2.4.1_A0005_70CDCR21R00000005_RFP_Conformed.pdf

SECTION B:

SUPPLIES OR SERVICES AND

PRICES/COSTS

B.1 GENERAL

The Contractor shall provide all management, supervision, labor, and materials necessary to perform the services identified in the Performance Work Statement on an Indefinite Delivery – Indefinite Quantity basis.

B.2 CONTRACT PRICING

Offerors are instructed to fill in the Contract Line Item Number (CLIN) table in Attachment 2 – “Schedule B – Contractor Cost/Pricing Summary”. Schedule B is anticipated to be the CLIN structure that will be utilized for this contract but may be edited prior to award. Offerors may not propose an alternative CLIN structure.

B.3 MINIMUM AND MAXIMUM QUANTITIES

In accordance with FAR 16.504(a)(4)(ii), the minimum and maximum quantity the Government will acquire are as follows:

Minimum: $500,000.00 during the period of performance of the IDIQ. There is no additional minimum for any option periods, if exercised.

Maximum: The maximum for this IDIQ will be the calculated total value of the base year and all options multiplied by 115%. This amount will be stated in the IDIQ award as a dollar amount.

B.4 FUNDING

Funds for the services provided will be obligated, at the task order level, as they become available, or excess funds will be de-obligated at the task order level, by modification to the task order contracts unilaterally by the Government.

END OF SECTION B

SECTION C:

DESCRIPTION/SPECIFICATIONS/

PERFORMANCE WORK STATEMENT

DEPARTMENT OF HOMELAND SECURITY (DHS)

U.S. IMMIGRATION AND CUSTOMS ENFORCEMENT (ICE)

ENFORCEMENT AND REMOVAL OPERATIONS (ERO)

PERFORMANCE WORK STATEMENT (PWS)

ICE HEALTH SERVICE CORPS (IHSC)

TELERADIOLOGY DIGITAL X‐RAY SERVICE

April 2021

See Attached PWS

Attachment 1 – Performance Work Statement

END OF SECTION C

SECTION D:

PACKAGING AND MARKING

D.1 PACKAGING AND SHIPPING

All materials shall be packed for shipment in such a manner that will ensure acceptance by common carrier and safe delivery at destination. Containers and closures shall comply with the Interstate Commerce Commission regulations, Uniform Freight Classification rules, or regulations of other carriers as applicable to the mode of transportation.

Damaged materials shall be replaced by the Contractor at no cost to the Government.

D.2 SHIPPING RECEIPTS

Receipts from common carriers for shipment of materials shall be retained by the Contractor and made available to the Contracting Officer upon request.

D.3 SHIPPING CONTAINER MARKINGS

All shipping containers shall be clearly marked with a delivery address.

D.4 SHIPPING INSURANCE

All shipments shall be Free on Board (FOB) destination, insured against loss or damage, and shall carry sufficient insurance to cover the full replacement value of the item(s) being shipped.

D.5 LOCATIONS

Locations are indicated in Attachment 1, Appendix 2 – IHSC Facility Locations.

END OF SECTION D

SECTION E:

INSPECTION AND ACCEPTANCE

E.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text can be accessed electronically at this internet address:

http://acquisition.gov/far/index.html.

Clause Title Date FAR 52.246-2 Inspection of Supplies - Fixed Price (AUG 1996) FAR 52.246-4 Inspection of Services - Fixed Price (AUG 1996) FAR 52.246-15 Certificate of Conformance (APR 1984)

E.2 INSPECTION REQUIREMENTS

Review of Deliverables ---

a. The Contractor shall provide all deliverables to the COR in Microsoft Excel, PowerPoint, or Word format unless otherwise approved by the COR/CO.

b. The Contracting Officer or Contracting Officer’s Representative will provide written acceptance, comments and/or change requests, if any, within thirty (30) business days from receipt by the Government of the initial deliverable.

c. Upon receipt of the Government comments, the Contractor shall have fifteen (15) business days to incorporate the Government's comments and/or change requests and to resubmit the deliverable in its final form.

E.3 DELIVERABLES CHART

ITEM DELIVERABLE / EVENT DUE BY

1 Post Award Conference 10 calendar days after contract Award

Inspection by physicist of Teleradiology Equipment and certification of ready equipment

Completion by end of transition

Equipment Quality Control Policies and Certifications

Upon Request

4 Transition Out Plan 90 calendar days prior to contract expiration

5 Business Continuity Plan Proposal Submission

6 General Liability and Malpractice Insurance Proposal submission/As Updated

Board Certifications, State Licensure for each Radiologist on the Staffing Plan

Award and Annually prior to each option exercised/as licenses are renewed

8 Staffing Plan 1st of the month

9 Contractual Reports In accordance with PWS

10 Training Schedule At least 14 calendar days prior to training

11 Training Documentation and Certificates In accordance with PWS.

12 Quality Control Plan (QCP) Proposal Submission and Updated as Needed

13 IT Security Plan 30 calendar days after contract award and updated annually

14 IT Security Accreditation 6 months after contract award and updated annually

15 Access to Radiological Images and Reports Within 7 days of request from facility POC

16 Radiological Reports Within 4 hours of order from facility POC

E.4 ACCEPTANCE CRITERIA

The Government will provide written notification of acceptance or rejection of all final deliverables within thirty (30) calendar days. Absent written notification, final deliverables may be construed as accepted. All notifications of rejection will be accompanied with an explanation of the specific deficiencies causing the rejection.

END OF SECTION E

SECTION F:

DELIVERIES OR PERFORMANCE

F.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text can be accessed electronically at this internet address:

http://acquisition.gov/far/index.html.

Clause Title Date FAR 52.242-15 Stop-Work Order (AUG 1989) FAR 52.242-17 Government Delay of Work (APR 1984)

F.2 PERIOD OF PERFORMANCE

The resultant contract from this solicitation has an anticipated period of performance that will include a base period of one (1) year from the date of contract award and four (4) one-year options in accordance with FAR 17.2. Included in the base period will be a ninety (90) day transition period and two hundred seventy-five (275) day operational period. The option to extend services for up to six (6) months, in accordance with FAR 52.217-8, is being evaluated but will not be listed as a separate CLIN. The associated cost will not be included in the overall price of the contract:

The anticipated period of performance for each requirement is as follows:

Period of Performance Dates

Base Period (inclusive of 90-day transition period) 12 Months Option 1 12 Months Option 2 12 Months Option 3 12 Months Option 4 12 Months

F.3 PLACE OF PERFORMANCE

Addresses of each facility are found in Attachment 1, Appendix 2 – IHSC Facility Locations.

Each facility is managed and operable 24 hours a day, 7 days a week for 365 days per year and 366 days per year for any leap years.

F.4 CONTRACTOR EVALUATING PROCEDURES

The Government will issue Contractor performance ratings for any award as a result of this solicitation via the Contractor Performance Assessment Reporting System (CPARS) in accordance with FAR 42.1502. The CPARS website is located at: https://www.cpars.gov.

END OF SECTION F

SECTION G:

CONTRACT ADMINISTRATION DATA

G.1 CONTRACT ADMINISTRATION

Notwithstanding the Contractor’s responsibility for total management responsibility during the performance of this contract, the administration of the contract will require maximum coordination between the ICE and the Contractor.

The Government points of contact for any resulting contract shall be identified at time of award.

G.2 CONTRACTING OFFICER’S REPRESENTATIVE

The following individual is designated and authorized by the CO to perform contract administration functions related to the technical performance of this contract.

To Be Designated at Time of Award

(a) The Contracting Officer (CO) may designate Government personnel to act as the Contracting Officer's Representative (COR) to perform functions under the contract such as review or inspection and acceptance of supplies, services, including construction, and other functions of a technical nature. The CO will provide a written notice of such designation to the Contractor within five working days after contract award or for construction, not less than five working days prior to giving the contractor the notice to proceed. The designation letter will set forth the authorities and limitations of the COR under the contract.

