B08_-_RFQ_140M0124Q0011_Addendum.pdf

BOEM: Geoscience Subsurface Interpretation RFQ 140M0124Q0011 Software – Cloud (GSIS-C) IDIQ Page 2 of 68

RFQ 140M0124Q0011

SECTION 1

PRICING

1.1 GENERAL INFORMATION

The United States Department of the Interior, Bureau of Safety and Environmental Enforcement (BSEE), on behalf of the Bureau of Ocean Energy Management (BOEM) is issuing this competitive Request for Quote (RFQ) for the program entitled, “Geoscience Subsurface Interpretation Software – Cloud (GSIS-C), as described in Section 2, in accordance with Federal Acquisition Regulation (FAR) Part 13.5 – Simplified Acquisition Procedures for Certain Commercial Items, FAR Part 12 – Acquisition of Commercial Products and Commercial Services, and FAR Subpart 16.5 – Indefinite-Delivery Contracts. The North American Industry Classification System (NAICS) code for this requirement is 541519, Other Computer Related Services, with a small business size representation of $34.0M.

If you are interested in this acquisition, you may participate by submitting your response in accordance with the requirements and instructions contained herein.

The Government anticipates the award of a single Indefinite Delivery-Indefinite Quantity (IDIQ) contract as a result of this solicitation. The Government anticipates awarding Task Orders focused on specific program requirements throughout the IDIQ period of performance.

The ordering period for the IDIQ is anticipated to be 60 months / five (5) years.

1.2 ANTICIPATED CONTRACT TYPE AND PRICING

All Task Orders issued under this IDIQ contract shall be priced in accordance with Section 1.3, less any discounts. Task Orders are anticipated to be Firm-Fixed Price (FFP); however, the Government reserves the right to issue Time & Materials (T&M), Labor Hour (LH), or a hybrid of the foregoing contract types. Task Orders shall be fully funded upon issuance and shall be non-severable orders.

1.3 CONTRACT LINE ITEM (CLIN) STRUCTURE

The specific details and descriptions of the Contract Line Item Numbers (CLINs) are described as follows (offeror shall fill in * and provide information as part of their quote).

CLIN DESCRIPTION PRICE

00010 IDIQ Year 1 (months 1 through 12) $TBD* 00020 IDIQ Year 2 (months 13 through 24) $TBD* 00030 IDIQ Year 3 (months 25 through 36) $TBD* 00040 IDIQ Year 4 (months 37 through 48) $TBD* 00050 IDIQ Year 5 (months 49 through 60) $TBD*

CLINs 00010, 00020, 00030, 00040, and 00050 are for all services required to perform the work in

Software – Cloud (GSIS-C) IDIQ Page 3 of 68

Section 2. The Contractor shall provide perpetual software licenses, and the requisite maintenance, consulting, and training services to support the software to meet the requirements specified at the individual Task Order level. The pricing for the forgoing licenses and support shall be based on the Contractor’s commercial price list, utilizing any discounts.

1.4 OTHER DIRECT COSTS

Other Direct Costs (ODCs) under Task Orders will be reimbursed on a reimbursement basis.

ODCs such as travel and materials, will be reimbursed for actual, allowable, and reasonable costs under individual Task Orders, in accordance with FAR 31.205-46 and the Federal Travel Regulations in effect at the time of travel. No travel shall be conducted to support the requirements of Task Orders without advanced written approval from the Contracting Officer’s Representative (COR).

Software – Cloud (GSIS-C) IDIQ Page 4 of 68

SECTION 2

DESCRIPTIONS/SPECIFICATIONS/REQUIREMENTS/STATEMENT OF WORK

Geoscience Subsurface Interpretation Software – Cloud (GSIS-C)

2.1 BACKGROUND

The Bureau of Ocean Energy Management (BOEM) Alaska Region Resource Evaluation (RE) Office mission is to investigate the mineral and energy resource potential of Alaska's Outer Continental Shelf (OCS) to ensure that the federal government receives fair market value (FMV) for OCS leases that it awards to private firms through a competitive bidding process and develop geologic prospect and play boundaries to support the National Program reserves inventory. In support of this mission, RE uses various types of geologic and geophysical data to identify areas of the Alaska OCS likely to contain hydrocarbon accumulations and assess the undiscovered oil and gas potential in these areas. These assessments are then used to guide leasing and exploration policies and programs.

The most frequent data types utilized by RE for analysis are seismic and well-log data. BOEM AK must be able to evaluate 2D seismic reflection data; well and borehole data to include logged-while-drilling (LWD) logs, core reports and images, and MD/INC/AZI surveys; and various geographic shapefiles. The integrated analysis of these data types is paramount to our evaluation process. Basic seismic interpretation and well log analysis is critical to support the BOEM National Program and BOEM AK must use subsurface interpretation software that allow for independent interpretations comparable to private oil and gas industry standards.

