19AQMM24R0113 - Appendix I - Draft.docx

19AQMM24R0113

Appendix 1

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 GENERAL

The Contractor shall provide and support the CA/CST Next Generation (NextGen) Passport Personalization Printers at all Domestic Passport Sites, 29 domestic passport Agencies, Passport Centers, non-production environment (NPE) sites and new site locations as required. The Contractor shall provide program management and support services, transition support, consumable materials, warranty, support services at passport site locations, support site location for labs, enhancement software, relocation for Agency moves (low-capacity printers) and travel. Optional services include the purchase of personalization printers, consulting services, shipping with or without storage, installation, integration and training, support site locations for warehouse, security augmentation, relocation for Agency moves (high-capacity printers) and decommission/disposal of printers as required in accordance with Section C, Statement of Work.

B.2 CONTRACT TYPE

This is a single-award indefinite-delivery, indefinite-quantity (IDIQ) contract, as defined in Federal Acquisition Regulation (FAR) 16.504 (Indefinite-Quantity Contracts).

The DoS Office of Acquisition Management (A/LM/AQM) will issue Firm Fixed Price (FFP) or Time and Material (T&M) Delivery/Task orders in accordance with FAR Part 16.5 and the procedures set forth in Sections G and I. Hybrid task orders may also be issued.

B.3 MINIMUM AND MAXIMUM QUANTITIES

The Government shall meet the contract minimum of support services required at all Passport Site Locations through the issuance of delivery/task order(s) within the contract’s period of performance.

The maximum for the contract’s period of performance, including any extension(s), shall be any quantity or combination of supplies and services not exceeding 15 high capacity printers including all related shipping, installation, warranties, consumables, and transition costs AND 10 low capacity printers including all related shipping, installation, warranties, consumables, and transition costs.

B.1. PRICE/COST

In order to be considered for contract award, the offeror must propose pricing for all CLINs, unless otherwise noted.

The Offeror shall submit pricing for each CLIN using Attachment A, Pricing Table.

B.5 OTHER DIRECT COSTS

The Contractor shall bill ODCs on a cost reimbursable basis. Costs are defined as the purchase price of materials or service plus General and Administrative (G&A) charges or material and handling (M&H) charges. The Contractor shall ensure that all ODCs receive prior approval from the GTM/COR in writing via email. Invoice submissions must include the COR email approval and all receipts to support charges for the reporting period. Estimated ODCs are for Miscellaneous and Material/IT Hardware.

B.6 TRAVEL COSTS (Cost-Reimbursement)

(a) Except as otherwise provided herein, the Contractor shall be reimbursed for its reasonable actual travel costs in accordance with its usual accounting practices consistent with FAR Subpart 31.2, specifically FAR31.205-46. Travel must be directly related to and required for performance of this contract, and authorized in advance and in writing by the Contracting Officer's Representative (COR). In no event shall costs associated with employee commuting be reimbursable as a direct cost under this contract.

(b) The Contractor shall include a breakout of all authorized travel expenses as an attachment to its invoices.

(c) Administrative support (coordination of travel arrangements, etc.) will be the responsibility of the Contractor.

(d) Should any Contractor personnel be requested to perform in any area which has been determined by the Department of State to be a hazardous duty area, hazardous duty premium pay may be payable at the same rate as would be given to Department of State direct hire employees pursuant to Chapter 650 of the U.S. Department of State Standardized Regulations (Government Civilians, Foreign Areas). Each employee will be notified upon arrival at any hazardous duty area of the applicable rates, terms, and conditions at the time of performance. Hazardous duty premium pay shall not be burdened with any indirect costs (e.g., overhead, G and A) or fee/profit.

(e) When local travel between the Contractor employee's regular place of performance and other locations is specifically authorized by the COR, transportation expenses shall be allowable costs under this contract. For the purposes of this clause, local travel means travel within a 50 mile radius of the Contractor employee's regular place of performance and does not include daily commuting or associated costs.