(b) The CO cannot authorize the COR or any other representative to sign documents, such as contracts, contract modifications, etc., that require the signature of the CO.

G.3 INVOICE REQUIREMENTS

Invoices shall be submitted as follows:

1. The contractor shall be active in the System for Award Management (www.SAM.gov) for invoice processing. Besides the information identified below, a proper invoice shall also include; contractor’s Dunn and Bradstreet (D&B) DUNS number; the ICE Program Office; and state whether the invoice is “INTERIM” or “FINAL”.

2. In accordance with Contract Clauses, FAR 52.212-4 (g) (1), Contract Terms and

Conditions - Commercial Items, or FAR 52.232-25 (a) (3), Prompt Payment, as applicable, the information required with each invoice submission is as follows:

"...An invoice must include-

(i) Name and address of the Contractor. The name, address and DUNS number on the invoice MUST match the information in both the Contract/Agreement and the information in SAM;

(ii) Dunn and Bradstreet (D&B) DUNS number;

(iii) Invoice date and number;

(iv) Contract number, line items and, if applicable, the order number;

(v) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(vi) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vii) Terms of any discount for prompt payment offered;

(viii) Remit to Address;

(ix) Name, title, and phone number of person to notify in event of defective invoice;

(x) ICE Program Office designated on the order/contract/agreement; and

(xi) Whether the invoice is “Interim” or “Final”

3. Invoice submission: shall be submitted via one of the following two methods. Improper invoices or those submitted by means other than these two methods will be returned.

Email is the preferred method.

a. Primary method of submission is email. The Contractor shall submit one (1) invoice in PDF format per e-mail and the subject line of the e-mail will reference the invoice number of the attached invoice to: Invoice.Consolidation@ice.dhs.gov; Attn: ICE - ERO-FHQ-DMD Invoice

b. Mail:

DHS, ICE

Financial Service Center Burlington

Attn: ICE-ERO-FHQ-DMD Invoice P.O. Box 1620 Williston, VT 05495-1620

4. Payment Inquiries: Questions regarding invoice submission or payment, please contact Financial Service Center Burlington at 1-877-491-6521, Option # 3 or by e-mail at OCFO.CustomerService@ice.dhs.gov

Invoices without the above information may be returned for resubmission.

The preferred method of submittal is email.

END OF SECTION G

SECTION H:

SPECIAL CONTRACT REQUIREMENTS

H.1 CONTRACTORS INSURANCE

The Contractor shall ensure all radiologists performing under this contractor maintain general liability and malpractice insurance as required by industry standards. The contractor shall provide proof of insurance coverage to the CO, CS and the COR as specified in the PWS.

H.2 SECURITY REQUIREMENTS – REQUIRED SECURITY LANGUAGE FOR

SENSITIVE DHS INFORMATION

H.2.1 GENERAL

The United States Immigration and Customs Enforcement (ICE) has determined that performance of the tasks as described in this Contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor) have access to sensitive DHS information, and that the Contractor will adhere to the following.

H.2.2 PRELIMINARY FITNESS DETERMINATIONS

ICE will exercise full control over granting, denying, withholding, or terminating unescorted government facility and/or sensitive Government information access for contractor employees, based upon the results of a Fitness screening process. ICE may, as it deems appropriate, authorize, and make a favorable expedited preliminary Fitness determination based on preliminary security checks. The preliminary Fitness determination will allow the contractor employee to commence work temporarily prior to the completion of a Full Field Background Investigation. The granting of a favorable preliminary Fitness shall not be considered as assurance that a favorable final Fitness determination will follow as a result thereof. The granting of preliminary Fitness or final Fitness shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable preliminary Fitness determination or final Fitness determination by the Office of Professional Responsibility, Personnel Security Unit (OPR-PSU). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable preliminary Fitness determination or final Fitness determination by OPR-PSU. Contract employees are processed under DHS Instruction 121-01-007-001 (Personnel Security, Suitability and Fitness Program), or successor thereto; those having direct contact with Detainees will also have 6 CFR § 115.117 considerations made as part of the Fitness screening process. (Sexual Abuse and Assault Prevention Standards) implemented pursuant to Public Law 108-79 (Prison Rape Elimination Act (PREA) of 2003)

H.2.3 BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive information and/or ICE Detainees, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract.

The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through the Personnel Security Unit. Contractor employees nominated by a Contracting Officer Representative for consideration to support this contract shall submit the following security vetting documentation to OPR-PSU, through the Contracting Officer Representative (COR), within 10 days of notification by OPR-PSU of nomination by the COR and initiation of an Electronic Questionnaire for Investigation Processing (e-QIP) in the Office of Personnel Management (OPM) automated on-line system.

1. Standard Form 85P (Standard Form 85PS (With supplement to 85P required for armed positions)), “Questionnaire for Public Trust Positions” Form completed on-line and archived by the contractor employee in their OPM e-QIP account.

2. Signature Release Forms (Three total) generated by OPM e-QIP upon completion of Questionnaire (e-signature recommended/acceptable – instructions provided to applicant by OPR-PSU). Completed on-line and archived by the contractor employee in their OPM e-QIP account.

3. Two (2) SF 87 (Rev. December 2017) Fingerprint Cards. (Two Original Cards sent via COR to OPR-PSU)

4. Foreign National Relatives or Associates Statement. (This document sent as an attachment in an e-mail to contractor employee from OPR-PSU – must be signed and archived into contractor employee’s OPM e-QIP account prior to electronic “Release” of data via on-line account)

5. DHS 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act” (This document sent as an attachment in an e-mail to contractor employee from OPR-PSU – must be signed and archived into contractor employee’s OPM e-QIP account prior to electronic “Release” of data via on-line account)

6. Optional Form 306 Declaration for Federal Employment (This document sent as an attachment in an e-mail to contractor employee from OPR-PSU – must be signed and archived into contractor employee’s OPM e-QIP account prior to electronic “Release” of data via on-line account)

7. If occupying PREA designated position: Questionnaire regarding conduct defined under 6 CFR § 115.117 (Sexual Abuse and Assault Prevention Standards) (This document sent as an attachment in an e-mail to contractor employee from OPR-PSU – must be signed and archived into contractor employee’s OPM e-QIP account prior to electronic “Release” of data via on-line account)

8. One additional document may be applicable if contractor employee was born abroad. If applicable, additional form and instructions will be provided to contractor employee. (If applicable, the document will be sent as an attachment in an e-mail to contractor employee from OPR-PSU – must be signed and archived into contractor employee’s OPM e-QIP account prior to electronic “Release” of data via on-line account.

9. Contractor employees who have an adequate, current investigation by another Federal Agency may not be required to submit complete security packages; the investigation may be accepted under reciprocity. The questionnaire related to 6 CFR § 115.117 listed above in item 7 will be required for positions designated under PREA.

An adequate and current investigation is one where the investigation is not more than five years old, meets the contract risk level requirement, and applicant has not had a break in service of more than two years. (Executive Order 13488 amended under Executive Order 13764/DHS Instruction 121-01-007-01)

Required information for submission of security packet will be provided by OPR-PSU at the time of award of the contract. Only complete packages will be accepted by the OPR-PSU as notified by the COR.

To ensure adequate background investigative coverage, contractor employees must currently reside in the United States or its Territories. Additionally, contractor employees are required to have resided within the Unites States or its Territories for three or more years out of the last five (ICE retains the right to deem a contractor employee ineligible due to insufficient background coverage). This timeline is assessed based on the signature date of the standard form questionnaire submitted for the applied position. Contractor employees falling under the following situations may be exempt from the residency requirement: 1) work or worked for the U.S. Government in foreign countries in federal civilian or military capacities; 2) were or are dependents accompanying a federal civilian or a military employee serving in foreign countries so long as they were or are authorized by the U.S. Government to accompany their federal civilian or military sponsor in the foreign location; 3) worked as a contractor employee, volunteer, consultant or intern on behalf of the federal government overseas, where stateside coverage can be obtained to complete the background investigation; 4) studied abroad at a U.S.

affiliated college or university; or 5) have a current and adequate background investigation (commensurate with the position risk/sensitivity levels) completed for a federal or contractor employee position, barring any break in federal employment or federal sponsorship.

Only U.S. Citizens and Legal Permanent Residents are eligible for employment on contracts requiring access to DHS sensitive information unless an exception is granted as outlined under DHS Instruction 121-01-007-001. Per DHS Sensitive Systems Policy Directive 4300A, only U.S. citizens are eligible for positions requiring access to DHS Information Technology (IT) systems or positions that are involved in the development, operation, management, or maintenance of DHS IT systems, unless an exception is granted as outlined under DHS Instruction 121-01-007-001.

H.2.4 TRANSFERS FROM OTHER DHS CONTRACTS

Contractor employees may be eligible for transfer from other DHS Component contracts provided they have an adequate and current investigation meeting the new assignment requirement. If the contractor employee does not meet the new assignment requirement a DHS 11000-25 with ICE supplemental page will be submitted to OPR-PSU to initiate a new investigation.

Transfers will be accomplished by submitting a DHS 11000-25 with ICE supplemental page indicating “Contract Change.” The questionnaire related to 6 CFR § 115.117 listed above in item 7 will be required for positions designated under PREA.

H.2.5 CONTINUED ELIGIBILITY

ICE reserves the right and prerogative to deny and/or restrict facility and information access of any contractor employee whose actions conflict with Fitness standards contained in DHS Instruction 121-01-007-01, Chapter 3, paragraph 6.B or who violate standards of conduct under 6 CFR § 115.117. The Contracting Officer or their representative can determine if a risk of compromising sensitive Government information exists or if the efficiency of service is at risk and may direct immediate removal of a contractor employee from contract support. The OPR- PSU will conduct periodic reinvestigations every 5 years, or when derogatory information is received, to evaluate continued Fitness of contractor employees.

H.2.6 REQUIRED REPORTS

The Contractor will notify OPR-PSU, via the COR, of all terminations/resignations of contractor employees under the contract within five days of occurrence. The Contractor will return any expired ICE issued identification cards and building passes of terminated/ resigned employees to the COR. If an identification card or building pass is not available to be returned, a report must be submitted to the COR referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card. The COR will return the identification cards and building passes to the responsible ID Unit.

The Contractor will report any adverse information coming to their attention concerning contractor employees under the contract to the OPR-PSU, via the COR, as soon as possible.

Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the contractor employees’ name and social security number, along with the adverse information being reported.

The Contractor will provide, through the COR a Quarterly Report containing the names of contractor employees who are active, pending hire, have departed within the quarter or have had a legal name change (Submitted with documentation). The list shall include the Name, Position and SSN (Last Four) and should be derived from system(s) used for contractor payroll/voucher processing to ensure accuracy.

CORs will submit reports to psu-industrial-security@ice.dhs.gov

Contractors, who are involved with management and/or use of information/data deemed “sensitive” to include ‘law enforcement sensitive” are required to complete the DHS Form 11000-6-Sensitive but Unclassified Information NDA for contractor access to sensitive information. The NDA will be administered by the COR to the all contract personnel within 10 calendar days of the entry on duty date. The completed form shall remain on file with the COR for purpose of administration and inspection.

Sensitive information as defined under the Computer Security Act of 1987, Public Law 100-235 is information not otherwise categorized by statute or regulation that if disclosed could have an adverse impact on the welfare or privacy of individuals or on the welfare or conduct of Federal programs or other programs or operations essential to the national interest. Examples of sensitive information include personal data such as Social Security numbers; trade secrets; system vulnerability information; pre-solicitation procurement documents, such as statements of work;

and information pertaining to law enforcement investigative methods; similarly, detailed reports related to computer security deficiencies in internal controls are also sensitive information because of the potential damage that could be caused by the misuse of this information. All sensitive information must be protected from loss, misuse, modification, and unauthorized access in accordance with DHS Management Directive 11042.1, DHS Policy for Sensitive Information and ICE Policy 4003, Safeguarding Law Enforcement Sensitive Information.”

Any unauthorized disclosure of information should be reported to ICE.ADSEC@ICE.dhs.gov.

H.2.7 SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with the OPR-PSU through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and the OPR-PSU shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract, the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

H.2.8 INFORMATION TECHNOLOGY SECURITY CLEARANCE

When sensitive government information is processed on Department telecommunications and automated information systems, the Contractor agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS MD 4300.1, Information Technology Systems Security. or its replacement. Contractor employees must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractor employees who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

H.2.9 INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

In accordance with Chief Information Office requirements and provisions, all contractor employees accessing Department IT systems or processing DHS sensitive data via an IT system will require an ICE issued/provisioned Personal Identity Verification (PIV) card. Additionally, Cybersecurity Awareness Training (CSAT) will be required upon initial access and annually thereafter. CSAT training will be provided by the appropriate component agency of DHS.

Contractor employees, who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices, systems rules of behavior, to include Unauthorized Disclosure Training, available on PALMS or by contacting ICE.ADSEC@ICE.dhs.gov. Department contractor employees, with significant security responsibilities, shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. System Administrators should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

H.2.10 FACILITY ACCESS

The Contractor is required to provide to the COR and the facility POCs, a list of all personnel who require access to IHSC facilities, including access during the Transition‐In phase, installation of equipment, training, testing, and etcetera. All applicable Contractor personnel shall be capable of passing the ICE‐required building access procedures and vendor authorization in order to enter IHSC facilities. The contractor employees are required to complete the Building Access Request Form, prior to facility access granted.

The Contractor’s personnel shall be required to obtain the necessary clearance required under this PWS to be granted access to the facility and its grounds. Contractor’s personnel criminal history checks shall be part of the general background check for performance of services in and around the facility. This process is strictly confidential, and access to the information must be limited to the Agency.

END OF SECTION H

SECION I:

CONTRACT CLAUSES

I.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

they were given in full text. Upon request, the CO will make their full text available. Also, the full text can be accessed electronically at this internet address:

https://acquisition.gov/far/indes.html.

Number Titles DATE

52.202-1 Definitions Jun 2020 52.203-3 Gratuities Apr 1984 52.203-5 Covenant Against Contingent Fees May 2014 52.203-7 Anti-Kickback Procedures

52.203-12 Limitations on Payments to Influence Certain Federal Jun 2020 Transactions

52.203-17 Contractor Employee Whistleblower Rights and Requirement Jun 2020 to Inform Employees of Whistleblower Rights

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber May 2011 Content Paper

52.204-13 System for Award Management Maintenance Oct 2018 52.204-18 Commercial and Government Entity Code Maintenance Aug 2020 52.204-19 Incorporation by Reference of Representations and Dec 2014 Certifications 52.212-4 Contract Terms and Conditions – Commercial Items Oct 2018 52.215-2 Audit and Records – Negotiations Jun 2020 52.215-8 Order of Precedence – Uniform Contract Format Jun 2020 52.215-14 Integrity of Unit Prices Jun 2020 52.219-8 Utilization of Small Business Concerns Oct 2018 52.219-28 Post-Award Small Business Program Representation Nov 2020

