47PC0624R0001 Rouses LPOE GC Draft Agreement vApril2024.pdf

Sol. Reference No. 47PC0624R0001 GSA Contract No: TBD

Construction Contract for:

General Construction services for the Rouses Point U.S. Land Port of Entry

The Agreement

Document: C101/SEPTEMBER2023 (The Agreement)

Table of Contents

I. Project Information A. Project Summary B. The Contract C. Period Of Performance D. Work Conditions/Site Requirements E. Authorized Representatives F. Contract Liquidated Damages Rate G. Buy American Exceptions H. Statement of Work, Specifications, Drawings, Exhibits and Other

Attachments

II. Prices A. Basis of Pricing B. Contract Price Form

III. Terms and Conditions A. Contractor Responsibilities B. Project Schedule C. Submittals D. Finality of Contract Modifications E. Liquidated Damages F. Insurance Requirements G. Order of Precedence H. Administrative Matters I. Non-Compliance with Contract Requirements J. Requirements for GSA Information Systems K. Options and Allowances L. Equal Employment Opportunity Plan M. Additional Terms and Conditions

IV. Contract Clauses

Document: C101/SEPTEMBER2023

A. Clauses Incorporated in Full Text

1. FAR 52.223-2 Affirmative Procurement of Biobased Products

Under Service and Construction Contracts (SEP 2013)

2. FAR 52.223-9 Estimate of Percentage of Recovered Material

Content for EPA-Designated Items (May 08)

3. GSAR 552.204-9 Personal Identity Verification Requirements

(APR 2023)

4. GSAR 552.252-6 Authorized Deviations in Clauses (NOV

2021)(Deviation FAR 52.252-6)

5. FAR 52.204-25, Prohibition on Contracting for Certain

Telecommunications and Video Surveillance Services or Equipment (NOV 2021 52.232-40

6. Buy American Requirements

7. FAR 52.228-11, Pledges of Assets (DEVIATION APR 2020)

8. FAR 52.232-40, Providing Accelerated Payments to Small

Business Subcontractors (MAR 2023)

9. Additional Clauses

i. FAR 52.222-30, Construction Wage Rate Requirements-Price Adjustment (None or Separately Specified Method) (Aug 2018)

10. Project Labor Agreement

B. Clauses Incorporated by Reference C. Subcontract Requirements

Document: C101/SEPTEMBER2023

I. Project Information

I.A. Project Summary

This U.S. General Services Administration (GSA), Public Buildings Service, Northeast and Caribbean Region is contracting with a General Contractor (GC) to perform construction services for the U.S. Department of Homeland Security – Customs and Border Protection to construct a new Land Port of Entry (LPOE) located at the U.S.-Canada border on New York State Route 11 in Rouses Point

NY.

The project scope includes construction of a new LPOE with an approximately 12,000 square foot main building. The new LPOE includes a railway platform for international Amtrak passenger inspection. This project also includes the construction of commercial and non-commercial vehicle inspection facilities on or adjacent to the Route 11 Right of Way.

The construction of the new facility will be performed as follows:

Construction: The construction as specified in the Construction Documents shall be adhered to, except for any discrepancies that may be discovered. In such situations, the GSA Contracting Officer shall provide direction and clarification.

The construction work includes, but is not limited to: concrete footings, foundations, slabs, and walkways. train platform, vehicle inspection canopies and inspection booths. Structural framing and the installation of walls, ceilings, flooring, lighting, interior finishes, HVAC, electrical, plumbing, fire protection, and customer required infrastructure for IT, AV and electronic security systems.

Testing and Commissioning: All HVAC systems shall be tested, balanced and approved per design requirements. Life Safety systems shall be tested and approved by GSA, the Construction Manager as Agent (CMa), Commissioning Agent and Design Team.

There will be Options for this contract including: Photovoltaic (solar panels), Greywater Harvesting System, electric & telecommunications utilities, and railroad platform and associated walkways.

I.B. The Contract

(1) The Contract consists of the SF1442, the Agreement, the Statement of Work, Specifications, Drawings, Exhibits, Amendments, Modifications, and other Attachments identified herein (collectively, the Contract Documents). The Contract contains the entire agreement of the Parties, and no prior written or oral

Document: C101/SEPTEMBER2023 agreement, express or implied, shall be admissible to contradict or modify any part of the Contract.

(2) The Contractor shall provide and pay for all labor, materials, equipment, tools, water, heat, utilities, transportation, and other facilities and services necessary for the proper execution of the work described in and reasonably inferable from the Contract Documents (the Work), whether temporary or permanent. In consideration for, and upon condition of, the Contractor's completion of the Work, GSA shall pay the Contractor the price or prices established in Section II, subject to the terms and conditions set forth in this Contract.

I.C. Period of Performance

(1) Commencement. The Contractor shall commence performance within 10 days after the Contractor receives the Notice to Proceed (NTP).

(2) Substantial Completion. The Contractor shall achieve Substantial Completion of the Work, as that term is defined in this Agreement, no later than 700 days from issuance of Phase 1 Notice to Proceed (NTP).

