Attachment 1 - SF - 1449 V2.pdf

15F06720R0000205 Page 1 of 15

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 & 30

1. REQUISITION NUMBER

5. SOLICITATION NUMBER

15F06720R0000205

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 6. SOLICITATION ISSUE

DATE

06/15/2020

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls) 8. OFFER DUE DATE / LOCAL

TIME

07/16/2020 12:00:00

CODE 15F067

FEDERAL BUREAU OF INVESTIGATION

PSAU - PROFESSIONAL SERVICES ACQUISITION UNIT

935 PENNSYLVANIA AVE, NW

WASHINGTON, DC 20535-0001

9. ISSUED BY X UNRESTRICTED OR SET ASIDE: % FOR

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS: 621498

SIZE STANDARD: $20.5M

10. THE ACQUISITION IS

SEE

SCHEDULE

11. DELIVERY FOR FOB DESTINATION

UNLESS BLOCK IS MARKED

NET 30

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER DPAS

(15 CFR 700)

13b. RATING

X RFQ IFB RFP

14. METHOD OF SOLICITATION

CODE15. DELIVER TO

SEE SCHEDULE

CODE 15F06716. ADMINISTERED BY

FEDERAL BUREAU OF INVESTIGATION

PSAU - PROFESSIONAL SERVICES ACQUISITION UNIT

935 PENNSYLVANIA AVE, NW

WASHINGTON, DC 20535-0001

FACILITY

CODE

CODE

TELEPHONE NO.

17a. CONTRACTOR/

OFFEROR

1200CODE18a. PAYMENT WILL BE MADE BY

SUBMIT ALL INVOICES VIA EMAIL TO

CENTRAL_INVOICES@FBI.GOV

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER SEE ADDENDUM

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS

CHECKED

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

0001 Firm Fixed Price Fitness For Duty - See Attached Model Task Order for CLIN structure and Statement of Work for service description

PSC: Q999

See Continuation Sheet(s) (Use Reverse and/or Attach Additional Sheets as Necessary)

0.000000 $________________ $_________________

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE X ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

X 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: REF. _____________________________ OFFER

DATED _________________ . YOUR OFFER ON SOLICITATION (BLOCK 5)

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH HEREIN,

IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (TYPE OR PRINT)

Joaquin Jarreau Tucker

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

Joaquin J. Tucker 6/19/2020

15F06720R0000205 Page 2 of 15

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _________________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

PARTIAL FINAL

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

COMPLETE PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

15F06720R0000205 Page 3 of 15

Table of Contents

Section Description Page Number

1 Solicitation/Contract Form 2 Commodity or Services Schedule 3 Contract Clauses

DJAR-PGD-07-12 Maintaining Contractor Performance During a Pandemic or Other Emergency DJAR-PGD-08-04 Security of Systems and Data, Including Personally Identifiable Information FBI-0003 Contracting Officer's Security Representative (COSR) - Contract Security Requirements from Acquisition Security Unit (ASU) FBI-0006 (U) Contractor Suitability Special Security Requirement (SSR) FBI-0007 DOJ Security of Systems and PII - Procurement Section Directive (PSD): 11-24.101 FBI-0008 Financial Disclosure - Contract Security Requirements from Acquisition Security Unit

(ASU)

FBI-0009 Personnel Security - Contract Security Requirements from Acquisition Security Unit

(ASU)

FBI-0010 Warrantless Search - Contract Security Requirements from Acquisition Security Unit

(ASU)

FBI-0013 e-QIP - Contract Security Requirements from Acquisition Security Unit (ASU), Procurement Section Directive (PSD): 09-22.18 52.217-8 Option to Extend Services (Nov 1999) 52.217-9 Option to Extend the Term of the Contract (Mar 2000) FBI-0001 Small Business Accelerated Payment FBI-0004 DOJ Residency Requirement - Contract Security Requirements from Acquisition Security Unit (ASU)

4 List of Attachments 5 Solicitation Provisions

FBI-0005 Source Selection Evaluation Board - Contract Security Requirements from Acquisition Security Unit (ASU)

15F06720R0000205 Page 4 of 15

Section 2 - Commodity or Services Schedule

SCHEDULE OF SUPPLIES/SERVICES

CONTINUATION SHEET

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE FEES AMOUNT

Line Period of Performance: 09/01/2020 - 08/31/2021

15F06720R0000205 Page 5 of 15

Section 3 - Contract Clauses

A.1 ADDENDUM TO FAR 52.212-4, Contract Terms and Conditions-Commercial Items (Oct 2018)

The terms and conditions for the following clauses are hereby incorporated into this solicitation and resulting contract as an addendum to FAR clause 52.212-4.

