the Coronavirus Aid, Relief, and Economic Security Act Pub. L. No. 116-136 (2020) (CARES Act) for national emergency forbearance servicing. Performance Incentives: i. At-Risk Borrower Performance Incentive: Payments for the At-Risk Borrower Performance Incentive associated with CLIN 3 shall be in accordance with the At-Risk Borrower Performance Incentive clause. The clause is in the Contract within Part II, Section I, Part 3 Additional Clauses. ii. Service Level Agreements & Objectives Performance Incentive: Invoice adjustments for this performance incentive associated with CLIN 3 shall be in accordance with the Service Level Agreements & Objectives Performance Incentive clause. The clause is in the Contract within Part II, Section I, Part 3 Additional Clauses. e. CLIN 4 Website and Mobile Services: USDS Servicers will invoice FSA on a monthly basis for the services associated with CLIN 4 Website and Mobile Services. Monthly billing will be on a progressive fixed-price basis tied to the number of borrower accounts with a remaining balance on the USDS Servicer’s system as of the last day of the month for which the invoice is submitted. Pricing will be in accordance with Contract Section B.2 CLIN Pricing and Rates. f. CLIN 5 User Authentication Services: USDS Servicer will invoice the FSA on a monthly basis for the services associated with CLIN 5 User Authentication Services. Monthly billing will be on a fixed-price basis tied to the number of borrower accounts with a remaining balance on the USDS Servicer’s system as of the last day of the month for which the invoice is submitted. Pricing will be in accordance with Contract Section B.2 CLIN Pricing and Rates. g. CLIN 6 Fulfillment Services: USDS Servicer will invoice FSA on a monthly basis for the services associated with CLIN 6 Fulfillment Services. Monthly billing will be based on the fixed-prices for CLIN 6 in accordance with Contract Section B.2 CLIN Pricing and Rates. h. CLIN 7 Development, Modernization & Enhancements: FSA will issue Task Orders for implementation or development of future requirements that are within scope of the Contract but not within the base requirements at

Attachment Page PAGE 37 OF 81 91003123D0005 Contract award. The USDS Servicer shall submit an invoice(s) to FSA in accordance with the payment schedule for CLIN 7 services established in the Task Order. i. Initial Task Order: The Initial Task Order under the Contract shall be invoiced in accordance with the clauses and procedures of the Contract and payment schedule established in the Initial Task Order. j. Billing and Prices – Less than one cent: All CLIN Task Order total prices and invoices shall be rounded up to a cent, if the quantity of units multiplied by the unit price results in a number with greater than two decimal places, to result in billing price or CLIN price with two decimal places. For example, if a fixed unit price was 0.00073 and the invoice was for a quantity of 20 units the total of 0.0146 would be rounded up to $0.02. The total of invoices may not exceed the funding on the CLIN as a result of this process. The last invoice for the full amount of unit quantities on the CLIN would invoice for the quantities delivered and at the amount which would total the total funding of the CLIN. This would result in the total quantity of units being delivered and total value of the CLIN being paid. E. PERIOD OF PERFORMANCE The Period of Performance for this IDIQ Contract may last up to ten (10) years, consisting of a five-year Base Period; two, two-year Option Periods; and one, one-year Option Period. Table 4, Period of Performance, below describes the period of performance of the Contract. Table 4, Period of Performance Term Start date End date 5 Year Base Period Upon contract award. See Schedule CLIN 0001. See Schedule CLIN 0001. 2 Year Option Period 1 See Schedule CLIN 0002. See Schedule CLIN 0002. 2 Year Option Period 2 See Schedule CLIN 0003. See Schedule CLIN 0003. 1 Year Option Period 3 See Schedule CLIN 0004. See Schedule CLIN 0004. F. ORDERING General The Task Orders issued under the Contract, may only be issued by an authorized FSA warranted CO (Ordering CO). Ordering COs must obtain permission in advance to issue a Task Order Request For Proposal (RFP) from the FSA CO or Contracting Office responsible for administering the Contract. Ordering COs are responsible for clearly identifying the applicable order type(s), in each Task Order, and making all required pre-solicitation determinations. Task Orders that are not within the scope of the Contract are not authorized. Ordering COs shall ensure Task Order proposals are responsive to RFP evaluation criteria and that proposed prices are fair and reasonable within the Contract pre-

Attachment Page PAGE 38 OF 81 91003123D0005 established labor rates. Ordering COs are responsible for all administration duties associated with Task Orders, including the timely closeout of Task Orders as they are completed. Requesting Proposal The authorized FSA warranted CO may solicit responses to requirements from USDS Servicers within a technical area covered by the Scope of Work. Generally, the Task Order solicitation will include, but is not limited to: 1. Statement of Work 2. Reporting Requirements and Deliverables 3. Proposal Due Date and Location to Deliver Proposals 4. Period of Performance of Task Order 5. Anticipated type of Task Order 6. Technical Proposal Instructions 7. Business proposal Instructions 8. Evaluation Factors for Award All Task Order solicitations/proposal requests or notices of intent to place an order shall include the provision 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (NOV 2021). Fair Opportunity In accordance with FAR 16.505, Ordering, all USDS Servicers under the awarded IDIQ contracts pursuant to Solicitation No. 91003122R0007shall be provided with fair opportunity to compete for Task Order awards unless an exception applies. Any Task Order awarded without providing for fair opportunity, must be documented in accordance with the applicable section of FAR 16.505. H. Special Contract Requirements A. Testing Approach FSA will leverage the USDS Servicer’s test plans in executing its oversight and to ensure proper testing of the USDS Servicer’s solution. FSA shall have access to all testing materials (e.g., scripts, testing results, etc.) for review and feedback and shall be given the capability to oversee testing in person or remotely. FSA shall have the ability to conduct side-by-side user acceptance testing with USDS Servicer to reduce cycle times. (End of Clause) B. Technology Business Management (TBM) Data Report The TBM Data Report Template is included as an attachment within Attachment 4. This Office of Management and Budget (OMB) required report shall be a quarterly deliverable under the Contract. The USDS Servicer shall complete all pertinent fields of the TBM Data Report and provide timely delivery consistent with the instructions contained in the annual A-11 OMB Circular on the Budget Submission Requirement, specifically in the section containing the annual OMB Guidance on the Capital Planning and Investment Control (CPIC) submission requirements for Information Technology (IT) investments. The specific deliverable descriptions for the IT Towers and sub-towers and Cost Pools are found in Attachment 4. USDS Servicer shall review the informational materials and select the IT Towers and Cost Pools that pertain to its Contract. Not all of the IT Towers nor all of the Cost Pools may apply to the Contract. USDS Servicer shall enter the

Attachment Page PAGE 39 OF 81 91003123D0005 percent (%) of total cost associated with each selected IT Tower and Cost Pool. The total of the percentages must be 100%. USDS Servicer shall ignore the first IT Cost Pool for Internal Labor. FSA will determine that percentage and adjust the remainder of the Cost Pool percentages in order to sum the percentages to 100%. In addition, after FSA receives this deliverable, it will calculate the actual amounts using the percentages and actual total IT cost of the investment. FSA will provide the USDS Servicer the Security and Compliance actual costs so that the USDS Servicer can calculate the Cyber BDR Costs Percentages by NIST Categories deliverable. OMB requires that the total of the IT Towers equal the total of the IT Cost Pools equal the total of the Lifecycle Cost table in the investment’s business case. (End of Clause) C. Subcontracting with Disabled and Severely Disabled Individuals The Government has preference for companies who employ disabled and severely disabled individuals and allow such individuals to support FSA remotely. Persons with blindness and other disabilities provide a ready source of capable labor. The AbilityOne Program is the largest source of employment for people who are blind or have significant disabilities in the United States. More than 550 nonprofit organizations employ these individuals and provide quality products and services to the Federal Government at a fair market price. They offer call center and helpdesk services with customer satisfaction scores and productivity levels that rival commercial call centers. These services are offered on your site, their site, or from “At-Home” agents. In addition, USDS Servicer may find they are able to fill many of USDS Servicer’s other service needs for the Contract. The Department strongly encourages the USDS Servicer to subcontract with an AbilityOne organization, or another organization that employees disabled and severely disabled individuals for at least a portion of the USDS Servicer call center, helpdesk and other service needs. (End of Clause) D. Annual Submittal of Financial Audit Statements. USDS Servicer shall submit annually a copy of its current Financial Audit Statement to the CO 60 days prior to the end of the current period of performance. This information will be a factor in assessing responsibility prior to exercising options or issuing new Task Orders, as applicable. E. Prohibitions on Contract Performance outside of the United States. The USDS Servicer has represented to the Department that it will perform all work required under the Contract, including all work subcontracted to or otherwise performed by other parties, within the United States. If, at any time, the USDS Servicer wishes to perform any Contract work outside the United States, the USDS Servicer shall inform the CO, in advance and in writing, of its intention and request the Department’s approval. The USDS Servicer shall not perform any Contract work outside the United States unless and until it has received the CO’s explicit, written approval to perform such work. In order to give proper consideration to the USDS Servicer’s request, the Department may ask for, and the USDS Servicer shall provide, information relevant to the proposed performance outside the United States, including but not limited to a detailed description of the physical, personnel and management resources to be used and any potential difficulties or constraints in performing in the foreign jurisdiction. The Department may refuse to approve Contract performance outside the United States to the extent that, solely in the Department’s judgment, the USDS Servicer has not shown that performance outside the United States would satisfy the Contract requirements and would not impair or degrade performance.

Attachment Page PAGE 40 OF 81 91003123D0005 Further, the Department may refuse to approve any performance outside the United States for any other reason, or for no reason, except as otherwise required by the laws and treaties of the United States. The Department may approve performance outside the United States subject to certain conditions, to which conditions the USDS Servicer shall strictly adhere. Neither performance within the United States, nor the Department’s refusal to allow performance outside the United States shall constitute a change to the Contract or give rise to any entitlement to additional compensation or excuse any failure of performance by the USDS Servicer. Nothing in this clause shall be interpreted to impose any obligation on the Department to allow or to refuse a request for performance of the Contract outside the United States. F. Labeling of Documents. The USDS Servicer shall not label any data produced in performance of the Contract in a way that would restrict the U.S. Government's right to use or release the information, unless limited or restricted rights, as define by 52.227-14, Rights in Data-General, were agreed upon and the Contract explicitly delineates the data that are subject to limited or restricted rights. If applicable, the USDS Xxxxxx shall include a legend that identifies sensitive data that should not be released for security reasons. Deliverables shall not contain USDS Servicer-specific logos, mottos, watermarks, or holograms. The USDS Servicer shall not use, particularly for proposals, U.S. Government logos, such as the U.S. Department of Education or Federal Student Aid. G. USDS Servicers Use of Government Commercial Software. This section applies to all commercial software that is– 1. provided by the Government to the USDS Servicer for performance of the Contract; 2. purchased, licensed, or maintained by the USDS Servicer and is directly reimbursed by the Government; or 3. purchased or licensed by the USDS Servicer in the name of the Department. Software provided by the Government will be supplied by the FSA Software Asset Management Team via the CO or COR. The USDS Servicer performing work on behalf of the Department shall not: 1. Install, reproduce, distribute, transmit, or otherwise use software for which the Department lacks the appropriate license, unless such software is properly licensed and used in accordance with Departmental policy and the applicable license. If the USDS Servicer becomes aware of the reproduction, distribution, or use of unauthorized software, the USDS Servicer will notify the CO or COR who in turn will notify the FSA Software Asset Management Team. All use above the licensed entitlement will be removed or purchased by the USDS Servicer. 2. Install, reproduce, or use any software upgrade on a computer that does not already have resident the original, licensed version of the software. 3. Loan, distribute, or transmit Department software to any third party, unless the employee or contractor is expressly authorized to do so by the COR and the applicable license. If the USDS Servicer performing work on behalf of the Department has any question concerning entitlement for use of any software, it has the responsibility to seek clarification, via the CO or COR, of the Software Asset Management Team.