(f) For travel where use of a personal automobile has been specifically authorized by the COR, reimbursement shall be computed on the basis of actual miles traveled from stat starting point to destination. Other related miscellaneous expenses, such as tolls and parking fees, incurred in the performance of tasks authorized under this contract, will be reimbursed. Car rentals require advance approval by the COR and will be authorized only when consistent with good business practice. Allowable costs shall not exceed the actual cost of renting a compact automobile (a maximum of one for four Contractor personnel), unless extenuating circumstances (e.g., excess baggage) require other arrangements and subsequent COR approval is obtained.

(g) The Government will reimburse the Contractor for Contractor employee's travel time to or from other authorized work locations, except that for labor categories which are exempt from the Fair Labor Standards Act (FSLA), a reimbursement will be allowed only for travel during the employee's regular working hours. The Contractor will not be reimbursed for time spent in stand down or temporary layovers by FLSA exempt contractor employees for the convenience of the Contractor except as authorized by the Federal Travel Regulations.

(h) The Contractor shall be responsible for ensuring that all personnel who will be required to travel outside the United States have current and valid passports. The Contractor shall also be responsible for obtaining any visas required for travel to foreign countries under this contract. The Contractor shall make no direct labor charges for obtaining/maintaining passports and/or visas.

SECTION C – DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

See Appendix 2

SECTION D – PACKAGING AND MARKING

See the Solicitation Form SF33

SECTION E – INSPECTION AND ACCEPTANCE

SECTION F – DELIVERABLES OR PERFORMANCE

F.1 PLACE OF PERFORMANCE.

The place of performance will be specified in each Delivery/Task Order issued under the contract.

F.2 DELIVERY INFORMATION.

Specific delivery terms, to include date of delivery and point of delivery will be set forth in each Delivery/Task Order issued under the contract.

F.3 DELIVERABLES/REPORTS

The following table includes deliverables and expected due dates. Deliverables will be provided electronically in a Microsoft Office Suite product pre-approved by the Government.

The GTM/COR will review preliminary or draft documentation that the Contractor submits for completeness and accuracy and may return it to the Contractor for correction. Absence of any comments by the GTM/COR will not relieve the Contractor of the responsibility for complying with the requirements. The GTM/COR will grant final approval and acceptance of documentation required by email. The Contractor shall not construe any acknowledgment of receipt as a waiver of review, or as an acknowledgment that the material is in conformance with the requirements. Any approval given during preparation of the documentation, or approval for shipment will not guarantee the final acceptance of the completed documentation.

All deliverables shall be saved on SharePoint or ShareDrive or Government specified locations.

COR

COR

COR

COR

COR

COR

COR

COR,

Designee

COR,

Designee

COR,

Designee

COR

Legend: DATOA – Days after Task Order Award

F.4 TECHNICAL PERFORMANCE STANDARDS

The Contractor shall define technical performance standards in the Quality Control Plan (QCP) that align with all technical tasks in Section C. The Contactor shall define specific performance metrics, establish a performance baseline or minimum acceptable quality level (AQL), and describe the monthly reporting methodology for each metric. The Contractor shall also define a target performance level for each metric, and a quality improvement path and schedule. The QCP shall also include a description of the process for corrective action, should the minimum AQL not be met during a performance review period. All performance metrics, quality levels, and reporting procedures are subject to Government COR review and approval.

Performance Requirement Summary

Desired Outcomes

Failure to meet the AQL will result in a 2% reduction of monthly fixed price (low capacity)

Failure to meet the AQL will result in a 2% reduction of monthly fixed price (low capacity)

Failure to meet the AQL will result in a 2% reduction of monthly fixed price (low capacity)

Annually, the COR will review performance standards achieved for determining CPARS ratings. If performance achieved is predominately equal to the Acceptable Quality Level, the Contractor will receive a “satisfactory” rating in CPARS. If performance achieved is predominately equal to or better than the Performance Standard, the Contractor will receive a “Very Good” or “Exceptional” in CPARS.

SECTION G – CONTRACT ADMINISTRATION DATA

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1 ORGANIZATIONAL CONFLICT OF INTEREST

(a) The Contractor warrants that, to the best of its knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, or that the Contractor has disclosed all such relevant information.

