1625DC-19-Q-00029_Amendment_1.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

BLS NATIONAL OFFICE

Room G225 2 Massachusetts Ave, NE Bureau of Labor Statistics US Department of Labor

BLS DC NAT SHIP CODE 16. ADMINISTERED BYCODE

X

X

518210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORBLS NATIONAL OFFICE

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

08/28/2019 1500 ET

08/14/2019

202-691-6008JASON LIU

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

1625DC-19-Q-00029

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 60 1625-OCW-19-NAT-0048OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

Washington DC 20212

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20212

ROOM G225

2 MASSACHUSETTS AVENUE, NE

US DEPARTMENT OF LABOR

15. DELIVER TO

Washington DC 20212 Room G225 2 Massachusetts Ave, NE Bureau of Labor Statistics

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$32.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

US Department of Labor

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

The purpose of this Request for Quote (RFQ) is to obtain competitive responses from qualified offerors for services in accordance with the attached PWS.

The period of performance dates listed throughout this solicitation reflect the best estimates at the time of solicitation and are subject to change.

Period of Performance: 10/31/2019 to 07/30/2020 Continued ...

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

XX

DATED

Marsha Daniels

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

0001 All tasks related to the building of the virtual data enclave (VDE). See 1.4 B. of the PWS.

Contract Line Item Number (CLIN) 0001 is to be executed and fully funded at the time of contract award. All tasks shall be completed and delivered within 105 days from the time of contract award.

Invoice shall be submitted upon completion, delivery, and acceptance of all tasks.

Product/Service Code: D399

Delivery: 105 Days After Award

0002 Base Period - Requirements of PWS with the exception of building of the VDE apply to this

CLIN

CLIN 0002 is to be executed and funded at the time of contract award.

Initial funding will, at a minimum, cover CLIN

0002 tasks starting 105 days from the time of contract award through the end of the base period. Additional funding will be included at

Continued ...

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

60 2 of

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1625DC-19-Q-00029

the time of contract award or added through contract modification(s) if the completion, delivery, and acceptance of the VDE occurs less than 105 days from contract award.

Includes 50 Projects and 20 Concurrent Users.

Product/Service Code: D399

The POP of CLIN 0002 ends nine months from the award of the contract. Up to 105 days from the start of CLIN 0002's POP are used for the completion, delivery, and acceptance of tasks under CLIN 0001.

Performance of tasks under CLIN 0002 shall begin immediately following the completion, delivery, and acceptance of CLIN 0001.

Due to the uncertainty of the completion timeline of CLIN 0001, the exact start date for the performance of tasks under CLIN 0002 and the quantity of adjustment(s) (CLIN 0003) and their timing cannot be determined at the time of solicitation. Their anticipated periods are listed in Attachment J.C.2.

Invoice for the first month of CLIN 0002 will be prorated to account for the completion, delivery, and acceptance of CLIN 0001.

0003 Base Period - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Add projects and concurrent users. Maximum: 400 projects and 80 concurrent users.

Monthly price per project:

Monthly price per concurrent user:

The contractor shall expand the VDE to support the additional projects and concurrent users within 10 days of receiving signed modification(s).

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

4 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1625DC-19-Q-00029

Due to the uncertainty of the completion timeline of CLIN 0001, the exact start date for the performance of tasks under CLIN 0002 and the quantity of adjustment(s) (CLIN 0003) and their timing cannot be determined at the time of solicitation. Their anticipated periods are listed in Attachment J.C.2.

Subject to FAR 52.217-6 Option for Increased

Quantity. (MAR 1989)

(Option Line Item)

(Anticipated Option Exercise Date) 0 Days After

Award

Product/Service Code: D399

1001 Option Year 1 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Includes 50 Projects and 20 Concurrent Users.

Subject to FAR 52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2020

Product/Service Code: D399

Period of Performance: 07/31/2020 to 07/30/2021

1002 Option Year 1 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Add projects and concurrent users. Maximum: 400 projects and 80 concurrent users.

Monthly price per project:

Monthly price per concurrent user:

The contractor shall expand the VDE to support the additional projects and concurrent users within 10 days of receiving signed modification(s).

May be exercised to take effect at the time of option year exercise and/or the following numbers of days after option year exercise: 90 days, 180

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

5 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1625DC-19-Q-00029

days, 270 days.

