RFP 12760421Q0122_ V2- Final 092621.pdf

RFP 12760421Q0122 - eSafety

Procurement Sensitive

SECTION II: PRICING SCHEDULE

2.1 Base Year: December XX, 2021 through December XX, 2022

ITEM SUPPLIES OR SERVICES QTY. UNIT UNIT PRICE TOTAL PRICE

0001 Hosting Costs (GovCloud) 12 MO $ $ 0002 Maintenance (GovCloud) 12 MO $ $ 0003 Vendor Operations and Maintenance 12 MO $ $ 0004 Incident/Claim Reporting (Monthly) 12 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 0005 Full User Licenses 2000 EA 0006 Claim Administrator Licenses 30 EA 0007 *Travel (TBD) NTE $ $ 0008 Configuration and Training(TBD) 12 MO $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may be added to support this effort. Contractor will not be reimbursed for local travel.

TOTAL COST: BASE YEAR_________________________

Contract Type: Firm-fixed Price Estimated Start Date: December XX, 2021 Estimated Completion Date: December XX, 2022

The contractor shall provide all necessary qualified personnel, services, supervision and all other items necessary to accomplish this task as defined in the Statement of Objectives.

**THIS BASE YEAR MAY HAVE SOME TIME ALOTTED TO TRANSITION TIME.

Cox, Christopher - FS How does this base year look if the potential bridge is going to be through Jan 2023? Will this base period only be transition? If the contractor is going to take over all operations within the base period what becomes of the bridge contract? Would want to make sure that we are not going to T4C the bridge and that there is a coordinated timeline between the two.

2.2 Option Year 1: December XX, 2022 through December XX, 2023

1001 Hosting Costs (GovCloud) 12 MO $ $ 1002 Maintenance (GovCloud) 12 MO $ $ 1003 Vendor Operations and Maintenance 12 MO $ $ 1004 Incident/Claim Reporting (Monthly) 12 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 1005 Full User Licenses 2000 EA 1006 Claim Administrator Licenses 30 EA 1007 *Travel (TBD) NTE $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may be added to support this effort. Contractor will not be reimbursed for local travel.

TOTAL COST: OPTION YEAR 1_________________________

Contract Type: Firm-fixed Price Estimated Start Date: December XX, 2022 Estimated Completion Date: December XX, 2023 The contractor shall provide all necessary qualified personnel, services, supervision and all other items necessary to accomplish this task as defined in the Statement of Objectives.

Procurement Sensitive

2.3 Option Year 2: December XX, 2023 – December XX, 2024

ITEM SUPPLIES OR SERVICES QTY. UNIT UNIT PRICE TOTAL PRICE

2001 Hosting Costs (GovCloud) 12 MO $ $ 2002 Maintenance (GovCloud) 12 MO $ $ 2003 Vendor Operations and Maintenance 12 MO $ $ 2004 Incident/Claim Reporting (Monthly) 12 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 2005 Full User Licenses 2000 EA 2006 Claim Administrator Licenses 30 EA 2007 *Travel (TBD) NTE $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may

TOTAL COST: OPTION YEAR 2_________________________

Estimated Start Date: December XX, 2023 Estimated Completion Date: December XX, 2024

The contractor shall provide all necessary qualified personnel, services, supervision and all other items

Procurement Sensitive

2.4 Option Year 3: December XX, 2024 – December XX, 2025

ITEM SUPPLIES OR SERVICES QTY. UNIT UNIT PRICE TOTAL PRICE

2001 Hosting Costs (GovCloud) 12 MO $ $ 2002 Maintenance (GovCloud) 12 MO $ $ 2003 Vendor Operations and Maintenance 12 MO $ $ 2004 Incident/Claim Reporting (Monthly) 12 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 2005 Full User Licenses 2000 EA 2006 Claim Administrator Licenses 30 EA 2007 *Travel (TBD) NTE $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may

TOTAL COST: OPTION YEAR 3_________________________

Estimated Start Date: December XX, 2024 Estimated Completion Date: December XX, 2025

