RFQ 88310321Q00124 Mobileframe licenses and support Amended.docx

National Archives and Records Administration Office of the Chief Acquisition Officer 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

RFQ# 88310321Q00124

THIS IS A REQUEST FOR QUOTATION (THIS IS NOT AN ORDER) in accordance with FAR 13.106-1(b), Soliciting from a Single Source. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular Number 2021-06 effective July 12, 2021.

This solicitation is for the acquisition of MobileFrame Licenses and Support

Complete and return one (1) copy of the quotation via e-mail by 12:00 PM ET on July 30, 2021 to:

Stephanie Tillman (Contractor), Contract Specialist stephanie.tillman@nara.gov

Please include the solicitation number in the subject line and plan to allow one extra business day for delivery and receipt, as the email will need to pass through IT security.

This is a Request for Quotation and quotations furnished are not offers. This request does not commit the Government to pay any costs incurred in the preparation or submission of the quotation or to contract for supplies and/or services. Any representations and/or certifications attached to this Request for Quotation must be completed by the Contractor. This includes the submission, with the vendor’s quotation, of representations required by FAR provision 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment and FAR provision 52.204-26, Covered Telecommunications Equipment or Services-Representation. FAR provision 52.212-3, Offeror Representations and Certifications - Commercial Items (Feb 2021) - The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site located at http://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision.

The Contractor's quotation will be evaluated to determine whether or not it addresses the requirements of the RFQ. Furthermore, the Contractor’s responsibility will be evaluated prior to the issuance of any contract.

Enclosures:

Attachment 1 – Schedule of Prices Attachment 2 – Contract Administration Attachment 3 – FAR Clauses Attachment 4 – Additional NARA Terms and Conditions - (ADDENDA TO FAR CLAUSE 52.212-4)

ATTACHMENT 1

SCHEDULE OF PRICES

Base Year: Period of Performance: Months 1-12

System Administrator – Included

20 MAX

HR

$_________NTE

CLIN = Contract Line Item Number; Qty = Quantity; HR = Hour LO= Lot

Option Year I: Period of Performance: Months 13-24

TOTAL OPTION YEAR I PRICE:

Option Year II: Period of Performance: Months 25-36

TOTAL OPTION YEAR II PRICE:

Option Year III: Period of Performance: Months 37-48

TOTAL OPTION YEAR III PRICE:

Option Year IV: Period of Performance: Months 49-60

TOTAL OPTION YEAR IV PRICE:

TOTAL CONTRACT PRICE:

NARA – 88310321Q00124 – MobileFrame Licenses and Support

ATTACHMENT 2

CONTRACT ADMINISTRATION

I. GOVERNMENT CONTRACT ADMINISTRATION

A. This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Office 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

B. Contract Specialist (CS):

See award document.

C. Contracting Officer (CO):

Any Z Warranted CO

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must reference the contract and must be emailed or mailed with postage prepaid, to the above address.

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. CONTRACTING OFFICER’S REPRESENTATIVE (COR) LEVEL 1:

a. COR: See award document

b. The individual named above is designated as the Contracting Officer’s Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The COR serves as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO. The COR is responsible for the inspection and acceptance of the contract requirements and for the review and certification of invoices for the contract requirements.

c. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the CO be effective or binding upon the Government.

d. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the CO in writing.

e. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

III. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – INVOICE PROCESSING PLATFORM (IPP) (JANUARY 2020)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice. Invoices shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

Contract Invoice to include:

1. Award number

2. CLIN/Item number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection if applicable

7. Serial number/part number if applicable

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

IV. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the contract, other than claims in amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s cl aim to amounts payable under the contract has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. § 203, 41 U.S.C. § 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the contract is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

ATTACHMENT 3

FAR CLAUSES

I. FAR 52.212-4 -- Contract Terms and Conditions -- Commercial Items (Oct 2018)

II. FAR 52.212-5 -- Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Jul 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.209-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232)

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note))

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-6, Restrictions on Subcontractor Sales to the Government (June 2020), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

(6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

(8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Jun 2020) (31 U.S.C. 6101 note).

(9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

___ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Mar 2020) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-3.

__ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Mar 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-4.

__ (13) [Reserved]

__ (14) (i) 52.219-6, Notice of Total Small Business Set-Aside (Mar 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17) (i) 52.219-9, Small Business Subcontracting Plan (Jun 2020) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Jun 2020) of 52.219-9

__ (18) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

___ (ii) Alternate I (Mar 2020) of 52.219-13.

___ (19) 52.219-14, Limitations on Subcontracting (Mar 2020) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Mar 2020) (15 U.S.C. 657f).

__ (22) (i) 52.219-28, Post Award Small Business Program Rerepresentation (Nov 2020) (15 U.S.C. 632(a)(2)).

(ii) Alternate I (MAR 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Mar 2020) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Mar2020) (15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (Mar 2020) (15U.S.C. 637(a)(17)).

(27) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

(28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan2020) (E.O.13126).

(29) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(30) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

(31) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

(32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

(33) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

(35) (i) 52.222-50, Combating Trafficking in Persons (Oct 2020) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(36) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) (42 U.S.C. 8259b).

__ (43) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

(44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

__ (47) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48) 52.225-1, Buy American-Supplies (Jan2021) (41 U.S.C. chapter 83).

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (Jan 2021)(41 U.S.C.chapter83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (Jan 2021) of 52.225-3.

__ (iii) Alternate II (Jan 2021) of 52.225-3.

__ (iv) Alternate III (Jan 2021) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (Oct 2019) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (51) 52.225-13, Restrictions on Certain Foreign Purchases (Jun 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury)

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov2007) (42 U.S.C. 5150).

__ (55) 52.229-12, Tax on Certain Foreign Procurements (Jun 2020).

__ (56) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (57) 52.232-30, Installment Payments for Commercial Items (Jan2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

(58) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) (31 U.S.C. 3332).

__ (59) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (60) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

__ (61) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (62) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

__ (63) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Feb 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages Under Executive Order 13658 (Nov 2020).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2017) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(iv) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(v) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(vi) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(vii) 52.222-26, Equal Opportunity (Sep 2015) (E.O.11246).

(viii) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793)

(x) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (Aug2018) (41 U.S.C. chapter 67).

(xiii) (A) 52.222-50, Combating Trafficking in Persons (Oct 2020) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May2014) (41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May2014) (41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (Oct 2015) (E.O. 12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Nov 2020).

(xviii) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2017) (E.O. 13706).

(xix) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

III. FAR 52.217-8, OPTION TO EXTEND THE TERM OF SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

IV. FAR 52.217-9, OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30-days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 (months).

X. FAR 52.252-2, CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

www.acquistion.gov/far

The following clause is hereby incorporated by reference:

(a) FAR 52.232-18, Availability of Funds (Apr 1984);

ATTACHMENT 4

ADDITIONAL TERMS AND CONDITIONS

I. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

II. INTERNET PROTOCOL (MAY 2021)

The Contractor shall ensure that all systems, including hardware, software, firmware, and/or network components developed, procured, or acquired in support and/or performance of this contract using the Internet Protocol (IP) are developed and used, in accordance with, commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile. All products or systems using the Internet Protocol may maintain provisions for IPv4 backward compatibility for non-governmental use.

III. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this contract, the Contractor may have access to confidential information and communications, including but not limited to Personally Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Contractor will preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting Officer. Failure to comply with the provisions of this paragraph will be grounds for Termination for Cause and the Contractor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this contract.

(d) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this contract, the Contractor may have access to and use of data and information which may be considered proprietary by other contractors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this contract, would be adverse to the interest of NARA and these other contractors.

(f) Except as may be otherwise agreed to with these other contractors, the Contractor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other contractors other than as required in the performance of this contract; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Contractor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Contractor and these contractors which provides for greater rights to the Contractor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Contractor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this contract.

IV. GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

V. SOFTWARE LICENSE,…