1333ND19QNB180073_DR_Request_for_Quotations_v2.pdf

RFQ IFB RFP

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODEFACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

DATED . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

17a CONTRACTOR/

OFFEROR.

CODE

8 (A)

SIZE STANDARD:

NAICS:

% FOR:SET ASIDE:UNRESTRICTED OR

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

10. THIS ACQUISITION IS

EDWOSB

SMALL BUSINESS PROGRAM

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

This is an 8(a) set aside under NAICS code 541513

- Computer Facilities Management Services with a small business size standard of $27.5 million. This requirement is for Disaster Recovery and Offsite Tape Storage Services and Equipment.

The Government intends to award a firm fixed price purchase order resulting from this Request for Quotes

(RFQ).

0001 6-MONTH BASE PERIOD: January 1, 2019 through June 30, 2019

Task 1: Backup Media Management Requirements in accordance with the Statement of Work.

PR NUMBER: NB184000-19-00174

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2019 to 06/30/2019

1.00 LO

0002 6-MONTH BASE PERIOD: January 1, 2019 through June

30, 2019

Task 2: Disaster Recovery Equipment and Services in

PR NUMBER: NB184000-19-00174

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2019 to 06/30/2019

1.00 LO

OPT

0003 6-MONTH OPTION PERIOD: July 1, 2019 through

December 31, 2019

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 07/01/2019 to 12/31/2019

1.00 LO

OPT

0004 6-MONTH OPTION PERIOD: July 1, 2019 through

December 31, 2019

PAGE 3 OF 47 1333ND19QNB180073

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 07/01/2019 to 12/31/2019

OPT

0005 OPTION YEAR ONE: January 1, 2020 through

December 31, 2021

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2020 to 12/31/2021

1.00 LO

OPT

0006 OPTION YEAR ONE: January 1, 2020 through

December 31, 2021

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2020 to 12/31/2021

1.00 LO

OPT

0007 OPTION YEAR TWO: January 1, 2021 through

December 31, 2022

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2021 to 12/31/2022

1.00 LO

OPT

0008 OPTION YEAR TWO: January 1, 2021 through

December 31, 2022

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2021 to 12/31/2022

PAGE 4 OF 47 1333ND19QNB180073

OPT

0009 OPTION YEAR THREE: January 1, 2022 through

December 31, 2023

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2022 to 12/31/2023

1.00 LO

OPT

0010 OPTION YEAR THREE: January 1, 2022 through

December 31, 2023

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2022 to 12/31/2023

1.00 LO

OPT

0011 OPTION YEAR FOUR: January 1, 2023 through

December 31, 2024

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2023 to 12/31/2024

1.00 LO

OPT

0012 OPTION YEAR FOUR: January 1, 2023 through

December 31, 2024

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 01/01/2023 to 12/31/2024

0013 OPTIONAL Task 3: Disaster Declaration in accordance with the Statement of Work.

PAGE 5 OF 47 1333ND19QNB180073

This OPTIONAL CLIN shall be available for exercise pursuant to FAR 52.217-7 for the entire period of performance, base and option periods included. If exercised, the Government may incrementally fund this optional CLIN. See Statement of Work for additional details.

PERIOD OF PERFORMANCE: 01/01/2019 - 12/31/2024

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

PAGE 6 OF 47 1333ND19QNB180073

Table of Contents

STATEMENT OF WORK

RFQ INSTRUCTIONS

RFQ EVALUATION FACTORS

52.202-1 DEFINITIONS (NOV 2013)

52.203-3 GRATUITIES (APR 1984)

52.203-11 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (SEP

2007)

52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010)

52.203-13 CONTRACTOR CODE OF BUSINESS ETHICS AND CONDUCT (OCT 2015)

52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS AND REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER

RIGHTS (APR 2014)

52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER (MAY 2011)

52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2018)

52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

52.204-16 COMMERCIAL AND GOVERNMENT ENTITY CODE REPORTING (JUL 2016)

52.204-17 OWNERSHIP OR CONTROL OF OFFEROR (JUL 2016)

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE MANAGEMENT (JUL 2016)

52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE, AND SERVICES DEVELOPED OR PROVIDED BY

KASPERSKY LAB AND OTHER COVERED ENTITIES (JUL 2018)

52.209-2 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS-REPRESENTATION (NOV 2015)... 31

52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER

ANY FEDERAL LAW (FEB 2016)

52.209-12 CERTIFICATION REGARDING TAX MATTERS (FEB 2016)

52.212-1 INSTRUCTIONS TO OFFERORS--COMMERCIAL ITEMS (OCT 2018)

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (OCT 2018)

52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (OCT 2018)

52.217-5 EVALUATION OF OPTIONS (JUL 1990)

52.223-5 POLLUTION PREVENTION AND RIGHT-TO-KNOW INFORMATION (MAY 2011)

