RFP_04302016.pdf

11. DELIVERY FOR FOB

DESTINATION UNLESS

BLOCK IS MARKED

+SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER

PAGE 1 OF

2. CONTRACT NO.

3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER

5. SOLICITATION NUMBER

2016-N-17841

6. SOLICITATION

ISSUE DATE

05/03/2016

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Florence P. Black

b. TELEPHONE NUMBER (No collect calls)

(412) 386-6455

8. OFFER DUE DATE/

LOCAL TIME

06/02/2016

9. ISSUED BY CODE 10. THIS ACQUISITION IS 12. DISCOUNT TERMS

Centers for Disease Control and Prevention Office of Acquisition Services 626 Cochrans Mill Rd, Building 140 Pittsburgh, PA 15236-0070

X UNRESTRICTED

SET ASIDE: % FOR

SMALL BUSINESS

SMALL DISADV. BUSINESS

8(A)

SIC: 621511

SIZE STANDARD:

X SEE SCHEDULE

13a. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB X RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE 436

SAME AS BLOCK 9

CODE 18a. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention (FMO) PO Box 15580 Atlanta, GA 30333-0080

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

“See Continuation Pages”

(Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

X 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA X ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

28.

CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN COPIES

TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET

FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT

TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

29.

AWARD OF CONTRACT: REFERENCE OFFER

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (Signature of Contracting Officer)

30b. NAME AND TITLE OF SIGNER (Type or print)

30c. DATE SIGNED

31b. NAME OF CONTRACTING OFFICER (Type or print)

Stephanie D Cruz 31c. DATE SIGNED

32a. QUANTITY IN COLUMN 21 HAS BEEN 33. SHIP NUMBER 34. VOUCHER NUMBER

RECEIVED INSPECTED

PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

32b. SIGNATURE OF AUTHORIZED GOV’T REPRESENTATIVE 32c. DATE COMPLETE PARTIAL FINAL

41a. I CERTIFY THIS AMOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC’D 42d. TOTAL CONTAINERS

40. PAID BY

AUTHORIZED FOR LOCAL REPRODUCTION SEE REVERSE FOR OMB CONTROL NUMBER AND PAPERWORK BURDEN STATEMENT STANDARD FORM 1449 (10-95)

ACCEPTED, AND CONFORMS TO THE

CONTRACT, EXCEPT AS NOTED

35. AMOUNT VERIFIED

CORRECT FOR

17a. CONTRACTOR/

OFFEROR

FACILITY

CODE

IS CHECKED

Page i

TABLE OF CONTENTS

Section Document/Clause/Provision Page No.

A Standard Form 1449 B Continuation of SF1449 (Block 19 – 24) 1 C Contract Clauses 3 D Contract Documents, Exhibits or Attachments 16 E Solicitation Provisions 24

Solicitation number 2016 –N- 17841

SECTION B - CONTINUATION CONTINUATION OF SF1449

Base Period Items: (07/15/2016 – 01/14/2017)

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Base Period –Herpes Simplex Virus

(HSV) 1 & 2 testing in accordance with Statement of Work.

(07/15/2016 – 01/14/2017)

MIN: 0 Each MAX: 250 Each

Option Period 1 Items: (01/15/2017 – 01/14/2018)

0002 Option Year 1 – Herpes Simplex Virus

(HSV) 1 & 2 testing in accordance with Statement of Work.

(01/15/2017 – 01/14/2018)

MIN: 200 Each MAX: 2025 Each

Option Period 2 Items: (01/15/2018 – 01/14/2019)

0004 Option Year 2 – Herpes Simplex Virus

(HSV) 1 & 2 testing in accordance with Statement of Work.

(01/15/2018 – 01/14/2019)

Option Period 3 Items: (01/15/2019 – 01/14/2020)

0005 Option Year 3 – Herpes Simplex Virus

(HSV) 1 & 2 testing in accordance with Statement of Work.

(01/15/2019 – 01/14/2020)

Option Period 4 Items: (01/15/2020 – 01/14/2021)

0006 Option Year 4 – Herpes Simplex Virus

(HSV) 1 & 2 testing in accordance with Statement of Work.

