20Q00042 RFQ Scanners.docx

NATIONAL ARCHIVES AND

RECORDS ADMINISTRATION

REQUEST FOR QUOTE (RFQ)

For

MICROFILM SCANNER EQUIPMENT

RFQ 88310320Q00042

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

Acquisitions Division 8601 Adelphi Road College Park, MD 20740-6001

TELEPHONE: (301) 837-1502 FAX: (301) 837-3227

RFQ# 88310320Q00042

THIS IS A REQUEST FOR QUOTATION (THIS IS NOT AN ORDER) in accordance with FAR Subpart 13.106-1(b), Soliciting from a single source, as supplemented with additional information included in this RFQ from the manufacturer of Microfilm Scanner Systems on Open Market (GSA) Federal Supply Schedule (FSS) 36 SIN 51 402, and 70 SIN 132-8.

Any resulting order from this solicitation will be Firm Fixed Priced. Vendors must submit a total fixed price quote that is inclusive of all Delivery Costs. FOB ORIGIN pricing is required. This is a request for quote, and quotations furnished are not offers. This request does not commit the government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

This is a FAR PART 13.106-1(b), buy and quotations should include pricing (GSA) Federal Supply Schedule (FSS) 36 SIN 51 402, and 70 SIN 132-8. Open Market items. The solicitation number is 88310320Q00042 and is issued as a Request for Quotation (RFQ).

All questions should be submitted to James Newell via fax (301-837-3227) or e-mail at James.newell@nara.gov by no later than 11:00 AM Eastern Time (ET) on March 09, 2020.

VENDORS ARE REQUESTED TO SUBMIT QUOTATIONS BY 11:00 AM ET ON March 18, 2020. FAILURE TO DO SO MAY RESULT IN REJECTION OF THE QUOTATION AS UNTIMELY. Questions should be e-mailed by March 12, 2020.

Submit quotations via fax or e-mail to:

ATTN: James Newell, Contract Specialist james.newell@nara.gov Fax: 301-837-3227

Vendors are strongly encouraged to offer discounts off of your open market Price List or Catalog pricing. The resulting order will be a firm fixed price order.

It is the Vendor's responsibility to ensure that NARA is not provided counterfeit products or services. In the event that such products or services are determined to be counterfeit, NARA will seek all available legal remedies including criminal prosecution. Counterfeit Microfilm Scanner System or service means any item of Microfilm Scanner including hardware and software or service that is an unauthorized copy, replica, or substitute. In an effort to further insure NARA is receiving original equipment manufacturer (OEM) new items or service and will receive the benefits of any warranties or other manufacturer guarantees. All related items or services must be covered by the manufacturer’s warranty.

IMPORTANT INFORMATION FOR VENDORS

Depending on the final results of the evaluation, the resulting order from this RFQ will include some or all of the FAR Clauses and NARA Terms and Conditions identified in Parts 2 and 3.

VENDOR EVALUTATION/SELECTION

Competition for this requirement is restricted to (FSS) 36 SIN 51 SN 402, and FSS 70 SIN 132-8 Vendors only. Best value for this order will be obtained through a lowest priced technically acceptable and Relevant Past Performance Information quote, with technical acceptability being defined as providing the required equipment and software.

Relevant Past Performance Information and being the authorized manufacturer and seller. The vendor must provide proof of OEM or authorized reseller or they will not be considered for award. The Government will only accept commercial equipment and services.

RFQ 88310320Q00042

PART1

SCHEDULE OF PRICES

1. SUPPLIES AND/OR SERVICES TO BE FURNISHED

The purpose of this solicitation and resulting contract is to purchase the Mekel Match Mini Scanner Equipment to include Software and a Warranty, for the National Archives Records and Administration (NARA), College Park, MD 20740-6001. This is a fixed price contract. All work shall be performed under the terms and conditions of this contract as Firm-Fixed Price (FFP). The FFP will include the fully burdened cost for delivery, the scanner equipment and software, as required by this contract. The Contractor is required to furnish all the equipment, supplies and services that can be identified in advance, both in sufficient detail and quantities, for which a fair and reasonable price can be obtained.

2. PRICING:

(a) Each Vendor shall identify the "Unit Price" and "Total Price" for the firm-fixed-priced items and services described in paragraph 3.

(b) The "Unit Price" for each CLIN shall be the Vendors price for the item or services identified.

