1333ND19RNB130003_Cyberlock_Expansion_RFP_12-07.pdf

RFQ IFB RFP

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODEFACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF.

DATED . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

OFFER

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

17a CONTRACTOR/

OFFEROR.

CODE

8 (A)

SIZE STANDARD:

NAICS:

% FOR:SET ASIDE:UNRESTRICTED OR

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

10. THIS ACQUISITION IS

EDWOSB

SMALL BUSINESS PROGRAM

STANDARD FORM 1449 (REV. 2/2012) BACK

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

40. PAID BY

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELPHONE NUMBER OF AUTHORZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

PARTIAL FINAL

37. CHECK NUMBER

38. S/R ACCOUNT NO. 39. S/R VOUCHER NUMBER

36. PAYMENT

COMPLETE PARTIAL FINAL

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

This is an 8(a) set aside under NAICS Code 561621 - Security Systems Services (except Locksmiths) with a small business size standard of $20.5 million. This is a brand name only requirement for Assa Abloy cyber lock-sets, and related products and services.

As a result of this Request for Proposals (RFP), the Government intends to award a single Indefinite Delivery/Indefinite Quantity (IDIQ) Contract with a maximum total ceiling value of $9,200,000.00. However, the Government reserves the right to award to multiple IDIQ contracts if deemed to be in the best interest of the Government.

Offerors shall reference Sections L and M of this RFP for specific instructions and the evaluation factors for award.

0001 BASE PERIOD: 03/01/2019 - 02/29/2020

Contractor Performance of requirements as specified in the Statement of Work in Section C of this Request for Proposals.

DELIVERY DATE: 03/01/2019

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 03/01/2019 to 02/29/2020

1.00 LO

OPT

0002 OPTION PERIOD 1: 03/01/2020 - 02/28/2021

Contractor Performance of requirements as specified in the Statement of Work in Section C of this Request for Proposals.

DELIVERY DATE: 03/01/2020

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 03/01/2020 to 02/28/2021

1.00 LO

OPT

0003 OPTION PERIOD 2: 03/01/2021 - 02/28/2022

Contractor Performance of requirements as specified in the Statement of Work in Section C of this Request for Proposals.

DELIVERY DATE: 03/01/2021

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 03/01/2021 to 02/28/2022

1.00 LO

OPT

0004 OPTION PERIOD 3: 03/01/2022 - 02/28/2023 1.00 LO

PAGE 3 OF 96 1333ND19RNB130003

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

Contractor Performance of requirements as specified in the Statement of Work in Section C of this Request for Proposals.

DELIVERY DATE: 03/01/2022

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 03/01/2022 to 02/28/2023

OPT

0005 OPTION PERIOD 4: 03/01/2023 - 02/29/2024

Contractor Performance of requirements as specified in the Statement of Work in Section C of this Request for Proposals.

DELIVERY DATE: 03/01/2023

SHIP TO:

NATIONAL INST OF STDS AND TECHNOLOGY

BUILDING 301 SHIPPING AND RECEIVING

100 BUREAU DRIVE

GAITHERSBURG MD 20899-0001

Period of Performance: 03/01/2023 to 02/29/2024

1.00 LO

PAGE 4 OF 96 1333ND19RNB130003

Table of Contents

SECTION B SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SECTION B - Minimum_Maximum Contract Amounts

SECTION C DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 IDIQ STATEMENT OF WORK

SECTION E INSPECTION AND ACCEPTANCE

E.1 52.246-2 INSPECTION OF SUPPLIES--FIXED-PRICE (AUG 1996)

E.2 52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

E.3 52.246-6 INSPECTION--TIME-AND-MATERIAL AND LABOR-HOUR (MAR 2001)

E.4 52.246-16 RESPONSIBILITY FOR SUPPLIES (APR 1984)

SECTION F DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

F.2 52.242-15 STOP-WORK ORDER (AUG 1989)

F.3 52.242-17 GOVERNMENT DELAY OF WORK (APR 1984)

SECTION G CONTRACT ADMINISTRATION DATA

G.1 IDIQ CONTRACT INFORMATION

G.2 1352.201-70 CONTRACTING OFFICER?s AUTHORITY (APR 2010)

G.3 1352.201-72 CONTRACTING OFFICER`S REPRESENTATIVE (COR) (APR 2010)

G.4 1352.216-76 PLACEMENT OF ORDERS (APR 2010)

G.5 1352.245-70 GOVERNMENT FURNISHED PROPERTY (APR 2010)

SECTION H SPECIAL CONTRACT REQUIREMENTS

H.1 LOCAL - CONVERSION OF CONTRACT TYPE

H.2 KEY PERSONNEL

H.3 LOCAL CLAUSE - CONTRACTOR RESPONSIBILITY

H.4 LOCAL FLOWDOWN PROVISION

H.5 LOCAL CLAUSE - NON PERSONAL SERVICES

H.6 1352.208-70 RESTRICTIONS ON PRINTING AND DUPLICATING (APR 2010)

H.7 1352.209-73 COMPLIANCE WITH THE LAWS (APR 2010)

H.8 1352.209-74 ORGANIZATIONAL CONFLICT OF INTEREST (APR 2010)

H.9 1352.231-71 DUPLICATION OF EFFORT (APR 2010)

H.10 1352.216-74 TASK ORDERS (APR 2010)

H.11 1352.237-70 SECURITY PROCESSING REQUIREMENTS - HIGH OR MODERATE RISK CONTRACTS (APR 2010).. 39

H.12 1352.237-71 SECURITY PROCESSING REQUIREMENTS - LOW RISK CONTRACTS (APR 2010)

H.13 1352.239-71 ELECTRONIC AND INFORMATION TECHNOLOGY (APR 2010)

