70US0925R70092450 - Clauses.pdf

Medical Examination Services

CONTRACT CLAUSES AND PROVISIONS

52.252-2 Clauses Incorporated by Reference. (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

Federal Acquisition Regulation (FAR): www.acquisition.gov/far

Homeland Security Acquisition Regulation (HSAR):

http://www.dhs.gov/interweb/assetlibrary/cpo_hsar_finalrule.pdf

Clauses incorporated by reference:

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (JUN 2020) 52.204-6 Unique Entity Identified (OCT 2016) 52.204-7 System for Award Management (OCT 2018) 52.204-13 System for Award Management Maintenance. (OCT 2018) 52.212-4 Contract Terms and Conditions - Commercial Items. (NOV 2021) 52.232-40 Providing Accelerated Payments to Small Business Subcontractors. (NOV 2021)

(End of Clauses)

Clauses incorporated by full text:

52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders— Commercial Products and Commercial Services.

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR

2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

X__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN

2020), with Alternate I (NOV 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

_X_ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

X__ (4) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) ( 41 U.S.C. 4712);

this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

_X_ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN

2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (6) [Reserved].

X__ (7) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (9) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (DEC 2023) ( Pub. L.

115–390, title II).

__ (11)

(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (DEC

2023) ( Pub. L. 115–390, title II).

__ (ii) Alternate I (DEC 2023) of 52.204-30.

_X_ (12) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (NOV 2021) ( 31 U.S.C. 6101 note).

X__ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) ( 41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (OCT 2022) ( 15 U.S.C. 657a).

__ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved]

__ (18) (i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (19)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-7.

__ (20) 52.219-8, Utilization of Small Business Concerns (FEB 2024) (15 U.S.C. 637(d)(2) and (3)).

_ (21) (i) 52.219-9, Small Business Subcontracting Plan (SEP 2023) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (NOV 2016) of 52.219-9.

__ (iii) Alternate II (NOV 2016) of 52.219-9.

__ (iv) Alternate III (JUN 2020) of 52.219-9.

__ (v) Alternate IV (SEP 2023) of 52.219-9.

__ (22) (i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (MAR 2020) of 52.219-13.

_X_ (23) 52.219-14, Limitations on Subcontracting (OCT 2022) (15 U.S.C. 657s).

_X_ (24) 52.219-16, Liquidated Damages—Subcontracting Plan (SEP

2021) (15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran- Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (FEB 2024) (15 U.S.C. 657f).

__ (26) (i) 52.219-28, Post Award Small Business Program Representation (FEB 2024) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (MAR 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (OCT 2022) (15 U.S.C. 637(m)).

__ (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (OCT 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR

2020) ( 15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (SEP 2021) ( 15 U.S.C. 637(a)(17)).

_X_ (31) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

__ (32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (FEB 2024).

X__ (33) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

X__ (34) (i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

__ (ii) Alternate I (FEB 1999) of 52.222-26.

X__ (35) (i) 52.222-35, Equal Opportunity for Veterans (JUN 2020) ( 38 U.S.C. 4212).

__ (ii) Alternate I (JUL 2014) of 52.222-35.

X__ (36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN

2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (JUL 2014) of 52.222-36.

X__ (37) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

X__ (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

X__ (39) (i) 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

X__ (40) 52.222-54, Employment Eligibility Verification (MAY 2022) (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (41) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (MAY 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (44) 52.223-20, Aerosols (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (MAY 2024) ( 42 U.S.C. 7671, et seq.).

__ (46) 52.223-23, Sustainable Products and Services (MAY 2024) ( E.O. 14057, 7 U.S.C.

8102, 42 U.S.C. 6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47) (i) 52.224-3 Privacy Training (JAN 2017) ( 5 U.S.C. 552 a).

__ (ii) Alternate I (JAN 2017) of 52.224-3.

__ (48) (i) 52.225-1, Buy American-Supplies (OCT 2022) (41 U.S.C. chapter 83).

__ (ii) Alternate I (OCT 2022) of 52.225-1.

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV 2023) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109- 283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (DEC 2022) of 52.225-3.

