15JPSS19Q00000053_Final.docx

Solicitation: 15JPSS19Q00000053 Technical Assistance Program Coordinator This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulations (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued.

The synopsis/solicitation reference number is 15JPSS19Q00000053 and is being issued as a Request for Quote (RFQ). The RFQ format is attached to this combination synopsis/solicitation that will be used to submit quotes.

This solicitation document and incorporated provisions and clauses are those in effect through FAC 2005- 100, Effective August 22, 2018.

This acquisition is solicited as a Small Business Set-aside basis under NAICS code 541618, Other Management Consulting Services, with a small business size standard of $15,000,000.

The contractor shall submit a quote for Technical Assistance Program Coordinator for the Antitrust Division (ATR) in accordance with the attached statement of work.

INSTRUCTIONS FOR SUBMISSION OF QUOTATIONS:

Contractor’s proposal shall be valid for thirty (30) days and include Volume 1, and 2.

Volume I - Technical Submission

1. The contractors’ technical submission shall address the following factors in accordance with the Statement of Work included in this RFQ to be considered for award:

A. Contractors technical submission MUST show the ability to accomplish all of the tasks in Section V of the SOW.

B. Contractors technical submission must address the personnel qualifications shown in the evaluation factors below.

C. Contractors technical submission must include two past performance references, including current contact information. If the contractor has no past performance, they must state this and it will be evaluated as neutral.

Volume II – Price Submission – The contractor shall provide a per hour estimated price using the attached Pricing Table. This contract will be a Labor Hour contract with a yearly maximum of 1,920 hours.

Any award resulting from this RFQ will be issued on Standard Form 1449 and will contain all clauses required by law and the Federal Acquisition Regulations as appropriate.

Quotations shall be submitted electronically via email by 1:00 pm, Eastern Time, on September 9, 2019 to the attention of Andrew Martin at Andrew.S.Martin@usdoj.gov. Quotations shall include the Offeror's CAGE code, Federal Taxpayer Identification Number, DUNS number, and a completed copy of the provisions at FAR 52.212-3, "Offeror Representations and Certifications - Commercial Items".

EVALUATION FACTORS:

Volume I, Technical Submission:

Technical Evaluation Factors Maximum Point Score

1. Technical Approach:

The Government will evaluate the Offerors’s ability to meet all requirements of the SOW and this RFQ.

2. Key Personnel:

The government will evaluate the Offeror’s proposed Key Personnel qualifications and capabilities as it relates to the criteria below:

(Minimum education or experience requirements are considered mandatory where they are described using the terms “required” or “must have” or “must be.”)

• Must have a minimum of five years of experience working for or with the Federal Government; experience working in an enforcement capacity is preferred;

• Must have demonstrated experience and/or leadership working in the field of international antitrust enforcement, including investigating and prosecuting criminal antitrust (price fixing, bid rigging and market allocation) violations;

• Must have demonstrated experience coordinating with international competition agencies and international and/or domestic law enforcement agencies.

• Must have demonstrated knowledge of and/or experience with prosecution and/or law enforcement techniques required in international criminal antitrust investigations; experience coordinating search warrants in multiple jurisdictions, interviewing for evidence to support criminal antitrust charges, organizing staffing support for large international antitrust investigations, preparing for trial, etc. is preferred;

• Must have demonstrated experience developing curriculum and conducting legal and investigative training programs;

• Must have at least a bachelor’s degree; an advanced degree, such as a juris doctor (J.D.) or master’s degree is preferred, and

• Must be a U.S. citizen.

• This position will require the ability to acquire, and maintain, a Top-Secret security clearance.

3. Past performance information (Offerors shall provide at least two references):

Past Performance is a measure of the degree to which the Offeror, as an organization, has satisfied its customers. The Department will check, to the extent it deems necessary, each vendor’s client references to inquire about: the management of multiple vehicles and personnel; the quality and timeliness of the vendor’s work; ability to stay within budget; reasonableness of its business behavior; and technical and management capabilities. The Government may expand the evaluation to include references not contained in the vendor’s submission. The actual number of references checked is entirely at the Government’s discretion. An Offeror with no relevant past performance history will not be evaluated favorably or unfavorably on past performance.

