49100419R1001_0005_Post_to_FBO.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 17

0005 May 21, 2019 Not Applicable

National Science Foundation Div. of Acq. & Cooperative Support 2415 Eisenhower Ave.

Alexandria VA 22314

DACS

National Science Foundation Div. of Acq. & Cooperative Support 2415 Eisenhower Ave.

Alexandria VA 22314

To all Offerors/Bidders 49100419R1001

02-15-2019 X

X

See page 2.

X

RFP 49100419R1001 Page 2 of 17

Amendment 0005

The purposes of this amendment 0005 under solicitation 49100419R1001 are the following:

A. To revise the due date under Section 9, page 1 of the SF33;

B. To revise the third paragraph under sub-section C.2.2.2;

C. To delete the NSF 030 Clause dated Dec 2017 and add the NSF 030 Clause dated May 2019;

D. To add Appendix L, Summit Station Systems 2018;

E. To revise sub-section L.14;

F. To add sub-section L.15.4.6 entitled “Other Direct Costs”;

G. To add sub-section L.15.4.7 entitled “Utqiaġvik Costs”;

H. To delete Attachment L-2 entitled “Prime Offeror Cost/Price Worksheet Rev. 1” in its entirety;

I. To add Attachment L-2 entitled “Prime Offeror Cost/Price Worksheet Rev. 2”;

J. To add Attachment L-9 entitled “Amendment 0005 Questions/Comments and Responses”;

K. To revise sub-section M.7.1;

L. To delete sub-section M.7.4 in its entirety;

M. To add sub-section M.8.7;

N. To add sub-section M.8.8;

O. To add Wage Determination WD 15-5637 Rev. 11; and

P. To revise Section J accordingly.

1. Section 9, page 1 of the SF33 is hereby revised, as follows:

9. Sealed offers in original and See Section L.11 copies for furnishing the supplies or services in

Schedule will be received at the place specified in Item 8, or if hand carried, in the depository located in See Section L.12 until 2:00 PM local time June 7, 2019.

CAUTION -LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No.

52.214-7 or 52.215-1. All Offers are subject to all terms and conditions contained in this solicitation.

2. The third paragraph of sub-section C.2.2.2 is hereby revised as follows (changes in bold):

Most projects requiring support in Greenland are managed from a logistics base at Kangerlussuaq

(Kanger) with a few working out of TAB and Summit Station. For operations in Kanger the

Contractor shall maintain a field equipment inventory and lease office space, garage space, and warehouse space. The Contractor shall coordinate air operations with the Greenland Airport Authority

(Mittarfeqarfiit), procure air support contracts for helicopter and fixed-wing activities, contract for lodging and food services and provide other support as needed. Most warehouse space in Kanger is owned/managed by Mittarfeqarfiit. The Kangerlussuaq International Science Support (KISS) center in Kanger offers lodging, laboratory, and office space. For projects working out of TAB, NSF leases facilities from the USAF for housing, office, field project staging, lab space, and storage and operations. The Contractor shall subcontract, with the U.S. Air Force TAB Base Maintenance

Contractor (BMC), for support services at the NSF leased TAB facilities. The respective TAB support services shall include but not be limited to snow removal, building maintenance, and vehicle maintenance when applicable. The Contractor shall operate, maintain and manage NSF-owned vehicles in Kanger and TAB.

3. Under sub-section H.1, the NSF 030 clause entitled “SECURITY REQUIREMENTS AND ACCESS

TO NATIONAL SCIENCE FOUNDATION FACILITIES AND UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (DEC 2017)” is hereby deleted and the NSF 030 clause entitled

“SECURITY AND PRIVACY REQUIREMENTS - ACCESS TO NATIONAL SCIENCE

RFP 49100419R1001 Page 3 of 17

FOUNDATION FACILITIES AND UNCLASSIFIED INFORMATION TECHNOLOGY

RESOURCES (MAY 2019) is hereby added as follows:

NSF 030 - SECURITY AND PRIVACY REQUIREMENTS - ACCESS TO NATIONAL SCIENCE

FOUNDATION FACILITIES AND UNCLASSIFIED INFORMATION TECHNOLOGY

RESOURCES (MAY 2019)

Applicable Laws and Regulations

1. Records Management by Federal Agencies [44 USC 31]

2. Privacy Act of 1974 as amended [5 USC 552a]

3. Federal Information Security Modernization Act (FISMA) of 2014 [Title III, PL 113-283]

4. Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification

Standard for Federal Employees and Contractors”