Attachment Page PAGE 41 OF 81 91003123D0005 The terms of this section apply to the USDS Servicer, and its employees performing work on behalf of the Government and accessing or using Government software assets from any off-site or remote work location. For example, this includes all telework locations, use of non-Government equipment while performing Government work, and/or use of any/all devices for this purpose that have the ability to connect/access any Government network or software product. The USDS Servicer shall hold the Government harmless for any noncompliance with this section or the licenses under which the software is provided. The USDS Servicer will be responsible for paying all damages, penalties, extra license fee or any other expense associated with its noncompliance without reimbursement or compensation from the Government. The USDS Servicer shall report annually by March 31, or more frequently if requested by the CO, the following: 1. Software product name 2. Software version number 3. Username 4. Workstation owner, as applicable 5. Server name, as applicable 6. Metrics required by license (e.g., the names of actual users if license is named user base.) The USDS Servicer is subject to audits by the Government or the software manufacturer at the USDS Servicer’s location to ensure it is complying with this section and licenses. The USDS Servicer shall remove the software immediately from its machines and certify to the CO its removal and the destruction or return of all documentation when any of the following occurs: 1. Contact under which software is required ends without renewal; 2. The software license’s term ends without renewal; 3. The software license is terminated by manufacturer for cause; or 4. The software is no longer required for performance of the Contract. For named user-based or client-based licenses, the USDS Servicer will report within 30 calendar days the addition, replacement, or termination of access of any specific named-user or the addition, transfer or removal of software from client machines. Such report will contain the name of the former client as well as the new client, as applicable. For server or core-based licenses, the USDS Servicer will report within 30 days the addition, transfer or removal of software from servers. Such report will contain the name of the former server as well as the new server, as applicable. H. Continuation of Mission Critical Contractor Services. As used in this section:

Attachment Page PAGE 42 OF 81 91003123D0005 1. Mission Critical Contractor System or Other Services are defined as a system or other services that have a material impact on the accomplishment of the Federal Student Aid mission. 2. The services under the Contract are vital to the mission of the Department. The USDS Servicer shall be responsible for the availability of all systems operated, or other services performed by the USDS Servicer for the Department, regardless of location. This section applies to all or any part of the Contract that includes services that directly support the Department's mission. 3. The USDS Servicer shall provide, implement, and maintain a Continuation of Mission Critical Services Plan (also referred to as Contingency Plan, or “The Plan”) for continuing performance of services no matter the circumstances. The Plan shall describe the processes and procedures that will be followed to ensure continued availability of services under the Contract. Any alternate site used as part of Disaster Recovery shall be fully operational within 48 hours of a declared disaster. The USDS Servicer shall identify in the Plan the provisions made for the acquisition of mission critical personnel and resources, if necessary, for continuity of operations for up to 30 calendar days or until normal operations can be resumed. 4. Within 60 calendar days after contract award, the USDS Servicer shall submit its Plan for approval, which shall be consistent with and further detail the approach contained in the USDS Servicer's final revised proposal. The Plan, as approved by the CO, shall be incorporated into the Contract as a compliance document. The Plan must, at a minimum, address: i. Name of the USDS Servicer’s officer overall responsible for the maintenance, management, exercising and execution of the Plan; ii. Plans and procedures; iii. Identification of mission critical functions; iv. The time lapse associated with the initiation of the acquisition of mission critical personnel and resources and their actual availability on site; v. Delegations of authority, planned order of succession, and cross-training to ensure personnel are available to provide services and make key decisions; vi. Proposed alternate operating facilities, interoperable, connectivity and emergency communications approach; vii. Critical records or data storage procedures; viii. Protection of human capital;

Attachment Page PAGE 43 OF 81 91003123D0005 ix. Testing approach for annual tests; x. Training plan; xi. Delegation of control and direction; xii. Reconstitution and resuming normal operations plans; and xiii. Schedule for periodic review and revisions of Plan. 5. The USDS Servicer shall maintain and update its Plan as necessary and adhere to its requirements throughout the Contract term. The USDS Servicer shall not materially alter the Plan without the CO's written consent. 6. As directed by the CO, the USDS Servicer shall participate and collaborate with the Department and its contractors in training events, exercises, and drills associated with Government efforts to test the effectiveness of continuity of operations procedures and practices with internal and external entities. Results of the exercises shall be delivered to the CO or other designated representative within 30 calendar days after the exercise. 7. In the event the USDS Servicer anticipates not being able to perform any of the mission critical contractor services identified in the paragraph above, the USDS Servicer shall notify the CO or other designated representative immediately and use its best efforts to cooperate with the Government in the Government’s efforts to maintain the continuity of operations. In no way does this paragraph relieve the USDS Servicer of financial responsibility in meeting the Contract terms and conditions. 8. The Government reserves the right to use Federal employees of other agencies or support from other parties or to enter into new contracts for mission critical contractor services. Any new contracting efforts would be conducted in accordance with OFPP letter, “Emergency Acquisitions’’ May 2011 and FAR Part 18, respectively, or any other subsequent emergency guidance issued. 9. The USDS Servicer is required to coordinate all changes to mission critical USDS Servicer systems or other services used to implement Federal Student Aid IT operations and services with the CO, the COR, and to Department representatives as directed by the CO, at least five business days prior to the changes, absent exigent circumstances. Emergency changes require immediate notification of the CO, the COR, and to Department representatives as directed by the CO as soon as the charge requirement is known, but prior to the change. If the continuity of such systems or services is disrupted as a consequence of the USDS Servicer’s failure to adequately coordinate these changes with the Department, the USDS Servicer may be subject to contractual remedies available to the Government pursuant to the terms of the Contract or as authorized by law.

Attachment Page PAGE 44 OF 81 91003123D0005 10. The USDS Servicer shall contact the CO and the COR to coordinate all changes to mission critical USDS Servicer systems or services. 11. The USDS Servicer shall include the substance of this section, including this paragraph (11), in subcontracts for the mission critical services. I. Monthly Vendor Employee Report. The Monthly Vendor Employee Report template is included as Attachment 26 to the Contract. This report is a monthly deliverable under the Contract. The USDS Servicer shall complete all fields of the Monthly Vendor Employee Report template and provide timely delivery consistent with the instructions contained in the Monthly Vendor Employee Report template. J. Contractor Security Responsibilities. 1. The USDS Servicer shall ensure that no USDS Servicer’s employee is granted access to the Department’s confidential and/or personally identifiable information (PII), and/or system(s) that permit access to the aforementioned data, until the USDS Servicer’s employee has completed the required security training and receives written access approval from the applicable Government Information System Security Officer (ISSO). If the employee requires access to multiple systems, approval must come from each system’s ISSO before receiving access to that system. 2. The written approval provided to the USDS Servicer by the ISSO shall identify the USDS Servicer’s employee/applicant, the system/platform for which access is being granted, whether privileged (6c) or non- privileged (5c) access is granted, and the Person Handle number (formerly referred to as “unique identification number”) assigned to the USDS Servicer’s employee. The written notification may include multiple USDS Servicer’s employees, but each USDS Servicer’s employee shall be listed separately, including the aforementioned information relevant to the access approval of each individual listed. 3. All USDS Servicer’s employees must complete the required security training as a prerequisite to accessing the Department’s confidential and/or PII data, and/or system(s), and must complete required training annually thereafter. The USDS Servicer’s employee responsible for security shall promptly forward a copy of the completion certificate (training completed within 12 months of the date of access approval will suffice) or other equivalent proof of completion to both the COR and the ISSO(s). Access will not be granted until proof of completion is received. 4. If the ISSO does not grant access to the USDS Servicer’s employee within 20 calendar days of submitting all required documents for a security investigation and the proof of security training completion, the USDS Servicer’s employee responsible for security shall contact the COR and ISSO(s) to ascertain the status of the approval. 5. The USDS Servicer’s employee responsible for security shall maintain a separate copy of the aforementioned written authorization and proof of security training completion for each individual USDS Servicer’s employee

Attachment Page PAGE 45 OF 81 91003123D0005 granted access, as evidence that access has been granted. The Person Handle shall also be included as reference to each employee in the Monthly Vendor Employee Report required under paragraph i, Monthly Vendor Employee Report, above. Each system/location receiving separate access approval will be listed separately on the Monthly Vendor Employee Report. K. Supplemental Instructions to EDAR 3452.239-72, Department Security Requirements. EDAR 3452.239-72,) is supplemented by the following: 1. The USDS Servicer will submit its Background Investigation Requests electronically. Upload the documents into Electronic Questionnaires for Investigation Process (E-QIP) and release the Investigation Request Packet to the COR in E-QIP. 2. Send an electronic copy of the completed coversheet to the Contract COR and system ISSO(s). If USDS Servicer requires a blank coversheet, please contact the COR. When transmitting the cover sheet, please use the following subject in the header of the Microsoft Outlook Message: Subject: [Name of Prime Contractor-Company Name (Name of Sub-Contractor- Company Name, if applicable)]: [Background Investigation (BI) Type] [BI Level] [Date of Submission] [Name of Company Official Responsible for Background applications] 3. Please ensure that each coversheet is encrypted and password protected with a unique password. Do not send the password with the coversheet; instead send a separate email with the exact same subject line with the password in the body of the email. The password should include upper and lower case letters, numbers and special characters. 4. Other than entering the requested data, do not modify the cover sheet format, structure or any other part of the spreadsheet. Any such change may result in the return of the cover sheet and background investigation paperwork for corrections and delay the processing of the package(s). 5. Do not submit SARs with the background investigation paperwork. SARs are to be submitted to the ISSO that is responsible for the USDS system. Please contact the ISSO(s) for specific information regarding the delivery (email, etc.) of the SARs. 6. Contact XXXXxxxxxxxxXxxxxxxx@XX.xxx or your assigned Personnel Security Specialist or by phone (000- 000-0000) with questions.

Attachment Page PAGE 46 OF 81 91003123D0005 II. Part II: Contract Clauses I. Contract Clauses 1. Federal Acquisition Regulation (FAR) Clauses 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998) The Contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the CO will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): xxxxx://xxx.xxxxxxxxxxx.xxx/xxx/ and xxxxx://xxx0.xx.xxx/xxxxxx/xxxx/xxx/xxxxxxxx/xxxx.xxxx (End of Clause) 52.202-1 Definitions (JUN 2020) 52.203-3 Gratuities (APR 1984) 52.203-5 Covenant Against Contingent Fees (May 2014) 52.203-6 Restrictions on Subcontractor Sales to the Government (Jun 2020) 52.203-7 Anti-Kickback Procedures (Jun 2020) 52.203-8 Cancellation, Rescission, and Recovery of Funds for Illegal or Improper Activity (May 2014) 52.203-10 Price or Fee Adjustment for Illegal or Improper Activity (May 2014) 52.203-12 Limitation on Payments to Influence Certain Federal Transactions (JUN 2020) 52.203-13 Contractor Code of Business Ethics and Conduct (Nov 2021) 52.203-14 Display of Hotline Poster(s) (Nov 2021) 52.203-17 Contractor Employee Whistleblower Right and Requirement to Inform Employees of Whistleblower Rights (JUN 2020) 52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper (MAY 2011) 52.204-9 Personal Identity Verification of Contractor Personnel (JAN 2011) 52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) 52.204-13 System for Award Management Maintenance (OCT 2018) 52.204-15 Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) 52.204-18 Commercial and Government Entity Code Maintenance (AUG 2020)

Attachment Page PAGE 47 OF 81 91003123D0005 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Xxxxxxxxx Lab and Other Covered Entities (Nov 2021) 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov 2021) 52.209-6 Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Nov 2021) 52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015) 52.210-1 Market Research (Nov 2021) 52.215-8 Order of Precedence-Uniform Contract Format (Oct 1997) 52.215-10 Price Reduction for Defective Certified Cost or Pricing Data (Aug 2011) 52.215-11 Price Reduction for Defective Certified Cost or Pricing Data -Modifications (Jun 2020) 52.215-12 Subcontractor Certified Cost or Pricing Data (Jun 2020) 52.215-13 Subcontractor Certified Cost or Pricing Data -Modifications (Jun 2020) 52.215-14 Integrity of Unit Prices (Nov 2021) 52.215-15 Pension Adjustments and Asset Reversions (Oct 2010) 52.215-18 Reversion or Adjustment of Plans for Postretirement Benefits (PRB) Other Than Pensions (July 2005) 52.215-19 Notification of Ownership Changes (Oct 1997) 52.215-21 Requirements for Certified Cost or Pricing Data and Data Other Than Certified Cost or Pricing Data - Modifications (Nov 2021) 52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Sep 2021) 52.219-8 Utilization of Small Business Concerns (Oct 2018) 52.219-9 Small Business Subcontracting Plan (Nov 2021) Alternate II (Nov 2016) 52.219-16 Liquidated Damages-Subcontracting Plan (Sep 2021) 52.219-28 Post-Award Small Business Program Rerepresentation (Sep 2021) 52.222-3 Convict Labor (June 2003) 52.222-21 Prohibition of Segregated Facilities (Apr 2015) 52.222-26 Equal Opportunity (Sept 2016) 52.222-37 Employment Reports on Veterans (Jun 2020)

