Continuation_of_the_1449_EL.docx

B. CONTINUATION OF SF 1449

B.1 Continuation of Block 16-ADMINISTERED BY

B.1.1 CONTRACTING OFFICER (JAN 2012)

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; issue task orders against the contract; make final decisions on disputed deductions from contract payments for nonperformance, or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to the Contracting Officer’s Representative (COR). All delegated duties will be specified in writing by a COR Appointment and Delegation Notice.

[End of Text]

B.2. DESIGNATION OF CONTRACTING OFFICER’S REPRESENTATIVE (JAN 2012)

The Contracting Officer hereby designates as the Contracting Officer’s Representative (COR):

[To Be Determined]

The COR shall be responsible for administering the performance of work under this contract. In no event, however, will any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the Government unless formalized by proper contractual documents executed by the Contracting Officer prior to completion of the contract.

The Contracting Officer shall be informed as soon as possible of any actions or inactions by the Contractor or the Government which will change the required delivery or completion times stated in the contract, and the contract shall be modified accordingly.

On all matters that pertain to the contract terms, the contractor shall communicate with the Contracting Officer. Whenever, in the opinion of the Contractor, the COR requests effort outside the scope of the contract, the contractor shall so advise the COR. If the COR persists and there still exists a disagreement as to proper contractual coverage, the Contracting Officer shall be notified immediately, preferably in writing if time permits. Proceeding with work without proper contractual coverage may result in nonpayment or necessitate submittal of a contract claim.

The COR shall be responsible for initiating the Contractor Performance Assessment Report (CPAR) for awards over the simplified acquisition threshold of $150K to document contractor’s performance during the period of performance 14 days after completion of services or delivery of goods.

[End of Text]

B. 3. UNAUTHORIZED PERFORMANCE OF SERVICES (MAY 2011)

(a) No personal services shall be performed under this contract. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

(b) The Contractor shall not perform any inherently Government actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work.

(c) The Contractor shall ensure that all of its employees working on this contract are informed of the substance of this clause. Nothing in this clause shall limit the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this clause shall be included in all subcontracts at any tier.

[End of Text]

B. 4. CONTINUATION OF BLOCK 18B-INVOICES

ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS— [April 2013]

INVOICE PROCESSING PLATFORM (IPP)

Effective May 6, 2013, payment requests must be submitted electronically through the U.S. Department of the Treasury’s Invoice Processing Platform (IPP).

“Payment Request” means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions—Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. Contractor assistance with enrollment, Use rids and Passwords can be obtained by contacting the IPP Helpdesk via email at IPP Customer Support Desk at 1-866-973-3131 or IPPCustomerSupport@fms.treas.gov. For all other IPP issues, please contact: National Finance Center’s Controller Operations Division (COD) Helpdesk at 1-877-243-3072 or COD.HELP@usda.gov.

(End of text)

B.5. PERIOD OF PERFORMANCE (FEB 2007)

The total period of performance shall not exceed 60 months. The periods of performance are defined as follows:

* Note: Period of Performance dates are estimated.

B.7. PRICE SCHEDULE

14 September 2018 thru 13 September 2019

Nitrogen Generator Maintenance Services

Nitrogen Generator Maintenance Services

14 September 2020 thru 13 September 2021

C. CONTRACT CLAUSES

C. 1. 52.212-4 CONTRACT TERMS AND CONDITIONS-COMMERCIAL ITEMS (SEPT 2013)

C.1.1. ADDENDUM TO FAR 52.212.4

The non-FAR Part 12 discretionary FAR and LOCAL clauses included herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

C. 2. CLAUSES INCORPORATED BY REFERENCE

52.204-9 Personal Identity Verification of Contractor Personnel (JAN 2011) 52.222-48 Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment—Requirements.

52.242-15 Stop Work Order (AUG 1989) 52.252-1 Solicitation Provisions Incorporated by Reference (FEB 1998)

C.3. CLAUSES INCORPORATED BY FULL TEXT

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days before contract expires.

(End of clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

a) The Government may extend the term of this contract by written notice to the Contractor within 30 days of contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 18 months.

