RFQ_24322619Q0034_CA_vision_results.pdf

United States Office of Personnel Management

Office of Procurement Operations

Request for Quote (RFQ) for

CA Vision Results software annual license

RFQ 243226-19-Q-0034

March 19, 2019

RFQ: 243226-19-Q-0034

TABLE OF CONTENTS

1.0 INSTRUCTIONS, CONDITIONS, AND NOTICES TO QUOTERS 3

1.1 Purpose 3

1.2 Background 3

1.3 Method of Acquisition 3

1.4 Number of Awards 3

1.5 Date of Award 3

1.6 Period of Performance 3

1.7 Commitment of Public Funds 4

1.8 Communications Prior to Award 4

1.9 Preparation Costs 4

1.10 Instructions to Quoters 4-7

1.11 GSA Pricing 7

1.12 Task Order Terms and Conditions 7

1.13 Selection of Vendor 7

1.14 Alternate Proposals 7

1.15 Quotation Due Date 7

1.16 Order Type 8

2.0 PRICE QUOTE 8

3.0 TECHNICAL CAPABILITY 8

4.0 EVALUATION FACTORS FOR AWARD 9

5.0 ATTACHMENTS 9

Attachment 1 Bill of Material 9 Attachment 2 Clauses 10-23 Attachment 3 Limited Source Justification 24-26

EPIC Application Administration Support

1.0 INSTRUCTIONS, CONDITIONS, AND NOTICES TO QUOTERS

1.1 Purpose

The purpose of this Request for Quote (RFQ) is to procure Computer Associates (CA) Vision Results software and associated maintenance services for the Office of Personnel Management’s (OPM), The Chief Information Office (CIO) Enterprise Infrastructure Solutions (EIS) Data Center (DC) as defined in the Bill of Materials (BOM) (Attachment 1). As a result, the purpose of this Request for Quote (RFQ) is to establish a single award firm fixed priced contract with a Small Business Authorized Reseller of CA vision results.

1.2 Background

The Chief Information Office (CIO) Enterprise Infrastructure Solutions (EIS) Data Center (DC) provides support to the Office of Personnel Management (OPM) by managing and operating OPM's Information Technology (IT) infrastructure including personal computers/workstations, local and wide area networks and data communications, and designing, developing, and maintaining application systems in support of program offices and e-Government initiatives.

CIO/EIS/DC has a continued requirement for CA Vision Results software and associated maintenance services. OPM internal customers use the software called “CA Vision-Results” which runs on the IBM zSeries Enterprise Server. The software is a report generation tool used to take data and produce ad-hoc reports on the mainframe. Renewal of support is required which ensure the continued use and the availability of corrective service information and program fixes.

1.3 Method of Acquisition

OPM anticipates awarding a single Firm Fixed Price contract to a small business authorized reseller of CA Vision Results software and associated maintenance in accordance with commercial practices the procedures of FAR 12 and 13.

Competition for the items listed will be limited to 100% small business authorized resellers on a brand name basis. The solicitation will be issued as a small business set aside under the applicable NAICS code (511210) for Software publishers, $38.5 million.

Award will be issued to the lowest priced technically acceptable offeror that is a CA vision results authorized reseller.

1.4 Number of Awards

OPM intends to award one (1) firm fixed price contract as a result of this solicitation.

1.5 Date of Award

It is anticipated that award will be made within 30 days following the closing date of this RFQ.

1.6 Period of Performance

The total Period of Performance (PoP) will be 24-months consisting of a 12-month base and one 12-month options starting March 31, 2019

Base: April 1, 2019 – March 31, 2020 Option 1: April 1, 2020 – March 31, 2021

1.7 Commitment of Public Funds

The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds in connection with the proposed acquisition. Any other commitment, either explicit or implied, is invalid.

1.8 Communications Prior to Award

Communications with officials other than the OPM Contracting Specialist or Contracting Officer may compromise the integrity of this acquisition and may result in the cancellation of the solicitation.

1.9 Preparation Costs

This RFQ does not commit the Government to pay for the preparation and/or submission of a quotation.

1.10 Addenda to FAR 52.212-1 Instructions to Quoters

The following instructions are provided in addition to those provided in FAR Clause 52.212-1 – Instructions to Offerors, which is incorporated by reference.