Scope Item/Description Substantial Completion (Calendar Days)

Phase 1: work performance required to bring new utilities along Route 11 to the project site as documented by contract drawings.

Any pre-construction and preparatory activities in support of Phase 2.

170 calendar days after issuance of Phase 1 Notice-to-Proceed (NTP)

Phase 2: remaining work performance as documented in contract drawings through project completion, inclusive of construction activity

530 calendar days after issuance of Phase 2 Notice-to-Proceed (NTP)

Document: C101/SEPTEMBER2023

(3) Contract Completion. The Contractor shall achieve Contract Completion, as the term is defined in this Agreement, within 60 calendar days of Substantial Completion.

I.D. Work Conditions/Site Requirements

Refer to Division 1 specification.

I.E. Authorized Representatives

(1) This Contract is between the United States of America, acting by and through the Administrator of General Services (GSA), and the Contractor (the Parties).

References in this Contract to "the Owner" or "the Government" shall be understood to refer to GSA. The following individual is designated as the only authorized GSA representative under this Contract, unless other warranted contracting officers are designated in writing:

Authorized Representative Information:

Contracting Officer’s Information

Name: Sonah Lee

Address: 1 World Trade Center, New York, NY 10007

Telephone: 347-205-1469

Email: sonah.lee@gsa.gov

(2) For the applicable authorities and limitations see Section IV of this Agreement, GSAR 552.236-70.

I.F. Contract Liquidated Damages Rate In accordance with GSAR 552.211-12, Liquidated Damages – Construction, in Section IV of this Agreement, liquidated damages shall be calculated at the rate of $689.86 per calendar day.

I.G. Buy American Exceptions For the applicable Buy American clause and any exceptions, see Section IV of this Agreement, GSAR 552.236-70.

Document: C101/SEPTEMBER2023 (The Agreement) mailto:sonah.lee@gsa.gov

I.H. Statement of Work, Specifications, Drawings, Exhibits, and Other Attachments

The following documents are incorporated by reference into this Contract.

(1) Statement of Work for GSA Contract No. XXXXXX, Dated xxxx.

(2) Specifications for GSA Contract No. XXXXXX, Dated X.

(3) Construction Drawings for GSA Contract No. XXXXXX, Dated X.

(4) Site Conditions as referenced in Division 01 specifications sections

“Work Restrictions,” “Temporary Facilities,” and “Summary and Scope of Work.”

(5) Wage Determinations: no. NY20240104 Construction in Clinton

County, NY dated January 5, 2024 and NY20240006 Heavy and Highway in Clinton County, NY dated January 5, 2024.

(6) Small Business Subcontracting Plan, Dated X [contractor proposed copy will be incorporated after SBA approval is received].

(7) A list of IRA-Eligible Materials corresponding to the list set forth in the solicitation’s Sustainability Factor.

(8) Offeror’s IRA Limit Commitments for each IRA-Eligible Material.

(9) The GWP values from GSA’s asphalt, concrete (and cement), glass and steel requirements associated with the IRA Limit for each material.

II. Prices

II.A. Basis of Pricing

(1) Contract Prices. All Contract prices set forth in this Section include all costs necessary to complete the work for which the price is established (e.g., Base Contract, Unit Price, Options) in accordance with the Contract Documents, including, but not limited to, the cost of work performed by subcontractors and consultants, indirect costs, fees, expenses, taxes, and profit.

(2) Knowledge of Conditions Affecting Price. FAR 52.236-3, Site Investigations and Conditions Affecting the Work, is incorporated by reference in this Contract.

The Contractor shall be presumed to have established all prices with knowledge of general and local conditions that may affect the cost of Contract performance at the site where the Work is to be performed, to the extent that such information is reasonably obtainable.

Document: C101/SEPTEMBER2023 (The Agreement) https://www.gsa.gov/system/files/Asphalt%20-%20GSA%20IRA%20Low%20Embodied%20Carbon%20Requirements%20%28Dec.%202023%29_508.pdf https://www.gsa.gov/system/files/Concrete%20-%20GSA%20IRA%20Low%20Embodied%20Carbon%20Requirements%20%28Dec.%202023%29_508.pdf https://www.gsa.gov/system/files/Glass%20-%20GSA%20IRA%20Low%20Embodied%20Carbon%20Requirements%20%28Dec.%202023%29_508.pdf https://www.gsa.gov/system/files/Steel%20-%20GSA%20IRA%20Low%20Embodied%20Carbon%20Requirements%20%28Dec.%202023%29_508.pdf

(3) Unit Prices and Allowances. If any portion of the Work is to be performed on a unit price basis, the Unit Price shall include all costs of coordinating and incorporating the unit-priced portion of the Work into the Base Contract Work.

The Contractor shall only be obligated to perform unit-priced work to the extent that an Allowance has been established. The Contractor shall be obligated to perform such work in excess of a unit quantity for which an Allowance is established only if directed by the Contracting Officer in writing. The Contractor shall be bound to the unit price or prices set forth herein in all equitable adjustments for changes including unit priced work, and no markups shall be applied to such unit prices.

(4) Options. If any portion of the Work is to be performed upon the timely exercise of an Option, the Option Price shall include all costs of coordinating and incorporating the Option-priced portion of the Work into the Base Contract Work.