Volume II – Price Submission:

To be considered for award, the vendor must submit prices which comply with the requirements of Statement of Work and are fair and reasonable. Price comparison will be conducted using information available in each price proposal. Vendors that fail to comply with all of these requirements will receive no further consideration and may be eliminated from this evaluation.

All Offerors must complete the pricing table in RFP Attachment 3 “CLIN Pricing Table”. It will be used to calculate the total evaluated price for the contract award determination. For price evaluation purposes, the Government will verify the accuracy of the data contained in the vendor’s pricing table. The price proposal will be evaluated inclusive of optional periods of performance.

SECURITY REQUIREMENTS

1. SECURITY REQUIREMENTS - CLASSIFIED

1.1 Contractor Personnel

1.1.1 Access to Classified Information

(a) The Contractor shall possess or be capable of obtaining a Defense Industrial Security Clearance Office (DISCO) Defense Industrial Security Clearance Facility Code and a Top Secret Facility Clearance to fully perform this contract. As directed by the COR and SPM, the Contractor shall submit the information necessary to allow the Government to prepare and obtain for the Contractor a "Department of Defense Contract Security Classification Specification" (DD Form 254) for this contract. Where such clearance is required, the Contractor agrees to provide information and access to Contractor facilities as may be required by Government investigators.

1.1.2 Access to Unclassified Information

Note: Contractor personnel that have a currently active, approved NSI clearance will not be processed for a Public Trust Investigation (PTI) if the current investigation meets the investigative requirements for the risk level of the position to be occupied under this DOJ contract.

Contractor personnel only requiring access to unclassified information will fall under the following categories:

(1) High Risk. High risk positions are those positions that have the potential for exceptionally serious impact on the integrity and efficiency of the DOJ and involve duties especially critical to the DOJ or a program mission with broad scope of policy or program authority.

(2) Moderate Risk. Moderate risk positions are those positions that have the potential for moderate to serious impact on the integrity and efficiency of the DOJ. Duties involved are very important to the DOJ or program mission with significant program responsibility or delivery of services.

(3) Low Risk. Low Risk positions are those positions that have limited potential for adversely affecting the national security operations of the Department.

1.1.2.1 Pre-Appointment Background Investigations and Waivers

(a) Background investigations must be conducted and favorably adjudicated for each contract employee prior to commencing work on this contract. However, where programmatic needs do not permit the Government to wait for completion of the entire background investigation, a pre-appointment background investigation waiver can be granted by the SPM, in consultation with the cognizant COR. The extent of the background investigation will vary depending upon the Risk Category associated with each position and whether each position is long- or short-term. Short-term is defined as contract employees having access to Federally-controlled information systems and/or unescorted access to Federally-controlled facilities or space for six months or fewer. The requisite background investigation does not need to be initiated for short-term positions as part of the pre-employment waiver except in the case of non-U.S. citizen contract employees. However, long-term contract employees requiring unescorted access to Federally-controlled facilities and/or access to any Federally-controlled information system shall be subject to the requisite background investigations described below. A waiver will be disapproved if it develops derogatory information that cannot be resolved in the contract employee’s favor. When a waiver has been disapproved, the COR, in consultation with the SPM, will determine (1) whether the contract employee will no longer be considered for work on a DOJ contract or (2) whether to wait for the completion and favorable adjudication of the background investigation before the contract employee commences work on a Department contract. The minimum pre-appointment investigative requirements are as follows:

(1) High Risk Positions. The minimum background investigation required is a five year scope Background Investigation (BI), and the five year reinvestigation required is an Access National Agency Check with Inquiries (ANACI). The Standard Form (SF) 85P, Questionnaire for Public Trust Positions, and the SF-85P-S (Supplemental Questionnaire for Selected Positions), are required.

(2) Moderate Risk Positions. The minimum background investigation required is a Minimum Background Investigation (MBI). The five year reinvestigation required is a National Agency Check with Law and Credit (NACLC). The SF-85P and the SF-85P-S are required.

(3) Low Risk/Non-Sensitive Positions. The minimum background investigation required for Low Risk/Non-Sensitive positions is a National Agency Check with Written Inquiries (NACI), and the required five year reinvestigation is also a NACI using the SF-85.