Attachment Page PAGE 48 OF 81 91003123D0005 52.222-40 Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) 52.222-41 Service Contract Labor Standards (Aug 2018) 52.222-43 Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) 52.222-49 Service Contract Labor Standards-Place of Performance Unknown (May 2014) Fill In: (a) “following: _No additional places or areas_. The CO will request wage determinations for additional places or areas of performance if asked to do so in writing by __ 20 calendar days prior to the solicitation proposal submission due date__.” 52.222-50 Combating Trafficking in Persons (Nov 2021) 52.222-54 Employment Eligibility Verification (Nov 2021) 52.222-55 Minimum Wages For Contractor Workers Under Executive Order 14026 (JAN 2022) 52.222-62 Paid Sick Leave Under Executive Order 13706 (Jan 2022) 52.223-6 Drug-Free Workplace (May 2001) 52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) 52.224-1 Privacy Act Notification (Apr 1984) 52.224-2 Privacy Act (Apr 1984) 52.224-3 Privacy Training (Jan 2017) 52.225-13 Restrictions on Certain Foreign Purchases (Feb 2021) 52.227-1 Authorization and Consent (Jun 2020) 52.227-2 Notice and Assistance Regarding Patent and Copyright Infringement (Jun 2020) 52.227-3 Patent Indemnity (Apr 1984) 52.227-9 Refund of Royalties (Apr 1984) 52.227-14 Rights in Data – General (MAY 2014) Alternate II (DEC 2007) Alternate III (DEC 2007 52.227-16 Additional Data Requirements (JUN 1987) 52.227-17 Rights in Data-Special Works (DEC 2007) 52.229-3 Federal, State, and Local Taxes (Feb 2013) 52.232-1 Payments (APR 1984) 52.232-8 Discounts for Prompt Payment (FEB 2002) 52.232-9 Limitation on Withholding of Payments (APR 1984) 52.232-11 Extras (APR 1984)

Attachment Page PAGE 49 OF 81 91003123D0005 52.232-17 Interest (May 2014) 52.232-18 Availability of Funds (Apr 1984) 52.232-23 Assignment of Claims (May 2014) 52.232-25 Prompt Payment (JAN 2017) 52.232-29 Unenforceability of Unauthorized Obligations (Jun 2013) 52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Nov 2021) 52.233-1 Disputes (May 2014) 52.233-4 Applicable Law for Breach of Contract Claim (Oct 2004) 52.233-3 Protest after Award (Aug 1996) 52.237-3 Continuity of Services (JAN 1991) 52.239-1 Privacy or Security Safeguards (Aug 1996) 52.242-5 Payments to Small Business Subcontractors (Jan 2017) 52.242-13 Bankruptcy (July 1995) 52.242-15 Stop Work Order (AUG 1989) 52.242-17 Government Delay of Work (Apr 1984) 52.243-1 Changes-Fixed Price (Aug 1987) Alternate I (Apr 1984) 52.243-7 Notification of Changes (Jan 2017) Fill in - (b) 3 days_ & (d) 4 days 52.244-5 Competition in Subcontracting (Dec 1996) 52.244-6 Subcontracts for Commercial Products and Commercial Services (Jan 2022) 52.245-1 Government Property (Sep 2021) 52.245-9 Use and Charges (Apr 2012) 52.246-25 Limitation of Liability – Services (FEB 1997) 52.247-55 F.O.B. Point for Delivery of Government-Furnished Property (JUN 2003) 52.249-2 Termination for Convenience of the Government (Fixed-Price) (Apr 2012) 52.249-8 Default (Fixed-Price Supply and Service) (Apr 1984) 52.253-1 Computer Generated Forms (Jan 1991)

Attachment Page PAGE 50 OF 81 91003123D0005 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (NOV 2021) (a) Definitions. As used in this clause— Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information. Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments. Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009). Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information ( 44 U.S.C. 3502). Safeguarding means measures or controls that are prescribed to protect information systems. (b) Safeguarding requirements and procedures. (1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls: (i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). (ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute. (iii) Verify and control/limit connections to and use of external information systems. (iv) Control information posted or processed on publicly accessible information systems. (v) Identify information system users, processes acting on behalf of users, or devices. (vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. (vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Attachment Page PAGE 51 OF 81 91003123D0005 (viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. (ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. (x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. (xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. (xii) Identify, report, and correct information and information system flaws in a timely manner. (xiii) Provide protection from malicious code at appropriate locations within organizational information systems. (xiv) Update malicious code protection mechanisms when new releases are available. (xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. (2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556. (c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system. (End of clause) 52.215-2 AUDIT AND RECORDS-NEGOTIATION (JUN 2020) (a) As used in this clause, "records" includes books, documents, accounting procedures and practices, and other data, regardless of type and regardless of whether such items are in written form, in the form of computer data, or in any other form. (b) Examination of costs. If this is a cost-reimbursement, incentive, time-and-materials, labor-hour, or price redeterminable contract, or any combination of these, the Contractor shall maintain and the Contracting Officer, or an authorized representative of the Contracting Officer, shall have the right to examine and audit all records and other evidence sufficient to reflect properly all costs claimed to have been incurred or anticipated to be incurred directly or indirectly in performance of this contract. This right of examination shall include inspection at all reasonable times of the Contractor’s plants, or parts of them, engaged in performing the contract.

Attachment Page PAGE 52 OF 81 91003123D0005 (c) Certified cost or pricing data. If the Contractor has been required to submit certified cost or pricing data in connection with any pricing action relating to this contract, the Contracting Officer, or an authorized representative of the Contracting Officer, in order to evaluate the accuracy, completeness, and currency of the certified cost or pricing data, shall have the right to examine and audit all of the Contractor’s records, including computations and projections, related to- (1) The proposal for the contract, subcontract, or modification; (2) The discussions conducted on the proposal(s), including those related to negotiating; (3) Pricing of the contract, subcontract, or modification; or (4) Performance of the contract, subcontract or modification. (d) Comptroller General.- (1) The Comptroller General of the United States, or an authorized representative, shall have access to and the right to examine any of the Contractor s directly pertinent records involving transactions related to this contract or a subcontract hereunder and to interview any current employee regarding such transactions. (2) This paragraph may not be construed to require the Contractor or subcontractor to create or maintain any record that the Contractor or subcontractor does not maintain in the ordinary course of business or pursuant to a provision of law. (e) Reports. If the Contractor is required to furnish cost, funding, or performance reports, the Contracting Officer or an authorized representative of the Contracting Officer shall have the right to examine and audit the supporting records and materials, for the purpose of evaluating- (1) The effectiveness of the Contractor’s policies and procedures to produce data compatible with the objectives of these reports; and (2) The data reported. (f) Availability. The Contractor shall make available at its office at all reasonable times the records, materials, and other evidence described in paragraphs (a), (b), (c), (d), and (e) of this clause, for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in subpart 4.7, Contractor Records Retention, of the Federal Acquisition Regulation (FAR), or for any longer period required by statute or by other clauses of this contract. In addition- (1) If this contract is completely or partially terminated, the Contractor shall make available the records relating to the work terminated until 3 years after any resulting final termination settlement; and (2) The Contractor shall make available records relating to appeals under the Disputes clause or to litigation or the settlement of claims arising under or relating to this contract until such appeals, litigation, or claims are finally resolved.

Attachment Page PAGE 53 OF 81 91003123D0005 (g) The Contractor shall insert a clause containing all the terms of this clause, including this paragraph (g), in all subcontracts under this contract that exceed the simplified acquisition threshold, as defined in FAR 2.101 on the date of subcontract award, and— (1) That are cost-reimbursement, incentive, time-and-materials, labor-hour, or price-redeterminable type or any combination of these; (2) For which certified cost or pricing data are required; or (3) That require the subcontractor to furnish reports as discussed in paragraph (e) of this clause. The clause may be altered only as necessary to identify properly the contracting parties and the Contracting Officer under the Government prime contract. (End of clause) 52.232-32 PERFORMANCE-BASED PAYMENTS (APR 2012) (a) Amount of payments and limitations on payments. Subject to such other limitations and conditions as are specified in this contract and this clause, the amount of payments and limitations on payments shall be specified in the contract’s description of the basis for payment. (b) Contractor request for performance-based payment. The Contractor may submit requests for payment of performance-based payments not more frequently than monthly, in a form and manner acceptable to the Contracting Officer. Unless otherwise authorized by the Contracting Officer, all performance-based payments in any period for which payment is being requested shall be included in a single request, appropriately itemized and totaled. The Contractor’s request shall contain the information and certification detailed in paragraphs (l) and (m) of this clause. (c) Approval and payment of requests. (1) The Contractor shall not be entitled to payment of a request for performance-based payment prior to successful accomplishment of the event or performance criterion for which payment is requested. The Contracting Officer shall determine whether the event or performance criterion for which payment is requested has been successfully accomplished in accordance with the terms of the contract. The Contracting Officer may, at any time, require the Contractor to substantiate the successful performance of any event or performance criterion which has been or is represented as being payable. (2) A payment under this performance-based payment clause is a contract financing payment under the Prompt Payment clause of this contract and not subject to the interest penalty provisions of the Prompt Payment Act. The designated payment office will pay approved requests on the 30th day after receipt of the request for performance- based payment by the designated payment office. However, the designated payment office is not required to provide payment if the Contracting Officer requires substantiation as provided in paragraph (c)(1) of this clause, or inquires into the status of an event or performance criterion, or into any of the conditions listed in paragraph (e) of this clause, or into the Contractor certification. The payment period will not begin until the Contracting Officer approves the request. (3) The approval by the Contracting Officer of a request for performance-based payment does not constitute an acceptance by the Government and does not excuse the Contractor from performance of obligations under this contract.

Attachment Page PAGE 54 OF 81 91003123D0005 (d) Liquidation of performance-based payments. (1) Performance-based finance amounts paid prior to payment for delivery of an item shall be liquidated by deducting a percentage or a designated dollar amount from the delivery payment. If the performance-based finance payments are on a delivery item basis, the liquidation amount for each such line item shall be the percent of that delivery item price that was previously paid under performance-based finance payments or the designated dollar amount. If the performance-based finance payments are on a whole contract basis, liquidation shall be by either predesignated liquidation amounts or a liquidation percentage. (2) If at any time the amount of payments under this contract exceeds any limitation in this contract, the Contractor shall repay to the Government the excess. Unless otherwise determined by the Contracting Officer, such excess shall be credited as a reduction in the unliquidated performance-based payment balance(s), after adjustment of invoice payments and balances for any retroactive price adjustments. (e) Reduction or suspension of performance-based payments. The Contracting Officer may reduce or suspend performance-based payments, liquidate performance-based payments by deduction from any payment under the contract, or take a combination of these actions after finding upon substantial evidence any of the following conditions: (1) The Contractor failed to comply with any material requirement of this contract (which includes paragraphs (h) and (i) of this clause). (2) Performance of this contract is endangered by the Contractor’s- (i) Failure to make progress; or (ii) Unsatisfactory financial condition. (3) The Contractor is delinquent in payment of any subcontractor or supplier under this contract in the ordinary course of business. (f) Title. (1) Title to the property described in this paragraph (f) shall vest in the Government. Vestiture shall be immediately upon the date of the first performance-based payment under this contract, for property acquired or produced before that date. Otherwise, vestiture shall occur when the property is or should have been allocable or properly chargeable to this contract. (2) "Property," as used in this clause, includes all of the following described items acquired or produced by the Contractor that are or should be allocable or properly chargeable to this contract under sound and generally accepted accounting principles and practices: (i) Parts, materials, inventories, and work in process; (ii) Special tooling and special test equipment to which the Government is to acquire title; (iii) Nondurable (i.e., noncapital) tools, jigs, dies, fixtures, molds, patterns, taps, gauges, test equipment and other similar manufacturing aids, title to which would not be obtained as special tooling under paragraph (f)(2)(ii) of this clause; and

