19AQMM25R0032-0001.pdf

19AQMM25R0032

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE RATING

2. AMENDMENT/MODIFICATION NO.

3. EFFECTIVE DATE

12/16/2024

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

LMAQMCODE

OFFICE OF ACQUISITION MANAGEMENT (A/LM/AQM)

PO BOX 9115, ROSSLYN STATION

US DEPARTMENT OF STATE

ARLINGTON, VA 22219

Khoa D Tran

NAME

703-875-5854

TEL.

TranKD@state.gov

EMAIL

6. ISSUED BY CODE

OFFICE OF ACQUISITION MANAGEMENT (A/LM/AQM)

PO BOX 9115, ROSSLYN STATION

US DEPARTMENT OF STATE

ARLINGTON, VA 22219

7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

19AQMM25R0032

CONTACT: UEI:

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

11/25/2024

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning ____copies of the amendment;(b)By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Amendment 0001 is issued to provide responses to interested vendors' questions and to extend the proposal due date to 13Jan2025 at 10:00AM EDT.

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Khoa D Tran

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

12/16/2024

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

CGFS // CGFS

Line Item Summary

Solicitation Number:

19AQMM25R0032

Contract Number: Title: Cybersecurity Support for At Risk Countries

Date of Solicitation:

12/16/2024

Line Item No.

Description Quantity Unit Unit Price Total Cost

001 Base Period: SMEs Support Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

12.00 0.00

12.00

MO $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

BASE PERIOD

002 Base Period: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$5,000.00 $0.00

$5,000.00

BASE PERIOD

003 Base Period: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

BASE PERIOD

101 Option Period 1: SMEs Support Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

12.00 0.00

12.00

MO $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

102 Option Period 1: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$5,000.00 $0.00

$5,000.00

103 Option Period 1: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

201 Option Period 2: SMEs Support Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

12.00 0.00

12.00

MO $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

202 Option Period 2: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$5,000.00 $0.00

$5,000.00

203 Option Period 2: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

Line Item Summary

Solicitation Number:

19AQMM25R0032

Contract Number: Title: Cybersecurity Support for At Risk Countries

Date of Solicitation:

12/16/2024

Line Item No.

Description Quantity Unit Unit Price Total Cost

Section A - Solicitation/Contract Form Identifier Title Date Number of

Pages 1 AQS 19AQMM25R0032.pdf 12/15/2024

B-015 - TRAVEL COSTS (Cost-Reimbursement)

(a) Except as otherwise provided herein, the Contractor shall be reimbursed for its reasonable actual travel costs in accordance with its usual accounting practices consistent with FAR Subpart 31.2, specifically FAR31.205-46. Travel must be directly related to and required for performance of this contract, and authorized in advance and in writing by the Contracting Officer's Representative (COR).

In no event shall costs associated with employee commuting be reimbursable as a direct cost under this contract.

(b) The Contractor shall include a breakout of all authorized travel expenses as an attachment to its invoices.

(c) Administrative support (coordination of travel arrangements, etc.) will be the responsibility of the Contractor.

(d) Should any Contractor personnel be requested to perform in any area which has been determined by the Department of State to be a hazardous duty area, hazardous duty premium pay may be payable at the same rate as would be given to Department of State direct-hire employees pursuant to Chapter 650 of the U.S. Department of State Standardized Regulations (Government Civilians, Foreign Areas). Each employee will be notified upon arrival at any hazardous duty area of the applicable rates, terms and conditions at the time of performance. Hazardous duty premium pay shall not be burdened with any indirect costs (e.g., overhead, G and A) or fee/ profit.

(e) When local travel between the Contractor employee's regular place of performance and other locations is specifically authorized by the COR, transportation expenses shall be allowable costs under this contract. For the purposes of this clause, local travel means travel within a 50 mile radius of the Contractor employee's regular place of performance and does not include daily commuting or associated costs.

(f) For travel where use of a personal automobile has been specifically authorized by the COR, reimbursement shall be computed on the basis of actual miles traveled from stat starting point to destination. Other related miscellaneous expenses, such as tolls and parking fees, incurred in the performance of tasks authorized under this contract, will be reimbursed. Car rentals require advance approval by the COR and will be authorized only when consistent with good business practice. Allowable costs shall not exceed the actual cost of renting a compact automobile (a maximum of one for four Contractor personnel), unless extenuating circumstances (e.g., excess baggage) require other arrangements and subsequent COR approval is obtained.