(b) Access to and use of information.

(i) If the Contractor, in the performance of this contract, obtains access to information such as Department plans, policies, reports, studies, financial plans, internal data protected by the Privacy Act of 1974 (Pub. L. 93-579), or data which has not been released or otherwise made available to the public; the Contractor agrees that without prior written approval from the Contracting Officer it shall not: (a) use such information for any private purpose unless the information has been released or otherwise made available to the public; (b) compete for work for the Department based on such information for a period of six months after either the completion of this contract or until such information is released or otherwise made available to the public, whichever occurs first; (c) submit an unsolicited proposal to the Government which is based on such information until one year after such information is released or otherwise made available to the public; or (d) release such information unless such information has previously been released or otherwise made available to the public by the Department.

(ii) In addition, the Contractor agrees that to the extent it receives or is given access to proprietary data, data protected by the Privacy Act of 1974, or other confidential or privileged technical, business, or financial information under this contract, it shall protect this information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished.

(iii) The Contractor shall have, subject to patent, data, and security provisions of this contract; the right to use technical data it first produces under this contract.

(c) The Contractor agrees that if an actual or potential organizational conflict of interest is discovered after award, the Contractor will make a full disclosure in writing to the Contracting Officer. This disclosure shall include a description of actions which the Contractor has taken or proposes to take to avoid or mitigate the actual or potential conflict.

(d) If the Contractor was aware of a potential organizational conflict of interest prior to award or discovered an actual or potential conflict after award and did not disclose or misrepresented relevant information to the Contracting Officer, the Government may terminate the contract for default.

(e) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts.

H.2 SECTION 508 COMPLIANCE.

(a) All electronic and information technology (EIT) products or services furnished under this contract (and any resultant TO) shall comply with the Section 508 Accessibility Standards (36 CFR 1194). The contractor shall, at no cost to the Government, repair or replace any non-compliant products or services within the period of time specified by the Contracting Officer. Information about Section 508 is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/standards.htm.

(b) All exceptions to paragraph (a) must be approved in writing by the Contracting Officer. When requesting an exception, the contractor shall provide written documentation to the Contracting Officer addressing the exception standards in FAR 39.204.

H.3 KEY PERSONNEL

The Contractor shall assign key personnel (staff considered to be essential to the work being performed) to this contract. Key Personnel shall be assigned as follows:

LABOR CATEGORY NAME

PROGRAM MANAGER

DEPUTY PROGRAM MANAGER

[Program Manager’s name and other key personnel labor categories and names to be inserted by Offeror at time of proposal submission.]

The Program Manager and Deputy Program Manager must be a U.S. citizen and able to obtain and maintain a SECRET level security clearance. The Contractor may propose additional key personnel. Positions and names are to be provided at time of proposal submission.

The Contractor shall assign its key persons, whose resumes are submitted with the proposal, to fulfill the requirements of the contract. During the first ninety (90) days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

The Contractor shall not substitute any key personnel without prior notification to and concurrence of the Contracting Officer. The Contractor shall ensure that all proposed substitutes meet or exceed the qualifications of the person to be replaced. The Contractor shall notify the Contracting Officer in writing of any proposed substitution at least forty-five (45) days, or ninety (90) days if a security clearance is to be obtained, in advance of the proposed substitution. The Contractor shall ensure that such notification includes:

· An explanation of the circumstances necessitating the substitution

· A complete resume of the proposed substitute

· Any other information requested by the Contracting Officer to enable him to judge whether or not the Contractor is maintaining the same high quality of personnel that provided the partial basis for award

H.4 SECURITY

The Contractor shall provide a facility at the TOP SECRET security clearance level for initial contract performance in accordance with the DD Form 254, Department of Defense (DOD) Contract Security Classification Specification (CSCS). (See Attachment E – Bidders DD 254).

The Contractor shall ensure that personnel accessing Sensitive But Unclassified (SBU) and / or classified material and / or entering into areas requiring a security clearance have an active, individual security clearance commensurate with the required level of access, prior to contract performance.

The Contractor shall maintain individual clearances for the duration of employment under this contract, or until access requirements change.

The Contractor shall perform this contract in accordance with the current and statutory requirements and with the attached DD Form 254, DOD-CSCS and Federal Acquisition Regulation (FAR) 52.204-2 “SECURITY REQUIREMENTS.”

The Contractor shall safeguard any SBU and/or classified material received or generated in the performance of this contract and shall ensure that the disposal of such material is conducted in accordance with the National Industrial Security Program Operating Manual (DOD 5220.22-M).

H.4.1 Homeland Security Presidential Directive 12 (HSPD-12) and Department of State Acquisition Regulation (DOSAR) 652.204-70 The Contractor shall comply with the DOS Personal Identification Card Issuance Procedures for all employees performing under this contract who require frequent and continuing access to DOS facilities, or information systems.

Homeland Security Presidential Directive 12 (HSPD-12) requires federal agencies to develop and deploy for their contract personnel and employees a Personal Identity Verification (PIV) credential that is secure, reliable, and interoperable among all federal agencies. (NIST 800-116) HSPD-12 mandates the establishment of a government-wide standard for identity credentials to improve physical security in federally controlled facilities. To that end, HSPD-12 requires all government employees and contractors be issued a new identity credential based on the Federal Information Processing Standard Publication (FIPS) 201 on PIV. FIPS 201 is a United States federal government standard that specifies PIV requirements for Federal employees and contractors. Following FIPS 201, this credential is referred to herein as a PIV Card.

HSPD-12 explicitly requires the use of PIV Cards “in gaining physical access to federally controlled facilities and logical access to Federally controlled information systems.”

In response to HSPD-12, the NIST Computer Security Division initiated a new program for improving the identification and authentication of Federal employees and contractors for access to Federal facilities and information systems. FIPS 201 was developed to satisfy the technical requirements of HSPD-12, approved by the Secretary of Commerce, and issued on February 25, 2005.

You must meet a minimum vetting standard and an ID must be issued for physical and logical access.

References:

http://www.state.gov/m/ds/rls/rpt/c21664.htm

The DOS Personal Identification Card Issuance Procedures may be accessed at: http://www.state.gov/m/ds/rls/rpt/c21664.htm

H.4.2 Personnel Security Requirements

a) A facility security clearance at the TOP SECRET level is required for contract performance in accordance with the DD Form 254, Department of Defense Contract Security Classification Specification, attached to this contract.

(b) Since it will be necessary for some Contractor personnel to have access to classified material and/or to enter into areas requiring a security clearance, each Contractor employee requiring such access must have Personal Security Clearance at SECRET or TOP SECRET level of access prior to contract performance. Individual clearances shall be maintained for the duration of employment under this contract, or until access requirements change.

(c) The Contractor shall obtain a Department of State building pass for all employees performing under this contract who require frequent and continuing access to Department of State facilities in accordance with Bureau of Diplomatic Security Instructions.

(d) Performance of this contract shall be in accordance with the attached DD Form 254, Department of Defense Contract Security Classification Specification and FAR 52.204-2 "SECURITY REQUIREMENTS."

(e) Classified material received or generated in the performance of this contract shall be safeguarded and disposed of in accordance with the National Industrial Security Program Operating Manual (DOD 5220.22-M).”

H.4.3 OpenNet Access The Contractor shall ensure that all Contractor personnel that have unescorted physical and / or logical access to OpenNet workstations, servers, and / or encryptors shall possess a SECRET personnel security clearance issued by the DSS (certified to the DOS, DS/IS/IND via a VAR with a Joint Clearance and Access Verification System (JCAVS) Person Summary attached).

The Contractor shall ensure that personnel (e.g. cleaning staff, building maintenance staff) that have not been cleared as described above, but require physical and / or logical access to OpenNet workstations and / or the room housing the server and / or encryption equipment, are escorted at all times by a cleared Contractor employee.

CA/CST ISSO will ensure that individual User IDs and passwords are issued to authorized Contractor users, as outlined in 12 FAM 622.1-3, Password controls.

All Contractor personnel with physical and / or logical access to OpenNet workstations, servers, and / or encryptors shall be given a briefing by the ISSO to ensure that each employee understands their obligations and requirements to adhere to established DOS security policies concerning the use of Automated Information Systems. The Contractor shall agree that the OpenNet connection is subject to on-site and remote auditing, scanning, and testing by DS/SI/CS and recurring inspections by DS/IS/IND as deemed necessary by DS. Audits, scans, testing and inspections will help to assess the compliance of this OpenNet connection with DOS requirements.

The Contractor shall return all media (e.g. hard drives, CDs) used on workstations and/or servers connected to OpenNet shall return to the Sponsoring Bureau when no longer used.

Approval for OpenNet connectivity is valid for up to one year from the date of the original DS/SI/CS Approval Memo. The DOS Sponsoring Bureau will request annual extensions for the Contractor, as necessary, a month ahead of time, or notify DS/SI/CS if the OpenNet requirement ceases or the contract ends before the annual renewal. OpenNet Connectivity approval is only for the Contractor location stated in this OpenNet request. If the approved Contractor performance location changes, the DOS Sponsoring Bureau will submit another OpenNet location request to DS/SI/CS.

If at any time, DS finds that the above listed security requirements are not being met, the OpenNet connection will be subject to termination.

H.5 GOVERNMENT FURNISHED EQUIPMENT (GFE)

The Contractor shall follow these instructions for GFE:

a) Any Government furnished property, equipment, information, materials, or data will remain the property of the Government. The Contractor shall return all Government furnished property, equipment, information, materials, or data to the Government or transfer it to another entity upon request or completion of the support services at the conclusion of this contract. The Contractor shall track Government furnished property, including equipment, through applicable procedures, provided by the CO in accordance with the FAR.

b) The Contractor shall not temporarily use for or transfer to other activities, the equipment allocated to this contract without prior approval from the GTM or COR. In the case of transfer, the Contractor shall prepare and submit a Non-Expendable Property Transaction form (DS-584) for GTM or COR and Asset Management Team approval / action. The Contractor shall prepare the Domestic Property Excess form (DS-1882) for surplus equipment, for GTM or COR and Asset Management Team approval / action.

c) The Government will provide the pre-configured DOS workstations for the secure OpenNet facility.

d) The Contractor shall follow Return Merchandise Authorization (RMA) and Return Authorization (RA) procedures.

H.6 TRAVEL

The Contractor shall follow the following instructions:

a) All travel must be pre-approved by the COR in writing via email. Invoice submissions must include the COR written approval.

b) Local travel within 50 miles of the CA/CST Government location in Washington DC or the relocation of personnel from other geographic areas for the purpose of staffing an order, are not subject to reimbursement. The Government will not pay travel charges for travel to and from the employee’s home and the Government offices, or to and from one company building to another (either within a company or to and from a prime to a sub company). Travel costs subject to reimbursement are limited to travel occurring at the direction of the Government, performed in conjunction with a specific requirement. Costs incurred during local travel for parking, gas, or tolls are not reimbursable.

c) Travel outside of the local metro area may be required. However, a projected trip schedule is not available at this time. Prior to any international travel, the Contractor shall prepare a travel authorization request for COR or designee for review and approval. The Contractor shall prepare and deliver a trip report upon the completion of travel. The Government will reimburse the cost of travel required in conjunction with performance of this contract in accordance with the Federal Travel Regulation (FTR) per diem rates listed at: http://www.gsa.gov/federaltravelregulation.com

H.7 ONBOARDING PROCESS

The Contractor will onboard and charge for personnel only after receiving DS clearances and written approval by email from the COR/GTM.

H.8 FEDERAL HOLIDAYS AND INCLEMENT WEATHER

Federal Holidays and Government closure due to inclement weather, as defined by OPM for the Federal Government for Washington DC area, are considered non-business hours for purposes of the performance standards in this contract.

H.9 OVERTIME

Overtime is defined as time worked in excess of the number of hours in a normal workweek.

“Number of hours” includes productive time hours, travel time hours, and paid time off hours (e.g., sick, vacation, holiday) “Productive time hours” consist of hours that, other than travel time hours, directly benefit the order “Travel time hours” consist of hours spent by the employee traveling to or from authorized work locations A normal workweek is defined as 40 hours per week

The Contractor shall adhere to the following instructions:

a) Payment for overtime will be authorized in writing by the COR/GTM and prior to the employee performing any overtime.

b) Payment for overtime will not conflict with any Contractor uncompensated overtime policy or practice.

c) For labor-hour arrangements and the time portion of time-and-materials arrangements, any Government payment for COR/GTM-authorized employee overtime will be made at the fixed fully-loaded hourly labor rates negotiated in the order for normal workweek performance.

d) For the materials portion of T&M arrangements, any Government payment for Contractor employee overtime will be made at the actual incurred hourly labor rate that the Contractor pays the COR/GTM-authorized employee and determined allowable by the COR/GTM. Such payment will be based on law, regulation, and Contractor policy or practice.

e) A COR/GTM-authorized employee is a Contractor employee who has been granted permission by the COR/GTM to work overtime.

f) The Government generally discourages overtime, so the Contractor agrees to use its best efforts to avoid (and when applicable, control) overtime.

H.10 TELEWORK

Telework is not a requirement for this contract; however it can be performed on a case-by-case basis with prior Government approval, if requested. Telework is an alternate work arrangement that gives contractor employees the opportunity to conduct all or some of their work away from the primary workplace to accommodate both core and situational telework employees within the Department. It has no effect on the hours an employee works. The location of telework is normally the employee’s primary residence. Work from any other place must be approved by the COR before teleworking.

The COR may cancel or adjust the telework arrangement by providing written notice to the contractor. This decision is not subject to dispute, nor does it give rise to a claim under the contract.

The Contractor shall follow adhere to following telework procedures:

1. Contractors shall provide the GTM and COR with a list of accomplishments prior to the end of the business day for all work completed while teleworking.

1. Contractors must be signed into Microsoft Teams and be accessible by email and phone during chargeable business hours.

1. Contractors must make appropriate arrangements ahead of time to call into all meetings.

1. Contractors are not authorized to telework when sick unless pre-approved by the GTM & COR.

1. Contractors are not authorized to telework while caring for someone.

1. If the network becomes unavailable or inaccessible for more than 30 minutes, the Contractor must notify the Government and their supervisor immediately.

h) If any contractor employee abuses this privilege, access will be revoked.

H.11 QUALITY ASSURANCE

The COR/GTM will review preliminary or draft documentation that the Contractor submits, for completeness and accuracy and may return it to the Contractor for correction. Absence of any comments by the COR/GTM will not relieve the Contractor of the responsibility for complying with the requirements of this work statement. Final approval and acceptance of documentation required herein shall be by letter of approval and acceptance by COR/GTM. The Contractor shall not construe any letter of acknowledgment of receipt material as a waiver of review, or as an acknowledgment that the material is in conformance with this work statement. Any approval given during preparation of the documentation, or approval for shipment shall not guarantee the final acceptance of the completed documentation. CA/CST will conduct Contractor performance evaluations in accordance with the Performance Standards.

H.12 EARNED VALUE MANAGEMENT (EVM)

The Contractor shall employ EVM in the management of this contract in accordance with the American National Standards Institute (ANSI)/Electronic Industries Alliance (EIA) Standard-748-A-1998, Earned Value Management Systems. A copy of the standard is available at http://global.ihs.com/. The Government expects the contractor to employ innovation in its proposed application of EVM techniques to this contract in accordance with best industry practices. The following EVM status information shall be included in each CSR:

a. Planned Value (PV)

b. Earned Value (EV) or BCWP

c. Actual Cost (AC) or ACWP

d. A cost curve graph plotting PV, EV, and AC on a monthly basis, from inception of the TO through the last report, and plotting the AC curve to the estimated cost at completion (EAC) value.

e. An EVM variance analysis that includes the following:

1. Cost Variance (CV) = (EV - AC)

2. Cost Variance % = (CV/PV X 100%)

3. Cost Performance Index (CPI) = (EV/AC)

4. Schedule Variance (SV) = (EV minus PV)

5. Schedule Variance % = (SV/PV X 100%)

6. Schedule Performance Index (SPI) = (EV/PV)

7. Estimate at Completion (EAC)

8. Budget at Completion (BAC)

9. AC cum + 1/CPI X (BAC minus EV cum)

10. AC cum + 1/CPI X SPI X (BAC minus EV cum)

11. Variance at Completion (VAC) = (BAC minus EAC) for EAC

12. Variance at Completion % + (VAC/BAC X 100%) for EAC

13. Estimate to Completion (ETC)

14. Expected Completion Date

f. Explain all variances greater than ten percent.

g. Explain, based on work accomplished as of the date of the report, whether the performance goals will be achieved.

h. Discuss the corrective actions that will be taken to correct the variances, the risk associated with the actions.

The Government will conduct an Integrated Baseline Review within 60 calendar days after contract award, at the exercise of significant contract options, and after incorporation of major contract modifications. The objective of the Integrated Baseline Review is for the Government and the contractor to jointly assess areas, such as the contractor’s planning, to ensure complete coverage of the SOW, logical scheduling of the work activities, adequate resources, and identification of inherent risks.

H.13 CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT (FEB 2023)

(a) Definitions. As used in this clause:

Covered article - The term "covered article" includes-

(1) "Information and Communications technology" which means-

(i) any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use of that equipment, or of that equipment to a significant extent in the performance of a service or the furnishing of a product.

(ii) computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; however, does not include any equipment acquired by a federal contractor incidental to a federal contract.

(2) "Telecommunications Equipment", which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

(3) "Telecommunications Service", which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

(4) “Cybersecurity Supply Chain Risk”, which means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

(b) Contractor Cybersecurity Supply Chain Risk Management Responsibilities. The Contractor shall take all prudent actions and comply with all Government direction (as identified in paragraph (c)) to regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services affecting covered articles to the Government. The Contractor shall maintain artifacts that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request.

(c) Supporting Government Cybersecurity Supply Chain Risk Assessments. The Government may perform a cybersecurity supply chain risk assessment at any time during contract administration to identity, assess, and monitor the cyber risks of the Contractor’s supply chain. The Contractor agrees that the Government may, at its own discretion, perform on-site assessments to collect information for the cybersecurity supply chain risk assessment. In performing the cybersecurity supply chain risk assessment, the Government may review any information provided by the Contractor, along with any other information available to the Government from public, unclassified, classified, or any other sources. Examples of information that the Government may collect for the cybersecurity supply chain risk assessment includes the following:

1. Functionality and features of covered articles, including access to data and information system privileges.

2. The user environment where a covered article is used or installed.

3. The ability of a source to produce and deliver covered articles as expected.

4. Foreign control of, or influence over, a source or covered article (e.g., foreign ownership, personal and professional ties between a source and any foreign entity or legal regime of any foreign country in which a source is headquartered or conducts operations).

5. Implications to Government mission(s) or assets, national security, homeland security, or critical functions associated with use of a source or covered article.

6. Vulnerability of Federal systems, programs, or facilities.

7. Market alternatives to the covered source.

8. Potential impact or harm caused by the possible loss, damage, or compromise of a product, material, or service to an organization’s operations or mission.

9. Likelihood of a potential impact or harm, or the exploitability of a system.

10. Security standards of the supplier as demonstrated by cooperation with assessments.

11. Security, authenticity, and integrity of covered articles and their supply and compilation chain.

12. Capacity to mitigate risks identified.

13. Factors that could lead to inability of the supplier to provide security updates.

14. Factors that may reflect upon the reliability of other supply chain risk information.

15. Any other considerations that would factor into an analysis of the security, integrity, resilience, quality, trustworthiness, or authenticity of covered articles or sources.

(d) Non-Destructive and Destructive Testing. The Government may engage in non-destructive and/or destructive testing of any information system, equipment, and software to determine whether it will negatively affect the security or performance of a Department of State information system.