(b) The pre-appointment background investigation waiver requirements include:

1.1.2.2 Required Security Forms

(a) The following forms must be completed and submitted by the Contractor’s Corporate Security Officer for each contract employee PTI:

(b) The Contractor shall also submit a credit report for each individual designated at the High Risk or Moderate Risk level, and have resolved satisfactorily any individual credit issues.

(c) Using e-QIP: Immediately after contract award, the Contractor shall designate an employee as its “e-QIP Initiator” and provide the name of this person to the COR. The e-QIP Initiator must have, at a minimum, a favorably adjudicated MBI and the appropriate DOJ security approval before being given access to e-QIP. After the e-QIP Initiator’s security approval is granted, the Contractor will be configured in e-QIP as a sub-agency to DOJ. The Contractor will then be responsible for initiating all contract personnel in e-QIP for completion of the security questionnaire form and forwarding the electronic form along with a hard copy of the form (as completed and signed by the contract employee) with the remainder of the security package to the designated DOJ representative. Subject to the prior approval of the SPM, the Contractor may designate an e-QIP Initiator for each subcontractor. Subcontractor e-QIP Initiators must have, at a minimum, a favorably adjudicated MBI and the appropriate DOJ security approval before being given access to e-QIP.

1.1.2.3 Citizenship and Residency Requirements

(a) Residency Requirement. Contract employees, both United States (U.S.) citizens and nonU.S. citizens, must meet the Department’s Residency Requirement, i.e., he/she must have lived in the U.S. three of the last five years immediately prior to employment under the Department contract; and/or worked for the U.S. overseas in a Federal or military capacity; and/or be a dependent of a Federal or military employee serving overseas. At the Department’s sole discretion, the residency requirement may be waived by the Department Security Officer (DSO) on a case-by-case basis where justified by extenuating circumstances.

(b) Citizenship. The DOJ gives strong priority to contract employees that are U.S. citizens and nationals. Any prospective contract employee that is a foreign national must be from a country allied with the U.S. (See http://www.state.gov/s/I/treaty/collectivedefense/). At the Department’s sole discretion, a waiver of the allied nations list requirement may be granted by the DSO on a case-by-case basis where justified by extenuating circumstances. The Contractor is responsible for verifying that all non-U.S. citizens working under this contract have been lawfully admitted to the U.S. Contract employees requiring access to DOJ Information Technology (IT) resources are subject to the following additional restriction:

NonU.S. citizens are not authorized access to or permitted to assist in the development, operation, management or maintenance of DOJ IT systems unless a waiver has been granted by the Head of the DOJ component, with the concurrence of the DSO and the DOJ Chief Information Officer (CIO). Such a waiver will be granted only in exceptional and unique circumstances. It should be noted that the Justice Consolidated Office Network (JCON) is a sensitive “DOJ IT system” and any contract employee that will need access to JCON must be a U.S. citizen or have received a waiver.

(c) Dual Citizenship. U.S. citizens who hold dual citizenship with a foreign country may be considered for contract employment. However, how the contract employee obtained or exercises his or her dual citizenship status will be a consideration in the adjudication process.

1.1.2.4 Procedures for Pre-Screening Applicants and Investigation

(a) The Contractor shall perform the following pre-screening and investigation duties for all persons proposed for work under this contract:

(1) Furnish to each proposed contract employee the forms described in Section 1.1.2.2 above and ensure that adequate instructions for completing the forms are provided to each applicant.

(2) Ensure that applicants obtain two (2) complete sets of their fingerprints on the prescribed Form FD-258 from an organization qualified to take fingerprints.

(3) Collect completed forms from each applicant and review all forms for completeness and correctness. This includes, for example, satisfactory resolution of address issues or discrepancies. Return any incomplete or incorrect form(s) to applicant(s) to be corrected and re-submitted.

(4) Submit completed forms to the COR by no later than (14) calendar days after receipt of the blank forms and access to e-QIP has been initiated.

(5) As directed by the COR, initiate pre-appointment waivers for certain positions. This may entail performing credit history checks and submission of these checks as part of the security package, including satisfactory resolution of any issues prior to submission to the Government.

(6) As directed by the COR, review all forms prior to their being submitted to DOJ to ensure that candidates meet DOJ requirements, including residency and citizenship requirements.