H.14 1352.239-72 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY RESOURCES (APR 2010)

H.15 NIST LOCAL-07COMPUTER SECURITY POLICY

H.16 NIST LOCAL-36TRAVEL NOTE

H.17 NIST LOCAL-40BILLING INSTRUCTIONS FOR DELIVERY/TASK ORDERS

SECTION I CONTRACT CLAUSES

I.1 CERTIFICATION REGARDING TAX MATTERS (FEB 2016)

I.2 LIMITATION OF COSTS ON T&M / LABOR HOUR TASK ORDER

I.3 WAGE DETERMINATIONS - GAITHERSBURG, MD

I.4 WAGE DETERMINATIONS - BOULDER, CO

I.5 52.202-1 DEFINITIONS (NOV 2013)

I.6 52.203-3 GRATUITIES (APR 1984)

I.7 52.203-5 COVENANT AGAINST CONTINGENT FEES (MAY 2014)

PAGE 5 OF 96 1333ND19RNB130003

I.8 52.203-7 ANTI-KICKBACK PROCEDURES (MAY 2014)

I.9 52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010)

I.10 52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS AND REQUIREMENT TO INFORM EMPLOYEES OF

WHISTLEBLOWER RIGHTS (APR 2014)

I.11 52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER (MAY 2011)

I.12 52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2016)

I.13 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL (JAN 2011)

I.14 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE (OCT 2018)

I.15 52.204-16 COMMERCIAL AND GOVERNMENT ENTITY CODE REPORTING (JUL 2016)

I.16 52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE MANAGEMENT (JUL 2016)

I.17 52.209-10 PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS (NOV 2015)

I.18 52.211-11 LIQUIDATED DAMAGES--SUPPLIES, SERVICES, OR RESEARCH AND DEVELOPMENT (SEP 2000)

I.19 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (JAN 2017)

I.20 52.212-4 I CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (JAN 2017)--ALTERNATE I (JAN 2017).49

I.21 52.215-2 AUDIT AND RECORDS--NEGOTIATION (OCT 2010)

I.22 52.215-8 ORDER OF PRECEDENCE--UNIFORM CONTRACT FORMAT (OCT 1997)

I.23 52.216-31 TIME-AND-MATERIALS/LABOR-HOUR PROPOSAL REQUIREMENTS -- COMMERCIAL ITEM ACQUISITION

(FEB 2007)

I.24 52.217-7 OPTION FOR INCREASED QUANTITY--SEPARATELY PRICED LINE ITEM (MAR 1989)

I.25 52.219-8 UTILIZATION OF SMALL BUSINESS CONCERNS (NOV 2016)

I.26 52.219-14 LIMITATIONS ON SUBCONTRACTING (JAN 2017)

I.27 52.222-1 NOTICE TO THE GOVERNMENT OF LABOR DISPUTES (FEB 1997)

I.28 52.222-62 PAID SICK LEAVE UNDER EXECUTIVE ORDER 13706 (JAN 2017)

I.29 52.223-5 POLLUTION PREVENTION AND RIGHT-TO-KNOW INFORMATION (MAY 2011)

I.30 52.223-6 DRUG-FREE WORKPLACE (MAY 2001)

I.31 52.224-1 PRIVACY ACT NOTIFICATION (APR 1984)

I.32 52.224-2 PRIVACY ACT (APR 1984)

I.33 52.227-1 AUTHORIZATION AND CONSENT (DEC 2007)

I.34 52.227-2 NOTICE AND ASSISTANCE REGARDING PATENT AND COPYRIGHT INFRINGEMENT (DEC 2007)

I.35 52.227-19 COMMERCIAL COMPUTER SOFTWARE LICENSE (DEC 2007)

I.36 52.228-5 INSURANCE--WORK ON A GOVERNMENT INSTALLATION (JAN 1997)

I.37 52.229-3 FEDERAL, STATE, AND LOCAL TAXES (FEB 2013)

I.38 52.232-1 PAYMENTS (APR 1984)

I.39 52.232-7 PAYMENTS UNDER TIME-AND-MATERIALS AND LABOR-HOUR CONTRACTS (AUG 2012)

I.40 52.232-8 DISCOUNTS FOR PROMPT PAYMENT (FEB 2002)

I.41 52.232-9 LIMITATION ON WITHHOLDING OF PAYMENTS (APR 1984)

I.42 52.232-11 EXTRAS (APR 1984)

I.43 52.232-17 INTEREST (MAY 2014)

I.44 52.232-18 AVAILABILITY OF FUNDS (APR 1984)

I.45 52.232-23 ASSIGNMENT OF CLAIMS (MAY 2014)

I.46 52.232-25 PROMPT PAYMENT (JAN 2017)

I.47 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUNE 2013)

I.48 52.233-1 DISPUTES (MAY 2014)

I.49 52.233-3 PROTEST AFTER AWARD (AUG 1996)

I.50 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (OCT 2004)

I.51 52.237-3 CONTINUITY OF SERVICES (JAN 1991)

I.52 52.242-13 BANKRUPTCY (JUL 1995)

I.53 52.243-1 CHANGES--FIXED-PRICE (AUG 1987)

I.54 52.243-3 CHANGES--TIME-AND-MATERIALS OR LABOR-HOURS (SEP 2000)

I.55 52.244-2 SUBCONTRACTS (OCT 2010)

I.56 52.245-1 GOVERNMENT PROPERTY (JAN 2017)

PAGE 6 OF 96 1333ND19RNB130003

I.57 52.245-9 USE AND CHARGES (APR 2012)

I.58 52.246-20 WARRANTY OF SERVICES (MAY 2001)

I.59 52.246-23 LIMITATION OF LIABILITY (FEB 1997)