The contractor shall provide all necessary qualified personnel, services, supervision and all other items

2.5 Option Year 4: December XX, 2025 – December XX, 2026

2001 Hosting Costs (GovCloud) 12 MO $ $ 2002 Maintenance (GovCloud) 12 MO $ $ 2003 Vendor Operations and Maintenance 12 MO $ $ 2004 Incident/Claim Reporting (Monthly) 12 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 2005 Full User Licenses 2000 EA 2006 Claim Administrator Licenses 30 EA 2007 *Travel (TBD) NTE $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may

TOTAL COST: OPTION YEAR 4_________________________

Estimated Start Date: December XX, 2025 Estimated Completion Date: December XX, 2026

The contractor shall provide all necessary qualified personnel, services, supervision and all other items

Procurement Sensitive

2.6 FAR 52.217-8: Option to Extend Services December XX, 2026 – May XX, 2027

ITEM SUPPLIES OR SERVICES QTY. UNIT UNIT PRICE TOTAL PRICE

2001 Hosting Costs (GovCloud) 6 MO $ $ 2002 Maintenance (GovCloud) 6 MO $ $ 2003 Vendor Operations and Maintenance 6 MO $ $ 2004 Incident/Claim Reporting (Monthly) 6 MO $ $ -Tier 1 up to 10K New Incidents/claims per Year

- Unlimited Users 2005 Full User Licenses 2000 EA 2006 Claim Administrator Licenses 30 EA 2007 *Travel (TBD) NTE $ $

*Travel costs are reimbursed based upon actual expenses incurred. NOTE: Travel CLIN is an unfunded firm-fixed price CLIN, costs to be determined at time of travel. No fee allowed. Travel will be reimbursed in accordance with the Federal Travel Regulations (FTR). All travel shall be approved by the Contracting Officer prior to the Vendor incurring costs. At the Government’s discretion additional travel funding may

TOTAL COST: OPTION PERIOD (NTE 6 months)_________________________

Estimated Start Date: December XX, 2025 Estimated Completion Date: May XX, 2026

The contractor shall provide all necessary qualified personnel, services, supervision and all other items

SECTION III: CONTRACT ADMINISTRATION DATA

3.1 Contracting Officer (CO)

The CO for this requirement is currently identified as follows:

Melissa Paquin-Leon USDA Forest Service WO AQM IT Support Branch 3900 Masthead ST. NE Albuquerque, NM 87109 Phone: (505) 563-7241 E-mail: melissa.paquin-leon@usda.gov

The CO has the overall responsibility for the administration of this contract. The Contracting Officer, without delegation, is authorized to take actions on behalf of the Government to amend, modify or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules.

However, the Contracting Officer may delegate certain other responsibilities to his/her authorized representative.

3.2 Contracting Officer’s Representative (COR)

The COR for this requirement is currently identified as follows:

Monica Moore USDA Forest Service Human Resources Management Business Enterprise Solutions 4000 Masthead St. NE Albuquerque, NM 87109 Phone: (505) 205-4757 E-mail: monica.moore@usda.gov

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

• Assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance;

• Maintain written and oral communications with the Contractor concerning technical aspects of the contract;

• Issue written interpretations of technical requirements to the Contracting Officer, including applicable Government drawings, designs, specifications;

• Monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; and

• Coordinate availability of government furnished property, and provide site entry of Contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or mailto:melissa.paquin-leon@usda.gov

Procurement Sensitive changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract or order.

3.3 Invoicing

Invoice Processing Platform (IPP) is added to this order. The Invoice submission is changed to require the use of the online Invoice Processing Platform (IPP). The Invoice Processing Platform (IPP) is a Web-based system that more efficiently manages government invoicing from purchase order (PO) through payment notification. IPP is a secure online platform outside federal agencies' core financial systems that centralizes all invoice transaction data and documents in one place. The U.S. Department of the Treasury's Financial Management Service offers IPP, and the Federal Reserve Bank of Boston manages its implementation and operations. The National Finance Center (NFC) began notifying USDA existing contractors that IPP online registration is required for doing business with USDA. Visit https://www.ipp.gov/ to enroll. The Contractor must now submit invoices online via the Invoice Processing Platform (IPP) for existing and new awards. See Contract for specific invoice processing instructions. Approximately 25% of the Contractor’s final invoice payment will be held until the agency receives CPO acceptance (Concurrency Review Acceptance/Concurrence/Approval Memorandum).