(End of clause)

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

https://www.acquisition.gov/?q=browsefar

(End of clause)

C.4. AGAR CLAUSES

C.4.1. AGAR 452.224-70 CONFIDENTIALITY OF INFORMATION (FEB 1988)

(a) Confidential information, as used in this clause, means --

(1) Information or data of a personal nature, proprietary about individual or (2) information or data submitted by or pertaining to an organization.

(b) In addition to the types of confidential information described in (a)(1) and (2) above, information which might require special consideration with regard to the timing of its disclosure may derive from studies or research, during which public disclosure of primarily invalidated findings could create an erroneous conclusion which might threaten public health or safety if acted upon.

(c) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the "Disputes" clause.

(d) If it is established that information to be utilized under this contract is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) Confidential information, as defined in (a) (1) and (2) above shall not be disclosed without the prior written consent of the individual, institution or organization.

(f) Written advance notice of at least 45 days will be provided to the Contracting Officer of the Contractor's intent to release findings of studies or research, which have the possibility of adverse effects on the public or the Federal agency, as described in (b) above. If the Contracting Officer does not pose any objections in writing within the 45 day period, the contractor may proceed with disclosure. Disagreements not resolved by the Contractor and Contracting Officer will be settled pursuant to the "Disputes" clause.

(g) Whenever the Contractor is uncertain with regard to the proper handling of material under the contract, or if the material in question is subject to the Privacy Act or is confidential information subject to the provisions of this clause, the Contractor shall obtain a written determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication.

(h) The provisions of paragraph (e) of this clause shall not apply when the information is subject to conflicting or overlapping provisions in other Federal, State or local laws.

(End of Clause)

C. 5. AGAR 452.237-75 RESTRICTIONS AGAINST DISCLOSURE (FEB 1988)

(a) The Contractor agrees, in the performance of this contract, to keep all information contained in source documents or other media furnished by the Government in the strictest confidence. The Contractor also agrees not to publish or otherwise divulge such information in whole or in part in any manner or form, or to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the Contractor's possession, to those employees needing such information to perform the work provided herein, i.e., on a "need to know" basis. The Contractor agrees to immediately notify in writing, the Contracting Officer, named herein, in the event that the Contractor determines or has reason to suspect a breach of this requirement.

(b) The Contractor agrees not to disclose any information concerning the work under this contract to any persons or individual unless prior written approval is obtained from the Contracting Officer. The Contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

(End of Clause)

C.6. AGAR 452.246-70 INSPECTION AND ACCEPTANCE (FEB 1988)

(End of Clause)

C. 7. FOOD SAFETY AND INSPECTION SERVICE (FSIS) AGENCY CLAUSES

C.6.1. RELEASE OF SENSITIVE INFORMATION (JUNE 2013)

Mark the title page with the following legend:

This proposal or document includes sensitive information that FSIS shall not disclose outside the Agency and its service providers that support management activities and administrative functions. To gain access to this sensitive information, a service provider’s contract must contain the clause entitled "Access to Sensitive Information". Consistent with this clause, the service provider shall not duplicate, use, or disclose the information in whole or in part for any purpose other than to perform the services specified in its contract. This restriction does not limit the Government's right to use this information if it is obtained from another source without restriction. The information subject to this restriction is contained in pages [insert page numbers or other identification of pages].

Mark each page of sensitive information the Contractor wishes to restrict with the following legend:

Use or disclosure of sensitive information contained on this page is subject to the restriction on the title page of this proposal or document.

(2) The Contracting Officer shall evaluate the facts supporting any claim that particular information is “sensitive.” This evaluation shall consider the time and resources necessary to protect the information in accordance with the detailed safeguards mandated by the clause entitled "Access to Sensitive Information". However, unless the Contracting Officer decides, with the advice of Legal Counsel, that reasonable grounds exist to challenge the Contractor’s claim that particular information is sensitive; FSIS and its service providers and their employees shall comply with all of the safeguards contained in paragraph (d) of this clause.

