88310321Q00120 Contex Scanners or Equal.docx

NARA – 88310320Q00049 – CyberArk Servers NARA – 88310321Q00120 Contex HD Ultra X -6090 Scanner or Equal/Contex IQ Flex Scanners or Equal

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is 88310321Q00120 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-07 effective September 10, 2021. This is a Brand Name or Equal RFQ under NAICS code 423430, Computer and Computer Peripheral Equipment and Software Merchant Wholesalers). CONTRACT LINE ITEM NUMBER(S): See Attachment 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain a Contex HD Ultra X – 6090 – 60 Inch Large Format Scanner or Equal, NextImage Repro Software and On-site Warranty. The National Archives and Records Administration (NARA) also has a requirement to obtain three (3) Contex IQ Flex Scanners or Equal and NextImage software. See Attachment 2, Salient Characteristics for the Contex HD Ultra X – 6090 – 60 Inch Large Format Scanner or Equal and Attachment 3, Requirements. See Attachment 4, Salient Characteristics for the Contex IQ Flex Scanners or Equal. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant purchase order. FAR provisions will be removed prior to award. FAR provision 52.212-1, Instructions to Offerors - Commercial Items (Sep 2021). Addenda: Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR provision 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation as prescribed by FAR 12.301(c)(2). Selection of the Contractor for award of this purchase order will be based on NARA’s assessment of the best overall value to the Government. Accordingly, best value for this purchase order will be obtained through a lowest price technically acceptable evaluation. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions”. The Contractor must also include a justification and the cost impact of each exception noted. However, Exceptions may render the quotation unacceptable for award. The Government reserves the right to make an award on the initial quotation without communicating with contractors. For evaluation purposes, Contractors must provide pricing for each Contract Line Item Number (CLIN). The evaluated total purchase order price will be determined by summing the total price for each CLIN. The total purchase order price will be used to determine the lowest price. The Government will assess whether the Contractor’s solution meets the requirement as outlined in Attachment 3, Requirements. FAR provision 52.212-3, Offeror Representations and Certifications - Commercial Items (Feb 2021) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (v)) of this provision. FAR clause 52.212-4, Contract Terms and Conditions - Commercial Items (Oct 2018) – see Attachment 6, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). FAR clause 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Sep 2021) - see Attachment 8, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. FAR provision 52.217-5, Evaluation of Options (Jul 1990). The Contractor is required to be registered in the System for Award Management (SAM) and maintain registration until final payment in accordance with FAR provision 52.204-7, System for Award Management (Oct 2018). Full text provisions and clauses can be found at http://www.acquisition.gov. QUOTATION DUE DATE: Quotations must be received by 12:00 PM ET on September 21, 2021. Failure to submit quotations by the due date and time may result in rejection of the quotation as untimely. Contractors submitting via e-mail are cautioned to allow one extra business day for delivery and confirm receipt of quotation as the e-mail will need to pass through IT security. QUOTATION SUBMISSION INSTRUCTIONS: This is a Brand Name or Equal requirement. Contractors must submit proof, in writing from the Original Equipment Manufacturer (OEM), of its status as an Authorized/Certified reseller of the Contex Scanners or Equal. Contractors must submit a completed copy of Attachment 1, Schedule of Prices with its quotation. Contractors quoting an equal product must submit a completed copy of Attachment 2, Salient Characteristics for the Contex HD Ultra X – 6090 – 60 Inch Large Format Scanner or Equal. Contractors quoting an equal product must submit a completed copy of Attachment 4, Salient Characteristics for the Contex IQ Flex Scanners or Equal. Contractors must submit a completed copy of Attachment 7, Required Quotation Instructions. Contractors must submit a completed copy of Attachment 9, Section 508 Accessibility Conformance Report. Contractors must also submit, with its quotation, representations required by FAR provision 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment, FAR provision 52.204-26, Covered Telecommunications Equipment or Services-Representation, or FAR provision 52.212-3(v), Covered Telecommunications Equipment or Services-Representation. Please indicate in the quotation if the representations are complete in the contractor’s SAM profile. The contractor’s quotation will be technically unacceptable without providing this documentation. NARA requests that contractors email one (1) copy of the quotation to: tyrice.buie@nara.gov.