Invoice Details: The Contractor’s invoice must be completely detailed to include, but not be limited to:

Order number; period of service (i.e. January 1-31, 2018), full description of services provided; labor category (if applicable); contract line item billed against; number of hours billed against the specific line item; unit price; extended price; invoice total; Contractor name, address, telephone and contact person;

invoice number and date; and GSA Federal Supply Schedule and/or Contract number. Incorrect invoices will be rejected and returned to the Contractor.

Invoice against Line Item: The Contractor must identify and invoice against each individual line item in accordance with the applicable order for service.

Invoice Billing Schedule: The Contract must identify an Invoice Billing Schedule in each proposal. The Contractor shall not bill in advance of services being performed. The Contractor shall submit no more than one (1) invoice per month for the previous month’s services. The Contractor must note in the price proposal whether the contractor intends to bill monthly or upon completion of all services for the applicable order.

Final Invoice, Release of Claims Required To Closeout BPA Call Orders, Task Orders and/or the Contract Completion Statement: The Contractor must complete and submit Attachment 3, Release of Claim & Contract Completion Statement (signed by the COR/TPM) to the Order COR and BPA Call Order, Task Order and/or Contract Contracting Officer not later than 15 business days, after submission of the Contractor’s final invoice (which completes services) through the online Invoice Processing Platform (IPP) and after all remaining unliquidated balances have been deobligated by the Order Contracting Officer via modification, which is needed for the closeout process.

3.4 Non-personal Services

(a) The services to be performed under this contract do not require the contractor or his/her personnel to exercise personal judgment and discretion on behalf of the Government.

(b) The Government will neither supervise Contractor employees nor control the method by which the

Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for individual Contractor employees. It shall be the responsibility of https://www.ipp.gov/

Procurement Sensitive the Contractor to manage their employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor’s further responsibility to notify the CO immediately.

(c) These services shall not be used to perform work which are inherently Government functions. All decisions relative to programs supported will be the sole responsibility of the Government.

3.5 Government Down Time for Various Authorities Including the President, USDA

Forest Service

(a) Facility Closures Due to Emergencies. From time to time, the Forest Service may decide to close all or part of a facility in response to an unforeseen emergency or similar occurrence. Sample emergencies include, but are not limited to, adverse weather such as snow or flood, an act of God such as a tornado or earthquake, acts of war or terrorism, computer failures or a base disaster such as a natural gas leak or fire.

Contractor personnel are "non-essential personnel" for purposes of any instructions regarding the emergency.

(1) Contractor shall be officially dismissed upon notification of a facility closure in accordance with paragraph b. Contractor shall promptly secure all government furnished property appropriately and evacuate in an expedient but safe manner.

(2) With regard to work under the contract, the government shall retain the following options:

(i) Government may grant a time extension in the contract, delayed by the closure equal to the time of the closure, subject to the availability of funds.

(ii) Government may forego the work. The contractor will not be paid for work not performed.

(iii) Government may reschedule the work on any day satisfactory to both parties.

(iv) The government may, in its discretion, permit the contractor to perform at an off-site location during the period of facility closure if meaningful work can be accomplished.

Contractor shall certify to the government by letter within 5 businesses days of returning to work the nature and scope of the work completed off-site. Contractor shall be permitted to bill the government at the labor rates identified in the contract.

(v) In rare instances, Government may request that the Contractor continue on-site performance during the facility closure period. Such a request shall be subject to agreement by Contractor.

(b) Facility Closure Notification Procedures.

