75P00122R00022.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

DAM

Bethesda MD 20814 8th Floor 7700 Wisconsin Avenue

DHHS/PSC/AMS/DAM

CODE 16. ADMINISTERED BYCODE

X

X

561499

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORDAM

RFPIFB

10. THIS ACQUISITION ISCODE

RFQ

14. METHOD OF SOLICITATION

13b. RATING

NAICS:

SMALL BUSINESS

03/04/2022 1400 ET

03/02/2022

DAN BERKOVITZ

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

75P00122R00022

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 34 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

Bethesda MD 20814 8th Floor 7700 Wisconsin Avenue

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$16.50

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS

THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

8(A)

DHHS/PSC/AMS/DAM

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

See page 3 for combined synopsis/solicitation details.

Period of Performance: 03/10/2022 to 03/09/2023

1 Base Period

2 Option Period 1 Period of Performance: 03/10/2023 to 03/09/2024

3 Option Period 2 Period of Performance: 03/10/2024 to 03/09/2025 Continued ...

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

X

XX

DATED

VICTORIA W. ESTABROOK

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

OFFER

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT:

REF.

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 2/2012) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

4 Option Period 3

Period of Performance: 03/10/2025 to 03/09/2026

5 Option Period 4

Period of Performance: 03/10/2026 to 03/09/2027

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

34 2 of

(i) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This requirement was initially posted to GSA eBuy as RFQ1541854 on

2/23/2022. Except the previously posted RFQ1541854, this announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

(ii) The solicitation number is 75P00122R00022. The solicitation is issued as a Request for

Proposals (RFP).

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2022-04.

(iv) The corresponding NAICS code is 561499 and the small business size standard is $41.5 million.

(v) A list of line item number(s) and items, quantities, and units of measure, (including option(s), if applicable). – N/A

(vi) Description of requirements for the items to be acquired.

Section C of the solicitation is incorporated here into this combined synopsis/solicitation as Attachment 1.

(vii) The period of performance shall be for a base period of 12 months from March 10, 2022 through March 9, 2023 with four (12) month option periods, as follows:

Base Period: 3/10/2022-3/9/2023

Option Period 1: 3/10/2023-3/9/2024

Option Period 2: 3/10/2024-3/9/2025

Option Period 3: 3/10/2025-3/9/2026

Option Period 4: 3/10/2026-3/9/2027

(viii) The provision at 52.212-1, Instructions to Offerors -- Commercial, applies to this acquisition and a statement regarding any addenda to the provision.

(ix) The provision at FAR 52.212-2, Evaluation – Commercial Items, applies to this acquisition.

Award will be made on the basis of Lowest Price Technically Acceptable (LPTA) to the technically acceptable, legally eligible, responsible Offeror, whose proposal is the lowest evaluated price and received an “Acceptable” rating overall for all technical criteria. All factors and sub-factors are of equal importance. A rating of “Unacceptable” for one or more technical factors (or subfactors) will result in an overall rating of “Unacceptable.”

Consistent with the LPTA method, the lowest priced quote will be evaluated first; if not found Acceptable, the next lowest priced quote will be evaluated, and so on until an

Acceptable quote is identified . Higher priced quotes will not be evaluated. The

Government reserves the right to make award without discussions.

The following factors will be used to evaluate offers:

• Technical Evaluation Criteria

The following items will be evaluated for technical acceptability:

Technical conformity with the requirement;

FedRAMP Certified;

ATO in process or approved;

Compatible with existing equipment;

Cloud Based Secured Data Hosting;

and Section 508 Compliance.

In order to be evaluated as "Acceptable" for HHS Section 508 Compliance, the offeror must complete the HHS 508 Evaluation Template, the technical quote must demonstrate compliance with the established EIT accessibility standards and the technical quote must include a binding statement of conformance to the established EIT accessibility standards.