52.225-25 PROHIBITION ON CONTRACTING WITH ENTITIES ENGAGING IN CERTAIN ACTIVITIES OR TRANSACTIONS RELATING

TO IRAN--REPRESENTATION AND CERTIFICATIONS (AUG 2018)

52.227-17 RIGHTS IN DATA--SPECIAL WORKS (DEC 2007)

52.229-3 FEDERAL, STATE, AND LOCAL TAXES (FEB 2013)

52.232-8 DISCOUNTS FOR PROMPT PAYMENT (FEB 2002)

52.232-18 AVAILABILITY OF FUNDS (APR 1984)

52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUNE 2013)

52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (DEC 2013)

52.237-2 PROTECTION OF GOVERNMENT BUILDINGS, EQUIPMENT, AND VEGETATION (APR 1984)

52.242-13 BANKRUPTCY (JUL 1995)

52.245-1 GOVERNMENT PROPERTY (JAN 2017)

52.245-9 USE AND CHARGES (APR 2012)

52.253-1 COMPUTER GENERATED FORMS (JAN 1991)

52.204-20 PREDECESSOR OF OFFEROR (JUL 2016)

52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (OCT 2015)

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--COMMERCIAL

ITEMS (OCT 2018)

52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

52.222-22 PREVIOUS CONTRACTS AND COMPLIANCE REPORTS (FEB 1999)

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

PAGE 7 OF 47 1333ND19QNB180073

Table of Contents

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

1352.201-70 CONTRACTING OFFICER?s AUTHORITY (APR 2010)

1352.201-72 CONTRACTING OFFICER`S REPRESENTATIVE (COR) (APR 2010)

1352.209-73 COMPLIANCE WITH THE LAWS (APR 2010)

1352.209-74 ORGANIZATIONAL CONFLICT OF INTEREST (APR 2010)

1352.215-72 INQUIRIES (APR 2010)

1352.219-71 NOTIFICATION TO DELAY PERFORMANCE (DEVIATION) (APR 2010)

1352.219-72 NOTIFICATION OF COMPETITION LIMITED TO ELIGIBLE 8(a) CONCERNS, ALTERNATE III (DEVIATION)

(APR 2010)

1352.233-70 AGENCY PROTESTS (APR 2010)

1352.233-71 GAO AND COURT OF FEDERAL CLAIMS PROTESTS (APR 2010)

1352.239-72 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY RESOURCES (APR 2010)

1352.246-70 PLACE OF ACCEPTANCE (APR 2010)

PERIOD OF PERFORMANCE (APR 2010)

NIST LOCAL-36TRAVEL NOTE

NIST LOCAL-53CONTRACT PERFORMANCE DURING CHANGES IN NIST OPERATING STATUS

52.217-7 OPTION FOR INCREASED QUANTITY--SEPARATELY PRICED LINE ITEM (MAR 1989)

52.219-14 LIMITATIONS ON SUBCONTRACTING (JAN 2017)

52.219-17 SECTION 8(a) AWARD (JAN 2017)

52.219-18 NOTIFICATION OF COMPETITION LIMITED TO ELIGIBLE 8(A) PARTICIPANTS (JAN 2017)

1352.239-71 ELECTRONIC AND INFORMATION TECHNOLOGY (APR 2010)

PAGE 8 OF 47 1333ND19QNB180073

CLAUSES

STATEMENT OF WORK

PAGE 9 OF 47 1333ND19QNB180073

STATEMENT OF WORK

NIST Disaster Recovery and Off‐Site Tape Storage Services and Equipment

Background Founded in 1901, the National Institute of Standards and Technology (NIST) is a non‐regulatory federal agency within the U.S. Commerce Department. NIST's mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

In order to ensure the continued availability of the computer infrastructure, there is need to develop and maintain a viable contingency planning/disaster recovery (DR) program for their information technology (IT) systems. The program must ensure the capability to maintain critical business functions and restore normal operations in the event of a disruption or interruption to automated information system or network services.

The requirement of an IT contingency plan/disaster recovery plan for systems is outlined in the respective system security plans as required by the following laws, policies, and regulations: Public Law 107‐347 E‐ Government Act of 2002, Title III, Information Security; Federal Information Security Management Act of 2002;

OMB Circular No. A‐130, Appendix III, Security of Federal Automated Information Resources; NIST Special Publication 800‐34, Contingency Planning Guide for Information Technology Systems; and NIST Special Publication 800‐53, Recommended Security Controls for Federal Information Systems and Organizations.

Mission The Infrastructure Services Division (ISD) of NIST’s Office of Information Systems Management (OISM) is responsible for providing system administration for all enterprise servers and scientific computing systems for NIST. Formulating and implementing an IT contingency plan/disaster recovery plan containing detailed guidance and procedures for restoring critical automated systems quickly and effectively following a service disruption is a vital service that ISD provides to its customers.