(1) After an official decision to close the facility has been made by the USFS, local television and radio stations will be notified of the closure.

(2) The Contractor is directed to listen or watch one of the local radio or television stations for notification of a facility closure. Contractor should follow instructions intended for non-essential personnel.

Procurement Sensitive

(3) The contractor will not receive any other form of notification of a facility closure from the government. The Contractor is responsible for notification of his or her employees.

(4) If the decision to close all or part of the agency is made during the duty day, and the USFS or

Chief’s decision is transmitted through official notification channels, the Contractor shall follow the instructions as given. Contractor personnel shall notify their COR and act in accordance with the Contract Officer Representative’s (COR) instruction.

(c) Agency Closure Due to Non-Emergencies. The USFS or USDA FS may elect to close all or part of the facility for non-emergency reasons such as time-off award, open house, etc. In the event of a non-emergency closure, the COR and the Contractor shall jointly choose a course of action within the following options:

(1) If there is a need for the service during the closure the Contractor may continue on-site work.

Contractor shall bill the Government in accordance with the contract.

(2) If there is a need for work during the closure but access will not be available, the Contractor may work off-site provided meaningful work may be accomplished. Contractor shall certify to the government by letter within 5 business days or returning on-site the nature and scope of the work completed off-site. Contractor shall bill the Government at the labor rates specified in the contract.

(3) If there is no need for the service during a scheduled closure, contractor shall not work on or off-site. Government may grant a time extension by the closure equal to the amount of time of the closure, subject to the availability of funds. The government will not be liable for time not worked.

3.6 Organizational Conflict of Interest (OCI)

The Contractor must identify in their proposal whether there is, or is not, an OCI. The Contractor warrants that, to the best of the Contractor's knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, or that the Contractor has disclosed all such relevant information.

The Contractor agrees that if an actual or potential organizational conflict of interest is discovered after award, the Contractor will make a full disclosure in writing to the Contracting Officer. This disclosure shall include a description of actions that the Contractor has taken or proposes to take, after consultation with the Contracting Officer, to avoid, mitigate, or neutralize the actual or potential conflict.

Remedies - The Contracting Officer may terminate this contract action for convenience, in whole or in part, if it deems such termination necessary to avoid an organizational conflict of interest. If the Contractor was aware of a potential organizational conflict of interest prior to award or discovered an actual or potential conflict after award and did not disclose or misrepresented relevant information to the Contracting Officer, the Government may terminate the contract for cause or default, debar the Contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

The Contractor further agrees to insert provisions which shall conform substantially to the language of this clause in any subcontract of consultant agreement hereunder.

3.7 Performance Period: AGAR 452.211-5 Period of Performance (FEB 1988)

• Base Year: December____, 2021 through December___, 2022

• Option Year 1: December ___, 2022 through December ___. 2023

• Option Year 2: December ___, 2023 through December ___ 2024

• Option Year 3: December ___, 2024 through December ___, 2025

• Option Year 4: December ___, 2025 through December ___, 2026

• FAR 52.217-8 Option to Extend Services:

December ___, 2026 through May___, 2027 (NTE 6 Months)

3.8 SPECIAL CONTRACT REQUIREMENTS

3.9 Technical Criteria: 508 information

E207.1 General - Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter 5

E207.2 WCAG Conformance - User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

E207.2.1 Word Substitution - When Applying WCAG to Non-Web Software For non-Web software, wherever the term “Web page” or “page” appears in WCAG 2.0 Level A and AA Success Criteria and Conformance Requirements, the term “software” shall be substituted for the terms “Web page” and “page”. In addition, in Success Criterion in 1.4.2, the phrase “in software” shall be substituted for the phrase “on a Web page.”

E207.3 Complete Process for Non-Web Software - Where non-Web software requires multiple steps to accomplish an activity, all software related to the activity to be accomplished shall conform to WCAG 2.0 as specified in E207.2.

E501.1 Scope - The requirements of Chapter 5 shall apply to software where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

E502.1 General - Software shall interoperate with assistive technology and shall conform to 502.