• Past Performance Evaluation

Past performance information is one indicator of an offeror’s ability to perform the contract successfully. This evaluation is subjective and will be based on information obtained from CPARS if available or if requested, references provided by the offeror, as well as information obtained by other sources known to the Government. For the purpose of this evaluation the term "offeror" is inclusive of the prime (including all subcontractor members, if applicable), predecessor companies, key personnel and subcontractors for which past performance will be evaluated.

• Price Evaluation

As part of the price analysis, the government will consider whether the proposed labor mix, level of effort and materials are consistent with the Technical Volume.

(x) Offerors are to include a completed copy of the provision at FAR 52.212-3, Offeror

Representations and Certifications – Commercial Items, with its offer or acknowledge its registration in the System for Award Management (www.sam.gov) Online

Representations and Certifications Application.

(xi) The clause at FAR 52.212-4, Contract Terms and Conditions – Commercial Items, applies to this acquisition.

(xii) The clauses at FAR 52.212-5, Contract Terms and Conditions Required to Implement

Statutes or Executive Orders – Commercial Items, applies to this acquisition.

The Contracting Officer has indicated the following clauses listed in paragraph (b) as applicable and are hereby incorporated by reference: (1) 52.203-6, Restrictions on

Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov

2021) (41 U.S.C. 4704 and 10 U.S.C. 2402); (4) 52.204-10, Reporting Executive

Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282)

( 31 U.S.C. 6101 note); (6) 52.204-14, Service Contract Reporting Requirements (Oct

2016) (Pub. L. 111-117, section 743 of Div. C); (8) 52.209-6, Protecting the

Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or

Proposed for Debarment. (Nov 2021) (31 U.S.C. 6101 note); (9) 52.209-9, Updates of

Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C.

2313); (16) 52.219-8, Utilization of Small Business Concerns (Oct

2018) (15 U.S.C. 637(d)(2) and (3)); (22) (i) 52.219-28, Post Award Small Business

Program Rerepresentation (Sep 2021) (15 U.S.C. 632(a)(2)); (27) 52.222-3, Convict

Labor (Jun 2003) (E.O.11755); (29) 52.222-21, Prohibition of Segregated Facilities (Apr

2015); (30) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246); (31) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212); (32) (i) 52.222-36, Equal

Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793); (33) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212); (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec

2010) (E.O. 13496); (35) (i) 52.222-50, Combating Trafficking in Persons (Nov

2021) (22 U.S.C. chapter 78 and E.O. 13627); (36) 52.222-54, Employment Eligibility

Verification (Nov 2021) . (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.); (44) 52.223-18, Encouraging

Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513);

(47) (ii) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a) Alternate I (Jan

2017) of 52.224-3; and (58) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) (31 U.S.C. 3332).

The Contracting Officer has indicated the following clauses listed in paragraph (c) as applicable and are hereby incorporated by reference: (1) 52.222-41, Service Contract

Labor Standards (Aug 2018) (41 U.S.C. chapter67); (2) 52.222-42, Statement of

Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and

41 U.S.C. chapter 67); (3) 52.222-43, Fair Labor Standards Act and Service Contract

Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug

2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67); (7) 52.222-55, Minimum Wages Under

Executive Order 13658 (Nov 2020); and (8) 52.222-62, Paid Sick Leave Under Executive

Order 13706 (Jan 2017) (E.O. 13706).

https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-3#FAR_52_222_3 https://www.acquisition.gov/far/52.222-21#FAR_52_222_21 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/52.222-37#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-54#FAR_52_222_54 https://www.acquisition.gov/far/22.1803#FAR_22_1803 https://www.acquisition.gov/far/52.223-18#FAR_52_223_18 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.232-33#FAR_52_232_33 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3332&num=0&edition=prelim https://www.acquisition.gov/far/52.222-41#FAR_52_222_41 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-42#FAR_52_222_42 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-43#FAR_52_222_43 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-55#FAR_52_222_55 https://www.acquisition.gov/far/52.222-62#FAR_52_222_62

(xiii) The following additional clauses are applicable to this acquisition: Option to Extend the Term of the Contract (Mar 2000); HHSAR 352.203-70 Anti-lobbying (DEC

2015); HHSAR 352.208-70 Printing and Duplication (DEC 2015); HHSAR 352.222–

70 Contractor Cooperation in Equal Employment Opportunity Investigations. (DEC

2015); HHSAR 352.224–70 Privacy Act (DEC 2015); HHSAR 352.224–71

Confidential Information (DEC 2015); and HHSAR 352.232-71 Electronic

Submission of Payment Requests (Feb 2022).