An adjustment to the Contract price for such additional work shall be computed solely on the basis of the Option price or prices set forth herein. Unless otherwise specified, all options may be exercised within 90 days of Contract award.

(5) Bid Rates. If this Contract includes Bid Rates to be used in determination of equitable adjustments (e.g., overhead, profit, daily rates for time-related costs), such rates shall be deemed to include all costs recoverable as components of an equitable adjustment consistent with the requirements, definitions, and exclusions applicable to equitable adjustments set forth in this Contract, and consistent with the Contractor's cost accounting practices. Unless otherwise specified, the bid rates shall be deemed to include only the Contractor's costs, and not the costs of any subcontractors.

II.B. Contract Price Form

See attached SF1442 and excel spreadsheet titled “Rouses LPOE GC Pricing Sheet”

III. Terms and Conditions

III.A. Contractor Responsibilities

GSAR 552.236-71, Contractor Responsibilities is located in Section IV.A. of this Agreement and is supplemented as follows:

(1) For the purposes of FAR 52.236-1, Performance of Work by the Contractor, the Contractor shall perform at least twelve (12) percent of the construction work.

Document: C101/SEPTEMBER2023

(2) The Contractor shall secure and pay for all necessary permits and governmental fees, licenses, and inspections that are customarily secured after award of the Contract and that are legally required at the time of award. The Contractor shall provide a copy of the permits required for execution of the work to the Contracting Officer prior to commencement of any related work.

(3) FAR 52.211-10, Commencement, Prosecution, and Completion of Work, and GSAR 552.211-10, Commencement, Prosecution and Completion of Work is supplemented as follows:

The Contractor shall diligently prosecute the Work so as to achieve Substantial Completion of the Work, as defined in GSAR 552.211-70 Substantial Completion (Mar 2019) and the time specified in Section I (Project Information), “Period of Performance” clause. If the Contract specifies different completion dates for different phases or portions of the Work, the Contractor shall diligently prosecute the Work so as to achieve Substantial Completion of such phases or portions of the Work within the times specified.

III.B. Project Schedule

GSAR 552.236-15, Schedules for Construction Contracts is supplemented as follows:

(1) Within ten (10) calendar days of phase 1 and phase 2 notices to proceed, the Contractor shall develop and provide a detailed schedule in widely used, commercially available software such as Microsoft Project and Primavera P6 for completion of all activities, tasks, and submissions required herein.

III.C. Submittals

FAR 52.236-21, Specifications and Drawings for Construction, and GSAR 552.236-72, Submittals located in Section IV.A. of the Agreement are supplemented as follows:

(1) The Contractor shall prepare and submit to the Contracting Officer shop drawings, samples, calculations, product information, mockups, and other submittals (collectively, "submittals") demonstrating compliance with Contract requirements for all Work components as specified elsewhere in this Contract.

III.D. Finality of Contract Modifications As set forth elsewhere in this Contract, the Contractor is entitled to additional consideration under certain conditions, including the issuance of change orders.

It is the Contractor's duty to include in proposals for equitable adjustment or other consideration all compensation to which it may be entitled, including cost and Document: C101/SEPTEMBER2023 time. Unless otherwise explicitly stated in a modification to the Contract providing such consideration, adjustments to the Contract price or time agreed upon therein shall be deemed to provide all compensation to which the Contractor is entitled, and shall constitute final settlement of the Contractor's entitlement to compensation on account of the change or other condition giving rise to the modification.

III.E. Liquidated Damages

The Contractor acknowledges that time is of the essence for the performance of the Work, and that determining actual damages from delay would be extremely difficult and impractical. If the Contractor fails to achieve Substantial Completion of the Work in accordance with FAR 52.211-12, Liquidated Damages, GSAR 552.211-12, Liquidated Damages and within the time specified in this Contract, the Contractor shall be liable to the Government for liquidated damages at the rate specified in Section I (Project Information), paragraph entitled, “Liquidated Damages Rate,” for each calendar day following the required completion date that the Work is not Substantially Complete.

III.F. Insurance Requirements

(1) The Contractor shall obtain and maintain for the entire life of the Contract, in addition to any insurance required by law, the following minimum kinds and amounts of insurance required pursuant to FAR clause 52.228-5, Insurance – Work on a Government Installation, and GSAR 552.228-5, Government as Additional Insured.

(a) Workers' compensation insurance in the amount required by the jurisdiction in which the Contract is performed. The Contractor shall obtain Employers' liability coverage of at least $2,000,000. If occupational diseases are not covered by workers' compensation insurance, Employers' liability coverage shall include occupational diseases.

(b) Broad form comprehensive commercial general liability insurance in the amount of at least $5,000,000 per occurrence. Such insurance shall include, but not be limited to, contractual liability, bodily injury and property damage.

(c) Comprehensive automobile liability covering the operation of all automobiles used in connection with performing the Contract in the amount of at least $1,000,000 per person and $2,500,000 per occurrence for bodily injury and $1,000,000 per occurrence for property damage.

(2) The Contractor shall require that the licensed design professionals it retains for the Project acquire and maintain professional liability insurance in the amount of $5,000,000 per claim and shall provide proof to the Contracting Officer.

