88310319Q00036_RFQ.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for

Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is 88310319Q00036 and is issued as a

Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-01 effective December 20, 2018.

This is a full and open RFQ under NAICS code 424120, Stationary and Office Supplies

Merchant Wholesalers. CONTRACT LINE ITEM NUMBER(S): See Attachment 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain Integrated Label Forms. See Attachment 2, Requirements. PERIOD OF

PERFORMANCE: The period of performance will consist of a base year and four (4) option years. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions, which will be removed prior to award: FAR provision 52.212-1, Instructions to Offerors -

Commercial Items (Oct 2018). Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 30 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation. Addenda: Delete paragraph

(h), Multiple Awards. - see below for additional quotation submission instructions.

EVALUATION (In lieu of FAR provision 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Items as prescribed by FAR 12.301(c)(2).

Selection of the Contractor for this Indefinite Delivery Indefinite Quantity (IDIQ) contract will be based on NARA’s assessment of the best overall value to the Government. Accordingly, best value for this contract will be obtained through a lowest priced technically acceptable evaluation.

Acceptability will be determined by accessing the Contractors ability to provide the requirement outlined in the solicitation. The Contractor will be evaluated to assess the demonstrated quality of performance on similar work, to include the ability to control the quality and cost of work, timeliness of performance, and effectiveness at accomplishing the goals of previous relevant work. Contractors are requested to submit no more than three (3) references for relevant past performance performed during the past five (5) years. Submission should include the entity name, a point of contact, contact information, dollar value of contract/order, brief description of work performed, and an explanation of how any performance difficulties were addressed and resolved. If the interested Contractor has no relevant past performance, an affirmative statement that no relevant past performance exists must be submitted. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the

Contractor’s quotation entitled “Exceptions”. The Contractor must also include a justification and the cost impact of each exception noted. However, Exceptions may render the quotation unacceptable for award. The Government reserves the right to make an award on the initial quotation without communicating with contractors. For evaluation purposes, the total ceiling price for each not-to-exceed Contract Line Item Number (CLIN) will be determined by multiplying the maximum quantity by the firm-fixed unit price. The total ceiling price for each performance year will be determined by summing the total ceiling prices of each CLIN. The evaluated total contract ceiling price will be determined by summing the total ceiling price of all performance years (base year and all option years). FAR provision 52.212-3, Offeror

Representations and Certifications - Commercial Items (Oct 2018) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision. FAR clause 52.212-4, Contract Terms and Conditions - Commercial Items (Oct

2018) – see Attachment 4, Additional NARA Terms and Conditions (Addenda to FAR clause

52.212-4). FAR clause 52.212-5, Contract Terms and Conditions Required to Implement

Statutes or Executive Orders - Commercial Items (Jan 2019) - see Attachment 5, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. Full text provisions and clauses can be found at http://www.acquisition.gov. QUOTATION DUE DATE: Quotations must be received by 12:00 PM ET on March 21, 2019. Failure to submit quotations by the due date and time may result in rejection of the quotation as untimely. Contractors submitting via e-mail are cautioned to allow one extra business day for delivery and confirm receipt of quotation as the e-mail will need to pass through IT security. QUOTATION SUBMISSION

INSTRUCTIONS: NARA request that contractors email one (1) copy of the quotation to diane.harding@nara.gov. Contractors must submit a complete copy of Attachment 1, Schedule of

Prices with its quotation along with relevant past performance. The contractor’s quotation will be considered technically unacceptable without providing this documentation https://www.sam.gov/ mailto:diane.harding@nara.gov

NARA - 88310319Q00036 – Integrated Label Forms

ATTACHMENT 1

SCHEDULE OF PRICES

Base Year: April 1, 2019 - March 31, 2020

Option Year I: April 1, 2020 - March 31, 2021

Option Year II: April 1, 2021 - March 31, 2022

CLIN Description Unit Min. Qty Max Qty Firm-Fixed

Unit Price

Total

0001 Provide Integrated Label Forms in accordance with Attachment

2, Requirements.

Each

112,500

450,000

NTE

0002 RESERVED

TOTAL BASE YEAR CEILING PRICE

Unit Price

Total

0003 Provide Integrated Label

Forms in accordance with

Attachment 2, Requirements.

0004 RESERVED

TOTAL OPTION YEAR I CEILING PRICE

CLIN Description Unit Min.

Qty

Max Qty Firm-Fixed

Unit Price

Total

0005 Provide Integrated Label

0006 RESERVED

TOTAL OPTION YEAR II CEILING PRICE

Option Year III: April 1, 2022 - March 31, 2023

Option Year IV: April 1, 2023 - March 31, 2024

Notes:

1. Shipping Costs: Contractor shall include the shipping cost in the firm-fixed unit price.

2. Mark for instructions: Contactor shall clearly print Mark for Instruction in addition to the

Delivery Address on shipping container address labels.

Unit Price

Total

0007 Provide Integrated Label

0008 RESERVED

TOTAL OPTION YEAR III CEILING PRICE

Unit Price

Total

0009 Provide Integrated Label

Attachment 2, Requirements

0010 RESERVED

TOTAL OPTION YEAR IV CEILING PRICE

TOTAL CONTRACT CEILING PRICE

ATTACHMENT 2

REQUIREMENTS

ARCIS INTEGRATED LABEL FORM (ILF)

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) serves American

Democracy by safeguarding and preserving the records of our Government, ensuring that the people can discover, use, and learn from this documentary heritage. NARA ensuring continuing access to the essential documentation of the rights of American citizens and the actions of their government. NARA supports democracy, promotes civic education, and facilitates historical understanding of our national experience.

1.2 NARA supports lifecycle management of records in all three branches of the Federal

Government and provides sustained access to historically valuable records at NARA and the

Presidential Libraries. In support of its mission, NARA has established a Federal Record Centers

Program (FRCP) that provides high-quality, cost-effective storage and servicing of temporary textual records in Federal Record Centers (FRCs) located throughout the United States.

1.3 The FRCP has been in existence since the early 1950s, however under the direction of the

Office of Management and Budget (OMB), NARA instituted a fee-for service revolving fund on

October 1, 1999, for its records centers' storage and servicing operation. There are 18 facilities throughout the United States; total holdings of approximately 29 million cubic feet of records; 11 million reference requests serviced annually; 18,000 tons of paper recycled annually;

professional staff of approximately 1,100 Federal employees; and nearly 400 Federal agency customers.

1.4 The FRCP uses an IT system called Archives and Records Center Information System

(ARCIS) to support the management and operations of NARA’s vision to become the records center service provider of choice for the Federal Government.

1.5 ARCIS uses Siebel CRM software to support streamlined business processes. ARCIS is used as a tracking mechanism. It uses barcodes to manage space inventory, manage assets, and provide transaction control.

2.0 OBJECTIVE

2.1 NARA requires the services of a Contractor to develop and provide blank Integrated

Label Forms (ILFs) to be used in conjunction with the ARCIS application throughout the Federal

Record Centers FRCP.

2.2 An ILF is a business form having a removable label. The label is made from a paper ply and a piece of transfer tape.

3.0 DESCRIPTION OF REQUIREMENT

3.1 The Contractor shall design, develop, and produce the standard ILF (Base Year) and manufacture ILFs to meet specifications as shown in the ILF specifications. ILFs must be printed on the printer (or similar) as shown in laser printer specifications; and

3.2 Design or modify ILFs (Option Years). During the term of the contract, FRCP business needs will require the ILF to be redesigned or new ILFs created. The FRCP may need an ILF that is (5.5 inches by 8.5 inches) with a smaller peelable label. The Contractor must design new

ILFs to meet NARA business requirements including manufacture and supply in accordance with the Requirements. The Contractor must deliver five (5) samples of the redesigned or modified

ILFs within thirty (30) days of receiving the request.

3.3 The Contractor must maintain an inventory of all ILFs and provide re-design of ILFs, if needed.

4.0 INTEGRATED LABEL FORM (ILF) SPECIFICATIONS

4.1 An Integrated Label Form (ILF) is a business form with a removable label. It is the combination of a label and a form as one unit. The label/form is made from paper ply and a piece of transfer tape. The adhesive face of the transfer tape is attached to the paper ply rear face, with the side edges of transfer tape between the tractor openings inside the paper ply. At least one die cut is formed in the paper ply front face to define, with adhesive from the transfer tape.

4.2 The ARCIS ILF label measures 5.0 inches wide by 2.5 inches high. It is centered near the bottom of the form, measured at 8.5 inches by 11 inches.

4.3 The ILF differs from standard printing paper or (standard labels), only the die cut label has adhesive behind it. A typical use for this type of sheet is printing a packing slip on the portion of the sheet and a shipping address on the label portion.

4.4 ARCIS uses the ILF to print forms to retrieve records from record holding areas. The label is removed from the ILF and attached to the folder or box. The form (minus the label) is put into the place where the record was removed, as a charge-out card.

4.5 Integrated Label Form Specifications

4.5.1 Face Stock paper

General -Printer type Tested to work without jamming with a workgroup laser printer

HP LaserJet P4515tn Printer (CB515A) or equal

General -Ink specifications Tested to work with a laser printer black toner cartridge without smearing.

HP LaserJet CC364X Black Print Cartridge

(CC364X) or equivalent

Size 8.5 inches by 11 inches

Face Paper 32lb white ledger 92 brightness laser qualified paper with toner adhesion coating to enhance anchoring of laser toner

Parts One part

Packing 250 per shrink wrap and 500 forms per carton

4.5.2 Label

Size One label with dimensions that are 5.0 inches wide by 2.5 inches high with rounded corners. See below for label placement

Location The label is centered on the face paper width at 0.75 inches from the bottom of the face stock

Adhesive Aggressive Permanent Acrylic with no adhesive ooze. (Label guaranteed to adhere to material substrate for 5 years and beyond)

Liner Material/Release coating Backing sheet completely coated with a release coating of silicone with enough thickness to allow deliberate manual peel-off from the label and to prevent accidental peel-off of the label from the backing sheet

4.6 Integrated Label Form Print Sample

4.7 LASER PRINTER SPECIFICATIONS

4.7.1 Laser Printer

Specification Type Description

Product Class Workgroup laser printer

HP LaserJet P4515tn Printer (CB515A) or equal

Time to first page 8.5 seconds

Speed 50 ppm (both ILF's and paper bond paper)

Duty Cycle* 250,000 pages per month

*Footnote for duty cycle Duty cycle is defined as the maximum number of pages per month of imaged output.

Print resolution 1200 dpi

Color Black

Connectivity Gigabit Ethernet

Input capacity (minimum) Up to I,I00 sheets (Multipurpose Tray: up to 100 sheets; Tray 2: up to 500 sheets;

Tray 3: up to 500 sheets)

Input capacity expansion Up to 3,600 sheets

Paper Types Supported Paper (bond, color, letterhead, plain, preprinted, pre-punched, recycled, rough), envelopes, labels, cardstock, transparencies, Integrated label forms

Document finishing Sheetfed

Memory, standard I28 MB

Memory expandable to 640MB

Processor speed (minimum) 540 MHz

Print languages, standard HP PCL 6, HP PCL 5e, HP postscript level

3 emulation, direct PDF (v 1.4) printing

(with at least 128MB printer memory)

Connectivity, standard Embedded Jetdirect (Gigabit Ethernet) print server, I Hi-Speed USB 2.0, I EIO slot, 1 external and 2 internal Host USB

2.0-like ports for 3rd party connection

Connectivity, optional HP Jetdirect EIO internal print servers, HP

Jetdirect external print servers, HP wireless print servers, HP Jetdirect EIO connectivity card (for USB, serial, LocalTalk), Bluetooth wireless

Minimum system requirements PC: Windows 2000: 133 MHz processor, 64MB RAM, CD-ROM drive; Windows

XP Home and Windows XP Professional:

233 MHz processor, 64MB RAM, CDROM drive; Windows Server 2003: 550

MHz processor, 128MB RAM (standard edition), 220 MB of free hard disk space for Windows, 1 GHz processor, 512 MB

RAM (Windows Vista (TM) Ready, check user guide for minimum hard drive space);

CD-ROM drive or Internet connection, IEEE 1284-compliant bidirectional parallel port, USB 1.1, USB 2.0

Warranty, standard One-year

4.7.2 Toner Cartridge

Specification Type Description

Product Class Toner Cartridge HP LaserJet CC364X Black

Print Cartridge (CC364X) or equivalent

Compatible hardware HP LaserJet P4515 Printer series or equivalent

Toner cartridge Appropriate for printing on ILF (see

ILF specifications) that includes a toner adhesion coating without smearing

Cartridge color Black

Warranty, standard Product is warranted to be free from defects in materials and workmanship

5.0 ORDERS

5.1 ILFs shall be received within seven (7) business days of ordering.

5.2 Orders will include quantity ordered and delivery location. Upon shipment, Contractor will provide tracking information to the COR via email.

5.3 The Contractor must deliver to the address identified in Requirements, paragraph 5.5 within 30 days of the contract award.

5.4 DELIVERY

5.5 Address: National Archives and Records Administration (NARA), Federal Records

Center (FRC) NARA-KC FRC 8600 NE Underground DR., Pillar 300-G, Kansas City, Mo

64161.

ATTACHMENT 3

CONTRACT ADMINISTRATION

I. GOVERNMENT CONTRACT ADMINISTRATION

A. This contract will be administered by:

National Archives and Records Administration

Office of the Chief Acquisition Officer (Z)

8601 Adelphi Road, Room 3340

College Park, MD 20740-6001

B. Contract Specialist (CS):

See award document.

C. Contracting Officer (CO):

Any Warranted Z Contracting Officer.

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make a reference to the contract number and must be either emailed or mailed, postage prepaid, to the above address.

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decision regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. DESIGNATION OF CONTRACTING OFFICER'S REPRESENTATIVE (COR)

(a) COR: See award document.

(b) The individual named above is designated as the Contracting Officer's Representative (COR) to assist the Contracting Officer (CO) in the discharge of the CO's responsibilities. The COR is responsible for monitoring, giving progress reports to the Contract Specialist (CS), and overall technical surveillance of services to be performed under this contract and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the CO be effective or binding upon the

Government.

(c) When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the CO in writing.

(d) No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

(e) The responsibilities of the COR include, but are not limited to, the following:

(1) Serve as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO;

(2) Be responsible for the inspection and acceptance of the services performed and determining the adequacy of performance by the Contractor in accordance with the terms and conditions of this contract;

(3) Confer with representatives of the Contractor regarding any non-performance or unsatisfactory performance; follow through to assure that all non-performance or unsatisfactory performance is performed/corrected or payment adjustment is recommended to the CS/CO;

(4) Review and certify invoices in accordance with invoicing instructions of the contract.

Maintain a file with copies of these documents;

(5) Review and evaluate Contractor's deliverables;

(6) Advise the CS of any performance problems and make recommendations for corrective action to correct performance issues;

(7) Furnish the CS with any requests for change, deviation, or waiver (whether generated by Government personnel or Contractor personnel), including all supporting paperwork in connection with such change, deviation, or waiver; and

(8) Submit a written evaluation to the CS/CO within 60 days of contract completion. The evaluation should include:

(i) The quality and timeliness of the Contractor's performance; and

(ii) A statement as to the uses made of any deliverables furnished by the

Contractor.

III. INVOICE SUBMISSION REQUIREMENTS

a. The preferred method of invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury’s Bureau of Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

b. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via email at

AccountsPayable@fiscal.treasury.gov or by phone at (304) 480-8000, Option 7.

c. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by email to AccountsPayable@fiscal.treasury.gov. Microsoft Excel, Adobe

Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

d. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

e. For invoice and payment questions call the Fiscal Service Help Desk at (304) 480-8000, Option 7.

IV. INVOICE FREQUENCY

The Contractor shall invoice one-time for the full amount, upon complete delivery and acceptance of the items in the orders.

V. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the contract, other than claims in stated amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s claim to amounts payable under the contract has been assigned under the

Assignment of Claims Act of 1940, as amended (31 U.S.C. § 203, 41 U.S.C. § 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the contract is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

mailto:AccountsPayable@fiscal.treasury.gov mailto:AccountsPayable@fiscal.treasury.gov

ATTACHMENT 4

ADDITIONAL NARA TERMS AND CONDITIONS

(Addenda to FAR clause 52.212-4)

I. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED

UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE

INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic;

requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract. (2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the

Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the

Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the

Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal

Information Security Management Act data reviews, and access by agency Inspectors General

(IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG,

(1) access to any and all information and records, including electronic information, regarding a

Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contactor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the

Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the

SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal

Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s

Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-

Owned information technology assets at the direction of the Contracting Officer or Contracting

Officer’s Representative. Removal must be accomplished in accordance with standard

FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards.

Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

http://www.archives.gov/foia/directives/nara1608.pdf http://www.archives.gov/foia/directives/nara1608.pdf http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsFIPS.html

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the

Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s

General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any

Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require

Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by

NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the

Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the

NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA

Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the

Contractor.

II. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential.

Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this contract, the Contractor may have access to confidential information and communications, including but not limited to Personally

Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Contractor will preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting

Officer. Failure to comply with the provisions of this paragraph will be grounds for Termination for Cause and the Contractor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this contract.

(d) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this contract, the Contractor may have access to and use of data and information which may be considered proprietary by other contractors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this contract, would be adverse to the interest of NARA and these other contractors.

(f) Except as may be otherwise agreed to with these other contractors, the Contractor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other contractors other than as required in the performance of this contract; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Contractor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Contractor and these contractors which provides for greater rights to the Contractor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Contractor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this contract.

(i) The terms of this paragraph apply to all Contractor employees, subcontractors, and consultants and must be incorporated into any subcontract.

ATTACHMENT 5

FAR CLAUSES

I. FAR 52.212-4 - Contract Terms and Conditions (Oct 2018)

II. FAR 52.212-5 -- Contract Terms and Conditions Required to Implement Statutes or

Executive Orders -- Commercial Items (Jan 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or

Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or

Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and

Further Continuing Appropriations Act 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section

1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov

2015)

(4) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws

108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items

___ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41

U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and

Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

___ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract

Awards (Oct 2018) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-

117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C.

6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility

Matters (Oct 2018) (41 U.S.C. 2313).

___ (10) [Reserved]

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011)

(15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small

Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved]

___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C.

644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C.

637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637

(d)(4)).

___ (ii) Alternate I (Nov 2016) of 52.219-9.

___ (iii) Alternate II (Nov 2016) of 52.219-9.

___ (iv) Alternate III (Nov 2016) of 52.219-9.

___ (v) Alternate IV (Aug 2018) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-

Aside (Nov 2011) (15 U.S.C. 657f).

___ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15

U.S.C. 632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically

Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C.

637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned

Small Business Concerns Eligible Under the Women-Owned Small Business Program

(Dec 2015) (15 U.S.C. 637(m)).

___ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan

2018) (E.O. 13126).

___ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(28) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

___ (ii) Alternate I (Feb 1999) of 52.222-26.

___ (29) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

___ (ii) Alternate I (July 2014) of 52.222-35.

___ (30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29

U.S.C. 793).

___ (ii) Alternate I (July 2014) of 52.222-36.

___ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

___ (32) 52.222-40, Notification of Employee Rights Under the National Labor

Relations Act (Dec 2010) (E.O. 13496).

___ (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C.

chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-

Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential

Hydrofluorocarbons (Jun 2016) (E.O.13693).

___ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration

Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

___ (38) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun

2014) (E.O.s 13423 and 13514

___ (ii) Alternate I (Oct 2015) of 52.223-13.

___ (39) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014)

(E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42

U.S.C. 8259b).

___ (41) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products

(Oct 2015) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

___ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging while

Driving (Aug 2011) (E.O. 13513).

___ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

___ (44) 52.223-21, Foams (Jun 2016) (E.O. 13696).

___ (45) (i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

___ (ii) Alternate I (Jan 2017) of 52.224-3.

___ (46) 52.225-1, Buy American--Supplies (May 2014) (41 U.S.C. chapter 83).

___ (47) (i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (May

2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43).

___ (ii) Alternate I (May 2014) of 52.225-3.

___ (iii) Alternate II (May 2014) of 52.225-3.

___ (iv) Alternate III (May 2014) of 52.225-3.

___ (48) 52.225-5, Trade Agreements (Aug 2018) (19 U.S.C. 2501, et seq., 19 U.S.C.

3301 note).

___ (49) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the

Department of the Treasury).

___ (50) 52.225-26, Contractors Performing Private Security Functions Outside the

United States (Oct 2016) (Section 862, as amended, of the National Defense

Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

___ (51) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42

U.S.C. 5150).

___ (52) 52.226-5, Restrictions on Subcontracting Outside Disaster or…