Subject to FAR 52.217-6 Option for Increased

Quantity. (MAR 1989)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2020

Product/Service Code: D399

Period of Performance: 07/31/2020 to 07/30/2021

2001 Option Year 2 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Includes 50 Projects and 20 Concurrent Users.

Subject to FAR 52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2021

Product/Service Code: D399

Period of Performance: 07/31/2021 to 07/30/2022

2002 Option Year 2 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Add projects and concurrent users. Maximum: 400 projects and 80 concurrent users.

Monthly price per project:

Monthly price per concurrent user:

The contractor shall expand the VDE to support the additional projects and concurrent users within 10 days of receiving signed modification(s).

May be exercised to take effect at the time of option year exercise and/or the following numbers of days after option year exercise: 90 days, 180 days, 270 days.

Subject to FAR 52.217-6 Option for Increased

Quantity. (MAR 1989)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2021

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

6 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1625DC-19-Q-00029

Product/Service Code: D399

Period of Performance: 07/31/2021 to 07/30/2022

3001 Option Year 3 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Includes 50 Projects and 20 Concurrent Users.

Subject to FAR 52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2022

Product/Service Code: D399

Period of Performance: 07/31/2022 to 07/30/2023

3002 Option Year 3 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Add projects and concurrent users. Maximum: 400 projects and 80 concurrent users.

Monthly price per project:

Monthly price per concurrent user:

The contractor shall expand the VDE to support the additional projects and concurrent users within 10 days of receiving signed modification(s).

May be exercised to take effect at the time of option year exercise and/or the following numbers of days after option year exercise: 90 days, 180 days, 270 days.

Subject to FAR 52.217-6 Option for Increased

Quantity. (MAR 1989)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2022

Product/Service Code: D399

Period of Performance: 07/31/2022 to 07/30/2023

4001 Option Year 4 - Requirements of PWS with the exception of building of the VDE apply to this

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

7 60

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1625DC-19-Q-00029

CLIN.

Includes 50 Projects and 20 Concurrent Users.

Subject to FAR 52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2023

Product/Service Code: D399

Period of Performance: 07/31/2023 to 07/30/2024

4002 Option Year 4 - Requirements of PWS with the exception of building of the VDE apply to this

CLIN.

Add projects and concurrent users. Maximum: 400 projects and 80 concurrent users.

Monthly price per project:

Monthly price per concurrent user:

The contractor shall expand the VDE to support the additional projects and concurrent users within 10 days of receiving signed modification(s).

May be exercised to take effect at the time of option year exercise and/or the following numbers of days after option year exercise: 90 days, 180 days, 270 days.

Subject to FAR 52.217-6 Option for Increased

Quantity. (MAR 1989)

(Option Line Item)

(Anticipated Option Exercise Date)07/31/2023

Product/Service Code: D399

Period of Performance: 07/31/2023 to 07/30/2024

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

A - Solicitation/Contract Form B - Supplies or Services/Prices C - Description/Specifications D - Packaging and Marking E - Inspection and Acceptance F - Deliveries or Performance G - Contract Administration Data H - Special Contract Requirements I - Contract Clauses J - List of Documents, Exhibits and Other Attachments K - Representations, Certifications, and Other Statements of Bidders L - Instructions,Conditions, and Notices to Bidders M - Evaluation Factors for Award

A - Solicitation/Contract Form

This section is intentionally left blank.

B - Supplies or Services/Prices

With the exception of CLIN 0001, the contractor shall submit invoices no more frequently than once a month. The invoice amount must reflect the level of service performed in proportion to the price of its respective line item. The invoice will be paid after the COR has accepted the service outlined in the PWS.

For CLIN 0001, the contractor shall submit an invoice after the COR has accepted all of the services outlined in the CLIN. Invoice for the first month of CLIN 0002 will be prorated to account for the completion, delivery, and acceptance of CLIN 0001.

Advance payment is not allowed under this contract.

C - Description/Specifications

Bureau of Labor Statistics Data Enclave for Restricted Access Microdata Performance Work Statement

PART 1

GENERAL INFORMATION

1. General: This is a non-personal services contract to host a modern stable platform that provides approved researchers with access to restricted BLS data in a secure virtual data enclave that is CIPSEA and FISMA compliant. It shall also allow for disclosure review of researcher output files, and provides technical support and secure access to software for users. The Government shall exercise control over contractor access to BLS confidential information. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform all tasks as defined in this Performance Work Statement except for those items specified as government furnished services. The Contractor shall perform to the standards in this contract.