(01/15/2020 – 01/14/2021)

Option Period 5 Items: (01/15/2021 – 07/14/2021)

0007 Option 5 – Herpes Simplex Virus (HSV)

1 & 2 testing in accordance with Statement of Work.

(01/15/2021 – 07/14/2021)

MIN: 0 Each MAX: 50 Each

Solicitation number 2016 –N- 17841

B.1 TYPE OF CONTRACT

This is an IDIQ contract for commercial items. Contract types for the individual task orders will be fixed priced. The Contracting Officer is the only individual authorized to issue task orders under this contract.

B.2 MINIMUM AND MAXIMUM QUANTITIES

The Government, through the issuance of task order(s) or otherwise (if Contractor does not receive a task order), shall pay a one-time minimum of $5,000.00 to the contractor during the contract’s five-year period of performance (base period plus five option periods).

The maximum for the contract’s five-year period of performance (base period plus five option periods) shall be any quantity or combination of supplies and services not exceeding $495,000 dollars.

Solicitation No. 2016-N-17841

SECTION C - CONTRACT CLAUSES

Contract Terms and Conditions

FAR/HHSAR TITLE AND DATE

52.202-1 Definitions (Nov 2013) 52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (Apr 2014) 52.203-12 Limitation on Payments to Influence Certain Federal Transactions (Oct 2010) 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper (May 2011) 52.204-13 System for Award Management Maintenance (July 2013) 52.204-18 Commercial and Government Entity Code Maintenance (Nov 2014) 52.204-19 Incorporation by Reference of Representations and Certifications (Dec 2014) 52.212-4 Contract Terms and Conditions – Commercial Items (May 2015) 52.229-3 Federal, State, and Local Taxes (Feb 2013) 52.232-23 Assignment of Claims (May 2014) 52.232-39 Unenforceability of Unauthorized Obligations (June 2013) 52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Dec 2013) 52.242-13 Bankruptcy (July 1995) 52.242-15 Stop Work Order (Aug 1989) 52.246-4 Inspection of Services – Fixed Price (Aug 1996) 352.203-70 Anti-Lobbying (Dec 2015) 352.222-70 Contractor Cooperation in EEO Investigations (Dec 2015) 352.224-70 Privacy Act (Dec 2015) 352.224-71 Confidentiality of Information (Dec 2015) 352.239-74 Electronic Information and Technology Accessibility (Dec 2015)

C.1 52.252-2 --CLAUSES INCORPORATED BY REFERENCE (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at these addresses:

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/far1toc.htm http://www.hhs.gov/policies/hhsar/subpart301-1.html

C.2 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Mar 2016)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

_X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/far1toc.htm http://www.hhs.gov/policies/hhsar/subpart301-1.html

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

_X__ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Oct 2015) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved] ___ (6) 52.204-14, Service Contract Reporting Requirements (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

_X__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

_X__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) [Reserved] ___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved] ___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

_X__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Oct 2015) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Oct 2001) of 52.219-9.

___ (iii) Alternate II (Oct 2001) of 52.219-9.

___ (iv) Alternate III (Oct 2015) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Nov 2011) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

__X_ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

_X__ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

___ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Feb 2016) (E.O. 13126).

_X__ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X__ (28) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246).

_X__ (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

_X__ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

_X__ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

_X__ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X__ (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O.

13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

_X_ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514 ___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (37) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (38) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

___ (39) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

_X__ (40) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

___ (41) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

___ (42) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C.

chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L.

103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112- 43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

_X__ (43) 52.225-5, Trade Agreements (Feb 2016) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X__ (44) 52.225-13, Restrictions on Certain Foreign Purchases (Jun 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (45) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (46) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

___ (47) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (48) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505), 10 U.S.C. 2307(f)).

___ (49) 52.232-30, Installment Payments for Commercial Items (Oct 1995) (41 U.S.C. 4505, 10 U.S.C.

2307(f)).

__X_ (50) 52.232-33, Payment by Electronic Funds Transfer— System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (51) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (52) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

___ (53) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

___ (54) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

___ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495) ___ (2) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67.).

___ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (May 2014) (29 U.S.C.206 and 41 U.S.C. chapter 67).

___ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Mar 2016) (E.O. 13658).

___ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C.

1792).

___ (10) 52.237-11, Accepting and Dispensing of $1 Coin (Sep 2008) (31 U.S.C. 5112(p)(1)).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph

(d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c) and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

(ii) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(iii) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (1) of FAR clause 52.222-17.

(iv) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(v) 52.222-26, Equal Opportunity (Apr 2015) (E.O. 11246).

(vi) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(vii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

(viii) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(ix) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222- 40.

(x) 52.222-41, Service Contract Labor Standards (May 2014), (41 U.S.C. chapter 67).

(xi) ____ (A) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(xii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67.)

(xiii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67)

(xiv) 52.222-54, Employment Eligibility Verification (Oct 2015) (E. O. 12989).

(xv) 52.222-55, Minimum Wages Under Executive Order 13658 (Mar 2016).

(xvi) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Jul 2013) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008;

10 U.S.C. 2302 Note).

(xvii) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xviii) 52.247-64, Preference for Privately-Owned U.S. Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of Clause)

Alternate I (Feb 2000). As prescribed in 12.301(b)(4)(i), delete paragraph (d) from the basic clause, redesignate paragraph (e) as paragraph (d), and revise the reference to “paragraphs (a), (b), (c), or (d) of this clause” in the redesignated paragraph (d) to read “paragraphs (a), (b), and (c) of this clause”.

Alternate II (Oct 2015). As prescribed in 12.301(b)(4)(ii), substitute the following paragraphs (d)(1) and (e)(1) for paragraphs (d)(1) and (e)(1) of the basic clause as follows:

(d)

(1) The Comptroller General of the United States, an appropriate Inspector General appointed under section 3 or 8G of the Inspector General Act of 1978 (5 U.S.C. App.), or an authorized representative of either of the foregoing officials shall have access to and right to—

(i) Examine any of the Contractor’s or any subcontractors’ records that pertain to, and involve transactions relating to, this contract; and

(ii) Interview any officer or employee regarding such transactions.

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P120_20017 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P120_20017

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), and (c), of this clause, the Contractor is not required to flow down any FAR clause in a subcontract for commercial items, other than—

(i) Paragraph (d) of this clause. This paragraph flows down to all subcontracts, except the authority of the Inspector General under paragraph (d)(1)(ii) does not flow down; and

(ii) Those clauses listed in this paragraph (e)(1). Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(A) 52.203–13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509).

(B) 52.203-15, Whistleblower Protections Under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5).

(C) 52.219–8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(D) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(E) 52.222–26, Equal Opportunity (Apr 2015) (E.O. 11246).

(F) 52.222–35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(G) 52.222–36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.

793).

(H) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(I) 52.222–41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67).

(J) ____ (1) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (2) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 E.O. 13627).

(K) 52.222–51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(L) 52.222–53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

(M) 52.222–54, Employment Eligibility Verification (Oct 2015) (Executive Order 12989).

(N) 52.222-55, Minimum Wages Under Executive Order 13658 (Mar 2016).

(O) 52.226–6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226–6.

(P) 52.247–64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247–64.

(End of Clause)

C.3 52.216-18 – Ordering (Oct 1995)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the Schedule. Such orders may be issued from date of contract award through 10 days prior to contract expiration.

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c) If mailed, a delivery order or task order is considered “issued” when the Government deposits the order in the mail. Orders may be issued orally, by facsimile, or by electronic commerce methods only if authorized in the Schedule.

(End of Clause)

C.4 52.216-19 -- Order Limitations (Oct 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than ten (10) analyses, the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor --

(1) Any order for a single item in excess of the maximum for each line item;

(2) Any order for a combination of items in excess of the contract maximums; or

(3) A series of orders from the same ordering office within 10 days that together call for quantities exceeding the limitation in subparagraph (b)(1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within five (5) days after issuance, with written notice stating the Contractor’s intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

(End of Clause)

C.5 52.216-22 -- Indefinite Quantity. (Oct 1995)

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the “maximum.” The Government shall order at least the quantity of supplies or services designated in the Schedule as the “minimum.”

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor’s and

Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the contract’s effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after 30 days after the end of the period of performance.

(End of Clause)

C.6 52.217-8 -- Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days prior to the end of the period of performance.

(End of Clause)

C.7 52.217-9 -- Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 10 days prior to the end of the period of performance; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 20 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

(End of Clause)

C.8 Issuance of Task/Delivery Orders Although the Contractor may not be required to conduct all of the tasks set forth in this Statement of Work, the Contractor shall be capable of providing the staff necessary to conduct the required work. The timing, magnitude, and scope of each requirement cannot be predicted until the Government determines the specific work to be performed. The Contractor should expect a fluctuating workload throughout the performance period of this contract and will provide the technical, professional, managerial, and clerical support required to complete each task/delivery order successfully.

Performance hereunder shall be accomplished by task/delivery orders issued under this contract in accordance with the following procedure:

As the Government identifies specific requirements for work to be performed under this contract, a Task/Delivery Order will be issued unilaterally. The Order will detail the requirements and associated funding. If the Contractor does not accept the task/delivery order and cannot reach agreement on an individual order basis, it shall be considered a dispute and be handled in accordance with contract clause 52.212-4 Contract Terms and Conditions – Commercial Items, section (d) Disputes.

(End of Clause)

C. 8 Invoicing Information

Payment by Electronic Funds Transfer (Dec 2005 - revised)

(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer – System For Award Management requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer payments.

(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form may be obtained by contacting the Contracting Officer or the CDC Financial Management Office at (678-475-4510).

(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, and been enrolled in the program, the form is not required unless the designated financial institution has changed.

(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is submitted, to the following address:

The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 30333 Or – Fax copy to: 404-638-5342

(End of Clause)

C. 9 Invoice Submission

(a) The Contractor may submit a paper copy of the contract invoice/voucher to the address shown below The Centers for Disease Control and Prevention Financial Management Office (FMO) P.O. Box 15580 Atlanta, GA 3033

Or – The Contractor may submit the original invoice/voucher via facsimile or email:

Fax: 404-638-5342

Email: FMOAPINV@CDC.GOV

NOTE: Submit to only one (1) of the above locations.

(b) A copy of each invoice must be submitted directly to the COR and Contracting Officer concurrently with submission to the Financial Management Office (FMO). The most efficient option is to email the invoices to the three (3) email addresses listed below:

Financial Management Office (FMO): Email to:FMOAPINV@CDC.GOV Contract Specialists: To be named at award Contracting Officer’s Representative (COR): To be named at award

(c ) In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Financial Management Office is the designated billing office for the purpose of determining the payment due date under FAR 32.904.

(d) The Contractor shall include (as a minimum) the following information on each invoice:

(1) Contractor’s Name & Address

(2) Contractor’s Tax Identification Number (TIN)

(3) Purchase Order/Contract Number and Contract Number, if Appropriate

(4) Invoice Number

(5) Invoice Date

(6) Contract Line Item Number and Description of Item

(7) Quantity

(8) Unit Price & Extended Amount for each line item

(9) Shipping and Payment Terms

(10) Total Amount of Invoice

(11) Name, title and telephone number of person to be notified in the event of a defective invoice

(12) Payment Address, if different from the information in (c) (1).

(13) DUNS + 4 Numbers mailto:FMOAPINV@CDC.GOV

C.10 Special Contract Requirements

Privacy Act

The contractor may have access to data that may be sensitive or private, therefore proper care must be exercised in handling this data. Pursuant to the Privacy Act of 1974 (5 USC 552a) and Section 308(d) of the Public Health Service Act (42 USC 242m), the Contractor is required to comply with the applicable provisions and to undertake safeguards against invasions of privacy.

Notification is hereby given that the Contractor and its employees are subject to criminal penalties for violation of the Privacy Act, Title V of Public Law 107-347, and Section 308(d) of the Public Health Service Act to the same extent as employees of the Government. The Contractor shall assure that each of its employees knows the prescribed rules of conduct and that each is aware that he or she can be subjected to criminal penalty for violation of these laws.