I.60 52.246-25 LIMITATION OF LIABILITY--SERVICES (FEB 1997)

I.61 52.249-2 TERMINATION FOR CONVENIENCE OF THE GOVERNMENT (FIXED-PRICE) (APR 2012)

I.62 52.249-8 DEFAULT (FIXED-PRICE SUPPLY AND SERVICE) (APR 1984)

I.63 52.249-14 EXCUSABLE DELAYS (APR 1984)

I.64 52.253-1 COMPUTER GENERATED FORMS (JAN 1991)

I.65 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

I.66 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS--

COMMERCIAL ITEMS (OCT 2018)

I.67 52.213-1 FAST PAYMENT PROCEDURE (MAY 2006)

I.68 52.216-18 ORDERING (OCT 1995)

I.69 52.216-19 ORDER LIMITATIONS (OCT 1995)

I.70 52.216-22 INDEFINITE QUANTITY (OCT 1995)

I.71 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

I.72 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

I.73 52.219-17 SECTION 8(a) AWARD (JAN 2017)

I.74 52.219-18 NOTIFICATION OF COMPETITION LIMITED TO ELIGIBLE 8(A) PARTICIPANTS (JAN 2017)

I.75 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

I.76 52.252-5 AUTHORIZED DEVIATIONS IN PROVISIONS (APR 1984)

I.77 52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

SECTION J LIST OF ATTACHMENTS

J.1 SECTION J - LIST OF ATTACHMENTS

SECTION K REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

K.1 52.203-11 CERTIFICATION AND DISCLOSURE REGARDING PAYMENTS TO INFLUENCE CERTAIN FEDERAL

TRANSACTIONS (SEP 2007)

K.2 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (JULY 2013)

K.3 52.204-8 ANNUAL REPRESENTATIONS AND CERTIFICATIONS (JAN 2018)

K.4 52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (OCT 2015)

K.5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (AUG 2018)

K.6 52.219-1 SMALL BUSINESS PROGRAM REPRESENTATIONS (OCT 2014)

K.7 52.222-22 PREVIOUS CONTRACTS AND COMPLIANCE REPORTS (FEB 1999)

K.8 52.222-25 AFFIRMATIVE ACTION COMPLIANCE (APR 1984)

SECTION L INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.1 INSTRUCTIONS TO OFFERORS

L.2 INQUIRIES

L.3 52.211-6 BRAND NAME OR EQUAL (AUG 1999)

L.4 52.211-7 ALTERNATIVES TO GOVERNMENT-UNIQUE STANDARDS (NOV 1999)

L.5 52.216-27 SINGLE OR MULTIPLE AWARDS (OCT 1995)

L.6 52.237-10 IDENTIFICATION OF UNCOMPENSATED OVERTIME (MAR 2015)

L.7 52.212-1 INSTRUCTIONS TO OFFERORS--COMMERCIAL ITEMS (AUG 2018)

L.8 52.216-1 TYPE OF CONTRACT (APR 1984)

L.9 52.233-2 SERVICE OF PROTEST (SEP 2006)

L.10 1352.233-70 AGENCY PROTESTS (APR 2010)

L.11 1352.233-71 GAO AND COURT OF FEDERAL CLAIMS PROTESTS (APR 2010)

SECTION M EVALUATION FACTORS FOR AWARD

PAGE 7 OF 96 1333ND19RNB130003

M.1 EVALUATION FACTORS FOR AWARD

M.2 52.217-5 EVALUATION OF OPTIONS (JUL 1990)

PAGE 8 OF 96 1333ND19RNB130003

SECTION B

SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SECTION B - Minimum_Maximum Contract Amounts

PAGE 9 OF 96 1333ND19RNB130003

1352.216-75 MINIMUM AND MAXIMUM CONTRACT AMOUNTS (APR 2010)

During the term of the contract, the Government shall place orders totaling a minimum of $100,000.00 against each awarded Indefinite Delivery, Indefinite-Quantity contract awarded. The amount of all orders awarded against all contracts awarded shall not exceed $9,200,000.00.

PAGE 10 OF 96 1333ND19RNB130003

SECTION C

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 IDIQ STATEMENT OF WORK

PAGE 11 OF 96 1333ND19RNB130003

Wireless (WIFI) Mortise Lock, Network, and Software IDIQ Contract Statement of Work (SOW)

Background The U. S. Department of Commerce, National Institute of Standards and Technology (NIST) Emergency Services Office, administers a Security Systems and Access Controls to physical resources located in multiple building research campuses located in Montgomery County, Maryland and Boulder, Colorado.

In the fall of 2016 and the spring of 2017 NIST constructed a system of wireless locking devices utilizing the existing NIST WIFI (IEEE 802.11 compliant) campus network.

Currently there is a Production system and a Test system located on virtual machines managed by the NIST Office of Information and Systems Management.

The system currently consists of 43 of 50 installed wireless mortise locks in three buildings; herein, the wireless mortise locks are called cyberlocks. The cyberlocks are ASSA ABLOY IN120 locksets. The cyberlocks utilize the RS2 AccessIT software platform as the management system.

During the 2016/2017 initial system testing, NIST reviewed several different manufacturers and software integrations to evaluate the characteristics of the software systems, lockset interactions, web‐based interfaces, system permissions, access control, and many other facets of the interaction that would take place between the locksets, users, and administrators.

It was determined at the time of this initial pilot deployment that the ASSA ABLOY IN120/220 was the only lockset capable of traditional 2.4 GHz WIFI communication, meeting encryption requirements, processing the NIST issued PIV card FASC‐N, as well as supporting traditional 26 Bit proximity cards in a single unit, while having enough memory to support a third card type such as PIV‐I which was also tested.