Document: C101/SEPTEMBER2023

(3) The Contractor shall promptly provide to the Contracting Officer proof that it has obtained insurance required by the Contract in the form of certificates of insurance. The Contractor shall submit to the Contracting Officer all renewal certificates issued during the life of this Contract immediately upon issuance.

III.G. Order of Precedence Different requirements within this Contract shall be deemed inconsistent only if compliance with both cannot be achieved. In case of inconsistency between Contract Documents, the following order of precedence shall apply:

(1) Section IV of the Agreement

(2) Sections I, II, and III of the Agreement

(3) The Statement of Work

(4) The Specifications

(5) The Drawings

(6) Exhibits and Other Attachments

III.H. Administrative Matters

(1) Project Meetings. The Contractor shall attend a pre-construction conference and shall participate in regularly scheduled Project meetings.

(2) Payments. FAR clause 52.232-5, Payments under Fixed-Price Construction Contracts, is supplemented by GSAR 552.232-5 Payments under Fixed-Price Construction Contracts located in Section IV.A. of this Agreement. In accordance with the relevant FAR and GSAR clauses, GSA requires the following data be included with each invoice:

(a) Invoices shall be submitted electronically to the designated billing office specified in this Contract or in individual delivery/work. An electronic copy of the invoice shall be sent to the CO and COR as designated after award.

(b) Invoices must include the Account Document Number (ADN) assigned at award.

(c) The Contractor shall submit the following information or documentation with each invoice:

(i) Updated Schedule of Values upon which the payment request is based;

Document: C101/SEPTEMBER2023

(ii) GSA Form 2419 - Certification of Progress Payments Under Fixed-Price Construction Contract;

(iii) The payment terms that apply for the particular services rendered;

(iv) Additional documentation:

1. The Contractor shall provide an itemized invoice detailing the amounts requested under each firm-fixed price CLIN and SubCLIN set forth in the Contract Price Form. Itemized invoices shall reflect progress on each CLIN and SubCLIN and should reflect the latest Schedule of Values. Provide updated IRA D&C Submittal: Contract Reporting Form (Construction Team section) as part of the Monthly Pay Application package. See Specification, Division One, Submittal Procedures, 013300 and Payment Procedures, 012900.

2. The Contractor shall submit GSA’s IRA Post Award Allocation Form, attached, within 20 days of contract award.

(3) Prompt Payment. In accordance with FAR clause 52.232-27, the period for payments is as follows:

(a) Progress Payments: 14 days

(b) Subsequent Subcontractor Payments: 7 days

(4) Payment Information. The General Services Administration (GSA) makes information on contract payments available electronically at the Office of the Chief Financial Officer. The Contractor may register at the site and review its record of payments. This site provides information only on payments made by GSA, not by other agencies.

(5) Security Clearances. Contractor shall comply with the following requirements pertaining to security clearances.

(a) All personnel performing work under the Contract on the Project site must obtain an Enter on Duty (EOD) determination before they will be granted access to the site.

(b) To obtain an EOD determination, Contractor shall submit for all such personnel fingerprints on Form SF87 and a completed Contractor Information Worksheet (CIW). Detailed information is available at Detailed information is

Document: C101/SEPTEMBER2023 (The Agreement) https://finance.ocfo.gsa.gov/pii/piinotice.aspx?token=PI002 https://finance.ocfo.gsa.gov/pii/piinotice.aspx?token=PI002 available at GSA Access Card . USAccess Credentialing Centers can be located at US Access Centers.

(c) In addition, all such personnel who will be on site 6 months or longer must apply for and receive clearance in accordance with Homeland Security Presidential Directive 12 (HSPD-12). See Section IV, Contract Clauses, GSAR 552.204-9.

(6) Safeguarding and Dissemination of Controlled Unclassified Information (CUI) Building Information

This clause applies to all recipients of CUI building information (which falls within the CUI Physical Security category), including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

Marking CUI. Contractors must submit any contractor-generated documents that contain building information to GSA for review and identification of any CUI building information that may be included. In addition, any documents GSA identifies as containing CUI building information must be marked in accordance with the Order and the Marking Controlled Unclassified Information Handbook (the current version may be found at https://www.archives.gov/files/cui/20161206-cui-marking-handbook-v1-1.pdf) before the original or any copies are disseminated to any other parties. If CUI content is identified, the CO may direct the contractor, as specified elsewhere in this contract, to imprint or affix CUI document markings (CUI) to the original documents and all copies, before any dissemination, or authorized GSA employees may mark the documents.