(e) Novation Agreement Notice. FAR 42.1203 require Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

(f) Software Bill of Materials (SBOM) Requests. For software, within 10 business days of request by a Department of State representative, the Contractor shall submit a SBOM to a designated representative. This request may be requested on one (1) or more occasions and shall be delivered at no increase in contract price.

(g) SBOM Sharing Notice. The Contractor consents to the sharing of its SBOM data with other contractors, such as tool solution providers, for the sole purpose of mapping against known vulnerabilities.

(h) Notification procedures for cybersecurity supply chain events. When cybersecurity supply chain events occur, the Contractor must contact the Contracting Officer or his/her designee within 12 hours of the event.

(i) Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

(j) Vulnerability Exploitability eXchange (VEX). The Contractor is required to notify the Department of any discovered software vulnerabilities within 12 hours. Within three (3) days, they shall provide a report using a VEX format.

(k) Attestation following Major Version Change. Critical Software, as defined by National Institute for Science and Technology (NIST) Guidance, that is provided by the Contractor or subcontractors and is modified during the contract’s period of performance by a major version change (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to 3.0) requires a new self attestation. For indefinite delivery contract vehicles, this self attestation must be provided for all critical software available for ordering on the contract vehicle when the software is modified during the contract vehicle’s ordering period of performance by a major version change. The Contractor shall either (i) post the new attestation in a publicly available internet location within 15 days of the major version change and provide the COR, or Contracting Officer if a COR is not appointed, with the internet link or (ii) shall contact the COR, or Contracting Officer if a COR is not appointed, and request the agency’s current software self attestation form and submit it to the Government within 15 days of the major version change. The self attestation form will contain the following elements: (i) the software producer's name; (ii) a description of which product or products the statement refers to including the number of the major version change; and (iii) a statement attesting that the software producer follows secure development practices and tasks consistent with NIST Guidance.

H.14 NONPAYMENT FOR UNAUTHORIZED WORK (05/95)

No payments will be made for any unauthorized supplies or services, or for any unauthorized changes to the work specified herein. This includes any services performed by the Contractor of his own volition or at the request of an individual other than a duly appointed Contracting Officer. Only a duly appointed Contracting Officer is authorized to change the specifications, terms, and/or conditions of this contract.

H.15 SAFEGUARDING OF INFORMATION (05/95)

The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the Contracting Officer. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of the U.S. Government. Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media without the prior written authorization of the Contracting Officer. These obligations do not cease upon the expiration or termination of this contract. The Contractor shall include the substance of this provision in all contracts of employment and in all subcontracts hereunder.

H.16 RESTRICTIONS AGAINST DISCLOSURE

(a) Subject to the provisions of paragraph (c) below, the Contractor agrees, in the performance of this contract, to keep all information which is obtained or otherwise unavailable to the general public, in the strictest of confidence. The Contractor acquires neither possessory nor proprietary interests in such information. The Contractor agrees not to publish, reproduce, or otherwise divulge such information in whole or in part, in any manner or form, at any time, during or following contract performance, no to authorize or permit others to do so. The Contractor agrees to take such reasonable measures as are necessary to restrict access to such information to those employees needing such information to perform the work provided herein, i.e., on a “need to know basis. The Contractor agrees to immediately notify the Contracting Officer’s Representative, in the event that he or she determines or has reason to suspect a breach of any of these requirements or restrictions, and to provide written notification as soon as possible.

(b) The Contractor agrees to include this clause or equivalent language in any agreement or subcontract hereunder.

(c) The Contractor agrees not to disclose any information concerning the work under this contract to any persons or entities unless prior written approval is obtained from the Contracting Officer.

H.17 NON-DISCLOSURE

Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the CO.

The Contractor agrees to assume responsibility for protecting the confidentiality of Government records, which are not public information. Each Contractor or employee of the Contractor to whom information may be made available or disclosed shall be notified in writing by the Contractor that such information may be disclosed only for a purpose and to the extent authorized herein.

The Contractor…