(c) The "Total Price" for each separately price CLIN shall be the "Unit Price" multiplied by the Quantity.

(d) The Total Firm-fixed Contract Price shall be the firm-fixed-price of all CLINS identified herein.

(End of Clause)

3. SCHEDULE OF PRICES

(a) In accordance with this contract, the Contractor shall provide all management, supervision, labor, material, supplies, transportation, and equipment described herein (except as specified to be furnished by the Government in Purchase Description, and shall plan, schedule, coordinate, and assure effective performance at the NARA, locations noted on the equipment list.

PRICE

AMOUNT

Contract Total:

PART 2

Purchase Description for the MEKEL Mach Mini-Turnkey Microfilm Scanners

1. The Mekel Mach Mini Scanner system is a turnkey microfilm digitization station that has the following specifications.

2. Resolution and Sensor Performance: The Unit must use a CCD line Array Camera with 8,192 pixels per line. The Unit must have automatic zoom and focus for different film types with no manual intervention from the end user. The unit must have the ability to scan 35mm microfilm and 16mm microfilm.

3. Other Scanner Requirements: The Unit must have a gentle film transport (comfort roller system with balanced tension). The system must produce a minimum resolution of 300 dpi and be capable of creating a minimum of 8-bit scanned images. Scan modes must include a grayscale option. The Unit must operate and have easy interface with traditional PC or laptop.

4. Software Component: The Unit must be able to be used with Quantum Scan and Quantum Processing. This software is already being used in multiple NARA locations on Mekel scanners. The Unit must be compatible with “smart” software that finds breaks in film images. The software must include auto-skew and centering functionality and the option for optical character recognition. Accompanying software should allow for enhancement, rotation, and re-sizing of images.

5. Speed of Operation: The Unit must scan up to 350 images per minute.

6. Output Requirements: Software must support multiple file output options, including JPG, TIF and PDF.

7. Storage Requirements: Each unit must come with a 10 TB of Storage Server.

8. Table Space: The unit must have a small footprint no larger than 17 x 16 x 8 and weigh no more than 30 lbs.), as units will need to be transported from project to project or between offices. The unit must be a stackable unit for special space requirements.

9. Warranty: Manufacturer Support must have local support by manufacturer service technicians, and have an 8 business hour response time by the manufacturer.

10. Upgradeability: The Camera system should be able to be upgraded to the latest technology without having to upgrade the entire digital bench.

End of Description

Part 3

CONTRACT ADMINISTRATION

1. VENDOR RESPONSIBILITY

The Vendor is responsible for the day-to-day inspection and monitoring of the Vendor work performed to ensure compliance with contract requirements. The results of all the Vendor quality control inspections conducted must be documented on inspection checklists and be made available to the Government during the term of the contract.

2. GOVERNMENT CONTRACT ADMINISTRATION

(a) This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer, Z 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

(b) Contract Administration:

James Newell, Contract Specialist (CS) Telephone: (301) 837-1502

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be mailed, postage prepaid, to the above address.

(c) Contracting Officer (CO)

Any Z Warranted Contracting Officer (CO)

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

3. DESIGNATION OF POINT OF CONTACT (POC)

(a) POC: TBD

Phone: 301-837-XXXX

E-Mail: @nara.gov

The individual named above is designated as the Contracting Officer’s Representative (POC) to assist the CS in the discharge of the CS’s responsibilities. The POC is responsible for monitoring, giving progress reports to the CS and overall technical surveillance of services to be performed under this task order and should be contacted regarding questions or problems of a technical nature. The POC will approve all invoices for payment. The POC will not establish an agreement, modification, change order, or other matter deviating from the terms of the basic task order between the Vendor and any person other than the CO be effective or binding upon the Government.

4. INVOICE SUBMISSION REQUIREMENTS

A. The preferred method for invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury's Bureau of the Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

B. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via e-mail at AccountsPayable@fiscal.treasury.gov or by phone at 304-480-8000, Option 7.

C. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by e-mail to NAR@bpd.treas.gov. Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

D. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

E. For invoice and payment questions call the Fiscal Service AP Help Desk at 304-480-8000, Option 7.

DISTRIBUTION LIST:

(X) Contract File - Original

(X) Contractor - 1 Copy

(X) Requesting Office - 2 Copies

(X) Invoice Approver –

COR/POC –

( ) NAF - Property (e-mail: HQ-NARA-NAF-PMB) ( ) AII Loading Dock

5. Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (January 2020)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this order/contract, the following documents are required to be submitted as an attachment to the IPP invoice: Invoice shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

Vendor Invoice to include:

1. Award number

2. CLIN//Item number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection if applicable

7. Serial number/part number if applicable The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Local Clause)

6. INVOICE CERTIFICATION

a. The COR will review a copy of each invoice for correctness, services performed, etc. The COR will certify the invoice and:

b. If the COR disagrees with the invoice, the COR will immediately:

(1) Notify the Contracting Officer and paying office;

(2)Withhold certification or, if applicable, Government purchase card reimbursement;

c. If only a portion of the invoice costs are in dispute, the CO or COR, if assigned, will certify only the undisputed costs and, as appropriate, submit the invoice to the payment office for partial payment or authorize only partial Government purchase card payment. The COR will work with the Vendor to resolve any remaining disputed costs.

d. If the COR cannot resolve the invoice discrepancy with the Vendor, or if a problem has been noted with the Vendor’s performance, the COR must notify the Contracting Officer, in writing, with details of the problem.

(1) No contract payments will be made by check. Invoice payments will be made electronically in accordance with FAR 52.232-33, Payment by Electronic Funds Transfer—Central Vendor Registration.

(2) The date of payment by wire transfer through the Treasury Financial Communications System must be considered to be the date payment is made.

(b) The Vendor will be paid for the work called for in Enclosure 2 and identified and set forth in the “Line Item Description” located in Enclosure 1 of this contract. Payment for completed services will be made monthly upon submission of the Vendor’s properly certified invoice.

8. FINAL PAYMENT

Before final NARA payment is made, the Vendor must furnish to the CO a written release of all claims against the Government arising by virtue of the contract, other than claims in stated amounts as may be specifically excluded by the Vendor from the operation of the release. If the Vendor’s claim to amounts payable under the contract has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. 203, 41 U.S.C. 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the contract is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

9. 52.252-2, CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make the full text available.

a. 52.212-4 -Contract Terms and Conditions -Commercial Items. (Oct 2018)

b. FAR 52.242-15: STOP WORK ORDER. (AUG 1989)

c. FAR 52.246-2, Inspection of Supplies—Fixed-Price, (AUG 1996).

d. FAR 52.246-4, Inspection of Services—Fixed-Price, (AUG 1996).

e. FAR 52.243-1, Changes-Fixed Price, (AUG 1987)

f. FAR 52.249-14, Excusable Delays, (APR 1984)

g. FAR 52.227-17, Rights in Data – Special Works, (DEC 2007)

The full text of a clause may be accessed electronically at this address: https://acquisition.gov.

PART 4

ADDITIONAL TERMS AND CONDITIONS

1. S ECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Vendor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this task order.

(2) The Vendor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Vendor shall only use CUI obtained under this task order for purposes of the Vendor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this task order that information to be utilized under this task order, or a portion thereof, is subject to the Privacy Act, The Vendor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this task order, the Vendor shall turn over all CUI obtained under the Vendor that is in its possession.

(d) Systems Access. Work to be performed under this task order may require the handling of CUI, including PII. The Vendor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Vendor, when requested by the Government, as part of the Vendor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Vendor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Vendor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Vendor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this task order, the Vendor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Vendor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this task order until the Vendor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP designee, approves the Vendor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Vendor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Vendor shall maintain an accurate inventory of devices used in the performance of this task order.

(3) All NARA information obtained under this task order shall be removed from Vendor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Vendor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Vendor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Vendor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Vendor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Vendor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Vendor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Vendor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Vendor to retain at Vendor's expense, a Third Party assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Vendor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the NARA. Vendor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Vendor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Vendor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Vendor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("PII") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Vendor shall be coordinated with, and subject to the approval of NARA. Vendor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Vendor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this task order, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Vendor.

2. CONTRACTOR NOTICE TO THE GOVERNMENT OF DELAYS

In the event the contractor encounters difficulty in meeting performance requirements, or when he/she anticipates difficulty in complying with the contract schedule, or whenever the contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this contract, the contractor must immediately notify the Contracting Officer and the COR, in writing, giving the pertinent details. However, the contractor’s data must be informational only in character. This provision must not be construed as a waiver by the Government of any delivery schedule or date, or any rights or remedies provided by law or under this contract.

3. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Vendor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Vendor or that the Vendor is expected to generate which is confidential. Similarly, the Contracting Officer and the Vendor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this contract, the Vendor may have access to confidential information and communications, including but not limited to Personally Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Vendor shall preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting Officer. Failure to comply with the provisions of this Paragraph will be grounds for Termination for Default and the Vendor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this contract.

(d) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Vendor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this contract, the Vendor may have access to and use of data and information which may be considered proprietary by other Vendors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this contract, would be adverse to the interest of NARA and these other Vendors.

(f) Except as may be otherwise agreed to with these other Vendors, the Vendor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other Vendors other than as required in the performance of this contract; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Vendor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Vendor and these Vendors which provides for greater rights to the Vendor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Vendor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this contract.

(i) The terms of this paragraph apply to all Vendor employees, subcontractors and consultants and must be incorporated into any subcontract.

4. NARA PROTECTION OF PII AND KEEP HARD DRIVE:

(a) In accordance with NARA policy, NARA will take title to all electronic storage devices, including but not limited to hard drives that may contain Personally Identifiable Information (PII). NARA will not allow the removal of any electronic storage device that may contain PII data from its facilities by a contractor, including individuals performing maintenance on equipment, devices or systems. This provision applies even in the event the equipment is leased. NARA will handle the destruction of this hardware internally. This provision must flow down to all subcontracts, including those for maintenance.

(b) If the Vendor comes into possession of an electronic storage device that may contain PII, the Vendor will immediately notify the Contracting Officer and return the electronic storage device to NARA. Vendor will protect the confidentiality of the electronic storage device and will not access, disclose, release, disseminate, or publish any of the information on the electronic storage device.

End of Clause

5. 52.212-5 -- Contract Terms and Conditions Required to Implement Statutes and Executive Orders--Commercial Items. (May 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.] x__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

x__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

x__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

x__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved] ___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

x__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

x__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

___ (10) [Reserved] ___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved] ___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

x__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Nov 2016) of 52.219-9.

___ (iii) Alternate II (Nov 2016) of 52.219-9.

___ (iv) Alternate III (Nov 2016) of 52.219-9.

___ (v) Alternate IV (Aug 2018) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

___ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C. 632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

x__ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

x__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2018) (E.O. 13126).

x__ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

x__ (28) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

___ (ii) Alternate I (Feb 1999) of 52.222-26.

x__ (29) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

___ (ii) Alternate I (July 2014) of 52.222-35.

x__ (30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

___ (ii) Alternate I (July 2014) of 52.222-36.

x__ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

x__ (32) 52.222-40, Notification of Employee Rights under the National Labor Relations Act (Dec 2010) (E.O. 13496).

x__ (33) (i) 52.222-50, Combating Trafficking in Persons (JAN 2019) (22 U.S.C. chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

x__ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

x__ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O.13693).

___ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

x__ (38) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514 ___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (39) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

x__ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

x__ (41) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

x__ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while Driving (Aug 2011) (E.O. 13513).

x__ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

x__ (44) 52.223-21, Foams (Jun 2016) (E.O. 13696).

x__ (45) (i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

___ (ii) Alternate I (Jan 2017) of 52.224-3.

x__ (46) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

x__ (47) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

x__ (48) 52.225-5, Trade Agreements (Aug 2018) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

x__ (49) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

___ (50) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (51) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

___ (52) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

___ (53) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505), 10 U.S.C. 2307(f)).

___ (54) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

x__ (55) 52.232-33, Payment by Electronic Funds Transfer--System for Award Management (Oct 2018) (31 U.S.C. 3332).

___ (56) 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management (Jul 2013) (31 U.S.C. 3332).

___ (57) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

x__ (58) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

x__ (59) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

___ (60) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx 1241(b) and 10 U.S.C. 2631).

___ (ii) Alternate I (Apr 2003) of 52.247-64.

___ (iii) Alternate II (Feb 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.] ___ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495) __ (2) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67.).

__ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C.206 and 41 U.S.C. chapter 67).

___ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards -- Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

___ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

___ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services--Requirements (May 2014) (41 U.S.C. chapter 67).

__ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015) (E.O. 13658).

__ (9) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

___ (10) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations. (May 2014) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records -- Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for…