ATTACHMENT 1

SCHEDULE OF PRICES

EA

Manufacturer Part Number: CSIQFLEX Model Number: CA53E

Manufacturer Part Number: 9691A608

TOTAL PURCHASE ORDER PRICE:

CLIN = Contract Line Item Number; QTY = Quantity

Notes: CLIN 0001

1. Contractors shall deliver to the room number identified in Enclosure 1, Schedule of Prices.

The Contractor shall install the equipment without networking it. Upon installation the Contractor shall provide On-site training on the operational functions of the equipment for up to 12 staff members.

2. Delivery Date: No more than 30 Calendar Days after Receipt of Order between 9:00 AM and 5:00 PM unless other arrangements are made in advance with the Contracting Officer’s Representative (COR) or their designated representative.

3. Delivery Address for the Contex HD Ultra X – 6090 – 3301 Metzerott Road, Suite 3055, College Park, MD 20740-6001.

4. Mark for Instruction: Information will be provided upon order issuance.

5. Delivery Instructions– Scanner shall be delivered, installed, programmed, and tested within 30 Calendar days from date of award. Contractor shall clearly print Mark for Instruction in addition to the Delivery Address on shipping container address labels.

6. Shipping Costs: Contractor shall include the shipping costs in the Total Firm-Fixed Price quote.

Notes: CLIN 0003

1. Delivery Date: No more than 30 Calendar Days after Receipt of Order between 9:00 AM and 5:00 PM unless other arrangements are made in advance with the Contracting Officer’s Representative (COR) or their designated representative.

2. Delivery Address for Two (2) Contex IQ Flex Scanners – 3301 Metzerott Road, College Park, MD 20740-6001.

3. Delivery Address for One (1) Contex IQ Flex Scanner – National Archives – Archival Operations – Riverside, 23123 Cajalco Road, Perris, CA 92570

4. Mark for Instruction: Information will be provided upon order issuance.

5. Shipping Costs: Contractor shall include the shipping costs in the Total Firm-Fixed Price quote.

ATTACHMENT 2

SALIENT CHARACTERISTICS

The following information is required. Vendors quoting an “Equal” product shall ensure that it meets the salient characteristics below. Failure to complete the information below will result in rejection of the quotation as not acceptable. Vendors shall write the specifics to show that its product meets the criteria. Inserting the word "Meets", “Yes”, or similar term or statement is not acceptable. Also, providing product specification sheets, marketing materials, brochures, website/form links, or any other document in lieu of providing this completed form is not acceptable.

CLIN 0001 – Contex HD Ultra X-6090 Scanner or Equal, Software and Warranty

Scan

Scan at least 17 inches per second

Scan in color, black and white, and grayscale

Compatible with scanning software that can operate on a 64-bit Windows 10 operating system

Scan sRGB, Adobe RGB, or 48-bit color.

Functions to allow for rotation, auto-alignment, sharpening, softening, and deskewing actions

Allow operator to make RGB level adjustments

ATTACHMENT 3

REQUIREMENTS

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 The Cartographic Branch, Special Media Research Services Division of the National Archives and Records Administration (NARA) is replacing their aging oversize scanner that provides researchers with additional width options for scanning oversize maps, charts, architectural and engineering drawings.

1.3 NARA seeks to acquire one (1) Contex HD Ultra X 6090 – 60-inch large format scanner or equal and maintenance and support services for Contex HD Ultra X 6090 scanner or equal in the Special Media Research Services division located at Archives II in College Park, MD.

2.0 SCOPE

2.1 The Cartographic Branch, Special Media Research Services Division of the National Archives and Records Administration has a requirement for one (1) Contex HD Ultra X 6090 Scanner or equal, installation, programming, testing, training, annual preventative maintenance, and repair services.

2.2 The Contractor shall provide one (1) Contex HD Ultra X 6090 Scanner or equal; Nextimage Repro software; Installation, Programming, and Testing; Training; Annual Preventative Maintenance; and Repair Services.

2.3 The maintenance and support services must include all terms necessary for the achievement of the stated requirements in a manner that enables the NARA staff person all functions by a single operator. The new maintenance and support services shall comply with all industry and Government equipment standards for health and safety.

2.4 The Contractor shall provide all tools, transportation, supplies, labor, materials, equipment and supervision necessary to provide maintenance and support services for the Contex HD Ultra X 6090 scanner or equal.

3.1 Onsite, in-person training shall be provided under conditions that are acceptable to both NARA and the Contractor.

3.2 Training shall be for up to twelve (12) NARA staff members.

3.3 The training shall take place during the regular core business hours.

3.4 Training materials about scanner operation and maintenance, either written or electronic form, shall be made available for NARA to train additional staff members as needed.

3.5 A customer service hotline shall be provided to answer questions relating to the operation of the equipment.

4.0 ANNUAL PREVENTATIVE MAINTENANCE

4.1 The Contractor shall provide annual onsite preventative maintenance for hardware and software in accordance with manufacturers’ specifications for the scanner.

4.2 Routine updates to software shall be provided immediately after release. Pertinent software licenses will be renewed annually.

4.3 Annual preventative maintenance shall be coordinated with the COR or their designated representative.

4.4 Annual preventative maintenance shall be completed on the scanner within each year of the purchase order with the last preventive maintenance being completed before the purchase order ends.

4.5 The Contractor shall submit a report via email to the COR outlining the work completed, including any repairs or software upgrades that were required. The report shall be submitted within 14 business days after completion of the annual preventative maintenance work.

5.0 SERVICE CALLS AND REPAIRS

5.1 The Contractor shall provide on-site warranty services when requested. NARA will not pay for travel under this purchase order.

5.2 The Contractor shall perform onsite and offsite repair work in accordance with the manufacturer’s specifications for the scanners.

5.3 In the event of a scanner malfunction, the Contractor will be notified by the COR or their designated representative. The Contractor shall respond via telephone or email to the COR or their designated representative within 8 business hours after receipt of notification.

5.4 The Contractor shall arrange to service the scanner within five (5) business days after receipt of notification. All onsite and offsite repair work shall be coordinated with the COR or their designated representative.

5.5 Repair work shall be completed within 10 business days of the coordinated start date.

5.6 The Contractor shall submit a report via email to the COR outlining the issue(s) requiring repair(s) and the repair(s) completed. The report shall be submitted within 14 business days after completion of repair work.

5.7 The COR or designated representative will test the full functionality of the repaired scanner to determine if it is operating according to the manufacturer’s specifications.

5.8 The testing will be conducted within five (5) business days after receiving the contractor’s report of repairs completed.

5.9 Acceptance of repair work is contingent on full functionality of serviced equipment.

ATTACHMENT 4

SALIENT CHARACTERISTICS

The following information is required. Vendors quoting an “Equal” product shall ensure that it meets the salient characteristics below. Failure to complete the information below will result in rejection of the quotation as not acceptable. Vendors shall write the specifics to show that its product meets the criteria. Inserting the word "Meets", “Yes”, or similar term or statement is not acceptable. Also, providing product specification sheets, marketing materials, brochures, website/form links, or any other document in lieu of providing this completed form is not acceptable.

CLIN 0003 – Contex IQ Flex Scanners or Equal and NextImage Software

Scan

48-bit/16-bit

Must support book scanning with page split and spine fold elimination.

Must support the following Cloud destinations: Dropbox, Google Drive, Microsoft OneDrive, Box.com

Must have the ability to allow users to send scans to their own private folder on the network via a scanner-to-pc function.