1.2 Background: The Bureau of Labor Statistics (BLS) of the U.S. Department of Labor is the principal Federal statistical agency responsible for measuring labor market activity, working conditions, and price changes in the economy. Its mission is to collect, analyze, and disseminate essential economic information to support public and private decision-making that forms the basis of our democratic, free-enterprise system. BLS executes its statistical mission with independence, serving its users by providing products and services that are accurate, objective, relevant, timely, and accessible.

The BLS currently shares microdata from the Census of Fatal Occupational Injuries (CFOI) and the National Longitudinal Surveys (NLS) with eligible researchers working on approved projects through an agreement, which allows for off-site access. The current data-sharing method involves sending an encrypted CD containing the data to the researchers who can then install the data on approved systems at their home institution.

Currently, CFOI and NLS maintain a similar set of procedures for handling off-site data access. BLS has established a licensing system through which researchers at universities and other research organizations in the United States can use CFOI and NLS geocode data at their own facilities, provided that the research project and physical and electronic security measures described in the proposal are approved by BLS. The NLS geocode files differ from the public use files, which are available online, because they contain variables that could allow for the respondents’ identities to be inferred. Researchers submit proposals with a clear statement of their research methodology and objectives and explain how the data are necessary to meet those objectives. Additional details on the expected duration of the project and researchers involved must also be included with the proposal. The proposals are reviewed to ensure that the project is feasible and statistical in nature. BLS creates a Letter of Agreement (LOA) for researchers at universities or other research organizations in the United States, or Memorandum of Understanding (MOU) for researchers in federal agencies authorizing the use of confidential CFOI and NLS geocode data and providing the requirements for safeguarding the information from unauthorized disclosure. The institution and researchers agree in writing to adhere to the BLS confidentiality policy and to follow all physical and electronic security measures described in the LOA/MOU. In addition to execution of the LOA/MOU with the researcher’s sponsoring organization, the researcher must sign a BLS Agent Agreement and complete annual on-line training in order to access the confidential files. The researcher is then sent the data via password-protected CD with instructions for its secure and confidential handling and storage at the home institution.

The current method does not leverage modern technologies, which results in inefficiencies such as the need to spend significant time conducting physical site inspections of the various university locations where the data is stored. More importantly, the current method by which the confidential information is stored on university systems is not compliant with NIST 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, requirements. BLS intends to replace the current mode of access with a new data distribution system centered on a virtual data enclave to ensure data is adequately protected per federal guidelines.

Objective and Scope of Work: The Contractor shall provide services to create a NIST 800-171 compliant virtual data enclave (VDE) through which confidential information can be stored and disseminated. If proposing a cloud based solution, contractors shall be a FedRamp authorized vendor at the moderate impact level. The provider shall ensure all employees of the prime and sub-contractors (including third party cloud service providers) that have access to the cloud data storage sign BLS agent agreements and complete required training. See J.C.1 - Bureau of Labor Statistics Sub-Contractor Confidentiality and Security Commitment. The Contractor shall ensure that BLS approved researchers can access data from their own computer via a ‘virtual desktop’ but cannot download or remove confidential data from the remote server. The contractor shall ensure the virtual desktop is isolated from the user's physical desktop computer, restricting the user from downloading files or parts of files to their physical computer. The Contractor shall ensure that external access is restricted, preventing users from emailing, copying, or otherwise moving files outside of the secure environment, either accidentally or intentionally. The Contractor shall provide a VDE that shall allow for virtual file sharing among research project team members and BLS disclosure review staff. The Contractor shall provide a VDE that includes technical support provided by the enclave staff and offers a variety of software packages for statistical analysis. The Contractor shall ensure the data enclave offers enhanced security while updating the method of data sharing to take advantage of advancements in IT security that have occurred since the off-site data sharing program at BLS originated.

1.3 Period of Performance: The period of performance (POP) shall consist of a base period of nine months and four option years.

Option Years are 12 months in duration.

Option Year 1: 12 months Option Year 2: 12 months Option Year 3: 12 months Option Year 4: 12 months

1.4 Base Period Tasks:

The Contractor shall perform the 9 tasks listed below during the Base Period:

A. Administrative Tasks (CLIN 0002 and CLIN 0003)

1. The Contractor shall participate in a kick-off meeting.

2. The Contractor shall submit a written Task Management Plan detailing the activity schedule, including the tasks and duration for each activity included in the project.