Attachment Page PAGE 55 OF 81 91003123D0005 (iv) Drawings and technical data, to the extent the Contractor or subcontractors are required to deliver them to the Government by other clauses of this contract. (3) Although title to property is in the Government under this clause, other applicable clauses of this contract (e.g., the termination clauses) shall determine the handling and disposition of the property. (4) The Contractor may sell any scrap resulting from production under this contract, without requesting the Contracting Officer’s approval, provided that any significant reduction in the value of the property to which the Government has title under this clause is reported in writing to the Contracting Officer. (5) In order to acquire for its own use or dispose of property to which title is vested in the Government under this clause, the Contractor shall obtain the Contracting Officer’s advance approval of the action and the terms. If approved, the basis for payment (the events or performance criteria) to which the property is related shall be deemed to be not in compliance with the terms of the contract and not payable (if the property is part of or needed for performance), and the Contractor shall refund the related performance-based payments in accordance with paragraph (d) of this clause. (6) When the Contractor completes all of the obligations under this contract, including liquidation of all performance-based payments, title shall vest in the Contractor for all property (or the proceeds thereof) not- (i) Delivered to, and accepted by, the Government under this contract; or (ii) Incorporated in supplies delivered to, and accepted by, the Government under this contract and to which title is vested in the Government under this clause. (7) The terms of this contract concerning liability for Government-furnished property shall not apply to property to which the Government acquired title solely under this clause. (g) Risk of loss. Before delivery to and acceptance by the Government, the Contractor shall bear the risk of loss for property, the title to which vests in the Government under this clause, except to the extent the Government expressly assumes the risk. If any property is lost (see 45.101), the basis of payment (the events or performance criteria) to which the property is related shall be deemed to be not in compliance with the terms of the contract and not payable (if the property is part of or needed for performance), and the Contractor shall refund the related performance-based payments in accordance with paragraph (d) of this clause. (h) Records and controls. The Contractor shall maintain records and controls adequate for administration of this clause. The Contractor shall have no entitlement to performance-based payments during any time the Contractor’s records or controls are determined by the Contracting Officer to be inadequate for administration of this clause. (i) Reports and Government access. The Contractor shall promptly furnish reports, certificates, financial statements, and other pertinent information requested by the Contracting Officer for the administration of this clause and to determine that an event or other criterion prompting a financing payment has been successfully accomplished. The Contractor shall give the Government reasonable opportunity to examine and verify the Contractor’s records and to examine and verify the Contractor’s performance of this contract for administration of this clause. (j) Special terms regarding default. If this contract is terminated under the Default clause, (1) the Contractor shall, on demand, repay to the Government the amount of unliquidated performance-based payments, and (2) title shall vest in the Contractor, on full liquidation of all performance-based payments, for all property for which the Government elects not to require delivery under the Default clause of this contract. The Government shall be liable for no payment except as provided by the Default clause.

Attachment Page PAGE 56 OF 81 91003123D0005 (k) Reservation of rights. (1) No payment or vesting of title under this clause shall- (i) Excuse the Contractor from performance of obligations under this contract; or (ii) Constitute a waiver of any of the rights or remedies of the parties under the contract. (2) The Government’s rights and remedies under this clause- (i) Shall not be exclusive, but rather shall be in addition to any other rights and remedies provided by law or this contract; and (ii) Shall not be affected by delayed, partial, or omitted exercise of any right, remedy, power, or privilege, nor shall such exercise or any single exercise preclude or impair any further exercise under this clause or the exercise of any other right, power, or privilege of the Government. (l) Content of Contractor’s request for performance-based payment. The Contractor’s request for performance-based payment shall contain the following: (1) The name and address of the Contractor; (2) The date of the request for performance-based payment; (3) The contract number and/or other identifier of the contract or order under which the request is made; (4) Such information and documentation as is required by the contract’s description of the basis for payment; and (5) A certification by a Contractor official authorized to bind the Contractor, as specified in paragraph (m) of this clause. (m) Content of Contractor's certification. As required in paragraph (l)(5) of this clause, the Contractor shall make the following certification in each request for performance-based payment: I certify to the best of my knowledge and belief that- (1) This request for performance-based payment is true and correct; this request (and attachments) has been prepared from the books and records of the Contractor, in accordance with the contract and the instructions of the Contracting Officer; (2) (Except as reported in writing on __________), all payments to subcontractors and suppliers under this contract have been paid, or will be paid, currently, when due in the ordinary course of business; (3) There are no encumbrances (except as reported in writing on _________) against the property acquired or produced for, and allocated or properly chargeable to, the contract which would affect or impair the Government's title; (4) There has been no materially adverse change in the financial condition of the Contractor since the submission by the Contractor to the Government of the most recent written information dated _____________; and (5) After the making of this requested performance-based payment, the amount of all payments for each deliverable item for which performance-based payments have been requested will not exceed any limitation in the contract, and the amount of all payments under the contract will not exceed any limitation in the contract.

Attachment Page PAGE 57 OF 81 91003123D0005 (End of clause) 52.216-18 ORDERING (AUG 2020) (a) Any supplies and services to be furnished under the Contract shall be ordered by issuance of delivery orders or Task Orders by the individuals or activities designated in the Schedule. Such orders may be issued from _Contract award_________ through _the last day of the Contract’s period of performance___________. (b) All delivery orders or Task Orders are subject to the terms and conditions of the Contract. In the event of conflict between a delivery order or Task Order and the Contract, the contract shall control. (c) A delivery order or Task Order is considered "issued" when— (1) If sent by mail (includes transmittal by U.S. mail or private delivery service), the Government deposits the order in the mail; (2) If sent by fax, the Government transmits the order to the USDS Servicer 's fax number; or (3) If sent electronically, the Government either— (i) Posts a copy of the delivery order or task order to a Government document access system, and notice is sent to the USDS Servicer; or (ii) Distributes the delivery order or task order via email to the USDS Servicer 's email address. (d) Orders may be issued by methods other than those enumerated in this clause only if authorized in the Contract. (End of clause) 52.216-19 ORDER LIMITATIONS (OCT 1995) (a) Minimum order. When the Government requires supplies or services covered by the Contract in an amount of less than $500, the Government is not obligated to purchase, nor is the USDS Servicer obligated to furnish, those supplies or services under the Contract. (b) Maximum order The USDS Servicer is not obligated to honor- (1) Any order for a single item and/or service in excess of $7,000,000,000; (2) Any order for a combination of items and/or services in excess of $7,000,000,000; or (3) A series of orders from the same ordering office within 5 calendar days that together call for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section. (c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the USDS Servicer if that requirement exceeds the maximum-order limitations in paragraph (b) of this section. (d) Notwithstanding paragraphs (b) and (c) of this section, the USDS Servicer shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within 4 calendar days after issuance, with written notice stating the USDS Servicer’s intent not to ship the item (or items) called

Attachment Page PAGE 58 OF 81 91003123D0005 for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source. (End of clause) 52.216-22 INDEFINITE QUANTITY (OCT 1995) (a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by the Contract. (b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The USDS Servicer shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the "maximum." The Government shall order at least the quantity of supplies or services designated in the Schedule as the "minimum." (c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations. (d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the USDS Servicer within the time specified in the order. The Contract shall govern the USDS Servicer’s and Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the Contract’s effective period; provided, that the USDS Servicer shall not be required to make any deliveries under this contract after 365 calendar days after the last day of the Contract’s period of performance. (End of clause) 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999) The Government may require continued performance of any services within the limits and at the rates specified in the Contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The CO may exercise the option by written notice to the USDS Servicer within 30 calendar days of the end of the period of performance. (End of clause) 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) (a) The Government may extend the term of the Contract by written notice to the USDS Servicer within 20 calendar days of the term’s end; provided that the Government gives the USDS Servicer a preliminary written notice of its intent to extend at least 20 calendar days before the Contract expires. The preliminary notice does not commit the Government to an extension. (b) If the Government exercises this option, the extended Contract shall be considered to include this option clause. (c) The total duration of the Contract, including the exercise of any options under this clause, shall not exceed 10 years and 6 months. (End of clause)

Attachment Page PAGE 59 OF 81 91003123D0005 52.222-35 EQUAL OPPORTUNITY FOR VETERANS (JUN 2020) (a) Definitions. As used in this clause- "Active duty wartime or campaign badge veteran," "Armed Forces service medal veteran," "disabled veteran," "protected veteran," "qualified disabled veteran," and "recently separated veteran" have the meanings given at Federal Acquisition Regulation (FAR) 22.1301. (b) Equal opportunity clause. The Contractor shall abide by the requirements of the equal opportunity clause at 41 CFR 60-300.5(a), as of March 24, 2014. This clause prohibits discrimination against qualified protected veterans, and requires affirmative action by the Contractor to employ and advance in employment qualified protected veterans. (c) Subcontracts. The Contractor shall insert the terms of this clause in subcontracts valued at or above the threshold specified in FAR 22.1303(a) on the date of subcontract award, unless exempted by rules, regulations, or orders of the Secretary of Labor. The Contractor shall act as specified by the Director, Office of Federal Contract Compliance Programs, to enforce the terms, including action for noncompliance. Such necessary changes in language may be made as shall be appropriate to identify properly the parties and their undertakings. (End of clause) 52.222-36 EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES (JUN 2020) (a) Equal opportunity clause. The Contractor shall abide by the requirements of the equal opportunity clause at 41 CFR 60-741.5(a), as of March 24, 2014. This clause prohibits discrimination against qualified individuals on the basis of disability, and requires affirmative action by the Contractor to employ and advance in employment qualified individuals with disabilities. (b) Subcontracts. The Contractor shall include the terms of this clause in every subcontract or purchase order in excess of the threshold specified in Federal Acquisition Regulation (FAR) 22.1408(a) on the date of subcontract award, unless exempted by rules, regulations, or orders of the Secretary, so that such provisions will be binding upon each subcontractor or vendor. The Contractor shall act as specified by the Director, Office of Federal Contract Compliance Programs of the U.S. Department of Labor, to enforce the terms, including action for noncompliance. Such necessary changes in language may be made as shall be appropriate to identify properly the parties and their undertakings. (End of clause) 52.222-42 STATEMENT OF EQUIVALENT RATES FOR FEDERAL HIRES (MAY 2014) In compliance with the Service Contract Labor Standards statute and the regulations of the Secretary of Labor (29 CFR Part 4), this clause identifies the classes of service employees expected to be employed under the contract and states the wages and fringe benefits payable to each if they were employed by the contracting agency subject to the provisions of 5 U.S.C.5341 or 5 332. This Statement is for Information Only: It is not a Wage Determination

Attachment Page PAGE 60 OF 81 91003123D0005 Employee Class Monetary Wage-Fringe Benefits CSR - (Customer Service Representative) $43,056 Operations Manager $111,001 IT Specialist $84,493 Clerical Support $31,582 Call Center Supervisor $72,161 (End of clause) 52.232-19 AVAILABILITY OF FUNDS FOR THE NEXT FISCAL YEAR (APR 1984) – FOR USE AT TASK ORDER LEVEL Funds are not presently available for performance under this contract beyond __[Fill In]______. The Government’s obligation for performance of this contract beyond that date is contingent upon the availability of appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise for performance under this contract beyond [Fill in]_____, until funds are made available to the Contracting Officer for performance and until the Contractor receives notice of availability, to be confirmed in writing by the Contracting Officer. (End of clause) 52.232-32 PERFORMANCE-BASED PAYMENTS (APR 2012) (a) Amount of payments and limitations on payments. Subject to such other limitations and conditions as are specified in this contract and this clause, the amount of payments and limitations on payments shall be specified in the contract’s description of the basis for payment. (b) Contractor request for performance-based payment. The Contractor may submit requests for payment of performance-based payments not more frequently than monthly, in a form and manner acceptable to the Contracting Officer. Unless otherwise authorized by the Contracting Officer, all performance-based payments in any period for which payment is being requested shall be included in a single request, appropriately itemized and totaled. The Contractor’s request shall contain the information and certification detailed in paragraphs (l) and (m) of this clause. (c) Approval and payment of requests. (1) The Contractor shall not be entitled to payment of a request for performance-based payment prior to successful accomplishment of the event or performance criterion for which payment is requested. The Contracting Officer shall determine whether the event or performance criterion for which

Attachment Page PAGE 61 OF 81 91003123D0005 payment is requested has been successfully accomplished in accordance with the terms of the contract. The Contracting Officer may, at any time, require the Contractor to substantiate the successful performance of any event or performance criterion which has been or is represented as being payable. (2) A payment under this performance-based payment clause is a contract financing payment under the Prompt Payment clause of this contract and not subject to the interest penalty provisions of the Prompt Payment Act. The designated payment office will pay approved requests on the 30thcalendar day after receipt of the request for performance-based payment by the designated payment office. However, the designated payment office is not required to provide payment if the Contracting Officer requires substantiation as provided in paragraph (c)(1) of this clause, or inquires into the status of an event or performance criterion, or into any of the conditions listed in paragraph (e) of this clause, or into the Contractor certification. The payment period will not begin until the Contracting Officer approves the request. (3) The approval by the Contracting Officer of a request for performance-based payment does not constitute an acceptance by the Government and does not excuse the Contractor from performance of obligations under this contract. (d) Liquidation of performance-based payments. (1) Performance-based finance amounts paid prior to payment for delivery of an item shall be liquidated by deducting a percentage or a designated dollar amount from the delivery payment. If the performance-based finance payments are on a delivery item basis, the liquidation amount for each such line item shall be the percent of that delivery item price that was previously paid under performance-based finance payments or the designated dollar amount. If the performance-based finance payments are on a whole contract basis, liquidation shall be by either predesignated liquidation amounts or a liquidation percentage. (2) If at any time the amount of payments under this contract exceeds any limitation in this contract, the Contractor shall repay to the Government the excess. Unless otherwise determined by the Contracting Officer, such excess shall be credited as a reduction in the unliquidated performance-based payment balance(s), after adjustment of invoice payments and balances for any retroactive price adjustments. (e) Reduction or suspension of performance-based payments. The Contracting Officer may reduce or suspend performance-based payments, liquidate performance-based payments by deduction from any payment under the contract, or take a combination of these actions after finding upon substantial evidence any of the following conditions: (1) The Contractor failed to comply with any material requirement of this contract (which includes paragraphs (h) and (i) of this clause). (2) Performance of this contract is endangered by the Contractor’s- (i) Failure to make progress; or (ii) Unsatisfactory financial condition. (3) The Contractor is delinquent in payment of any subcontractor or supplier under this contract in the ordinary course of business. (f) Title. (1) Title to the property described in this paragraph (f) shall vest in the Government. Vestiture shall be immediately upon the date of the first performance-based payment under this contract, for property acquired or produced before that date. Otherwise, vestiture shall occur when the property is or should have been allocable or properly chargeable to this contract.