RS2 AccessIT was the chosen platform because of the robustness of the web‐based interface, granularity of system permissions, and control that could be exercised when creating the sites, access levels, role‐based access, and many other attributes.

PAGE 12 OF 96 1333ND19RNB130003

Wireless (WIFI) Mortise Lock, Network, and Software IDIQ SOW

IDIQ SOW Page 2

The project scope is to expand and provide cyberlock systems in NIST facilities.

Objectives

Software and hardware system utilizing the existing NIST WIFI system for provided wireless cyberlocks

Site surveys for suitability for doors to include existing WIFI Signal strength/compatibility

Removal of existing locksets and hardware

Modifying doors to accept new cyberlocks

Cylinder changes related to new cyberlocks

Providing, configuring and modifying software related to the cyberlocks

Adding cyberlocks to the system

Training and support for cyberlocks.

Support all NIST Facilities noted in the IDIQ SOW.

1. IDIQ Scope of Requirements

Each task order will specify the services required on that task order.

A. Surveying existing NIST facilities for interoperability with existing WIFI IEEE 802.11 networks to permit the successful installation of working cyberlocks.

B. Surveying existing doors to determine requirements to install cyberlocks.

C. Removal of existing locksets, cylinders, and door hardware necessary to provide new cyberlocks.

D. Providing the key cylinders specified with housings and any trim or extension rings as necessary.

E. Door modifications such as door wraps, spacers, longer screws, core tail pieces, etc. as necessary to ensure cyberlock installation and operability.

F. Providing all required software licensing to support the existing cyberlocks and software application as well as the licenses and software upgrades associated with these expansion efforts.

G. Scheduling services via Microsoft Project or similar scheduling program.

H. Cyberlock programming on the server to include recommendations for setting up additional servers/ communication servers.

I. Configuration of cyberlocks as they are installed, to communicate with the production server.

J. Software programming for access, alarms, access groups, door groups, email alerts, etc. on the server or other computer equipment.

K. Provide software upgrades for the software on the servers. Software and restoration from a file(s) backup.

L. Software, hardware, and end user training.

PAGE 13 OF 96 1333ND19RNB130003

IDIQ SOW Page 3

M. Testing and verification of the cyberlocks’ successful communication and remediation of issues such as but not limited to communication, function, installation, or aesthetics using the testing procedures found on the individual task orders.

N. Computer Aided Drawings (AUTOCAD 2018 or higher) resulting from door survey information showing the floorplan, door locations, and a reference to a door schedule or type. Drawings shall be prepared via US Army Corps A/E/C Standard

6.0 or higher.

Deliverable Schedule

Deliverables will be specified at the task order level in the Task Order SOWs. However, the table below lists the example minimum deliverables that the contractor shall prepare for on every task order issued.

Deliverable Description Quantity/Media Date Completed

1 Contractor Badge Application (NAIS) – Green

Every onsite contract employee except delivery drivers

Completed forms hard copies

Within 14 days of task order award

2 Contractor activity hazard analysis (job specific health and safety plan)

Electronic PDF submission

Within 14 days of Task Order award

Government‐Furnished Property, Material, Equipment, or Information (GFP, GFM, GFE, or GFI) per task order:

1. Laptop for programming

2. Encrypted USB flash drive as needed for file transfers from server/ workstations for documentation or email

3. USB to mini‐usb cable for connecting to locks from the laptop and manufacturer provided Lock Configuration Tool (LCT) *Contractor provided USB drives shall not be used*

4. Information pertaining to the programming of the lock profile such as the username, password, secure certificates, as well as the communication and encryption protocols being used.

5. Site specific training, e.g. Gaithersburg Radiation Safety Division training for personnel entering radiation‐controlled areas.

PAGE 14 OF 96 1333ND19RNB130003

IDIQ SOW Page 4

Security and Badging

Initial Entry for All Individuals to the Campus

All contractors shall be required to have a background check prior to issuance of any NIST badge.

The contractor shall request, complete, and submit a DN‐52 Limited Access Pass Authorization for Release of Information form for each person, using their Full Legal Name, that will be onsite. The contractor shall submit those applications via secure email or fax. If the documents are being sent by fax they shall have a cover sheet and the COR or TPOC must be successfully contacted first so that they are at the fax machine to receive the transmission. Failure to do so may result in a compromise of PII information and will be reported as a security violation.

The DN‐52s will be processed by our Office of Security (OSY). Any approvals or denials will be reported to the COR/ TPOC and a subsequent notification will be sent to the contractor’s POC.

Contractor personnel shall request a date to pick up their badge from the badge office via email to the COR/ TPOC. Once the visit has been authorized contractor personnel shall report to the NIST Visitor Center before entering site.

Individuals must provide one (1) form of identification (Real ID Act) and a vehicle registration document if operating a motor vehicle. Branded Commercial vehicles shall (Gaithersburg: enter through C Gate located on Quince Orchard Road) report to truck inspection whether the contractor personnel have a badge or are scheduled to visit.

The Visitor Center/ Truck Inspection staff validates the contractors information and provides a White Visitor Card to the individual. Staff directs individual(s) to the appropriate badge office location for processing.

The contractor’s employees will be provided with a temporary access card. This card will have the person’s photo, activation and deactivation dates, and other information that will be visually verified at the gates each morning. Depending on the length of the person’s visits they may be required to complete an EQIP and another background investigation for a PIV card. The contractor will be notified once this factor is established.

Contractor Employees are reminded of the following:

Ensure the NIST issued badge is physically displayed at all times at or above the waist while on NIST campus and follow the rules of behavior as specified within this procedure.

Within the timeline provided in the notice, complete enrollments, activations, certificate updates, and renewal requests of their PIV card when notified.