Current Environment ISD plans and maintains NIST’s central information technology systems including specialized scientific computing systems, data storage systems, messaging and collaboration systems, web‐based information systems, as well as financial and administrative systems. ISD plans for and maintains NIST’s central computing facilities, provides system security for NIST enterprise information technology systems and monitors system performance and workload to achieve maximum effective use of installed systems. Evaluates alternative approaches for satisfying customer needs and recommends solutions based on NIST priorities and resources.

ISD addresses disaster recovery requirements by providing their internal customers backup services that include an off‐site tape storage option. In addition, the Commerce Business Systems (CBS) applications have a requirement for an alternate data center for disaster recovery.

General Requirements This support requirement is for maintaining critical data, restoring data following a service disruption and contingency planning for recovery (providing facilities and equipment) in the event of a declared disaster.

Requirements include the following:

Task 1 ‐ Backup Media Management Requirements:

Provide all labor, materials other than NIST provided tapes, supervision, a storage vault at a remote secure location, and Courier service to provide weekly pick‐ups/deliveries from/to NIST Gaithersburg, Maryland campus to the remote storage vault and from/to NIST Boulder, Colorado campus to the remote storage vault.

PAGE 10 OF 47 1333ND19QNB180073

On a weekly basis, tapes will be delivered to facility more than 50 miles from the NIST Gaithersburg and Boulder Campuses.

Task 2 – Disaster Recovery Equipment and Services:

Support the implementation of a recovery strategy to use tapes stored off site to perform bare metal restoration of its selected IT systems. The Contractor shall provide specified equipment, services and facilities necessary to perform and support the various disaster recovery functions described later in the more detailed description of Task 2.

Optional Task 3 – Disaster Declaration:

Provide support to ensure the success of the contingency planning/disaster recovery program by defining the disaster declaration requirements. This optional task will be exercised by the government if a disaster necessitating a Disaster Declaration were to occur. Contractor shall provide “hot site” and “cold site” locations with required equipment to support government occupancy (daily) for up to 8 weeks (hot site) and 1 year (cold site) of use.

Period of Performance

This requirement is for a 6‐month base period and includes 1, 6‐month option period, and four (4), 12‐month option periods, totaling a 5‐year period of performance, if all options are exercised. Optional Task 3 (CLIN 0013) shall be available for exercise, pursuant to FAR 52.217‐7, for the entire period of performance, base and option years included and shall be available for multiple disaster declarations throughout the period of performance if necessary. The optional task shall cover up to 8 weeks at a Hot Site and up to an additional 1 year at a Cold Site, as described in the sections below. However, the Government may modify the order to increase the level of support by adding additional coverage if projected to be needed (e.g. an additional Optional CLIN for further disaster declaration support).

If exercised, the optional CLIN for Disaster Declaration services may be incrementally funded to support severable nature of these services.

Task 1: Backup Media Management Requirements The Contractor shall provide all labor, materials other than NIST provided tapes, supervision, a storage vault at a remote secure location, and Courier service to provide weekly pick‐ups/deliveries from/to NIST Gaithersburg, Maryland campus to the Contractor’s remote storage vault and from/to NIST Boulder, Colorado campus to the Contractor’s remote storage vault. On a weekly basis, tapes will be delivered to facility more than 50 miles from the NIST Gaithersburg and Boulder Campuses. These tapes will be rotated out with newer tapes. The older tapes will be returned to NIST, Gaithersburg, MD and Boulder, Colorado campuses respectively or as directed by authorized NIST personnel.

The contractor shall provide an on‐line database, accessible by NIST operators, which includes the media tracking information, as well as label recording for the tapes and historical information.

The tapes will contain sensitive data (Human Resources data, Financial, and Disaster Recovery data).

The maximum number of LT06/LT07 tapes is approximately 700 per month in Gaithersburg, and 50 per month in Boulder.

PAGE 11 OF 47 1333ND19QNB180073

Requirements for Gaithersburg Tapes:

up to 700 slotted tapes up to 30 containers

16 large containers at 60 tapes/container or miscellaneous DR material

14 small containers at 20 tapes/container

Containers to be bar coded and handled as one item (i.e. Entire container transported. Contractor does not handle content of containers.)

Containers shall be kept at Off‐Site Storage facility until recalled by NIST operations.

Additional Note: NIST policy is to store 12 Large containers off site in a 12 months cycle with the 13th container being returned to NIST. Additionally, two (2) large containers are rotated monthly and small containers are used for supplemental off‐site storage.

Requirement for Boulder Tapes:

50 slotted tapes

26 small containers at 20 tapes/container

Containers shall have bar codes and be handled as one item (i.e. Entire container transported.

Contractor does not handle content of containers.)

Containers shall be kept at Off‐Site Storage facility until recalled by NIST operations.

NIST policy is to store 12 containers off site in a 12 months cycle, with the 13th container being returned to NIST, additionally, other small containers are used for supplemental off‐site storage.