E504.1 General - Where an application is an authoring tool, the application shall conform to 504 to the extent that information required for accessibility is supported by the destination format.

E504.2 Content Creation or Editing -

Procurement Sensitive

Authoring tools shall provide a mode of operation to create or edit content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for all supported features and, as applicable, to file formats supported by the authoring tool.

Authoring tools shall permit authors the option of overriding information required for accessibility.

E504.2.1 Preservation of Information Provided for Accessibility in Format Conversion - Authoring tools shall, when converting content from one format to another or saving content in multiple formats, preserve the information required for accessibility to the extent that the information is supported by the destination format.

E504.2.2 PDF Export - Authoring tools capable of exporting PDF files that conform to ISO 32000-1:2008 (PDF 1.7) shall also be capable of exporting PDF files that conform to ANSI/AIIM/ISO 14289-1:2016 (PDF/UA-1) (incorporated by reference, see 702.3.1).

E504.3 Prompts - Authoring tools shall provide a mode of operation that prompts authors to create content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for supported features and, as applicable, to file formats supported by the authoring tool.

E504.4 Templates - Where templates are provided, templates allowing content creation that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) shall be provided for a range of template uses for supported features and, as applicable, to file formats supported by the authoring tool.

502.2 Documented Accessibility Features -

Software with platform features defined in platform documentation as accessibility features shall conform to 502.2.

502.2.2 No Disruption of Accessibility Features -

Software shall not disrupt platform features that are defined in the platform documentation as accessibility features.

502.3.1 Object Information -

The object role, state(s), properties, boundary, name, and description shall be programmatically determinable.

502.3.2 Modification of Object Information -

States and properties that can be set by the user shall be capable of being set programmatically, including through assistive technology.

502.3.3 Row, Column, and Headers -

If an object is in a data table, the occupied rows and columns, and any headers associated with those rows or columns, shall be programmatically determinable.

502.3.4 - Any current value(s), and any set or range of allowable values associated with an object, shall be programmatically determinable.

502.3.5 Modification of Values -

Values that can be set by the user shall be capable of being set programmatically, including through assistive technology.

502.3.6 Label Relationships -

Any relationship that a component has as a label for another component, or of being labeled by another component, shall be programmatically determinable.

502.3.7 Hierarchical Relationships -

Any hierarchical (parent-child) relationship that a component has as a container for, or being contained by, another component shall be programmatically determinable.

502.3.8 Text -

The content of text objects, text attributes, and the boundary of text rendered to the screen, shall be programmatically determinable.

502.3.9 Modification of Text -

Text that can be set by the user shall be capable of being set programmatically, including through assistive technology.

502.3.10 List of Action -

502.3.11 Actions on Objects -

Applications shall allow assistive technology to programmatically execute available actions on objects.

502.3.12 Focus Cursor -

Applications shall expose information and mechanisms necessary to track focus, text insertion point, and selection attributes of user interface components.

502.3.13 Modification of Focus Cursor -

Focus, text insertion point, and selection attributes that can be set by the user shall be capable of being set programmatically, including through the use of assistive technology.

502.3.14 Event Notification -

Notification of events relevant to user interactions, including but not limited to, changes in the component’s state(s), value, name, description, or boundary, shall be available to assistive technology.

503.1 General -

Applications shall conform to 503.

503.2 User Preferences -

Applications shall permit user preferences from platform settings for color, contrast, font type, font size, and focus cursor.

Functional Performance Criteria:

Procurement Sensitive

301.1 Scope - The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

302.1 Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

302.5 With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech - Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

3.10 Security Requirements

FEDRAMP Control and Compliance Specifications:

AU-11 Audit Record Retention

The vendor shall support a system in accordance with the requirement for Federal agencies to manage their electronic records in accordance with 36 CFR § 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in:

• NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of e-mail archiving applications to store e-mail (ref. c),

• NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud Computing Environments (ref 8).

