49100424Q0097.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

49100424Q0097 07-11-2024

Jonathan Schmeelk jschmeel@nsf.gov 07-25-2024

5:00PM EDT

National Science Foundation

Div. of Acq. & Cooperative Support

2415 Eisenhower Ave.

Alexandria VA 22314

X 100

X

541611

$24.5 Million

N/A

X

DACS

National Science Foundation

Div. of Acq. & Cooperative Support

DFM, Phone: (703) 292-8280

Commercial Cash Management

See CONTINUATION Page

Request for Quotation - NSF Strategic Plan Requirement

This is a GSA Schedule RFQ under NAICS 541611, issued as a 100% small business set-aside.

See continuation pages and attached for NSF clauses and statement of work.

The expected period of performance will be 12 months, however quotes are requested to incorporate an additional 3-month

Optional quantity to allow for extended support should the

Need arise.

See CONTINUATION Page

X X

Jonathan Schmeelk

49100424Q0097 Section D

SECTION B - CONTINUATION BLOCK

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0.00

Base Period Labor - Firm Fixed Price

Contract Period: Base

POP Begin: 09-02-2024

POP End: 09-01-2025

1.00 EA $20,000.00 $20,000.00

Base Period Travel - Time and Materials

Contract Period: Base

POP Begin: 09-02-2024

POP End: 09-01-2025

0.00

Option Period Labor - Firm Fixed Price

Contract Period: Option 1

POP Begin: 09-02-2025

POP End: 12-01-2025

1.00 EA $5,000.00 $5,000.00

Option Period Travel - Time and Materials

Contract Period: Base

POP Begin: 09-02-2025

POP End: 12-01-2025

GRAND

TOTAL

SECTION C - CONTRACT CLAUSES

C.1 FSS RFQ INTRODUCTORY LANGUAGE

The terms and conditions of the contractor's FSS contract (including any contract modifications) apply to all Blanket Purchase Agreements (BPA) and task or delivery orders issued under the contract as a result of this RFQ. When a lower price has been established, or when the delivery terms, FOB terms, or ordering requirements have been modified by the BPA or task/delivery order, those modified terms will apply to all purchases made pursuant to it and take precedence over the FSS contract. Any unique terms and conditions of a BPA or order issued under the contract that are not a part of the applicable FSS contract will govern. In the event of an inconsistency between the terms and conditions of a BPA or task/delivery order and the Contractor's FSS terms, other than those identified above, the terms of the FSS contract will take precedence.

C.2 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR

2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 5 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 15 days days before the contract expires. The preliminary notice does not commit the

Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 15 Months.

C.3 NSF020 AUTHORITY OF GOVERNMENT PERSONNEL (APR 2013)

Contracting Officer

The Contracting Officer (CO) is the only person authorized to approve changes in any of the requirements under this contract. Notwithstanding any clause contained elsewhere in this contract, the said authority remains solely with the CO.

In the event the Contractor effects any change at the direction of any person other than the CO, including any change beyond the scope of authority given to the duly authorized Contracting Officer's

Representative identified in the contract, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The CO has the authority to perform any and all post-award functions in administering and enforcing this contract in accordance with its terms and conditions.

Contracting Officer's Representative

The Contracting Officer's Representative (COR) is responsible for administering the performance of work under this contract. IN NO EVENT, however, will any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the

Government unless formalized by proper contractual documents executed by the CO prior to completion of the contract.

The COR may give technical direction to the Contractor that fills in details, requires pursuit of certain lines of inquiry, or otherwise serves to facilitate the Contractor's compliance with the contract. To be valid, technical direction by the COR must be consistent with the general scope of work set forth in this contract; may not constitute new assignment of work nor change the expressed terms, conditions or specifications of this contract; and shall not constitute a basis for any increase in the contract estimated cost, or extension to the contract delivery schedule.

C.4 NSF030 SECURITY REQUIREMENTS AND ACCESS TO NATIONAL

SCIENCE FOUNDATION FACILITIES AND UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (MAY 2021)

Applicable Laws and Regulations

1. Records Management by Federal Agencies [44 USC 31]

2. Privacy Act of 1974 as amended [5 USC 552a]

3. Federal Information Security Modernization Act (FISMA) of 2014 [Title III, PL 113-283]

4. Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification

Standard for Federal Employees and Contractors”

5. Presidential Policy Directive 21 (PPD-21), "Critical Infrastructure Security and Resilience"

6. Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act

[OMB Circular A-108, as amended]

7. Management's Responsibility for Enterprise Risk Management and Internal Control [OMB Circular

A-123, Revised 7/15/2016]

8. Managing Information as a Strategic Resource [OMB Circular A-130, revised 7/28/2016]

9. Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB M-01-05]

10. Safeguarding Against and Responding to the Breach of Personally Identifiable Information [OMB

M-07-16]

11. Ensuring New Acquisitions Include Common Security Configurations [OMB M-07-18]

12. Completing the Transition to Internet Protocol Version 6 (IPv6) [OMB M-21-07]

13. Controlled Unclassified Information [CFR 2002]

Applicable Standards and Guidance

1. Security Requirements for Cryptographic Modules [FIPS Publication 140-3]

2. Standards for Security Categorization of Federal Information and Information Systems [FIPS

Publication 199]

3. Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication

200]

4. Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-2]

5. Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18]

6. Guide for Conducting Risk Assessments [NIST SP 800-30]

7. Contingency Planning Guide for Federal Information Systems [NIST SP 800-34]

8. Risk Management Framework for Information Systems and Organizations: A System Life Cycle

Approach for Security and Privacy [NIST SP 800-37]

9. Managing Information Security Risk: Organization, Mission, and Information System View [NIST SP

800-39]

10. Security and Privacy Controls for Information Systems and Organizations [NIST SP 800-53]

11. Control Baselines for Information Systems and Organizations [NIST SP 800-53B]

12. Guide for Mapping Types of Information and Information Systems to Security Categories [NIST SP

800-60]

13. Computer Security Incident Handling Guide [NIST SP 800-61]

14. Security Considerations in the System Development Life Cycle [NIST SP 800-64]

15. Technical Guide to Information Security Testing and Assessment [NIST SP 800-115]

16. Guide for Security-Focused Configuration Management of Information Systems [NIST SP 800-128]

17. Information Security Continuous Monitoring for Federal Information Systems and Organizations

[NIST SP 800-137]

18. Supply Chain Risk Management Practices for Federal Information Systems and Organizations [NIST

SP 800-161]

19. Framework for Improving Critical Infrastructure Cybersecurity [NIST Cybersecurity Framework

1.1, April 16, 2018]

20. Advanced Encryption Standard [FIPS 197]

21. Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations [NIST SP

800-171R2]

NSF Policies (NSF Policies are available through the Contracting Officer)

1. NSF Manual 7, "Information Security Handbook"

2. NSF Personnel (PER) Manual

3. NSF Bulletin 13-09 Onboarding and Separation Policy for Contractors

4. NSF Bulletin 19-14 Mobile Communications Devices

5. NSF Policy Regarding the Privacy of Sensitive Information

6. NSF Privacy Impact Assessment Policy

7. NSF Privacy Impact Assessment Guide and Template

8. NSF Privacy Threshold Analysis Guide and Template

9. NSF Privacy Breach Plan

10. NSF Computer Security Incident Response and Recovery Procedure

11. Information Security and Privacy Continuous Monitoring Program

1. General

a. Policy Compliance - All Contractor personnel performing under this contract and requiring access to

NSF information systems, networks, or information must comply with all Federal Information Security

Modernization Act (FISMA), Office of Management and Budget (OMB), Homeland Security Presidential

Directive 12 (HSPD-12), National Institute of Standards and Technology (NIST) and NSF IT security and privacy policies, procedures and guidance.

b. Compliance with Onboarding and Separation Procedures - The Contractor is responsible for its employees’ conduct and establishing in- and out-processing procedures that ensure accomplishment of the actions identified in this clause.

c. Contractor Self-Identification - In accordance with requirements set forth in the Federal Acquisition

Regulation (FAR) and guidance issued by OMB, all Contractor personnel attending meetings, interacting with NSF staff to complete work assignments, and working in other situations where their Contractor status is not obvious to third parties or internal agency staff, are required to identify themselves as

Contractor employees, including email signature blocks and voicemail. Contractors interacting with

Government staff or the public for purely administrative functions, such as for forwarding telephone calls, may be exempted from this self-identification requirement.

d. Expiration of Contract - Contractor personnel access to NSF facilities for work performance will be revoked upon expiration of this contract or task orders issued hereunder.

e. Incorporation in Subcontracts - The Contractor shall incorporate the substance of this clause in all subcontracts.

2. Personnel Onboarding

a. Federal Identity Card - Contractor personnel assigned to work at NSF facilities shall be issued a

Personal Identity Verification (PIV) card that permits their entrance to NSF facilities without going through visitor access processes. Contractor personnel may also be granted certain other privileges such as NSF email accounts and/or access to NSF information systems. This access shall be provided solely at the discretion of NSF, and may be revoked or withdrawn at any time, without notice or cause, by the

Contracting Officer.

b. Background Investigation - Contractor personnel requiring access to systems operated by a Contractor for the NSF or interconnected to an NSF network, or requiring access to NSF information shall be investigated at an appropriate level. The Contractor shall not work on the contract until a favorable determination is granted. The FBI National Criminal History Check must be completed, and the investigation must be released to the Defense Counterintelligence and Security Agency (DCSA) before the cards are issued. NSF shall submit the Tier 1 (or higher level) investigation to DCSA using the standard personnel investigation forms listed in this clause, see 2.d. Required Forms. Contractors are required to report to the Division of Administrative Services (DAS) ID Card office during business hours to be electronically fingerprinted, inputted into the online Electronic Questionnaire for Investigations

Processing (eQIP) system and provide other required documents to begin the investigations process. The

Contractor shall submit the required forms to the NSF Personnel Security Office within five (5) days after award or assignment of an individual to a position requiring investigation.

c. Level of Investigation - Guidance for selecting the appropriate level of investigation is based on the risk of adverse impact to the NSF. The levels of risk for which investigation is required is determined by the DCSA Position Designation Record (PDR) tool. For example, IT positions typically result in a Tier 1 or Tier 2 investigation level.

i. DCSA Tier 1: Individuals having privileged access or limited privileged access to systems whose misuse can cause significant adverse impact to NSF programs. These systems include, for example, those that interconnect with a NSF network in a way that exceeds access by the general public, such as bypassing firewalls; and systems operated by a Contractor for NSF whose function, data, or information has substantial cost to replace, even if these systems are not interconnected with an NSF network.

ii. DCSA Tier 2: Individuals having privileged access or limited privileged access to systems whose misuse can cause very serious adverse impact to NSF systems and programs.

d. Required Forms - Investigation for individuals shall employ forms appropriate for the level of risk as follows:

i. DCSA Tier 1: Electronic fingerprints, online Standard Form (SF) 85 Questionnaire for Non-

Sensitive Positions, Official Form (OF) 306 Declaration for Federal Employment, Credit Report Notice

Form and resume.

ii. DCSA Tier 2: Electronic fingerprints, Electronic and Standard Form (SF) 85-P Questionnaire for

Public Trust Positions, Official Form (OF) 306 Declaration for Federal Employment, Credit Report

Notice Form and resume.

e. Proof of Investigation - Investigation of Contractor personnel may be waived by the Personnel

Security Office for individuals in cases where proof of prior investigation at the Tier 1, 2 or higher level within the last two years can be obtained.

f. Physical Access to NSF Headquarters - Contractor personnel requiring routine physical access to NSF facilities for more than six months require a Personal Identity Verification (PIV) or Personal Identity

Verification Interoperability (PIV-I) card.

g. Records Management Training – The Contractor shall ensure that its employees, in the performance of the contract, receive Records Management Training as it is made available in the learning management system.

h. IT Security and Privacy Awareness Training - The Contractor shall ensure that its employees, in performance of the contract, receive initial IT Security and Privacy Awareness Training before being granted access to NSF systems and networks, and receive refresher IT Security and Privacy Awareness

Training annually. The Contractor may use web-based training available from NSF to meet this requirement.

i. Rules of Behavior - The Contractor shall ensure that its employees, in performance of the contract, sign and submit the “National Science Foundation (NSF) IT Security and Privacy Awareness Training

Rules of Behavior” before receiving access to NSF systems and networks. Additionally, the Rules of

Behavior will be signed and submitted annually at the completion of the IT Security and Privacy

Awareness Training referenced in 2.h. above.

j. Insider Threat Training – If a Contractor receives, or must hold, a national security clearance, the

Contractor shall ensure its contractor(s), in the performance of the contract, receive NSF Insider Threat training within 30 days of receiving a clearance, and annually thereafter.

k. Contractor Separation - At any time during the term of this contract or task orders issued hereunder, Contractor personnel issued a PIV card, granted access to NSF email or any other NSF information, that do not require any further access, and/or at completion, expiration or termination of any such contract or task order where access has been granted, shall follow the requirements in the Contractor Onboarding and

Separation Guide, specifically:

i. Complete and submit the online Contractor/Guest Exit Form, which will result in termination of all access to any NSF email accounts and information systems.

ii. Report to the lobby floor visitor center to identify themselves to the personnel present and surrender their PIV.

iii. Notify the Contracting Officer Representative (COR) and appropriate Property Custodian of any

NSF equipment or information to be surrendered to NSF.

3. Access Controls for NSF Systems and Information - The Contractor shall be responsible for

Information Technology (IT) security for all systems used in performance of this contract, or those which are connected to an NSF network. This clause is applicable to all or any part of the contract that includes

IT resources or services in which the Contractor must have physical or electronic access to NSF’s information, including sensitive information and personally identifiable information, contained in unclassified systems that directly support the mission of the Agency. The access includes information technology, hardware, software, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

4. Remote Access – The Contractor may have the need to access NSF information systems remotely. The

Contractor will remotely access NSF systems only through approved mechanisms. All remote access sessions will be encrypted using NSF services to protect NSF data and information.

5. Protection of Sensitive and Personally Identifiable Information (PII) - NSF's privacy program includes policies, plans, training, and technical safeguards to protect sensitive information, which includes

Personally Identifiable Information (PII). NSF recognizes the importance of protecting sensitive information and implements policy, guidance, and best practices to safeguard information from inappropriate access, use, or disclosure.

a. Information Types - The term, Information, is synonymous with Data, regardless of format or medium. PII is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of

Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII. The hierarchy of sensitive information is as follows and defined below:

i. Sensitive Information - Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data are compromised. Some categories of sensitive information include financial, medical or health, legal, strategic and business, human resources, PII and sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

ii. Personally Identifiable Information (PII) - PII, as defined in OMB Memorandum M-07-16

Safeguarding Against and Responding to the Breach of Personally Identifiable Information, refers to information that can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc., either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information that is publicly available — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name or an email address because these pieces of information uniquely identify an individual, but alone may not constitute

Sensitive PII.

iii. Sensitive PII - Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), are also considered Sensitive PII. The context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or compliant.

b. Access to Information - While performing official duties, Contractors may have the need to access sensitive information or PII. Sensitive information includes proposal reviews, reviewer identity tied to specific reviews or panels, unfunded proposals, proprietary parts of funded proposals, and other similar information. Most of the sensitive information maintained by NSF falls within Privacy Act systems of records, which places disclosure restrictions on NSF and provides access rights to individuals. Sensitive information may also exist in other types of records, such as databases, log files, email, and correspondence files. All Contractor personnel are responsible for recognizing sensitive information and avoiding inappropriate or accidental access, use, or disclosure in accordance with Privacy Act and NSF IT security and privacy policies.

c. Responsibility to Identify and Protect PII - All Contractor personnel are responsible for recognizing

PII and avoiding inappropriate or accidental access, use, or disclosure in accordance with NSF IT policies. Actual business sensitive information (i.e., names of reviewers, PIs, budget information, etc.)

from NSF systems should not be used for illustration purposes. If business sensitive information is used, it must be obscured or redacted.

d. Information Use - The Contractor must not use or redistribute any NSF information processed, stored, or transmitted by the Contractor except as specified in the Contract.

e. NSF Privacy Program and PII - PII may be in the scope of the acquisition and PII may be stored, processed, or transmitted in the Contractor's information system. The collection, maintenance or dissemination of any PII that is subject to the Privacy Act and/or the E-Government Act will be handled in full accordance with all NSF rules of behavior and in accordance with NSF Privacy Program requirements. The Contractor shall ensure that any PII stored on any Contractor system as a function of the contract is encrypted at rest and in transit in accordance with NSF policy.

f. PII Guidelines - PII (should it come into scope) will require the following guidelines be adhered to.

i. The Contractor’s information system must be authorized at least at the FIPS PUB 199 Moderate level.

ii. For any system that collects, maintains or disseminates PII, a Privacy Threshold Analysis (PTA) and

Privacy Impact Assessment (PIA) must be completed by the contractor and provided to the NSF Privacy

Office (DIS Privacy Liaison) (https://www.nsf.gov/policies/privacy.jsp) for review along with the other authorization to operate (ATO) documents.

iii. If the system retrieves information using name or personal identifier, the Office of General Counsel should be consulted to make a determination as to whether the Privacy Act applies and whether a System of Records Notice (SORN) is in place.

iv. If a data collection involves Privacy Act protected information, a Privacy Act Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

6. Systems and Information Integrity

a. Vulnerability Management - If access, including remote access, is through a Contractor-managed system, the Contractor is responsible for IT security patching and maintenance of the system. NSF is responsible for security and patching of NSF managed devices, including Contractor devices if they have an NSF image, when the Contractor device is connected to the NSF network.

b. NSF Configuration Baseline - The Contractor shall certify applications are fully functional and operate correctly as intended on systems using the established NSF configuration baseline. The standard installation, operation, maintenance, updates, and/or patching of software, including software purchased under this Agreement, shall not alter the configuration settings from the approved established NSF configuration baseline configuration. Offerings that require installation should follow OMB M-07-18, Ensuring New Acquisitions Include Common Security Configurations. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The

Contractor shall use Security Content Automation Protocol (SCAP) validated tools with established NSF configuration baseline scanner capability to certify their products operate correctly with established NSF configuration baseline settings and do not alter established NSF configuration baselines.

c. Mobile Devices – Personally owned mobile devices are permitted to connect to NSF IT resources and services (such as email, calendar, contacts, etc.). If the Contractor wishes to use a personally owned mobile device, the device must first be enrolled in Mobile Device Services (MDS). Use of personally owned mobile devices must be in accordance with the NSF MDS Terms of Use and enrollment guides.

7. Continuous Monitoring and Ongoing Authorization

a. Security Assessment and Authorization (A&A)

i. Major Applications - For Information Systems NSF has identified as Major Applications or General

Support Systems (GSS) that are not connected to a NSF network, but for which the Contractor has operational responsibility on behalf of NSF, the Contractor must conform to all NSF policy guidance and reporting requirements regarding Assessment and Authorization (A&A) of IT systems. NSF shall perform all assessment activities as outlined in NIST SP 800-37, while the Contractor will provide full support and documentation to NSF for this effort. Unless otherwise specified by NSF, NSF shall fulfill the roles of

“Senior Agency Information Security Officer" (or "Chief Information Security Officer”) and

“Authorizing Official” as outlined in NIST SP 800-37 Appendix D. For all Contractor Operated systems, NSF shall establish accreditation boundaries and A&A schedules.

ii. Timeline - The A&A activities will be done prior to service commencement (go-live into

Production) and periodically thereafter as required by Federal or NSF policies. This is currently every three years or according to ongoing authorization plans unless there is a major change.

b. Continuous Monitoring – Continuous monitoring is an important activity of NSF’s IT Security and

Privacy Program. Continuous monitoring assures NSF infrastructure and information assets are protected while maintaining an open and collaborative environment for scientific research and discovery. NSF’s

Information Security Continuous Monitoring (ISCM) program contributes to NSF’s Enterprise Risk

Management approach, which is charged to develop, mitigate, and manage significant risks to NSF.

ISCM activities incorporate compliance with the Federal Information Security Modernization Act

(FISMA) and ongoing operational security for a system throughout its lifecycle. NSF’s continuous monitoring approach assesses the security state of information systems based on FISMA security requirements and NIST guidance.

c. Cloud Services – If cloud services are used to support NSF, the Contractor shall implement the controls contained within the Federal Risk and Authorization Management Program (FedRAMP) Cloud

Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for

Low and Moderate impact systems (as defined in FIPS PUB 199). FedRAMP documents define requirements for compliance to meet minimum Federal information security and privacy requirements for

Low or Moderate impact systems. The FedRAMP baseline controls are based on NIST Special

Publication 800-53, Security and Privacy Controls for Information Systems and Organizations and includes a set of additional controls for use within systems providing cloud services to the federal government.

The Contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and security guidance. In situations where there are no procedural guides, the Contractor shall use generally accepted industry best practices for IT security.

d. Risk Management – NSF manages enterprise information security and privacy risk in compliance with NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information

System View and the Framework for Improving Critical Infrastructure Cybersecurity (the Framework).

The Framework encourages agencies to operate within an implementation tier that includes formally approved policies and procedures, an integrated risk management program, and collaboration and partnership with external parties to develop, maintain, and enhance a holistic cybersecurity environment.

NSF uses the Framework's adaptive process to identify and respond to cybersecurity risk.

NSF monitoring activities are based on NIST Special Publication (SP) 800-37, Risk Management

Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and

Privacy. The risk management framework process emphasizes the continuous monitoring of information systems through enhanced monitoring and providing essential information for risk-based decisions.

The Contractor shall apply appropriate techniques to manage and mitigate risk during the acquisition, implementation, and operation of information technology at NSF. The techniques include but are not limited to prudent project management; continuous collection and evaluation of risk-based assessment data; prototyping prior to implementation; post implementation reviews; and focusing on risks and returns using quantifiable measurements.

e. Supply Chain Risk Management – Supply chain risk means the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of an information system (as that term is defined at 44 U.S.C. 3542(b)) so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of such system.

i. The Contractor shall provide information system(s) in compliance with the annual Consolidated and

Further Continuing Appropriations Act regarding the acquisition of high impact or moderate impact systems in effect at the time of award.

ii. The Contractor shall mitigate supply chain risk in the provision of supplies and services to the

Government.

iii. The Contractor shall maintain threat awareness while supplying the Government with products and services.

iv. The Contractor products and services shall comply with industry standard development and engineering principles to ensure security requirements are incorporated throughout the development and delivery process.

v. The Contractor shall incorporate secure configuration in products and services that are consistent with organizational risk management.

8. Cooperation with Audits

a. Contractor Cooperation - The Contractor (and subcontractors) shall fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the Contracting Officer or the

Chief Information Security Officer or designated representative including the IT Security Officer. Full cooperation includes, but is not limited to, prompt disclosure to authorized requestors of information sufficient to identify the nature and extent of any computer security incident, including a breach of sensitive information or personally identifiable information and the individuals responsible for such activity. The Contractor’s (and any subcontractors’) cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government.

b. Government Data and Records - The Contractor (or subcontractor) shall timely produce to the

Contracting Officer, a Contracting Officer’s Representative (COR), or the Chief Information Security

Officer, Government data, information, or records under the control of or in the possession of the

Contractor pursuant to this contract, which the Agency, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Senior Agency Information Security Officer

(or Chief Information Security Officer) is involved. Requests for production under this paragraph shall specify a reasonable deadline for compliance which will presumptively determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

9. Incident Response

a. Notification - In the event of any violation or computer security incident, the Contractor shall promptly notify the Chief Information Security Officer or the agency IT Security Officer.

b. Incident Data Preservation - In the event of any suspected violation of Federal laws and regulations such as illegal activity, computer security incidents, violations of Agency policy, malicious or otherwise prohibited use, (as defined in NIST Special Publication 800-61, Computer Security Incident Handling

Guide), including but not limited to those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or subcontractor), or to the function of information systems operated by the Contractor (or subcontractor) in the performance of this contract, the Contractor (or subcontractor) shall preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of the computer security incident.

c. Notification to Inspector General - If an incident is determined to be actual or suspected criminal activity, the Chief Information Security Officer will make the determination to notify the agency’s Office of the Inspector General (OIG).

C.5 NSF050 NSF BUSINESS HOURS, HOLIDAYS, AND LEAVE (JUL 2016)

The normal business hours of the National Science Foundation (NSF) are 6:00 AM through 6:00 PM

ET, Monday through Friday excluding federal holidays and periods approved for general administrative leave.

Federal holidays observed by the NSF are New Year's Day, Martin Luther King's Birthday, Inauguration

Day, Presidents Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans' Day, Thanksgiving Day, Christmas Day, and any other day designated by federal statute, Executive Order, or Presidential Proclamation. When any such day falls on a Saturday, the preceding

Friday is observed; or if any such day falls on a Sunday, the following Monday is observed.

Except as specified elsewhere in this contract, the Contractor shall perform any services required to be performed at NSF's site(s) during business hours. The NSF Contracting Officer Representative (COR) may grant written approval to work outsideof normal business hours.

C.6 NSF110 ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS –

INVOICE PROCESSING PLATFORM (IPP) (FEB 2019)

Payment requests by the Contractor shall be submitted for reimbursement in the manner and format described herein.

"Payment request" means any request for contract financing payment or invoice payment by the

Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices”, and all applicable payment clauses and provisions included in this contract.

Invoices must be submitted electronically through the U.S. Department of the Treasury’s Invoice

Processing Platform System (IPP). The IPP website address is: https://www.ipp.gov. If you have multiple contracts with NSF, you cannot reuse the same invoice number when invoicing under different contracts.

Each invoice number from your organization must be different. (When searching for your PO in the system, please use the abbreviated form. For example, instead of “NSFDACS17T1234”, please use

“17T1234”.)

https://www.ipp.gov/

If you are not already enrolled, please go to https://www.ipp.gov and click on the “Vendors – Enroll

Now” button for instructions on how to enroll.

Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk via e-mail: IPPCustomerSupport@fiscal.treasury.gov or by phone: (866) 973-3131.

If any contract deliverables are rejected for failure to conform to the technical requirements of the contract or are otherwise unacceptable, the provisions of this clause will apply only to delivery of the acceptable contract deliverables, unless otherwise determined by the Contracting Officer.

All payments for proper invoices will be made via Electronic Fund Transfer (EFT).

Contractors that are small businesses under the appropriate NAICS code for this contract are permitted to request accelerated payments in accordance with the OMB Memorandum, Accelerating Payments to

Small Businesses for Goods and Services, dated September 14, 2011. Requests for accelerated payments shall be made by typing “Small Business Invoice” in the Comments field of your IPP invoice screen. Per the OMB Memorandum, Accelerating Payments to Small Businesses for Goods and Services, dated

September 14, 2011, the accomplishment of accelerated payments to small businesses is a goal and not a guarantee.

If the Contractor is unable to comply with the requirement to use IPP for submission of invoices, the

Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation. The Contractor may submit payment requests using other than IPP only when the Contracting

Officer expressly authorizes alternate procedures in writing.

Payment assistance for small businesses is available from the NSF Office of Small and Disadvantaged

Business Utilization (OSDBU) (see https://www.nsf.gov/about/contracting/osdbu.jsp).

C.7 NSF310 NOTICE OF REGISTERING IN RESEARCH.GOV (MAY 2018)

The prospective awardee shall, upon notification from the Contracting Officer, register in Research.gov prior to award. Instructions on how to register in Research.gov are as follows:

1. Sign in to Research.gov. (If you do not have a NSF account, first go to Research.gov and select

Register from the menu to create one.)

2. Select the My Profile link located on the top right hand of the screen.

3. Select the Add a New Role option from the left navigation bar.

4. Select Add Organizational Role.

Note: The organization is required to be registered in the System for Award Management (SAM). Please go to Sam.gov to register your organization with SAM prior to registering with NSF. Note that completion of the SAM registration process may take up to two weeks. A DUNS number is also required to register your organization with NSF.

For instructions on the registration process, go to https://www.research.gov/common/attachment/Desktop/Single_ID_Help.pdf#page=11.

The prospective awardee shall follow the instructions and inform the Contracting Officer when registration has been completed.

https://www.nsf.gov/about/contracting/osdbu.jsp https://www.research.gov/common/attachment/Desktop/Single_ID_Help.pdf%23page=11

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR

ATTACHMENTS

Attachment #1 Strategic Plan Engagement Support

49100424Q0097 Section E

SECTION E - SOLICITATION PROVISIONS

E.1 INSTRUCTIONS TO OFFERORS

SUBMISSION OF QUESTIONS

All questions regarding this Request for Quotation must be submitted by 5:00 PM (ET) on July 18, 2023

(07/18/2023). Submit all questions or comments by email to Contracting Officer Jonathan Schmeelk at jschmeel@nsf.gov and Contracting Officer Bethany Stutler at bstutler@nsf.gov.

NOTE: Questions must be submitted via email; no questions regarding this solicitation will be answered over the telephone or in person. Questions submitted as an attached Microsoft Word formatted document are preferred. Questions may be answered in anonymized format and provided through an amendment to the solicitation.

SUBMISSION OF QUOTATION

Please submit a quotation electronically (in PDF format), by email to Jonathan Schmeelk, Contracting

Officer, at jschmeel@nsf.gov and Contracting Officer Bethany Stutler at bstutler@nsf.gov by 5:00 PM

(Eastern Time) on July 25, 2024 (07/25/2024), as delineated below. Submissions that are submitted late or to incorrect email inboxes shall not be considered or evaluated. Offerors are solely responsible for ensuring timely delivery of complete quotations.

INSTRUCTIONS TO OFFERORS

Clarity and completeness are of the utmost importance in the quotations. With the exception of past performance information, only material contained within the quotation will be considered in the source selection evaluation and selection process, with the exception of Past Performance information. This contract is planned to be awarded as a Time and Materials type contract.

QUOTATION CONTENT AND CONFIGURATION

The term “quotation” shall mean, collectively, the following items:

1) Summary Cover Letter signed by the offeror;

2) A signed copy of the SF 1449.

3) One electronic copy of the complete quotation delineated below, which shall be submitted to the contracting officer.

Each quotation shall be broken out into three, separate volumes –

1) Volume I, Quotation Reference Documents, consisting of ancillary business information, confirmation of business size status, and all other required representations.

2) Volume II, Non-Price Factors shall consist of the following:

mailto:jschmeel@nsf.gov mailto:bstutler@nsf.gov mailto:jschmeel@nsf.gov mailto:bstutler@nsf.gov

a. Technical Approach – Technical narrative in response to the requirements and approach to addressing the work tasks anticipated and how the task order’s requirements and objectives will be met. This part has a maximum page limit of 10 pages, as delineated in the narrative below.

3) Volume III, Price Quotation

Volume I – Quotation Reference Documents

The Quotation Reference Documents shall consist of relevant offeror business information, written confirmation of business size status, and other required representations or certification as delineated in the solicitation provisions. This volume has no page limits, however information included in Volume I will not be considered for evaluation of Non-Price Factors.

Volume II, Non-Price Factors

The technical volume shall consist of one part. No cost/price data shall be included in any part of the technical volume.

The quotation shall clearly and fully demonstrate the quoter’s capability, knowledge, and experience regarding the technical requirements described herein. Stating that you understand and will comply or paraphrasing the requirements is not adequate.

The quoter shall limit the technical volume to a maximum of 10-pages of narrative of the tasks which shall be specific to the procedures proposed, including any charts, graphs, etc. The technical volume shall be single-spaced and a minimum font size of 12 for the main text, the text for graphs, charts etc may be smaller.

Technical Approach

The quoter shall demonstrate an understanding of the requirements and approach to addressing the work tasks anticipated and how the task order’s requirements and objectives will be met. The quotations shall not repeat the Statement of Work’s (SOW) requirements, but instead demonstrate a thorough, sound, and comprehensive understanding of the issues involved, and the approach to addressing such issues, as stated in the SOW. Failure to address any of the areas of the SOW will result in a lower confidence and higher risk of failure to perform.

• The quoter shall demonstrate the ability to address all scope areas as defined in the SOW

• The quoter shall demonstrate a holistic approach to contract performance management that incorporates industry and government best practices to ensure successful contract performance.

• The quoter shall demonstrate the ability to provide staff and key personnel as well as their depth and breadth of experience. This should include a staffing and management plan for meeting the tasks as described in the SOW, including the timely submission of deliverables in accordance with the schedule laid out in the scope of work.

Volume III – Price Quotation

The price volume does not have a page limit. No technical or past performance information shall be included in any part of Volume III. The price volume shall be submitted as a Microsoft Excel document.

Offerors do not need to provide ODC/Travel prices, as those CLINs are established at defined levels by the Government.

The offeror shall propose pricing in support of the SOW and utilize GSA Schedule rates for each period as outlined in this RFQ. The offeror shall also provide a total estimated price. The total estimated price shall encompass the base plus all option period pricing. Discounts from the established GSA rates are requested.

The offeror shall identify the labor categories with the actual title to be utilized in the performance of this effort for the contract period. Each labor category identified for services under this order shall correspond to specified GSA Schedule rates.

The information in Volume III will not be evaluated as part of the Non-Price factors, and Offerors should ensure that all information necessary to evaluate Non-Price factors is incorporated into Volume II.

FACTORS FOR DETERMINING BEST VALUE FOR PURPOSES OF ESTABLISHING A

TASK ORDER

Best value determination:

The Government’s establishment of a contract to fill its ongoing needs for supplies or services shall reflect its assessment of the contractor(s) that can provide the supply or service that represents the best value. In this regard, the Government’s best value determination will be based on a price/non-price trade-off that considers the following evaluation factors in descending order of importance:

Non-Price Factors

a. Technical Approach

Price Factors

a. Price

The non-price factors are significantly more important than price, but price will become more important in making the best value determination as offerors’ non-price factors are found to be more equal. For example, the Government may properly select a more highly rated proposal from a non-price perspective over one offering a lower price where it has reasonably determined and documented that the…