Task 1‐Specific Contractor Requirements

Contractor shall provide door to door pick‐up and deliveries in unmarked, company owned vehicles.

Contractor shall respond to and perform emergency pick‐up within two hours of Government request.

Contractor shall return a requested cartridge / container within 24 hours after notification from the Government.

A 24X7 support contact with a 1‐hour call back is required.

Contractor shall supply boxes for media shipping and storage.

Contractor shall supply bar codes for media with a bar code readers for Gaithersburg and Boulder.

Contractor shall supply tape management software so that Gaithersburg and Boulder can share the same database.

Contractor shall have a vault constructed in accordance with U.L. Class B standards. The vault modular structure shall meet the requirement of GSA Federal Specification AA‐V‐2737 or approved equivalent such as Lloyds Register Type Approval System 2002 for Fireblast Barriers and Walls.

Contractor shall provide training to the NIST CCF operations personnel if they do not already have experience with the contractor’s tape management tools and procedures. Once more than 70% of NIST CCF operations personnel have training or experience with the tools they shall teach new hires.

NIST may request re‐training if operators experience significant difficulties.

Vault shall have fire protection of each vault to provide minimum of six hours of fire resistance construction requirements of NFPA 232. Vault air conditioning and ventilation systems conform to NFPA Standard 90A.

During a declared disaster – designated media stored in vendor vaults must be transferred door to door to a NIST specified disaster recovery site. Contractor personnel must interact with the specified personnel at the disaster recovery site to deliver the tapes.

Contractor shall obtain and maintain through the life of the contract, Data reconstruction insurance of transit ($250,000.00) and stored ($1,000,000.00) media at no additional charge.

PAGE 12 OF 47 1333ND19QNB180073

Additionally, all couriers shall be a United States citizen, have a photo ID badge, secret or higher clearance and meet NIST requirements to enter the NIST campus. A primary and backup courier may, at NIST option, be asked to complete NIST procedures to obtain NIST badges for access to the Gaithersburg, MD Campus. Only authorized NIST employees and NIST operators may request tape transfers

Government furnished Property and Facilities NIST shall provide:

Systems access and access, as necessary, to meet the requirements of these tasks.

Tapes for storage.

Task 1 – Reporting Requirements The contractor shall provide the following reports and/or documentation throughout the period of performance to the COR.

On‐line bar code label ordering On‐line media return management Automatic media returning scheduling Templates for repetitive transactions Media Tracking Reports

Task 1 – Place of Performance These tasks shall be performed by the contractor accessing the NIST Central Computing Facility (CCF) located on the Gaithersburg campus in the Technology Building, picking up the container of tapes and returning the tapes to the off‐site storage facilities. The contractor shall also perform the same task at the Boulder Central Computing Facility located on the Boulder, Colorado campus in the Radio Building 1 or at a new CCF building once operations are relocated. NIST will provide contractor with necessary access to the building in accordance with NIST Security policies and procedures.

Hours of Operation ‐ Pick‐Up / Delivery Normal hours of operation for IT operations and maintenance are Monday through Friday from 7:00 am to 7:00 pm Eastern Standard time. Weekly work schedule is negotiable. Weekly tape pickup / drop off shall occur on Wednesdays during normal hours of operation.

In the event a Holiday falls on Wednesday or an emergency prevents normal pickup / delivery an alternate pickup or delivery shall occur at the earliest date as determined by NIST operations.

Holidays In performance under this Task, the Contractor shall observe the following Federal Holidays:

New Year’s Day Martin Luther King’s Birthday Presidents Day Memorial Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

The Contractor will not have access to NIST employees or to the NIST facilities during observed Federal Holidays or when Federal facilities are closed due to emergencies or Executive Orders. The Contractor must

PAGE 13 OF 47 1333ND19QNB180073

call the NIST status line at (301) 975‐8000 to determine whether NIST is open before its personnel report to work during national emergencies or during inclement weather.

Inspection and Acceptance Criteria.

Acceptance criteria. The COR will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance within the guidelines/requirements of the contract.

Unless otherwise indicated, the government will require 20 workdays to review and comment on deliverables.

If the deliverable does not meet the noted criteria, the Government will return it in accordance with the SOW requirements.

Rejection Procedures. A rejected deliverable will be handled in the following manner:

After notification that the deliverable did not meet the acceptance criteria, the contractor shall resubmit updated/corrected version 15 workdays after receipt of government comments.

Upon re‐submission by the contractor, the Government will reapply the same acceptance criteria. If the deliverable does not meet the acceptance criteria a second time the government might consider the contractor as having deficient performance with respect to the subject task.

Task 2: NIST Disaster Recovery Equipment and Services.

The objective of task 2 is to ensure the success of the contingency planning/disaster recovery program for NIST IT systems in support of the service agreements between ISD and its internal government customers.