Procurement Sensitive

The organization must retain audit records for a minimum of 30 days on line and a minimum of three (3) years off line not to conflict with NARA policy to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

IA-2 Identification and Authentication (Organizational Users)

The vendor shall support a secure, multi-factor method of remote authentication and authorization to identified Government Administrators that will allow Government designated personnel the ability to perform management duties on the system. The vendor shall support multi-factor authentication including [authentication to the system through an FS-issued device with the organizational users’ Active Directory (AD) account combined with LincPass; to FS Web-based applications through the USDA eAuthentication system; or using PKI certificates for specifications for PKI based authentication .

The information system must uniquely identify and authenticate organizational users. Organizational users include employees or individuals that the organization deems to have equivalent status of employees (e.g., contractors). All user accounts must be approved by the supervisor/sponsor and the identifier must uniquely identify the user.

IR-6, MP-5(2) and (4), PS-3

IR-6: INCIDENT REPORTING TIMEFRAMES

FedRAMP parameters set compliance for Incident Reporting at the levels stipulated in NIST SP 800-61;

and the Authorizing Officials (AO) will require an Incident Reporting plan that complies with those requirements. Agency contracts should stipulate any specific incident reporting requirements including who and how to notify the agency.

Cloud Service Providers are required to report all computer security incidents to the United States Computer Emergency Readiness Team (US-CERT) in accordance with US-CERT “Incident Categories and Reporting Timeframes” in, Appendix J, Table J-1 of NIST SP 800-61 (as amended), Any incident that involves compromised Personally Identifiable Information (PII) must be reported to US-CERT within 1 hour of detection regardless of the incident category reporting timeframe. For further information, NIST published SP800-86 Guide to Integrating Forensic Techniques into Incident Response.

SP800-86 defines in a much more precise and specific way the procedures, issues and technologies required to move an incident from the point of discovery all the way through to resolution.

MP-5(2) AND (4): MEDIA TRANSPORT

The vendor shall document activities associated with the transport of Federal agency information stored on digital and non-digital media and employ cryptographic mechanisms to protect the confidentiality and integrity of this information during transport outside of controlled areas. Digital media, containing Federal agency information, that is transported outside of controlled areas must be encrypted using FIPS 140-2 level 2 [or approved encryption modes specified in NIST SP-800-53 current rev]; nondigital media including but not limited to CD-ROM, floppy disks, etc., must be secured using the same policies and procedures as paper. Media, containing Federal agency information that is transported outside of controlled areas must ensure accountability. Federal agency data that resides on mobile/portable devices

Procurement Sensitive

(e.g., USB flash drives, external hard drives, and SD cards) must be encrypted using [NIST SP-800-53 current rev approved encryption modes]. All Federal agency data residing on laptop computing devices must be protected with NIST-approved encryption software.

PS-3: PERSONNEL SCREENING

Federal agencies are responsible for the level of Background Investigations that should be conducted in accordance with OPM and OMB requirements. As a note, the Joint Authorization Board (JAB) does not have contracts with CSP’s achieving Provisional Authorizations and therefore does not provide background investigations for CSPs seeking a Provisional Authorization. Agencies leveraging FedRAMP Provisional Authorizations will be responsible for conducting their own Background Investigations and or accepting reciprocity from other agencies that have implemented Cloud Service Provider systems.

FedRAMP parameters set reinvestigation parameters as follows: moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low risk positions. Agencies are responsible for the screening process and may want to stipulate additional screening requirements.

The vendor shall provide support personnel who are U.S. persons maintaining a NACI clearance or greater in accordance with OMB memorandum M-05-24, Section C (http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-24.pdf).

Vendor shall furnish documentation reflecting favorable adjudication of background investigations for all personnel supporting the system. Vendor shall comply with [FSM 6680 and SecureCap PS-3 Personnel Screening]. USFS separates the risk levels for personnel working on Federal computer systems into [3] categories: [Public Trust High, Moderate, Low]. All positions subject to investigation under this part must also receive a sensitivity designation of Special-Sensitive, Critical-Sensitive, or Noncritical- Sensitive, when appropriate. In accordance with CFR, Title V, Section 731.106, Designation of public trust positions and investigative requirements, the cost of meeting all security requirements and maintaining assessment and authorization shall be the responsibility of the contractor.