(1) The contractors quote must show--

(i) The RFQ number;

(ii) Quoter's (DUNS) number and CAGE code;

(iii) The name, address, telephone and e-mail address of the company and primary point of contact;;

(iv) Socio-Economic status (e.g., Service Disabled Veteran Owned Small Business, 8(a) Business, Woman-Owned Small Business, HUBZone Business, Small Disadvantaged Business, Small Business, or Large Business)

(v) A statement specifying the agreement with all terms, conditions, and provisions included in the solicitation and agreement to furnish any or all items upon which prices are offered at the price set opposite each item;

(vi) Verification of compliance with FAR 52.222-35, 52.222.37, or 52.222-38.

Verification shall be in the form of information from Veterans Employment & Training Services (VETS) 4212 Service Desk.

(vii) Name, title, contact information, and signature of person authorized to sign the quote.

(viii) Quote must be submitted via email to the Contracting Officer no later than the date and time specified below in paragraph 1.15.

(2) Unless otherwise permitted in the solicitation, quotations submitted must be on an all-or-none basis, e.g., quotations that propose to provide any item or combination of items shall be determined to be nonresponsive.

(3) Quotations submitted in response to this solicitation shall be in English and in U.S.

dollars.

(4) Quotations in response to this solicitation will be valid for a period of 30 calendar days.

(5) Restriction on disclosure and use of data. Quoters that include in their quotations data that they do not want disclosed to the public for any purpose, or used by the Government except for evaluation purposes, shall:

(i) Mark the title page with the following legend: This quotation includes data that shall not be disclosed outside the Government and shall not be duplicated, used or disclosed--in whole or in part--for any purpose other than to evaluate this quotation. If, however, a contract is awarded to this Quoter as a result of--or in connection with-- the submission of this data, the Government shall have the right to duplicate, use, or disclose the data to the extent provided in the resulting purchase order. This restriction does not limit the Government's right to use information contained in this data if it is obtained from another source without restriction. The data subject to this restriction are contained in sheets [insert numbers or other identification of sheets]; and

(ii) Mark each sheet of data it wishes to restrict with the following legend: Use or disclosure of data contained on this sheet is subject to the restriction on the title page of this quotation.

(6) Contract award

(i) The Government intends to award a contract to the quote received that is deemed the lowest priced and technically acceptable.

(ii) The Government may reject the quote if such action is in the Government's interest.

(iii) The Government may waive informalities and minor irregularities in the quotation received.

(iv) The Government reserves the right to make an award on any item for a quantity less than the quantity quoted, at the unit cost or prices quoted, unless the Quoter specifies otherwise in the quotation.

(v) Exchanges with Quoter after receipt of a quotation do not constitute a rejection or counteroffer by the Government.

(vi) The Government may determine that a quotation is unacceptable if the prices proposed are materially unbalanced between line items. Unbalanced pricing exists when, despite an acceptable total evaluated price, the price of one or more line items is significantly overstated or understated as indicated by the application of cost or price analysis techniques. A quotation may be rejected if the Contracting Officer determines that the lack of balance poses an unacceptable risk to the Government.

1.11 Pricing

Prices quoted shall be fixed prices for all items, no partial quotes will be accepted and will be determined to be technically unacceptable.

1.12 Terms and Conditions

Any contract awarded as a result of this RFQ shall be subject to the terms and conditions of this RFQ. See Attachment 2 for applicable FAR and OPM-Specific clauses which will be incorporated into and made a part of any resulting award.

The terms and conditions presented within the RFQ and ultimate award apply to the Contractor, its subcontractors, teaming partners, and employees (hereafter referred to collectively as “Contractor”).

1.13 Selection of Vendor

This acquisition is being conducted in accordance with FAR 13.5 – Items Peculiar to one manufacturer/Brand Name. This is a brand name acquisition of CA Vision Results and quotes will only be accepted from authorized resellers of CA Vision Results. The lowest priced technically acceptable offeror will be selected for task order award. See 4.0 for specific selection criteria.

1.14 Alternate Quotes

Alternate quotations will not be considered.