The recovery strategy is to use tapes stored at contractor’s off‐site location to perform bare metal restoration of its selected IT systems. The Contractor shall provide specified equipment (see Contractor Equipment, Software Facility And Network Modifications), services and facilities necessary to perform and support the following functions:

IT Disaster Recovery

Disaster Recovery Security

Disaster Recovery Operational Services to provide for:

Support for the annual testing of recovery plan(s) that ensures business continuity of the financial systems used by NIST and other select IT systems.

Support during a declaration event.

Support for the eventual transition back to NIST after a disaster.

ISD, in conjunction with its internal government customers, is responsible for testing its disaster recovery plan and recovering its critical operations with the assistance of a disaster recovery service provider. Work performed under this contract will be limited to disaster recovery services for the equipment that supports the NIST financial and administrative applications. It will include only those systems that have alternate processing requirements as described in the service agreements that ISD has with its customers. The specific IT equipment requirements for this contract are listed in Contractor Equipment, Software Facility and Network Modifications. The contractor is not responsible for developing the strategies for how to perform the recoveries of the servers. ISD will be performing bare metal restores of its IT systems.

Task 2 Specific Requirements For purposes of this contract, the following definitions are used:

A Hot Site is defined as: A data center or office facility which is equipped with hardware, communications interfaces, electricity and environmental conditioning capable of providing backup

PAGE 14 OF 47 1333ND19QNB180073

operating support. This site relies on backups for recovery, typically tape backups. All components of this site, including storage, are shared among multiple customers.

A Cold Site is defined as: One or more data centers or office space facilities equipped with sufficient pre‐qualified environmental conditioning, electrical connectivity, communications access, configurable space and access to accommodate the installation and operation of equipment by the Government required to resume business operations.

Contractor shall provide a minimum of one Hot Site and one Cold Site that is a fully operational information technology recovery facility for midrange, server and workstation systems that provides redundant support for the Government’s requirements. The Contractor shall assign a primary Hot Site recovery facility to NIST.

Hot Site Requirements: Provide a fully operational, configured computing facility that is compatible and functionally equivalent to the equipment configurations specified in Contractor Equipment, Software Facility And Network Modifications of the Statement of Work, requires only installation of the Government's software and data, and the establishment of communication arrangements to the Government's facility(ies) and/or network to affect the Government's recovery of its data and applications. The Hot Site shall be provided for testing the Government’s disaster recovery plans and provided for a defined period of occupancy for each disaster declaration. (See Task 3.)

Cold Site Requirements: Provide a Cold Site facility equipped with the necessary environmental support systems, including, but not limited to electric power (primary and backup), air conditioning, fire detection and suppression systems, security systems and communications, to support the operation of the computer system resources specified in Attachment A of the Statement of Work. The Cold Site shall be provided for a defined period of occupancy for each disaster declaration. (See Optional Task 3.)

Task 2 Customer Recovery Requirements:

The contractor shall provide disaster recovery sites, computer systems, network resources and technical professional services specified below to support:

Disaster recovery test/exercises (see Test below).

Disaster recovery as soon as possible but no longer than twenty‐four (24) hours after a disaster declaration.

Provide at the earliest opportunity, services at another facility if the primary recovery site is unavailable.

If a mobile facility is part of the solution, deliver the mobile facility to the location the Government requests.

Give the Government priority access to a recovery site over other customers who have test time scheduled when the government declares a disaster.

Facilities

The contractor must operate and have full control of the facilities provided.

At a minimum, the contractor shall provide twenty‐four (24) hour/day, seven (7) day/week facility maintenance on all hot and Cold Site equipment (e.g., computer systems, HVAC). The contractor shall provide preventive and corrective maintenance in accordance with the original equipment manufacturers specifications.

The contractor shall provide a conference room to accommodate at least 25 individuals for meetings which will occur at the contractor’s recovery facility at the time of testing or disaster recovery.

PAGE 15 OF 47 1333ND19QNB180073

The contractor shall provide lockable storage space to stage and store the Government’s data tapes at time of testing or disaster recovery.

Task 2 Place of Performance

Alternate DR Site In accordance with NIST SP800‐34, “Contingency Planning Guide for Federal Information Systems”, the alternate DR sites shall be operationally ready to support the recovery and performance of the required systems. To assure that NIST’s financial and administrative systems will be operational and accessible at all times, including when the contractor’s infrastructure is being maintained or upgraded, the contractor’s facilities shall have been designed for concurrent maintainability.

One Hot Site recovery facility shall be located not more than 10 miles away from the NIST, Gaithersburg main campus to provide ease of access for NIST personnel during the annual exercise.

This site shall be used for contingency plan / disaster recovery testing / exercises.

This facility shall also include a Cold Site that will be the preferred disaster recovery Cold Site if a disaster is declared and a cold site is activated.

An alternate Cold Site, recovery facility shall be located more than 50 miles away from the NIST, Gaithersburg main campus to avoid the same regional hazards that would affect the NIST campus (ref: NIST SP800‐53, CP‐ 7(1)).