(g) The Government will reimburse the Contractor for Contractor employee's travel time to or from other authorized work locations, except that for labor categories which are exempt from the Fair Labor Standards Act (FSLA),, a reimbursement will be allowed only for travel during the employee's regular working hours. The Contractor will not be reimbursed for time spent in stand down or temporary layovers by FLSA exempt contractor employees for the convenience of the Contractor except as authorized by the Federal Travel Regulations.

(h) The Contractor shall be responsible for ensuring that all personnel who will be required to travel outside the United States have current and valid passports. The Contractor shall also be responsible for obtaining any visas required for travel to foreign countries under this contract. The Contractor shall make no direct labor charges for obtaining/maintaining passports and/or visas.

(end of clause)

C-001 - STATEMENT OF WORK

U.S. Department of State

COMMISSIONING GLOBAL SUPPORT FOR COUNTER-DPRK CYBERSECURITY SUPPORT IN THE

INTERNATIONAL FINANCIAL SECTOR AND AMONG VIRTUAL ASSET SERVICE PROVIDERS

I. Introduction

There are several U.S. sanctions authorities and other restrictions related to the Democratic People’s Republic of Korea (DPRK), including the North Korea Sanctions and Policy Enhancement Act of 2016, the Iran, North Korea, and Syria Nonproliferation Act, the Countering America’s Adversaries Through Sanctions Act, and others. In addition, it is the subject of a range of United Nations Security Council resolutions (UNSCRs) including UNSCRs 1718, 1874, 2087, 2094, 2270, 2321, 2356, 2371, 2375, and 2397. UN Member States are obligated to implement legally binding measures outlined in these UNSCRs.

The State Department (‘the Government’) works with partner governments on implementation of these sanctions-related measures.

This includes working with foreign financial sector firms and virtual asset service providers, with an emphasis on combatting DPRK theft and money-laundering within crypto-currency exchanges. Currently, the Government intends to commission support from a cybersecurity service provider to assist foreign entities in enhancing their counter-DPRK cybersecurity posture as needed.

II. SCOPE

Pursuant to the terms of the Contract and within the established requirement by the Government, the Contractor shall provide cybersecurity subject matter expertise to foreign governments, financial sector entities, and virtual asset service providers.

A. The Contractor shall provide remote cyber incident response support, cybersecurity consultancy, and forensic analysis services to foreign governments, financial institutions, virtual asset service providers, or other victim entities within 48 hours of notification by the Government.

B. The Contractor shall deploy/provide a minimum of two (2) cybersecurity subject matter experts (SMEs) worldwide within 14 calendar days of notification. The cybersecurity SMEs need not be the same SMEs for each deployment, or the SMEs identified as Key Personnel. Per approval of the COR or Program Manager, the Contractor may deploy/provide different SMEs to satisfy the cybersecurity requirements for each deployment.

C. Deployment requirements will vary based on global/international incidents/circumstances, and may include but not limited to:

1. i. Supporting cybersecurity, information technology (IT), and cyber incident response personnel in identifying, analyzing, responding to, and/or preventing potentially malicious cyber operations targeting private sector or government networks.

ii. Conducting an assessment or audit of the IT design architecture of foreign entities to identify vulnerabilities and recommend solutions.

iii. Providing hands-on assistance in implementing recommended solutions.

iv. Providing training and material detailing cybersecurity best practices.

v. Actively mitigating the effects of an ongoing network intrusion or cyber operation.

vi. Conducting analyses of malicious cyber operations, including collecting forensic evidence and assessing damage to support government or victim efforts to attribute cyber intrusions to specific advanced persistent threats.

vii. Providing reports to victim entities to raise awareness of the attack lifecycle, cybersecurity vulnerabilities, and likely perpetrators.

viii.Producing sanitized incident reports for foreign entities. The Government may require specific reports to be prepared for public release. At the request of the Government, the Contractor may be required to arrange translation of individual reports.

D. The Contractor shall arrange interpretation services as necessary for global/international virtual engagements and deployments.

E. The Contractor shall maintain cybersecurity standards that are, at a minimum, comparable to the NIST Cybersecurity Framework.

F. The Contractor shall provide experienced personnel responding to global/international cyber incidents involving nation state Advanced Persistent Threats (APTs). Specific experience responding to DPRK-origin threats is desirable, but not required.