Attachment Page PAGE 62 OF 81 91003123D0005 (2) "Property," as used in this clause, includes all of the following described items acquired or produced by the Contractor that are or should be allocable or properly chargeable to this contract under sound and generally accepted accounting principles and practices: (i) Parts, materials, inventories, and work in process; (ii) Special tooling and special test equipment to which the Government is to acquire title; (iii) Nondurable (i.e., noncapital) tools, jigs, dies, fixtures, molds, patterns, taps, gauges, test equipment and other similar manufacturing aids, title to which would not be obtained as special tooling under paragraph (f)(2)(ii) of this clause; and (iv) Drawings and technical data, to the extent the Contractor or subcontractors are required to deliver them to the Government by other clauses of this contract. (3) Although title to property is in the Government under this clause, other applicable clauses of this contract (e.g., the termination clauses) shall determine the handling and disposition of the property. (4) The Contractor may sell any scrap resulting from production under this contract, without requesting the Contracting Officer’s approval, provided that any significant reduction in the value of the property to which the Government has title under this clause is reported in writing to the Contracting Officer. (5) In order to acquire for its own use or dispose of property to which title is vested in the Government under this clause, the Contractor shall obtain the Contracting Officer’s advance approval of the action and the terms. If approved, the basis for payment (the events or performance criteria) to which the property is related shall be deemed to be not in compliance with the terms of the contract and not payable (if the property is part of or needed for performance), and the Contractor shall refund the related performance-based payments in accordance with paragraph (d) of this clause. (6) When the Contractor completes all of the obligations under this contract, including liquidation of all performance-based payments, title shall vest in the Contractor for all property (or the proceeds thereof) not- (i) Delivered to, and accepted by, the Government under this contract; or (ii) Incorporated in supplies delivered to, and accepted by, the Government under this contract and to which title is vested in the Government under this clause. (7) The terms of this contract concerning liability for Government-furnished property shall not apply to property to which the Government acquired title solely under this clause. (g) Risk of loss. Before delivery to and acceptance by the Government, the Contractor shall bear the risk of loss for property, the title to which vests in the Government under this clause, except to the extent the Government expressly assumes the risk. If any property is lost (see 45.101), the basis of payment (the events or performance criteria) to which the property is related shall be deemed to be not in compliance with the terms of the contract and not payable (if the property is part of or needed for performance), and the Contractor shall refund the related performance-based payments in accordance with paragraph (d) of this clause. (h) Records and controls. The Contractor shall maintain records and controls adequate for administration of this clause. The Contractor shall have no entitlement to performance-based payments during any time the Contractor’s records or controls are determined by the Contracting Officer to be inadequate for administration of this clause.

Attachment Page PAGE 63 OF 81 91003123D0005 (i) Reports and Government access. The Contractor shall promptly furnish reports, certificates, financial statements, and other pertinent information requested by the Contracting Officer for the administration of this clause and to determine that an event or other criterion prompting a financing payment has been successfully accomplished. The Contractor shall give the Government reasonable opportunity to examine and verify the Contractor’s records and to examine and verify the Contractor’s performance of this contract for administration of this clause. (j) Special terms regarding default. If this contract is terminated under the Default clause, (1) the Contractor shall, on demand, repay to the Government the amount of unliquidated performance-based payments, and (2) title shall vest in the Contractor, on full liquidation of all performance-based payments, for all property for which the Government elects not to require delivery under the Default clause of this contract. The Government shall be liable for no payment except as provided by the Default clause. (k) Reservation of rights. (1) No payment or vesting of title under this clause shall- (i) Excuse the Contractor from performance of obligations under this contract; or (ii) Constitute a waiver of any of the rights or remedies of the parties under the contract. (2) The Government’s rights and remedies under this clause- (i) Shall not be exclusive, but rather shall be in addition to any other rights and remedies provided by law or this contract; and (ii) Shall not be affected by delayed, partial, or omitted exercise of any right, remedy, power, or privilege, nor shall such exercise or any single exercise preclude or impair any further exercise under this clause or the exercise of any other right, power, or privilege of the Government. (l) Content of Contractor’s request for performance-based payment. The Contractor’s request for performance-based payment shall contain the following: (1) The name and address of the Contractor; (2) The date of the request for performance-based payment; (3) The contract number and/or other identifier of the contract or order under which the request is made; (4) Such information and documentation as is required by the contract’s description of the basis for payment; and (5) A certification by a Contractor official authorized to bind the Contractor, as specified in paragraph (m) of this clause. (m) Content of Contractor's certification. As required in paragraph (l)(5) of this clause, the Contractor shall make the following certification in each request for performance-based payment: I certify to the best of my knowledge and belief that- (1) This request for performance-based payment is true and correct; this request (and attachments) has been prepared from the books and records of the Contractor, in accordance with the contract and the instructions of the Contracting Officer;

Attachment Page PAGE 64 OF 81 91003123D0005 (2) (Except as reported in writing on __________), all payments to subcontractors and suppliers under this contract have been paid, or will be paid, currently, when due in the ordinary course of business; (3) There are no encumbrances (except as reported in writing on _________) against the property acquired or produced for, and allocated or properly chargeable to, the contract which would affect or impair the Government's title; (4) There has been no materially adverse change in the financial condition of the Contractor since the submission by the Contractor to the Government of the most recent written information dated _____________; and (5) After the making of this requested performance-based payment, the amount of all payments for each deliverable item for which performance-based payments have been requested will not exceed any limitation in the contract, and the amount of all payments under the contract will not exceed any limitation in the contract. (End of clause) 52.239-70 ACCESS TO CONTRACTOR AND SUBCONTRACTOR INFORMATION SYSTEMS AND RELATED RESOURCES IN CARRYING OUT PRIVACY AND INFORMATION SECURITY INSPECTIONS (DEVIATION) (a) Privacy and security inspections. In accordance with the terms of this contract and as authorized by law, the Government carries out a program of privacy and information security inspections. Such inspections may be undertaken for various purposes, including but not limited to: (1) Examination of the security of federal information systems or of contractor information systems that process, store or transmit Government data, Government-related data, or controlled unclassified information, or which provide security protection for such systems (including vulnerability testing); (2) Information Technology security reviews; (3) Investigation and audit of administrative, technical, and physical safeguards taken to protect against threats and hazards to the integrity, confidentiality, and availability of Government data, Government-related data, or controlled unclassified information, or to the function of computer systems operated on behalf of the Government; (4) Review of contractor policies, procedures and practices for handling Government data, Government-related data, controlled unclassified information and other sensitive data; (5) Investigation of incidents involving actual or suspected improper releases of information (including cyber security incident response and reporting); (6) Conduct of forensic analyses, investigation of computer crime, or the preservation of evidence of computer crime; or (7) Review of the contractor’s performance for compliance with the terms and conditions in the contract governing privacy and the security of information and information systems. (b) Requirement to provide access to information systems and related resources. The contractor shall afford the Government, any Federal agency and its subcomponents including the Office of Inspector General, the Comptroller General of the United States, and their authorized third-party representatives, full and timely access to contractor information systems and related resources to the extent required to carry out privacy and information security inspections. The contractor resources to which Government inspectors shall have access shall include the contractor’s installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms) including full and complete certification and accreditation records, databases, and personnel used in the performance of this contract.

Attachment Page PAGE 65 OF 81 91003123D0005 In the case of security audits, access shall be provided to all systems, components, network devices, virtualized devices, and the like, for the purposes of evaluating the security postures and controls implemented to prevent unauthorized access, modification, or destruction to Government data and systems. In addition, the contractor shall provide the Government the following information upon request: (1) any or all user-ids; (2) any or all system and/or database administrator passwords used for the operation and maintenance of the system or environment, and (3) security credentials, encryption keys, security algorithms, and the like; to the extent needed to allow unfettered access to conduct a security audit or other privacy or information security inspection specified by the Government. The contractor shall also provide the Government access to all user passwords and all password files to the extent necessary to validate the contractor’s password policy. The contractor agrees to provide user ids and passwords regardless of whether the user is a Federal employee or not, so long as the user works in support of a Government contract, or may have access to Government data or Government related data. In addition to providing such access, the contractor agrees to fully cooperate with the Government in its conduct of privacy and information security inspections. That cooperation shall include, among other things, timely and complete production of data, metadata, information, and records, and making employees of the contractor available for interview upon request. Cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture. What constitutes “timely” access for purposes of compliance with this clause will depend on the circumstances surrounding the inspection being performed, the urgency of the matter under inspection, the procedures governing the inspection, logistical considerations, and other factors. In some cases, such as when investigating an on-going cyber security breach, access may be required within minutes of the Government’s request. In other cases, access provided by the contractor within a few days of a request may be acceptable. In the event of an information security incident, including, but not limited to, incidents involving the loss or potential loss of Personally Identifiable information in physical or electronic form, the contractor must respond (as required by other provisions of this contract, Departmental Directive OM: 6-107 “External Breach Notification Policy and Plan” and Handbook OCIO-14 “Handbook for Information Security Incident Response and Reporting Procedures” within specified time frames. Access to the contractor and subcontractor’s information systems under this clause shall be provided when, and as necessary, to meet any applicable information security incident response times. (c) Access to subcontractor information systems and related resources and clause flow-down. Access shall also be provided to information systems and related resources of subcontractors at any tier that are providing information technology which requires security of information technology, and/or is designing, developing, or operating a system of records using commercial information technology services or support services. The fact that an information system is owned or operated by a subcontractor shall not excuse the prime contractor from ensuring full and timely access to such information systems and related resources to the extent necessary to conduct privacy and information security inspections under this contract or as authorized by law. The contractor shall ensure that it retains operational and configurational control over any information system (whether operated by the contractor or a subcontractor) as needed to conduct privacy and information security inspections. The Contractor shall include the substance of this clause, including this paragraph (c), in all subcontracts, including subcontracts for commercial items. (d) Cost of compliance. The aforementioned access and cooperation shall be provided by the contractor at no additional cost to the Government. However, if a Government inspection unduly delays the contractor’s performance of the

Attachment Page PAGE 66 OF 81 91003123D0005 contract, the Contracting Officer may grant a contractor’s request for a non-compensable delay, as appropriate and provided the contractor submits information adequate to support the request. (e) Access to information systems where a cloud or a co-mingled data environment is used. When the contractor will perform all or part of the work using commercial cloud computing services (whether directly or through a subcontract), or where Government data, Government related data or controlled unclassified information will be comingled with non- Government data, the contractor shall ensure that appropriate measures and controls are in place to allow Government inspectors to search the information systems and access information needed to conduct required privacy and information security inspections. The contractor may choose to create (at no cost to the Government) a segregated data space where inspections may take place without undue interference with non-Government data. However, the fact that Government data and non-Government data is co-mingled in the contractor’s information system shall not excuse the contractor from affording the Government full and timely access and cooperation as needed to conduct privacy and information security inspections. The Government shall protect against the unauthorized use or release of information obtained from the Contractor (or derived from information obtained from the Contractor) under this clause that includes Contractor proprietary information. To the extent practicable, the Contractor shall identify and mark proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the Contractor proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released (f) Miscellaneous. The access obligations under this clause will survive the expiration or termination of this contract, and this term is not to be less than 3 years following the final disposition and close out of the contract. (g) Remedies for breach. A breach of the obligations or restrictions set forth in this clause may subject the Contractor to a Termination for Default, in addition to any other appropriate remedies under the contract. (h) Relation to other requirements. The requirements of this clause are in addition to those required by any other inspection or audit clause of this contract. To the extent that requirements imposed by Federal law, regulation, Executive Orders, Office of Management and Budget (OMB) guidance, or standards promulgated by the National Institute of Standards and Technology (NIST) are in direct and irreconcilable conflict with the requirements of this clause, those other requirements, standards, laws, or regulations shall take precedence. In conducting its security testing the Government intends to follow NIST Special Publication 800-115 Technical Guide to Information Security Testing and Assessment and other appropriate testing and assessment standards. Further, the Contractor agrees to negotiate in good faith rules of engagement and other supplementary agreements to govern specific privacy and information security inspections, with the goal of ensuring access necessary to conduct such inspections while protecting the contractor’s property and other interests. Any such rules of engagement and supplementary agreements are incorporated into this contract to the extent not inconsistent with the terms of this clause. (End of Clause) 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020) (a) The use in this Contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

Attachment Page PAGE 67 OF 81 91003123D0005 (b) The use in this Contract of any Department of Education Acquisition Regulation (EDAR) (48 CFR 34) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation. (End of clause) 2. Department of Education Acquisition Regulations (EDAR) Clauses A. EDAR Clauses Incorporated by Reference The Contract incorporates one or more clauses by reference in accordance with FAR clause 52.252-2 Clauses Incorporated By Reference (FEB 1998). The full text of a clause may be accessed electronically at this address: xxxxx://xxx0.xx.xxx/xxxxxx/xxxx/xxx/xxxxxxxx/xxxx.xxxx 3452.202-1 Definitions – Department of Education (MAR 2011) 3452.208-71 Printing (MAR 2011) 3452.208-72 Paperwork Reduction Act (MAR 2011) 3452.224–70 Release of information under the Freedom of Information Act (MAR 2011) 3452.227-70 Publication and Publicity (MAR 2011) 3452.227-71 Advertising of Awards (MAR 2011) 3452.227-72 Use and Non-Disclosure Agreement (MAR 2011) 3452.227-73 Limitations on the use or disclosure of Government-furnished information marked with restrictive legends 3452.237-71 Observance of Administrative Closures (MAR 2011) 3452.239-70 Internet Protocol Version 6 (MAR 2011) 3452.242-71 Notice to The Government of Delays (MAR 2011) 3452.242-73 Accessibility of Meetings, Conferences, and Seminars to Persons with Disabilities (MAR 2011) 3452.247-70 Foreign Travel (MAR 2011) B. 3452.201–70 Contracting Officer’s Representative (COR) (MAR 2011) (a) The COR is responsible for the technical aspects of the project, technical liaison with the USDS Servicer, and any other responsibilities that are specified in the Contract. These responsibilities include inspecting all deliverables, including reports, and recommending acceptance or rejection to the CO. (b) The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes that affect the Contract price, terms, or conditions. Any USDS Servicer requests for changes shall be submitted in writing directly to the CO or through the COR. No such changes shall be made without the written authorization of the CO. (c) The COR’s name and contact information: Xxxxxx Xxxxx Phone: 000-000-0000 Email: xxxxxx.xxxxx@xx.xxx (d) The COR may be changed by the Government at any time, but notification of the change, including the name and address of the successor COR, will be provided to the USDS Servicer by the CO in writing. (End of Clause)

Attachment Page PAGE 68 OF 81 91003123D0005 C. 3452.204-72 Contractor Security Vetting Requirements. (DEVIATION) (JUN 2021) (a) The USDS Servicer and its subcontractors shall comply with Department of Education personnel, cyber, privacy, security policy requirements as set forth in “Contractor Security Vetting Requirements” at xxxx://xxx.xx.xxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxx. (b) USDS Servicer employees who will have access to proprietary or sensitive ED information including “Controlled Unclassified Information” as defined in 32 CFR Part 2002.4(h), ED IT systems, contractor systems operated with ED data or interfacing with ED systems, ED facilities or space, and/or perform duties in a school or in a location where children are present, must undergo a personnel security screening and a receive favorable determination and are subject to reinvestigation as described in the “Contractor Vetting Security Requirements.” Compliance with the “Contractor Vetting Security Requirements,” as amended, is required. (c) The type of security investigation required to commence work on an ED contract is dictated by the position designation determination assigned by ED. All ED contractor positions are designated commensurate with their position risk/sensitivity, in accordance with Title 5 Code of Federal Regulations (5 CFR 731.106) and OPM’s Position Designation Tool (PDT) located at: xxxxx://xxx.xxxx.xxx/. The position designation determines the risk level and the corresponding level of background investigations required. (d) The USDS Servicer shall comply with all contractor position designations established by ED. (e) The following are the contractor employee positions required under the Contract and their designated risk levels: High Risk (HR): Positions on this contract that perform the duties of system administrator, database administrator, software/code developer, IT operations support manager, system technicians with administrative privileges, software test manager, quality assurance manager, configuration manager, system analyst, security manager, security analyst, any position with access to vulnerability scan/penetration testing results, customer services manager, project manager, program manager, policy officer, program executive, and any IT-related positions designated as key personnel are required to meet requirements for High Risk/Public Trust Contractor Positions Moderate Risk (MR): All other contractor positions. Low Risk (LR): Not applicable. (f) For performance-based contracts where ED has not identified required labor categories for contractor positions, ED considers the risk sensitivity of the services to be performed and the access to ED facilities and systems that will be required during performance, to determine the uniform contractor position risk level designation for all USDS Servicer employees who will be providing services under the Contract. The uniform contractor position risk level designation applicable to this performance-based contract is: Not Applicable (g) Only U.S. citizens will be eligible for employment on contracts requiring a Moderate Risk/Public Trust, High Risk/Public Trust, or a National Security designation. (h) Permanent resident aliens may be eligible for employment on contracts requiring Low Risk/ Public Trust access. (i) An approved waiver, in accordance with “Contractor Vetting Security Requirements” is required for any exception to the requirements of paragraphs (g) and (h) above.

Attachment Page PAGE 69 OF 81 91003123D0005 (j) The USDS Servicer shall- (1) Comply with the Principal Office (PO) processing requirements for personnel security screening, (2) Ensure that no USDS Servicer employee is placed in a higher risk position than for which he or she is approved, (3) Ensure USDS Servicer employees submit required security forms for reinvestigation in accordance with the timeframes set forth in the “Contractor Vetting Security Requirements,” (4) Report to the COR any information (i.e., personal conduct, criminal conduct, financial difficulties, etc.) that would raise a concern about the suitability of the USDS Servicer or whether a USDS Servicer employee’s continued employment would promote the efficiency of the service or violate the public trust, (5) Protect sensitive and Privacy Act-protected, including “Controlled Unclassified Information” as defined in 32 CFR Part 2002.4(h), from unauthorized access, use or misuse by its contractor employees, prevent unauthorized access by others, and report any instances of unauthorized access, use or misuse to the COR, (6) Report to the COR within two business days any removal of a USDS Servicer employee from a contract; or within one business day if removed for cause, (7) Upon the occurrence of any of the events listed under paragraph (b) of FAR Clause 52.204-9, Personal Identity Verification of Contractor Personnel, return a PIV ID to the COR within seven business days of the USDS Servicer employee’s departure; and (8) Report to the COR any change to job activities that could result in a change in the USDS Servicer employee’s position or the need for increased security access. (k) Failure to comply with any of the personnel security requirements, set forth in “Contractor Security Vetting Requirements” at xxxx://xxx.xx.xxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxx, may result in a termination of the Contract for default or cause. (End of Clause) D. 3452.209-71 Conflict of interest (MAR 2011) (a)(1) The USDS Servicer, subcontractor, employee, or consultant, has certified that, to the best of its knowledge and belief, there are no relevant facts or circumstances that could give rise to an organizational or personal conflict of interest ( see FAR Subpart 9.5 for organizational conflicts of interest) (or apparent conflict of interest) for the organization or any of its staff, and that the USDS Servicer, subcontractor, employee, or consultant has disclosed all such relevant information if such a conflict of interest appears to exist to a reasonable person with knowledge of the relevant facts (or if such a person would question the impartiality of the USDS Servicer, subcontractor, employee, or consultant). Conflicts may arise in the following situations: (i) Unequal access to information —A USDS Servicer, subcontractor, employee, or consultant has access to non-public information through its performance on a Government contract. (ii) Biased ground rules —A USDS Servicer, subcontractor, employee, or consultant has worked, in one Government contract, or program, on the basic structure or ground rules of another Government contract.

Attachment Page PAGE 70 OF 81 91003123D0005 (iii) Impaired objectivity —A USDS Servicer, subcontractor, employee, or consultant, or member of their immediate family (spouse, parent, or child) has financial or other interests that would impair, or give the appearance of impairing, impartial judgment in the evaluation of Government programs, in offering advice or recommendations to the Government, or in providing technical assistance or other services to recipients of Federal funds as part of its contractual responsibility. “Impaired objectivity” includes but is not limited to the following situations that would cause a reasonable person with knowledge of the relevant facts to question a person's objectivity: (A) Financial interests or reasonably foreseeable financial interests in or in connection with products, property, or services that may be purchased by an educational agency, a person, organization, or institution in the course of implementing any program administered by the Department; (B) Significant connections to teaching methodologies that might require or encourage the use of specific products, property, or services; or (C) Significant identification with pedagogical or philosophical viewpoints that might require or encourage the use of a specific curriculum, specific products, property, or services. (2) USDS Servicer must provide the disclosure described above on any actual or potential conflict (or apparent conflict of interest) of interest regardless of their opinion that such a conflict or potential conflict (or apparent conflict of interest) would not impair their objectivity. (3) In a case in which an actual or potential conflict (or apparent conflict of interest) is disclosed, the Department will take appropriate actions to eliminate or address the actual or potential conflict (or apparent conflict of interest), including but not limited to mitigating or neutralizing the conflict, when appropriate, through such means as ensuring a balance of views, disclosure with the appropriate disclaimers, or by restricting or modifying the work to be performed to avoid or reduce the conflict. In this clause, the term “potential conflict” means reasonably foreseeable conflict of interest. (b) The USDS Servicer, subcontractor, employee, or consultant agrees that if “impaired objectivity”, or an actual or potential conflict of interest (or apparent conflict of interest) is discovered after the award is made, it will make a full disclosure in writing to the CO. This disclosure shall include a description of actions that the USDS Servicer has taken or proposes to take, after consultation with the CO, to avoid, mitigate, or neutralize the actual or potential conflict (or apparent conflict of interest). (c) Remedies. The Government may terminate the Contract for convenience, in whole or in part, if it deems such termination necessary to avoid the appearance of a conflict of interest. If the USDS Servicer was aware of a potential conflict of interest prior to award or discovered an actual or potential conflict (or apparent conflict of interest) after award and did not disclose or misrepresented relevant information to the CO, the Government may terminate the Contract for default, or pursue such other remedies as may be permitted by law or the Contract. These remedies include imprisonment for up to five years for violation of 18 U.S.C. 1001 and fines of up to $5,000 for violation of 31 U.S.C. 3802. Further remedies include suspension or debarment from contracting with the Federal Government. The USDS Servicer may also be required to reimburse the Department for costs the Department incurs arising from activities related to conflicts of interest. An example of such costs would be those incurred in processing Freedom of Information Act requests related to a conflict of interest. (d) In cases where remedies short of termination have been applied, the USDS Servicer, subcontractor, employee, or consultant agrees to eliminate the organizational conflict of interest, or mitigate it to the satisfaction of the CO.