__ (iv) Alternate III (FEB 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (NOV 2023) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (51) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (NOV

2007) (42 U.S.C. 5150).

X__ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (MAY 2024) ( E.O. 13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (FEB 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (NOV 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (NOV 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

X__ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT2018) ( 31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (MAY 2014) (31 U.S.C. 3332).

__ (62) 52.239-1, Privacy or Security Safeguards (AUG 1996) ( 5 U.S.C. 552a).

__ (63) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (NOV 2024) (Sections 1821-1826, Pub. L. 118- 31, 41 U.S.C. 3901 note prec.).

__ (64) 52.242-5, Payments to Small Business Subcontractors (JAN 2017) (15 U.S.C. 637(d)(13)).

__ (65) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV

2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (APR 2003) of 52.247-64.

__ (iii) Alternate II (NOV 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (AUG 2018) (41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (MAY 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (AUG 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (JAN

2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)

(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) (41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) ( 41 U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (DEC 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (JUN 2023) (Section 102 of Division R of Pub. L. 117-328).

(vii)

(A) 52.204–30, Federal Acquisition Supply Chain Security Act Orders— Prohibition. (DEC 2023) ( Pub. L. 115–390, title II).

(B) Alternate I (DEC 2023) of 52.204–30.

(viii) 52.219-8, Utilization of Small Business Concerns (FEB 2024) ( 15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

(x) 52.222-26, Equal Opportunity (SEP 2015) (E.O.11246).

(xi) 52.222-35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212).

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (AUG 2018) ( 41 U.S.C. chapter 67).

(xvi) (A) 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (MAY 2022) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (JAN

2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O. 13706).

(xxii) (A) 52.224-3, Privacy Training (Jan 2017) ( 5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN

2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (NOV 2024) (Sections 1821-1826, Pub. L. 118- 31, 41 U.S.C. 3901 note prec.).

(xxvii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV

2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

FAR 52.217-8 Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within the period of performance of the contract.

(End of clause)

FAR 52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 66 months.

(End of clause)

52.227-17 Rights in Data-Special Works.

RIGHTS IN DATA-SPECIAL WORKS (DEC 2007)

(a) Definitions. As used in this clause-

Data means recorded information, regardless of form or the media on which it may be recorded.

The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

Unlimited rights means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of Rights. (1) The Government shall have-

(i) Unlimited rights in all data delivered under this contract, and in all data first produced in the performance of this contract, except as provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced in the performance of this contract, and to obtain assignment of copyright in that data, in accordance with paragraph (c)(1) of this clause.

(iii) The right to limit the release and use of certain data in accordance with paragraph (d) of this clause.

(2) The Contractor shall have, to the extent permission is granted in accordance with paragraph (c)(1) of this clause, the right to assert claim to copyright subsisting in data first produced in the performance of this contract.

(c) Copyright- (1) Data first produced in the performance of this contract. (i) The Contractor shall not assert or authorize others to assert any claim to copyright subsisting in any data first produced in the performance of this contract without prior written permission of the Contracting Officer. When copyright is asserted, the Contractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402 and acknowledgment of Government sponsorship (including contract number) to the data when delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. The Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

(ii) If the Government desires to obtain copyright in data first produced in the performance of this contract and permission has not been granted as set forth in paragraph (c)(1)(i) of this clause, the Contracting Officer shall direct the Contractor to assign (with or without registration), or obtain the assignment of, the copyright to the Government or its designated assignee.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without prior written permission of the Contracting Officer, incorporate in data delivered under this contract any data not first produced in the performance of this contract and that contain the copyright notice of 17 U.S.C. 401 or 402, unless the Contractor identifies such data and grants to the Government, or acquires on its behalf, a license of the same scope as set forth in paragraph (c)(1) of this clause.

(d) Release and use restrictions. Except as otherwise specifically provided for in this contract, the Contractor shall not use, release, reproduce, distribute, or publish any data first produced in the performance of this contract, nor authorize others to do so, without written permission of the Contracting Officer.

(e) Indemnity. The Contractor shall indemnify the Government and its officers, agents, and employees acting for the Government against any liability, including costs and expenses, incurred as the result of the violation of trade secrets, copyrights, or right of privacy or publicity, arising out of the creation, delivery, publication, or use of any data furnished under this contract; or any libelous or other unlawful matter contained in such data. The provisions of this paragraph do not apply unless the Government provides notice to the Contractor as soon as practicable of any claim or suit, affords the Contractor an opportunity under applicable laws, rules, or regulations to participate in the defense of the claim or suit, and obtains the Contractor’s consent to the settlement of any claim or suit other than as required by final decree of a court of competent jurisdiction; and these provisions do not apply to material furnished to the Contractor by the Government and incorporated in data to which this clause applies.

(End of clause)

FAR 52.237-3 CONTINUITY OF SERVICES (JAN 1991)

(a) The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to-

(1) Furnish phase-in training; and

(2) Exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

(b) The Contractor shall, upon the Contracting Officer’s written notice, (1) furnish phase-in, phase-out services for up to 60 days after this contract expires and (2) negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan and shall be subject to the Contracting Officer’s approval. The Contractor shall provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

(c) The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this contract. The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

(d) The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e., costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations) and a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract.

(End of clause)

USSS 3052.204-90 Unauthorized Use of the U.S. Secret Service Name

In accordance with 18 U.S.C. 709, any contractor, except with the written permission of the Director of the U.S. Secret Service, who knowingly uses the words "Secret Service", "Secret Service Uniformed Division", "U.S.S.S.", "U.D." or any colorable imitation or such words or initials, in connection with or as a part of any advertisement, circular, book, pamphlet or other publication, play, motion picture, broadcast, telecast, other production, product or item, in a manner reasonably calculated to convey the impression that such advertisement, circular, book, pamphlet or other publication, product, or item, is approved, endorsed, or authorized by or by associated in any manner with, the U.S. Secret Service or the U.S. Secret Service Uniformed Division shall be punishable as follows: a corporation, partnership, business trust, association, or other business entity, by a fine under this title; an officer or member thereof participating or knowingly acquiescing in such violation or any individual violating this section, by a fine under this title or imprisonment for not more than one year, or both.

USSS 3052.1107-70 Electronic Submission of Payment Requests

(a) Definitions. As used in this clause

(1) Payment request means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), Content of Invoices and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the

Contracting Officer authorizes alternate procedures in writing in accordance with Treasury procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer's written authorization with each payment request.

SPECIAL CONTRACT REQUIREMENTS

Security Requirements

Contractor personnel performing work under this contract/order shall be able to obtain a Tier 4 Background Investigation or have an in-scope Tier 4 Background Investigation with another agency at time of the proposal submission and must maintain the level of security required for the life of the contract/order.

Controlled Access Facilities / Information Systems Security:

The contractor and his/her employees and sub-contractors shall be citizens of the United States.

The US Secret Service Contracting Officer Representative (COR) or their US Secret Service designee is responsible for determining the contract employee’s position description level as being either Escort Access, Low Risk, or High Risk. The COR or their designee will also make the determination when contract employees require access to US Secret Service controlled Information Technology systems, unless otherwise stipulated within this Performance Work Statement.

Contract employees shall undergo a Suitability Assessment as determined by the US Secret Service’s Personnel Security Vetting Division Contractor Support Branch (PSV-CSB) prior to performing any work within US Secret Services controlled access facilities or on US Secret Service’s information technology systems.

Additional Continuous Suitability Reviews will be required for continued work requirements as determined by PSV-CSB, but no less than once every two years.

All contractors shall ensure that their employees are precleared prior to the start of any US Secret Service (USSS) contract. Contractor employees for High Risk shall possess a current Tier 4 Background Investigation prior to performing any work within USSS controlled access facilities or on USSS information technology systems.

The COR or their designee is responsible for ensuring that all employees supporting USSS contracts are compliant with USSS security requirements. Additional Continuous Suitability Reviews shall be required for continued work requirements as determined by Personnel Vetting Division).

At a minimum, the contractor shall submit to the COR the following completed documentation for each High-Risk contract employee requiring access to US Secret Services controlled access facilities, in order to satisfy initial and/or recurring (as requested by the COR) Continuous Suitability Reviews:

o DHS-11000-25: Form Contractor Fitness/Security Screens Request Form o SSF 4024: US Secret Service Non-Disclosure Agreement o SSF 3230A: Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the

Fair Credit Report Act o Form 14767: Consent to Disclose Tax Compliance Check (IRS Tax Form) o OF 306: Optional Form 306

When work performance requirements exceed Non-Sensitive standards, additional Continuous Suitability Reviews will be required prior to access being granted, specifically:

Contract employees who provide support in Non-IT Low Risk positions must have undergone a minimum of a Tier 1/NACI (National Agency Check and Inquiries) or a higher level favorable Public Trust background investigation within the last 5 years.

Contract employees who provide support in High-Risk positions must have undergone a minimum of a Tier 4 Public Trust or higher-level favorable background investigation within the last 5 years.

For certain positions, PSV may require a contractor to complete the below electronic forms and be subject to a personnel security interview:

Low Risk - S F 85: Questionnaire for Non-Sensitive Positions High Risk - SF 85P: Questionnaire for Public Trust Positions

Privacy Act: Personnel who have access to Privacy Information shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. This effort is for information technology (IT) that has been determined by the CIO to be “high risk”.

Physical Security: The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use.

Badge/Key Control: The contractor shall establish and implement methods of making sure all badges, keys, and/or key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering badge/key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost badges, lost or duplicate keys/key cards to the Contracting Officer.

In the event keys, are lost or duplicated, the Government can bill the contractor the total cost of re-keying or the replacement of the lock or locks. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

The contractor shall prohibit the use of Government issued badges, keys, and/or key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

Data Rights

FAR Clause 52.227-17, Rights in Data – Special Works is incorporated into this contract. The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer.

All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Privacy Terms

1. Information Protection

The contractor shall treat all records containing employee medical information as confidential and maintain them in accordance with 5 U.S.C. 552a and the Privacy Act of 1974. HHSAR Subpart 324.70 – Health Insurance Portability and Accountability Act of 1996 (HIPPA) is applicable to this requirement.

As such, the Contractor shall be HIPAA compliant in accordance with this subpart and 45 CFR 160 and 164 as applicable.

The collection, use, disclosure, and retention of Personally Identifiable Information (PII) shall be limited to that which is necessary for purposes set forth in this Agreement. USSS collected or provided PII will only be disclosed to authorized individuals and organizations with a need to know and only for uses that are consistent with the stated purposes under the Agreement for which the information was originally collected. USSS collected or maintained PII shared and maintained under this Agreement shall, to the extent feasible, be maintained as accurately, completely, and up to date as necessary for the purposes identified. The collection, use, disclosure, and retention of PII shall be limited to that which is necessary for purposes set forth in this Agreement.

2. Use and Sharing

USSS-supplied PII will only be disclosed to authorized individuals and organizations with a need to know and only for uses that are consistent with the stated purposes under this Agreement for which the information was originally collected. USSS-supplied PII shared and maintained under this Agreement shall, to the extent feasible, be maintained as accurately, completely, and up to date as necessary for the purposes identified. Any disclosure to third parties (outside the authorized individuals and organizations with a need to know referred to above) of PII obtained pursuant to this Agreement may only occur after explicit, written consent is obtained from USSS for that dissemination or sharing, to include subcontractors/data processors. Any access requests for USSS-provided information made by a member of the public shall be referred to USSS for appropriate handling and response.

Contractor will notify USSS immediately of any request for disclosure of the USSS-supplied PII from a government requestor, such as a regulatory or law enforcement authority, prior to responding to any such request. Should the requesting agency prohibit Contractor from contacting the USSS to coordinate a response, The Contractor will ask the requesting agency to make contact with the USSS prior to responding.

3. Auditing and Reporting

Regular information handling reviews are to be done to ensure that the control architecture and supporting standards, baselines, procedures, and guidelines are being adhered to. When significant privacy risks and vulnerabilities are discovered during reviews, provide a written plan for addressing the issues, and a timeline for issue resolution/correction.

4. Retention

At a minimum, USSS-supplied PII should be only as long as necessary to fulfill the stated purpose and need of this PWS. USSS-supplied PII must be appropriately destroyed no longer than thirty

(30) days after the event/operations have ceased. All media containing USSS-supplied PII, to include paper, will be securely destroyed, or, if requested, provided to the USSS for appropriate disposition.

5. Training

The Contractor shall ensure that staff receive annual Privacy training. Contractor shall maintain documentation of employee training and shall provide it to USSS upon request.

6. Privacy Incident Reporting

The Contractor’s division director or designee shall notify the USSS of all suspected or confirmed incidents involving the loss of control of or unauthorized access to PII (i.e., privacy incident) or other confidential information within one hour of discovery. The Contractor shall:

1) Determine what PII was or could have been improperly accessed, used, processed, stored, maintained, disseminated, disclosed, or disposed of;

2) Construct a timeline of user activity;

3) Cooperate and exchange information with USSS Privacy Service Program (PSP), as determined necessary by USSS, in order to effectively report and manage a suspected or confirmed privacy incident. The Contractor shall not communicate any information to any entity without the written approval of the Government. The Contractor is permitted to communicate with its corporate counsel and cyber breach insurer.

Restrictions on Other Work

The Contractor and its employees are not authorized to accept any instructions, interpretations or requests for work; honor any changes or revisions that may incur expenditures or affect the price:

or take actions which affect the terms of performance or any other requirements of the order except from the Contracting Officer.

Government Furnished Information

As support for the performance of this contract the Government will provide access to existing documentation and other technical documentation or information in whatever existing form as soon as the contractor has been approved by Service Personnel Security to receive such information.

Confidentially of Medical Records

The contractor shall treat all records containing employee medical information as confidential and maintain them in accordance with 5 U.S.C. 552a and the Privacy Act of 1974. Health and Human Services Acquisition Regulation (HHSAR) Subpart 324.70 – Health Insurance Portability and Accountability Act of 1996 (HIPPA) is applicable to this requirement. As such, the Contractor shall be HIPAA compliant in accordance with this subpart and 45 CFR 160 and 164 as applicable.

Non-Disclosure Agreements

All personnel (to include subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the contract and who will require access to sensitive or protected information shall execute and submit an “SSF 4024 NDA (Conditional Access to Sensitive but Unclassified Information Non-Disclosure Agreement” This is required prior to commencement of any work on the contract and whenever replacement personnel are proposed under an ongoing contract. Any information obtained and provided in the performance of this contract is only to be used in the performance of this contract.

Organizational Conflict of Interest

Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the

OCI.

FEDERAL RISK AND MANAGEMENT PROGRAM (FEDRAMP) AND AUTHORITY TO

OERATATE (ATO) REQUIREMENTS

General

Government information security guidelines do not distinguish between services and products, nor do they distinguish whether the hosting systems are Government-owned or Contractor-owned. All Contractor components within the accreditation boundary that contain U.S. Government data shall be required to achieve and maintain the same level of security and protection required for Government-owned information systems.

The Contractor shall be responsible for protecting U.S. Government information against unauthorized access of any form. Events involving a confirmed or suspected breach or compromise of the system or data may result in suspension of the service by the Contracting Officer. The Government may pursue termination for cause and the payment of damages.

FedRAMP

If the Contractor uses cloud technologies to provide services to the Government under this solicitation, the Contactor and proposed system must already be designated as FedRAMP Authorized (Moderate) upon contract award. The Contractor shall continue to comply with the FedRAMP authorization process for cloud-based systems throughout the contract period of performance. The Contractor is responsible for all costs associated with achieving and maintaining their FedRAMP authorization.

Secret Service Security Authorization to Operate

The Contractor shall achieve a Government-granted authority to operate (ATO) within 180 days of contract award. If the vendor plans to utilize a non-cloud-based system it is required that upon contract award, the proposed system must be operating under a current ATO at DHS or one of its subordinate components in order to leverage the DHS allowance for ATO reciprocity. The Contractor is responsible for all costs associated with achieving and maintaining the Authority to Operate as granted by the Secret Service.

The USSS determines whether or not to authorize the system to operate based on the ability of the Contractor to comply and adhere to the information technology security requirements and management principles outlined in this document. A risk acceptance memorandum may be granted by the Government prior to the Contractor achieving the authority to operate. Extensions to the deadline for achieving the authority to operate may be granted at the sole discretion of the Government.

The Government reserves the right to withdraw the authority to operate or risk acceptance memorandum for the Contractor system at any time for failure to comply with federal statutes, regulations, policy, or the terms of this contract. The Contractor may not operate a production system on behalf of the Government without the authority to operate or a risk acceptance memorandum.

Data Security

All Government data must remain in the United States. Data may not be stored, processed, transmitted, or accessed in or from any country other than the United States. All Government data on non- Government systems must remain within the authorization boundary unless its removal is authorized in writing by the Government.

The Contractor may not disclose Government data to a third party outside the terms of this contract without the written authorization of the Government.

The Contractor shall protect US Government information against disruption, theft, exploitation, and inadvertent disclosure.

Identity and Authentication Control

The Contractor shall implement Identity Assurance Level (IAL3), Authenticator Assurance Level (AAL3), and Federation Assurance Level (FAL3) for privileged accounts. IAL3, AAL3, and FAL3 are defined in NIST 800-63, Digital Identity Guidelines. Non-privileged accounts should implement IAL, AAL, and FAL in accordance with Government analysis of NIST 800-63, Digital Identity Guidelines.

Vulnerability Management

The Contractor shall remediate all Information Security Vulnerability Management (ISVM) notices provided by the Government as well as vulnerabilities published in the National Vulnerability Database (NVDB) that are identified in software, databases, operating systems, and firmware. Information Security Vulnerability Management (ISVM) notices shall be remediated within the stated time documented by the ISVM notice.

The Contractor shall immediately remediate all vulnerabilities with a CVSS v3 rating of Critical. The Contractor shall remediate all vulnerabilities with a CVSS v3 rating of High within 15 calendar days and vulnerabilities with a CVSS rating of Medium, Low, or None within 30 calendar days.

The Government reserves the right to call for ad hoc reports, logs, or screen shots, and so forth to support the requirement to perform vulnerability management. These artifacts shall be provided to the Government COR within seven (7) calendar days from the request.

The Contractor shall comply with the event logging, log retention, and log management requirements as directed in OMB Memorandum M-21-31, SUBJ: Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents, dated August 27, 2021.

Continuous Monitoring

The Contractor shall provide a monthly report of continuous monitoring data defined in the DHS Information Security Performance plan. Contractor IP addresses and hostnames may be de-identified by using hash values. The Government shall provide report templates.

The Contractor shall comply with the FedRAMP Continuous Monitoring Strategy guide.

The Contractor shall provide the Government a monthly report of the remediation progress for POA&Ms.

The Contractor shall use the FedRAMP POA&M Template as the monthly report format.

The Government reserves the right to call for ad hoc reports, logs or screen shots, and so forth to support the requirement to perform continuous security monitoring and Office of the Inspector General (OIG) audits. These artifacts shall be provided to the Government COR within seven (7) calendar days from the request.

The Contractor shall allow the Government or its designated representative to perform quarterly scans, including penetration scans, as part of the continuous security monitoring.

The Contractor shall comply with the event logging, log retention, and log management requirements as directed in OMB…