Network Services The contractor shall provide and maintain a dedicated, high‐capacity Virtual Private Network (VPN) to connect the contractor’s recovery facilities to each other.

The contractor shall provide and maintain Internet connectivity and a set range of IP addresses to be used by the customer for tests and disasters as specified in Attachment A.

The contractor shall provide NIST personnel access to network diagnostic and test equipment to allow the Government the ability to troubleshoot connectivity issues at time of testing or at time of disaster recovery.

Testing The contractor shall provide annual test time and technical assistance before, during, and after testing to validate that the Government’s recovery plans will be implemented successfully at the contractor’s recovery facilities at time of disaster declaration.

The contractor shall provide Hot Site availability for the agency’s recovery capability testing. There shall be one (1) recovery exercise performed annually. The test period shall be scheduled so that the Government will be allocated at least 96 hours of test time and will include all equipment and the work recovery area.

The contractor shall respond to the Government’s request within one week, with test dates and times mutually agreeable to the contractor and the Government, to schedule test time to be performed within one

(1) year of contract award.

The contractor shall ensure that all services provided under this contract, including technical and operational staff support, are provided prior to testing (to plan and coordinate test activities), at time of testing, and after testing to assess test results.

The contractor shall send a confirmation letter to the Government within seven (7) days of a test being scheduled. The confirmation letter shall include the date and time of the test and a complete list of

PAGE 16 OF 47 1333ND19QNB180073

equipment that is scheduled for the test. The contractor shall provide a test planning form to be completed by the Government at least thirty (30) days prior to the test and schedule a pre‐test meeting with the Government, at least fourteen (14) days prior to the test, to coordinate all technical and logistical aspects of the test. During the call, the contractor shall describe, and the Government will validate, who is responsible for what activities, and when they will be completed, before, during, and after the test. After the test, the Government shall provide a written assessment of the vendor’s performance.

If the Government’s test is canceled by the contractor prior to the test’s completion, due to another subscriber declaring a disaster, or if the Government’s test cannot be completed due to the unavailability or malfunctioning of the contractor’s system or network resources, the scheduled test time shall be credited in full to the Government. Credited test time shall be rescheduled, at the Government’s request, either during the current contract year, and/or a mutually acceptable cost reduction shall be negotiated. The Government may cancel or reschedule reserved test time sixty (60) or more days before a scheduled test without penalty.

IT Equipment Changes From time to time, changes to the disaster recovery IT architecture take place. The Government requires the contractor to provide a mechanism to facilitate equipment changes. For example, change the model of a Sun server or add or delete a mid‐frame server. Changes to the equipment listed in table 2 shall be made by authorized NIST personnel and executed via bilateral modification to the contract.

Task 2 ‐ Alternate Disaster Recovery Site Deliverables The Contractor shall provide the following deliverable documents for review and acceptance by the COR via email in either Word or PDF format:

Task 2 Deliverables

DELIVERABLE TITLE Delivery Method DELIVERABLE DATE

Kick‐off Meeting N/A Not Later than 30 Days after Receipt of Award

Annual Test Dates and Times to be delivered electronically via email and/or hard copy

Within one (1) week after requested.

Pre‐Test Plan to be delivered electronically via email and/or hard copy

30 days prior to test date; to be delivered electronically via email and/or hard copy

Post‐Test Report – Evaluation and Recommendations to be delivered electronically via email and/or hard copy

2 weeks after completion of test to be delivered electronically via email and/or hard copy

Quality Control Plan (QCP) to be delivered electronically via email and/or hard copy

30 days after contract award

Security The Contractor and its proposed facilities must meet all security requirements per NIST SP800‐53 as noted below.

Contractor personnel assigned to support the customer’s recovery exercises and recovery events shall be subjected to suitability screening and background investigation, in accordance with Federal regulations.

Background investigation shall, at a minimum, checking criminal court records and verifying social security

PAGE 17 OF 47 1333ND19QNB180073

number, credit, employment and education records and reports to determine suitability for employment.

(SP800‐53 Control Number PS‐3)

The contractor shall provide each facility and its component parts (e.g. Hot Site, Cold Site, conference room space, storage space, communications and specialized equipment space) an environment to accommodate a sensitive/unclassified system. Facility security shall include, but not be limited to the following:

Access to each facility and its component parts shall be restricted by a manned and/or automated access control system which identifies individuals, authenticates identity, validates access authorization, and maintains an audit trail. At time of occupancy for testing or disaster, the Government will provide a list of individuals to access the facility and its components parts.