3. The Contractor shall participate in weekly meetings during the development of the VDE, and then monthly conference call meetings throughout the duration of the base period. The Contractor shall take meeting notes during these meetings and provide them to BLS. Notes shall include the meeting agenda, summary of the discussion topics, any decisions made during the call, and action items.

4. The Contractor shall submit via email brief weekly progress reports during the constructions of the VDE, and then monthly status reports throughout the duration of the base period. During the VDE construction, the reports shall include the work completed in the previous week, goals for the current week, identification of any risk factors that could affect the timely completion of the VDE, and contingency plans for those risks. After the implementation of the VDE, monthly reports shall include at a minimum: a daily log of VDE usage, total number of projects supported, average number of concurrent users, any security risk factors and identification of how the risk will be mitigated, and any other issues that occurred with the VDE.

B. Technical Tasks (CLIN 0001):

5. The Contractor shall build a virtual data enclave that conforms to the requirements listed.

a. The virtual data enclave (VDE) shall ensure secure access to the CFOI research file and the NLS geocode file that are both considered controlled unclassified information (CUI).

b. The contractor shall ensure the virtual data enclave is built to adhere to CIPSEA (https://www.bls.gov/bls/cipsea.pdf) and NIST 800-171 based confidentiality and security requirements for CUI in a Non-Federal System.

c. The VDE shall be a secure solution with controls that prevent all users from emailing, copying, printing, capturing screenshots, sharing, or moving files and confidential data outside the VDE environment.

d. The VDE will provide technical controls to only provide access to agency approved researchers at specified locations.

e. The VDE shall house four BLS data sets – the CFOI (less than 1GB) and three NLS geocoded datasets with restricted variables

(10 GB).

f. The VDE shall have capacity for 50 approved research projects and 20 researchers working concurrently. The VDE shall be scalable up to having capacity for 400 projects and 80 concurrent users. Some projects have multiple researchers affiliated with them.

All adjustments to the capacity for the number of projects and concurrent users are to be executed by a modification(s) per FAR 52.217-6. Such modification(s) may be executed individually or in conjunction with modification(s) to exercise option years per FAR 52.217-9 (1001, 2001, 3001, and 4001) or extension period(s) per FAR 52.217-8. The capacity for the number of projects and/or concurrent users is anticipated to vary throughout the POPs of the contract, but contractual adjustments to the quantity(ies), when needed, will not be implemented more frequently than once per quarter (three months). The contractor shall deliver quarterly adjustments for option years on dates outlined in Attachment J.C.2 - Contract Line Items and Anticipated Dates. Dates outlined in the attachment represent the best estimates and are subject to change; they will be finalized prior to the base award. The aforementioned adjustments are either to be delivered at the time of option year(s)’s exercise and/or 90, 180, 270 days after their respective option year exercise. Due to the uncertainty of the completion timeline of CLIN 0001, the exact start date of CLIN 0002’s POP and the quantity of adjustment(s) (CLIN 0003) and their timing cannot be determined at the time of solicitation. Their anticipated periods are listed in Attachment J.C.2. The government will issue a modification at least 10 days prior to the required delivery of adjusted capacity for projects and/or concurrent users. Once an adjustment is made, the capacity for the number of projects and concurrent users supported by the Data Enclave will remain unchanged until a subsequent quarterly adjustment or through the end of the period of performance for which the adjustment falls under, whichever occurs first.Although the capacity for the number of projects and concurrent users will only fluctuate by modification(s) executed per FAR 52.217-6, the vendor shall add and remove projects and users throughout the life of the contract, as long as those additions and removals do not exceed the available capacity exercised on the contract.

g. The VDE shall have a secure workspace for each approved project. The VDE shall have workspace with a minimum of 200GB and maximum of 500GB for each researcher project working with NLS data and a maximum of 200 GB for each researcher project working with CFOI data.

dell_k Highlight

h. The VDE shall restrict researcher access to the data sets approved for use by BLS. The VDE shall contain a shared workspace for researchers working on the same approved project.

i. The VDE shall accommodate researchers requests for statistical software to include but not limited to: SAS, Stata, StatTransfer, R and R Studio, SPSS, Python, and a text editor.

j. The contractor shall allocate virtual space to have publicly available datasets uploaded to the enclave to allow researchers to combine them with the restricted BLS data. For researchers interested in adding licensed datasets, the contractor shall obtain BLS approval prior to uploading any licensed data into the VDE. The system shall ensure all uploaded information is scanned to prevent viruses from entering the data enclave. The minimum space for this is 100 GB.

k. The VDE shall include a space for researchers to save outputs that they wish to have approved for public dissemination. This space shall allow BLS staff to review and approve those outputs for disclosure concerns. Upon approval, a partition must exist where the researchers can download BLS approved outputs. The minimum size for this space is 100GB.