(xiv) DPAS – N/A

(xv) “Quote” and “Offer” shall mean one and the same.

(xvi) Quotes are due by March 4, 2022 2:00 PM Eastern Time, electronically to the Contract

Specialist at Dan.Berkovitz@psc.hhs.gov.

(xvii) Contact Mr. Dan Berkovitz, Contract Specialist, at Dan.Berkovitz@psc.hhs.gov regarding the solicitation. Any inquiries must be emailed to the Contract Specialist, with

“Solicitation 75P00122R00022 – Enterprise Mail Solution” in the subject line.

mailto:Dan.Berkovitz@psc.hhs.gov mailto:Dan.Berkovitz@psc.hhs.gov

Solicitation No. 75P00122R00022

Attachment No. 1

TITLE: ENTERPRISE MAIL SOLUTION

SECTION C - Description/Specifications/Statement of Work

C.1 PROGRAM DESCRIPTION AND BACKGROUND

Introduction

The Program Support Center (PSC) is a shared service provider to the federal government.

Hosted by the U.S. Department of Health and Human Services (HHS), PSC provides customers support services focused on their non-core requirements — so they can focus on their core missions. Currently HHS PSC utilizes an enterprise multi-carrier mailing system manufactured by Pitney Bowes called SendSuite© that has both an inbound and outbound module. HHS PSC requires a brand name or equal to the SendSuite© system that must be listed on the FedRAMP

Marketplace with a designation of “In Process” or “Authorized” compatible with existing Pitney

Bowes equipment. The requirement is for a FedRAMP compliant cloud data storage system with necessary components to include software and peripherals to support mail metering capability, inbound/outbound mail tracking, and maintenance for a period of 60 months: one 12-month base period with four 12-month option periods that will be integrated with the current

Pitney Bowes equipment and mailing systems that will not be replaced at this time. HHS PSC has invested a significant amount of time and resources in the deployment of the current enterprise mail solution and, at this time, does not require a full replacement of all systems and equipment.

Background

Pursuant to 44 U.S.C. § 2904, GSA has issued regulations requiring all Executive Agencies to adopt commercial payment processing to pay postage costs and to ensure that mail costs are identified at the agency program level. See 41 C.F.R. § 102-192-50 et seq. To meet this requirement, Health and Human Services – Program Support Center (HHS - PSC) intends to order solutions capable of meeting all of the requirements of this Statement of Work (SOW). An award will be issued for a FedRAMP compliant cloud data storage (inbound/outbound functionality as well as all postage services) system with necessary components include peripheral equipment such as handheld tracking assistants, mail metering capability, inbound/outbound mail tracking, and maintenance for a period of 60 months-- one 12-month base period with four 12-month option periods.

Program Goals and Objectives

A. The objective of this Statement of Work (SOW) is to obtain the services and equipment to maintain the currently deployed HHS-PSC mail and package system which includes a vendor supplied FedRAMP data hosting system for both inbound and outbound enterprise mail functionalities that will fully integrate with the current Pitney Bowes mailing systems where applicable. FedRAMP applications to be used for a single postage reporting and funding for all HHS PSC supported locations for both Official Mail

Accounting System (OMAS) and Commercial to include all virtual and physical meters.

All physical and virtual commercial meters shall be funded using a single USPS Trust

Account. Federal funds for postage are not to be held by the postage meter manufacturer as per US Department of Treasury Notice for requirement’s for using depositaries to hold public money, Chapter 4100 Section 4130. In addition, no postage for all meters

(physical and virtual) can be accepted by the Government with the vendor billing for postage used.