A copy of 45 CFR Part 5b, Privacy Act Regulations, may be obtained at https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-part5b.pdf

Title V of PL 107-347 may be obtained at https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf ;

and the Public Health Service Act section 308(d) at http://www.law.cornell.edu/uscode/html/uscode42/usc_sup_01_42_10_6A.html .

These laws require that data shall not be disclosed in identifiable form to any person or agency not entitled to receive it, and that data will be used for statistical purposes only.

Information Technology Security The Contractor’s performance and resulting deliverables must adhere to all federal, HHS, and/or CDC IT security policies and procedures. Based upon the scope of this contract, adherence to the following IT Security guidance is required whether the entire contract or order (hereafter “contract”), or portion thereof, includes information technology resources or services in which the Contractor has physical or logical (electronic) access to, or operates a Department of Health and Human Services (HHS) system containing, information that directly supports HHS' mission. The term “information technology (IT)”, as used in this contract, includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), cloud environments, and related resources. This clause does not apply to national security systems as defined in FISMA.

The Contractor is responsible for the following: (1) Protecting Federal information and Federal information systems in order to ensure their—(i) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity; (ii) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and (iii) Availability, which means ensuring timely and reliable access to and use of information.(2) Providing security of any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor, regardless of location, on behalf of HHS. (3) Adopting, and implementing, at a minimum, the policies, procedures, controls, and standards of the HHS Information Security Program to ensure the integrity, confidentiality, and availability of Federal information and Federal information systems for which the Contractor is responsible under this contract or to which it may otherwise have access under this contract. The HHS Information Security Program is outlined in the HHS Information Security Program Policy, which is available on the HHS Office of the Chief Information Officer's (OCIO) Web site.

All development or implementation of an electronic information system or any electronic data collection effort conducted in the performance of this contract will be required to complete Certification and Accreditation https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-part5b.pdf https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf http://www.law.cornell.edu/uscode/html/uscode42/usc_sup_01_42_10_6A.html

(C&A)/Security Assessment and Authorization (SA&A) prior to operation resulting in an Authority of Operate (ATO) from CDC. The contractor shall be required to complete all security documentation and materials necessary to obtain an ATO. The contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other federal policies and regulations in the performance of the security requirements.

All information systems developed, implemented, or maintained in support of this contract must adhere to the security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf) and NIST 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations.

The Contractor must follow the latest guidance available from NIST and other recognized sources, including but not limited to:

• FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf),

• FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf),

• NIST Special Publication 800-18, Guide for Developing Security Plans for Federal Information Systems (http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf),

• NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf),

• NIST publication SP 800-44 Guidelines on Securing Public Web Servers, (http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf)

• NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf),

• NIST Special Publication 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories Vol. 1 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1- Rev1.pdf) and Vol. 2 (http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf),

• NIST Special Publication 800-63, Electronic Authentication Guideline (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf).

• NIST publication SP 800-95 Guide to Secure Web Services, (http://csrc.nist.gov/publications/nistpubs/800- 95/SP800-95.pdf) when applicable.

• Web Application Security Consortium (http://www.webappsec.org)

• Open Web Application Security Project (OWASP) (http://www.owasp.org).

The contractor must follow CDC development standards and use the CDC web template package. All CDC websites, campaign sites, and applications must use the standard CDC web template to ensure a consistent look and feel for CDC websites. The template will be provided as needed. The CDC Secure Web Application Coding Guidelines and CDC Template Package (http://intranet.cdc.gov/ocio/docs/information-systems-security/CDC_Secure_Web_App_Coding_Guidelines.pdf) can be provided by the CDC Project Officer or the Center’s ISSO.

All web content must reside on a CDC.gov domain and must be hosted at CDC or in a CDC-authorized environment. The contractor may not establish a .com, .org, or other type of site to host CDC funded content or web applications.

During any application development or enhancement, the contractor shall work closely with NCHS offices/divisions and NCHS Information System Security Officer (ISSO) to ensure all CDC-related technical and security standards, processes and procedures are followed. This working relationship shall continue through full production.