Attachment Page PAGE 71 OF 81 91003123D0005 (e) The USDS Servicer further agrees to insert in any subcontract or consultant agreement hereunder, provisions that conform substantially to the language of this clause, including specific mention of potential remedies and this paragraph (e). (End of Clause) E. EDAR 3452.239-72 Department Security Requirements (DEVIATION) (JUN 2021) (a) The USDS Servicer and its subcontractors shall, at all times, maintain compliance with the most current version of Department of Education requirements as set forth in “Security and Privacy Requirements for Information Technology Procurements” posted at xxxx://xxx.xx.xxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxx. (b) Performance of the Contract will [X] will not [ ] involve access to Department IT systems and/or contractor systems operated with Department data or interfacing with Department systems. For contracts that require access to Department IT systems and/or contractor systems operated with Department data or interfacing with Department systems, the Information Security Categorization applicable to each security objective has been determined to be: Confidentiality: [ ] Low [X] Moderate [ ] High (Contracting Officer to complete) Integrity: [ ] Low [X] Moderate [ ] High (Contracting Officer to complete) Availability: [ ] Low [X] Moderate [ ] High (Contracting Officer to complete) Overall Risk Level: [ ] Low [X] Moderate [ ] High (Contracting Officer to complete) (c) Performance of the Contract [X] does involve [ ] does not involve Personally Identifiable information (PII) or “Controlled Unclassified Information” as defined in 32 CFR Part 2002.4(h). The Confidentiality Impact Level of such information has been determined to be: [ ] Not Applicable [ ] Low [X] Moderate [ ] High. (d) Failure to comply with Department of Education Security and Privacy Requirements for Information Technology Procurements may result in a termination of the Contract for default or cause. (End of Clause) F. 3452.232-72 Limitation of Government’s Obligation – For use in Task Orders Sufficient funds are not presently available to cover the total price of the CLIN(s) listed in paragraph (l) below. The CLIN(s) identified in paragraph (l) below are incrementally funded to cover the identified period of performance. Additional funds are intended to be allotted to the applicable CLIN(s) by contract modification up to and including the full price of the entire period of performance. This notwithstanding, the Government will not be obligated to pay the USDS Servicer for amounts payable in excess of the amount actually allotted, nor will the USDS Servicer be obligated to perform in excess of such amount. (a) The CLIN(s) in paragraph (l) of this clause is/are incrementally funded. Paragraph (l) also lists the allotment amount presently available for payment and allotted to the CLIN(s), inclusive of any termination costs for the Government’s convenience, and the allotment schedule which provides the last date of USDS Servicer

Attachment Page PAGE 72 OF 81 91003123D0005 performance for which it is estimated the allotted amount will cover. The parties contemplate that the Government may allot additional funds incrementally to the applicable CLIN(s) under the Contract, up to the full price specified in the Contract. The USDS Servicer agrees to perform work under the applicable CLIN(s) up to the point at which the total amount paid and payable by the Government under the Contract for the applicable CLIN(s), including estimated costs in the event of termination of those CLIN(s) for the Government’s convenience, approximates the total amount currently allotted to such CLIN(s). (b) Notwithstanding the dates specified in the allotment schedule in paragraph (l) of this clause, the USDS Servicer shall notify the CO in writing at least thirty (30) days prior to the date when, in the USDS Servicer’s best judgment, the work will reach the point at which the total amount payable by the Government, including any cost for termination for the Government’s convenience, will approximate 75 percent of the total amount then allotted to the Contract for performance of the applicable CLIN(s). The notification will state (1) the estimated date when that point will be reached and (2) an estimate of additional funding, if any, needed to continue performance of applicable CLIN(s) up to the date in paragraph (l) of this clause, or to a mutually agreed upon substitute date. (c) If, after notification pursuant to paragraph (b) of this clause, additional funds are not allotted by the date identified in paragraph (l), the date identified in the USDS Servicer’s notification, or by an agreed substitute date, upon the USDS Servicer’s written request, the CO may terminate for the Government’s convenience any CLIN(s) for which additional funds have not been allotted. If the USDS Servicer estimates that the funds available will allow it to continue to discharge its obligations beyond that date, it may specify a later date in its request to terminate the applicable CLIN(s), and the CO may terminate such CLIN(s) on that later date. In no event is the Contractor authorized to continue work on those CLIN(s) beyond the time when the amount payable, to include costs of termination for the Government’s convenience, is equal to the funds allotted. (d) If, solely by reason of failure of the Government to allot additional funds, by the dates indicated in paragraph (l) of this clause, in amounts sufficient for timely performance of the CLIN(s) identified in paragraph (l) of this clause, the USDS Servicer incurs additional costs or is delayed in the performance of the work under the Contract and if additional funds are allotted, the USDS Servicer may request an equitable adjustment to the price or prices (including appropriate target, billing, and ceiling prices, where applicable) of the applicable CLIN(s), or in the time of delivery, or both, by written request to the CO with sufficient documentation to support such equitable adjustment. Failure to agree to any such equitable adjustment hereunder will be a dispute concerning a question of fact within the meaning of the clause entitled “Disputes.” Notwithstanding anything to the contrary herein, in no event will an equitable adjustment under this paragraph (d) be due to the USDS Servicer for costs that arise from or relate to the USDS Servicer’s breach of the notification obligations in paragraph (b) of this clause. (e) Except as required by other provisions of the Contract, specifically citing and stated to be an exception to this clause- (1) The Government is not obligated to pay for goods or services, to include reimbursement of costs for termination for the Government’s convenience, in excess of the total amount allotted by the Government to the CLIN(s) identified in paragraph (l) of this clause; and (2) The USDS Servicer is not authorized to continue performance of the CLIN(s) identified in paragraph (l) of this clause in excess of the amount allotted by the Government to the applicable CLIN(s).

Attachment Page PAGE 73 OF 81 91003123D0005 (3) As used in this clause, the total amount payable by the Government in the event of termination of applicable CLIN(s) for convenience includes reasonable costs, profit, and termination settlement costs for those item(s). (f) No communication or representation in any form other than in writing from the C O shall affect the amount allotted by the Government to the Contract and applicable CLIN(s). The Government is not obligated to reimburse the USDS Servicer for any costs in excess of the total amount allotted by the Government to the applicable CLIN(s), whether incurred during the course of the Contract or as a result of termination. (g) The Government may at any time prior to termination allot additional funds for the performance of the CLIN(s) identified in paragraph (l) of this clause. (h) When additional funds are allotted for continued performance of the CLIN(s) identified in paragraph (l) of this clause, the parties will agree as to the period of contract performance that will be covered by the funds. The provisions of this clause will apply in like manner to the additional allotted funds and agreed substitute date, and the Contract will be modified accordingly. (i) The termination provisions of this clause do not limit the rights of the Government to terminate the Contract, in whole or in part, for cause in the event of any breach or default by the USDS Servicer. The provisions of this clause are limited to the work and allotment of funds for the CLIN(s) set forth in paragraph (l) of this clause. This clause no longer applies once the Contract is fully funded except with regard to the rights or obligations of the parties concerning equitable adjustments negotiated under paragraph (d) of this clause. (j) Nothing in this clause affects the right of the Government to terminate the Contract, in whole or in part, for convenience or cause. (k) Nothing in this clause shall be construed as authorization of voluntary services whose acceptance is otherwise prohibited under 31 U.S.C. 1342. (l) Incremental funds are allotted to the CLIN(s) under the Contract as follows: CLIN Amount Allotted Last Date of Performance

Attachment Page PAGE 74 OF 81 91003123D0005 (End of clause) 3. Additional Clauses AT-RISK BORROWER PERFORMANCE INCENTIVE Task Orders may include when awarded or through modification a performance incentive for At-Risk Borrowers associated with performance under CLIN 0003 Contact Center and Back-Office Processing Operation & Maintenance. Funding for the performance incentive shall be held in a separate CLIN to be designated on the Task Order which may as detailed in the Task Order either be for the initial period of the performance incentive or for multiple periods of the performance incentive. The additional terms of the performance incentive and an example of how to calculate the achieved performance incentive amount are in the following incorporated contract attachments: Attachment 20 – At Risk Borrower Incentive (Attachment 20) and Attachment 20a – At Risk Borrower Incentive Calculator (Attachment 20a). SERVICE LEVEL AGREEMENTS & OBJECTIVES PERFORMANCE INCENTIVE Task Orders containing CLIN 3 Contact Center and Back-Office Processing Operation & Maintenance are subject to a Service Level Agreement & Service Level Objective performance incentive as further described in Attachment 8 Service Level Methodology Performance Metrics (Attachment 8) and Attachment 9 SLA and Future Borrower Allocation Calculator (Attachment 9). ECONOMIC PRICE ADJUSTMENT FSA will apply a standard escalation methodology to pricing established under the Contract. The following escalation methodology is based upon multiple indexes and rates from sources like the Bureau of Labor Statistics (BLS) which are applicable to different CLINs to account for significant inflation and/or deflation: CLIN Cost Indexes & Published Rates 1, 2, 4, 5 7, 8, 9, 10, 11, & 12 BLS Employment Cost Index (ECI) for Total compensation for Private industry workers in Service-providing; management, professional, and related occupations, 12- month percent change -- Series ID (CIU201S000100000A (B) Not seasonally adjusted) 3 & 6 (Scanned Documents & Alternative Format Documents) BLS Employment Cost Index (ECI) for Total compensation for Private industry workers in Service occupations, 12- month percent change – Series ID (CIU2010000300000A (B) Not seasonally adjusted) 6 Envelops (Letter(s)) Sent US Postal Service (USPS) Rate for First-Class Mail Commercial Letters (Weight Not Over 1 oz for Automation 5-Digit) & BLS Producer Price Index (PPI) for Paper, except newsprint, xxxxx-Primary products, not seasonally adjusted – Series ID (PCU322121322121P) In the event of the change to any of these indexes or the USPS category is no longer published or is changed, FSA will unilaterally update the ones affected to one FSA determines most appropriate and modify the Contract.

Attachment Page PAGE 75 OF 81 91003123D0005 In June of the Contract’s second year of performance Federal Student Aid will review the indexes and published rates listed in the table above to determine whether an economic price adjustment in accordance with this clause is applicable. The indexes in the above table from the BLS will be from the BLS website xxx.xxx.xxx. The USPS rate for comparison will be as found on the xxxxx://xx.xxxx.xxx/ website in the Price List effective on the 1st day of June for First-Class Mail Commercial Letters (Weight Not Over 1 oz for Automation 5-Digit). When any of the indexes or the USPS rate cited in in the table increases or decreases more than three and a half (3.5) percent starting in the second year of the Contract’s period of performance, the Government will adjust the established pricing in the affected CLINs by the amount above 3.5% up to a ceiling of 3%. The adjustment ceiling of 3% would be reached if the increase or decrease is 6.5%. The escalation amount for the CLINs using indexes excluding CLIN 6 will equal the amount that the listed 12-month percent change shown for the series for quarter 4 (Qtr4) of the prior calendar year is over 3.5% up to the ceiling of 3%. For example, if the 12-month percent change is 5% then the escalation amount would be 1.5% and if it was negative 5% the escalation would be negative 1.5%. All adjusted prices shall be rounded to four decimal places. For example, if after calculating the adjustment the price is $1.155549 then it would be rounded down to $1.1555 or if the price is $1.155562 then it would be rounded up to $1.1556. For escalation of CLIN 6 Envelops (Letter(s)) Sent price the escalation is calculated by determining first the percentage change for the USPS rate from the prior year’s rate and the percentage change for the BLS PPI from the prior year’s February index to the current year’s index rate (final or preliminary) and the amount each is greater than 3.5% in the positive or negative direction up to the ceiling of 3%. Second the prior year’s USPS rate is subtracted from the Letters/Envelops Sent price and the resultant price is adjusted by the percentage that the PPI is greater than 3.5% up to the ceiling of 3%. Third the USPS prior year rate is adjusted by the percentage that is greater than 3.5% up to the ceiling of 3% and the resultant amount is added back into the price from the second step to calculate the adjusted price. The adjusted price is then rounded if necessary to four decimal places. An example of the escalation for CLIN 6’s Envelopes (Letter(s)) Sent price using the methodology above where the postal rate has gone up five percent. For the example the Envelops (Letter(s)) Sent price is $0.64, the percentage change for the BLS PPI is 6%, and the USPS rates are $0.426 for the prior year and $.0447 for the current year. Calculation: First Step: USPS Percentage Change: ($0.426 - $0.447) / $0.426 = .05 or 5% Amount Greater than 3.5%: 5% - 3.5% = 1.5% BLS PPI Percentage Change: 6% Amount greater than 3.5%: 6% - 3.5% = 2.5% Second Step: $0.64 - $0.426 = $0.214 $0.214 X 1.025 = $0.219350 Third Step: $0.426 X 1.015 = $0.43239 $0.219350 + $0.43239 = $0.651740 then rounded down to four decimal places equals $0.6517 Total adjusted Envelops (Letter(s)) Sent price would be $0.6517.