B. Included in the requirements will be: (i) secure vendor supplied FedRAMP authorized data hosting service and Software as a Service (SaaS) application with a FedRAMP

Marketplace designation of “In Process” or “Authorized” (vendor is required to supply cloud services certification with offering); (ii) components available on a GSA schedule necessary to meet regulatory and performance requirements that are compatible with and can be integrated to the existing enterprise mail solution; and (iii) initial startup supplies for peripherals, as needed.

C. Reducing carrier charges and overhead costs while protecting data in a secure environment are key components of this effort. The system shall include rate shopping capabilities that enable the mail system operator to choose the most economical mail carrier and class from HHS-PSC approved carriers. Average monthly usage for each

Authorized User (“User”) will be used to determine the appropriate component configuration for each site.

C.2 STATEMENT OF WORK - Severable Services

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified herein), and otherwise do all the things necessary for or incident to the performance of the work as set forth below:

C.2.1 GENERAL REQUIREMENTS

1. On behalf of Users, HHS PSC will obtain new, unused, non-refurbished, non-remanufactured, inbound mail tracking with associated components for incoming mail and outgoing mail. HHS-PSC will not accept used, remanufactured, or refurbished components. This applies to all components of the system as well as to all connectivity components. Peripherals must be compatible with and accredited to interface with the proposed FedRAMP solution.

2. For those User locations that currently utilize equipment and an enterprise software application that is compatible with the current HHS PSC system, only those components required to extend the enterprise-wide HHS-PSC objective will be acquired. The utilization of existing compatible components will conserve HHS-PSC and User fiscal resources.

3. The contractor shall install and set up the new system at each HHS-PSC User location providing connectivity to the FedRAMP cloud data storage, supplies, preventive and problem maintenance for the system, rate-changes, software updates, training and customer support services.

4. The system shall accurately weigh, rate, meter, and account for all outbound mail and parcels. All systems supplied shall have postage meters with remote setting capability that permit postage replenishment and maintenance. HHS-PSC will provide a User supplied network connection. The contractor shall provide a system that can connect online through this network. To meet network security requirements, all contractor supplied components and software must meet security requirements as set forth in this document.

5. RESERVED

6. The system will support Okta password protected security features (Single Sign On) to prevent unauthorized use. The software application connecting all components of the system for reporting purposes must be Federal Information Processing Standards (FIPS) compliant. In addition, the system must be able to be configured using government furnished PC workstations or contractor supplied PC workstations at the User’s Location as noted below.

7. The system must meet federal accessibility requirements as contained in Section 508 of the Rehabilitation Act of 1973, as amended.

8. Termination of service to a location shall be in accordance with the terms and conditions of the contractor’s GSA Multiple Award Schedule contract.

9. Network Security – In order to maintain security and ensure that data entered into and stored by the system are kept confidential, the system must support the following requirements:

a. The URL web link that connects the various HHS-PSC User locations must be a port

443 Secure Socket Layer connection. URL is unique to the FedRAMP application.

In addition, vendor must have an existing FedRAMP ATO – Authority to Operate issued by Health and Human Services with a designation on the FedRAMP

Marketplace as “Authorized” or “In Process”. On premise solutions will not be accepted.

b. The data must be consolidated by each HHS-PSC User location into one report on a real-time (current-time) basis meaning that at any point in time, the User and only the

User can immediately create a report on postal and carrier activity across all User locations for all UPS, FedEx, DHL and USPS to include all physical and virtual meters (OMAS and Commercial Meters). In addition, system must display in real-time (current time) the current unused postage for all postage meters (physical and virtual) and carriers on a single report.

c. The mail data must be captured, and all applications supported via a contractor supplied hosting facility. Contractor shall provide details on the hosting center security, redundancy, failover and operations.

d. Contractor must supply to HHS-PSC, when requested, annual third-party audits for

