ACCESS_FORM.rtf

SOURCE SELECTIO N INFORM ATION SEE FAR 2.101 and FAR 3. 1 04 I SOLICITATION No: GS-07-P-16-JU- D-7005

Sensitive But Unclassified Information Solicitation 47PH0218R0002 For Reference Library Information and Other Applicable Information Contained in the Solicitation THIS FORM MUST BE RETURNED PRIOR TO OBTAINING ACCESS TO SOLICITATION Submit completed form to: david.bustamante@gsa.gov

The Interested party shall protect SBU building information by strictly limiting access to those individuals having a need to know such information acting on behalf of Federal, State , and local government entities, nongo vernment entitie s engaged in the condu ct of business on behalf of or with GSA, and firm s currently registered as "active " in the System for Award Management (SAM) database via https:// w ww.sam.gov. If a subcontract or is not registered in the SAM and has a need to possess SBU building information, the subcontractor shall provide to the Interested party its DUNS number or its tax ID number and a copy of its business license. This clause shall not be construed to encumber the dissemination of SBU building information to public safety entities.

The Interested party shall use session or file encryption when transmitting SBU building information electronically outside of the GSA firewall and network . The Interested party shall encrypt sessions or file s with an approved NIST algorithm, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES), in accordance with Feder al Information Proce ssing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic M odules. Encryption tools that meet FIPS 140 -2 are referenced on the NIST web page found at the following URL:

http:// csrc.nist.gov/ groups/ STM/ cmvp/ document s/140-1/1401 vend.htm

All encryption products used to satisfy the FIPS 140-2 requirement should have a validation certificate that can be verified at the following URL:

http:/ / csrc.nist.go v / groups/STM/cmvp/ validat ion.html#02

(Note that not all vendors of security products that claim conformance with FIPS 140-2 have validation certificates.)

When transmitting SBU building information contained in any physical media, including hardcopy and portable electronic data storage devices, the interested party shall only use methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt. Portable electronic data storage devices include but are not limited to CDs, DVDs, and USB drives .

The Interested party shall maintain a list of the entities and the firms to which it has disseminated SBU building information. This list must include at a minimum (1) the name of the entity or firm; (2) the name and contact information of the individual at the entity or firm who is responsible for protecting the SBU building information; and (3) a description of the SBU building information provided. Upon completion of the Work, the interested party shall collect all lists maintained in accordance with this clause, including those maintained by any subcontra ctors and/ or suppliers , and submit them to the Contracting Officer.

Upon completion of the solicitation process, the interested party shall either destroy all records containing SBU building information or return them to the Contracting Officer, as directed by the

SOURCESELECTIONINFORMATIONSEE FAR 2.101and FAR 3.104 I SOLICITATION No: 47PH0218R0002

Contracting Officer. The Interested party shall destroy electronically stored SBU building information by deleting it or otherwise rendering it unreadable and incapable of being restored, in accordance with guidelines provided for media sanitization within Appendix A of NIST Special Publication 800-88, Guidelines for Media Sanitization , available at htt p:/ / csrc.nist.gov/publication s/nistpubs/800- 88/NISTSP800-88 revl .pdf. Examples of acceptable destruction methods for SBU building information are: burning or shredding hardcopies; physically destroying portable electronic storage devices; deleting and removing files from electronic recycling bins; and removing material from computer and hard drives using a permanent-erase utility such as bit-wiping software or disk crushers.

The Interested party shall verify to the Contracting Officer in writing that SBU building information has been disposed of as required in Paragraph (7)(f) of this clause.

The Interested party shall immediately report to the Contracting Officer all improper disclosures of SBU building information. If the Interested party fails to comply with any provision of this clause, the Contracting Officer may withhold approval of progress payments until the Interested party provides a corrective action plan explaining how it will rectify any noncompliance and prevent future improper disclosures of SBU building information.

The Interested party shall insert the substance of this clause in all subcontracts.

Name of Requester:

Company:

DUNs:

I understand the above requirements Signature______________________

DATE:_________________________