1.15 Quote Due Date

Your quotation shall be organized as specified in Section 1.10., Instructions to Quoters and received via email by the OPM Contracting Officer (William.Dunlap@opm.gov) by:

March 26, 2019, by 1:00 PM (Eastern),

1.16 Order Type

The Government intends to issue a Firm Fixed Price contract for the services described in the BOM (Attachment 1).

2.0 PRICE QUOTATION

The Quoter must submit firm fixed prices for all products requested in the BOM, Attachment 1.

3.0 TECHNICAL CAPABILITY

The Quoter shall demonstrate its ability to meet the requirements of the BOM by validating that it is a Small Business authorized reseller of the CA Vision Results as requested within the BOM (Attachment 1), that the supply can be provided to OPM for the dates specified in Section 1.6, Period of Performance.

4.0 EVALUATION FOR AWARD

This is a Lowest Price Technically Acceptable acquisition.

Lowest Priced Technically Acceptable Evaluation Process:

1. The Government will first evaluate price to determine the lowest through highest priced quotations.

2. Only the lowest priced quote will be evaluated for technical acceptability and authorized reseller of ca Vision Results, unless the lowest priced quote is deemed technically unacceptable.

If the lowest priced quote is deemed technically unacceptable, the next lowest quote will be evaluated for technical acceptability, unless the next lowest priced quote is deemed technically unacceptable, and so on until a low priced Quoter is identified to be technically acceptable.

Quoters are advised that the Government may not evaluate the technical quotation response of all Quoters under this RFQ.

3. Award will then be made on the basis of the lowest evaluated price of quote meeting or exceeding the acceptability standards for non-cost factors and the quoter being a CA Vision Results authorized reseller.

4. The following non-cost factors will be evaluated for acceptability:

(a) Technical Products and support:

The submitted technical quote will be evaluated based on the Quoter’s quote to provide all support identified for all items within the BOM. The evaluation criteria used for this element shall be either ACCEPTABLE or NOT ACCEPTABLE. If the quoted products meet the stated minimum requirements, it will be rated ACCEPTABLE. If the proposed product(s)/service(s) do not meet the stated minimum requirements, it will be rated NOT ACCEPTABLE.

(b) Past Performance:

The Government reserves the right to obtain past performance information for use in the determination of responsibility from any and all sources including, but not limited to Federal Awardee Performance, and Integrity Information System (FAPIIS) and System for Award Management Exclusions (SAM). No additional past performance submission is required.

5.0 ATTACHMENTS

Attachment 1 – Bill of Material (BOM) Attachment 2 – FAR and OPM Clauses

ATTACHMENT 1

BILL OF MATERIAL

CA Vision: Results Maintenance & Renewal

Base

Sub

CLIN

Mfg./Product Item #

Product Name QTY Unit Price Extended Price

VSNRES002

CA Vision: Results - 24x7 License Maint. & Renewal Support 4/1/19-03/31/20 1 $ - $ -

Vendor must quote on all CLINS to be considered for award. TOTAL: $______________

OPTION YEAR

Sub

CLIN

Mfg./Product Item #

Product Name QTY Unit Price Extended Price

VSNRES002

CA Vision: Results - 24x7 License Maint. & Renewal Support 4/1/20-03/31/21 1 $ - $ -

Vendor must quote on all CLINS to be considered for award. TOTAL: $______________

ATTACHMENT 2

FAR CLAUSES

The following provision and clauses are applicable to the resultant purchase order:

INSPECTION AND ACCEPTANCE OF SERVICE

The Contracting Officer (CO), unless delegated to the Contracting Officer's Representative (COR) will be responsible for inspecting products/services furnished under the contract.

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

https://www.acquisition.gov/?q=/browse/far/52

52.202-1 Definitions (Nov 2013) 52.203-3 Gratuities (Apr 1984) 52.203-5 Covenant Against Contingent Fees (May 2014) 52.203-7 Anti-Kickback Procedures (May 2014) 52.203-12 Limitation on Payments to Influence Certain Federal Transactions (Oct 2010) 52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (Apr 2014) 52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements-Representation (Jan 2017) 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper (May 2011) 52.204-13 System for Award Management Maintenance. (Oct 2016) 52.204-18 Commercial and Government Entity Code Maintenance. (Jul 2016) 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015) 52.233-4 Applicable Law for Breach of Contract Claim (Oct 2004)

52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Jun 2016)

Definitions. As used in this clause--

“Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C.