PAGE 15 OF 96 1333ND19RNB130003

IDIQ SOW Page 5

Within 48 hours, report the loss, damage, or theft of their badge to their supervisor and the NIST Badge Office (301)975‐6010. Complete forms NIST‐351 for Human Resources (OHRM) and DN‐42 for submission to Emergency Services Office (ESO).

Report damaged or non‐functioning badges to the Badge Office (301)975‐6010.

Upon receipt of their badge, individuals must utilize it to gain access to NIST facilities.

Except where authorized by ESO, individuals must surrender their Site card upon receipt of their PIV card.

RULES OF BEHAVIOR FOR ALL CARD TYPES

The NIST badge shall be displayed fully to the Police Officer/Security Officer at all access gates and any other time Contractor personnel are challenged while on the NIST campus.

All visitors/guests shall display their badge while on the NIST campus and must remain with their NIST sponsor/host at all times if being escorted.

If authorized for "security‐hours" access, Contractor personnel shall badge in and out of the campus at A Gate located on Clopper Rd from 6am to 7pm.

The NIST badge shall only be utilized to access authorized areas.

Contractor personnel shall not attempt to access controlled areas unless properly authorized.

Contractor personnel shall NOT piggyback or allow others to piggyback when entering an access‐controlled space.

Contractor personnel shall not share assigned badge or associated PIN (for PIV cards) with anyone and shall protect each appropriately. Individuals found in violation of this policy will have their badge will be confiscated, will be escorted off site immediately, and denied access to NIST‐administered sites.

Contractor personnel shall secure their NIST badge to prevent loss / theft.

o Contractor personnel shall immediately report a lost or stolen NIST badge to ESO, x2805. Once reported Contractor personnel will be required to complete a DN‐42 form for submission to ESO.

The NIST badge remains property of the Federal government and shall be returned when departing from NIST (i.e., separation, retirement, transfer, termination). Badges are returnable to the Badge Office located in the basement of Building 101 in room B08.

NIST reserves the right to revoke any badge and/ or access given at any time for any reason without notice.

Travel Travel on each task order shall be in accordance with FAR 31.205–46 Travel costs. The primary places of performance for task orders are expected to be the NIST campuses in Gaithersburg, MD and Boulder, CO. Each task order will detail the travel requirements.

PAGE 16 OF 96 1333ND19RNB130003

IDIQ SOW Page 6

Special Material Requirements This requirement is for the licensing, delivery, installation, programming, and testing of a IT‐based electronic cyber‐lock system to include locksets that will leverage the existing NIST network infrastructure as well as the existing NIST 802.11 b/g/n WIFI network.

A. The existing software system is RS2 AccessIT Universal.NET version 5.5.0.5. The total card count on the server is 9,745 with 5,205 active. On the Production system we currently have:

1. 6 client licenses,

2. 8 Sites,

3. 53 active lock licenses for the wireless readers,

4. Data Exchange,

5. Import/Export,

6. IP Locksets Enabled,

7. Web Client Support,

8. Terminal Server Support,

9. Report Designer,

10. Email/ Paging Integration.

Because the existing Wireless Lock Pilot has been running for almost two years and software changes occur quite frequently, NIST requests that the contractor use the existing software system but would accept alternate software platforms that are able to meet or exceed the list of requirements detailed below. Any system proposed that is unable to meet these requirements will not be considered viable. All costs of an alternate system shall include accommodations for the existing 50 locksets and shall utilize the ASSA ABLOY locksets identified in this IDIQ and subsequent task orders.

B. System Requirements if proposing an alternate:

1. The system shall be web based or have a web‐based interface.

2. The system shall be capable of utilizing a connection to an authoritative database view and data exchange to import system information, usernames, and other cardholder information such as exists in the current system.

3. The SQL database in the current system would be capable of being imported into the proposed software ensuring all data migrations were in‐ tact and that no record corruption had occurred.

4. The system shall be capable of utilizing role‐based access to the software.

5. The system shall not connect to the Internet except when initiated by a system user with an appropriate role.

6. The system shall be capable of updating access to individual locks via a communication mechanism from the server interface such as a schedule.

7. The system should be capable of updating firmware/software for lock groups.

PAGE 17 OF 96 1333ND19RNB130003

IDIQ SOW Page 7

8. The system shall be capable of producing reports in multiple formats but shall be available to view or print from the interface being used to access the system.

9. The system shall be capable of filtering reports based on lock groups/ devices/ by person.

10. The system shall be capable of creating custom reports

11. The system shall be capable of delegating control of lock groups to authorized system users.

12. The system shall be capable of organizing locks in lock groups.

13. The system shall be capable of managing 10000 or more cardholders.

14. The system shall be capable of receiving and storing events from locks.

15. The system shall be capable of associating user identities with events when the card identifier is received in a lock event.

16. The system shall be capable of logging low/ dead battery conditions at individual locks.

17. The system shall be capable of logging communication issues with individual locks.

18. The system shall be capable of transferring data from doors within 12 hours of the event occurring at the door.

19. The system shall be capable of storing all system data in a relational database.

20. The system shall be capable of utilizing one or more of the following database systems: Microsoft SQL 2012 or higher, Oracle 12c or higher;

MySQL 5.7 or higher.

21. The system shall not create separate archive databases when archiving.

22. The system shall be capable of creating a central archive database that can be searched at any time using reports.

23. The system shall only require 3 databases (max) for a fully functional system, including Active, Archive, Wireless Lock Database (if needed).

24. The system shall comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance specified as child requirements.

25. The system shall comply with all NIST SP 800‐53 controls and enhancements applicable to system components and system CIA ratings (low, low, low) for the revision of NIST SP 800‐53 in effect at time of system delivery.

26. The system shall enforce approved authorizations for logical access to the system in accordance with applicable policy as required by NIST SP 800‐53

AC‐3.