52.222-1 Notice to the Government of Labor Disputes Feb 1997 52.222-40 Notification of Employee Rights Under the National Labor Dec 2010 Relations Act 52.222-50 Combating Trafficking in Persons Oct 2020 52.222-54 Employment Eligibility Verification Oct 2015 52.222-62 Paid Sick Leave Under Executive Order 13706 Jan 2017 52.223-2 Affirmative Procurement of Bio-based Products Under Sep 2013

Service or Construction Contracts 52.223-6 Drug-Free Workplace May 2001 52.223-19 Compliance with Environmental Management Systems May 2011 52.224-1 Privacy Act Notification Apr 1984

52.224-2 Privacy Act Apr 1984 52.227-1 Authorization and Consent Jun 2020 52.229-3 Federal, State, and Local Taxes Feb 2013 52.232-1 Payments Apr 1984 52.232-8 Discounts for Prompt Payment Feb 2002 52.232-9 Limitation on Withholding of Payments Apr 1984 52.232-11 Extras Apr 1984 52.232-17 Interest May 2014 52.232-23 Assignment of Claims May 2014 52.232-25 Prompt Payment Jan 2017 52.232-39 Unenforceability of Unauthorized Obligations Jun 2013 52.232-40 Providing Accelerated Payments to Small Business Dec 2013

Subcontractors 52.233-1 Disputes May 2014 52.239-1 Privacy or Security Safeguards Aug 1996 52.242-13 Bankruptcy Jul 1995 52.249-2 Termination for Convenience of the Government –Fixed Price Apr 2012 52.249-8 Default (Fixed-Price Supply and Service) Apr 1984 52.253-1 Computer Generated Forms Jan 1991

I.2 CLAUSES INCORPORATED IN FULL TEXT

52.204-1 Approval of Contract (Dec 1989)

This contract is subject to the written approval of the Contracting Officer and shall not be binding until so approved.

(End of Clause)

52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Jun 2016)

(a) Definitions. As used in this clause-- “Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of Clause)

FAR 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kapersky Lab and Other Covered Entities (DEVIATION 20-05)

(a) Definitions. As used in this clause—

“Covered article” means any hardware, software, or service that–

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity.

“Covered entity” means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any covered article. The Contractor is prohibited from—

(1) Providing any covered article that the Government will use on or after October 1, 2018; and

(2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing via email, to the Contracting Officer, Contracting Officer’s Representative, and the Enterprise Security Operations Center (SOC) at NDAA_Incidents@hq.dhs.gov, with required information contained in the body of the email. In the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Enterprise SOC, Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) and Contracting Officer’s Representative(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

(End of clause)

FAR 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (DEVAITION 2020-05) (DEC 2020)

(a) Definitions. As used in this clause—

“Backhaul” means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

“Covered foreign country” means The People’s Republic of China.

“Covered telecommunications equipment or services” means–

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

“Critical technology” means–

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

“Interconnection arrangements” means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

“Reasonable inquiry” means an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

“Roaming” means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

“Substantial or essential component” means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115–232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

(c) Exceptions. This clause does not prohibit contractors from providing—

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement.

(1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause in writing via email to the Contracting Officer, Contracting Officer’s Representative, and the Network Operations Security Center (NOSC) at NDAA_Incidents@hq.dhs.gov, with required information in the body of the email. In the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the NOSC, Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) and Contracting Officer’s Representative(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause

(i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e) and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders – Commercial Items (JAN 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017)

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018)**

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (AUG 2020)**

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015)

52.233-3 Protest After Award (AUG 1996)

52.233-4 Applicable Law for Breach of Contract Claim (OCT 2004)

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

52.203-6 Restrictions on Subcontractor Sales to the Government (JUN 2020)

Alternate I (OCT 1995)

52.203-13 Contractor Code of Business Ethics and Conduct (JUN 2020)

52.203-15 Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUNE 2010)

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020)

[Reserved]

52.204-14 Service Contract Reporting Requirements (OCT 2016)

52.204-15 Service Contract Reporting Requirements for…