3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

Safeguarding requirements and procedures.

The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Verify and control/limit connections to and use of external information systems.

Control information posted or processed on publicly accessible information systems.

Identify information system users, processes acting on behalf of users, or devices.

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Identify, report, and correct information and information system flaws in a timely manner.

Provide protection from malicious code at appropriate locations within organizational information systems.

Update malicious code protection mechanisms when new releases are available.

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

OPM Specific Clauses

1752.209-74 Organizational Conflicts of Interest (July 2005)

The Contractor warrants that, to the best of the Contractor’s knowledge and belief, there are no relevant facts or circumstances which could give rise to an organizational conflict of interest (OCI), as defined in FAR 9.5, Organizational and Consultants Conflicts of Interest, or that the Contractor has disclosed all such relevant information.

The Contractor agrees that if an actual or potential OCI is discovered after award, the Contractor shall make a full disclosure in writing to the Contracting Officer. This disclosure must include a description of actions, which the Contractor has taken or proposes to take, after consultation with the Contracting Officer, to avoid, mitigate, or neutralize the actual or potential conflict.

The Contracting Officer may terminate this contract for convenience, in whole or in part, if it deems such termination necessary to avoid an OCI. If the Contractor was aware of a potential OCI prior to award or discovered an actual or potential conflict after award and did not disclose or misrepresented relevant information to the Contacting Office, the Government may terminate the contract for default, debar the Contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

The Contractor must include this clause in all subcontracts and in lower tier subcontracts unless a waiver is requested from, and granted by, the Contracting Officer.

In the event that a requirement changes in such a way as to create a potential conflict of interest for the Contractor, the Contractor must:

Notify the Contracting Officer of a potential conflict, and;

Recommend to the Government an alternate approach which would avoid the potential conflict, or Present for approval a conflict of interest mitigation plan that will:

Describe in detail the changed requirement that creates the potential conflict of interest; and Outline in detail the actions to be taken by the Contractor or the Government in the performance of the task to mitigate the conflict, division of subcontractor effort, and limited access to information, or other acceptable means.

The Contractor must not commence work on a changed requirement related to a potential conflict of interest until specifically notified by the Contracting Officer to proceed.

If the Contracting Officer determines that it is in the best interest of the Government to proceed with work, notwithstanding a conflict of interest, a request for waiver must be submitted in accordance with FAR 9.503.

1752.209-75 Reducing Text Messaging While Driving (Oct 2009)

In accordance with Section 4 of the Executive Order, “Federal Leadership on Reducing Text Messaging While Driving,” dated October 1, 2009, you are hereby encouraged to:

Adopt and enforce policies that ban text messaging while driving company- owned or -rented vehicles or Government-owned, -leased or –rented vehicles, or while driving privately-owned vehicles when on official Government business or when performing any work for or on behalf of the Government; and Consider new company rules and programs, and reevaluating existing programs to prohibit text messaging while driving, and conducting education, awareness, and other outreach for company employees about the safety risks associated with texting while driving. These initiatives should encourage voluntary compliance with the company’s text messaging policy while off duty.

For purposes of complying with the Executive Order:

"Texting" or "Text Messaging" means reading from or entering data into any handheld or other electronic device, including for the purpose of SMS texting, e-mailing, instant messaging, obtaining navigational information, or engaging in any other form of electronic data retrieval or electronic data communication.

"Driving" means operating a motor vehicle on an active roadway with the motor running, including while temporarily stationary because of traffic, a traffic light or stop sign, or otherwise.

It does not include operating a motor vehicle with or without the motor running when one has pulled over to the side of, or off, an active roadway and has halted in a location where one can safely remain stationary.

1752.222-70 Notice of Requirement for Certification of Nonsegregated Facilities (July 2005)

By signing this offer or contract, the contractor will be deemed to have signed and agreed to the provisions of Federal Acquisition Regulations (FAR) Clause 52.222-21, Certification of Nonsegregated Facilities, incorporated by reference in this solicitation/contract. The certification provides that the bidder or offeror does not maintain or provide for its employees, facilities which are segregated on a basis of race, color, religion, or national origin, whether such facilities are segregated by directive or on a de facto basis. The certification also provides that the bidder/offeror does not and will not permit its employees to perform their services at any location under its control where segregated facilities are maintained. FAR Clause 52.222-21 must be included in all subcontracts as well.