G. The Contractor shall provide tailored recommendations on how to proceed in a diplomatically sensitive manner.

H. The Contractor shall provide experienced cyber forensic analyst(s) for entirely post-incident engagement.

I. The Contractor shall provide experienced personnel responding to global/international ransomware incidents. Specific experience responding to DPRK-origin ransomware threats is desirable, but not required.

J. The Contractor shall provide experienced personnel in global/international cyber incident response assistance to government and private sector entities. Demonstrated experience supporting blockchain development companies and/or virtual asset exchanges is preferred.

K. The Contractor shall provide experienced personnel in offering post-incident remediation guidance and attribution evidence.

E-004 - INSPECTION AND ACCEPTANCE (Services)

Inspection and acceptance of the services to be provided hereunder shall be made by the Contracting Officer's Representative.

(end of clause)

F-001 - Deliverables

Deliverables Deliverable Recipient Deadline Periodic status report, to include technical progress update and problems encountered, upcoming challenges and plans to address these challenges, staffing progress, licenses obtained, materials acquired, and progress of subcontractors and any other pertinent information deemed relevant during Contract performance.

COR, GTM, and other COR designated ISN personnel.

Monthly

Formal After-Action Report Describing the Virtual Engagement

COR & GTM 10 days following the conclusion of a virtual engagement

Informal E-Mail Describing the Individual Formal Deployments

COR & GTM 3 days following the conclusion of an individual deployment

Formal After-Action Report Describing the Individual Foreign Deployments

COR & GTM 30 days following the conclusion of an individual deployment

Formal After-Action Report Describing Actions Taken, Findings, and Recommended Actions for Foreign Beneficiaries

COR, GTM & Foreign Beneficiaries

30 days following the conclusion of an individual engagement

652.242-70 - CONTRACTING OFFICER'S REPRESENTATIVE (COR) (AUG 1999)

(a) The Contracting Officer may designate in writing one or more Government employees, by name and position title, to take action for the Contracting Officer under this contract. Each designee shall be identified as a Contracting Officer's Representative (COR).

Such designation(s) shall specify the scope and limitations of the authority so delegated; provided, that the designee shall not change the terms or conditions of the contract, unless the COR is a warranted Contracting Officer and this authority is delegated in the designation.

(b) The COR is [insert job title of COR] .

(End of clause)

INV-IPP - ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS AND INSTRUCTIONS TO IMPLEMENT

USAGE OF THE INVOICE PROCESSING PLATFORM (IPP).

(a) Definitions. As used in these instructions

(1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of these instructions, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP) at www.ipp.gov. Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with the IPP application can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866)973-3131. The Contractor shall ensure that its supporting documentation conforms to IPP requirements. IPP accommodates up to 25 supporting attachments per invoice, individual attachment file size may not exceed ten megabytes (10mb). If the Contractor assesses that their supporting documentation will not reasonably conform to IPP requirements, the Contractor shall contact the Contracting Officer to explore possible alternatives. In addition, the IPP only allows certain characters to be used as the invoice number. The invoice number shall conform to the IPP convention and the attachments (if used) shall match exactly the invoice number allowed. The allowed characters in the IPP are “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_”

(c) If the Contractor wishes to be paid via a foreign bank account, the contractor must properly fill out form GFS-FO-CLM-089 and attach it to each invoice in the IPP where payment to a foreign bank account is requested. The form can obtained by e-mailing CGFSIPPITSForm@state.gov.

(d) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing.

(e) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

[End of instructions]

H-016 - KEY PERSONNEL

(1) The Contractor shall assign to this contract the following key personnel:

Project Manager Lead Technical Subject Matter Expert (SME) Deputy Technical Subject Matter Expert (SME)

---Project Manager shall possess active SECRET clearances---

(2) The Contractor agrees that a partial basis for award of this contract is the list of key personnel proposed. Accordingly, the Contractor agrees to assign to this contract those key persons whose resumes were submitted with the proposal necessary to fulfill the requirements of the contract. No substitution shall be made without prior notification to and concurrence of the Contracting Officer. During the first ninety days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

(3) All proposed substitutes shall meet or exceed the qualifications of the person to be replaced. The Contracting Officer shall be notified in writing of any proposed substitution at least forty-five days, or ninety days if a security clearance is to be obtained, in advance of the proposed substitution. Such notification shall include:

(1) an explanation of the circumstances necessitating the substitution;

(2) a complete resume of the proposed substitute; and

(3) any other information requested by the Contracting Officer to enable him to judge whether or not the Contractor is maintaining the same high quality of personnel that provided the partial basis for award.