• Those vendor personnel (hereafter known as “Applicant”) determined to be in a high or moderate level of risk will require a Public Trust investigation.

The Contracting Officer, through the Contracting Officer’s Technical Representative or Program Manager will ensure that all required information is forwarded to the Federal Protective Service (FPS) in accordance with the FSM6680 and SecureCap PS-3 Personnel Screening. FPS will then contact each Applicant with instructions for completing required forms and releases for the particular type of personnel investigation requested.

Optional Additional Sample Template Language for Technical Requirements (if not already included elsewhere in the RFP):

Applicants will not be reinvestigated if a prior favorable adjudication is on file with FPS or [USFS], there has been less than a one-year break in service, and the position is identified at the same or lower risk level.

Once a favorable FBI Criminal History Check (Fingerprint Check) has been returned, Applicants may receive a USFS identity credential (if required) and initial access to USFS information systems. The http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-24.pdf

Procurement Sensitive

HSPD-12 Handbook contains procedures for obtaining identity credentials and access to USFS information systems as well as procedures to be followed in case of unfavorable adjudications.

SC-7(1) - BOUNDARY PROTECTION (TIC)

Cloud Service Providers pursuing a FedRAMP authorization will have to provide boundary protection in accordance with SC-7; however, if the agency data assets require utilization of a Trusted Internet Connection, the agency must include requirements for data routing within their contract.

(This control enhancement specific to a TIC requirement and may not be applicable to eSafety.)

SC-28 - PROTECTION OF INFORMATION AT REST

Cloud Service Providers pursuing a FedRAMP authorization will have to support the capability to encrypt data-at-rest; however, contract clauses should indicate any specific agency requirements for data encryption.

“The vendor (RFP respondent) shall provide security mechanisms for handling data at rest and in transit as recommended by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-111 “Guide to Storage Encryption Technologies for End User Devices.”

SI-5 - SECURITY ALERTS, ADVISORIES, AND DIRECTIVES

Cloud Service Providers are required to include FedRAMP personnel in the list of personnel required to receive alerts, advisories and directives; if an agency elects to include their own SOC or security personnel in alerts, an agency should include a contract clause.

“The vendor shall provide a list of their personnel, identified by name and role, with system administration, monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives. This list shall include the following NRE Forest Service eSafety information system personnel: System Owner (SO), Information System Security Officer (ISSO), Alternate ISSO (AISSO), and relevant network and system administrators.”

SECTION IV: APPLICBLE CLAUSES/TERMS AND CONDITIONS

4.1 FAR 52.252-2 Clauses Incorporated by Reference (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

www.arnet.gov/far/ www.usda.gov/procurement/policy/agar.html

52.203-16 Preventing Personal Conflicts of Interest (DEC 2011) 52.204-4 Printed or Copied Double-Sided on Recycled Paper (MAY 2011) 52.204-9 Personal Identity Verification of Contractor Personnel (JAN 2011) 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (JUN 2016) 52.212-4 Contract Terms and Conditions – Commercial Items (FEB 2012) 52.212-4 Alternate 1 (Oct 2008) 52.227-14 Right in Data General (MAY 2014)

Agriculture Acquisition Regulation (48 CFR Chapter 4) Clauses

452.224-70 Confidentiality of Information (FEB 1988) 452.237-75 Restrictions Against Disclosure (FEB 1988)

4.2 52.212-4 Contract Terms and Conditions—Commercial Items (Jan 2017)

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government shall exercise its post-acceptance rights—

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Government wide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising http://www.arnet.gov/far/ http://www.usda.gov/procurement/policy/agar.html

Need to insert clause FAR 52.204-21

Procurement Sensitive under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice.

(1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice shall include—

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Contract number, line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer—System for Award Management, or 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR Part 1315.