(d) To receive access to sensitive information needed to assist FSIS in accomplishing management activities and administrative functions, the service provider must be operating under a contract that contains the clause entitled "Access to Sensitive Information". This clause obligates the service provider to do the following:

(1) Comply with all specified procedures and obligations, including the Organizational Conflicts of Interest Avoidance Plan, which the contract has incorporated as a compliance document.

(2) Utilize any sensitive information coming into its possession only for the purpose of performing the services specified in its contract.

(3) Safeguard sensitive information coming into its possession from unauthorized use and disclosure.

(4) Allow access to sensitive information only to those employees that need it to perform services under its contract.

(5) Preclude access and disclosure of sensitive information to persons and entities outside of the service provider’s organization.

(6) Train employees who may require access to sensitive information about their obligations to utilize it only to perform the services specified in its contract and to safeguard it from unauthorized use and disclosure.

(7) Obtain a written affirmation from each employee that he/she has received and will comply with training on the authorized uses and mandatory protections of sensitive information needed in performing this contract.

(8) Administer a monitoring process to ensure that employees comply with all reasonable security procedures, report any breaches to the Contracting Officer, and implement any necessary corrective actions.

(e) This clause does not affect FSIS's responsibilities under the Freedom of Information Act.

(f) The Contractor shall insert this clause, suitably modified to reflect the relationship of the parties, in all subcontracts that may require the furnishing of sensitive information to assure any service provider that requires access to sensitive information follows the steps outlined in this clause, including this paragraph (f), to protect the information from unauthorized use or disclosure.

[End of text]

C.8. REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFEROR (FEB 2007)

In accordance with FAR 15.204-1(b), the completed and submitted “Representations, Certifications, and Other Statements of Offeror”, are incorporated by reference in this resulting contract.

[End of text]

C. 9 SECTION 508 COMPLIANCE ACCESSIBILITY OF ELECTRONIC AND INFORMATION TECHNOLOGY (MAR 2015)

(a) This SOW/PWS or TO is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Electronic and Information Technology (EIT), the EIT must allow Federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to Federal employees and individuals of the public without disabilities.

(b) The EIT accessibility standards at 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board ("Access Board") and apply to contracts and task/delivery orders, awarded under indefinite quantity contracts on or after June 25, 2001.

(c) Each Electronic and Information Technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194), as specified in the contract, as a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

1. Cancellation of the contract, delivery or task order, purchase or line item without termination liabilities; or

2. In the case of custom Electronic and Information Technology (EIT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant EIT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

(d) The contractor must ensure that all EIT products that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.

(e) For every EIT product or service accepted under this contact by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date; whichever shall occur first.

Section 508 Compliance for Communications The vendor shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents, the SOW shall take precedence.

Rehabilitation Act, Section 508 Accessibility Standards

1. 29 U.S.C. 794d (Rehabilitation Act as amended)

2. 36 CFR 1194 (508 Standards)

3. www.access-board.gov/sec508/508standards.htm (508 standards)

4. FAR 39.2 (Section 508)

5. USDA Standards, policies and procedures (Section 508) In addition, all contract deliverables are subject to these 508 standards as applicable.

Regardless of format, all Web content or communications materials produced, including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the content or communications material identified in this SOW:

36 CFR Part 1194.21 a - l 36 CFR Part 1194.22 a - p 36 CFR Part 1194.31 a - f 36 CFR Part 1194.41 a – c The contractor shall provide a completed Section 508 Product Assessment Template and the contractor shall state exactly how proposed EIT deliverable(s) meet or does not meet the applicable standards.