Payment Card Industry (PCI) and vulnerability testing of the hosting facility.

e. The mail data consolidation program must be web-based with all administration, backup and redundancy the responsibility of the contractor. Failover disaster recovery sites for cloud services must be physically separated by over 750 miles.

f. All data collection must happen on a real-time (current-time) basis without any HHS-

PSC operator intervention at any of the User locations.

g. All carrier rate updates for the system shall be performed by the contractor via a web-based application.

h. The system must support enterprise business rules configuration and enforcement so as to reduce carrier costs and associated services without compromising on delivery services.

i. Cloud-based data hosting services shall be FedRAMP certified and must have received at least an “In Process” or “Authorized” designation from either the Joint

Authorization Board or another U.S. Federal Executive Branch Agency listed on the

FedRAMP Marketplace at time of offer submission. The system’s cloud-based data hosting services must meet the applicable additional requirements for cloud computing documented in NIST SPs 800-144, 800-145 and 800-146.

j. The contractor shall create and implement policies, processes and procedures to address the system’s security requirements needed for disaster recovery in the event of a disruption. This includes regular review and testing of a disaster recovery plan(s) related to recovering the information service(s) provided. Results of all disaster recovery plan tests, exercises or actual events, including but not limited to after-action reports, lessons learned, and plan updates will be made available to HHS-PSC for review within ten (10) working days of a request by HHS-PSC. Furthermore, HHS-

PSC will be provided a point of contact for disaster recovery planning and exercise.

The contractor shall invite participation from the HHS-PSC during tests.

k. Data hosting shall include backup and failover of FedRAMP services with hosting centers to be located in the United States and be geographically separated by over 750 miles.

l. Postage Funding – Applies to all postage (virtual (PC Postage) and that are included in this requirement) HHS PSC supports a wide range of Federal Agency’s and as such, requires the enterprise system to be able to simultaneously support through a single enterprise application both OMAS and Commercial Postage funding for both physical and virtual meters. This includes one system that will support multiple

USPS OMAS Agency codes. HHS PSC will not accept having to fund separate commercial postage accounts or subscriptions. All commercial virtual meters shall be funded only by a single USPS Trust Account. The FedRAMP enterprise reporting must have one reporting database that collectively reports on all

OMAS/Commercial metering devices that are both physical and virtual meters serviced by HHS PSC. In addition, the system must have the ability to process 1st class letter postage (virtual meter) for desktop users, in both OMAS and Commercial

Payment as described above using one centralized managed HHS PSC funds for the various Federal Agency supported under this contract.

10. Where noted for specific locations, the requirement is to interface the FedRAMP outbound module to the existing mailing system.

(1) FedRamp Outbound User (SaaS); and

(2) PC Workstation where noted as required. If not noted, it shall be

Government furnished.

C.2.2 OPERATOR TRAINING

1. The contractor shall provide system training at User sites to at least one key operator and one alternate for each system installed. This training shall cover, at a minimum, the following operations: proper operation of the system’s components, replacement and ordering of supplies, performance of routine tasks such as daily maintenance, adding money to the meter, locating a component’s model and serial numbers, meter serial number, and placing a service call.

2. The contractor shall provide and complete key operator training within two days of the system’s installation. The contractor shall schedule training in coordination with the local User office manager or assigned key operator as designated by the User.

C.2.3 SUPPLIES

1. The contractor shall provide, at time of delivery, the initial 10 business day stock of supplies sufficient for the installed peripheral equipment. The supplies shall include labels.

a. Letter and flat shipments - The contractor shall provide labels needed to apply postage to any item processed in the main mailroom location.

b. Package shipments. The contractor shall provide all label related supplies for packages processed at each location with the installed system.

2. As an option, the contractor shall provide a price list for consumable supplies that would be applicable to systems and peripherals. These supplies may be purchased and delivered to location(s) supported by HHS PSC.

C.2.4 COMPONENT REQUIREMENTS

1. INBOUND TRACKING

1. San Francisco, CA

2. Atlanta, GA

3. Chicago, IL

4. Boston, MA

5. Kansas City, MO

6. New York, NY

7. Philadelphia, PA

8. Dallas, TX

9. Seattle, WA

10. Denver, CO

Locations 1-10 listed above will get a refresh to the tracking assistants and software as listed below:

QT

Description

1 Tracking Assistant

1 Single Bay Cradle

1 Inbound FedRAMP User

2. Washington, D.C. HHS

Location listed above will get a tracking assistants and software as listed below:

3 Tracking Assistant

1 Single Bay Cradle

3. Rockville, MD

Location listed above will get a refresh to the tracking assistants and software User (SaaS) as listed below:

10 Tracking Assistant

2 Four Bay Cradles

2 Belt Printers

4. RESERVED (site closed)

5. Baltimore, MD – CMS

Location CMS listed above will get the tracking assistants and software as listed below:

5 Tracking Assistant

1 Four Bay Cradle

Specific to this location:

SendPro 360 (or equal) must function with SWIFT Digital Mail.

To support requests for paper delivery, the SWIFT system will be set-up to allow mail recipients to request physical mail from the Mail Center and generate a unique SWIFT carrier code. The

Mail Center will then be able to manually enter this information into SendPro 360 tracking as a received package and execute the current accountable mail delivery process. SWIFT DM will be added as a carrier option to the drop-down selection in SP360, or equal, tracking to identify the delivery as a SWIFT DM physical mail delivery in the SP360 transaction logs.

In order to provide CMS centralized status tracking and reporting of accountable and physical mail delivery in SWIFT a periodic standardized file transfer from Pitney Bowes SP360 tracking to the SWIFT DM system will be managed by a system operator. Pitney Bowes SP360 tracking will create a csv export of SWIFT DM delivery transactions for uploading into the SWIFT DM solution.

6. CDC Atlanta, GA

1 FedRAMP Interface to existing mailing machine

3 Tracking Assistant

1 Five Bay Cradle

1 Inbound FedRAMP User

1 Wedge Scanner

1 Laser Printer

2 Label Printer

1 Outbound FedRAMP User

2 PC Workstations – to support

1 inbound station and 1 outbound station

7. Outbound Processing to include UPS, USPS (with Intelligent Mail® Package Barcode

(IMpb) Schedule 48) and FedEx

43 Locations with existing Pitney Bowes P1000’s and P3000’s

• Existing Postal metering hardware is only 3 years old and has not reached end of life and shall not be replaced. Proposed solution shall integrate with existing mailing machine and associated peripherals such as scales and label printers.

• System shall report on usage for all carriers supported

• Computer is Agency supplied (Government Furnished

Equipment (GFE)) 3 FedRAMP Desktop Users

• Computer is Agency supplied (GFE)

8. Outbound Processing to include UPS, USPS (w/IMpb Schedule 48) and FedEx

130 Locations with existing Pitney Bowes DM475

• Existing Postal metering hardware is only 3 years old and has not reached end of life and shall not be replaced. Proposed solution shall integrate with existing mailing machine and associated peripherals such as scales. Offering to include label printers for each location that can print IMpb, FedEx and UPS.

• Agency shall supply updated image to remove IE and replace with

Agency approved browser such as Chrome.

• System shall report on usage for all carriers supported

9. FedRAMP security controls (for 1. through 8. above)

At a minimum, system shall contain the following:

• Anti-virus / Anti-Malware

• Security Vulnerability Scanning

• Pen Testing (enhanced scope / attach vectors for FedRAMP)

• Data encryption in transit and at rest

• Monitoring and alerting

• Incident Response

• Disaster Recovery

• Static and Dynamic Code Scanning

• Advanced Firewall

• Strong Key Management

• FIPS Modules

• Center for Internet Security (CIS) hardened images

System shall offer FedRAMP controls as listed above designed for agencies and have an

Authority to Operate certification on the software under the Federal Risk and Authorization

Management Program (FedRAMP) issued by HHS. System shall have a Security Plan (SSP) across 17 control families and 325 controls as well as additional policies, procedures, plans and artifacts totaling over 50 documents. System shall also comply with the FedRAMP continuous monitoring and evidencing requirements and provides the purchasing agency the ability to participate in monthly continuous monitoring meetings with the vendor. At time of offering submission, system shall be FedRAMP listed as "in process" or “authorized” in the FedRAMP marketplace.

