RFQ 88310320Q00027 Cubic Foot Archival Boxes.docx

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is 88310320Q00027 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-01 effective November 12, 2019. This is a full and open RFQ under NAICS code 322211, Corrugated and Solid Fiber Box Manufacturing. CONTRACT LINE ITEM NUMBER(S): See Attachment 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain Cubic Foot Archival Boxes. See Attachment 2, Specifications. PERIOD OF PERFORMANCE: The period of performance will consist of a base year and four (4) option years. PLACE OF DELIVERY: Delivery will occur at NARA locations throughout the continental United States. See Attachment 3, Shipping Destinations. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions, which will be removed prior to award: FAR provision 52.212-1, Instructions to Offerors - Commercial Items (Oct 2018). Addenda: (1) Change paragraph (c) to read: Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 90 calendar days from the date specified for receipt of offers. (2) Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR provision 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Items as prescribed by FAR 12.301(c)(2). NARA intends to award an Indefinite Delivery / Indefinite Quantity (IDIQ) contract based on its assessment of the best value to the Government. Best value will be determined by the Lowest Price Technically Acceptable quotation. The firm-fixed unit prices must include the fully burdened cost for delivering the supplies required by this contract. See Attachment 1, Schedule of Prices. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions”. The Contractor must also include a justification and the cost impact of each exception noted. However, Exceptions may render the quotation unacceptable for award The Government reserves the right to make an award on the initial quotation without communicating with contractors. FAR provision 52.212-3, Offeror Representations and Certifications - Commercial Items (Oct 2018) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u)) of this provision. FAR clause 52.212-4, Contract Terms and Conditions - Commercial Items (Oct 2018) – see Attachment 5, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). FAR clause 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Oct 2019) - see Attachment 6, FAR Clauses for the full text of this clause and for additional applicable FAR clauses.FAR provision 52.217-5, Evaluation of Options (Jul 1990). The Contractor is required to be registered in the System for Award Management (SAM) and maintain registration until final payment in accordance with FAR provision 52.204-7, System for Award Management (Oct 2018). Full text provisions and clauses can be found at http://www.acquisition.gov. QUESTIONS: Questions regarding this RFQ must be submitted in writing to the Contract Specialist, Ms. Stephanie Tillman (Contractor) at stephanie.tillman@nara.gov no later than 12:00 PM ET on January 13, 2020 to be considered. Questions submitted in any other manner will not be answered. Contractors are requested to group and submit questions in the same order found in the RFQ while making reference to the particular paragraph number. The Government will answer questions or requests for clarification via a written RFQ amendment. QUOTATION DUE DATE: Quotations must be received by 12:00 PM ET on January 27, 2020. Failure to submit quotations by the due date and time may result in rejection of the quotation as untimely. Contractors submitting via e-mail are cautioned to allow one extra business day for delivery and confirm receipt of quotation as the e-mail will need to pass through IT security. QUOTATION SUBMISSION INSTRUCTIONS: NARA requests that contractors email one (1) copy of the quotation to: stephanie.tillman@nara.gov.

NARA – 88310320Q00027- Cubic Foot Archival Boxes

ATTACHMENT 1

SCHEDULE OF PRICES

Base Year: Months 1 - 12

Cubic Foot Archival Storage Box, standard size (for letter or legal folders) in accordance with the Attachment 2, Specifications Interior dimensions: 14 15/16”L x 12”W x 10”D.

Note: Shipping Cost: Contractor shall include the shipping cost (FOB Destination) in the total firm-fixed price quotation.

20,000

Each

Estimated Not to Exceed

Reserved

Option Year I: Months 13 - 24

Cubic Foot Archival Storage Box, standard size (for letter or legal folders) in accordance with the Attachment 2, Specifications, Note: Shipping Cost: Contractor shall include the shipping cost (FOB Destination) in the total firm-fixed price quotation.

Reserved

Option Year II: Months 25 - 36

Cubic Foot Archival Storage Box, standard size (for letter or legal folders) in accordance with the Attachment 2, Specifications

Note: Shipping Cost: Contractor shall include the shipping cost (FOB Destination) in the total firm-fixed price quotation.

Reserved

Option Year III: Months 37 - 48

Cubic Foot Archival Storage Box, standard size (for letter or legal folders) in accordance with the Attachment 2, Specifications

Note: Shipping Cost: Contractor shall include the shipping cost (FOB Destination) in the total firm-fixed price quotation.