(SP800‐53 Control Number PE‐2)

Provide twenty‐four (24) hour/day physical security coverage when the Government uses its facility. Security coverage shall be provided for all internal and external facility components. (SP800‐53 Control Number PE‐3)

Written security and emergency procedures shall be in place and posted conspicuously. Sign in logs which include participant name and affiliation and record of time of arrival and departure shall be used whenever entering the recovery facility. After sign in a unique access device shall be issued to each authorized person to limit access to only pre‐authorized individuals. (SP800‐53 Control Number PE‐8)

Each recovery facility shall contain fire detection and suppression systems in accordance with applicable Local, State, and Federal regulations. (SP800‐53 Control Number PE‐13)

Each recovery facility shall contain adequate environmental control systems to sustain continuous operations within both the hot and Cold Site. The environmental control systems shall satisfy the original equipment manufacturer’s specifications for its equipment, and shall include: heating, ventilation, and air conditioning;

chillers; water detection and protection; dual power feeds from separate power stations; and uninterruptible power supply. Each Cold Site shall contain adequate environmental systems to accommodate the systems under subscription. (SP800‐53 Control Numbers PE‐1, PE‐12, and PE‐18)

Provide a fully operational backup generator at each recovery facility. The backup generator shall have sufficient capacity to keep the computer systems, air conditioning, lighting, security system, fire detection and suppression systems, and private branch (PBXs) operational in the event of a power disruption or interruption.

(SP800‐53 Control Number PE‐11)

The contractor shall reformat, and virus scan/virus eradicate all fixed disks on all servers and workstations immediately before a server or workstation is provided to the Government for a test and/or at time of disaster.

The contractor shall confirm that it has completed a Security Plan, Disaster Recovery Plan, and Security Review for the facilities, systems, and networks proposed to satisfy the requirements of this contract within three (3) months after award. (SP800‐53 Control Number CP‐2) The contractor shall meet with NIST IT security staff to verify the following:

The contractor shall comply with the Security Plan and maintain the specified countermeasures to protect Government test and recovery operations and safeguard sensitive Government information resources.

PAGE 18 OF 47 1333ND19QNB180073

The contractor shall comply with the Disaster Recovery Plan and maintain the specified recovery capabilities to support Government test and recovery operations in the event that a disaster affects one or more of the contractor’s recovery facilities, systems, and/or network.

The contractor shall comply with the Security Reviews findings and recommendations and implement and maintain appropriate countermeasures to protect Government test and recovery operations and safeguard sensitive Government information resources.

Task 3 ‐ Optional Task: DISASTER DECLARATION The objective of this task is to ensure the success of the contingency planning/disaster recovery program by defining the disaster declaration requirements. This optional task will be exercised by the government in the event of a disaster necessitating a Disaster Declaration.

A disaster declaration occurs when the NIST central computing facility is affected by an event that causes a severe disruption in services such as loss of utility services; building evacuation and subsequent inability to occupy the building for a lengthy amount of time; or any catastrophic event such as a major fire. The computing facility will be deemed inaccessible and off‐limits to NIST staff. The cause of the disruption may or may not affect staff offices, surrounding buildings, utilities, or transportation systems. In such an event authorized NIST representatives may activate this Task by declaring a disaster and notifying the alternate site provider.

Note: During a declared disaster – designated media stored in vendor vaults must be transferred door to door to a NIST specified disaster recovery site. Contractor personnel must interact with the specified personnel at the disaster recovery site to deliver the tapes.

Optional Task 3 Requirements.

The Government will provide the contractor the list of individuals authorized to declare a disaster. The Government will provide System Administrators, database administrators and developers to manage the applications.

The contractor shall:

provide the Government the procedures for initiating a disaster declaration with the contractor, activating the Hot Site as well as for activating and transitioning to the Cold Site if that becomes necessary.

be able to handle multiple simultaneous disaster declarations such that the Government is not precluded from successfully implementing their recovery operations at the same time as other contractor customers.

provide technical support at time of disaster declaration (to bring all systems to operational readiness), during Hot Site occupancy (to assist with operations and troubleshooting), and after the disaster is declared to be over (to assess recovery operations). Systems engineers, software specialists, communications analysts, operations support personnel, facilities maintenance personnel, and all other necessary personnel shall be provided, as necessary after declaration of a Disaster event.

Ensure the Hot Site is fully operational as soon as possible, but not longer than twenty‐four (24) hours after a disaster declaration. The Hot Site shall be provided for a period of up to Eight (8) weeks occupancy for each disaster declaration.

Provide a Hot Site to Cold Site transition plan that is acceptable to NIST.

PAGE 19 OF 47 1333ND19QNB180073

After the period of occupancy of the Hot Site, the Cold Site shall be provided for a period of up to one (1) year occupancy for each disaster declaration. The disaster declaration may be cancelled at any time by the authorized government representatives.

The Contractor shall provide the labor and logistics to activate the Cold Site. The decision to activate the Cold Site shall be made and agreed upon at least Four (4) weeks prior to Cold Site activation and transition. Options include but are not limited to:

Transfer of Equipment from the Hot Site within a 24 Hr window on a Saturday.

Installing additional Government Provided equipment at the Cold site

Continue operations at the Hot Site beyond the initial 8 weeks.