1. Authorized recipients.

a. Building information designated as CUI must be protected with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information, as defined in 32 C.F.R. § 2002.4(bb). Those with such a Lawful Government Purpose may include Federal, state and local government entities, and non-governmental entities engaged in the conduct of business on behalf of or with GSA. Non-governmental entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to GSA, or performing work under a GSA contract or subcontract. Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov, and have

Document: C101/SEPTEMBER2023 (The Agreement) http://www.gsa.gov/portal/category/107203 http://www.fedidcard.gov/centerlist.aspx https://www.archives.gov/files/cui/20161206-cui-marking-handbook-v1-1.pdf a Lawful Government Purpose to access such information. If a subcontractor is not registered in the SAM database and has a Lawful Government Purpose to possess CUI building information in furtherance of the contract, the subcontractor must provide to the contractor its DUNS number or its tax ID number and a copy of its business license. The contractor must keep this information related to the subcontractor for the duration of the contract and subcontract.

b. All GSA personnel and contractors must be provided CUI building information when needed for the performance of official Federal, state, and local government functions, such as for code compliance reviews and the issuance of building permits. Public safety entities such as fire and utility departments may have a Lawful Government Purpose to access CUI building information on a case-by-case basis. This clause must not prevent or encumber the necessary dissemination of CUI building information to public safety entities.

2. Dissemination of CUI building information:

a. By electronic transmission. Electronic transmission of CUI information outside of the GSA network must use session encryption (or alternatively, file encryption) consistent with National Institute of Standards and Technology (NIST) SP 800-

171. Encryption must be through an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard or Triple Data Encryption Standard, in accordance with Federal Information Processing Standards Publication 140-2, Security Requirements for Cryptographic Modules, as required by GSA policy.

b. By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include CDs, DVDs, and USB drives.

Non-electronic forms of CUI building information include paper documents, photographs, and film, among other formats.

i. By mail. Contractors must only use methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt. CUI markings must not appear on the exterior of packages.

ii. In person. Contractors must provide CUI building information only to authorized recipients with a Lawful Government Purpose to access such information. Further information on authorized recipients is found in section 1 of this clause.

Document: C101/SEPTEMBER2023

3. Record keeping. Contractors must maintain a list of all entities to which CUI is disseminated, in accordance with sections 2 and 3 of this clause. This list must include, at a minimum: (1) the name of the state, Federal, or local government entity, utility, or firm to which CUI has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the CUI building information, with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information; (3) contact information for the named individual; and (4) a description of the CUI building information provided. Once “as built” drawings are submitted, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and suppliers, and submit them to the CO. For Federal buildings, final payment may be withheld until the lists are received.

4. Safeguarding CUI documents. CUI building information (both electronic and paper formats) must be stored within controlled environments that prevent unauthorized access. GSA contractors and subcontractors must not take CUI building information outside of GSA or their own facilities or network, except as necessary for the performance of that contract. Access to the information must be limited to those with a Lawful Government Purpose for access.

5. Destroying CUI building information. When no longer needed, CUI building information must either be returned to the CO or destroyed in accordance with guidelines in NIST Special Publication 800-88, Guidelines for Media Sanitization.

6. Notice of disposal. The contractor must notify the CO that all CUI building information has been returned or destroyed by the contractor and its subcontractors or suppliers in accordance with paragraphs 4 and 5 of this clause, with the exception of the contractor's record copy. This notice must be submitted to the CO at the completion of the contract to receive final payment. For leases, this notice must be submitted to the CO at the completion of the lease term.

7. CUI security incidents. All improper disclosures or receipt of CUI building information must be immediately reported to the CO and the GSA Incident Response Team Center at gsa-ir@gsa.gov. If the contract provides for progress payments, the CO may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of CUI building information. Progress payments may also be withheld for failure to comply with any provision in this clause until the contractor provides a corrective action plan explaining how the

Document: C101/SEPTEMBER2023 (The Agreement) mailto:gsa-ir@gsa.gov contractor will rectify any noncompliance and comply with the clause in the future.

8. Subcontracts. The contractor and subcontractors must insert the substance of this clause in all subcontracts.

[End of clause]

III.I. Non-Compliance with Contract Requirements

In the event the Contractor, after receiving written notice from the Contracting Officer of non-compliance with any requirement of this Contract, fails to initiate promptly such action as may be appropriate to comply with the specified requirement within a reasonable period of time, the Contracting Officer shall have the right to order the Contractor to stop any or all work under the Contract until the Contractor has complied or has initiated such action as may be appropriate to comply within a reasonable period of time. The Contractor will not be entitled to any extension of Contract time or payment for any costs incurred as a result of being ordered to stop work for such cause.

III.J. Requirements for GSA Information Systems

1.0 Security Requirements

The contractor for this project is required to meet the Security and Privacy requirements identified in the ensuing sections.

1.1 Security Assessment and Authorization Requirements

Contractors must obtain an Authorization to Operate (ATO) for the proposed solution at the FIPS 199 Moderate impact level. Service Providers offering solutions delivered as-a-service in the cloud, meeting the NIST 800-145 cloud definition, consistent with the OMB FedRAMP Policy memo, are subject to FedRAMP cloud information security and privacy requirements. Vendors with traditional on-premise or cloud deployments (not delivered as SaaS) are required to meet traditional GSA Assessment and Authorization (A&A) requirements.

Vendors having mobile application components are required to meet the additional mobile application security requirements as defined in Section 9.2.5.

Further, any software required for installation on Government Furnished Equipment (GFE) or hardware required for deployment in GSA Facilities is

Document: C101/SEPTEMBER2023 (The Agreement) https://www.fedramp.gov/ subject to GSA software and device testing processes as defined in section 9.2.4.