2.2 OBJECTIVES

BOEM seeks to obtain the software required to perform independent subsurface interpretations to support BOEM’s National Program while maintaining technical standards equal with the private energy industry.

The main objective of this contract is to procure a commercial, off-the-shelf (COTS) geoscience and geophysical software package which can be hosted in accordance with the DOI cloud mandate. This contract will provide for the acquisitions of the software, software maintenance and support, software and non-software support and services (e.g., technical support regarding software best-practice workflows), and training to effectively use the software. BOEM AK RE seeks a fully integrated software solution for seismic interpretation, geologic modelling, 3D visualization, geological interpretations (cross-sections, well log analysis, well log surface markers), subsurface mapping, and data management.

2.3 SCOPE OF WORK

The contractor will provide licenses, maintenance and support in accordance with the requirements of each individual Task Order. The initial provisioning of the software (the first Task Order) will include technical consulting and support to create the software and license environment with optimal configuration; a technical data and systems transition plan with

Software – Cloud (GSIS-C) IDIQ Page 5 of 68 services and consultation to migrate the current subsurface interpretation environment (to include but not limited to data, interpretation products, databases, license installation and activation);

introductory training for up to 10 geologists/geophysicists/data managers; and software and subsurface workflow maintenance and support. The initial provisioning will also provide digital training guides in an unprotected, highlightable, printable portable document format (pdf) for the basic use of the software programs. The contractor will make updates to the training guides available to BOEM as these updated documents are available commercially.

Additional task orders may be issued against the IDIQ which will describe specific services and deliverables. These services and deliverables may include purchasing or relinquishing additional licenses and/or software suites, maintenance and support, software and non-software consulting services, vendor specific technical support and services either in-person or through remote connections (e.g. technical experts performing system migrations and creating functional interpretation environments that align with best practices, seismic data processing and loading, complex interpretation workflow support), introductory software training, and additional software training to meet the requirements of BOEM AK RE.

The software must be in compliance with the DOI cloud strategy (Cloud Smart Strategy | U.S.

Department of the Interior (www.doi.gov/cloud/strategy)) and Federal Cloud Smart Strategy (Strategy | Federal Cloud Computing Strategy (www.cio.gov/policies-and-priorities/cloud-smart/)). This entails either hosting licenses and software on a DOI virtual infrastructure hosted in a DOI private cloud or, if the solution is Software as a Service (SaaS), the SaaS solution must be FEDRAMP certified (How to Become FedRAMP Authorized | FedRAMP.gov (www.fedramp.gov/agency-authorization/)) and Security FAQs | U.S. Department of the Interior (www.doi.gov/cloud/faq)) allowing BOEM the ability to host proprietary data and information at a FISMA moderate level in the vendor’s cloud environment.

BOEM AK Region’s current environment is built around SLB’s Petrel and Studio software hosted through an on-premises data center and localized software installations. All user projects, reference projects, template projects, and seismic .segy files loaded to Petrel projects are currently hosted on NetApp servers. There are currently eight (8) Petrel template/shell projects based on BOEM AK planning areas with appropriate coordinate reference system (CRS) in Alaska State Plane NAD 83 UTM zone 1-10 and associated Studio repository folder organization. BOEM AK has 14 Petrel reference projects that are configured with appropriate CRS, associated repository folder organization, and vetted gold and user interpreted data based on specific project or planning area (e.g., Lease Sale 258, Automated Workflows, Cook Inlet AOI, Bering Sea AOI, etc.). The total size of all reference projects is 15.2 GB. The database to support user Petrel working projects is Studio Manager. Studio Manager and associated repositories are hosted on Microsoft SQL server. BOEM AK has six (6) Studio repositories, two

(2) are legacy repositories from the migration of GeoFrame to Petrel and four (4) are repositories that have been created to house proprietary, public, lease sale, and lease sale collaboration data and interpretation products. The total size of all repositories is approximately 115 GB. BOEM AK currently has 377 GB of seismic .segy files loaded to area of interest (AOI) Petrel reference projects. In total BOEM AK has nine (9) TB of seismic. segy associated with BOEM AK oil and gas permits and an additional 20 TB of seismic from external agencies, universities, and other

Software – Cloud (GSIS-C) IDIQ Page 6 of 68 entities stored on its shared drives. The largest seismic survey currently loaded to a Petrel project is approximately eight (8) TB.