Transition from the Hot site to the Cold Site shall minimize business disruption.

If a disaster declaration is in effect during August through September (during our year end processing period) the systems shall continue to operate at the Hot Site and will not be moved to a cold site until October 15, unless released by the government to move earlier. Transition shall occur on the weekend.

Systems may need to run in parallel until validated by the government business owner. Systems may need to be installed and configured up to a week prior to transition from the Cold site to the Hot site.

Data Communications capability (physical network connectivity and IP addresses) with external entities, such as other government sites, shall transition to the Cold Site at the same time.

The contractor shall ensure that all equipment and services provided under this contract, including technical and operational staff support, are provided at the time of disaster declaration.

The contractor shall provide support and security for accepting backup tape delivery from the Off‐Site Tape facility.

Once the disaster declaration is cancelled the contractor shall support return to normal operations as follows:

Allow access to the facility to carry out relocation of GFP.

Sanitize all systems that remain on the contractor premises and provide a letter attesting to the sanitization.

Maintain confidentiality of the events.

Table 13: Disaster Recovery Declaration Fee Schedule

Category Reference Qty Item Description

Occupancy Daily Hot Site Occupancy Fee

1 Daily occupancy fee for utilization of all or any portion of this configuration pursuant to a formal disaster declaration. Daily occupancy fees are in addition to the regular monthly fee above and cover all equipment and labor to support NIST 24 x 7 on this configuration. The Daily fee may start at the time of disaster declaration. Hot Site Occupation fees transition to Cold Site Occupancy Fees structure after 6 weeks at the Hot Site.

Occupancy Daily Cold Site Occupancy Fee

1 Daily occupancy fee for utilization of all or any portion of this configuration at the Cold Site, Daily occupancy fees are in addition to the regular monthly fee above and cover all equipment and labor to support NIST 24 x 7 at the Cold Site, including moving any existing equipment. The move from the Hot Site to the Cold Site is for the convenience of the vendor. Therefore, the vendor shall coordinate the transition. The transition to a Cold Site shall occur on a weekend and, PAGE 20 OF 47 1333ND19QNB180073 may not occur in September and shall allow NIST to resume operations within 24 hours or less.

Disaster Declaration Deliverables The Contractor shall provide the following deliverable documents for review and acceptance by the COR via email in either Word or PDF format:

Table 24: Deliverables

DELIVERABLE TITLE DELIVERABLE DATE

Procedures for declaring a disaster.

Within one (1) week after contract award.

Post Disaster Evaluation and Recommendations

4 weeks after return to normal operations to be delivered electronically via email and/or hard copy

Optional Task 3 ‐ Miscellaneous Requirements: Other The Security requirements, QCP and QASP developed for Task 2 shall continue to apply to the facility and contractor services during a disaster declaration.

Miscellaneous Requirements for All Tasks

Government Furnished Property (GFP) Materials furnished by NIST at the Disaster Recovery Facilities NIST may provide its own software to include operating systems, other systems software, application software, and data at the Hot Site. NIST is responsible for providing tapes with encrypted backup data for task 1 for off‐ site tape storage services and these may be used during disaster recovery exercises and then returned to the off‐side storage facility.

NIST is responsible for the delivery and maintenance of its own NIST‐owned equipment at the hot and Cold Sites. All Government furnished property shall remain the property of the Government and shall be returned to the Government prior to the end of this Contract.

In addition, no sharing of Government furnished property shall occur without prior written approval from the Government. Any Contractor contributions to Government furnished property under this contract shall become the property of the Government.

Government Furnished Information (GFI) All Government furnished information shall remain the property of the Government and shall be returned to the Government prior to the end of this Contract. Sharing of Government furnished information shall only be done after obtaining written approval from the Government, in advance of sharing Government furnished information.

Any Contractor contributions to Government furnished information under this contract shall become the property of the Government.

Contractor Equipment, Software, Facility and Network Modifications The contractor shall provide to the Government, and to the Contracting Officer’s Representative, written request and notification before making a change that will adversely impact the Government. Notification of a planned change to the contractor’s hardware (including address scheme changes, CPU identification number

PAGE 21 OF 47 1333ND19QNB180073

change), software, firmware, facility and/or network shall be provided at least sixty (60) days prior to implementation. No changes shall be made that prevent the Government from successfully testing or recovering its operations. Additional charges shall not be made for equipment changes the contractor elects to make to upgrade or improve its capabilities.

The table Disaster Recovery Resources below specifies the equipment required of the contractor.

Table 32: Disaster Recovery Resources

Category Reference Qty Item Description

Workspace Desktops 17 17 Desktop PCs w/ Windows 10

Workspace Workspace 17 Workspace with:

Desk and chair Separate jacks for Test network vs. Internet Access Telephone

Workspace Printer 1 Laser Jet Printer

Workspace WiFi 1 Internet access via Secured WiFi (users…