(end of clause)

H-020 - SAFEGUARDING INFORMATION

The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the Contracting Officer. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of the U.S. Government. Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media without the prior written authorization of the Contracting Officer. These obligations do not cease upon the expiration or termination of this contract. The Contractor shall include the substance of this provision in all contracts of employment and in all subcontracts hereunder.

(end of clause)

H-031 - SECURITY REQUIREMENTS

H-031 - SECURITY REQUIREMENTS

(a) A facility security clearance at the SECRET is required for contract performance in accordance with the DD Form 254, Department of Defense Contract Security Classification Specification, attached to this contract.

(b) Since it will be necessary for some Contractor Personnel to have access to classified material and/ or enter into areas requiring security clearances, each Contractor employee requiring such access must have a SECRET personnel security clearance issued by the Defense Counterintelligence and Security Agency (DCSA) prior to contract performance. Individual clearances shall be maintained for the duration of employment under this contract, or until access requirements change.

(c) The Contractor shall obtain a Department of State building pass for all employees performing under this contract who require frequent and continuing access to Department of State facilities in accordance with Bureau of Diplomatic Security Instructions.

(d) Performance of this contract shall be in accordance with the attached DD Form 254, Department of Defense Contract Security Classification Specification and FAR 52.204-2 "SECURITY REQUIREMENTS."

(e) Classified material received or generated in the performance of this contract shall be safeguarded and disposed of in accordance with the National Industrial Security Program Operating Manual (NISPOM) (32 CFR Part 117)

H-043 - Cybersecurity Supply Chain Risk Management Requirements (AUG 2023)

a. Definitions. As used in this clause:

Covered article - The term "covered article" includes:

1. "Information and Communications technology," which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

2. "Telecommunications Equipment," which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

3. "Telecommunications Service," which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

4. “Cybersecurity Supply Chain Risk,” which means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

1. “Incident,” which means, per the Federal Information Security Modernization Act of 2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

1. "Vulnerability,” means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

a. Contractor Cybersecurity Supply Chain Risk Management Responsibilities. The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

b. Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

a. Novation Agreement Notice. FAR 42.1203 require Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

a. Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the

Contractor must contact the CO or their designee within 72 hours of the incident.

a. Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

a. Attestation following Major Version Change. Critical Software, as defined by NIST Guidance, that is provided by the Contractor or subcontractors and is modified during the contract’s period of performance by a major version change (e.g., using a semantic versioning schema of Major. Minor.

Patch, the software version number goes from 2.5 to 3.0) requires a new self-attestation. For indefinite delivery contract vehicles, this self-attestation must be provided for all critical software available for ordering on the contract vehicle when the software is modified during the contract vehicle’s ordering period of performance by a major version change. The Contractor shall either (i) post the new attestation in a publicly available internet location within 14 days of the major version change and provide the Contracting Officer’s Representative (COR), or CO if a COR is not appointed, with the internet link or shall contact the COR, or CO if a COR is not appointed, and request the agency’s current software self-attestation form and submit it to the Government within 15 days of the major version change. The self-attestation form must contain the following elements: (i) the software producer's name; (ii) a description of which product or products the statement refers to including the number of the major version change; and (iii) a statement attesting that the software producer follows secure development practices and tasks consistent with NIST Guidance.

(End of clause)

52.212-5 - Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Services (May 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004)(Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community--see FAR 3.900(a).

__ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) (31 U.S.C.

6101 note).

__ (6) [Reserved].

__ (7) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

X (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

X (9) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders-Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Dec 2023) (Pub. L. 115-390, title II).

__ (11)(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition. (Dec 2023) (Pub. L. 115-390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204-30.

__ (12) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Nov 2021) (31 U.S.C. 6101 note).

__ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Oct 2022) (15 U.S.C. 657a).

__ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved]

__ (18)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (19)(i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

X (20) 52.219-8, Utilization of Small Business Concerns (Feb 2024) (15 U.S.C. 637(d)(2) and (3)).

X (21)(i) 52.219-9, Small Business Subcontracting Plan (Sep 2023) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Sep 2023) of 52.219-9.

__ (22)(i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

X (23) 52.219-14, Limitations on Subcontracting (Oct 2022) (15 U.S.C. 657s).

__ (24) 52.219-16, Liquidated Damages-Subcontracting Plan (Sep 2021) (15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (Feb 2024) (15 U.S.C. 657f).