Must be Wi-Fi enabled to allow file transfers directly to the cloud, specifically Google Drive

Color space: Adobe RGB/Device RGB/RAW RGB/sRGB Scan in color, black and white, and grayscale

Compatible with scanning software that can operate on a 64-bit Windows 10 operating system

Creates scans of RGB color or grayscale/monochrome at 200 dpi, full image area, in up to six seconds

Scan sRGB, Adobe RGB, or 48-bit color.

Include functions to allow for rotation, auto-alignment, sharpening, softening, and deskewing actions

Allow operator to make RGB level adjustments

Include TWAIN Driver

Include Histogram view

Include Measurement tool

TIF, JPG, PDF, PDF/A, DWF, CALS, BMP, JPEG-2000(JP2), JPEG2000 Extended(JPX), TIF-G3, TIF-G4, multi-page PDF and others

ATTACHMENT 5

PURCHASE ORDER ADMINISTRATION

I. GOVERNMENT PURCHASE ORDER ADMINISTRATION

a. This purchase order will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer (Z) 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

b. Contract Specialist (CS):

See award document.

c. Contracting Officer (CO):

Any Warranted Z Contracting Officer.

The Contracting Officer (CO) has the overall responsibility for the administration of this purchase order. Written communication to the Contract Specialist (CS) must reference to the purchase order number.

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the purchase order terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from purchase order payments for non-performance or unsatisfactory performance; terminate the purchase order for convenience or default; and issue final decisions regarding purchase order questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. CONTRACTING OFFICER’S REPRESENTATIVE (COR) LEVEL 1:

a. COR: See award document

b. The individual named above is designated as the Contracting Officer’s Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The COR serves as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO. The COR is responsible for the inspection and acceptance of the purchaser order requirements and for the review and certification of invoices for the purchase order requirements.

c. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the purchase order between the Contractor and any person other than the CO be effective or binding upon the Government.

d. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the purchase order, the Contractor must promptly notify the CO in writing.

e. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

III. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – INVOICE PROCESSING PLATFORM (IPP) (January 2020)

(a) Payment request must be submitted electronically through the U.S. Department of the Treasury’s Invoice Processing Platform System (IPP).

(b) “Payment request” means any request for purchase order financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contact/purchase order, or the clause 52.212-4, Contract Terms and Conditions – Commercial Items include commercial item contract. The IPP website address is https://www.ipp.gov.

(c) Under this purchase order, the following documents are required to be submitted as an attachment to the IPP invoice. Invoices shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

(d) Contractor invoice to include:

1. Award Number

2. CLIN/Item Number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection, if applicable

7. Serial Number/Part Number, if applicable

(e) The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

(f) If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

IV. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the purchase order, other than claims in stated amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s claim to amounts payable under the purchase order has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. § 203, 41 U.S.C. § 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the purchase order is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

ATTACHMENT 6

ADDITIONAL TERMS AND CONDITIONS

(Addenda to FAR Clause 52.212-4)

I. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this Purchase order.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this purchase order for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this purchase order that information to be utilized under this purchase order, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this purchase order, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access.

Work to be performed under this purchase order may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this purchase order, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this purchase order until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this purchase order.

(3) All NARA information obtained under this purchase order shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party vendors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this purchase order, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

II. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this purchase order specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the purchase order. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this purchase order, the Contractor may have access to confidential information and communications, including but not limited to Personally Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Contractor will preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting Officer. Failure to comply with the provisions of this paragraph will be grounds for Termination for Cause and the Contractor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this purchase order.

(d) If it is established elsewhere in this purchase order that information to be utilized under this purchase order, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this purchase order, the Contractor may have access to and use of data and information which may be considered proprietary by other contractors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this purchase order, would be adverse to the interest of NARA and these other vendors.

(f) Except as may be otherwise agreed to with these other contractors, the Contractor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other vendors other than as required in the performance of this purchase order; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Contractor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Contractor and these vendors which provides for greater rights to the Contractor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Contractor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this purchase order.

(i) The terms of this paragraph apply to all Contractor employees, subcontractors, and consultants and must be incorporated into any subcontract.