1.2 Cloud Delivered as-a-Service (Requires FedRAMP)

Cloud computing offers an opportunity for the Federal Government to take advantage of cutting edge information technologies to dramatically reduce procurement and operating costs and greatly increase the efficiency and effectiveness of services provided to its agencies and citizens. Established by OMB in 2011, The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP empowers agencies to use modern cloud technologies, with emphasis on security and protection of federal information. Federal executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information systems that support the operations and assets of the departments and agencies are required to ensure applicable contracts appropriately require cloud service providers (CSPs) to comply with FedRAMP security authorization requirements. This includes systems across all cloud deployment models (e.g., Public Clouds, Community Clouds, Private Clouds); Hybrid Clouds) and all cloud service models (e.g., Infrastructure as a Service, Platform as a Service, Software as a Service) as defined per NIST 800-145, The NIST Definition of Cloud Computing.

The Cloud Information Systems – IT Security and Privacy Requirements identified in Chapter 5 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level. Personally Identifiable Information (PII) is not in the scope of acquisition and PII is not expected to be stored in the service provider's cloud solution.

Vendors are required to submit and receive GSA’s approval of documentation as evidence of complying with the security requirements listed in Chapter 5 prior to being able to accept any orders.

Document: C101/SEPTEMBER2023 (The Agreement) https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

Changes to the platform that impact the security authorization throughout the period of performance will require attendant changes to maintain the security authorization.

Vendors are required to either be already FedRAMP authorized or be able to achieve a FedRAMP Moderate authorization within One (1) year of the contract award. If not already FedRAMP authorized at the FIPS 199 Moderate impact level, GSA can work with the vendor to obtain a GSA MiSaaS (Moderate Impact Software as a Service) Authority To Operate (ATO) from GSA IT-Security within 150 days of the notice to proceed. Onboard base year projects within 30 days of obtaining MiSaaS ATO. No Government data can be uploaded into the production software application until the GSA Authority To Operate (ATO) is obtained. See 3.1.1.A for anticipated volume of projects.

Vendors pursuing award under this solicitation are required to partner with a Third-Party Assessment Organization (3PAO) to facilitate an independent assessment of the offeror’s documented and implemented NIST 800-53 security controls. Vendors are encouraged to also attain 3PAO services for documentation preparation.

Vendor shall adhere to a milestone schedule to ensure compliance with first year FedRAMP requirement.

If at any time, the vendor is either unwilling or unable to meet any of the process requirements, GSA may choose to terminate the award.

1.3 Traditional On-Premise or Cloud Delivered (not SaaS)

● 1.3.1 External hosted or Cloud Delivered

○ Vendors choosing to offer a solution hosted on their system should reference The External Information Systems – IT Security and Privacy Requirements identified in Chapter 2 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level. The vendor shall be required to obtain a GSA IT-Security Authority to Operate (ATO) For further guidance on ATO, reference. GSA-IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30.

Document: C101/SEPTEMBER2023 (The Agreement) https://insite.gsa.gov/system/files/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-24%5D-06-26-2023.pdf https://insite.gsa.gov/system/files/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-24%5D-06-26-2023.pdf https://insite.gsa.gov/system/files/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-24%5D-06-26-2023.pdf

● 1.3.2 On-Premise (GSA) hosted

○ Vendors choosing to offer a solution hosted within GSA environment should reference the Internal Information Systems - IT Security and Privacy Requirements identified in Chapter 3 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level.The vendor shall be required to obtain a GSA IT-Security Authority to Operate (ATO) For further guidance on ATO, reference. GSA-IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30.

○ Additionally for any smart buildings or IoT components, the vendor should adhere to the Building Technologies Technical Reference Guide (version 2.0 or the latest posted version).

Vendors pursuing award under this solicitation are required to partner with an independent assessor (GSA is required to approve) to facilitate an independent assessment of the offeror’s documented and implemented NIST 800-53 security controls. Vendors are encouraged to leverage a 3PAO for assessment services and for documentation preparation.

1.4 Hardware Device and Software Security Testing for Components Required for Deployment in GSA Facilities/Networks (If any)

Per GSA policy 16-76, all IP addressable devices, appliances and software applications that will communicate over the GSA network shall be scanned by GSA-IT Security. Before any hardware, software or IT device/system is connected to its network, a security risk assessment of selected management, operational, and technical security controls is performed, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. A security assessment report is produced by GSA IT Security, which will be provided to the PBS stakeholders and the vendor. The assessment report will allow GSA to understand and accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls. The contractor/vendor shall therefore be held responsible for mitigating

Document: C101/SEPTEMBER2023 (The Agreement) https://insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-22%5D-12-23-2021_%281%29docx_%281%29.pdf https://insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-22%5D-12-23-2021_%281%29docx_%281%29.pdf https://insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-22%5D-12-23-2021_%281%29docx_%281%29.pdf https://drive.google.com/file/d/1H6UTXpB2mnZ09SiqRVdzFK9s4hHOBG1Z/view?usp=sharing https://drive.google.com/file/d/1H6UTXpB2mnZ09SiqRVdzFK9s4hHOBG1Z/view?usp=sharing all security risks identified. Vulnerabilities shall be mitigated, within the following timeframes:

Severity Expected resolution

Critical and high vulnerabilities ≤ 30 business days

Moderate vulnerabilities ≤ 90 business days

The GSA IT Security team performs security control reviews utilizing a systematic, repeatable approach, which is utilized to uniformly evaluate any device, application or general support system.