__ (26)(i) 52.219-28, Post-Award Small Business Program Rerepresentation (Feb 2024) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Oct 2022) (15 U.S.C. 637(m)).

X (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (Sep 2021) (15 U.S.C. 657s).

__ (31) 52.222-3, Convict Labor (Jun 2003) (E.O. 11755).

__ (32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Feb 2024) (E.O. 13126).

X (33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

__ (34)(i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

X (35)(i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

__ (36)(i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

__ (37) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

X (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

__ (39)(i) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (40) 52.222-54, Employment Eligibility Verification (May 2022). (E.O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (41)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c) (3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (May 2024) (42 U.S.C.

7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (May 2024) (42 U.S.C. 7671, et seq.).

X (44) 52.223-20, Aerosols (May 2024) (42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (May 2024) (42 U.S.C. 7671, et seq.).

__ (46) 52.223-23, Sustainable Products and Services (May 2024) (E.O. 14057, 7 U.S.C. 8102, 42 U.S.C. 6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47)(i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48)(i) 52.225-1, Buy American--Supplies (Oct 2022) (41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__ (49)(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Nov 2023) (19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Dec 2022) of 52.225-3.

__ (iv) Alternate III (Feb 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (Nov 2023) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

X (51) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.'s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

__ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (May 2024) (E.O. 13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

X (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C.

3805).

__ (59) 52.232-33, Payment by Electronic Funds Transfer--System for Award Management (Oct 2018) (31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer--Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

X (61) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

__ (62) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (63) 52.242-5, Payments to Small Business Subcontractors (Jan 2017)(15 U.S.C. 637(d)(13)).

__ (64)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C. 55305 and 10 U.S.C.

2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards--Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-- Requirements (May 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract and does not contain the clause at 52.215-2, Audit and Records--Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause--

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204–25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

(vii)(A) 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition. (Dec 2023) (Pub. L. 115-390, title II).

(B) Alternate I (Dec 2023) of 52.204-30.

(viii) 52.219-8, Utilization of Small Business Concerns (Feb 2024) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (Apr 2015)

(x) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

(xi) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212)

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(xvi) (A) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services- Requirements (May 2014) (41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (May 2022) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

(xxii)(A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C. 3903 and 10 U.S.C.

3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C. 55305 and 10 U.S.C. 2631).

Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

52.217-8 - Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 - Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 45 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 24 months.

(End of clause)

52.228-3 - Workers' Compensation Insurance (Defense Base Act) (July 2014)

(a) The Contractor shall--

(1) Before commencing performance under this contract, establish provisions to provide for the payment of disability compensation and medical benefits to covered employees and death benefits to their eligible survivors, by purchasing workers' compensation insurance or qualifying as a self-insurer under the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 932) as extended by the Defense Base Act (42 U.S.C. 1651, et seq.), and continue to maintain provisions to provide such Defense Base Act benefits until contract performance is completed;

(2) Within ten days of an employee's injury or death or from the date the Contractor has knowledge of the injury or death, submit Form LS-202 (Employee's First Report of Injury or Occupational Illness) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 930(a), 20 CFR 702.201 to 702.203);

(3) Pay all compensation due for disability or death within the time frames required by the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914, 20 CFR 702.231 and 703.232);

(4) Provide for medical care as required by the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 907, 20 CFR 702.402 and 702.419);

(5) If controverting the right to compensation, submit Form LS-207 (Notice of Controversion of Right to Compensation) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914(d), 20 CFR 702.251);

(6) Immediately upon making the first payment of compensation in any case, submit Form LS-206 (Payment Of Compensation Without Award) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C.

914(c), 20 CFR 702.234);

(7) When payments are suspended or when making the final payment, submit Form LS-208 (Notice of Final Payment or Suspension of Compensation Payments) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914(c) and (g), 20 CFR 702.234 and 702.235); and

(8) Adhere to all other provisions of the Longshore and Harbor Workers' Compensation Act as extended by the Defense Base Act, and Department of Labor regulations at 20 CFR Parts 701 to 704.

(b) For additional information on the Longshore and Harbor Workers' Compensation Act requirements see http://www.dol.gov/owcp/ dlhwc/lsdba.htm.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts to which the Defense Base Act applies.

(End of clause)

52.232-39 - Unenforceability of Unauthorized Obligations (Jun 2013)

(a) Except as stated in paragraph (b) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government…