1752.222-71 Special Requirements for Employing Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans (July 2005)

If this contract contains FAR Clause 52.222-35 (Equal Opportunity for Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans), your company must comply with the requirements of this clause, including the listing of employment opportunities with the local office of the state employment service system.

If this contract contains FAR clauses 52.222-37 (Employment Reports on Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans) or 52.222- 38 (Compliance with Veterans’ Employment Reporting Requirements), you are reminded that your company must comply with the special reporting requirements described in those clauses.

Your company must submit information on several aspects of its employment and hiring of special disabled and Vietnam era veterans or other veterans who served on active duty during a war or in a campaign or expedition for which a campaign badge has been authorized. You must submit this information no later than September 30 of each year, in the “Federal Contractor Veterans’ Employment Report” or VETS-100 Report. The U.S. Department of Labor has established a web site for submitting this report. The address is:

http://www.vets100.cudenver.edu.

1752.223-71 Environmentally Preferable Products and Services (Jan 2017)

Executive Order 13693, Planning for Federal Sustainability in the Next Decade, requires in agency acquisitions of goods and services (i) use of sustainable environmental practices, including acquisition of biobased, environmentally preferable, energy-efficient, water-efficient, and recycled-content products, and (ii) use of paper of at least 30 percent post-consumer fiber content.

By signing this offer or contract, the contractor will be deemed to have signed and agreed that all goods and services provided under this contract will comply with the above requirements of Executive Order 13693.

1752.224-70 Definition of Terms (Dec 2015)

The following definitions apply to this contract:

Information: This term is synonymous with the term Data. Both terms refer to single or multiple instances of any recorded or communicated fact or opinion being stored or transferred in any digital or analog format or medium.

Controlled Unclassified Information (CUI): This term refers to that sub-category of Information where the loss, misuse, or unauthorized access or modification could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 USC Section 552a (the Privacy Act) that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

Personally Identifiable Information (PII): This term refers to that sub-category of CUI that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

Information System: This term refers to a system composed of people and equipment that processes or interprets Information.

Information Technology (IT) System: This term refers to that sub-category of Information System composed of hardware, software, data, and networks that processes or interprets Information.

Information Security Incident (ISI): This term refers to any event that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government Information or Information Systems.

Record:

For the purpose of Records Management, this term refers to all recorded Information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transactions of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the US Government or because of the informational value of the data in them.

For the purpose of the Privacy Act, this term refers to any item, collection, or grouping of Information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, or criminal or employment history, and that contains the person's name, or the identifying number, symbol, or other identifier assigned to the individual, such as a fingerprint, voiceprint, or a photograph.

System of Records on individuals: This term refers to a group of any Records from which Information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier assigned to the individual.

Operation of a System of Records: This term refers to the performance of any of the activities associated with maintaining the System of Records, including the collection, use, and dissemination of Records.

Privileged User: This term refers to a user that is assigned an organization-defined privileged role that allows that individual to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, but are not limited to, IT system development, key management, account management, network and system administration, database administration, and web administration.

1752.224-71 Freedom of Information Act Requests (Sep 2009)

Offerors are reminded that information furnished under this solicitation may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore:

All items that are confidential to business, or contain trade secrets, proprietary, or personnel information must be clearly marked in all documents submitted to the U.S. Office of Personnel Management (OPM or The Government). Marking of items will not necessarily preclude disclosure when the OPM determines disclosure is warranted by FOIA. However, if such items are not marked, all information contained within the submitted documents will be deemed to be releasable.

No later than five (5) business days after award of a contract, blanket purchase agreement (BPA), or order, the Contractor must provide OPM a redacted copy of the contract/BPA/order in electronic format. This copy will be used to satisfy any requests for copies of the contract/BPA/order under the FOIA. If the Contracting Officer believes that any redacted information does not require protection from public release, the issue will be resolved in accordance with paragraph 3.104-4(d) of the Federal Acquisition Regulation.

Any information made available to the Contractor by the Government must be used only for the purpose of carrying out the provisions of this contract and must not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor's responsible employees.

Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 19 U.S.C. 641. That section provides, in pertinent part, that whoever knowingly converts to their use or the use of another, or without authority, sells, conveys, or disposes of any record of the United States or whoever receives the same with intent to convert it to their use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine of up to $10,000, or imprisoned up to ten years, or both.

1752.224-72 Access to Contractor Information Technology (IT) Systems (Dec 2015)

During the period of performance of the contract and throughout any contract close-out period, the Contractor must provide OPM, or its designate, with immediate access to all IT systems used by the Contractor to support the performance of the contract for the purpose of inspection and forensic analysis in the event of an Information Security Incident (ISI).

1752.224-73 Protecting Information (Dec 2015)

Applicability This clause applies to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).

These requirements are applicable to all Information, regardless of medium, maintained by the Contractor for the performance of this contract.

These requirements are in addition to all applicable requirements established by the Privacy Act of 1974 (5 U.S.C. 552a); and to all other requirements established by various Federal statutes, mandates, and Executive Orders for the management and security of Information and Information Systems. The following additional requirements should not be construed to alter or diminish civil and/or criminal liabilities provided under the Privacy Act or any other applicable Federal statutes.

Authorization to Handle Controlled Unclassified Information (CUI) Prior to receiving, collecting, transmitting, storing, using, accessing, sharing, or removing CUI from any approved locations; the Contractor must receive approval in writing from the Chief Information Officer (CIO) through the Contracting Officer (CO) or Contracting Officer’s Representative (COR).

If the Contractor should begin to receive, collect, transmit, store, use, access, or share CUI without appropriate approval, it should be reported as an Information Security Incident (ISI).

Prior to removing CUI from any approved location, electronic device, removable media, or storage container, approval must be received in writing from the CO or COR.

Authorization to Use Information Technology (IT) Systems Prior to designing, developing, operating, accessing, or using an IT system that will store or process Information other than general information necessary to manage the contract (such as billing), the Contractor must receive approval in writing from the CIO through the CO or COR.

The time required to obtain approval may be lengthy, and the Contractor should identify this requirement as soon as possible.

If the Contractor should begin to operate, access, or use an IT system without appropriate approval, it must be reported as an ISI.

Retention of Authorizing Documentation

The Contractor must maintain a current and complete file of all documentation authorizing handling of CUI during the period of performance of the contract, unless otherwise instructed by the Contracting Officer. Documentation will be made accessible during inspections or upon written request by the CO or the COR.

1752.224-77 Information Security Incidents (ISI) (Dec 2015)

a. ISI Reporting Activities

(1) Contractors must report any and all ISI involving OPM Information to the

OPM Security Monitoring Center (SMC) at CyberSolutions@opm.gov, 844- 377-6109. The SMC is available 24 hours per day, 365 days per year.

(2) Contractors must report any and all ISI involving information technology (IT) systems and Controlled Unclassified Information (CUI) immediately upon becoming aware of the ISI but no later than 30 minutes after becoming aware of the ISI, regardless of day or time; regardless of internal investigation, evaluation, or confirmation of procedures or activities; and regardless of whether the ISI is suspected, known, or determined to involve IT systems operated in support of this contract.

(3) Contractors reporting an ISI to the SMC by email or phone must copy the Contracting Officer (CO) or Contracting Officer’s Representative (COR) if possible; but if not, must notify the CO or COR immediately after reporting to the SMC.

(4) When reporting an ISI to the SMC by email:

(a) Do not include any CUI in the subject or body of any email;

(b) Use FIPS 140-2 compliant encryption methods to protect CUI to be included as an email attachment, and do not include passwords in the same email as the encrypted attachment; and

(c) Provide any supplementary information or reports related to a previously reported incident directly to the OPM SMC with the following text in the subject line of the email: “Supplementary Information / Report related to previously reported incident # [insert number].”

b. ISI Review and Response Activities

(1) The Contractor must provide full access and cooperation for all activities determined by CO or COR to be required to ensure an effective review and response to protect OPM’s Information and Information Systems operated in support of this contract.

(2) The Contractor must promptly respond to all requests by the CO or COR for ISI and system-related information, including but not limited to disk images, log files, event information, and any other information determined by OPM to be required for a rapid but comprehensive technical and forensic review.