Once the device/application has completely gone through the remediation process and has a remediation/hardening plan in place, all other projects can use that report to configure the named device, or application accordingly. This assessment is revisited every three years, or upon release of any major new revision of the solution, at any stage when new vulnerabilities are uncovered and reported (i.e ICS-CERT advisories). The contractor(s) will therefore need to have a strategy to address evolving vulnerabilities in timelines set by GSA.

● 1.4.1

Per M-21-07 the Federal Government will deliver information services, operate networks and access services of others using only IPv6. Starting no later than FY23, all new networked federal BMC systems must be IPv6 enabled when deployed. The intent is to phase out IPV4 for all federal BMC systems. Currently, our network and client devices are IPv6-enabled, but the applications and the systems they run on, including servers and databases are likely not capable based on their current configuration. GSA must accept only IPv6 enabled systems when deploying new networked federal BMC systems. The intent is to phase out all IPv4 systems over the next several years. IPv4 will no longer be allowed for new projects/assessments starting July 2023. Break/Fix replacements of existing (deployed) hardware should prioritize utilizing an IPv6 capable replacement when possible.

Document: C101/SEPTEMBER2023 (The Agreement) https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

1.5 Mobile Application Security Requirements (If any)

The contractor shall adhere to the following requirements and guidelines for developing mobile applications. All requirements and guidelines are found in the GSA IT Security Procedural Guide 12-67, “Securing Mobile Devices and Applications,” which will be provided upon contract award.

A mobile application, most commonly referred to as an app, is a type of application software designed to run on a mobile device, such as a smartphone or tablet computer. Mobile applications frequently serve to provide users with similar services to those accessed on PCs. Apps are generally small, individual software units with limited capabilities and isolated functionality. The simplest apps are developed to utilize the web browser of the mobile device to provide a feature set integration much like what is found on a user’s PC. However, as mobile app development has grown, a more sophisticated approach involves developing applications specifically for the mobile environment, taking advantage of both its limitations and advantages. For example, apps that use location-based features are inherently built from the ground up with an eye to mobile devices given that you do not have the same concept of location on a PC. With this new paradigm in both mobile platforms and the applications loaded on them, GSA will concentrate security focus on the following goals:

● That all apps loaded have an initial assessment by GSA for acceptability and then a security assessment & authorization, when required

● That all apps are deployed from only trusted sources, following their security/assessment process – This presently is the Apple ITunes store for iOS and the Google Play store for Android. MaaS360 may also be used, once retrieved from these sources, for enterprise deployment

● That Terms of Service (ToS) discipline is adhered to, based on acceptability of an app – either as an individual user or for GSA as an Agency

● That apps deemed to be unacceptable are blacklisted, using MaaS360

● That a mobile app inventory for all devices be maintained

● That GSA developed apps are assessed, evaluated and approved by the

AO for the system they support before deployment

1.6 Identification and Authentication Requirements

Document: C101/SEPTEMBER2023

● The vendor shall support configurable integrations with GSA operated, and government-wide operated, identity and authentication / single sign on services. The vendor shall support SAML 2.0 and/or OpenID Connect integrations. GSA will identify and provide the services upon award.

● The vendor shall support multi-factor authentication for GSA administrator users (privileged users) through integrations with a GSA managed identity and authentication service. The vendor shall support SAML 2.0 and/or OpenID Connect integrations.

1.7 Other Security and Privacy Requirements

● Compliance with Section 889 Part 1 and Part 2 of the John S. McCain National Defense Authorization Act (NDAA)

● No 3rd party integrations are authorized without the expressed permission of the GSA CISO and/or Authorizing Official and an assessment and authorization of the 3rd party offering having been completed prior to the integration.

● The Contractor shall comply with GSA administrative, physical, and technical security controls to ensure that all Government’s security requirements are met. The Contractor is responsible for addressing any issues or concerns raised by PBS within five (5) workdays.

● Safeguarding Sensitive Data and Information Technology Resources

(a) In accordance with FAR 39.105 and GSAM Subpart 539.70 , this section is included in the contract.

(b) This section applies to all who access or use GSA information technology (IT) resources or sensitive data, including awardees, Contractors, subcontractors, lessors, suppliers and manufacturers.

(c) The GSA policies as identified in paragraphs (d), (e) and (f) of this section are applicable to the contract. These policies can be found at https://www.gsa.gov/directives or https://insite.gsa.gov/directives.

(d) All of the GSA policies listed in this paragraph shall be followed.