NARA – 88310321Q00120 Contex HD Ultra X -6090 Scanner or Equal/Contex IQ Flex Scanners or Equal

III. INTERNET PROTOCOL (MAY 2021)

The Contractor shall ensure that all systems, including hardware, software, firmware, and/or network components developed, procured, or acquired in support and/or performance of this contract using the Internet Protocol (IP) are developed and used, in accordance with, commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile. All products or systems using the Internet Protocol may maintain provisions for IPv4 backward compatibility for non-governmental use.

IV. NARA PROTECTION OF PII AND KEEP HARD DRIVE (AUG 2016)

In accordance with NARA policy, NARA will take title to all electronic storage devices, including but not limited to hard drives that may contain Personally Identifiable Information (PII). NARA will not allow the removal of any electronic storage device that may contain PII data from its facilities by a contractor, including individuals performing maintenance on equipment, devices or systems. This provision applies even in the event the equipment is leased. NARA will handle the destruction of this hardware internally. This provision must flow down to all subcontracts, including those for maintenance.

If the Contractor comes into possession of an electronic storage device that may contain PII, the Contractor will immediately notify the Contracting Officer and return the electronic storage device to NARA. The contractor will protect the confidentiality of the electronic storage device and will not access, disclose, release, disseminate, or publish any of the information on the electronic storage device.

ATTACHMENT 7

REQUIRED QUOTATION INSTRUCTIONS

STAUTORY/REGULATORY COMPLIANCE – The following items, if checked by NARA, apply to this solicitation. Contractors must confirm in its quotation that all products quoted are new only and meet the checked items. Completion and submission of this sheet is required. Failure to submit this sheet with the quotation will result in rejection of the entire quotation without review. Contractors must complete, sign and return this enclosure with its quotation.

FAILURE TO PROVIDE THE TRADE AGREEMENT ACT (TAA) COUNTRY OF PRODUCTION WILL RESULT IN NO FURTHER CONSIDERATION OF THE QUOTATION AS IT WILL BE DEEMED SIMILAR TO QUOTING A PRODUCT FROM A NON-TAA COUNTRY OF PRODUCTION. CONTRACTORS THAT DO NOT PROVIDE THE REQUIRED INFORMATION WILL NOT BE CONSIDERED FOR RECEIPT OF THE PURCHASE ORDER. FOR THIS REQUIREMENT ITEMS LISTED IN CLIN 0001 and CLIN 0003 MUST BE FROM A TAA COUNTRY OF PRODUCTION.

Statutory/Regulatory Compliance CLIN 0001 and CLIN 0003

X

Energy Star® Energy Use requirement compliance, as required: YES ____ or NO _____?

X

EPEAT Rating: Bronze___, Silver___, or Gold___? [Check One]

X

IPv6 COMPLIANT: YES___ or NO___?

X

Attachment 9, Section 508 Accessibility Conformance Report: Completed and returned with quotation: Yes __ or No ___

X

Appropriate IT security policies and requirements [see http://checklists.nist.gov] that must be met are: ___________________________

X

Original Equipment Manufacturer (OEM) authorized/certified Contractor: YES___ or NO___?

X

Quoted items are approved for resale in the USA by the OEM and are not grey market items:

YES___ or NO___?

Delivery Terms:

CLIN 0001 and CLIN 0003

[Insert specific date or time (e.g. 15 days after order)]

Address

DUNS?

Purchase Order Number

Contractor Point of Contact (POC) Name

Contractor POC Email

Contractor POC Telephone Number

POC Fax

Contractor Certification: By signing, the Contractor certifies that all information provided is Response to RFQ 88310321Q00120, is accurate and complete. This enclosure must be returned with Contractor’s quotation.

Printed Name

Title

Signature of Person Authorized to Sign Date

ATTACHMENT 8

FAR CLAUSES

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (June 2020), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

(4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Jun 2020) (31 U.S.C. 6101 note).

(9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11) (i) 52.219-3,…