Attachment Page PAGE 76 OF 81 91003123D0005 The USPS rate used for the prior year’s rate for the first calculation in June of the Contract’s second ordering year period is the rate set in the Contract at time of award effective that month as follows: USPS Rate at time of Contract award: _____$0.471________ For the CLINs that met the criteria for adjustment, the CLIN prices are adjusted for the current ordering period and all the subsequent remaining base and option period ordering CLINs. The Contract will be unilaterally modified to update the CLIN pricing and rates adjusted by this clause in Section B of the Contract. Task Orders will be unilaterally modified to update the rates that are fixed price with economic price adjustment that meet this clause’s criteria for adjustment. Firm-fixed prices within Task Orders are not subject to this clause and will not be adjusted. Adjusted Contract and Task Order prices or rates will be effective beginning the first of September of the same year. (End of Clause) 4. Additional Terms COMMON PRICING ADJUSTMENTS FOR CLAUSE CHANGES TO WAGES The common pricing established under the Contract shall be adjusted across all USDS IDIQ Contract holders in the event of required changes to USDS Servicer pricing resulting from either clauses 52.222-55 Minimum Wages For Contractor Workers Under Executive Order 14026 (JAN 2022) or 52.222-43 Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) or any other clause in the Contract with similar mandatory contract price changes. USDS Servicer shall provide supporting documentation as required by the clauses. The Contract shall be modified unilaterally increasing the affected CLIN’s common prices. (End of Term) FSA 19-2 SUBCONTRACT REPORTING AND ACHIEVEMENTS (APR 2014) The USDS Servicer shall submit timely and accurate subcontract reporting, which will be a factor used in assessing contractor past performance. In addition, contractors are advised that achievements related to subcontracting plans can and may be used as part of responsibility determinations under future procurements. (End of Clause) FSA 32-3, Alternate 1 - Invoice and Contract Financing Requests Submission – Invoice Processing Platform (December 2017) (a) Payments shall be rendered in accordance with the identified payment schedule(s). (b) The USDS Servicer shall submit invoices electronically in the web-based system, Invoice Processing Platform (IPP) that can be accessed at: xxxx://xxx.xxx.xxx/. All submitted invoices must be accompanied by supporting documentation in accordance with the Contract’s terms and conditions. The supporting documentation shall be submitted in the following formats: Adobe Acrobat (pdf), Microsoft Word (doc), Pictures (jpeg), Microsoft Excel (excel), or Microsoft Outlook message (msg). The invoice processing platform limits 25 attachments per invoice at 10 MB per attachment.

Attachment Page PAGE 77 OF 81 91003123D0005 (c) If the supporting documentation contains Personally Identifiable Information (PII) or Sensitive Unclassified Information, this information shall be sent to the COR, encrypted and/or password protected by email external to the IPP system. (d) Request for Financing Payment – financing payments are not subject to the Prompt Payment Act. Failure to identify the invoice as a request for financing may result in delay of payment. Invoices that are identified as Requests for Finance Payments shall only include the finance payments listed in the Contract. Requests for finance payments shall not be combined with other types of invoice payments. (e) If the USDS Servicer does not have an IPP account that was established by either the Department of Education or another Government agency, the USDS Servicer will need to go to xxx.XXX.xxx and select “Vendors Enroll Now” and complete enrollment. (f) The USDS Servicer must ensure that the “Accounts Receivable POC” Section of its XXX registration is accurate and up-to-date. (g) Upon completion of enrollment and within ten (10) business days of the USDS Servicer entering or updating the “Accounts Receivable POC” information within the USDS Servicer’s XXX registration, the USDS Servicer’s Designated Primary Administrator will receive an email from the IPP Customer Support Team containing the USDS Servicer’s Designated Primary Administrator’s IPP username. Within 24 hours of receiving the initial email, the USDS Servicer’s Designated Primary Administrator will receive a second email containing their IPP password. Once both emails have been received, the USDS Servicer’s Designated Primary Administrator must log into IPP and complete the registration process. (h) The USDS Servicer’s Designated Primary Administrator will be authorized to further designate other administrators under USDS Servicer’s IPP account who may submit invoices on behalf of the USDS Servicer. (i) In the event that an invoice is rejected in IPP, the USDS Servicer shall make the necessary corrections and resubmit the invoice by means of IPP. Any questions, concerns, or issues regarding the use of IPP should be directed to IPP Customer Support Team, as identified at xxxx://xxx.xxx.xxx/ (End of Clause) FSA 37-3 DISRUPTION OF MISSION CRITICAL CONTRACTOR SYSTEM OR OTHER SERVICES (Sep 2012) (a) Definition. As used in this clause— (1) Mission Critical Contractor System or Other Services - are defined as a system or other services that have a material impact on the accomplishment of the Federal Student Aid mission. (b) The USDS Servicer is required to coordinate all changes to mission critical USDS Servicer’s systems or other services used to implement Federal Student Aid IT operations and services with the individual(s) identified in (c) at least five business days prior to the changes, absent exigent circumstances. Emergency changes require immediate notification of the individual(s) identified in (c) as soon as the charge requirement is known, but prior to the change. If the continuity of such systems or services is disrupted as a consequence of the USDS Servicer’s failure to adequately coordinate these changes with FSA, the USDS Servicer may be subject to contractual remedies available to the Government pursuant to the terms of the Contract or as authorized by law.

Attachment Page PAGE 78 OF 81 91003123D0005 (c) The USDS Servicer shall contact the following individuals to coordinate all changes to mission critical USDS Servicer systems or services. System Owner: Xxxxxx Xxxx Email: xxxxxx.xxxx@xx.xxx Phone: (000) 000-0000 The notice shall be sent to the CO as well. (End of Clause) FSA 39-3 FSA Section 508 and Electronic and Information Technology Accessibility Standards Compliance (September, 2016) (a) Members of the public with disabilities that are seeking information or services from the USDS Servicer shall have access to and use of information and data maintained and provided to the public under the Contract that is comparable to the access to and use of information and data by members of the public who are not individuals with disabilities. The USDS Servicer’s Website, and any documents or other forms of communication that may be viewed by the public via the Website, shall remain current with manners of assistive technology utilized by the public for accessing such information. In order to maintain an accessible Website and documents or other forms of communication, the USDS Servicer shall ensure that the public can access required information in a variety of ways, which do not have to rely on a single sense or ability of the user. FSA 39-4 Remedies for Contractor’s Violation of System Security Requirements If Personally Identifiable Information (PII) is improperly disclosed, released to or accessed by an unauthorized system(s) or individual(s), or is otherwise compromised (collectively referred to as PII Breach), or if the USDS Servicer has knowledge of a potential PII Breach, in addition to the requirements elsewhere under the Contract, the USDS Servicer shall immediately: a. take all reasonable measures necessary to implement security safeguards to prevent further compromise of PII, improper disclosure of PII, or release of or access of PII by unauthorized systems or individuals. b. mitigate any potential harm suffered by those individuals whose PII may have been exposed in a PII Breach (Affected Individuals) once a PII Breach is confirmed and notices to Affected Individuals are sent as provided under the Contract. Such mitigation shall include, at a minimum, data breach protection services (Data Protection Services), including identity theft and credit protection, to all Affected Individuals for a period not less than 18 months from the date of discovery of the improper disclosure. Data Protection Services must include: i. one year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; ii. data breach analysis; iii. fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; iv. three years of identity theft insurance with up to $1,000,000.00 coverage at $0 deductible; and

Attachment Page PAGE 79 OF 81 91003123D0005 v. reimbursement of necessary legal expenses that Affected Individuals may incur to repair falsified or damaged credit records, histories, or financial affairs. (End of Term) FSA 45-1 SPECIAL CONTRACT REQUIREMENTS FOR GOVERNMENT FURNISHED PROPERTY – TWO FACTOR AUTHENTICATION TOKENS (TFA) (JUN 2015) In addition to the requirements of FAR 52.245-1(b) - Government Property, the USDS Servicer shall: a) Ensure the USDS Servicer’s Government Property Manager or designee shall sign a distribution letter provide by the CO upon receipt of Government Property; b) Comply with instructions on how to register the tokens using the Federal Student Aid Two Factor Authentication Token For FSA User Handout distributed with the tokens; c) Seek immediate assistance with any challenges encountered with FSA CITRIX and TFA and immediately report any security or other incidents by telephone or email to the helpdesk at: 0-000-000-0000 or xx.xxxxxxxx.xxxxxxx@xx.xxx and; d) Provide a Property Management Plan to the CO within 5 business days of receipt of the Government Furnished Property. Among other requirement required under FAR 52.245-1(b) the Property Management Plan must contain at minimum the following: * Description on how the USDS Servicer will establish and maintain an auditable record of the token assignment to its employees by individual name and token Serial Number (AVT+9 digits); * Method by which the USDS Servicer shall ensure that the serial number label on the back of each token remains legible and secure to the device. * Security and management process for the physical devices as well as changes in assignment. e) Upon written notification from the CO, the USDS Servicer shall affirm its understanding and compliance with the Government’s requirement for quarterly re-certification of user access and token activation. In the event of any reported security breach, the Government shall immediately disable or deactivate USDS Servicer access to its network without prior notice. f) Soft Tokens can be used instead of hard tokens. The soft token is an app that runs on the user’s mobile device. After downloading and registering the free Symantec VIP Access app on a phone or tablet, a user simply opens the app and an One-Time Password (OTP) is automatically generated similar to a hard token. Use of a soft token is optional, however users who have a compatible mobile device are encouraged to transition to a soft token. There is no requirement to maintain property records on soft tokens. g) Contact Information. For additional information on TFA or the use of a soft token, contact the TFA Support Center at 800/330-5947, option 2 (TDD/TTY 800/511-5806) or by email at XXXXxxxxxx@xx.xxx. (End of Clause)

Attachment Page PAGE 80 OF 81 91003123D0005 III. List of Documents, Exhibits, and Other Attachments J. List of Attachments Attachment Title 01 01 - Business Operations Servicing Requirements 01a 01a – Business Operations Deliverables Table 02 02 - Financial Technical Requirements 02a 02a – Financial Deliverables Table 03 03 - IT Requirements Repository 04 04 – IT Deliverable Repository 04a 04a – IT Deliverable Table 05 05 - Business Change Management Plan 06 06 – LMM Process Guide 06a 06a - LMM Reference Files Repository 07 07 - Initial Authorization to Operate Timeline Actions 08 08 - Service Level Methodology Performance Metrics 09 09 - SLA and Future Borrower Allocation Calculator 10 10 - FSA Brand Style and FSA Design System 2021 11 11 - FSA Servicer Brand Guidelines 12 12 - FSA Writing Style Guide 2021 13* Reserved 14* Reserved 15* Reserved 16* Reserved 17* Reserved 18* Reserved 19 19 - Technology Standards and Products Guide 20 20 – At Risk Borrower Incentive 20a 20a – At Risk Borrower Incentive Calculator 21 21 – Future Borrower Allocation Methodology 22 22 – Progressive Fixed-Priced Calculator 23* Reserved 24* Reserved 25* Reserved 26 26 - FSA 39-5 Monthly Vendor Reporting Deliverable Template (AUG 2018) 27* Reserved 28 28 – Wage Determination Repository * Attachments removed and number reserved at award.

SCHEDULE Continued ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT Contracting Officer: Xxxxxxx McClam, 000-000-0000, xxxxxxx.xxxxxx@xx.xxx Primary Contracting Officer Representative: Xxxxxx Xxxxx, 000-000-0000, xxxxxx.xxxxx@xx.xxx Alternate Contracting Officer Representative(s): None Primary Technical Point of Contact: None Alternate Technical Point(s) of Contact: None Base Ordering Period 1 0001 Period of Performance: Five years from the date of award. Dates will be input at the time of contract award. All CLINs and associated prices for this ordering period are contained within Section B of the Contract. Period of Performance: 04/25/2023 to 04/24/2028 0.00 EA 0.00 0.00 Option Ordering Period 2 OPT 0002 Period of Performance: 2 years Dates will be input at the time of contract award. All CLINs and associated prices for this ordering period are contained within Section B of the Contract. Period of Performance: 04/25/2028 to 04/24/2030 0.00 EA 0.00 0.00 Option Ordering Period 3 OPT 0003 Period of Performance: 2 years Dates will be input at the time of contract award. All CLINs and associated prices for this ordering period are contained within Section B of the Contract. Period of Performance: 04/25/2030 to 04/24/2032 0.00 EA 0.00 0.00 Option Ordering Period 4 OPT 0004 Period of Performance: 1 years Dates will be input at the time of contract award. All CLINs and associated prices for this ordering period are contained within Section B of the Contract. Period of Performance: 04/25/2032 to 04/24/2033 0.00 EA 0.00 0.00 PAGE 81 OF 81 91003123D0005