5. Presidential Policy Directive 21 (PPD-21), "Critical Infrastructure Security and Resilience"

6. Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act

[OMB Circular A-108, as amended]

7. Management's Responsibility for Enterprise Risk Management and Internal Control [OMB

Circular A-123, Revised 7/15/2016]

8. Managing Information as a Strategic Resource [OMB Circular A-130, revised 7/28/2016]

9. Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB M-01-

05]

10. Safeguarding Against and Responding to the Breach of Personally Identifiable Information

[OMB M-07-16]

11. Ensuring New Acquisitions Include Common Security Configurations [OMB M-07-18]

Applicable Standards and Guidance

1. Security Requirements for Cryptographic Modules [FIPS Publication 140-2]

2. Standards for Security Categorization of Federal Information and Information Systems [FIPS

Publication 199]

3. Minimum Security Requirements for Federal Information and Information Systems [FIPS

Publication 200]

4. Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication

201-2]

5. Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18]

6. Guide for Conducting Risk Assessments [NIST SP 800-30]

7. Contingency Planning Guide for Federal Information Systems [NIST SP 800-34]

8. Risk Management Framework for Information Systems and Organizations: A System Life Cycle

Approach for Security and Privacy [NIST SP 800-37]

9. Managing Information Security Risk: Organization, Mission, and Information System View

[NIST SP 800-39]

10. Security and Privacy Controls for Federal Information Systems and Organizations [NIST SP 800-

53]

11. Assessing Security and Privacy Controls in Federal Information Systems and Organizations:

Building Effective Assessment Plans [NIST SP 800-53A]

12. Guide for Mapping Types of Information and Information Systems to Security Categories [NIST

SP 800-60]

13. Computer Security Incident Handling Guide [NIST SP 800-61]

14. Security Considerations in the System Development Life Cycle [NIST SP 800-64]

15. Technical Guide to Information Security Testing and Assessment [NIST SP 800-115]

16. Guide for Security-Focused Configuration Management of Information Systems [NIST SP 800-

128]

RFP 49100419R1001 Page 4 of 17

17. Information Security Continuous Monitoring for Federal Information Systems and Organizations

[NIST SP 800-137]

18. Supply Chain Risk Management Practices for Federal Information Systems and Organizations

[NIST SP 800-161]

19. Framework for Improving Critical Infrastructure Cybersecurity [NIST Cybersecurity Framework

1.1, April 16, 2018]

NSF Policies (NSF Policies are available through the Contracting Officer)

1. NSF Manual 7, "Information Security Handbook"

2. NSF Manual 14, "Personnel Manual (PER)"

3. NSF Bulletin 13-09 Onboarding and Separation Policy for Contractors

4. NSF Bulletin 18-07 Mobile Communications Devices

5. NSF Policy Regarding the Privacy of Sensitive Information

6. NSF Privacy Impact Assessment Policy

7. NSF Privacy Impact Assessment Guide and Template

8. NSF Privacy Threshold Analysis Guide and Template

9. NSF Privacy Breach Plan

10. NSF Computer Security Incident Response and Recovery Procedure

11. Information Security and Privacy Continuous Monitoring Program

1. General

a. Policy Compliance - All Contractor personnel performing under this contract and requiring access to NSF information systems, networks, or data must comply with all Federal

Information Security Modernization Act (FISMA), Office of Management and Budget

(OMB), Homeland Security Presidential Directive 12 (HSPD-12), National Institute of

Standards and Technology (NIST) and NSF IT security and privacy policies, procedures and guidance.

b. Compliance with Onboarding and Separation Procedures - The Contractor is responsible for its employees’ conduct and establishing in- and out-processing procedures that ensure accomplishment of the actions identified in this clause.

c. Contractor Self-Identification - In accordance with requirements set forth in the Federal

Acquisition Regulation (FAR) and guidance issued by OMB, all Contractor personnel attending meetings, interacting with NSF staff to complete work assignments, and working in other situations where their Contractor status is not obvious to third parties or internal agency staff, are required to identify themselves as Contractor employees, including email signature blocks and voicemail. Contractors interacting with Government staff or the public for purely administrative functions, such as for forwarding telephone calls, may be exempted from this self-identification requirement.

d. Expiration of Contract - Contractor personnel access to NSF facilities for work performance will be revoked upon expiration of this contract or task orders issued hereunder.

e. Incorporation in Subcontracts - The Contractor shall incorporate the substance of this clause in all subcontracts.

2. Personnel Onboarding

a. Federal Identity Card - Contractor personnel assigned to work at NSF facilities shall be issued a Personal Identity Verification (PIV) card that permits their entrance to NSF facilities without going through visitor access processes. Contractor personnel may also be granted

RFP 49100419R1001 Page 5 of 17 certain other privileges such as NSF email accounts and/or access to NSF information systems. This access shall be provided solely at the discretion of the NSF, and may be revoked or withdrawn at any time, without notice or cause, by the Contracting Officer.

b. Background Investigation - Contractor personnel requiring routine physical access to NSF facilities for more than six months require a Personal Identity Verification (PIV) or Personal

Identity Verification Interoperability (PIV-I) and shall be investigated (i.e., a Tier 1 or higher-level investigation). Contractor personnel requiring access to systems operated by a

Contractor for the NSF or interconnected to a NSF network shall be investigated at an appropriate level. The Contractor shall not work on the contract until a favorable determination is granted. The FBI National Criminal History Check must be completed, and the investigation must be scheduled by the Office of Personnel Management (OPM) before the cards are issued. NSF shall submit the Tier 1 (or higher level) investigation to OPM using the standard personnel investigation forms listed in this clause. Contractors are required to report to the Division of Administrative Services (DAS) ID Card office during business hours to be electronically fingerprinted, inputted into the online Electronic

Questionnaire for Investigations Processing (eQIP) system and provide other required documents to begin the investigations process. The Contractor shall submit the required forms to the NSF Personnel Security Office within five (5) days after award or assignment of an individual to a position requiring investigation.

c. Level of Investigation - Guidance for selecting the appropriate level of investigation is based on the risk of adverse impact to the NSF. The levels of risk for which investigation is required is as follows (IT-1 has the highest level of risk):

i. IT-1: Individuals having privileged access or limited privileged access to systems whose misuse can cause very serious adverse impact to NSF systems and programs.

ii. IT-2: Individuals having privileged access or limited privileged access to systems whose misuse can cause significant adverse impact to NSF programs. These systems include, for example, those that interconnect with a NSF network in a way that exceeds access by the general public, such as bypassing firewalls; and systems operated by a Contractor for NSF whose function or data has substantial cost to replace, even if these systems are not interconnected with a NSF network.

d. Required Forms - Investigation for individuals shall employ forms appropriate for the level of risk as follows:

i. IT-1: Electronic fingerprints, online Standard Form (SF) 85 Questionnaire for Non-

Sensitive Positions, Official Form (OF) 306 Declaration for Federal Employment, Credit Report Notice Form and resume.

ii. IT-2: Electronic fingerprints, Electronic and Standard Form (SF) 85P Questionnaire for Public Trust Positions, Official Form (OF) 306 Declaration for Federal

Employment, Credit Report Notice Form and resume.

e. Proof of Investigation - Investigation of Contractor personnel may be waived by the

Personnel Security Office for individuals in cases where proof of prior investigation at the

Tier 1, 2 or higher level within the last two years can be obtained.

f. Records Management Training – The Contractor shall ensure that its employees, in the performance of the contract, receive Records Management Training as it is made available in the learning management system.

RFP 49100419R1001 Page 6 of 17

g. IT Security and Privacy Awareness Training - The Contractor shall ensure that its employees, in performance of the contract, receive initial IT Security and Privacy Awareness Training before being granted access to NSF systems and networks, and receive refresher IT Security and Privacy Awareness Training annually. The Contractor may use web-based training available from the NSF to meet this requirement.

h. Rules of Behavior - The Contractor shall ensure that its employees, in performance of the contract, sign and submit the “National Science Foundation (NSF) IT Security and Privacy

Awareness Training Rules of Behavior” before receiving access to NSF systems and networks. Additionally, the Rules of Behavior will be signed and submitted annually at the completion of the IT Security and Privacy Awareness Training referenced in 2.g. above.

i. Employee and Contractor Separation - At any time during the term of this contract or task orders issued hereunder, Contractor personnel issued a Personal Identity Verification (PIV) card, or granted access to NSF email or any other NSF information system, that do not require any further access, and/or at completion, expiration or termination of any such contract or task order where access has been granted, SHALL;

i. Complete and submit the online Contractor/Guest Exit Form, which will result in termination of all access to any NSF email accounts and information systems.

ii. Report to the lobby floor visitor center to identify themselves to the personnel present and surrender their Personal Identity Verification (PIV).

iii. Notify the Contracting Officer Representative (COR) and appropriate Property

Custodian of any NSF equipment or information to be surrendered to NSF.

3. Access Controls for NSF Systems and Information - The Contractor shall be responsible for

Information Technology security for all systems used in performance of this contract, or those which are connected to a NSF network. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor must have physical or electronic access to NSF’s information, including sensitive information and personally identifiable information, contained in unclassified systems that directly support the mission of the Agency. The access includes information technology, hardware, software, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

4. Remote Access – The Contractor may have the need to access NSF information systems remotely.

The Contractor will remotely access NSF systems only through approved mechanisms. All remote access sessions will be encrypted using NSF services to protect NSF data.

5. Protection of Sensitive and Personally Identifiable Information (PII) - NSF's privacy program includes policies, plans, training, and technical safeguards to protect sensitive information, which includes Personally Identifiable Information (PII). NSF recognizes the importance of protecting sensitive information and implements policy, guidance, and best practices to safeguard information from inappropriate access, use, or disclosure.

a. Information Types - The term, Information, is synonymous with Data, regardless of format or medium. PII is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

RFP 49100419R1001 Page 7 of 17

i. Sensitive Information - Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data are compromised. Some categories of sensitive information include financial, medical or health, legal, strategic and business, human resources, PII and sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

ii. Personally Identifiable Information (PII) - PII, as defined in OMB Memorandum M-

07-16 Safeguarding Against and Responding to the Breach of Personally Identifiable

Information, refers to information that can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc., either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information that is publicly available — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name or an email address because these pieces of information uniquely identify an individual, but alone may not constitute Sensitive PII.

iii. Sensitive PII - Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), are also considered Sensitive PII. The context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or compliant.

b. Access to Information - While performing official duties, Contractors may have the need to access sensitive information or PII. Sensitive information includes proposal reviews, reviewer identity tied to specific reviews or panels, unfunded proposals, proprietary parts of funded proposals; and other similar information. Most of the sensitive information maintained by NSF falls within Privacy Act systems of records, which places disclosure restrictions on NSF and provides access rights to individuals. Sensitive information may also exist in other types of records, such as databases, log files, email, and correspondence files.

All Contractor personnel are responsible for recognizing sensitive information and avoiding inappropriate or accidental access, use, or disclosure in accordance with Privacy Act and

NSF IT security and privacy policies.

c. Responsibility to Identify and Protect PII - All Contractor personnel are responsible for recognizing Personally Identifiable Information and avoiding inappropriate or accidental access, use, or disclosure in accordance with NSF IT policies.

RFP 49100419R1001 Page 8 of 17

d. Information Use - The Contractor must not use or redistribute any NSF information processed, stored, or transmitted by the Contractor except as specified in the Contract.

e. NSF Privacy Program and PII - PII may be in the scope of the acquisition and PII may be stored, processed, or transmitted in the Contractor's information system. The collection, maintenance or dissemination of any PII that is subject to the Privacy Act and/or the E-

Government Act will be handled in full accordance with all NSF rules of behavior and in accordance with NSF Privacy Program requirements. The Contractor shall ensure that any

PII stored on any Contractor system as a function of the contract is encrypted in accordance with NSF policy.

f. PII Guidelines - PII (should it come into scope) will require the following guidelines be adhered to.

i. The Contractor’s information system must be authorized at least at the FIPS PUB 199

Moderate level.

ii. For any system that collects, maintains or disseminates PII, a Privacy Threshold

Analysis (PTA) and Privacy Impact Assessment (PIA) must be completed by the contractor and provided to the NSF Privacy Office

(https://www.nsf.gov/policies/privacy.jsp) for review along with the other authorization to operate (ATO) documents.

iii. If the system retrieves information using name or personal identifier, the Office of

General Counsel should be consulted to make a determination as to whether the

Privacy Act applies and whether a System of Records Notice (SORN) is in place.

iv. If a data collection involves Privacy Act protected information, a Privacy Act

Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act

Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

g. Privacy Training - All Contractor staff who have significant privacy information responsibilities must complete NSF's IT Security and Privacy Awareness Training. This includes contractors who work with PII as part of their work duties (e.g. Human Resource staff, Finance staff, and managers/supervisors).

6. Systems and Information Integrity

a. Vulnerability Management - If access, including remote access, is through a Contractor-managed system, the Contractor is responsible for IT security patching and maintenance of the system. NSF is responsible for security and patching of NSF managed devices, including

Contractor devices if they have a NSF image, when the Contractor device is connected to the

NSF network.

b. NSF Configuration Baseline - The Contractor shall certify applications are fully functional and operate correctly as intended on systems using the established NSF configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software, including software purchased under this Agreement, shall not alter the configuration settings from the approved established NSF configuration baseline configuration. Offerings that require installation should follow OMB M-07-18, Ensuring New

Acquisitions Include Common Security Configurations. Applications designed for normal

RFP 49100419R1001 Page 9 of 17 end users shall run in the standard user context without elevated system administration privileges. The Contractor shall use Security Content Automation Protocol (SCAP) validated tools with established NSF configuration baseline scanner capability to certify their products operate correctly with established NSF configuration baseline settings and do not alter established NSF configuration baselines.

c. Mobile Devices – Personally owned mobile devices are permitted to connect to NSF IT resources and services (such as email, calendar, contacts, etc.). If the Contractor wishes to use a personally owned mobile device, the device must first be enrolled in Mobile Device

Services (MDS). Use of personally owned mobile devices must be in accordance with the

NSF MDS Terms of Use and enrollment guides

7. Continuous Monitoring and Ongoing Authorization

a. Security Assessment and Authorization (A&A)

i. Major Applications - For Information Systems NSF has identified as Major

Applications or General Support Systems (GSS) that are not connected to a NSF network, but for which the Contractor has operational responsibility on behalf of

NSF, the Contractor must conform to all NSF policy guidance and reporting requirements regarding Assessment and Authorization (A&A) of IT systems. NSF shall perform all the assessment activities as outlined in NIST SP 800-37, while the

Contractor will provide full support and documentation to NSF for this effort. Unless otherwise specified by NSF, NSF shall fulfill the roles of “Senior Agency

Information Security Officer" (or "Chief Information Security Officer”) and

“Authorizing Official” as outlined in NIST SP 800-37 Appendix D. For all

Contractor Operated systems, NSF shall establish accreditation boundaries and assessment schedules.

ii. Timeline - The A&A activities will be done prior to service commencement (go-live into Production) and periodically thereafter as required by Federal or NSF policies.

This is currently every three years or according to ongoing authorization plans unless there is a major change.

b. Continuous Monitoring – Continuous monitoring is an important activity of NSF’s IT

Security and Privacy Program. Continuous monitoring assures NSF infrastructure and information assets are protected while maintaining an open and collaborative environment for scientific research and discovery. NSF’s Information Security Continuous Monitoring

(ISCM) program contributes to NSF’s Enterprise Risk Management approach, which is charged to develop, mitigate, and manage significant risks to NSF.

ISCM activities incorporate compliance with the Federal Information Security Modernization

Act (FISMA) and ongoing operational security for a system throughout its lifecycle. NSF’s continuous monitoring approach assesses the security state of information systems based on

FISMA security requirements and National Institute for Standards and Technology (NIST) guidance.

c. Cloud Services – If cloud services are used to support NSF, the Contractor shall implement the controls contained within the Federal Risk and Authorization Management Program

(FedRAMP) Cloud Computing Security Requirements Baseline and FedRAMP Continuous

Monitoring Requirements for Low and Moderate impact systems (as defined in FIPS PUB

199). FedRAMP documents define requirements for compliance to meet minimum Federal

RFP 49100419R1001 Page 10 of 17 information security and privacy requirements for Low or Moderate impact systems. The

FedRAMP baseline controls are based on NIST Special Publication 800-53 Security and

Privacy Controls for Federal Information Systems and Organizations and includes a set of additional controls for use within systems providing cloud services to the federal government.

The Contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and security guidance. In situations where there are no procedural guides, the Contractor shall use generally accepted industry best practices for IT security.

d. Risk Management – NSF manages enterprise information security and privacy risk in compliance with NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View and the Framework for Improving Critical

Infrastructure Cybersecurity (the Framework). The Framework encourages agencies to operate within an implementation tier that includes formally approved policies and procedures, an integrated risk management program, and collaboration and partnership with external parties to develop, maintain, and enhance a holistic cybersecurity environment. NSF uses the Framework's adaptive process to identify and respond to cybersecurity risk.

NSF monitoring activities are based on NIST Special Publication (SP) 800-37. Risk

Management Framework for Information Systems and Organizations: A System Life Cycle

Approach for Security and Privacy. The risk management framework process emphasizes the continuous monitoring of information systems through enhanced monitoring and providing essential information for risk-based decisions.

NSF leverages the Department of Homeland Security (DHS) Continuous Diagnostics and

Mitigation (CDM) Program to augment NSF’s capabilities for automated control monitoring.

The DHS CDM program improves NSF’s ability to implement a more robust continuous monitoring program and response to risks and emerging cyber threats.

The Contractor shall apply appropriate techniques to manage and mitigate risk during the acquisition, implementation, and operation of information technology at NSF. The techniques include but are not limited to: prudent project management; continuous collection and evaluation of risk-based assessment data; prototyping prior to implementation; post implementation reviews; and focusing on risks and returns using quantifiable measurements.

e. Supply Chain Risk Management – Supply chain risk means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of an information system (as that term is defined at 44 U.S.C. 3542(b)) so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system.

i. The Contractor shall provide information system(s) in compliance with the annual

Consolidated and Further Continuing Appropriations Act regarding the acquisition of high impact or moderate impact systems in effect at the time of award.

ii. The Contractor shall mitigate supply chain risk in the provision of supplies and services to the Government.

iii. The Contractor shall maintain threat awareness while supplying the Government with products and services.

RFP 49100419R1001 Page 11 of 17

iv. The Contractor products and services shall comply with industry standard development and engineering principles to ensure security requirements are incorporated throughout the development and delivery process.

v. The Contractor shall incorporate secure configuration in products and services that are consistent with organizational risk management.

8. Cooperation with Audits

a. Contractor Cooperation - The Contractor (and subcontractors) shall fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the

Contracting Officer or the Chief Information Security Officer or designated representative including the IT Security Officer. Full cooperation includes, but is not limited to, prompt disclosure to authorized requestors of information sufficient to identify the nature and extent of any computer security incident, including a breach of sensitive information or personally identifiable information and the individuals responsible for such activity. The Contractor’s

(and any subcontractors’) cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government.

b. Government Data and Records - The Contractor (or subcontractor) shall timely produce to the

Contracting Officer, a Contracting Officer’s Representative (COR), or the Chief Information

Security Officer, Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the

Senior Agency Information Security Officer (or Chief Information Security Officer) is involved. Requests for production under this paragraph shall specify a reasonable deadline for compliance which will presumptively determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

9. Incident Response

a. Notification - In the event of any violation or computer security incident, the Contractor shall promptly notify the Chief Information Security Officer or the agency IT Security Officer.

b. Incident Data Preservation - In the event of any suspected violation of Federal laws and regulations such as illegal activity, computer security incidents, violations of Agency policy, malicious or otherwise prohibited use, (as defined in NIST Special Publication 800-61, Computer Security Incident Handling Guide), including but not limited to those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or subcontractor), or to the function of information systems operated by the Contractor (or subcontractor) in the performance of this contract, the Contractor (or subcontractor) shall preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of the computer security incident.

c. Notification to Inspector General - If an incident is determined to be actual or suspected criminal activity, the Chief Information Security Officer will make the determination to notify the agency’s Office of the Inspector General (OIG).

(End of Clause)

4. Append L, Summit Station Systems 2018 is hereby added as attached.

RFP 49100419R1001 Page 12 of 17

5. Sub-section L.14.1 is hereby revised as follows (changes in bold):

L.14 VOLUME III – PAST PERFORMANCE

L.14.1 Each Offeror shall submit a past performance volume which identifies their contracts with recent and relevant performance. Contract is defined under FAR sub-part 2.101.

L.14.1.1 Recency is defined as performing within the previous three (3) years from the initial date the RFP is posted to fbo.gov.

L.14.1.2 Relevancy is focused on how relevant a recent effort accomplished by the offeror is to the effort to be acquired through the source selection. The criteria used to establish what prior performance is relevant for this acquisition is defined as recent past performance which exhibits:

similar program complexity; similar dollar value; similar contract type; similar scope; same division of company doing the work; and same subcontractor. Past performance information may include data on efforts performed by other divisions, corporate management, and subcontractors or teaming contractors, if such information is relevant to the subject acquisition and may be an indicator of performance under the proposed effort.

L.14.2 The Offeror shall identify and highlight a maximum total of three (3) contracts which are the most relevant and meet the recency definition. The Offeror shall demonstrate that the work under each of the respective three (3) contracts is directly relevant to this requirement. In addition to the respective most relevant contracts, the Offeror shall demonstrate how the work under all other recent contracts meets the recency definition and is directly relevant to this requirement.

L.14.3 The Government reserves the right to contact the Offeror’s references and any other parties in order to verify and obtain performance information.

L.14.4 In the evaluation of Past Performance, the Government may also evaluate past performance information obtained from reliable sources such as an official past performance database and/or other Government and local agency contacts.

L.14.5 For the recent and relevant past performance references, Offerors are strongly cautioned that inability of the Government to contact past performance references directly, including but not limited to those associated to any survey; or, in the case past performance information is not entered into the Contract Performance Assessment Reporting System (CPARS) database, the Offeror will not be evaluated favorably or unfavorably on past performance, which is otherwise known as a neutral rating.

L.14.6 The Offeror shall provide a Contractor Performance Assessment Report

(CPAR) or Past Performance Survey for the most relevant contracts (maximum of three) identified under L.14.2 above. Only in the event CPARS information is not available will an Offeror be allowed to substitute a Past Performance Survey.

L.14.7 Past Performance for the Most Relevant as Identified under L.14.2

(Maximum of three) ((CPARS) information exists)

If the Government has an interim or final Contractor Performance Assessment Report (CPAR) in

CPARS for any of the most relevant contracts (maximum of three) identified under L.14.2 above, the Offeror shall provide a copy of the entire CPAR with their proposal. The Government

RFP 49100419R1001 Page 13 of 17 will retrieve past performance information from the CPARS database to validate the Offeror’s submission. For the purposes of this solicitation, the final past performance information will be used for relevant past performance reference. If a final rating is not available, the most current past performance information will be used. Offerors are responsible for verifying whether a CPAR exists in the CPARS database prior to using Past Performance Surveys.

L.14.8 Past Performance for the Most Relevant as Identified under L.14.2

(Maximum of three) ((CPARS) information does NOT exist)

For the most relevant contracts (maximum of three) identified under L.14.2, if the Government has not finalized an interim or final CPAR in the CPARS database; if the past performance experience was not as a prime contractor; or, if the past performance reference(s) are considered

Non-U.S. Federal or commercial projects; the Offeror shall submit a certified Past Performance

Survey using the template in Attachment L-1, “Past Performance Survey”. No other format or additional proposal documentation will be considered.

In addition, the Offeror shall provide the following information for each past performance reference provided under this sub-section L.14.8:

a) Offeror’s or subcontractor’s Company/Division Name/Business Unit performing the work;

b) Program Title;

c) Address of the Government agency (Federal, state or local), contracting activity or company name;

d) Contract/subcontract number;

e) Contract type;

f) Original contract dollar value and current contract dollar value, and a brief description for any difference;

g) Current status of the contract or subcontract (i.e., in-progress, completed);

h) Final amount invoiced (if completed) or amount invoiced to date (if on-going);

i) Date of contract or subcontract and period of performance (including option periods, if applicable);

j) Name, mailing address, e-mail address, and telephone number of the following contract references:

i. CO (or company business manager) or Administrative CO, and

ii. COTR (or lead federal technical point of contact or company principal technical point of contact).

k) A brief description of the contract or subcontract effort and the services performed;

l) State performance responsibility as either prime contractor or subcontractor;

m) Description of contract or subcontract work and relevancy to the subject RFP requirements;

n) Description of problems or obstacles encountered on the contract and corrective actions taken to resolve the problems or obstacles;

o) Descriptions, at a minimum, shall address the following:

i. Quality of Product or Service - compliance with contract requirements, accuracy of reports, technical excellence; satisfaction of end users with contractor’s service or recommended solutions.

ii. Cost Control - performing within original approved budget without the need for additional funds

[except for augmentation of work]; current, accurate and complete billings; relationship of negotiated to actual costs; and cost efficiencies.

iii. Timeliness of Performance - meeting interim milestones, reliability, responsiveness to technical direction, and on-time completion.

iv. Business Relations - effective contract administration.

RFP 49100419R1001 Page 14 of 17

Using the Past Performance Survey in Attachment L-1, the Offeror shall provide the survey directly to each of the references. For prime contracts, the Past Performance Survey must be completed and signed by a Warranted Contracting Officer with cognizance over the submitted project. For a Non-federal government or commercial project, the Past Performance Rating Survey must be completed and signed by a Corporate Officer of the firm with cognizance over the submitted project. For a subcontract, the Past Performance Survey must be completed and signed by a Corporate

Officer of the firm with cognizance over the submitted project.

The Offeror shall instruct each rater to send a completed Past Performance Survey directly back to the

Offeror. If the rater may not be able to submit and deliver a Past Performance Survey to the Offeror, in time to submit their proposal before the due date, the Offeror shall instruct the rater to copy the contracting officer (joscloft@nsf.gov) when submitting. Offerors are solely responsible for providing

Past Performance Surveys with their proposal and copying the contracting officer before the solicitation due date/time. Under the Past Performance Volume, the Offeror shall document which completed Past Performance Surveys are included with their proposal and which Past Performance

Surveys are expected to be completed and submitted directly to the NSF.

The Offeror must follow up with each rater to ensure the Past Performance Surveys were received and included in the proposal or submitted to the contracting officer prior to the proposal closing date. The Government reserves the right to consider Past Performance Surveys received by the contracting officer after the proposal closing date.

In the event the evaluation team discovers misleading, falsified, and/or fraudulent past performance ratings, an Offeror shall be eliminated from further consideration for award. Falsification of any proposal submission, documents, or statements may subject the Offeror to civil or criminal prosecution under Section 1001 of Title 18 of the United States Code.

6. Sub-section L.15.4.6 entitled “Other Direct Costs” is hereby added as follows:

Under Attachment L-2, the Government provided surrogate (AKA: plug) amounts for Other Direct

Costs. Each Offeror shall enter the surrogate ODC amounts under their cost proposal. The surrogate

ODC amounts shall not be revised lower. If an Offeror proposes additional ODC costs, the Offeror shall provide justification and fair and reasonable price documentation for the proposed additional

ODC costs. Proposed additional ODC justifications shall include an explanation of why the proposed

ODCs are in the best interest of the Government. Each proposed additional ODC shall be entered under a line item of the Attachment L-2 ODC worksheet. Offerors shall not enter unit type, unit quantities and/or unit costs for surrogate ODC line items.

7. Sub-section L.15.4.7 entitled “Utqiaġvik Costs” is hereby added as follows:

Under Attachment L-2, the Government provided surrogate (AKA: plug) amounts for Utqiaġvik labor costs which may be provided by UIC. Each Offeror shall enter the surrogate Utqiaġvik labor costs under their cost proposal. The surrogate Utqiaġvik labor costs shall not be revised lower. If an Offeror proposes additional Utqiaġvik labor costs, the Offeror shall provide justification and fair and reasonable price documentation for the proposed additional Utqiaġvik labor costs. Proposed additional Utqiaġvik labor costs justifications shall include an explanation for why the proposed

Utqiaġvik labor costs are in the best interest of the Government. Offerors shall not revise unit quantities and/or enter direct labor rates for surrogate Utqiaġvik labor costs.

RFP 49100419R1001 Page 15 of 17

8. Attachment L-2 entitled “Prime Offeror Cost/Price Worksheet Rev. 1” is hereby deleted in its entirety and Attachment L-2 entitled “Prime Offeror Cost/Price Worksheet Rev. 2” is hereby added as attached;

9. Attachment L-9, entitled “Amendment 0005 Questions/Comments and Responses” is hereby added as attached;

10. Sub-section M.7.1 is hereby revised as follows (changes in bold):

M.7.1 The Government will evaluate “past performance information” as defined at

FAR 42.1501 and consistent with FAR 15.305(a)(2). The Past Performance evaluation will examine how the Offeror’s past and present performance validates anticipated future performance relating to the following areas:

a) Quality of Product or Service - compliance with procurement contract requirements, accuracy of reports, technical excellence; satisfaction of end users with contractor’s service or recommended solutions.

b) Cost Control - performing within original approved budget without the need for additional funds

[except for augmentation of work]; current, accurate and complete billings; relationship of negotiated to actual costs; and cost efficiencies.

c) Timeliness of Performance - meeting interim milestones, reliability, responsiveness to technical direction, and on time completion.

d) Business Relations - effective administration of award.

The Government will assess the past performance information gathered from all available sources for recency and relevancy (see Section L of the solicitation for the definitions of recency and relevancy).

Information utilized will be obtained from the references listed in the proposal, the Past Performance

Surveys submitted for the Offeror, and may also be obtained from other sources known to the

Government.

11. Sub-section M.7.4 is hereby deleted in its entirety.

12. Sub-section M.8.7 is hereby added as follows:

M.8.7 Surrogate Other Direct Costs. Offers with proposed other direct costs that are lower than the Government surrogate (AKA: plug) other direct costs, may be considered incomplete and non-responsive, rendering the prime’s proposal ineligible for award. Deviations above the surrogate other direct costs will be evaluated to determine if the respective deviation(s) matches the respective technical proposal. When evaluating cost realism, the Government may make reasonable adjustments to total proposed estimated cost if proposed deviations from surrogate other direct costs are determined inadequate for the SOW and/or proposed technical approach.

13. Sub-section M.8.8 is hereby added as follows:

M.8.8 Surrogate Utqiaġvik Costs. Offers with proposed Utqiaġvik labor costs that are lower than the…