(b) The Department will be responsible for the following:

(1) Determine the appropriate risk level for each contract employee position.

(2) Provide the Contractor an adequate supply of forms and instructions for completing the forms within five business days after contract award. Ensure that the Contractor is provided access to the e-QIP system as described in 1.1.2.2(c).

(3) Ensure that completed security forms are forwarded to the appropriate investigating agency in accordance with appropriate internal procedures. The investigating agency will conduct the requisite investigations.

(4) Determine whether pre-appointment background investigation waivers will be needed, and if so, which positions will require such waivers. The COR will notify the Contractor which pre-appointment waivers to initiate.

(5) Notify the Contractor of the results of background investigations as they are completed and adjudicated. The COR will notify the Contractor of any applicants who are found ineligible for employment security approval so that the Contractor can immediately recruit and initiate paperwork to clear replacement applicants.

(6) Notify the Contracting Officer when a sufficient number of contract employees have received employment security approvals or pre-appointment waivers approvals. Upon receipt of this information and any other information which may be required elsewhere in the contract, the Contracting Officer will issue the Contractor a Notice to Proceed which permits the commencement of work under the contract.

(7) Maintain an up-to-date file of Certificates of Investigation (COI) and other background investigation-related documentation for all contract employees throughout the life of the contract.

(c) The investigating agency will furnish the relevant SPM the results of each proposed contract employee’s investigation through issuance of a Certificate of Investigation (COI). Upon receipt of the COI and any other pertinent documents from the investigating agency, the SPM will determine whether or not each proposed contract employee should be granted employment security approval. This decision process is called “adjudication.” The SPM will notify, if required, the investigating agency of the adjudicative determination of each investigation. If OPM is the investigating agency, this will be accomplished by the SPM completing and submitting to OPM an INV Form 79A, “Report of Agency Adjudicative Action.”

1.1.2.5 Identity Proofing and Badging

(a) During the life of this contract, the right to unescorted access to Federally-controlled facilities and/or access to Federally-controlled information systems shall be made available after the contract employees have (1) met the identity proofing requirements outlined below, and (2) completed all other security requirements stated elsewhere in this contract. During all operations on Government premises, the contract employees shall comply with the rules and regulations governing the conduct of personnel and the operation of the facility. The Government reserves the right to require contract employees to "sign-in" upon entry and "sign-out" upon departure from the DOJ facility.

(b) All contract employees requiring unescorted access to Federally-controlled facilities and/or access to Federally-controlled information systems (regardless of whether they will be issued a DOJ badge), shall comply with the identity proofing and registration requirements outlined below:

(c) All contract employees requiring unescorted access to a DOJ controlled facility shall comply with the badge requirements outlined below:

1.1.2.6 Replacement Personnel

(a) Security investigations are very costly to the Government. The Contractor shall make every effort to preclude incurrence of costs by the Government for security investigations for replacement of employees, and in so doing, shall assure that otherwise satisfactory and physically able employees assigned hereunder remain in contract performance for at least one (1) year. The Contractor shall take all necessary steps to assure that Contractor personnel who are selected for assignment to this contract are professionally qualified and personally reliable, of reputable background and sound character, and meet all other requirements stipulated herein.

(b) The fact that the Government performs security investigations shall not in any manner relieve the Contractor of its responsibility to assure that all personnel furnished are reliable and of reputable background and sound character. Should a security investigation conducted by the Government render ineligible a Contractor furnished employee, the Contracting Officer will investigate the cause and determine whether the Contractor has abdicated its responsibilities to make every effort to select reliable employees of reputable background and sound character. Should there be need to replace a contract employee due to nonperformance, the Contracting Officer will determine whether the Contractor has abdicated its responsibilities to make every effort to select trained and experienced employees.

(c) Should the Contracting Officer determine that the Contractor has failed to comply with the terms of Section 1.1.2.4 (a), the Contractor may be held monetarily responsible, at a minimum, for all reasonable and necessary costs incurred by the Government to (a) provide coverage (performance) through assignment of individuals employed by the Government or third parties in those cases where absence of Contractor personnel would cause either a security threat or DOJ program disruption and (b) conduct security investigations in excess of those which would otherwise be required.

(d) Nothing in this Clause shall require the Contractor to bear costs involved in the conduct of security investigations for replacement of an employee who becomes deceased or severely ill for a long period of time.