If use of a cloud environment is needed, the provider must be FedRAMP certified. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The cloud environment must also have an Authority to Operate from HHS.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf http://www.webappsec.org/ http://www.owasp.org/ http://intranet.cdc.gov/ocio/docs/information-systems-security/CDC_Secure_Web_App_Coding_Guidelines.pdf http://intranet.cdc.gov/ocio/docs/information-systems-security/CDC_Secure_Web_App_Coding_Guidelines.pdf

All publicly accessible Federal websites and web services must provide service over a secure connection. The strongest privacy protection currently available for public web connections is Hypertext Transfer Protocol Secure

(HTTPS).

Government access for IT inspection. The Contractor shall afford the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases, and personnel used in performance of this contract to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the integrity, confidentiality, and availability, of HHS data or to the protection of information systems operated on behalf of HHS.

Standard for Encryption Language

• The Contractor shall use Federal Information Processing Standard (FIPS) 140-2-compliant encryption (Security Requirements for Cryptographic Module, as amended) to protect all instances of HHS information during storage and transmission.

• The Contractor shall verify that the selected encryption product has been validated under the Cryptographic

Module Validation Program (see http://csrc.nist.gov/groups/STM/cmvp/index.html) to confirm compliance with FIPS 140-2 (as amended). If requested, the Contractor shall provide a written copy of the validation documentation to the Contracting Officer and the Contracting Officer's Technical Representative.

• The Contractor shall use the Key Management Key (see FIPS 201, Chapter 4, as amended) on the HHS personal identification verification (PIV) card; or alternatively, the Contractor shall establish and use a key recovery mechanism to ensure the ability for authorized personnel to decrypt and recover all encrypted information (see http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf). The Contractor shall notify the Contracting Officer and the Contracting Officer's Technical Representative of personnel authorized to decrypt and recover all encrypted information.

• The Contractor shall securely generate and manage encryption keys to prevent unauthorized decryption of information in accordance with FIPS 140-2 (as amended).

• The Contractor shall ensure that this standard is incorporated into the Contractor's property management/control system or establish a separate procedure to account for all laptop computers, desktop computers, and other mobile devices and portable media that store or process HHS information.

• The Contractor shall ensure that its subcontractors (at all tiers) which perform work under this contract comply with these requirements.

HSPD-12 Compliance

As part of the Federal HSPD-12 directive, all information systems deployed within/outside of any federal infrastructure must be able to support HSPD-12 compliant Personal Identity Verification (PIV) of federal employees and contractors. The government has complied with HSPD-12 by issuing PIV cards with embedded digital certificates to all users of federal information systems. In accordance with this directive, all vendors providing hardware and software to the federal government are required to ensure that these PIV cards will integrate with their software and hardware at the application level. Contractor must be able to implement and support PIV card integration.

Standard for Security Configurations

The Contractor shall apply approved security configurations to information technology (IT) that is used to process information on behalf of CDC. The following security configuration requirements apply.

• The Contractor shall configure its computers that contain CDC data with the applicable United States Government Configuration Baseline (USGCB) (see http://usgcb.nist.gov/) and ensure that its computers have and maintain the latest operating system patch level and anti-virus software level. Note: USGCB is http://csrc.nist.gov/groups/STM/cmvp/index.html http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://usgcb.nist.gov/ applicable to all computing systems, including desktops and laptops—regardless of function—but not including servers.

• The Contractor shall ensure IT applications operated on behalf of CDC are fully functional and operate correctly on systems configured in accordance with the above configuration requirements. The Contractor shall use Security Content Automation Protocol (SCAP)-validated tools with USGCB Scanner capability to ensure its products operate correctly with USGCB configurations and do not alter USGCB settings—see http://scap.nist.gov/validation/. The Contractor shall test applicable product versions with all relevant and current updates and patches installed. The Contractor shall ensure currently supported versions of information technology products meet the latest USGCB major version and subsequent major versions.

• The Contractor shall ensure IT applications designed for end users run in the standard user context…