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the

Procurement Sensitive performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment.—

(1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract.

(2) Prompt payment. The Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR Part 1315.

(3) Electronic Funds Transfer (EFT). If the Government makes payment by EFT, see 52.212-5(b) for the appropriate EFT clause.

(4) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made.

(5) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall—

(i) Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment including the—

(A) Circumstances of the overpayment (e.g., duplicate payment, erroneous payment, liquidation errors, date(s) of overpayment);

(B) Affected contract number and delivery order number, if applicable;

(C) Affected line item or subline item, if applicable; and

(D) Contractor point of contact.

(ii) Provide a copy of the remittance and supporting documentation to the Contracting Officer.

(6) Interest.

(i) All amounts that become payable by the Contractor to the Government under this contract shall bear simple interest from the date due until paid unless paid within 30 days of becoming due. The interest rate shall be the interest rate established by the Secretary of the Treasury as provided in 41 U.S.C. 7109, which is applicable to the period in which the amount becomes due, as provided in (i)(6)(v) of this clause, and then at the rate applicable for each six-month period as fixed by the Secretary until the amount is paid.

(ii) The Government may issue a demand for payment to the Contractor upon finding a debt is due under the contract.

(iii) Final decisions. The Contracting Officer will issue a final decision as required by 33.211 if—

Procurement Sensitive

(A) The Contracting Officer and the Contractor are unable to reach agreement on the existence or amount of a debt within 30 days;

(B) The Contractor fails to liquidate a debt previously demanded by the Contracting Officer within the timeline specified in the demand for payment unless the amounts were not repaid because the Contractor has requested an installment payment agreement; or

(C) The Contractor requests a deferment of collection on a debt previously demanded by the Contracting Officer (see 32.607-2).

(iv) If a demand for payment was previously issued for the debt, the demand for payment included in the final decision shall identify the same due date as the original demand for payment.

(v) Amounts shall be due at the earliest of the following dates:

(A) The date fixed under this contract.

(B) The date of the first written demand for payment, including any demand for payment resulting from a default termination.

(vi) The interest charge shall be computed for the actual number of calendar days involved beginning on the due date and ending on—

(A) The date on which the designated office receives payment from the Contractor;

(B) The date of issuance of a Government check to the Contractor from which an amount otherwise payable has been withheld as a credit against the contract debt; or

(C) The date on which an amount withheld and applied to the contract debt would otherwise have become payable to the Contractor.

(vii) The interest charge made under this clause may be reduced under the procedures prescribed in 32.608-2 of the Federal Acquisition Regulation in effect on the date of this contract.

(j) Risk of loss. Unless the contract specifically provides otherwise, risk of loss or damage to the supplies provided under this contract shall remain with the Contractor until, and shall pass to the Government upon:

(1) Delivery of the supplies to a carrier, if transportation is f.o.b. origin; or

(2) Delivery of the supplies to the Government at the destination specified in the contract, if transportation is f.o.b. destination.

(k) Taxes. The contract price includes all applicable Federal, State, and local taxes and duties.

(l) Termination for the Government’s convenience. The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience. In the event of such termination, the Contractor shall immediately stop all work hereunder and shall immediately cause any and all of its suppliers and subcontractors to cease work. Subject to the terms of this contract, the Contractor shall be paid a percentage of the contract price reflecting the percentage of the work performed prior to the notice of termination, plus reasonable charges the Contractor can demonstrate to the satisfaction of the Government using its standard record keeping system, have resulted from the termination. The Contractor shall not be

Procurement Sensitive required to comply with the cost accounting standards or contract cost principles for this purpose. This paragraph does not give the Government any right to audit the Contractor’s records. The Contractor shall not be paid for any work performed or costs incurred which reasonably could have been avoided.

(m) Termination for cause. The Government may terminate this contract, or any part hereof, for cause in the event of any default by the Contractor, or if the Contractor fails to comply with any contract terms and conditions, or fails to provide the Government, upon request, with adequate assurances of future performance.