27. The system shall enforce a limit determined by policy on the number of consecutive login attempts by a user during a pre‐determined by policy time period; and shall automatically lock the account for a period of time determined by policy when the maximum number of unsuccessful attempts is exceeded as required by NIST SP 800‐53 AC‐7.

PAGE 18 OF 96 1333ND19RNB130003

IDIQ SOW Page 8

28. The system shall display an approved system use notification prior to granting access to the system as required by NIST SP 800‐53 AC‐8.

29. The system shall notify the user, upon successful login (access), of the date and time of the last logon (access) as required by NIST SP 800‐53 AC‐ 9.

30. The system shall prevent further access to the system by initiating a session lock after a pre‐determined amount of inactivity and shall retain the lock until the user re‐establishes access using approved identification and authentication procedures as required by NIST SP 800‐53 AC‐11.

31. The system shall produce audit records that contain sufficient information to, at a minimum, establish what type of event occurred, when (date and time) the event occurred, where the event occurred, the source of the event, the outcome (success or failure) of the event, and the identity of any user/subject associated with the event as required by NIST SP 800‐53

AU‐3.

32. The system shall use internal system clocks to generate time stamps for audit records as required by NIST SP 800‐53 AU‐8.

33. The system shall protect audit information and audit tools from unauthorized access, modification, and deletion as required by NIST SP

800‐53 AU‐9.

34. The system shall:

a. Provide audit record generation capability for the list of auditable events defined by the organization policy satisfying AU‐2;

b. Allow designated organizational personnel to select which auditable events are to be audited by specific components of the system; and

c. Generate audit records for the list of audited events defined in the organizational policy satisfying AU‐2 with the content as defined in AU‐ 3 as required by NIST SP 800‐53 AU‐12.

35. The system shall uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) as required by NIST

SP 800‐53 IA‐2.

36. The system shall obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals as required by NIST SP 800‐

53 IA‐6.

37. The system shall be capable of using mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication as required by NIST SP 800‐53 IA‐7.

38. The system shall uniquely identify and authenticate non‐organizational users (or processes acting on behalf of non‐organizational users) as required by NIST SP 800‐53 IA‐8.

PAGE 19 OF 96 1333ND19RNB130003

IDIQ SOW Page 9

39. The system shall separate user functionality (including user interface services) from information system management functionality as required by NIST SP 800‐53 SC‐2.

40. The system shall implement required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards and guidance as required by NIST SP 800‐53 SC‐13.

41. The system shall check the validity of information inputs as required by

NIST SP 800‐53 SI‐10.

42. The system shall:

a. Identify potentially security‐relevant error conditions;

b. Generate error messages that provide information necessary for corrective actions without revealing organizationally defined (both the NIST organization and the business unit) sensitive information in error logs and administrative messages that could be exploited by adversaries;

c. Reveal error messages only to authorized personnel as required by

NIST SP 800‐53 SI‐11.

43. The system shall comply with all requirements related to web accessibility as specified in Section 508 of the Rehabilitation Act of 1973.

44. The system shall be capable of reading the CHUID data object from Federal PIV cards.

45. The system shall be capable of reading the 32‐digit FASC‐N from Federal PIV cards.

46. The system shall use the first five FASC‐N fields (16 binary digits) as the unique identifier for Federally issued PIV cards.

47. The system shall be capable of distinguishing between Federally issued PIV cards and Federally issued PIV‐I cards.

48. The system shall distinguish between Federally issued PIV cards and Federally issued PIV‐I cards by reading the first 14 digits of the FASC‐N and shall interpret the card as PIV‐I if all 14 digits are the number nine (9).

49. The system shall be capable of reading the CHUID data object from Federal PIV‐I cards.

50. The system shall be capable of reading the 32‐digit FASC‐N from Federal PIV‐I cards.

51. The system shall be capable of reading the 128‐bit GUID/ UUID from Federally issued PIV‐I cards.

52. The system shall use the 128‐bit GUID/ UUID as unique identifier for Federally issued PIV‐I cards.

53. The system shall be capable of reading the card format from 36‐bit proximity cards.

54. The system shall be capable of utilizing a card only access option.

55. The system shall be capable of requiring PIN lengths of 6‐8 digits.

PAGE 20 OF 96 1333ND19RNB130003

IDIQ SOW Page 10

56. The system shall be capable of specifying different access options for each lock.

57. The system shall be capable of recording the date and time of each event in the local log.

58. The system shall be capable of recording the type of event in the local log.

59. The system shall be capable of recording the card identifier for an event in the local log when a card is associated with the event.

60. The system shall be capable of overwriting the oldest events in the local log only when the log is full.

61. The system shall be capable of overwriting the oldest events in the local log without any user interaction.

62. The system shall be capable of logging manual key override events at each lock.

63. The system shall be capable of logging access granted events at each lock.

64. The system shall be capable of logging access denied events at each lock.

65. The system shall be capable of logging held‐open events at each lock.

66. The system shall be capable of logging forced‐open events at each lock.

67. The system shall be capable of logging low battery events at each lock.

68. The system shall be capable of logging communication issues between the lock and server at individual locks.

69. The system shall be capable of storing access privileges for 5000 users at each individual lock.

70. The system should be capable of wired communication using 802.3 wired

Ethernet specifications.

71. The system shall be capable of utilizing 100BASE‐TX or better when using wired communication.

72. The system shall be capable of wireless communication using 802.11 wireless LAN specifications.

73. The system shall be capable of utilizing the 802.11b protocol in the 2.4

GHz band.

74. The system shall be capable of utilizing the 802.11g protocol in the 2.4

GHz band.

75. The system shall be capable of utilizing the 802.11n protocol in the 2.4

GHz band.

76. The system shall be capable of utilizing the 802.11n protocol in the 5 GHz band.

77. The system shall not utilize IR technology.

78. The system shall be able to read the PIV, PIV‐I, and 36‐Bit Prox card information from a single reader.

C. If an alternate software platform is used, the alternate shall include a system test license with all of the same salient features as the primary license but will only ever need a maximum of 50 lock license files to support the already installed IN120 locksets, 8 Sites (Segments), Data Exchange, Import/ Export, IP Locksets

PAGE 21 OF 96 1333ND19RNB130003

IDIQ SOW Page 11

Enabled, Web Client Support, Terminal Server Support, Report Designer, Email/ Paging Integration, 6 Client Workstations. A designated Contracting Officer’s Representative (COR) will be provided post award to gain access to the Production and Test VM instances when onsite.

D. WiFi Access Control Mortise and cylindrical locks to be IN120/ IN220 ASSA ABLOY

Manufacturing.

1. BHMA certified extra heavy duty, lever type mortise/cylindrical lock conforming to ANSI 156.13 Series 1000, Grade 1 standard and ANSI A117.1 accessibility guidelines. Electronic motorized locking control of lever handle trim with 3/4" anti‐friction deadlocking. UL listed and labeled for up to 3‐hour fire rated openings.

2. WiFi access control locking devices interface using field replaceable IEEE

802.11 b/g/n, 2.4 GHz wireless radio connection to an Ethernet Local Area Network (LAN) facilitating centralized control via a Software Development Kit (SDK). Locks will continue to operate independent of Ethernet (LAN) wireless connection slowdown or failure.

3. Provide access control products with non‐volatile memory.

4. Supports WEP, WPA, WPA2, PEAP, EAP‐TLS and 802.1x wireless encryption (IEEE 802.11 b/g/n, 2.4 GHz). AES 128 encrypted communication between IP Enabled lock and electronic access control system platform via SDK.

Programmable time zone periods, blocked holidays, automatic unlock with or without first entry, minimum of 2,400 user codes and the ability to audit the last 10,000 transactions (event type, date, time, user ID and name). Distributed intelligence allows standalone functional operation of lock in absence of network communication or slowdown allowing for system operational redundancy.

5. Integrated reader supports HID® 125 kHz proximity credentials or ISO

14443 A/B and ISO 15693 13.56 MHz contactless credentials: HID® iCLASS / iCLASS SE (full authentication, all formats), MIFARE Classic and DESFire EV1 (full authentication, all formats); NFC (Near Field Communications) and HID® SIO‐Enabled™.

6. Valid/Invalid credential presentation viewable by means of LED indicators on outside escutcheon.

7. Environmental Conditions: Conformally coated weather resistant electronic controller shall meet the following minimum requirements:

A. Operating temperature: ‐13°F (‐25°C) to 151°F (66°C)

PAGE 22 OF 96 1333ND19RNB130003

IDIQ SOW Page 12

B. Operating humidity: < 85% non‐condensing C. Weatherized design suitable to withstand harsh environments with a certified rating of IP55

8. Configuration: Programming of time zone periods, blocked holidays, automatic unlock with or without first entry, and listing 10,000 event transaction history consisting of event type, date, time, user ID and name is required.

A. Provide lock configuration CD tool kit for initial lock set‐up and programming via USB connection.

9. Monitoring: Software accessible monitoring (via SDK) of inside lever handle (Request‐to‐Exit), door position switch (DPS) integral to the lock (door open/closed status), forced door, unknown card, door held open, battery and tamper.

A. Privacy function initiated from push button on inside escutcheon and cancelled upon activation of valid Request‐To‐Exit (REX) or user defined credentials.

i. Activation of privacy function is indicated by LED notification on inside escutcheon.

ii. Redundant actuation of privacy button does not deactivate privacy mode.

10. Emergency override access capability by mechanical key cylinder retraction of lock latch bolt without electronic activation necessary.

11. Inside lever retracts latch bolt.

12. Power Source: Powered by 6 AA alkaline batteries with LED indication of locked, programming mode and low capacity warning status conditions.

Other Unique Requirements

A. Personnel access to these doors shall be managed by the OU end user. The NIST Security Systems and Access Control Group (SSACG) will retain an over‐arching umbrella‐based role mostly for administrative functions such as receiving battery, non‐communication, troubleshooting, custom programming, or programming alterations, and reader/system error types of alarms. All persons in the database shall be searchable and found by anyone authorized to access the application by assigning new users to “All Sites.” Authorized personnel (determined by role) shall only be able to search for a cardholder, locate their record, add or import a card, and assign or remove the appropriate access level for the rooms/ labs they require access to.

PAGE 23 OF 96 1333ND19RNB130003

IDIQ SOW Page 13

B. System Administrators shall be given full application access for performing administrative functions. Any communication, configuration, system features, database issues, script problems, or installation issues with the hardware is the responsibility of the contractor. NIST SSACG as well as NIST Office of Information Systems Management (OISM), including the COR and/or TPOC will be available to work with the contractor to find a potential solution, document the problem, enact the solution, and make it permanent. The contractor shall act as the liaison between the government and the manufacturer should there be an issue that requires the manufacturer to address.

C. OU/ Division System Administrators shall be given application access for performing administrative functions associated with door locations assigned to their group. Any communication issues with the hardware is the responsibility of the contractor to correct and will be communicated to them via the NIST SSACG as well as NIST OISM, including the COR and/or TPOC. The NIST SSACG as well as NIST OISM, including the COR and/or TPOC will be available to work with the contractor to find a potential solution, document the problem, enact the solution, and make it permanent. The contractor shall act as the liaison between the government and the manufacturer should there be an issue that requires the manufacturer to address.

D. The contractor shall be accountable for the identification and purchase of additional licensing features such as:

a. Lock License Files (unless included in the cost of the lock).

b. Additional workstation licenses.

c. Additional features as needed to ensure lockset communication and system functionality required throughout this expansion effort.

E. The contractor shall include:

a. 8 (E‐CLIENT‐5P Client license 5 packs)

b. Locksets

c. Other components needed to complete this work (Door wraps, Trim, Coverplates, etc.)

d. System upgrade to a VU‐ESSL255 AccessIT!® Universal ‐ Enterprise Single

Server Version Upgrade 255 Sites

e. 1 DS‐ESSL255 AccessIT!® Universal ‐ Enterprise Single Server Direct

Support Agreement Annual Fee including Version Upgrade Fee.

F. The contractor shall use the GFE laptop and GFE USB to mini‐USB cable to configure the locks in the following manner:

PAGE 24 OF 96 1333ND19RNB130003

IDIQ SOW Page 14

a. Card Format 0 = Format selection to support the 13.56MHz PIV smart card read of the correctly formatted FASC‐N. In support of the PIV and PIV‐I (if necessary) card reads.

b. Card Format 1 = Format selection of the 26BIT 125KHz prox card format to support already existing NIST Site cards.

c. If the formats are not available on the unit, the firmware may need to be updated and must be obtained from the lock manufacturer (ASSA ABLOY).

The firmware can only be applied using a laptop and the Lock Configuration Tool via USB connection to the IP controller within each lock itself.

d. Assign DHCP as the IP Address being used.

e. Record and build a report containing the Media Access Control (MAC) address, Serial Number, and any other pertinent information needed for warranty or troubleshooting onto a spreadsheet so that the data can be transposed into Automated NIST Tracking System (ANTS). Provide the spreadsheet to the COR/ TPOC for distribution to the NIST IT Security Officer (ITSO) responsible for this system.

f. Any other information concerning the lock profile, secure certificates, usernames, and passwords will be provided by the government and cannot not be disclosed to those without a need to know in support of this project.

g. All software, hardware, parts, and labor installed under this IDIQ shall be warrantied as detailed in each Task Order. The Contractor shall respond to COR warranty calls within two (2) business days.

Place of Performance The place of performance of a given task order will be specified in the Task Order SOW.

The place of performance of task orders will primarily be one or a combination of the following NIST campuses:

Gaithersburg, Montgomery County, Maryland Boulder, Boulder County, Colorado

Period of Performance The period of performance for this effort is one, 12‐month base period with four (4), 12‐ month option periods.

END OF SOW

PAGE 25 OF 96 1333ND19RNB130003

SECTION E

INSPECTION AND ACCEPTANCE

E.1 52.246-2 INSPECTION OF SUPPLIES--FIXED-PRICE (AUG 1996)

(Reference 52.246-2)

E.2 52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

(Reference 52.246-4)

E.3 52.246-6 INSPECTION--TIME-AND-MATERIAL AND LABOR-HOUR (MAR 2001)

(Reference 52.246-6)

E.4 52.246-16 RESPONSIBILITY FOR SUPPLIES (APR 1984)

(Reference 52.246-16)

PAGE 26 OF 96 1333ND19RNB130003

SECTION F

DELIVERIES OR PERFORMANCE

F.1 PERIOD OF PERFORMANCE

PAGE 27 OF 96 1333ND19RNB130003

1352.270-70 Period of Performance (APR 2010)

a) The base period of performance of this contract is from March 1, 2019 through February 29, 2020. If an option is exercised, the period of performance shall be extended through the end of that option period.

(b) The option periods that may be exercised are as follows:

Period Start date End date

Option I March 1, 2020 February 28, 2021

Option II March 1, 2021 February 28, 2022

Option III March 1, 2022 February 28, 2023

Option IV March 1, 2023 February 29, 2024

(c) The notice requirements for unilateral exercise of option periods are set out in FAR 52.217-9.

(End of clause)

F.2 52.242-15 STOP-WORK ORDER (AUG 1989)

(Reference 52.242-15)

F.3 52.242-17 GOVERNMENT DELAY OF WORK (APR 1984)

(Reference 52.242-17)

PAGE 28 OF 96 1333ND19RNB130003

SECTION G

CONTRACT ADMINISTRATION DATA

G.1 IDIQ CONTRACT INFORMATION

PAGE 29 OF 96 1333ND19RNB130003

IDIQ CONTRACT INFORMATION

A. Description of contract: This is an Indefinite Delivery, Indefinite Quantity (IDIQ) contract under which the contractor shall provide any or all of the support services described in the Statement of Work (SOW) of the contract as detailed in individual task/delivery orders issued by the contracting officer during the term of this contract.

B. Single Award Preference: The contracting officer intends to award a single IDIQ Contract to one Offeror to the extent that this approach is in the best interests of the Government based on the proposals received. However, the Government reserves the right to award multiple IDIQ contracts, if deemed to be in the best interest of the Government. All proposals will be evaluated based on the evaluation factors detailed in section M of the RFP. A determination on whether the issuance of a single award is in the best interests of the Government will be made by the government during the evaluation process.

C. Task Orders: Task orders under this contract shall be either firm fixed price or time & materials/labor hour type task orders, with preference towards firm fixed price contract type. Task orders may also be a hybrid of the different contract types.

The following procedures apply for the issuance of task orders as a result of the solicitation.

a. Work shall be initiated only by issuance of a fully executed task order by the contracting officer. The work to be performed under these task orders must be within the scope of the SOW in Section C of the contract. The Government is only liable for costs expended under the terms and conditions of the contract to the extent that a fully executed task order has been issued and covers the required work. Charges for any work not authorized shall not be allowed.

b. The Contractor shall provide a quotation/proposal in response to a request for quotation…