Reserved

Option Year IV: Months 49 - 60

Cubic Foot Archival Storage Box, standard size (for letter or legal folders) in accordance with the Specifications, Attachment 2

Note: Shipping Cost: Contractor shall include the shipping cost (FOB Destination) in the total firm-fixed price quotation.

2,000

Reserved

ATTACHMENT 2

SPECIFICATIONS

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 NARA requires cubic foot archival storage boxes to be delivered to various locations outlined in Attachment 3, Shipping Destintations.

2.0 SCOPE

The Contractor shall provide all tools, transportation, supplies, labor, materials, equipment and supervision necessary to produce and deliver hinged lid boxes, acid free with calcium carbonate buffering, B-Flute corrugated paper board shipped flat and palletized in accordance with the specifications herein.

3.0 REQUIREMENTS

3.1 Construction. The single piece box shall be assembled from B-flute corrugated single-wall (double-faced) board, comprised of two facings (liners) adhered to one fluted medium. The assembled box shall consist of the die cut corrugated boxboard blanks cut, scored, and adhered as indicated in Figure 1. Adhesives shall meet the Quality Assurance provisions in paragraph 3.3.14. Assembly shall not include metal fasteners. Drawing is not to scale.

C C = direction of corrugation

3.2 Dimensions: Standard Sized Storage Box (For Letter or Legal Folders). Interior dimensions 14 15/16” length x 12” width x 10” depth, such that a legal sized folder will fit in one orientation and a letter size folder will fit in the perpendicular orientation. The exterior dimension at the top of a box with a closed lid is not to exceed 15 13/16” in length, 12 3/4” in width, and 10 13/16” in height in order to fit on the regional shelves. All dimensions will be accurate to plus/minus 1/16”.

3.3 Paperboard (Singlewall B-Flute Corrugated Board)

3.3.1 Composition: All layers of the corrugated paperboard laminate shall be made from any unbleached pulp meets the following specification:

3.3.2 Free of alum-rosin sizing (ASTM D 549 or TAPPI T-408)

3.3.3 Contain <0.0008% reducible sulfur (TAPPI T-406).

3.3.4 Free of optical whitening agent and fire retardant.

3.3.5 Free of particles or other impurities such as: metals, waxes, plasticizers (i.e. wet strength additives), plastics, residual bleach, and peroxide,

3.3.2 Sizing. Alkaline sizing shall be used (surface, internal, or both).

3.3.3 Alkaline Reserve. The corrugated paperboard shall contain an alkaline reserve of calcium carbonate, magnesium carbonate, or a combination of both, within a range of 36% (calculated as CaCO3) when tested according to TAPPI T-553 or modified by slurrying the sample pulp prior to measurement, and shall be evenly distributed throughout all plies and layers. NARA will provide slurry method procedure upon request.

3.3.4 Hydrogen lon Concentration (pH). The pH value of the corrugated paperboard shall be between 8.0 and 10.0 when tested according to cold extraction method TAPPI T-509 or modified by slurrying the sample pulp prior to measurement.

3.3.5 Basis Weight. The corrugated paperboard must have a combined basis weight of ≥110 lb./1,000 ft2 as determined by TAPPI T-410.

3.3.5.1 Liners: ≥42 lb./1,000 ft2

3.3.5.2 Corrugated medium: ≥26 lb./1,000 ft2

3.3.6 Abrasion Resistance. The outer surfaces of the liner board stock must show <0.3% total weight-loss (mounting card and sample) when tested according to TAPPI T-476 with a #CS10 wheel and 100 wear cycles.

3.3.7 Label Adhesion. The surface of the corrugated paperboard liner shall hold a piece of weighted PS tape securely for ≥10 min. in 6 out of 9 trials, when tested according to ASTM D2860. Note: Procedure B modified as follows:

3.3.7.1.1 Use a 3/4", 3M Scotch® Magic™ 810 pressure sensitive tape to conduct the test

3.3.7.1.2 Adhere the tape to the paperboard surface with 2 rolls of a 10kg steel roller

3.3.7.1.3 Suspend a 2oz weight from the tape

3.3.8 Surface Smoothness.Smoothness shall be 250-400 Sheffield units as determined by TAPPI T-538.

3.3.9 Bending Resistance.The corrugated paperboard shall be tested for bending resistance in accordance with TAPPI T-836, and shall satisfy the following requirement: ≥ 6.2 N.m (MD) and ≥ 2.9 N.m (CD).

3.3.9.1 The corrugated paperboard shall be tested for bending resistance by adapting TAPPI T-556 to confirm that minimum acceptable stiffness, listed below, is met, except that for each specimen tested the corrugations shall run in the long direction of the specimen. Test conditions shall include 7.5 degrees deflection. ≥ 7000 mN (MD) and ≥ 4600 mN (CD).

3.3.10 Delamination. The corrugated paperboard shall have sufficient folding strength, especially along the score lines. It shall show no continuous visual break of the plies when the board is flexed 180▫, both parallel and perpendicular to the flutes, or along the score lines, when testing according to ASTM D 4727, section 9.3 (for singlewall corrugated fiberboard).

3.3.11 Burst Strength. The corrugated paperboard shall be tested for burst strength using TAPPI T-810 and meet a requirement of ≥170 PSI. Note: Need to pass ≥5 out of 6 total tests. If failed, retest 12 times with ≥8 passes.

3.3.12 Flat Crush. The corrugated board should have a flat crush reading of ≥48psi when tested according to TAPPI T-825 (rigid support method).

3.3.13 Adhesion Strength of Flutes (Pin Adhesion). The adhesion strength between the flutes and liners shall reach ≥48 lbs per foot of glue line, when tested according to TAPPI T 821.

3.3.14 Adhesive. A stable adhesive shall be used when adhering the two paperboard facings to each side of the fluted inner paperboard sheet. More specifically:

3.3.14.5 The adhesive shall be invisible through and not alter the color of the paperboard.

3.3.14.6 The adhesive shall not contain sulfur, iron, copper or other ingredients that may be detrimental to archival records.

3.3.14.7 The adhesive shall not contain or generate oxidants.

3.3.14.8 When used, the adhesive must not extend beyond the joined area.

3.3.15 Color & Dye Bleed/Transfer. The color shall be light blue or light tan. Dyes used to color the corrugated board shall show no bleeding or transferring when soaked in deionized water for 48 hours under ambient temperature while held in direct contact with white bond paper.

3.3.16 Worksmanship

3.3.16.1 The corrugated paperboard shall be assembled in accordance with good commercial practice, and shall be free of visible imperfections that may affect its utility or aesthetic appearance.

3.3.16.5 The paperboard shall be scored evenly.

3.3.16.6 When scored twice to assemble a double wall, the space between parallel scores shall not exceed two board thicknesses.

3.3.16.12 The corners of the corrugated board shall be square.

3.3.16.13 Each cubic foot box shall be made to the dimensions specified.

3.3.16.14 When assembled, all components shall fit closely without gaps or warping.

3.3.16.15 When assembled the top and bottom shall rest flat on a flat plane. When locked into place, the self locking sides shall remain in position.

3.3.16.16 When closed the top and bottom shall fit snugly and remain closed.

4.0 PREPARATION FOR DELIVERY

4.1 Identification. The following product identification information shall be legibly embossed or pricked on what will be the outside bottom of each box: name of manufacturer, pH range, year of manufacture. The pin punch or embossing shall not affect the smoothness of the inside of the box by passing through the board from the opposite side. The identification information shall not include the use of printing or media of any kind.

4.2 Packaging. The cubic foot storage boxes shall be shipped flat in a manner that meets the following requirements: full attachment (i.e. a box) sealed with tape to provide rigid support and protection from the elements that is non-damaging to the contents (does not bend, crimp, or fold edges or corners) so that the product arrives dry and undamaged.

4.3 Marking. The outside of each packing container shall be legibly marked with the following information: the contractor, contract number, type, size and number of items on the palettes.

4.4 Delivery Acceptance. An examination shall be made to determine whether the packaging of the corrugated boxes for delivery complies with all the requirements in section 4.0 of the specification. The following characteristics in the packaging will be regarded as unacceptable:

4.4.1 The number of boxes per container is different from the number specified on the shipping document.

4.4.2 Container is not sealed with tape.

4.4.3 Container is not legibly marked with the contract number.

4.4.4 Container is not legibly marked with the number of boxes within.

4.4.5 Container does not protect contents to prevent damage of environmental exposure (i.e. prevent boxes from bending, crimping, or edges or corners from folding).

5.0 QUALITY ASSURANCE PROVISIONS

5.1 Tests. Test procedures and controls specified in this document shall be used to determine the quality of the product. Other procedures and controls must be approved by the NARA COR before test results will be accepted.

5.1.1 To sample for testing, shipments will be sampled according to ANSI/ASQ Z1.4, inspection level S-2, AQL 2.5%.

5.1.2 Unless otherwise indicated, the tests shall be performed at, and the samples be conditioned to a standard condition of 73±3.5 °F and 50±2% RH (TAPPI T-402).

5.2 Test Methods. The requirements for paperboard quality and characteristics shall be tested in accordance with specified test methods of the American Society for Testing and Materials (ASTM), the Technical association of the Pulp and Paper Industry (TAPPI) and the American National Standards Institute (ANSI). Publications describing these tests may be ordered directly from the technical association.

5.3 Responsibility for Tests. The Contractor is responsible for quality control to ensure the specifications of this contract are met. The Contractor shall provide test results to the Contract Specialist (CS) and/or Contracting Officer (CO), for each production lot used to provide supplies under this contract.

5.3.1 The test results shall display, at a minimum, the characteristics listed below and shall be provided at least 30 days prior to shipping any items from the production lot under this contract.

5.3.2 The Contractor may use its facilities or any commercial laboratory certified to run quality assurance test methods listed below. NARA reserves the right to perform quality assurance at any time during the contract where such tests are deemed necessary to assure that supplies and services conform to the specifications.

5.3.3 Therefore, the test results (pH, alkaline reserve, sizing, sulfur, basis weight, abrasion and bending resistances, label adhesion capability, burst strength, flat crush, surface smoothness, pin adhesion, score and fold strength, bleeding and adhesive), two samples of each item purchased, and a sample of at least 12” by 12”of the material used to make the item (for example boxboard), shall be sent to the COR within 14 days after award of the contract. Additionally, the Contractor shall provide a sample of at least 12” by 12” of the material from a new production lot at any time, upon request of the COR

Table of QC Test Items and Specifications

(test methods, test conditions, etc.)

Basis Weight boxboard corrugate medium liners

≥110 lbs./1,000 ft2 ≥26 lbs./1,000 ft2 ≥42 lbs./1,000 ft2

TAPPI T-410

(total weight-loss)

TAPPI T-476

(#CS10 wheel, 100 wear cycles, on outer surfaces )

for ≥10 min.

(≥6 passes out of 9 trials) ASTM D2860, Method B, modified by:

· Use a 3/4" wide, 3M Scotch® Magic™ 810 pressure sensitive tape

· Adhere the tape to the sample surface with 2 rolls of a 10kg steel roller

Bending Resistance

≥6.2 N.m (MD) & ≥2.9 N.m (CD) or ≥ 7000 mN (MD) & ≥ 4600 mN (CD).

TAPPI T-836

or

TAPPI T-556

continuous surface break of plies (see details in page 4) ASTM D 4727, section 9.3. Flex the sample 180° both parallel and perpendicular to the flutes, or along the score lines.

ATTACHMENT 3

SHIPPING DESTINATIONS

Deliveries may be made to all NARA Sites and the shipping destinations are below. All delivery orders will include a Point of Contract (POC).

National Archives at College Park 3301 Metzerott Road College Park, MD 20740 Delivery Hours: Mon-Fri 9:00 AM-3:00 PM National Archives Building Loading Dock 7th & Pennsylvania Ave., (R) Washington, DC 20408 (see Note 1) Delivery Hours: Mon-Fri 9:00 AM-3:00 PM

National Archives at Waltham 380 Trapelo Road Waltham, MA 02154 Delivery Hours: Mon-Fri 9:30 AM-2:30 PM National Archives at New York 1 Bowling Green New York, NY 10004 Delivery Hours: Mon-Fri 9:30 AM-2:30 PM

John F. Kennedy Library Columbia Point Boston, MA 02125 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM Franklin D. Roosevelt Library 4079 Albany Post Road Hyde Park, NY 12538 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM

National Archives at Philadelphia 14700 Townsend Road Philadelphia, PA 19154-1025 Delivery Hours: Mon-Fri 9:30 AM-2:30 PM National Archives at Atlanta 5780 Jonesboro Road Morrow, GA 30260-3087 Delivery Hours: Mon-Fri 9:30 AM-2:30 PM

Jimmy Carter Library 441 Freedom Parkway Atlanta, GA 30307 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM Gerald R. Ford Library Library: 1000 Beal Avenue Ann Arbor, MI 48109 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM

Herbert Hoover Library 210 Parkside Drive West Branch, IA 52358 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM National Archives at Chicago 7358 South Pulaski Road Chicago, IL 60629 Delivery Hours: Mon-Fri 9:30 AM-2:30 PM

Dwight D Eisenhower Library 200 Southeast Fourth Street Abilene, KS 67410 Delivery Hours: Mon-Fri. 9:30 AM-2:30 PM Barack Obama Library 2500 West Golf Road Hoffman Estates, IL 60169 Delivery Hours: 9:00 AM-3:00 PM

ATTACHMENT 4

CONTRACT ADMINISTRATION

I. GOVERNMENT CONTRACT ADMINISTRATION

A. This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer (Z) 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

B. Contract Specialist (CS):

See award document.

C. Contracting Officer (CO):

Any Z Warranted CO

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be emailed or mailed with postage prepaid, to the above address.

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. DESIGNATION OF CONTRACTING OFFICER'S REPRESENTATIVE (COR)

(a) COR: See award document.

(b) The individual named above is designated as the Contracting Officer's Representative (COR) to assist the Contracting Officer (CO) in the discharge of the CO's responsibilities. The COR is responsible for monitoring, giving progress reports to the Contract Specialist (CS), and overall technical surveillance of services to be performed under this contract and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the CO be effective or binding upon the Government.

(c) When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the CO in writing.

(d) No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

(e) The responsibilities of the COR include, but are not limited to, the following:

(1) Serve as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO;

(2) Be responsible for the inspection and acceptance of the services performed and determining the adequacy of performance by the Contractor in accordance with the terms and conditions of this contract;

(3) Confer with representatives of the Contractor regarding any non-performance or unsatisfactory performance; follow through to assure that all non-performance or unsatisfactory performance is performed/corrected or payment adjustment is recommended to the CS/CO;

(4) Review and certify invoices in accordance with invoicing instructions of the contract. Maintain a file with copies of these documents;

(5) Review and evaluate Contractor's deliverables;

(6) Advise the CS of any performance problems and make recommendations for corrective action to correct performance issues;

(7) Furnish the CS with any requests for change, deviation, or waiver (whether generated by Government personnel or Contractor personnel), including all supporting paperwork in connection with such change, deviation, or waiver; and

(8) Submit a written evaluation to the CS/CO within 60 days of contract completion. The evaluation should include:

(i) The quality and timeliness of the Contractor's performance; and

(ii) A statement as to the uses made of any deliverables furnished by the Contractor.

III. INVOICE SUBMISSION REQUIREMENTS

A. The preferred method of invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury’s Bureau of Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

B. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via email at AccountsPayable@fiscal.treasury.gov or by phone at (304) 480-8000, Option 7.

C. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by email to AccountsPayable@fiscal.treasury.gov. Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

D. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

E. For invoice and payment questions call the Fiscal Service Help Desk at (304) 480-8000, Option 7.

ATTACHMENT 5

ADDITIONAL NARA TERMS AND CONDITIONS

(Addenda to FAR clause 52.212-4)

I. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from

, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits).

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG,

(1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media

Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

ATTACHMENT 6

FAR CLAUSES

I. FAR 52.212-4, Contract Terms and Conditions--Commercial Items (Oct 2018)

II. FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Oct 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2019) (Section 889(a)(1)(A) of Pub. L. 115-232). (4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

(4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved] ___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Oct 2015) (31 U.S.C. 6101 note).

___ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) [Reserved] ___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved] ___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

___ (16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637 (d)(4))___ (ii) Alternate I (Nov 2016) of 52.219-9.

___ (iii) Alternate II (Nov 2016) of 52.219-9.

___ (iv) Alternate III (Nov 2016) of 52.219-9.

___ (v) Alternate IV (Aug 2018) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Oct 2019) (15 U.S.C. 657f).

(22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C. 632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m))

(25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

(26) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Oct 2019) (E.O.13126).

(27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(28) 52.222-26, Equal Opportunity (Sep 2016) (E.O. 11246).

(29) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

(31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

(32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

__(33) (i)…