6. The contractor shall create a database that shall track all current agreements and agents that have been issued to researchers accessing the VDE. The database shall include the BLS agent’s name and user credentials, date access was given, and the date the LOA expires. Access for new BLS agents shall be completed within three business days of receipt of BLS LOA. Access shall be removed immediately on the LOA expiration date. All dates will be provided by BLS. In addition to removing access based on expiration date, the contractor shall remove any agent’s access within 24 hours of being requested by BLS. This database should also be readily transferrable to an Excel or Access file.

7. The contractor shall provide a report to demonstrate the VDE complies with all applicable security requirements including NIST 800-171. If using a cloud based solution, the vendor shall also include their FedRamp systems security plan.

8. The contractor shall provide a virtual demonstration of the VDE and BLS agreement and agent database within 5 days of their completion. The contractor shall demonstrate the VDE and database have all the required capabilities listed in task 5 and 6.

9. BLS will provide feedback within 10 days of the presentation, and the contractor shall make any updates needed to the VDE or database within 10 days of receiving feedback.

C. Maintenance Tasks (CLIN 0002 and CLIN 0003):

10. Confidentiality and Security Requirements. The contractor shall comply with all Confidentiality and Security Requirements as outlined in Attachments J.H.1 to J.H.3 of the contract through steps outlined in their quality control plan.

11. The contractor shall maintain the VDE in order to support the current level of projects and concurrent users that are specified in the base period. This includes providing access to BLS approved projects, ensuring adequate space is available to support the number of projects and concurrent users, and removing access from BLS agents whose projects have completed. Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends, be communicated to VDE users and the BLS COR and Task Monitors at least 5 calendar days in advance, and occur no more than 24 hours per quarter.

12. The contractor shall provide technical support to BLS staff and BLS agents using the VDE by email. Supported topics shall be related to accessing and using the VDE. The support will not include questions about the CFOI or NLS microdata. Emails requests shall be responded to within two business days.

1.4.1 Option Year Tasks:

The Contractor shall perform the 4 tasks listed below for each Option Year:

A. Administrative Tasks (CLINs 1001, 1002, 2001, 2002, 3001, 3002, 4001, 4002):

1. The Contractor shall participate in monthly conference call meetings throughout the duration of each Option Year. The Contractor shall take meeting notes during these meetings and provide them to BLS. Notes shall include the meeting agenda, summary of the discussion topics, any decisions made during the call, and action items.

2. The Contractor shall submit via email brief monthly reports throughout the duration of each Option Year. Monthly reports shall include a snapshot of the VDE database, a list of removed agents from the previous month, a daily log of VDE usage, total number of projects supported, average number of concurrent users, any security risks and identification of how the risk will be mitigated, and any other issues that occurred with the VDE.

B. Maintenance Tasks (CLINs 1001, 1002, 2001, 2002, 3001, 3002, 4001, 4002):

3. Confidentiality and Security Requirements. The contractor shall comply with all Confidentiality and Security Requirements as outlined in Attachments J.H.1 to J.H.3 of the contract through steps outlined in their quality control plan and systems security plan.

The BLS maintains the right to conduct site inspections to ensure compliance with CIPSEA, FedRamp (if cloud based) and NIST requirements.

4. The contractor shall maintain the VDE in order to support the current level of projects and concurrent users that is specified in each Option Year. This includes providing access to BLS agents attached to approved projects, ensuring adequate space is available to support the number of projects and concurrent users, and removing access from users whose projects have completed. Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends, be communicated to VDE users and the BLS COR and Task Monitors at least 5 calendar days in advance, and occur no more than 24 hours per quarter.

5. The contractor shall provide technical support to BLS agents using the VDE by email. Supported topics shall be procedures for accessing the data and any access issues to the VDE. Emails requests shall be responded to within two business days.

1.4.2 Closeout Tasks:

The contractor shall perform 2 tasks during final contract closeout.

1. 30 days prior to contract expiration or termination, the Contractor shall provide a closeout plan how they will preserve, transfer or destroy the Agency data stored in the VDE based on the Agency’s direction. BLS will provide approval of the plan prior to execution.

2. Upon expiration or termination of this Contract, the Contractor shall ensure that no Data Breach occurs and shall follow the approved plan to preserve, transfer, or destroy the Agency Data stored in the VDE. The contractor shall preserve and deliver to BLS any project data that has been created by researchers in the VDE. For all other data, the contractor shall destroy it by “purging” or “physical destruction”, in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-171 section

3.8.3 media protection. The Contractor shall certify in writing that the destruction of data has been completed.

1.5 Contract Information

Quality Control: The Contractor shall develop and maintain an effective quality control plan (QCP) to ensure services are performed in accordance with this PWS including the Performance Requirement Summary (PRS). The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective, or subpar, services. The Contractor’s quality control program is the means by which the Contractor assures that work performed complies with the requirement of the contract. The QCP shall be delivered within 10 days after award of the contract.

1.5.1 Quality Assurance: The government shall evaluate the Contractor’s performance under this contract in accordance with Attachment J.H.4 - Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards shall be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.2 Place of Performance: All work shall be performed at the Contractor’s worksite.

1.5.3 Type of Contract: The government shall award a firm-fixed-price contract with optional line items for increasing the quantity of projects and concurrent users.

1.5.4 Contracting Officer’s Representative (COR): In order to improve and standardize the federal acquisition workforce, the Office of Federal Procurement Policy created the Federal Acquisition Certification for Contracting Officer’s Representatives (FAC-COR).

The program establishes core competencies and sets government-wide standards regarding minimum training requirements for all CORs. The COR shall be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements; monitor the Contractor's performance and notify both the Contracting Officer and Contractor of any deficiencies;

coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.5 Task Monitors: Task Monitors shall be assigned and assist the COR as the technical subject matter expert(s). The task monitor shall not provide technical direction to the Contractor without the COR's involvement.

1.5.6 Key Personnel: Two key personnel labor categories shall be designated for this contract. The Contractor shall provide the Contracting Officer with the name of the key personnel and alternate(s) who shall act for the Contractor when the key personnel are absent. No substitution of key personnel is to be made without the prior written approval of the Contracting Officer. The Contractor shall comply with all duties and qualifications listed in section 1.5.6.1 of the PWS.

1.5.6.1 Key Personnel Labor Categories and Qualifications: The Contractor shall designate staff to fill the labor category listed below.

The key personnel shall meet the minimum qualifications for the labor category.

a. Project Manager (PM) – The PM shall be responsible for the performance of all work conducted under the contract. The PM shall organize and direct a project team who shall carry out the tasks listed in Section 1.3 Tasks. The PM shall serve as the liaison between Contractor personnel, the Contracting Officer's Representative (COR) and Task Monitors and shall have overall responsibility for all administrative matters. The PM shall be available to communicate with the Government by telephone or email between 8:00 am and 4:30 pm, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

Qualifications

The Project Manager shall be a member of the Contractor's organization with training and/or experience in managing and administering a virtual data enclave as described in Section 1.3 Tasks. The Project Manager shall have a minimum of three years of experience working with and maintaining a virtual data enclave.

b. Information Security Officer (ISO) – The ISO is responsible for ensuring the data security of the data enclave. They will be in charge of implementing effective technology solutions to prevent internal and external malicious users from compromising BLS data integrity. Implement and monitor information security requirements, policies, and compliance. Assist with regulatory and data transfer procedures and document the current state of the VDE system.

Qualifications

The Information Security Officer shall have a bachelor’s degree in cyber security or a related degree and a minimum of four years of experience ensuring federal information security compliance standards are met and enforced. Standards shall include some or all of the following: OMB, FISMA, and/or NIST Federal Policies, Directives and Standards.

1.5.6.2 Travel: No travel shall be authorized for this contract.

PART 2

DEFINITIONS & ACRONYMS

2.1. Definitions:

2.1.1. AGENT: An individual who meets the definition of agent as set forth by CIPSEA and who has been designated by the BLS to perform exclusively statistical activities under an agent agreement.

2.1.2. BLS AGENT AGREEMENT: A formal legal agreement used to designate non-BLS employees as BLS agents under the authority of CIPSEA. Agent status authorizes non-BLS employees to access CIPSEA-protected data for exclusively statistical purposes. There are different versions of agent agreements depending on the organizational affiliation of the individual and the circumstances involved.

2.1.3. CONCURRENT USERS: The number of researchers able to access the virtual data enclave at any given time.

2.1.4. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.5. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.6. CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.7. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.8. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.9. KEY PERSONNEL. Contractor personnel that are evaluated in the evaluation process and that may be required to be used in the performance of the contract. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.10. LETTER OF AGREEMENT: Authorizes the provision of sensitive information and the requirements for protecting that information with a university or non-profit institution.

2.1.11. MEMORANDUM OF UNDERSTANDING: Authorizes the provision of sensitive information and the requirements for protecting that information with a Federal or State agency.

2.1.12. PROJECT: A research proposal submitted and accepted by the BLS. Each project may have multiple researchers/users who will be required to complete a BLS agent agreement prior to gaining access to the VDE.

2.1.13. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.14. QUALITY CONTRL PLAN (QCP). A written document specifying how the Contractor shall monitor and control quality of all services to be provided.

2.1.15. QUALITY ASSURANCE SURVELLIENCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.16. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.17. SUBCONTRACTOR. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.18. TASK MONITOR. BLS subject matter experts who shall support the COR in contract management and deliverable review.

2.2. Acronyms:

BLS Bureau of Labor and Statistics

CO Contracting Officer

COR Contracting Officer Representative

FAR Federal Acquisition Regulation

LOA Letter of Agreement

MOU Memorandum of Understanding

OCI Organizational Conflict of Interest

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

QCP Quality Control Plan

TMP Task Management Plan

VDE Virtual Data Enclave

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1. Services: The Government will answer questions about BLS data or procedures, review and provide feedback on deliverables.

3.2 Facilities and Equipment: No facilities or equipment shall be provided under this contract.

3.3 Materials: The Government will provide all BLS restricted data sets to be accessed within the VDE. These data sets will be provided as flat files. The government will also provide a list of approved research agreements, including researcher contact information, approved data sets, and confirmation that the researchers have an approved MOU/LOA and have completed required BLS training. Datasets may be updated yearly updated with new information.

PART 4

CONTRACTOR PROPERTY, EQUIPMENT, AND SERVICES

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed as Government furnished items and services.

4.2. Materials: The Contractor shall furnish all materials required to perform work under this contract including office supplies.

4.3. Equipment: The Contractor shall furnish and maintain all necessary equipment required to perform work under this contract including but not limited to computers, hardware and software required to conduct analysis.

PART 5

DELIVERABLES SCHEDULE

5.1. Deliverables Table: The following is a list of deliverables and delivery dates. The final delivery dates shall be mutually agreed upon between BLS and the Contractor during the kick-off meeting and shall be included in the Task Management Plan (TMP). Each written deliverable shall first be submitted as a draft and then revised based on BLS feedback. An estimation of 10 business days should be allowed for BLS review and feedback.

CLIN 0001 and Base Period Tasks Deliverable Frequency # of Copies Medium/Format Submit To

1. Kick off and clarification meeting

Within 10 business days of award.

Teleconference

COR and Task Monitor

2. Task Management Plan and Quality Control Plan

2 weeks after kick off meeting

1 MSWord COR and Task Monitor via email

3. Meeting notes

Within 2 business days after meeting

1 MSWord COR and Task Monitor via

4. Monthly Progress Reports

Every Friday during VDE constructions, and by the 5th day of the month for the duration of the base period.

1 MSWord COR and Task Monitor via email

5. VDE Development Complete

90 days after meeting

COR and Task Monitor

6. Database of BLS agreements and agents

90 days after meeting

COR and Task Monitor

7. Documentation that VDE complies to all applicable security requirements including NIST 800-171

Proof of compliance due 90 days after kick off meeting.

Confirmation of continued compliance shall be included in monthly reports.

1 MSWord COR and Task Monitor

8. Presentation of the VDE and BLS agreements and agents database

Within 5 days of VDE and Database Completion

COR and Task Monitor

9. Complete updates to the VDE and BL S agreements and agents database

Within 10 days of receiving BLS feedback

COR and Task Monitor

Option Year Tasks

1. Meeting notes

Within 2 business days after meeting

1 MSWord COR and Task Monitor via

Option Year Tasks

2. Monthly Progress Reports

By 5th day of the month for the duration of each option year.

1 MSWord COR and Task Monitor via

Closeout Tasks

1. Submit closeout plan 30 days prior to contract expiration or termination

1 MS Word CO, COR and Task Monitor via email

2. Certify in writing that the return or destruction of data has been completed.

1 day after to contract completion

1 MSWord CO, COR and Task Monitor via email

5.2 Acceptance: The COR and BLS Task Monitor(s) shall make final inspection and acceptance of all deliverables to ensure they conform to the requirements listed in section 1.4 Tasks.

PART 6

PERFORMANCE REQUIREMENTS SUMMARY

6.1 PRS: Below is a set of performance objectives and standards. The contractor shall adhere to all performance objectives and standards.

Performance Objective

Performance Standard

Maximum Allowable Deviation from the Requirement (AQL)

Method of Surveillance

Consequences of Noncompliance

Staffing

The Contractor shall provide key personnel with the qualifications required in the PWS.

Key Personnel proposed shall have the experience and skills required by the qualifications in the PWS.

No Deviation allowed.

100% Inspection of Resumes

Impact on CPARS review.

Quality Control

The Contractor shall develop and adhere to quality requirements

The Contractor has a quality control plan which specifies procedures to identify, prevent, and ensure non-recurrence of defective or subpar deliverables and adherence to all security requirements.

No allowable deviation.

inspection

Timelines

The Contractor shall meet established deadlines for deliverables.

Deliverables are completed by the deadline established in the task management plan.

Deliverables may be provided up to 2 days past the deadline, if the delay is communicated to the agency at least a week in advance.

inspection

Impact on CPARS review.

Communication

The Contractor shall maintain communication with the agency about delays and unexpected issues that may impact the project schedule, or quality of deliverables.

Contractor informs BLS of any delays at least a week in advance of deadline.

Any issues that could impact performance at any point during performance are communicated to BLS within 3 business days of being identified.

Communication shall be provided within the standard time 95% of the time.

Customer feedback from Task Monitors.

Technical Support

The contractor shall provide technical support to BLS agents via email.

Email questions are responded to within two business days.

Responses shall be provided within the standard time 95% of the time.

BLS Agent feedback

Impact on CPARS review.

BLS Agent Access Management

The contractor shall ensure access and removal of access comply with section B.6.

Access for new BLS agents shall be completed within three business days after receipt of BLS LOA. Access shall be removed immediately on the LOA expiration date. All dates will be provided by BLS.

In addition to removing access based on expiration date, the contractor shall remove any agent’s access within 24 hours of being requested by

BLS.

Additions shall meet the standard 95% of the time each quarter and removals shall meet the standard 100% of the time each quarter

Periodic Surveillance

Impact on CPARS review.

Schedule downtime of the VDE The contractor shall ensure scheduled VDE downtime occurs in accordance with sections 1.4 C 11 and 1.4.1 B4.

Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends, be communicated to VDE users and the BLS COR and Task Monitors at least 5 calendar days in advance, and occur no more than 24

Duration of scheduled downtown shall meet the standard 95% of the time each quarter

Periodic Surveillance hours per quarter.

Availability of the

VDE

The contractor shall ensure the VDE is available to all covered projects and concurrent users.

The VDE shall be available to users at all times.

VDE users and BLS staff shall be notified within 5 calendar days in advance of any planned downtimes.

No more than 5% of unscheduled downtime occurs during each quarter.

No deviation from the standard unless a security breach is identified.

BLS Agent feedback and Periodic Surveillance

Impact on CPARS review, possible termination for cause.

Security

The contractor shall conform to security requirements listed in Attachments J.H.1 to J.H.3.

All software, hardware, systems and contractor staff handling confidential data function properly and are compliant with the requirements of Attachments J.H.1 to J.H.3.

No deviation from the standard is allowed.

Periodic Surveillance

Impact on CPARS review, possible termination for cause.

D - Packaging and Marking

This section is intentionally left blank.

E - Inspection and Acceptance

This section is intentionally left blank.

F - Deliveries or Performance

This section is intentionally left blank.

G - Contract Administration Data

G.1 INCORPORATION OF CONTRACTOR'S QUOTE

It is understood and agreed that the Contractor(s) quote to the U.S.