(1) CIO P 1878.3 Conducting Privacy Impact Assessments (PIAs) in GSA

(2) CIO P 2100.1N GSA Information Technology (IT) Security

Policy

(3) CIO P 2180.2 GSA Rules of Behavior for Handling

Personally Identifiable Information (Pll)

(4) 2231.1 CIO GSA Data Release Policy

(5) CIO 9297.2C CHGE 1 GSA Information Breach

Notification Policy Document: C101/SEPTEMBER2023

(e) All of the GSA policies listed in this paragraph shall be followed, when inside a GSA building or inside a GSA firewall.

(1) CIO P 2100.2B GSA Wireless Local Area Network (LAN) Security

(2) CIO 2104.1B GSA Information Technology IT General Rules of Behavior

(4) CIO 2182.2 Mandatory Use of Personal Identity Verification (PIV) Credentials

(5) ADM P 9732.1 E Suitability and Personnel Security

(f) The GSA Policies listed in this paragraph shall be followed.

The contractor shall assume that all policies are applicable unless otherwise stipulated by the GSA Office of the Chief Information Security Officer.

(1) CIO 2101.2 GSA Enterprise Information Technology Management (ITM) Policy

(2) CIO 2105.1 D GSA Section 508: Managing Electronic and Information Technology for Individuals with Disabilities

(3) OSC 2106.2 GSA Social Media Policy

(4) CIO 2107.1 Implementation of the Online Resource

Reservation Software

(5) CIO 2108.2 Software License Management

(6) CIO 2160.2B CHGE 2 GSA Electronic Messaging and

Related Services

(7) CIO 2160.4A CIO Provisioning of Information Technology

(IT) Devices

(8) CIO 2162.2 GSA Digital Signature Policy

(9) CIO P 2165.2 GSA Telecommunications Policy

(g) The Contractor and subcontractors shall insert the substance of this section in all subcontracts.

● Relevant FAR Clauses

○ 552.239-70 Information Technology Security Plan and Security Authorization. Information Technology Security Plan and Security Authorization (Jun 2011) “All offers/bids submitted in response to this solicitation must address the approach for completing the security plan and certification and security authorization requirements as required by the clause at 552.239-71, Security Requirements for Unclassified Information Technology Resources. (End of clause)”

● FAR Clauses Incorporated by Reference

Document: C101/SEPTEMBER2023

● 52.239-1 Privacy or Security Safeguards

● 552.239-71 Security Requirements for Unclassified

Information Technology Resources

III.K. Options and Allowances

Option 1: Photovoltaic (solar panels) Option 2: Greywater Harvesting System Option 3: Electric and Telecommunications Utilities Option 4: Railroad platform and associated walkways Option 5: Storage Shed

III.L. Equal Employment Opportunity Plan

(1) Within 30 days following award, the Contractor shall furnish the Contracting Officer with an EEO Compliance Plan. The plan shall include the following:

(a) Name of contractor’s EEO Manager for the contract and point of contact information. The EEO Manager is responsible for:

(i) Monitor all employment-related activity to ensure that the Contractor’s equal employment policy is being carried out;

(ii) Submit reports as may be required by the Government;

and

(iii) Keep records that shall at least include for each employee the name, address, telephone number, construction trade, union affiliation (if any), employee identification number, social security number, race, sex, status (e.g., mechanic, apprentice, trainee, helper, or laborer), dates of changes in status, hours worked per week in the indicated trade, rate of pay, and locations at which the work was performed. Records shall be maintained in an easily understandable and retrievable form; however, to the degree that existing records satisfy this requirement, separate records are not required to be maintained.

(a) Address how the contractor intends to include the EEO provisions of the contract in all subcontracts in excess of $10,000.

(b) Address what type of efforts will be used to ensure equal employment opportunity in accordance with FAR 52.222-27 Affirmative Action Compliance Requirements for Construction. Discuss organized

Document: C101/SEPTEMBER2023 meeting with subcontractors, labor organizations and/or other community stakeholders. Meetings should focus on increased employment opportunities, perceived problems and working to achieve the goals established. DOL representatives are available to participate in such meetings.

(2) During the performance of this contract, the Contractor shall submit to the Contracting Officer semi-annually an EEO Compliance Report containing the following:

(a) List of awarded subcontractors by trade, date of award and amount of subcontract. If subcontract is in excess of $10,000, date the Deputy Assistant Secretary for Federal Contract Compliance, U.S.

Department of Labor was notified of award.

(b) Narrative of actions taken to comply with the affirmative action procedures in paragraphs (g)(1) through (g)(16) of FAR 52.222-27.

(c) List participation in any voluntary associations that may assist in fulfilling the contractor’s affirmative action obligations.

Semi-annual reports are due on the 30th calendar day (or next business day) following the March 31st and September 30th.

III.M. Additional Terms and Conditions

1. Limited Notice to Proceed with Post-award Low Embodied Carbon Materials Research Report.

If any of the Contractor’s IRA Limit Commitments do not correspond to the subject material’s Top 20% Limits, notice to proceed with the project entails only a limited notice to proceed with the Low Embodied Carbon Materials CLIN.

Specifically, Contractor shall only proceed with preparation of a Low Embodied Carbon Materials Research Report explaining why such IRA Limit Commitments did not correspond to the subject material’s Top 20% Limits.

Additionally, to the extent applicable, the Contractor shall also explain why any IRA Limit Commitments did not meet the subject…