Clauses By Reference

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): www.acquisition.gov

Clause Title Fill-ins (if applicable)

52.242-15 Stop-Work Order (Aug 1989)

52.222-26 Equal Opportunity (Sept 2016)

52.225-13 Restrictions on Certain Foreign Purchases (June 2008)

52.233-1 Disputes (May 2014)

52.233-4 Applicable Law for Breach of Contract Claim (Oct 2004)

52.244-6 Subcontracts for Commercial Items (Aug 2019)

52.212-4 Contract Terms and Conditions-Commercial Items (Oct 2018)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or

Executive Orders--Commercial Items (Oct 2019)

(b)(2): "X"

(b)(3): "X"

(b)(7): "X"

(b)(8): "X"

(b)(16): "X"

(b)(17)(i): "X"

(b)(25): "X"

(b)(26): "X"

(b)(27): "X"

(b)(28)(i): "X"

(b)(29)(i): "X"

15F06720R0000205 Page 6 of 15

Clause Title Fill-ins (if applicable)

(b)(30)(i): "X"

(b)(33)(i): "X"

(b)(34): "X"

(b)(45)(i): "X"

(b)(58): "X"

52.224-2 Privacy Act (Apr 1984)

52.232-22 Limitation of Funds (Apr 1984)

52.232-25 Prompt Payment (Jan 2017)

52.243-1 Changes-Fixed-Price (Aug 1987)

52.249-2 Termination for Convenience of the Government (Fixed-Price) (Apr

2012)

Clauses By Full Text

DJAR-PGD-07-12 Maintaining Contractor Performance During a Pandemic or Other Emergency

Continuing Contract Performance During a Pandemic Influenza or other National Emergency  

During a Pandemic or other emergency we understand that our contractor workforce will experience the same high levels of absenteeism as our federal employees. Although the Excusable Delays and Termination for Default clauses used in government contracts list epidemics and quarantine restrictions among the reasons to excuse delays in contract performance, we expect our contractors to make a reasonable effort to keep performance at an acceptable level during emergency periods.

 

The Office of Personnel Management (OPM) has provided guidance to federal managers and employees on the kinds of actions to be taken to ensure the continuity of operations during emergency periods. This guidance is also applicable to our contract workforce.

Contractors are expected to have reasonable policies in place for continuing work performance, particularly those performing mission critical services, during a pandemic influenza or other emergency situation.

 

The types of actions a federal contractor should reasonably take to help ensure performance are:

Encourage employees to get inoculations or follow other preventive measures as advised by the public health service.

Contractors should cross-train workers as backup for all positions performing critical services. This is particularly important for work such as guard services where telework is not an option.

• Implement telework to the greatest extent possible in the workgroup so systems are in place to support successful remote work in an emergency.

• Communicate expectations to all employees regarding their roles and responsibilities in relation to remote work in the event of a pandemic health crisis or other emergency.

Establish communication processes to notify employees of activation of this plan.

• Integrate pandemic health crisis response expectations into telework agreements.

With the employee, assess requirements for working at home (supplies and equipment needed for an extended telework period).

Security concerns should be considered in making equipment choices; agencies or contractors may wish to avoid use of employees' personal computers and provide them with PCs or laptops as appropriate.

• Determine how all employees who may telework will communicate with one another and with management to accomplish work.

Practice telework regularly to ensure effectiveness.

• Make it clear that in emergency situations, employees must perform all duties assigned by management, even if they are outside usual or customary duties.

• Identify how time and attendance will be maintained.

It is the contractor's responsibility to advise the government contracting officer if they anticipate not being able to perform and to work with the Department to fill gaps as necessary. This means direct communication with the contracting officer or in his/her absence, another responsible person in the contracting office via telephone or email messages acknowledging the contractors notification.

15F06720R0000205 Page 7 of 15

 

The incumbent contractor is responsible for assisting the Department in estimating the adverse impacts of nonperformance and to work diligently with the Department to develop a strategy for maintaining the continuity of operations.

(End of Clause)

DJAR-PGD-08-04 Security of Systems and Data, Including Personally Identifiable Information

Security of Systems and Data, Including Personally Identifiable Data.

a. Systems Security The work to be performed under this contract requires the handling of data that originated within the Department, data that the contractor manages or acquires for the Department, and/or data that is acquired in order to perform the contract and concerns Department programs or personnel.

For all systems handling such data, the contractor shall comply with all security requirements applicable to Department of Justice systems, including but not limited to all Executive Branch system security requirements (e.g., requirements imposed by OMB and NIST), DOJ IT Security Standards, and DOJ Order 2640.2E. The contractor shall provide DOJ access to and information regarding the contractor's systems when requested by the Department in connection with its efforts to ensure compliance with all such security requirements, and shall otherwise cooperate with the Department in such efforts. DOJ access shall include independent validation testing of controls, system penetration testing by DOJ, FISMA data reviews, and access by the DOJ Office of the Inspector General for its reviews.

The use of contractor-owned laptops or other media storage devices to process or store data covered by this clause is prohibited until the contractor provides a letter to the contracting officer (CO) certifying the following requirements:

1. Laptops must employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 approved product;

2. The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism;

4. The contractor shall log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required. All DOJ information is sensitive information unless designated as non-sensitive by the Department;

5. Contractor-owned removable media, such as removable hard drives, flash drives, CDs, and floppy disks, containing DOJ data, shall not be removed from DOJ facilities unless encrypted using a NIST FEPS 140-2 approved product;

6. When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed, or destroyed) in accordance with security requirements applicable to DOJ;

7. Contracting firms shall keep an accurate inventory of devices used on DOJ contracts;

8. Rules of behavior must be signed by users. These rules shall address at a minimum: authorized and official use; prohibition against unauthorized users; and protection of sensitive data and personally identifiable information;

9. All DOJ data will be removed from contractor-owned laptops upon termination of contractor work. This removal must be accomplished in accordance with DOJ IT Security Standard requirements. Certification of data removal will be performed by the contractor's project manager and a letter confirming certification will be delivered to the CO within 15 days of termination of contractor work;

b. Data Security

By acceptance of, or performance on, this contract, the contractor agrees that with respect to the data identified in paragraph a, in the event of any actual or suspected breach of such data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the contractor will immediately (and in no event later than within one hour of discovery) report the breach to the DOJ CO and the contracting officer's technical representative

(COTR).

If the data breach occurs outside of regular business hours and/or neither the CO nor the COTR can be reached, the contractor shall call the DOJ Computer Emergency Readiness Team (DOJCERT) at 1-866-US4-CERT (1-866-874-2378) within one hour of discovery of the breach. The contractor shall also notify the CO as soon as possible during regular business hours.

c. Personally Identifiable Information Notification Requirement

The contractor further certifies that it has a security policy in place that contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification shall be coordinated with the Department, and shall not proceed until the Department has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by the contractor

15F06720R0000205 Page 8 of 15 shall be coordinated with, and be subject to the approval of, the Department. The contractor assumes full responsibility for taking corrective action consistent with the Department's Data Breach Notification Procedures, which may include offering credit monitoring when appropriate.

d. Pass-through of Security Requirements to Subcontractors The requirements set forth in Paragraphs a through c above, apply to all subcontractors who perform work in connection with this contract. For each subcontractor, the contractor must certify that it has required the subcontractor to adhere to all such requirements.

Any breach by a subcontractor of any of the provisions set forth in this clause will be attributed to the contractor.

B. Information Resellers or Data Brokers

For contracts where the Department obtains PII from a contractor (such as an information reseller or data broker) but the contractor does not handle the data described in Section A of this guidance document, the following clause must be used:

Information Resellers or Data Brokers

Under this contract, the Department obtains personally identifiable information about individuals from the contractor. The contractor hereby certifies that it has a security policy in place which contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, lost or acquired by an unauthorized person while the data is under the control of the contractor. In any case in which the data that was lost or improperly acquired reflects or consists of data that originated with the Department, or reflects sensitive law enforcement or national security interest in the data, the contractor shall notify the Department contracting officer so that the Department may determine whether notification would impede a law enforcement investigation or jeopardize national security. In such cases, the contractor shall not notify the individuals until it receives further instruction from the Department.

(End of Clause)

FBI-0003 Contracting Officer's Security Representative (COSR) - Contract Security Requirements from Acquisition Security Unit

(ASU)

COSR are the designated representatives of the CO and derives their authorities directly from the CO. They are responsible for certifying the contractor’s capability for handling classified material and ensuring that customer security policies and procedures are met. The COSR is the focal point for the contractor, CO, and COR regarding security issues. The COSR cannot initiate any course of action that may alter the terms of the contract. The COSR is UC Saunders and can be reached on (202) 220-9230. The provisions of this clause shall apply to the extent that any aspect of this contract requires the contractor to access classified, of Sensitive But Unclassified and/or Law Enforcement Sensitive information. If, subsequent to the date of this contract, the security requirements under this contract are changed by the FBI, as provided in this clause, and the security costs or time required for delivery under this contract are thereby increased or decreased, the contract price, delivery schedule, or both, and any other provision of this contract which may be affected shall be subject to an equitable adjustment in accordance with the procedures in the Changes clause of this contract.

FBI-0006 (U) Contractor Suitability Special Security Requirement (SSR)

Access to FBI facilities and information is subject to specific security and suitability requirements. The FBI reserves the right and prerogative to deny and/or restrict facility and information access of any contractor employee determined by the FBI, at any time prior to or during performance, to be unsuitable for access and/or present a risk of compromising sensitive government information to which he or she would have access to under this contract. Contractors will be allotted a reasonable amount of time, determined by the government, to replace the employee found not suitable for contract performance. Failure to replace the employee may result in a no cost termination by the government.

FBI-0007 DOJ Security of Systems and PII - Procurement Section Directive (PSD): 11-24.101

On 3/20/2008, the Senior Procurement Executive, DOJ, notified the FBI of requirements for addressing Department systems and data, including provisions governing the use of laptops by contractors which are to be included in all current and future contracts where a contractor handles data that originated within the Department, data that the contractor manages or acquires for the Department, and/ or data that is acquired in order to perform on the contract and concerns Department programs or personnel. Effective immediately if a procurement is expected to result in the acquisition of services where the contractor handles data that originated within the Department, data that the contractor manages or acquires for the Department, and/or data that is acquired in order to perform the contract and concerns Department programs or personnel procurement officials are required to incorporate the appropriate special security requirements. It should be noted that within Section A, paragraphs a, b, and d apply to all data, even data that may not be

15F06720R0000205 Page 9 of 15 personally identifiable information (PII). Section B sets forth special security requirements that must be used in contracts involving PII obtained by the Department from a contractor, such as an information seller or data broker. A request for a wavier from the requirement to include these special security requirements, or deviations from the language (except those that are more stringent), must be made in writing to the Senior Procurement Executive. Permission for a deviation or waiver will only be granted in unusual circumstances.

INFORMATION TO BE INCLUDED IN CONTRACT: 1.2 Special Security Requirements: A. Security of Systems and Data, Including Personally Identifiable Data: a. Systems Security: The work to be performed under this contract requires the handling of data that originated within the Department of Justice, data that the contractor manages or acquires for the Department, and/or data that is acquired in order to perform the contract and concerns Department programs or personnel. For all systems handling such data, the contractor shall comply with all security requirements applicable to Department of Justice systems, including but not limited to all Executive Branch system security requirements (e.g. requirements imposed by OMB and NIST), DOJ IT Security Standards, and DOJ Order 2640.2E. The contractor shall provide DOJ access to and information regarding the contractor's systems when requested by the Department in connection with its efforts to ensure compliance with all such security requirements, and shall otherwise cooperate with the Department in such efforts. DOJ access shall include independent validation testing of controls, system penetration testing by DOJ, FISMA data reviews and access by the DOJ Office of the Inspector General for its reviews. The use of contractor-owned laptops or other media storage devices to process or store data covered by this clause is prohibited until the contractor provides a letter to the Contracting Officer (CO) certifying the following requirements: 1. Laptops must employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 approved product; 2. The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date; 3. Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism; 4. The contractor shall log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required. All DOJ information is sensitive information unless designated as non-sensitive by the Department; 5. Contractor-owned removable media, such as removable hard drives, flash drives, CDs, and floppy disks, containing DOJ data, shall not be removed from DOJ facilities unless encrypted using a NIST FIPS 140-2 approved product; 6. When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed or destroyed) in accordance with security requirements applicable to DOJ; 7. Contracting firms shall keep an accurate inventory of devices used on DOJ contracts; 8. Rules of behavior must be signed by users. These rules shall address at a minimum: authorized and official use; prohibition against unauthorized users; and protection of sensitive data and personally identifiable information; 9. All DOJ data will be removed from contractor-owned laptops upon termination of contractor work. This removal must be accomplished in accordance with DOJ IT Security Standard requirements. Certification of data removal will be performed by the contractor's project management and a letter confirming certification will be delivered to the CO within 15 days of termination of contractor work; b. Data Security: By acceptance of, or performance on, this contract, the contractor agrees that with respect to the data identified in paragraph a, in the event of an actual or suspected breach of such data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the contractor will immediately (and in no event later than within one hour or discovery) report the breach to the CO and the Contracting Officer's Representative (COR). If the data breach occurs outside of regular business hours and/or neither the CO nor the COR can be reached, the contractor shall call the DOJ Computer Emergency Readiness Team (DOJCERT) at 1-866-US4-CERT (1-866-874-2378) within one hour of discovery of the breach. The contractor shall also notify the CO as soon as possible during regular business hours. c. Personally Identifiable Information Notification Requirement: The contractor further certifies that it has a security policy in place that contains procedures to promptly notify any individual whose personally identification information (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification shall be coordinated with the Department, and shall not proceed until the Department has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by the contract shall be coordinated with, and be subject to the approval of, the Department. The contractor assumes full responsibility for taking corrective action consistent with the Department's Data Breach Notification Procedures, which may include offering credit monitoring when appropriate. d. Pass-through of Security Requirements to Subcontractors: The requirements set forth in Paragraphs a through c above, apply to all subcontractors who perform work in connection with this contract. For each subcontractor, the contractor must certify that it has required the subcontractor to adhere to all such requirements. Any breach by a subcontractor of any of the provisions set forth in this clause will be attributed to the contractor. B. Information Resellers or Data Brokers: Under this contract, the Department obtains personally identifiable information about individuals from the contractor. The contractor hereby certified that it has a security policy in place which contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, lost or acquired by an unauthorized person while the data is under the control of the contractor. In any case in which the data that was lost or improperly acquired reflects or consists of data that originated with the Department, or reflects sensitive law enforcement or national security interest in the data, the contractor shall notify the Department Contracting Officer so that the Department my determine whether notification would impede a law enforcement investigation or jeopardize national security. In such cases, the contractor shall notify the individuals until it receives further instruction from the Department.

FBI-0008 Financial Disclosure - Contract Security Requirements from Acquisition Security Unit (ASU)

15F06720R0000205 Page 10 of 15

1.1 Financial Disclosure Requirements: Financial considerations and foreign travel have been identified as significant elements in recent espionage cases. In response to these threats, Executive Order 12968 established a requirement that all Executive Branch personnel who are granted access to "particularly sensitive classified information" as a condition of such access, file with the agency head an annual financial disclosure report. With the continuous dependency on contractors to support the FBI, to include access to classified information, if a procurement is expected to result in the acquisition of services involving the assignment of contractor personnel to FBI locations, access to Sensitive Compartmented Information (SCI) and access to the FBI's Secret Network (FBINET) the Program Management Officer/Contracting Officer's Representative (COR), in coordination with the assigned Chief Security Officer, are required to identify during procurement planning stages, whether an acquisition will require the anticipated contract to include the Special Security Requirement identified below.

1.2 Special Security Requirement: Security Requirements Applicable to Contractor Personnel Assigned to FBI Locations, with Access to Sensitive Compartmented Information (SCI) and the FBI Secret Network (FBINET), or those selected by the Director or Deputy Director of the FBI. Requirements are applicable to all individuals to be assigned to FBI locations, to include those identified as "Key Personnel", if specified in the contract, who will require access to FBI locations, SCI and FBINET, or those selected by the Director or Deputy Director of the FBI. Award of this contract is anticipated to result in the assignment of contractor personnel to FBI controlled or occupied space with access to SCI and the FBINET. As such, all contractor personnel assigned to such space with access to SCI and FBINET, or those selected by the Director or Deputy Director of the FBI, are required to file an annual Security Financial Disclosure Form (SFDF). Information collected through these filings is used to help make personnel security determinations including whether to allow access to classified information, sensitive areas, and equipment; or to permit assignment to sensitive national security positions. The data may be subsequently used as part of a review process to evaluate continued eligibility for access to classified information or as evidence in legal proceedings. Upon request, contractor employees required to file must: a. Submit an annual financial disclosure form electronically using the SFDF. The SFDF is a web-based form that is accessible only through the FBI Intranet. Every form submitted undergoes automated analysis, and is stored in a secure database; b. Sign and submit two consent forms: Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act, (DOJ-555) and Personnel Consent to Release Information, (FD-979) to the assigned FBI Chief Security Officer. (These consent forms are used only if deemed necessary by the FBI in the event of a financial review. If a filer submitted the consent forms in a previous year, he/ she would be required to resubmit only the form if requested to do so by the assigned FBI Chief Security Officer); c. Include all requested information pertaining to the filer, his or her spouse, and any dependent children. A filer whose spouse or dependent(s) refuse to provide financial information should explain the circumstances of this refusal in the Comments Section of the SFDF.

The filer may be subject to penalties, including having access to classified information suspended, revoked, or denied. Individual circumstances are reviewed on a case by case basis. d. Not omit or provide false or misleading information on an SFDF. Filings are reviewed for accuracy and completeness, and filers may be contacted by FBI employees/contractors assigned the responsibility of the Financial Disclosure Program regarding any potential discrepancies and/or omissions. Contractor employees who meet the sited criteria are required to file and are responsible for the successful completion of the SFDF process. Refusal to submit financial disclosure information could result in the immediate removal of the employee from FBI space, restricted access to FBI information or denial of unescorted access to FBI facilities. Exceptions will be resolved on a case-by-case basis. If contract performance is impacted as a result of removal of the employee, the contractor may be found in default of the contract. If a contractor employee terminates employment and/or assignment to the FBI prior to the reporting requirement, the contractor employee is not required to file.

FBI-0009 Personnel Security - Contract Security Requirements from Acquisition Security Unit (ASU)

1.1 Personnel Security Requirements: The administrative control and maintenance of accurate records of contractors has been identified by both the Intelligence Community and FBI Executive Management as a matter of concern. With the continuous dependency on contractors to support the FBI, to include access to FBI facilities and information, if a procurement is expected to result in the acquisition of services involving the assignment of contractor personnel to FBI locations the Program Management Officer/Contracting Officer's Technical Representative (COTR), in coordination with the assigned Chief Security Officer, are required to identify during procurement planning stages, whether an acquisition will require assignment of contractor personnel to FBI locations, and therefore require the anticipated contract to include the Special Security Clause identified below in 1.2.

1.2 Special Security Requirements: Security Requirements Applicable to Contractor Personnel Assigned to FBI Locations:

Requirements are applicable to all individuals to be assigned to FBI locations, to include those identified as "Key Personnel", if specified in the contract. The contractor shall plan for expected attrition through advanced preparation and submission of required information. Award of this contract is anticipated to result in assignment of contractor personnel to FBI controlled or occupied space. Security and ethical conduct requirements, specific to the contract, to include a copy of the "Contractor & FBI Employees Ethics Standards Factsheet" are provided. Any questions that the contractor or contractor personnel may have on the applicability of these requirements shall be addressed to the Contracting Officer's Security Representative or (name of Chief Security Officer), Chief Security Officer, at (telephone number). As such, all contractor personnel assigned to such space must be briefed, in advance of arrival, by the contractor on the provided FBI policies and procedures, as identified in the contract, regarding ethical conduct and

15F06720R0000205 Page 11 of 15 security requirements. A list of assigned Contractor personnel and verification of their briefing, shall be provided to the cognizant contractor security officer for subsequent transmittal to the proper FBI Security Officer assigned oversight of this contract. This list must be provided no later than seven (7) days in advance of the individual's scheduled date of initial performance at an FBI location.

Failure to provide the required verification of briefing will result in a delay of the individual's access to the facility. Additionally, within 15 days from assignment to FBI space, the employee must attend an FBI Security Awareness Briefing, which will further address FBI policies and procedures, as identified in FBI's Policy and Guidance Library. This training is currently satisfied through the contractor employee's attendance at the Security Division's Career Services Management Unit's quarterly contractor's training offered at FBI, 935 Pennsylvania Avenue, NW, Washington, DC. The assigned FBI Chief Security Officer will contact the employee with the date and time of their scheduled briefing. Failure to attend this briefing or make arrangements to attend a subsequent briefing will result in immediate removal of the employee from FBI space. If contract performance is impacted as a result of removal of the employee, the contractor may be found in default of the contract. In the event that the development of information or material is not clearly covered by the contract or regulations, the contractor is required to seek FBI guidance regarding its handling of classified and/or unclassified information. Only such persons who have been authorized by the Contracting Officer and/or the Chief Security Officer/Contracting Officer's Security Representative, if the work is for other than specified personnel, shall be assigned to this work.

In this connection, for identification purposes, the contractor will be required to submit the name, address, place and date of birth of all personnel who will be involved in the work hereunder. Said information will be required to be provided to the identified Chief Security Officer not later than seven (7) days in advance of the scheduled date of such work. Information relating to an individual(s) identified as "Key Personnel" should be reported to the Chief Security Officer after the written consent of the Contracting Officer has been received. All contractor personnel who receive a security clearance or access approval under the terms of this contract will be required to execute a FBI specified nondisclosure agreement. The contractor agrees to abide by all applicable FBI security regulations governing personnel, facilities, technical, information systems, communications and protective programs. The following reporting requirements are to be reported to the identified Chief Security Officer as promptly as possible, but in no event later than two (2) business days after receipt of such knowledge. a. Adverse Information. Contractors shall report any adverse information coming to their attention concerning any of their employees supporting this contract. Adverse information is defined as any information that adversely reflect on the integrity or character of an employee that suggests that his or her ability to safeguard FBI Sensitive But Unclassified (SBU)/Law Enforcement Sensitive (LES) and/or classified information may be impaired, or that his or her access to the information clearly may not be in the interest of the FBI and/or National Security. b. Suspicious Contacts. Contractors shall report efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to FBI SBU/LES or classified information or to compromise an employee. c. Change in Employee Status. Contractors shall report (1) the death, (2) a name change, (3) change in marital status, (4) change to performance which alters their originally assigned location and FBI Division to which they report, (5) termination of employment. d. Employees Desiring Not to Perform on the Contract. Evidence that an employee no longer wishes to support the contract. f. Official or Unofficial Foreign Travel.

FBI-0010 Warrantless Search - Contract Security Requirements from Acquisition Security Unit (ASU)

All cleared personnel accessing information within FBI controlled space are required to execute an FBI Form FD 1001 Consent for Warrantless Searches of Department of Justice (DOJ) Workplaces as a condition of working at FBI facilities. The FBI's Director implemented the Attorney General's policy subjecting employees to warrantless physical searches of their offices or immediate workplaces within DOJ premises when authorized by the Attorney General (AG) or the Deputy Attorney General (DAG) based upon a determination that information the Department deems credible indicates that the employee: 1) is, or may be, disclosing classified information in an unauthorized manner; 2) has incurred excessive indebtedness or has acquired a level of affluence that can not be reasonably explained by other information; 3) had the capability and opportunity to disclose classified information that is believed to have been lost or compromised to a foreign power or an agent of a foreign power; or 4) has repeatedly or significantly mishandled or improperly stored classified information. The search may extend to the entire office or workplace and anything within it that might hold classified information, including locked containers (such as briefcases) and electronic storage media (such as computer disk and handheld computers), whether owned by the government, by the employee, or by a third party. The search may be conducted by appropriate FBI personnel and/or law enforcement officers, on an announced or unannounced basis, during the workday or after hours.

If discovered during a search, evidence of misconduct - whether related to storage or classified information, storage of sensitive but unclassified information, or a crime - will be collected and reported to appropriate authorities. Contractor personnel who will meet the above criteria will be required to sign Form FD 1001 Consent for Warrantless Searches of Department of Justice (DOJ) Workplaces (attached) upon award and forward the executed form(s) to the assigned Contracting Officer's Representative designated in Section G of the solicitation if this is a formal solicitation or listed below. All forms will be retained by the FBI during the period the individual is providing services and two years after that individual's departure before final disposition is taken.

FBI-0013 e-QIP - Contract Security Requirements from Acquisition Security Unit (ASU), Procurement Section Directive (PSD):

09-22.18

Performance under this contract may require access to FBI locations to provide some service, product, or perform some other official function of interest to the FBI. Requirements, as identified below, to include approval by the FBI's Security Division, must be

15F06720R0000205 Page 12 of 15 satisfied prior to access. Contractors who will require escorted access, to include short-term, intermittent, or infrequent access, to an FBI facility must complete an "Access of Non-FBI Personnel to FBI Facilities, Background Data Information Form," (FD 816), a "Privacy Act of 1974 Acknowledgment Form" (FD 484) and two Fingerprint Cards (FD 258). Completed forms should be provided to the assigned Contracting Officer's Technical Representative (COTR) at least 10 days prior to required access. Individuals requiring unescorted access to an FBI facility must complete the Standard Form 86 (SF-86), Questionnaire for National Security Positions, using the Office of Personnel Management’s Electronic Questionnaires for Investigations Processing (e-QIP) and provide two Fingerprint Cards (FD 258). e-QIP is a secure website that can be accessed from any computer system which has an Internet connection. Only the signed release forms and FD 258 will need to be mailed to the identified Chief Security Officer, the SF-86 itself will be transmitted to the FBI electronically. To complete the SF-86 using e-QIP, the individual requiring unescorted access to the FBI facility must contact (insert Chief Security Officer, Division, and telephone number) in order to be initiated into e-QIP. Once this action has been accomplished, the individual should be able to access e-QIP at the following link in order to initiate and complete the electronic process: http://www.opm.gov/e-qip/browser-check.asp. Thoroughly read and follow the instructions for completing the SF-86. NOTE: To fully address suitability/security issues, the FBI requires individuals to provide responses to questions on the SF-86 for the last ten years. Failure to complete the application as instructed may lead to significant delays in processing the required investigation and approval for unescorted access. Upon logging onto e-QIP, there will be a prompt to answer three “Golden” security questions to establish the user account. After completing the electronic SF-86, please print and sign the (1) Certification Form (CER) - Certify Completeness and Accuracy of your Investigation Request; (2) Medical Release Form (MEL) - Authorization for Release of Medical Information; and (3) Release Form (REL) - Authorization for Release of Information. In addition to these SF 86 release forms, the completion of a Non-Personnel Consent to Release Information (FD-979a), the United States Department of Justice Disclosure and Authorization Pertaining to Consumer Reports (DOJ 555) are required. Annotation of the assigned e-QIP Investigation Request Number on the upper right corner of each document transmitted to the identified Chief Security Officer is required for coordination with the electronic transmission and to facilitate the investigative process. The e-QIP Investigation Request Number, automatically generated by e-QIP, is located on both the header and footer of the signature forms. These release forms (five total) and FD 258 should be mailed via Federal Express or UPS Express mail directly to the following address: (insert name and address of Chief Security Officer). The use of regular U.S. mail channels may cause significant delays in processing the unescorted access request. Upon completion of processing the facility access request, the individual will be required to execute a non-disclosure agreement suitable for their approved access.

52.217-8 Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days [insert the period of time within which the Contracting Officer may exercise the option].

(End of clause)

52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days [insert the period of time within which the Contracting Officer may exercise the option]; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days days [60 days unless a different number of days is inserted] before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 (months)(years).

(End of clause)

FBI-0001 Small Business Accelerated Payment

THE CONTRACTOR MUST INDICATE HIS BUSINESS SIZE ON EACH INVOICE TO ASSIST THE PAYMENT OFFICE IN DETERMINING ELIGIBILITY FOR ACCELERATED PAYMENT IN ACCORDANCE WITH OMB MEMO M-11-32, 'ACCELERATING PAYMENTS TO SMALL BUSINESSES FOR GOODS AND SERVICES', DATED 10/14/2011. THE PROMPT PAYMENT ACT STILL APPLIES TO THIS ACTION; HOWEVER, THE AGENCY WILL MAKE BEST EFFORTS TO PAY

PROPER INVOICES WITHIN 15 DAYS.

15F06720R0000205 Page 13 of 15

FBI-0004 DOJ Residency Requirement - Contract Security Requirements from Acquisition Security Unit (ASU)

DOJ Residency Requirement: All contractor personnel employed within the United States, both United States citizens and non-United States citizens, are required to meet the following residency requirements: For three of the five years immediately prior to applying for the specific contract position, the individual must have 1) resided in the United States; 2) worked for the United States overseas in a Federal or military capability; or 3) be a dependent of a Federal or military employee serving overseas. The requirement may be waived for short term contractor personnel (performing duties for a cumulative total of 14 days or less) if there is a critical need for their specialized and unique skills. These individuals must, however, be United States citizens or Permanent Resident Aliens.

[END OF ADDENDUM TO FAR 52.212-4]

15F06720R0000205 Page 14 of 15

Section 4 - List of Attachments

This Section Is Intentionally Left Blank

15F06720R0000205 Page 15 of 15

Section 5 - Solicitation Provisions

Provisions By Reference

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer.

In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es): www.acquisition.gov

Provision Title Fill-ins (if applicable)

52.204-8 Annual Representations and Certifications (Dec 2019) (a)(1): "621498"

(a)(2): "$20.5M"

52.204-7 System for Award Management (Oct 2018)

FBI-0005 Source Selection Evaluation Board - Contract Security Requirements from Acquisition Security Unit (ASU)

The requirement for a Security Proposal is as follows: Security is a criterion in the evaluation of proposals received in response to this solicitation. The security proposal should be submitted as a separate document/file from the cost and technical proposal and has a twenty-five (25) page limit which…