10. Additional instance of SaaS Solution with FedRAMP security controls

65 Locations with existing Pitney Bowes Meters

• Existing Postal metering hardware. Proposed solution shall integrate with existing mailing machine and associated peripherals such as scales that are compatible with salient characteristics of the SaaS requirements

(inbound/outbound/analytics). Offering to include label printers/scales for each location that can print IMpb, FedEx and

UPS where existing peripherals are not compatible.

• Agency shall supply updated image to remove IE and replace with Agency approved browser such as Chrome.

• System shall report on usage for all carriers supported

• Support PC postage in low volume locations.

At a minimum, system shall contain the following:

• Anti-virus / Anti-Malware

• Security Vulnerability Scanning

• Pen Testing (enhanced scope / attach vectors for FedRAMP)

• Data encryption in transit and at rest

• Monitoring and alerting

• Incident Response

• Disaster Recovery

• Static and Dynamic Code Scanning

• Advanced Firewall

• Strong Key Management

• FIPS Modules

• CIS hardened images

System shall offer FedRAMP controls as listed above designed for agencies and have an

Authority to Operate certification on the software under the Federal Risk and Authorization

Management Program (FedRAMP) issued by HHS. System shall have a Security Plan (SSP) across 17 control families and 325 controls as well as additional policies, procedures, plans and artifacts totaling over 50 documents. System shall also comply with the FedRAMP continuous monitoring and evidencing requirements and provides the purchasing agency the ability to participate in monthly continuous monitoring meetings with the vendor. At time of offering submission, system shall be FedRAMP listed as "in process" in the FedRAMP marketplace.

C.2.5 TECHNOLOGY SUBSTITUTION

HHS-PSC’s requirement for the acquisition of solutions extends over several years, a time period which may exceed the technological useful life of the system initially acquired. It may be in the best interest of HHS-PSC and the contractor to mutually agree to substitute components for newer technology, or some portion thereof, if the conditions below are satisfied:

1. The component(s) substituted shall be fully compatible with the originally acquired system.

2. The component(s) substituted shall meet or exceed the technical capability of the original acquired system.

3. The component(s) substituted shall be field proven and off the shelf configurations.

4. The price of the component(s) substituted, including maintenance services, shall be equal to or lower than that originally acquired component and available on the GSA Schedule.

5. The contractor shall agree to all terms and conditions, equal to or more favorable to HHS-

PSC for the substituted component(s).

6. The substitution of component(s) will be by mutual agreement of HHS-PSC and the contractor.

C.2.6 LETTER PROCESSING

1. The system may include an inbound station to process the incoming mail along with a tracking system. Inbound mail tracking systems for additional User locations. The inbound mail tracking system must be maintained by contractor in a secure data hosting facility supporting the same network security characterized as outlined in Section 10 below.

2. The contractor shall provide new, non-refurbished components capable of generating codes used by the USPS for Delivery Confirmation, Signature Confirmation and Certified

Mail. The system must support and print USPS Intelligent Mail Package Barcode

(IMPB) labels.

3. All postage meters shall automatically advance to the correct date without operator intervention to avoid posting material with the incorrect date.

C.2.7 PACKAGE PROCESSING

1. The contractor shall provide systems that accommodate a minimum of UPS, FedEx and

USPS inclusive of rate shopping capability with meter rental. When comparing rates in order to provide an accurate comparison it is a requirement that the system show the latest and lowest rates provided by the USPS to federal agencies known as Schedule 48 rates. This requirement applies to all sites supported by this contract.