(3) OPM, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in ISI Review and Response activities.

c. ISI Determination Activities

(1) The Contractor must not make any determinations related to an ISI associated with

Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract, including determinations related to notification of affected individuals and/or Federal agencies (except reporting criminal activity to Law Enforcement Organizations) and offering of services, such as credit monitoring.

(2) The Contractor must not conduct any internal ISI-related review or response activities that could modify or eliminate any existing technical configuration or information or forensic technical evidence existing at the time of the ISI without approval from the OPM Chief Information Officer (CIO) through the CO or COR.

(3) All determinations related to an ISI associated with Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract will be made only by the OPM CIO through the CO or COR.

(4) The Contractor must report criminal activity to Law Enforcement Organizations upon becoming aware of such activity.

1752.224-79 Suspension of Contract for Security Concerns (Dec 2015)

If at any time during Contract performance it is determined that the Contractor is not in full compliance with the security requirements of this Contract, the Government may immediately suspend performance under this Contract and require the immediate return of all Controlled Unclassified Information (CUI) materials and information to the Government at full Contractor expense. Any work suspension resulting from a security lapse will not be subject to equitable adjustment; all costs incurred will be borne by the Contractor.

1752.232-71 Method of Payment (July 2005)

Payments under this contract will be made either by check or by wire transfer through the Treasury Financial Communications System at the option of the Government.

The Contractor must forward the following information in writing to the Contracting Officer not later than seven (7) days after receipt of notice of award:

Full Name (where practicable), title, telephone number, and complete mailing address of responsible official(s):

to whom check payments are to be sent, and who may be contacted concerning the bank account information requested below.

The following bank account information required to accomplish wire transfers:

Name, address, and telegraphic abbreviation of the receiving financial institution.

Receiving financial institution's 9-digit American Bankers Association (ABA) identifying number for routing transfer of funds. (Provide this number only if the receiving financial institution has access to the Federal Reserve Communications System.)

Recipient's name and account number at the receiving financial institution to be credited with the funds. If the receiving financial institution does not have access to the Federal Reserve Communications System, provide the name of the correspondent financial institution through which the receiving institution receives electronic funds transfer messages. If a correspondent financial institution is specified, also provide:

Address and telegraphic abbreviation of the correspondent financial institution.

The correspondent financial institution's 9-digit ABA identifying number for routing transfer of funds.

Any changes to the information furnished under paragraph (b) of this clause shall be furnished to the Contracting Officer in writing at least 30 days before the effective date of the change. It is the Contractor’s responsibility to furnish these changes promptly to avoid payments to erroneous addresses or bank accounts.

The document furnishing the information required in paragraphs (b) and (c) must be dated and contain the signature, title, and telephone number of the Contractor official authorized to provide it, as well as the Contractor's name and contract number

1752.232-73 Small Business Invoice Requirements (October 2012)

(a) A proper invoice must include the following items (except for interim payments on cost reimbursement contracts for services):

(1) Name and address of the contractor.

(2) Invoice date and invoice number. (Contractors should date invoices as close as possible to the date of transmission.)

(3) Contract number or other authorization for supplies delivered or services performed (including order number and contract line item number).

(4) Description, quantity, unit of measure, unit price, and extended price of supplies delivered or services performed.

(5) Shipping and payment terms (e.g., shipment number and date of shipment, discount for prompt payment terms). Bill of lading number and weight of shipment will be shown for shipments on Government bills of lading.

(6) Name and address of contractor official to whom payment is to be sent (must be the same as that in the contract or in a proper notice of assignment).

(7) Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice.

(8) Taxpayer Identification Number (TIN). The contractor must include its TIN on the invoice only if required by agency procedures. (See 4.9 TIN requirements.)

(9) Electronic funds transfer (EFT) banking information.

(i) The contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision (e.g., 52.232-38, Submission of Electronic Funds Transfer Information with Offer), contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer-Central Contractor Registration, or 52.232-34, Payment by Electronic Funds Transfer-Other Than Central Contractor Registration), or applicable agency procedures.

(ii) The last four digits of the contractor’s bank account must be shown on each invoice submitted for payment. This information will be used as a cross-reference in situations where the EFT banking information in the Central Contract Registration is suspect.

(iii) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(10) The vendor’s certification that their EFT banking information in the Central Contractor Registration is current, accurate and complete as of the date of the invoice.

(11) Any other information or documentation required by the contract (e.g., evidence of shipment).

(b) Any invoice that does not contain all of the information listed in paragraph (a) above will be rejected as improper, and a new complete corrected invoice must be submitted. The payment due date for the corrected invoice will be calculated from the date it is received in the Prompt Pay e-mail box.

(c) ALL small business invoices—without exception—must have unique identifying numbers, and be submitted via e-mail to OPM’s Small Business Invoice e-mail box at:

SmallBusinessInvoices@opm.gov

Please note that OPM cannot guarantee payment of invoices sent by any other means, such as regular mail or e-mail to other addresses.

(d) Please attach ONLY one invoice to each e-mail, and use the following format for the subject line of the e-mail:

<Contractor name>&<Invoice no>&<Amount>&<Contract Number>/<Call or Order Number>

Example:

ABC Co&AB-1298433&10000.00&OPM00-00-X-0000/X0000

(e) Payment due dates will only be calculated from the date that invoices are received in the Small Business Invoice e-mail box.

(f) Inquiries regarding payment of invoices should be e-mailed to InvoiceInquiries@opm.gov. The relevant invoice must be attached to the inquiry e-mail, and the subject line of the e-mail must state “INQUIRY,” followed by the information described in paragraph (d) above.

Example:

INQUIRY: ABC Co&AB-1298433&10000.00&OPM00-00-X-0000/X0000

Do NOT use the Prompt Pay e-mail box for inquiries.

(g) If the supplies, services, technical or other reports are rejected for failure to conform to the technical requirements of the contract, or for damage in transit or otherwise, the invoice will be rejected and returned to the Contractor.

1752.237-70 Non-Personal Services (July 2005)

As stated in the Office of Federal Procurement Policy Letter 92-1, dated September 23, 1992, Inherently Governmental Functions, no personal services shall be performed under this contract.

No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any Contractor employee, the Contractor must promptly notify the Contracting Officer of this communication or action.

The Contractor must not perform any inherently governmental actions under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee may state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with the contract, Contractor employees must identify themselves as Contractor employees and specify the name of the company for which they work. In all communications with other Government Contractors in connection with this contract, the Contractor employee must state that they have no authority to in any way change the contract and that if the other Contractor believes this communication to be a direction to change their contract, they should notify the Contracting Officer for that contract and not carry out the direction until a clarification has been issued by the Contracting Officer.

The Contractor must insure that all of its employees working on this contract are informed of the substance of this clause. Nothing in this clause limits the Government's rights in any way under any other provision of the contract, including those related to the Government's right to inspect and accept the services to be performed under this contract. The substance of this clause must be included in all subcontracts at any tier.

1752.242-71 Return of OPM and OPM-Activity-Related Information (Dec 2015)

a. Within thirty (30) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, unless otherwise instructed by the Contracting Officer, the Contractor must return all original OPM-provided and OPM- Activity-Related Information, such as records, files, and metadata in electronic or hardcopy format, including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract with OPM;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or received from the Contractor by any other related organization and/or any other component or separate business entity.

b. Within forty-five (45) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, unless otherwise instructed by the Contracting Officer, the Contractor must provide the Contracting Officer and COR with an associated Certification of Verified Return of all original OPM and OPM-Activity-Related Information, such as records, files, and metadata in electronic or hardcopy format, including but not limited to the following:

provided by OPM; obtained by the Contractor while conducting activities in accordance with the contract with OPM; distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or received from the Contractor by any other related organization and/or any other component or separate business entity.

1752.242-72 Secure Destruction of All OPM and OPM-Activity-Related Information (Dec 2015)

a. Within sixty (60) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, BUT ONLY after the Contracting Officer (CO) or Contracting Officer’s Representative (COR) has accepted and approved the Contractor’s compliance with the Certification of Verified Return, the Contractor must execute secure destruction of all copies of all OPM and OPM-activity-related files and information (including but not limited to all records, files, and metadata in electronic or hardcopy format) not returned to OPM and held in possession by the Contractor, by procedures approved by the CO or COR in advance and in accordance with applicable OPM IT Security Policy Requirements, including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

(4) received from the Contractor by any other related organization and/or any other…