The following Section 508 provisions apply for software development material identified in this SOW, PWS, or TO:

For software development, software applications, and operating systems the Contractor/Developer/Vendor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For web-based applications (intranet, internet information and applications, 16 rules), the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.22 (a – p) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For Telecommunication products the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.23 (a – k) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For video and multimedia applications (including training), the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.24 (a – e) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For self-contained, closed products, the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.25 (a – j) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For Desktop and portable computers, the Contractor shall comply with the standards, policies, and procedures below:

Rehabilitation Act, Section 508, Accessibility Standards

(1) 29 U.S.C. 794d (Rehabilitation Act as amended)

(2) 36 CFR 1194 (508 Standards) 36 CFR Part 1194.26(a – d) 36 CFR Part 1194.31 (a – f) 36 CFR Part 1194.41 (a – c)

(3) www.access-board.gov/sec508/508standards.htm (508 Standards)

(4) FAR 39.2 (Section 508)

(5) USDA Standards, policies and procedures (Section 508)

For the purposes of this SOW, the Contractor shall review the complete system for 508 compliance and correct all deficiencies or document exceptions as required by departmental and federal requirements.

All Electronic Information Technology that is subject to the 36 CFR 1194 standards will have a Section 508 acceptance test and Section 508 will be validated upon acceptance.

All maintenance for Electronic Information Technology that requires upgrades, modifications, installations and purchases will adhere to the Section 508 Standards and 36 CFR 1194.

POST-AWARD ADMINISTRATION AND MONITORING OF SECTION 508 COMPLIANCE ACCESSIBILITY OF ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY (MAY 2015) The Section 508 Plan/Remediation Plan and any modifications to the Plan must be submitted for approval to the Office of the Chief Information Officer (OCIO) or the Department OCIO when the proposed requirement is for, or includes, the acquisition of EIT products and services that are subject to Section 508 conformance provisions as required by departmental and federal requirements. Any exception must be documented and approved by OCIO.

ADDITIONAL PRIVACY ACT REQUIREMENTS (JAN 2012)

For contracts that are awarded with Federal Acquisition Regulations (FAR) and Agriculture Acquisition Regulations (AGAR) concerning the Privacy Act, Food Safety and Inspection Service (FSIS) requests that contractor employees complete Privacy Act training. Contractor employees may take the course at any place of their choice. An acceptable course is one that covers the basics of the Privacy Act. A certificate that shows completion of training is to be provided to the Contracting Officer’s Representative (COR).

Contractor employees are to complete at least one Privacy Act training course within thirty days after contract award and at least once each year thereafter. USDA offers free Privacy Act training for contractor employees that have a current contract. Contractor employees must be assigned to a current contract that is subject to the Privacy Act to receive the free training. The Contracting Officer (CO) and/or COR can be contacted for further information on procedures for Privacy Act training.

COMPLIANCE WITH INTERNET PROTOCOL VERSION (IPv6) (JULY 2010) This contract involves the acquisition of Information Technology (IT) that uses Internet Protocol (IP) Technology. In order to comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6) issued on August 2, 2005, the contractor agrees that: (1) all deliverables that involve IT that uses IP (products, services, software, etc.) will comply with IPv6 standards set forth in the USGv6 Profile (NIST Special Publication 500-267) and interoperate with both IPv4 and IPv6 systems and products; and (2) it has IPv6 technical support for such deliverables. If the contractor plans to offer a deliverable that involves IT that is not compliant with these requirements, the contractor agrees to obtain the Contracting Officer’s approval before starting work on the deliverable.

COMMONLY ACCEPTED SECURITY CONFIGURATIONS FOR WINDOWS OPERATING SYSTEMS (MARCH 2015) By delivering applications under this contract/order, the Contractor certifies that such applications are fully functional and operate correctly as intended on systems using the United States Government Configuration Baseline (USGCB), formerly called Federal Desktop Core Configuration (FDCC) and comply with E-authentication and other federal mandates such as LincPass. This includes Internet Explorer 10, Mozilla FireFox 35.0.1 and higher configured to operate on Windows 7, windows 2008, windows 2012 and higher, as well as Androids and IOS mobile devices.

The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology should also use the Windows Installer Service for installation of the default program files directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

RULES OF BEHAVIOR FOR PRIVILEGED USERS (FEB 2006)

Food Safety and Inspection Service (FSIS) Information Technology (IT) Security Rules of Behavior for Privileged Users Version 1.0 February 10, 2006 Introduction Purpose The intent of the FSIS Rules of Behavior (ROB) for Privileged Users is to recognize the additional responsibilities associated with special access to, and/or privileges associated with, computer resources within the Department or its offices/bureaus/components. The ROB for Privileged Users are in addition to the Computer System User IT Security General ROB to which all DOJ users are subject. The identification of these responsibilities originates in OMB A-130 and is included in the FSIS IT Security Standards.

“Privileged User” defined:

A privileged user is someone authorized access to departmental/office/bureau/component computer resources when that access provides the capability to alter the properties, behavior or control of the information system/network. It includes, but is not limited to, any of the following types of access:

a. “Super user,” “root,” or equivalent access, such as access to the control functions of the information system/network, administration of user accounts, etc.

b. Access to change control parameters (e.g., routing tables, path priorities, addresses) of routers, multiplexers, and other key information system/network equipment or software.

c. Ability and authority to control and change program files, and other users’ access to data.

d. Direct access to operating system level functions (also called unmediated access) that would permit system controls to be bypassed or changed.

e. Access and authority for installing, configuring, monitoring or troubleshooting the security monitoring functions of information systems/networks (e.g., network/system analyzers; intrusion detection software; firewalls) or in performance of cyber/network operations.

Who is covered by these rules?

These rules extend to all privileged users (FSIS employees and contractors) who use any computing resources that support the mission and functions of the Food Safety and Inspection Service. All privileged users will review and provide signature or electronic verification to these rules annually, or upon change of assigned responsibilities, whichever occurs first.

What are the penalties for Noncompliance?

Compliance with these rules will be enforced through sanctions commensurate with the level of infraction. Actions may include a verbal or written warning, removal of system access for a specific period of time, reassignment to other duties, or termination, depending on the severity of the violation. In addition, activities that lead to or cause the disclosure of classified information may result in criminal prosecution under the U.S. Code, Title 18, Section 798, and other applicable statutes.

Responsibilities Complying Privileged Users will:

1. Understand that it is their responsibility to comply with all security measures necessary to prevent the unauthorized disclosure, modification, or destruction of information; follow appropriate system security policies, guidelines and procedures

2. Agree to the FSIS General Rules of Behavior.

3. Minimize exposure and risk by utilizing a separate account to perform privileged functions from general user functions.

4. Not establish or reset any account utilizing the same password for more than one account, and will not provide the user name and password at the same time through the same medium.

5. Grant read or write authority no higher than is granted to him/her (e.g., a component level user administrator shall not assign department level access to another user administrator).

6. Access application programs only for the purpose of creating or maintaining files.

7. Not make modifications to system configurations that could impact availability or security of the system without the approval of the Change Control Board and/or change management process.

8. Not perform general user activities under the same account (user name and password) due to the security requirement for separation of duties.

9. Protect all passwords from unauthorized disclosure.

10. Not share accounts with another privileged user.

11. Make the system available at any time to the SAISO for inspection and review of audit logs.

12. Grant only read-only access to audit files to the Security Auditor; grant access to general system information only if a need-to-know is established and authorization is received from the ISSO.

13. Make the computer(s) available for periodic reviews of the security configuration by independent testers

14. Make changes to system configuration as directed to meet Vulnerability and Patch Management requirements.

15. Immediately record and report any security incidents to the ISSPM.

I acknowledge and understand the responsibilities associated with my role as a Privileged User, and I will comply with the February 10, 2006, Privileged User Rules of Behavior. The Statement of acknowledgement can be provided via email.

Typed Name

1. Contractor shall complete the Assessment and Accreditation process in accordance with the USDA Risk Management Framework Process Guide to ensure the appropriate security controls and configuration baselines are implemented commensurate with the information system's categorization. (SSP Control RA-01)

2. All contractor personnel who will access USDA information or information systems shall sign a nondisclosure agreement. (SSP Control CA-01)

3. Contractor shall comply with the following: (SSP Control SA-04)

a. Security functional requirements.

b. Security strength requirements.

c. Security assurance requirements.

d. Security-related documentation requirements.

e. Requirements for protecting security-related documentation.

f. Description of the information system development environment and environment in which the system is intended to operate.

g. Acceptance criteria.

4. Contractors shall provide information describing the functional properties of the security controls to be employed within the information system, information system components, or information system services in sufficient detail to permit analysis and testing of the controls. (SSP Control SA-04(1))

5. Contractor shall provide design and implementation information for the security controls to be employed that includes: NIST-compliant, security-relevant external system interfaces, high-level design, low-level design, source code, hardware schematics and /or other design/implementation information, as determined by the Information System Security Program Manager (ISSPM), at a level of detail determined by the agency and/or agency policy. (SSP Control SA-04(2))

6. The developer of the information system, system component, or information system service shall identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use. (SSP Control SA-04(9))

7. The contractor shall provide administrator documentation for the information system, system component, or information system service that describes: (SSP Control SA-05)

1. Secure configuration, installation, and operation of the system, component, or service;

2. Effective use and maintenance of security functions/mechanisms; and

3. Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;

7. Administrator documentation shall be provided in hard copy and also made available for placement on a shared network drive that is accessible by the (authorized) user community. (SSP Control SA-05)

8. User documentation shall be provided for the information system, system component, or information system service that describes: (SSP Control SA-05)

1. User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;

2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and

3. User responsibilities in maintaining the security of the system, component, or service;

9. User guides and SOPs shall be provided in hard copy and are also made available for placement on a shared network drive that is accessible by the (authorized) user community. These user documents shall describe user-accessible security features/functions and how to effectively use those security features/functions; as well as methods for user interaction with the system, which enables individuals to use the system in a more secure manner. User documents shall also describe responsibilities in maintaining the security of the information and the system. (SSP Control SA-05)

10. The contractor shall notify the Government when such documentation is either unavailable or nonexistent and notifies the ISSO/ISSPM in response. (SSP Control SA-05)

11. The developer of the information system, system component, or information system service shall: (SSP Control SA-11)

a. Create and implement a security assessment plan.

b. Perform unit, integration, system, and/or regression testing/evaluation at agency-approved level of depth and coverage consistent with the USDA Risk Management Framework (RMF).

c. Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation.

d. Implement a verifiable flaw remediation process.

e. Correct flaws identified during security testing/evaluation.

INFORMATION TECHNOLOGY SYSTEMS SECURITY (SEPT 2013)

The activities covered under by this contract shall require the Contractor’s access to Federal Automated Information System or systems, as well as the implementation of new systems. The Offeror’s proposal must include:

(1) A detailed outline (commensurate with the size and complexity of the Statement of Work) of its present and proposed information technology systems security program. The response must demonstrate that it complies with the security requirements of the SOW, the Federal Information Security Management Act of 2002 (FISMA, Public Law 107-347, 44 U.S.C. 3531-3536); Office of Management and Budget (OMB) Circular A-130, Appendix III “Security of Federal Automated Information Systems” (http://www.whitehouse.gov/omb/circulars_a130_a130appendix_iii) and an acknowledgement of its understanding of the security requirements of the SOW.

(2) A signed copy of the USDA FSIS IT Rules of Behavior shall be included with the Offeror’s proposal.

INFORMATION TECHNOLOGY SYSTEMS SECURITY CONTRACT REQUIREMENTS (JAN 2012)

The contractor shall establish and implement appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The contractor shall comply with IT systems security and/or privacy specifications set forth in FSIS and USDA directives, policy, and procedures; the Computer Security Act of 1987; Office of Management and Budget (OMB) Circular A-130; and the Federal Information Security Management Act of 2002 (FISMA).

Pursuant to FSIS policy, the contractor shall be responsible for assuring that each contractor employee who requires routine unaccompanied physical access to a Federally-controlled facility and/or unaccompanied access to a Federally-controlled information system, including an FSIS-issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten (10) calendar days of an individual starting work on this contract.”

ACCESS TO SENSITIVE INFORMATION (FEB 2007)

[End of Text] C. 10. 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JAN 2018)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004)(Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

X__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

_X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (JAN 2011) of 52.219-4.

__ (13) [Reserved] __ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644).

__ (ii) Alternate I…