2. When shopping rates it is a requirement that the equipment and associated technology when comparing rates between carriers use the lowest prices offered to federal agencies pursuant to the US Postal Service GSA Schedule 48 Contract and United Parcel Service

GSA Schedule 48 including but not limited to Commercial Plus Pricing to make the comparison.

3. Each system shall perform rate shopping within specified parameters, to include, but to not be limited to: delivery by a specified date, by a specified time, by next business day, by next day, within two days, within three days, or via standard ground transportation.

4. The contractor shall provide new peripheral components to process packages weighing up to 70 pounds for identified locations.

5. Contractor shall assure that an electronic manifest and summary printout can be produced, when needed, in accordance with each carrier's specifications. This includes the printing of carrier compliant labels as required.

6. The contractor shall provide new components capable of generating codes used by commercial carriers for package tracking and delivery confirmation.

7. The system shall have the ability to print postage from $.01 to $999.99 in value.

C.2.8 MAILROOM

Incoming Accountable Mail - Accountable mail includes certified and registered mail as well as any overnight item delivered to the mailroom.

1. The contractor shall provide, at specified locations, new, non-refurbished components to process and track incoming accountable mail. The components shall produce a delivery label with the current location of the employee.

2. The contractor provided system shall also track and verify package delivery within the

User location with peripherals that fully integrate with existing SendSuite.

3. The contractor shall provide a system that identifies each individual that handles accountable mail. A file shall be produced and be made accessible for audit purposes, which contains the date, time, and name of each such person handling this mail, including the final recipient.

4. Contractor shall provide a system that shall confirm delivery on all accountable mail. The incoming accountable mail component shall have the capacity to store up to 500 delivery transactions with signatures, weigh not more than 16 oz., have a laser scanner, and shall have passed a drop test of 4 feet.

a. Inbound Accountable Mail Network Security – In order to maintain security and ensure that User systems and data are kept confidential, the offered system must support the following requirements:

(1) The URL web link that connects the various User locations must be a port 443

Secure Socket Layer connection.

(2) The data must be consolidated by each location into one report on a real-time

(current time) basis meaning that at any point as applicable, the User can immediately pull a report on inbound carrier activity across all locations.

(3) User mail data must not be comingled with data from any other User or commercial business.

(4) The data must be captured, and all applications supported via a contractor supplied hosting facility. Contractor must provide details on the hosting center security, redundancy, failover and operations.

(5) Contractor must provide HHS-PSC annual third-party audits for PCI and vulnerability testing of hosting center as requested by HHS-PSC.

(6) Data consolidation program must be web based with all administration, backup and redundancy the responsibility of the contractor

(7) All data collection must happen on a real-time (current time) basis without any

User operator intervention at any of the mailing locations.

(8) All carrier rate updates shall be updated on the web-based system by the contractor outside the firewalls of the Government.

(9) The system must support enterprise business rules configuration and enforcement for the utilization of carriers and the associated services in order to reduce costs without compromising on delivery services.

(10) Inbound system must be FIPS compliant.

(11) Hosting centers must be located in the United States and application must be

FedRAMP certified with a designation listed on the FedRAMP Marketplace of

“In Process” or greater.

C.3 INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

REQUIREMENTS

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of

“information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the

HHS Information Security and Privacy Policy (IS2P), by contacting the Contracting Officer

(CO)/Contracting Officer’s Representative (COR) or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to

Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High

Integrity: [ ] Low [X] Moderate [ ] High

Availability: [ ] Low [X] Moderate [ ] High

Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB)

Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with

Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be: a.

marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Information Systems and Organizations if handled by internal

Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-

88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability.

The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive

Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and policies. Unauthorized disclosure of information will be subject to the HHS sanction policies and/or governed by the following laws and regulations: a. 18 U.S.C. 641

(Criminal Code: Public Money, Property or Records); b. 18 U.S.C. 1905 (Criminal Code:

Disclosure of Confidential Information); and c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork

Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict

Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS…