RFQ__88310319Q00098_Records_Management_Training.docx

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is 88310319Q00098 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-03 effective July 12, 2019. This is a full and open RFQ under NAICS code 611430, Professional and Management Development Training. CONTRACT LINE ITEM NUMBER(S): See Enclosure 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain Records Management Training Services. See Enclosure 2, Performance Work Statement. PERIOD OF PERFORMANCE: The period of performance will consist of a base year and four (4) option years. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions, which will be removed prior to award: FAR provision 52.212-1, Instructions to Offerors - Commercial Items (Oct 2018). Addenda. (1) Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR provision 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Items as prescribed by FAR 12.301(c)(2). Selection of the Contractor for this BPA will be based on NARA’s assessment of the best overall value to the Government. NARA may award up to three (3) BPAs. Accordingly, best value for this BPA will be evaluated based on the following evaluation factors: (1) Technical Understanding and Approach (Volume I) The Government will assess the Contractor’s demonstrated technical knowledge and competence with regard to the Government’s requirements and program objectives; and approach to the work that the Contractor would have to perform under the prospective BPA. The Government will assess whether the Contractor exhibits adequate teaching techniques and approaches to meet BPA needs and provide effective and efficient services. (2) Personnel (Volume I).The Government will assess the suitability of the Contractor’s personnel (ie. qualifications and experience) who will provide courses as they relate to Records Management Training. The Contractor must also provide resumes of key personnel quoted under this effort. The Contractor must demonstrate how it will provide for the replacement of personnel. (3) Relevant Past Performance (Volume II). The Contractor will be evaluated to assess the demonstrated quality of performance on similar work, to include the ability to control the quality and cost of work, timeliness of performance, and effectiveness at accomplishing the goals of previous relevant work. Contractors are requested to submit no more than five (5) references for relevant past performance performed during the past five (5) years. If the interested Contractor has no relevant past performance, an affirmative statement that no relevant past performance exists must be submitted. (4) Price (Volume III) All technical factors are equal in importance. All evaluation factors other than cost or price, when combined, are more important than cost or price. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions”. The Contractor must also include a justification and the cost impact of each exception noted. The Government reserves the right to make an award on the initial quotation without communicating with contractors. FAR provision 52.212-3, Offeror Representations and Certifications - Commercial Items (Oct 2018) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u)) of this provision. FAR clause 52.212-4, Contract Terms and Conditions - Commercial Items (Oct 2018) – see Enclosure 4, Additional Terms and Conditions (Addenda to FAR clause 52.212-4). FAR clause 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (May 2019) - - see Attachment 4, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. FAR provision 52.217-5, Evaluation of Options (Jul 1990). The Contractor is required to be registered in the System for Award Management (SAM) and maintain registration until final payment in accordance with FAR provision 52.204-7, System for Award Management (Oct 2018). Full text provisions and clauses can be found at http://www.acquisition.gov. QUESTIONS: Questions regarding this RFQ must be submitted in writing to the Contract Specialist, Ms. Stephanie Tillman (Contractor) at Stephanie.tillman@nara.gov no later than 3:00 PM ET on August 9, 2019 to be considered. Questions submitted in any other manner will not be answered. Contractors are requested to group and submit questions in the same order found in the RFQ while making reference to the particular paragraph number. The Government will answer questions or requests for clarification via a written RFQ amendment. QUOTATION DUE DATE: Quotations must be received by 12:00 PM ET on August 22, 2019. Failure to submit quotations by the due date and time may result in rejection of the quotation as untimely. Contractors submitting via e-mail are cautioned to allow one extra business day for delivery and confirm receipt of quotation as the e-mail will need to pass through IT security. QUOTATION SUBMISSION INSTRUCTIONS: Past Performance Submissions should include the entity name, a point of contact, contact information, dollar value of contract/order, brief description of work performed, and an explanation of how any performance difficulties were addressed and resolved. NARA requests that contractors email one (1) copy of the quotation (Volumes I, II, and III) to: Stephanie.tillman@nara.gov.

NARA – 88310319Q00024- Secure Nontextual Disposal

ENCLOSURE 1

SCHEDULE OF PRICES

I. DESCRIPTION OF SERVICES

The purpose of this solicitation is to acquire Records Management Training services for the National Archives and Records Administration (NARA).

1.0 PRICING OF BASE YEAR

(a) The fixed hourly prices must include the fully burdened cost for delivering the services required by this BPA.

(b) Embedded Table. The Contractor must identify the appropriate labor category and the applicable “Fully Burdened Fixed Price Hourly Rate” that will be used to provide Records Management Training. The Contractor may add labor categories to the table as necessary. Deliverables are not separately priced. Rates should include the costs of deliverables.

2.0 PRICING OF OPTION YEARS

Option years will be priced using the procedure for pricing the base year.

3.0 SCHEDULE OF PRICES

(a) In accordance with this BPA, the Contractor must provide all services described herein (except as specified to be furnished by the Government in the PWS), and must plan, schedule, coordinate, and assure effective performance.

(b) For CLINs 0001, 0002, 0003, 0004, and 0005 insert in the table fully burdened fixed hourly rates. CLIN = Contract Line Item Number; PWS = Performance Work Statement; and NSP = Not Separately Priced.

NARA – 88310319Q00098 – Records Management Training

4.0 CONTRACT LINE ITEMS

CLIN

Vendor is to provide fixed priced rates for Records Management Training in accordance with the PWS.

Vendor is to provide fixed priced rates for Records Management Training in accordance with the PWS.

Vendor is to provide fixed priced rates for Records Management Training in accordance with the PWS.

Vendor is to provide fixed priced rates for Records Management Training in accordance with the PWS.

Vendor is to provide fixed priced rates for Records Management Training in accordance with the PWS.

ENCLOSURE 2

PERFORMANCE WORK STATEMENT

RECORDS MANAGEMENT TRAINING

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 The Permanent Records Capture (PRC) Team within the Office of the Chief Records Officer requires contractor support to provide training in electronic records management. The PRC team develops and implements methods, priorities, and strategies for transferring permanent records into NARA. The team collaborates with staff across NARA to address lifecycle issues and to identify and transfer eligible permanent records to NARA, and raises awareness of permanent records responsibilities within the Federal community. The team consists of ten full time employees located in Maryland, Virginia, New Jersey, Chicago, Boston, and San Francisco.

1.3 Electronic records provide a comprehensive documentation of essential government functions and information necessary to protect government and citizen interests; proper management is essential. Under the Federal Records Act, agencies are to manage the creation, maintenance, use, and disposition of records in order to achieve adequate and proper documentation of the policies and transactions of the federal government and effective and economical management of agency operations. Federal agencies are increasingly moving to an electronic environment rather than paper records. As the volume of electronic information grows, so does the challenge of capturing electronic records agencies create in various formats. While the PRC team has primarily been focused on capturing Federal records in analog formats the team needs to develop the skills to capture Federal records in electronic format.

2.0 SCOPE

NARA – 88310319Q00098 – Records Management Training The Contractor is tasked with ensuring that personnel assigned to the BPA have the skills, training, and qualifications necessary to perform this requirement. The Contractor shall provide training based on the topics listed below. Contractors shall work directly with the PRC Team to accomplish the training. Since the team is geographically dispersed the training should be given by an instructor on-line to deliver the required content to the participants through lecture, discussion, activities, and Q&A sessions. Delivery can be either through a vendor provided utility or NARA can provide the system and support to deliver the training.

3.0 TRAINING TOPICS / OBJECTIVES

3.1 Identify basic elements of a system containing electronic records:

3.1.2 Content (data/information)

3.1.3 Structure (e.g., hardware, media, format, coding language), and

3.1.4 Context (e.g., metadata, representational information, inputs, outputs).

3.2 Structure

3.2.1 Understand the distinction between, definition of and role of hardware, software, operating system, and coding language.

3.2.2 Understand how data can be presented or organized, including the terms: structured vs. unstructured data, relational database, primary key (in a relationship database), dynamic vs static data in e-systems, and flat file.

3.2.3 Understand different media types, the pros and cons of each, including the difference between magnetic tape (open-reel or tape cartridges) and disk storage, and CD-ROM.

3.2.4 Understand the definition of a file format.

3.2.5 Understand different format types, basic definition of what they are and what they look like, including: textual data (ASCII, EBCDIC, Unicode, XML); and scanned text (TIFF, JPEG).

3.2.6 Understand the distinction between and role of multiple parts of a file format (wrapper and codec) and see what they look like.

3.2.7 Understand what is compression and the difference between lossy and lossless.

3.3 Context

3.3.1 Metadata

3.3.2 Understand the definition and role of metadata to make e-records understandable and accessible over time.

3.3.3 Understand the fact that there are different types of metadata (e.g., xml, sgml).

3.3.4 Understand that standards groups have determined what should be the most basic or core set of metadata maintained for e-records, and what they are.

3.3.5 Understand the definition and role of representational information. Examples of different types of system documentation that generally exist. Describe a record layout, what it does, how fields relate to each other, and how to read it.

3.3.6 What is a schema, what it does, when it’s used (currently for structured data), and how to read it.

3.3.7 What is a code book, what it does and how to read it.

3.3.8 Understand basic storage environments. Understand the definition of server, cloud, client-based, stand-alone, enterprise, and data warehouse vs data lake.

3.3.9 Understand basic concepts of data exchange/transfer: Understand basic options for transfer, generally how they work, and pros and cons of each, including: File Transfer Protocol (FTP), media-based, and cloud-to-cloud transfer. Understand the elements that enable data exchange, the role of marks delimiting a data element (including pipe delimited and comma delimited), and a record length indicator.

3.4 Understand basic elements of preserving electronic records: keeping them understandable, accessible and usable over time, including understanding:

3.4.1 What it means to put records that are in a format that is not dependent on specific hardware or software;

3.4.2 The role of open source software;

3.4.3 The role of migration;

3.4.4 The role of a media refresh; and

4.1 Task 1: Develop training materials.

4.1.1 The Contractor shall develop and deliver for government review an outline of how they will design, sequence, develop and deliver training for the content outlined in paragraph 3.0. The outline will be reviewed and approved prior to the vendor developing the training materials.

4.1.2 The Contractor shall deliver training materials to the government for review and approval at least two weeks prior conducting the training. If the training is delivered over multiple sessions, the training content delivery and review may also be segmented as long as the content for each session is delivered at least two weeks before the session is conducted.

4.1.3 The Contractor will deliver any student training aids, references, or other materials developed for the course.

4.1.4 All training materials used in the training and delivered to the government must comply with accessibility requirements in Section 508.

5.0 GOVERNMENT FURNISHED PROPERTY

If needed, the Government will provide the Contractor access to one (1) lecture/conference room, telephone, and computer and webinar software at Archives II in College Park, MD. The Contractor shall coordinate the setup with the COR prior to instruction. If needed, NARA can provide personnel who supports the instructor in the IT component in this scenario.

6.0 KEY PERSONNEL

6.1 Course Instructors are considered Key Personnel.

6.2 In order to deliver training successfully, the designated instructor(s) shall possess the following minimum credentials. This does not include expertise needed for producers:

6.3 Subject Matter Experts (SMEs) in electronic records:

6.4 At least 10 years of experience with online and instructor-led, classroom-based training courses and assessment;

6.5 These requirements are designated for the Instructor(s) and does not apply to the personnel assisting the instructor.

7.0 QUALITY ASSURANCE

The Government will evaluate the Contractor's performance under this BPA. The COR will perform review of the course and will record all reviewing observations. The COR will maintain a file of all inspection results. Government review of tasks not listed in the PWS or by methods other than those listed in the PWS (such as provided for by the Inspection of Service clause) may occur during the performance period of this order. Such review will be done according to standard inspection procedures or other order provisions.

ENCLOSURE 3

BLANKET PURCHASE AGREEMENT TERMS AND CONDITIONS

1.0 DESCRIPTION OF AGREEMENT

1.1 The Contractor agrees to provide all services and supplies necessary to provide Records Management Training services in accordance with the details outlined in this agreement. All orders issued under this agreement will be requested by a NARA Z Warranted Contracting Officer or Ordering Official(s) as designated herein.

1.2 Terms and conditions cited in the BPA will be applicable to all orders and will be incorporated into the BPA orders.

2.0 EXTENT OF OBLIGATION

2.1 The Government, by issuance of the BPA, is not obligated to issue any orders beyond that which is authorized by the CO or authorized official. The Government is obligated only to the extent of authorized orders placed against the BPA. Services unrelated to Records Management Training or not priced in the agreement shall not be supplied. Services not priced in the requirement but relevant and necessary for Records Management Services must be brought to the attention of the Contracting Officer prior to purchase. Any unauthorized services are accomplished at the Contractors own risk.

2.2 All orders (telephonically or e-mail) will be followed by issuance of a written award document signed by a NARA Contracting Officer. This BPA does not obligate any funds. Each order will be funded individually.

3.0 PURCHASE LIMITATION

The dollar limitation for each individual order under this BPA is $20,000.00.

4.0 INDIVIDUALS AUTHORIZED TO PURCHASE UNDER THE BPA

Purchases against this BPA may only be made by the following individuals:

5.0 GOVERNMENT BPA ADMINISTRATION

(a) This BPA will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer, Z

8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

(b) Purchase Administration: See Award Document.

The Contracting Officer (CO) has the overall responsibility for the administration of this BPA. Written communication to the Contractor Support Specialist must make reference to the BPA number and must be mailed, postage prepaid, to the above address.

(c) Contracting Officer:

Any Z CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the BPA terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from order payments for non-performance or unsatisfactory performance; terminate the order for convenience or default; and issue final decisions regarding order questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

6.0 NARA CONTRACTING OFFICER REPRENSATIVE (COR)

The NARA COR for this requirement is: See Award Document.

a. The individual named above is designated as the NARA Contracting Officer Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The NARA COR serves as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO. The NARA COR is responsible for the inspection and acceptance of the order requirements and for the review and certification of invoices for the order requirements.

b. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the order between the Contractor and any person other than the CO be effective or binding upon the Government.

c. When, in the opinion of the Contractor, the NARA COR requests effort outside the existing scope of the BPA, the Contractor must promptly notify the CO in writing.

d. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

7.0 INVOICE SUBMISSION REQUIREMENTS

A. The preferred method of invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury’s Bureau of Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

B. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via email at AccountsPayable@fiscal.treasury.gov or by phone at (304) 480-8000, Option 7.

C. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by email to AccountsPayable@fiscal.treasury.gov. Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

D. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

E. For invoice and payment questions call the Fiscal Service Help Desk at (304) 480-8000, Option 7.

ENCLOSURE 4

ADDITIONAL TERMS AND CONDITIONS

1. STANDARDS OF CONDUCT

a. The Contractor shall be responsible for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity. The Contractor is also responsible for ensuring that its employees and those of its subcontractor(s) do not disturb papers on desks, open desk drawers or cabinets, use Government telephones, except as authorized, or otherwise jeopardize the security and the privacy of Government employees, its clientele, and the contents and property of the federal building(s) in which the contract work is performed. Each employee or supervisor of the Contractor is expected to adhere to standards of behavior that reflect credit on themselves, their employer, and the Federal Government.

b. The Contractor shall be responsible for taking such disciplinary action, including suspension without pay or removal from the worksite, with respect to its employees, as may be necessary to enforce those standards.

c. Where applicable, the requirements of this clause shall be expressly incorporated into subcontract(s) and shall be applicable to all subcontractor employees who may perform recurring services or work at the federal building and grounds of this agreement.

d. The Government retains the right to permanently remove any employee of the Contractor from performing duties assigned under this agreement at the federal building or grounds should the employee's performance so warrant. The Government will request the Contractor to immediately remove any employee of the Contractor from the federal building/work-site should it be determined by the Contracting Officer that the individual employee of the Contractor is "unsuitable" for security reasons or for otherwise being found to be unfit for performing his assigned duty at a federal building. The following areas (not all inclusive) are considered justification for requesting the Contractor to immediately remove an employee from a federal building/work site:

(1) Neglect of assigned duty and refusing to render assistance or cooperate in upholding the integrity of the security programs at the worksite;

(2) Falsification or unlawful concealment, removal, mutilation, or destruction of any official documents or records, or concealment of material facts by willful omissions from official documents or records;

(3) Disorderly conduct, use of abusive or offensive language, quarreling, intimidation by words or actions, or fighting; participation in disruptive activities which, interfere with the normal and efficient operations of the Government;

(4) Theft, vandalism, immoral conduct, or any other criminal actions;

(5) Selling, consuming, or being under the influence of intoxicants, drugs, or controlled substances which produce similar effects;

(6) Improper use of official authority or credentials, as a supervisor or employee of the Contractor

(7) Violation of Agency anti-discrimination and anti-harassment policies, including but not limited to NARA 396;

(8) Violation of Agency and Contractor security procedures and regulations; and (10)Violation of the rules and regulations governing federal public buildings and grounds set forth in 41 CFR Subpart 102-74 Conduct on Federal Property.

e. Following a recommendation from an Agency program official or security officer, the Contracting Officer will make all determinations regarding the removal of any employee of the Contractor from and denial/termination of clearance and access to the federal building worksite for non-performance, misconduct, or failure to abide by all laws and regulations. The Contracting Officer will verbally inform the Contractor about the employee, followed by a written confirmation or determination. Specific reasons for the removal of an employee will be provided to the Contractor in writing. In the event of a dispute, the Contracting Officer will make a final determination.

f. Upon a determination of the Government that an employee of the Contractor be removed from or denied access to a federal building worksite, the employee's clearance and access to the federal building shall be immediately revoked or otherwise terminated. Furthermore, if applicable, the building pass and/or other access device(s) previously given to the employee shall be immediately surrendered, returned, or delivered to the security officer of the federal building.

g. During the course of this agreement, the Contractor may come into contact with data files subject to the Privacy Act. If this situation occurs, Privacy Act data must conform to the Privacy Act of 1974, 5 U.S.C. 552a, as amended. The Contractor also may come into contact with confidential documents and confidential information about documents and proposed Federal Agency actions. The Contractor, including Contractor’s personnel, subcontractors, and consultants must not divulge or release data or information developed or obtained in performance of this BPA except to Authorized Government personnel or upon written approval of the Contracting Officer. The Contractor must not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as required in the performance of this BPA. The limitations above do not apply to data or information that has been made public by the Government.

2. KEY PERSONNEL

(a) The Contractor agrees to assign to the BPA key personnel whose resumes were submitted as required by the PWS to fill the requirements of the BPA. No substitution or addition of personnel will be made except in accordance with this clause.

(b) The Contractor agrees that during the first twelve (12) months of the BPA period, no personnel substitutions will be permitted, unless such substitutions are necessitated by an individual’s sudden illness, death, or termination of employment. In any of these events, the Contractor must promptly notify the Contracting Officer and COR, and provide the information required by paragraph (d) below.

(c) If key personnel, for whatever reason, become unavailable for work under this BPA for a continuous period that exceeds, or is expected to exceed, thirty (30) working days, or are expected to devote substantially less effort to the work than indicated in its Quotation, the Contractor must propose a substitution of such personnel in accordance with paragraph (d) below.

(d) All proposed key personnel substitutions must be submitted, in writing, to the Contracting Officer and the COR at least fifteen (15) days prior to the proposed substitution. Each request must provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute and any other information required by the Contracting Officer to approve or disapprove the proposed substitution(s). Resumes for key personnel substitutions must be submitted in Contractor format. All proposed substitutes (no matter when they are proposed during the performance period) must have qualifications that are equal to or higher than the qualifications of the person being replaced.

(e) In the event the Contractor designates additional key personnel as deemed appropriate for the requirement, the Contractor must submit to the Contracting Officer for approval the information required in paragraph (d) above.

(f) The Contracting Officer will evaluate requests for substitution and addition of personnel and promptly notify the Contractor, in writing, whether a request is approved or disapproved.

(g) If the Contracting Officer determines that suitable and timely replacement of key personnel who have been reassigned, terminated, or have otherwise become unavailable to perform under the BPA is not reasonably forthcoming, or that a resultant reduction of productive effort would impair the successful completion of the BPA, the BPA may be terminated by the Contracting Officer for default or for the convenience of the Government, as appropriate. Alternatively, at the Contracting Officer’s discretion, if the Contracting Officer finds the Contractor to be at fault for the condition, the CO may equitably adjust (downward) the BPA price to compensate the Government for any delay, loss or damage as a result of the Contractor’s action.

3. PERMITS AND LICENSES

In performance of work under this BPA, the Contractor must, without additional expense to the Government, be responsible for obtaining all necessary licenses and permits, including a city license and for complying with any Federal, State, and municipal laws, codes, and regulations applicable to the performance of this BPA.

4. PLACE OF PERFORMANCE

The Contractor’s primary place of performance will be as determined by the order.

5. PERIOD OF PERFORMANCE/CONTRACT TYPE

(a) Period of Performance. The period of performance is a base year one year from date of award with four (4) option years.

(b) Contract Type. This is a BPA with orders that will be Firm Fixed Price.

6. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits).

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of allaffected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informedotherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

5. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this BPA, the Contractor may have access to confidential information and communications, including but not limited to Personally

Identifiable Information (PII).