(e) Acceptance by the Government of consideration to which the Government may be entitled pursuant to paragraph (c) above shall not be construed to establish a course of conduct which will serve to limit the rights and remedies otherwise available to the Government. Under no circumstances shall the Contractor fail to comply with the terms and conditions set forth herein without assuming liability for such failure as may be established pursuant to this Clause. The rights and remedies conferred upon the Government by this Clause are in addition to all and other rights and remedies specified elsewhere in this contract or established by law.

1.2 Contractor Facility

The Contractor shall implement physical controls as necessary to maintain the integrity and confidentiality of all data/information in its possession. At a minimum, the following requirements shall be in effect for Contractor controlled spaces where information is processed and/or stored:

(1) Access to the facility shall be limited to Contractor personnel or those escorted by Contractor personnel.

(2) Document/media storage areas shall be restricted to persons requiring access to them on a need-to-know basis and have a security access approval or clearance granted by DOJ.

(3) All designated storage areas/containers must be made available for inspection upon initial award of a contract and semiannually or as otherwise directed by the SPM, COR or COR designee.

2. SECURITY OF DEPARTMENT INFORMATION AND SYSTEMS

2.1 Applicability to Contractors and Subcontractors

This clause applies to all contractors and subcontractors, including cloud service providers (“CSPs”), and personnel of contractors, subcontractors, and CSPs (hereinafter collectively, “Contractor”) that may access, collect, store, process, maintain, use, share, retrieve, disseminate, transmit, or dispose of DOJ Information. It establishes and implements specific DOJ requirements applicable to this Contract. The requirements established herein are in addition to those required by the Federal Acquisition Regulation (“FAR”), including FAR 11.002(g) and 52.239-1, the Privacy Act of 1974, and any other applicable laws, mandates, Procurement Guidance Documents, and Executive Orders pertaining to the development and operation of Information Systems and the protection of Government Information. This clause does not alter or diminish any existing rights, obligation or liability under any other civil and/or criminal law, rule, regulation or mandate.

2.2 General Definitions

The following general definitions apply to this clause. Specific definitions also apply as set forth in other paragraphs.

A. Information means any communication or representation of knowledge such as facts, data, or opinions, in any form or medium, including textual, numerical, graphic, cartographic, narrative, or audiovisual. Information includes information in an electronic format that allows it be stored, retrieved or transmitted, also referred to as “data,” and “personally identifiable information” (“PII”), regardless of form.

B. Personally Identifiable Information (or PII) means any information about an individual maintained by an agency, including, but not limited to, information related to education, financial transactions, medical history, and criminal or employment history and information, which can be used to distinguish or trace an individual's identity, such as his or her name, social security number, date and place of birth, mother's maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.

C. DOJ Information means any Information that is owned, produced, controlled, protected by, or otherwise within the custody or responsibility of the DOJ, including, without limitation, Information related to DOJ programs or personnel. It includes, without limitation, Information (1) provided by or generated for the DOJ, (2) managed or acquired by Contractor for the DOJ in connection with the performance of the contract, and/or (3) acquired in order to perform the contract.

D. Information System means any resources, or set of resources organized for accessing, collecting, storing, processing, maintaining, using, sharing, retrieving, disseminating, transmitting, or disposing of (hereinafter collectively, “processing, storing, or transmitting”) Information.

E. Covered Information System means any information system used for, involved with, or allowing, the processing, storing, or transmitting of DOJ Information.

2.3 Confidentiality and Non-disclosure of DOJ Information

A. Preliminary and final deliverables and all associated working papers and material generated by Contractor containing DOJ Information are the property of the U.S. Government and must be submitted to the Contracting Officer (“CO”) or the CO’s Representative (“COR”) at the conclusion of the contract. The U.S. Government has unlimited data rights to all such deliverables and associated working papers and materials in accordance with FAR 52.227-14.

B. All documents produced in the performance of this contract containing DOJ Information are the property of the U.S. Government and Contractor shall neither reproduce nor release to any third-party at any time, including during or at expiration or termination of the contract without the prior written permission of the CO.

C. Any DOJ information made available to Contractor under this contract shall be used only for the purpose of performance of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of this contract. In performance of this contract, Contractor assumes responsibility for the protection of the confidentiality of any and all DOJ Information processed, stored, or transmitted by the Contractor. When requested by the CO (typically no more than annually), Contractor shall provide a report to the CO identifying, to the best of Contractor’s knowledge and belief, the type, amount, and level of sensitivity of the DOJ Information processed, stored, or transmitted under the Contract, including an estimate of the number of individuals for whom PII has been processed, stored or transmitted under the Contract and whether such information includes social security numbers (in whole or in part).

2.4 Compliance with Information Technology Security Policies, Procedures and Requirements

A. For all Covered Information Systems, Contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the Federal Information Security Management Act of 2014 (“FISMA”), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology (“NIST”) Special Publications (“SP”), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards (“FIPS”) Publications 140-2, 199, and 200, OMB Memoranda, Federal Risk and Authorization Management Program (“FedRAMP”), DOJ IT Security Standards, including DOJ Order 2640.2, as amended. These requirements include but are not limited to:

1. Limiting access to DOJ Information and Covered Information Systems to authorized users and to transactions and functions that authorized users are permitted to exercise;

2. Providing security awareness training including, but not limited to, recognizing and reporting potential indicators of insider threats to users and managers of DOJ Information and Covered Information Systems;

3. Creating, protecting, and retaining Covered Information System audit records, reports, and supporting documentation to enable reviewing, monitoring, analysis, investigation, reconstruction, and reporting of unlawful, unauthorized, or inappropriate activity related to such Covered Information Systems and/or DOJ Information;

4. Maintaining authorizations to operate any Covered Information System;

5. Performing continuous monitoring on all Covered Information Systems;

6. Establishing and maintaining baseline configurations and inventories of Covered Information Systems, including hardware, software, firmware, and documentation, throughout the Information System Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed in Information Systems;

7. Ensuring appropriate contingency planning has been performed, including DOJ Information and Covered Information System backups;

8. Identifying Covered Information System users, processes acting on behalf of users, or devices, and authenticating and verifying the identities of such users, processes, or devices, using multifactor authentication or HSPD-12 compliant authentication methods where required;

9. Establishing an operational incident handling capability for Covered Information Systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities, and tracking, documenting, and reporting incidents to appropriate officials and authorities within Contractor’s organization and the DOJ;

10. Performing periodic and timely maintenance on Covered Information Systems, and providing effective controls on tools, techniques, mechanisms, and personnel used to conduct such maintenance;

12. Protecting Covered Information System media containing DOJ Information, including paper, digital and electronic media; limiting access to DOJ Information to authorized users; and sanitizing or destroying Covered Information System media containing DOJ Information before disposal, release or reuse of such media;

13. Limiting physical access to Covered Information Systems, equipment, and physical facilities housing such Covered Information Systems to authorized U.S. citizens unless a waiver has been granted by the Contracting Officer (“CO”), and protecting the physical facilities and support infrastructure for such Information Systems;

14. Screening individuals prior to authorizing access to Covered Information Systems to ensure compliance with DOJ Security standards;

15. Assessing the risk to DOJ Information in Covered Information Systems periodically, including scanning for vulnerabilities and remediating such vulnerabilities in accordance with DOJ policy and ensuring the timely removal of assets no longer supported by the Contractor;

16. Assessing the security controls of Covered Information Systems periodically to determine if the controls are effective in their application, developing and implementing plans of action designed to correct deficiencies and eliminate or reduce vulnerabilities in such Information Systems, and monitoring security controls on an ongoing basis to ensure the continued effectiveness of the controls;

17. Monitoring, controlling, and protecting information transmitted or received by Covered Information Systems at the external boundaries and key internal boundaries of such Information Systems, and employing architectural designs, software development techniques, and systems engineering principles that promote effective security; and

18. Identifying, reporting, and correcting Covered Information System security flaws in a timely manner, providing protection from malicious code at appropriate locations, monitoring security alerts and advisories and taking appropriate action in response.

B. Contractor shall not process, store, or transmit DOJ Information using a Covered Information System without first obtaining an Authority to Operate (“ATO”) for each Covered Information System. The ATO shall be signed by the Authorizing Official for the DOJ component responsible for maintaining the security, confidentiality, integrity, and availability of the DOJ Information under this contract. The DOJ standards and requirements for obtaining an ATO may be found at DOJ Order 2640.2, as amended. (For Cloud Computing Systems, see Section V, below.)

C. Contractor shall ensure that no Non-U.S. citizen accesses or assists in the development, operation, management, or maintenance of any DOJ Information System, unless a waiver has been granted by the by the DOJ Component Head (or his or her designee) responsible for the DOJ Information System, the DOJ Chief Information Officer, and the DOJ Security Officer.

D. When requested by the DOJ CO or COR, or other DOJ official as described below, in connection with DOJ’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of DOJ Information, Contractor shall provide DOJ, including the Office of Inspector General (“OIG”) and Federal law enforcement components, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor’s facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by DOJ or agents acting on behalf of DOJ, and such access shall be provided within 72 hours of the request. Additionally, Contractor shall cooperate with DOJ’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of DOJ Information.

E. The use of Contractor-owned laptops or other portable digital or electronic media to process or store DOJ Information covered by this clause is prohibited until Contractor provides a letter to the DOJ CO, and obtains the CO’s approval, certifying compliance with the following requirements:

1. Media must be encrypted using a NIST FIPS 140-2 approved product;

2. Contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Where applicable, media must utilize antivirus software and a host-based firewall mechanism;

4. Contractor must log all computer-readable data extracts from databases holding DOJ Information and verify that each extract including such data has been erased within 90 days of extraction or that its use is still required. All DOJ Information is sensitive information unless specifically designated as non-sensitive by the DOJ; and,

5. A Rules of Behavior (“ROB”) form must be signed by users. These rules must address, at a minimum, authorized and official use, prohibition against unauthorized users and use, and the protection of DOJ Information. The form also must notify the user that he or she has no reasonable expectation of privacy regarding any communications transmitted through or data stored on Contractor-owned laptops or other portable digital or electronic media.

F. Contractor-owned removable media containing DOJ Information shall not be removed from DOJ facilities without prior approval of the DOJ CO or COR.

G. When no longer needed, all media must be processed (sanitized, degaussed, or destroyed) in accordance with DOJ security requirements.

H. Contractor must keep an accurate inventory of digital or electronic media used in the performance of DOJ contracts.

I. Contractor must remove all DOJ Information from Contractor media and return all such information to the DOJ within 15 days of the expiration or termination of the contract, unless otherwise extended by the CO, or waived (in part or whole) by the CO, and all such information shall be returned to the DOJ in a format and form acceptable to the DOJ. The removal and return of all DOJ Information must be accomplished in accordance with DOJ IT Security Standard requirements, and an official of the Contractor shall provide a written certification certifying the removal and return of all such information to the CO within 15 days of the removal and return of all DOJ Information.

J. DOJ, at its discretion, may suspend Contractor’s access to any DOJ Information, or terminate the contract, when DOJ suspects that Contractor has failed to comply with any security requirement, or in the event of an Information System Security Incident (see Section V.E. below), where the Department determines that either event gives cause for such action. The suspension of access to DOJ Information may last until such time as DOJ, in its sole discretion, determines that the situation giving rise to such action has been corrected or no longer exists. Contractor understands that any suspension or termination in accordance with this provision shall be at no cost to the DOJ, and that upon request by the CO, Contractor must immediately return all DOJ Information to DOJ, as well as any media upon which DOJ Information resides, at Contractor’s expense.

2.5 Cloud Computing

A. Cloud Computing means an Information System having the essential characteristics described in NIST SP 800-145, The NIST Definition of Cloud Computing. For the sake of this provision and clause, Cloud Computing includes Software as a Service, Platform as a Service, and Infrastructure as a Service, and deployment in a Private Cloud, Community Cloud, Public Cloud, or Hybrid Cloud.

B. Contractor may not utilize the Cloud system of any CSP unless:

1. The Cloud system and CSP have been evaluated and approved by a 3PAO certified under FedRAMP and Contractor has provided the most current Security Assessment Report (“SAR”) to the DOJ CO for consideration as part of Contractor’s overall System Security Plan, and any subsequent SARs within 30 days of issuance, and has received an ATO from the Authorizing Official for the DOJ component responsible for maintaining the security…