2.3.1 Detailed Software Subsurface Workflow Capability Requirements

“Off-the-shelf” refers to native software features that have already been developed and are implemented and commercially available to all current users in the current release of the software program. The detailed “off-the-shelf” subsurface interpretation workflow minimum requirements for this software are as follows:

Interpretation Must Haves:

- Interpret 2D and 3D seismic o Horizon picking and extraction o Fault picking and extraction o Multiple line correlation o Intersection planes o Filtering to highlight seismic frequencies o Attribute manipulation and extraction to include but not limited to:

Amplitude Coherence Acoustic Impedance RMS Amplitude

- Build velocity models for time to depth conversion o Generate synthetics from well logs o Use stacking and processing velocity information o Multiple velocity modelling options o Ability to convert seismic and surfaces to depth

- Generate surfaces based on extracted/picked faults and horizons o Ability to control contouring and gridding algorithms with multiple algorithms to select from the interpretation tools o Ability to shift surfaces vertically and use surface snapping o Ability to filter input data on specific subsurface criteria or interpreter

- Well log analysis o Display, manipulate, and correlate numerous wells, logs, surface markers, zones, and associated data o Display seismic within log interpretation correlations o Tie wells to seismic lines and extract traces along wellbore path o Apply calculations and limits to logs to generate rock properties and pay determinations o Build and display cross-plots

- Create quality final maps and plotting products e.g. well logs

Data Management Must Haves:

- Escalate user interpretative data to “gold”/vetted data and limit or lock editing capabilities to maintain integrity of original interpretation data

Software – Cloud (GSIS-C) IDIQ Page 7 of 68

- Ability to organize data in a meaningful, efficient. What does the database/catalogue look like, is it searchable, how is it accessed, is it files on a disc or external files on a network share?

- Capture metadata on all data types to include source, interpreter, loading parameters, intended uses and restrictions, store metadata within catalogue easily viewed when viewing or editing the data

- Load 2D seismic with detached navigation – navigation either stored in shapefiles, .83/.27 files, UKOOA files, non-standard ascii files

- Ability to customize user permissions and manipulations to specific data types and/or user roles

- Import/export data to/from external sources

- Manage and transform coordinate reference systems

- Software SME support (or action) of initial transfer of data from existing software without losing granularity/data quality (by decimating), interpretation functionality or metadata

Interpretation Nice-to-Haves:

- Blending of multiple 3D volumes

- Ability to auto-track while picking horizons

- Ability to load .tiff files (2D seismic .tiffs)

- Display and manipulate gravity, magnetic, and gradiometry data

- Basin modeling capabilities o Carbon capture/sequestration reservoir modeling properties

Data Management Nice-to-Haves:

- Ability to setup or automate external database connections (Oracle, SQL, etc.…) to import and export external data sources

- Ability to automate routine data updates/loading/syncing o Ability to use script language

- Ability to control “versioned” data/interpreted products

2.3.2 Software License, Installation, Maintenance and Support Requirements

The contractor will digitally provide the required license files, installation instructions, and installation support to BOEM geologic toolkit SMEs and identified IT personnel. The contractor will also provide updated license files if needed, e.g., due to the software and/or system upgrades, additional software or license acquisition, or license file corruption.

The initial provisioning will include support to determine best-practices and workflows to migrate stand-alone data, databases, projects, network license configurations from the current subsurface interpretation environment into an environment that has been optimally configured for the software and to support BOEM AK Region’s duty to responsibly manage offshore energy resources.

BOEM software users will have the ability to notify the software vendor of software bugs, processing, programming, errors and failures via an online ticket system or customer support phoneline. The customer support phoneline must be available during Alaska standard time-zone

Software – Cloud (GSIS-C) IDIQ Page 8 of 68 business hours (8am-5pm AKST). The notification will be logged, and the user will be notified of receipt within 24 hours. The ticket will aim to be resolved within 72 hours, if the ticket is not resolved within 72 hours, 24-hour status updates are required until the ticket is resolved, or an alternative solution has been provided and approved by the BOEM COR. The contractor will notify BOEM AK of new software version upgrades, corrections, modifications, and fixes.

Upgrades, patches, or releases will be made available to BOEM AK at the same time these modifications are made commercially available.

2.3.3 Department of the Interior (DOI) Virtual Private Cloud (VPC) Requirements

If the contractor’s proposed Software as a Service (SaaS) is not a full stack SaaS and permits alternate location installation(s), DOI’s preferred solution is hosting the software application and associated data on a private DOI Azure VPC using DOI IT staff and/or contractors to administer and manage portions of the hosting environment. Hosting the software application on the DOI VPC requires the application and data managed at the FISMA moderate level in accordance with NIST SP-800-53 revision 5. Under this scenario, DOI will procure all the required Azure licenses under an alternate mandatory contract. See Attachment A for the DOI Azure Guidelines for Prospectus Vendors. The software contractor will need to provide support, training, and a transition plan to assist DOI staff in initial software and license environment configuration, software and license upgrades and patches, and software and license administration. Once all software and licenses have been confirmed to be available to BOEM users and running as advertised, DOI and BOEM staff will manage the environment with support from the vendor as needed. All support and training will need to be available via remote screen-shares, in-person, or via phone depending on scope (e.g., complexity, est. resolution time, number of attendees). All training and support will need to be documented by the contractor as requested.

2.3.4 Cloud SaaS Requirements

If the proposed software solution is not the 2.3.3 DOI VPC as described above, the environment must be in accordance with FedRAMP and/or FISMA requirements and the contractor will need to deliver a Security Assessment Plan (SAP), a Security Assessment Report (SAR), and a Continuous Monitoring Plan (CMP). The contractor shall identify and provide all required license(s). The contractor shall provide a zero-trust phishing-resistant security plan in compliance with OMB M-22-09 “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”. The contractor will need to provide backup, recovery, and disaster recovery parameters in a disaster recovery plan to include recovery time objective (RTO), recovery point objective (RPO), and mean-time-to-recovery (MTTR). The RTO is the maximum allowable downtime to restore SaaS environment back to normal operations and includes the ability to recover files within 48 hours of request for high-value assets. The RPO is the ability to, following a triggering event, revert the system to a prior state no older than 24 hours of any specific day within a rolling two-week period. If the Alaska region is performing mission critical work (e.g., during a lease sale) these times will reduce to 24 hours and 12 hours respectively.

The contractor will need to ensure system infrastructure is able to support on-demand fluctuations with minimal impact to software performance. SaaS performance metrics may include access to ongoing performance and resource usage, access to log files generated by the software for software usage, tracking of SaaS incident reports and ticket resolution time to

Software – Cloud (GSIS-C) IDIQ Page 9 of 68 ensure compliance with service level agreement and others as deemed necessary.

In accordance with FISMA requirements, the contractor will provide security for non-standard and routine data transfers during the migration to the SaaS environment; provide support for specified auditable or FOIA events pertaining to BOEM subsurface data, interpretations, and information; and provide BOEM with responsibility requirements should end-of-life, repurchasing, or decommissioning of services occur. BOEM data will routinely be identified by BOEM SMEs and communicated through the COR for transfer from the SaaS environment to a DOI file storage environment. SaaS proposals will need to include cost for storage size, storage type, and data transfers to/from/between environments. Through-out the period of performance, the contractor will be responsible for software environment configurations and upgrades while BOEM staff will manage and maintain ownership of subsurface data, interpretation workflows, and interpretation products.

Software – Cloud (GSIS-C) IDIQ Page 10 of 68

SECTION 3

GENERAL TERMS AND CONDITIONS

3.1 ORDERING PERIOD/PERIOD OF PERFORMANCE

The ordering period/period of performance for this Indefinite Delivery-Indefinite Quantity (IDIQ) contract consists of 60 months (or five (5) years). The anticipated period of performance for this IDIQ shall be as follows:

Contract Year 1: 1 August 2024 through 31 July 2025 Contract Year 2: 1 August 2025 through 31 July 2026 Contract Year 3: 1 August 2026 through 31 July 2027 Contract Year 4: 1 August 2027 through 31 July 2028 Contract Year 5: 1 August 2028 through 31 July 2029

Work on issued Task Orders may extend beyond the period of performance of this IDIQ;

however, no new Task Orders may be issued once the IDIQ has expired.

3.3 PLACE OF PERFORMANCE

The primary place of performance will be specified in the individual Task Orders issued under this IDIQ. It is anticipated the majority of the work will be performed at the Contractor’s location or partner’s facilities as appropriate. Teleconferences or videoconferences will be coordinated between the Contractor and the Contracting Officer’s Representative as necessary.

3.4 ADMINISTRATIVE POINTS OF CONTACT

3.4.1 Contracting Officer (CO): The CO for this effort is as follows:

Dave Villani U.S. Department of the Interior Bureau of Safety and Environmental Enforcement 45600 Woodland Road, Sterling, VA 20166 Phone: 703-787-1756 Email: david.villani@bsee.gov

3.4.2 Contracting Officer’s Representative (COR): The COR for this effort is as follows:

To be announced at time of award U.S. Department of the Interior Bureau of Ocean Energy Management Alaska Regional Office Environmental Sciences Management 3801 Centerpoint Drive, Mailstop AM 500, Anchorage, AK 99503 Phone: TBD

Software – Cloud (GSIS-C) IDIQ Page 11 of 68

Email: TBD

3.5 DIAR 1452.201-70 AUTHORITIES AND DELEGATIONS (SEP 2011)

(a) The Contracting Officer is the only individual authorized to enter into or terminate this contract, modify any term or condition of this contract, waive any requirement of this contract, or accept nonconforming work.

(b) The Contracting Officer will designate a Contracting Officer's Representative (COR) at time of award. The COR will be responsible for technical monitoring of the contractor's performance and deliveries. The COR will be appointed in writing, and a copy of the appointment will be furnished to the Contractor. Changes to this delegation will be made by written changes to the existing appointment or by issuance of a new appointment.

(c) The COR is not authorized to perform, formally or informally, any of the following actions:

(1) Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change this contract;

(2) Waive or agree to modification of the delivery schedule;

(3) Make any final decision on any contract matter subject to the Disputes Clause;

(4) Terminate, for any reason, the Contractor's right to proceed;

(5) Obligate in any way, the payment of money by the Government.

(d) The Contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum. The Contractor need not proceed with direction that it considers to have been issued without proper authority. The Contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the COR has taken an action or has issued direction (written or oral) that the Contractor considers to exceed the COR's appointment, within 3 days of the occurrence. Unless otherwise provided in this contract, the Contractor assumes all costs, risks, liabilities, and consequences of performing any work it is directed to perform that falls within any of the categories defined in paragraph (c) prior to receipt of the Contracting Officer's response issued under paragraph (e) of this clause.

(e) The Contracting Officer shall respond in writing within 30 days to any notice made under paragraph (d) of this clause. A failure of the parties to agree upon the nature of a direction, or upon the contract action to be taken with respect thereto, shall be subject to the provisions of the Disputes clause of this contract.

(f) The Contractor shall provide copies of all correspondence to the Contracting Officer and the

COR.

(g) Any action(s) taken by the Contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the COR acting within his or her appointment, shall be at the Contractor's risk.

Software – Cloud (GSIS-C) IDIQ Page 12 of 68

3.6 INVOICE FREQUENCY AND PAYMENTS

Invoices shall be submitted based upon delivery and acceptance of the tasks performed as proposed and agreed to by the Government in accordance with Section 1.4 – Partial Delivery Payment Schedule via the Internet Payment Platform (IPP) as delineated in Section 3.5.1 below.

3.6.1 Invoice Submission Instructions

Electronic Invoicing and Payment Requirements - Internet Payment Platform (IPP) (February 2021)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Products and Commercial Services included in commercial contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice:

1. Detailed invoice(s) as an attachment to the IPP showing:

a. Documentation required by FAR 32.905(b)

b. For FFP Orders:

i. Deliverable and Price

c. For Level-of-Effort Term, Labor-Hour, and Time-and-Materials Orders:

i. Description of the supplies or services provided and date;

ii. All invoices and receipts for ODCs billed; and

iii. Certification of time worked for employees billed under the order.

d. Any travel shall be submitted with supporting documentation in accordance with the Federal Travel Regulation.

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award date. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

Software – Cloud (GSIS-C) IDIQ Page 13 of 68

3.6.2 Invoice Frequency and Payments

Invoices shall be submitted no more than monthly based upon the payment provisions specified in the individual Task or Deliver Orders issued under this IDIQ in accordance with Section 3.6.1 above.

3.7 CONTRACTOR PROJECT MANAGER

The Contractor shall provide a designated Program Manager (PM) for the IDIQ to facilitate Government-Contractor communications. The PM shall be the primary technical and managerial interface between the Contractor, the CO, and the COR.

The IDIQ Program Manager is: [To be provided as part of the Offeror’s proposal.]

The Contractor shall be responsible for managing and overseeing the activities of all Contractor personnel, as well as subcontractor efforts used in performance of any and all Task Orders issued under this IDIQ. The Contractor’s management responsibilities shall include all the activities necessary to ensure the accomplishment of timely and effective tasks, deliverables, and support, performed in accordance with the requirements contained herein and any individual Task Orders.

The PM shall have fully authority to act for the Contractor in the performance of the required services. The PM shall meet with the COR to discuss problem areas as they occur. The PM, or designated representative, shall respond within four hours after notification of the existence of a problem The PM, and all designated representatives, shall be able to fluently read, write, and speak the English language.

3.8 ORDERING PROCEDURES AND LIMITATIONS

All Task or Delivery Orders issued under this IDIQ will be in writing and signed by an authorized BSEE Contracting Officer. The Government will not reimburse the Contractor for the costs of preparing quotations for Task or Delivery Orders. The Contracting Officer will request written technical and price quotations from the IDIQ holder in accordance with FAR 16.505. The Request for Quotation for each Task or Delivery Order will specify the pertinent requirements and quotation instructions, such as the following:

Deadline for submission of the quotation Statement of Objectives (Background, Objectives, and Specific Tasking) Specifications for Deliverables Location of Performance Period of Performance Government Furnished Items, if available Detailed instructions for the quotation Evaluation Factors for Task or Delivery Order award

The Contractor will provide a written quotation no later than the deadline specified in the Task or Delivery Order Request for Quotation. The Task or Delivery Order quotation will be evaluated

Software – Cloud (GSIS-C) IDIQ Page 14 of 68 by the Government based upon the Evaluation Factors specified in the Request for Quotations (such as technical approach, price, and other criteria) to determine whether the price is fair and reasonable and in the best interests of the Government.

3.8.1 Minimum Order Consideration: The minimum order consideration under this IDIQ is $500,000.00 worth of Task or Delivery Orders, in accordance with FAR Clause 52.216-22, Indefinite Quantity.

3.8.2 Maximum Order Amount: The maximum total amount for all task or delivery orders issued under this IDIQ is $2,500,000.00.

3.9 DOI-AAAP-0050, v02 CONTRACTOR PERFORMANCE ASSESSMENT

REPORTING SYSTEM (DEC 2015)

1) FAR 42.1502 directs all Federal agencies to collect past performance information on contracts. The Department of the Interior (DOI) has implemented the Contractor Performance Assessment Reporting System (CPARS) to comply with this regulation.

One or more past performance evaluations will be conducted to record your contract performance as required by FAR 42.15.

2) The past performance evaluation process is a totally paperless process using CPARS.

CPARS is a web-based system that allows for electronic processing of the performance evaluation report. Once the report is processed, it is available in the Past Performance Information Retrieval System (PPIRS) for Government use in evaluating past performance as part of a source selection action.

3) We request that you furnish the Contracting Officer (CO) with the name, position title, phone number, and email address for each person designated to have access to your firm's past performance evaluation(s) for the contract no later than 30 days after award. Each person granted access will have the ability to provide comments in the Contractor portion of the report and state whether or not the Contractor agrees with the evaluation, before returning the report to the Assessing Official (AO). Information in the report must be protected as source selection sensitive information not releasable to the public.

4) When your Contractor Representative(s) are registered in CPARS, they will receive an automatically generated email with detailed login instructions. Further details, systems requirements, and training information for CPARS is available at https://www.cpars.gov/.

5) Within 60 days after the end of a performance period, the AO will complete an interim or final past performance evaluation, and the report will be accessible at https://www.cpars.gov/.

a) Contractor Representatives may then provide comments in response to the evaluation or return the evaluation without comment.

Software – Cloud (GSIS-C) IDIQ Page 15 of 68

b) Your comments should focus on objective facts in the AO's narrative and should provide your views on the causes and ramifications of the assessed performance.

c) All information provided should be reviewed for accuracy prior to submission.

d) If you elect not to provide comments, please acknowledge receipt of the evaluation by indicating "No comment" in the space provided, and then selecting “Accept the Ratings and Close the Evaluation”.

e) Your response is due within 60 calendar days after receipt of the CPAR. On day 15, the evaluation will become available in PPIRS-RC marked as “Pending” with or without comments and whether or not it has been closed.

f) If you do not sign and submit the CPAR within 60 days, it will automatically be returned to the Government and will be annotated: "The report was delivered/received by the contractor on (date). The contractor neither signed nor offered comment in response to this assessment."

6) The following guidelines apply concerning your use of the past performance evaluation:

a) Protect the evaluation as source selection information. After review, transmit the evaluation by completing and submitting the form through CPARS. If for some reason you are unable to view and/or submit the form through CPARS, contact the CO for instructions.

b) Strictly control access to the evaluation within your organization. Ensure the evaluation is never released to persons or entities outside of your control.

c) Prohibit the use of or reference to evaluation data for advertising, promotional material, pre-award surveys, responsibility determinations, production readiness reviews, or other similar purposes.

7) If you wish to discuss a past performance evaluation, you should request a meeting in writing to the CO no later than seven days following your receipt of the evaluation.

The meeting will be held in person or via telephone or other means during your 60-day review period.

8) A copy of the completed past performance evaluation will be available in CPARS for your viewing and for Government use supporting source selection actions after it has been finalized.

3.10 DATA USE, DISCLOSURE OF INFORMATION, AND HANDLING OF

SENSITIVE INFORMATION

The Contractor shall maintain, transmit, retain in strictest confidence, and prevent the unauthorized duplication, use, and disclosure of information. The Contractor shall provide information only to employees, Contractors, and subcontractors having a need to know such information in the performance of their duties for this project.

Software – Cloud (GSIS-C) IDIQ Page 16 of 68

Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the CO.

If public information is provided to the Contractor for use in performance or administration of this effort, the Contractor except with the written permission of the CO may not use such information for any other purpose.

If the Contractor is uncertain about the availability or proposed use of information provided for the performance or administration, the Contractor will consult with the COR regarding use of that information for other purposes.

The Contractor agrees to assume responsibility for protecting the confidentiality of Government records which are not public information. Each employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

Each employee shall sign the non-disclosure agreement form as provided at Attachment B, and the Contractor shall submit the signed form to the CO prior to the employee’s information access.

Performance of this effort may require the Contractor to access and use data and information proprietary to a Government agency or Government contractor which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others.

Contractor and/or contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorized Government personnel or upon written approval of the CO. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort. Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations or prohibit an agreement at no cost to the Government between the Contractor and the data owner that provides for greater rights to the Contractor. All data received, processed, evaluated, loaded, and/or created as a result of this task order shall remain the sole property of the Government unless specific exception is granted by the CO.

3.11 INFORMATION SECURITY

The term “sensitive information” means any information which warrants a degree of protection and technical, operational, and administrative control as defined by DOI or that meets the criteria for exemption from public disclosure set forth under Sections 552 and 552a of Title 5, United States Code: The Freedom of Information Act and the Privacy Act. Sensitive information is generally categorized as For Official Use Only (FOUO) and shall include other unclassified information and proprietary data (The protection of classified information is beyond the scope of this clause. If any work on classified information is required under this contract, it is addressed under other task order clauses). The Contractor shall protect this type of information from

Software – Cloud (GSIS-C) IDIQ Page 17 of 68 unauthorized release into public domain, or to unauthorized persons, organizations, or subcontractors. Information which, either alone or in aggregate, is deemed sensitive or proprietary by the DOI shall be protected as instructed by BSEE in accordance with the magnitude of the loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. All provisions of this clause also apply to all subcontractors that are performing under this contract.

3.12 NON-DISCLOSURE AGREEMENT

No Contractor employees may start work under this order until they have signed the required non-disclosure statement (See Attachment B).

During the period of performance of the contract, the Contractor might acquire access to confidential data, which is the sole property of the Department of the Interior and/or BSEE.

Each contractor agrees to sign, and have its personnel sign a non-disclosure agreement, and to maintain the confidentiality of all such data and to not disclose any data, interpretations of, and/or derivatives of, such data to any unauthorized party without the express written approval of the CO. The Contractor hereby agrees to include this clause in all subcontracts or consulting agreements relating to work under this contract, and further agrees to have its employees and subcontractor employees sign a “non-disclosure” agreement to be retained by the CO.

The Contractor shall maintain in strictest confidence all information received from the government and other parties in association with this contract unless expressly authorized otherwise by the Government. The Contractor shall share such information only with employees, contractors, and subcontractors having a need to know the information in the performance of their duties under this contract.

Information made available to the Contractor by the government pertaining to this contract shall be used only in the performance or administration of the contract and shall not be used in any other way without the written consent of the CO. The Contractor agrees to assume responsibility for protecting the confidentiality of materials that the Government or other parties submit to the Contractor that are not to be made available to the public. In making available or disclosing such information to the Contractor or its agents the government and other parties will state in writing that the information is to be maintained as confidential. The Contractor shall inform all entities to whom such information is made available or disclosed to enable performance under this contract that the information may be disclosed only for the purposes of performing under this contract and in accordance with its terms.

Performance of the tasks under this contract may require the Contractor to access and use information that is proprietary and of such a nature that its dissemination or use, other than in the performance of these tasks, would be adverse to the interests of the government or others. The Contractor and Contractor personnel shall not divulge or release such proprietary information until it is made public by the government (exceptions may be made for disclosing data to authorized government personnel or in other cases in which the CO gives written approval to do so). The Contractor shall not use, disclose, or reproduce proprietary information that bears a restrictive label or legend other than as required for performance of the tasks under this contract.

Software – Cloud (GSIS-C) IDIQ Page 18 of 68

Nothing in this contract shall preclude the use of any information independently acquired by the Contractor without such limitations or prohibit an agreement at no cost to the government between the Contractor and the information owner that provides greater rights to the Contractor.

All information received, processed, evaluated, loaded, or created as a result of this contract shall remain the sole property of the government unless specific exception is granted by the CO.

If the Contractor is uncertain about the availability or proposed use of information provided by the government and other parties under this contract, the Contractor will consult with the COR regarding the handling and use of that information.

3.13 RELEASE OF INFORMATION

No release (including photographs and films, public announcements, denial or confirmation of same) on any part of the subject matter of this effort shall be made without the prior written approval of the CO.

3.14 INTERNET PROTOCOL VERSION 6 (JUN 2012)

(a) Any system hardware, software, firmware and/or networked component (voice, video or data) developed, procured, or acquired in support and/or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

(b) Specifically, any new IP product or system developed, acquired, or produced must:

(1) Interoperate with both IPv6 and IPv4 systems and products, and

(2) Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

(c) As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government. The Contractor shall retrofit all non-IPv6 capable equipment, as defined above, that is fielded under this contract with IPv6 capable equipment, at no additional cost to the Government.

(d) The contractor shall provide technical support for both IPv4 and IPv6.

(e) Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

(f) Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at

Software – Cloud (GSIS-C) IDIQ Page 19 of 68 no additional cost to the Government.

3.15 DOI IT BASELINE COMPLIANCE CONTRACT GUIDELINES

(a) Information systems and system services provided to the DOI by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance (see References section of this clause).

(b) Contractors and information system service providers shall be responsible for recognizing and reporting security incidents.

(c) Contractors shall comply with the requirements of the Privacy Act of 1974 and shall not remove personally identifiable information (PII) or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity.

(d) Products, platforms, and services delivered as part of a contract statement of work that use information and communication technology (ICT), shall conform to the ICT Accessibility Revised 508 Standards of the Rehabilitation Act.

(e) Contractors shall comply with all applicable records management laws and regulations that includes National Archives and Records Administration (NARA) records guidance and departmental policy.

(f) Acquired services shall comply with the Homeland Security Presidential Directive-12 that requires all federal entities to ensure that all Contractor employees have current and approved security background investigations that are equivalent to investigations performed with the federal employee workforce.

(g) Contractors must manage Controlled Unclassified Information (CUI) in accordance with applicable laws, regulations, executive orders, and policies.

(h) If a portion of the contract requirement seeks information from ten or more members of the public, the Contactor employees shall work with the Bureau Information Collection Clearance Officer to obtain a Paperwork Reduction Act clearance from the Office of Management and Budget (OMB).

References

Federal Information Security Modernization Act of 2014 (FISMA):

https://www.cisa.gov/federal-information-security-modernization-act

Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems: https://www.fedramp.gov

Section 208 of the E-Government Act of 2002:

https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf

Privacy Act of 1974: https://www.justice.gov/opcl/privacy-act-1974

Software – Cloud (GSIS-C) IDIQ Page 20 of 68

Federal Information Processing Standards (FIPS) and the National Institute of Standards and Technology (NIST) 800-Series Special Publications (SP):

https://www.nist.gov

Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource: https://www.cio.gov/policies-and-priorities/circular-a-130/ NIST Computer Security Resource Center Glossary Terms and Definitions:

https://csrc.nist.gov/glossary

3.16 CLAUSES

3.16.1 In accordance with FAR 52.252-2, this solicitation incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. The Contractor shall comply with these clauses unless the circumstances do not apply. Upon request, the Contracting Officer will make their full text available. The full text of a clause may be accessed electronically at https://www.acquisition.gov/far/.

CLAUSE TITLE

52.203-12 Limitation on Payments to Influence Certain Federal Transactions (JUN 2020) 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper (MAY

2011) 52.204-13 System for Award Management Maintenance (OCT 2018) 52.204-18 Commercial and Government Entity Code Maintenance (AUG 2020) 52.204-19 Incorporation by Reference of Representations and Certifications (DEC 2014) 52.212-4 Contract Terms and Conditions - Commercial Products and Commercial Services

(NOV 2023)

52.227-14 Rights in Data-General (MAY 2014) 52.227-19 Commercial Computer Software License (DEC 2007) 52.232-7 Payments Under Time-and-Materials and Labor-Hour Contracts (NOV 2021)

3.16.2 The following FAR clauses as required by the Federal Acquisition Regulations are attached hereto in full text.

3.16.2.1 FAR 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT

ORDERS – REPRESENTATION AND DISCLOSURES (DEC 2023)

(a) Definitions. As used in this provision, Covered article, FASCSA order, Intelligence community, National security system, Reasonable inquiry, Sensitive compartmented information, Sensitive compartmented information system, and Source have the meaning provided in the clause 52.204-30, Federal Acquisition Supply Chain Security Act Orders— Prohibition.

(b) Prohibition. Contractors are prohibited from providing or using as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the prohibition is set out in an applicable Federal Acquisition Supply Chain Security Act (FASCSA) order, as described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

Software – Cloud (GSIS-C) IDIQ Page 21 of 68

(c) Procedures. (1) The Offeror shall search for the phrase “FASCSA order” in the System for Award Management (SAM)( https://www.sam.gov) for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders— Prohibition.

(2) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM, but are effective and do apply to the solicitation and resultant contract (see FAR 4.2303(c)(2)).

(3) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(d) Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror…