88310322Q00053 HH Platform Solicitation Attachments 1-13.docx

NARA – 88310322Q00053, History Hub

NARA—88310322Q00053, History Hub

ATTACHMENT 1

SCHEDULE OF PRICES

1. SERVICES TO BE FURNISHED

(a) The purpose of this contract is to acquire initial configuration, migration, implementation, hosting, and operations and maintenance support of a Software-as-a-Service (SaaS) solution for the National Archives and Records Administration (NARA)’s History Hub (HH). All work must be performed in accordance with the terms and conditions of this contract.

(b) Firm-Fixed Price (FFP). The Contractor is required to furnish all the work that can be identified in advance, both in sufficient detail, and for which a fair and reasonable price can be obtained. The FFP must include the fully burdened cost for delivering the services required by this contract. All work in Attachment 2, Performance Work Statement (PWS) is considered firm-fixed price work, except for the: Base Year, SaaS -- License Term Production Instance Subscription for the HH minimum 400,000 page views/users per month; Base Year, SaaS -- Operations and Maintenance for the HH.

(c) Base Year, SaaS -- License Term Production Instance Subscriptions HH (minimum of 400,000 page views per month). The Base Year, SaaS License Term Production Instance Subscriptions shall only begin upon successful completion and Government acceptance of the Contractor’s deployment of History Hub solution to production.

(d) Base Year, SaaS -- Operations and Maintenance of the HH. The Base Year SaaS -- Operations and Maintenance shall only begin upon successful completion and Government acceptance of the Contractor’s deployment of these systems to production.

(e) Additional Services with Fixed Hourly Rates. Throughout the term of this contract, Additional Services shall be provided on an as needed, firm-fixed price basis, as ordered in accordance with the PWS. The not-to-exceed (NTE) amount listed is the maximum amount the Government has reserved in the performance period, for Additional Services. The government does not guarantee that any Additional Services will be ordered throughout the term of this contract and the Contractor shall not provide services which would exceed the obligated NTE amount. If the Contractor provides services in excess of the obligated NTE amount, within the performance period, it does so, exclusively, at its own risk and cost.

2. PRICING OF BASE YEAR

(a) Fixed Price Services.

(i) The Contractor must identify the base year “Unit Price” and “Total Price” for the services described in paragraph 4, Schedule of Prices.

(A) The “Total Price” for CLINs 0001, 0002, 0003, and 0004 is the total fixed “Lot” price for the services identified.

(B) The “Unit Price” for CLINs 0005, 0006, 0007, and 0008 must be the Contractor’s total fixed price per “Month” for the services identified.

(b) The “Total Price” for CLINs 0005, 0006, 0007, and 0008 is the “Unit Price” multiplied by the MAX “Quantity” to equal the “Total Price”.

(c) The “Total Price” for CLIN 0009, Additional Services is the “Not-to-Exceed” amount listed under the “Total Price”.

(d) Total Base Year Price. The “Total Base Year Price” is the sum of the “Total Price” of each separately priced CLIN and the not-to-exceed amount for Additional Services.

(e) The services identified in CLINs 0005, 0006, and 0008 are not billable until the Contractor’s solution is in production after NARA issues an Authorization to Operate (ATO). Therefore, the quantities are identified as “MAX”.

3. PRICING OF OPTION YEARS

(a) Option years will be priced using the procedure for pricing the contract base year for each separately priced CLIN. The “Total Price” must be the identified “Quantity” multiplied by the “Unit Price”. For evaluation purposes, the “Total Price” for the “Additional Services” CLINs is the not-to-exceed amount identified.

(b) Total Option Year Price. The “Total Option Year Price” for each Option Year is the sum of the “Total Price” of each separately priced CLIN and the not-to-exceed amount for Additional Services.

4. SCHEDULE OF PRICES

(a) In accordance with this contract, the Contractor must provide all management, support, and services described herein (except as specified to be furnished by the Government in the PWS), and must plan, schedule, coordinate, and ensure effective performance.

(b) For CLINs 0005, 0007, 0012, 0014, 0019, 0021, 0026, 0028, 0033, and 0035 insert fixed unit prices per “Month” for these services. For evaluation purposes, the “Total Price” is the “Unit Price” multiplied by the “Quantity”.

(c) For CLINs 0008, 0015, 0022, 0029, and 0036 insert fixed unit prices per “Month”: for these services. For evaluation purposes, the “Total Price” is the “Unit Price” multiplied by the “Quantity”. The Contractor must provide a detailed breakout of the price associated with these CLINs, if applicable, which includes the labor categories, mix, fully burdened hourly rates, level of effort, and materials, as needed. The Contractor must use table (i)1 “Composite Hourly Rate Table” for any and all labor associated with these CLINs, if they are priced based on direct labor.

(d) For CLINs 0006, 0013, 0020, 0027, and 0034 the contractor must complete pricing lines contained within each CLIN “Description”, the Contractor may, as applicable, include any “Overage Fees” priced as a dollar amount to the “Price Difference (from 400,000 page views/users per month)” which, is the “Full Price Per Month” (see table (j)1) subtracted by the “Unit Price” per “Month” for the following CLINs, within the respective period of performance, this dollar amount is the “Unit Price” the Contractor shall use. If the Contractor includes an “Overage Fee” it must show its calculation. The “Total Price” is the “Unit Price” multiplied by the “Quantity”. Additionally, the Contractor must complete table (j)1 which will be the applicable “Unit Price” per “Month” which will become applicable should NARA exercise its option to increase History Hub page views/user per month up to the next tier of 1,000,000. The Contractor SHALL NOT apply any “Overage Fees” priced a dollar amount to the “Full Price Per Month” in the price quoted in table (j)1. The pricing included in this table shall be incorporated into the contract and apply when and if NARA exercises its option to increase the page views to this tier.

(e) NARA has included not-to-exceed amounts in CLINs 0009, 0016, 0023, 0030, and 0037. For evaluation purposes, the “Total Price” for these CLINs is the total not-to-exceed amount. The Contractor must submit all available labor categories, descriptions, and fully burdened, fixed hourly rates, for the personnel available under these CLINs utilizing Table (i)1, Composite Hourly Rate Table.

NOTE: The Contactor must separately identify and explain known ODCs (e.g. subcontract, applicable material, parts, etc.), if applicable, for all separately priced CLINs. The Government reserves the right to not pay for ODCs which are not clearly identified and explained in the Contractor’s proposal. The Government does not guarantee that ODCs will be included in the resulting contract.

(h) The “Total Price” for each performance year will be determined by adding the individual CLIN prices for each year. The “Total Contract Price” will be determined by summing the yearly “Total Prices.”

(i) Composite Hourly Rate Pricing Table

The following table is for pricing all direct labor associated with the services required herein, including additional services [the Contractor may add as many rows to this table as necessary]:

TABLE (i)1

COMPOSITE HOURLY RATE

(Labor Category, Description)

(j) History Hub, Next Tier (1,000,000 page views/users per month). Full Price Per Month

TABLE (j)1 History Hub, Full Price Per Month – Next Tier 1,000,000 page views/users per month). (OPTIONAL INCREASE)

II

Option Year

III

Option Year IV

CLIN = Contract Line Item Number; IAW = In Accordance With; MAX = Maximum; Mo. = Month; NSP = Not Separately Priced; NSP = Not Separately Priced; NTE = Not-to-Exceed; PWS = Performance Work Statement; and QTY = Quantity.

Base Year: Months 1-12

MAX

MAX

MAX

NTE

Option Year I: Months 13-24

NTE

Option Year II: Months 25-36

NTE

Option Year III: Months 37-48

NTE

Option Year IV: Months 49-60

NTE

ATTACHMENT 2

PERFORMANCE WORK STATEMENT - HISTORY HUB

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 NARA answers hundreds of thousands to millions of written questions annually. With traditional communication channels such as postal mail or email, NARA staff must answer each question individually and many of the same or similar questions are asked repeatedly. Staff time that is spent answering repeat questions could be saved with a support community that allows the public to ask questions using their own words, which then allows future customers to find and interact with through searching the platform and popular web search engines.

1.3 In order to further its mission, NARA is seeking a cost effective, flexible, and adaptable solution to support the needs for a customer support community, entitled History Hub (HH), to serve as a way for NARA staff, staff from other federal agencies, and public researchers who register for accounts to create and share content (https://historyhub.history.gov/welcome). The content consists of topical communities, discussion forums, tagging, blogs, collaborative documents, file-sharing, polls, user profiles, and announcements. This content is publicly viewable via the web to non-account holding users. During 2021 NARA’s page views did not exceed 240,000 per month. NARA anticipates expanding outreach of the HH with a growth rate of about 60% per year. HH is currently hosted within Jive SBS version 9.9.0.0.

1.4 Since initial deployment in 2017, HH has experienced exponential growth in the number of: (1) registered users, (2) questions, (3) visitors, (4) page views, and (5) visitor sessions. With the COVID-19 pandemic and resultant closure of NARA facilities in March 2020 that reduced in-person public access to NARA’s holdings, HH has become a critical channel for providing reference services to agency customers. Searches on HH and referrals to it from Archives.gov have significantly increased, indicating that customers have adopted it as one of the de facto communication platforms at NARA. To date, HH has fielded more than 15,000 questions and 50,000 responses. For fiscal year 2021, HH had more than 31,000 registered user accounts, over 970,000 web visitors, 1.13 million sessions, and more than 2.25 million pageviews. Pageview growth over time has increased as listed below from the previous five years;

· 2017 - 301,260

· 2018 - 483,943

· 2019 - 777,404

· 2020 - 1,248,817

· 2021 - 2,250,458

2.0 SCOPE

2.1 NARA has a requirement for HH to continue services to external customers. Accordingly, NARA requires the Contractor to furnish a Software as a Service (SaaS) with out-of-the-box capabilities and little-to-no customization, for NARA’s customer support community. HH is a government-sponsored platform for crowdsourcing information that allows public researchers and interested individuals to engage with subject matter experts.

2.2 The goal of HH is to allow NARA and other institutions to connect to the public and allow the public to communicate more effectively with subject matter experts.

2.3 The Contractor shall migrate data from the existing instance of HH to a new cloud-hosted SaaS product. The Contractor shall provide, configure, and host the customer support community and provide all support for the SaaS hosted solutions for the duration of this contract. The Contractor shall implement a SaaS solutions with little or no customization, except as described in this Performance Work Statement (PWS), which provides the following general functional features:

2.3.1 Profiles - provide the capability for authorized users to add, change, and delete user profiles and related information including: the capability to upload and display profile images (e.g., head shots) and update email addresses.

2.3.2 Spaces - allow Administrative users to setup and have the capability to be either: a) open to all, b) open only by invitation, or c) completely private, with the capability of full functionality, open only by invitation, and not searchable. All spaces shall have the following features: discussion forums, blogs, and document collaboration capability.

2.3.3 Discussions - provide the capability for authorized users to initiate, edit, and reply to new and existing discussions and question threads

2.3.4 In addition to the stakeholder requirements, which are located in PWS Appendix 3, Stakeholder Requirements Specification (StRS) (HH), the Contractor shall configure History Hub to comply with the technical requirements.

2.4 Constraints. The following constraints pertain to the contents of this document in general and to the requirements specifically:

2.4.1 HH must be implemented as an SaaS solution with out-of-the-box capabilities and little-to-no customization with no hardware required at NARA locations;

2.4.2 The current HH uses Jive SBS version 9.9.0.0 and a Postgres database, and is hosted by Jive in an AWS hosting environment;

2.4.3 HH must be internet accessible and shall not require additional networking or other infrastructure changes to provide access, except as necessary to comply with security requirements; and

2.4.4 Data from the existing HH must be migrated to the new HH solution and must be live, in production, by no later than August 30, 2022.

2.5 Place of Performance. All services required herein shall be performed at the Contractor’s facilities. Meetings, briefings, and presentations shall, to the maximum extent practicable, be held via teleconference or webinar (via either contractor furnished or NARA furnished telecommunications services). Travel costs will not be reimbursed under this contract.

2.6.2 Federal holidays observed by NARA

Independence Day

2.6.2 In addition to the holidays listed above, any day specifically declared by the President of the United States as a holiday will be considered a Federal holiday.

2.6.3 When a holiday falls on a Sunday, the following Monday shall be observed as the Federal holiday. When a holiday falls on a Saturday, the preceding Friday shall be observed as the Federal holiday.

3.0 REQUIREMENTS

3.1 NARA has identified and established baseline requirements. These requirements are defined in the PWS Appendix 3, StRS (HH).

3.1.1 The solution shall provide, at a minimum, the capabilities in PWS Appendix 4 RVTM (HH) listed with requirement priority “MUST”.

3.1.2 The solution may provide capabilities listed in PWS Appendix 4, RVTM (HH) listed with requirement priority “SHOULD”.

3.1.3 The solution shall conform to PWS Appendix 11, ICT Accessibility Requirements Per the Revised Section 508 of the Rehabilitation Act. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to the SaaS and not user generated content.

3.1.3.1 Technical Standards:

☒ 1194.21 – Software Applications and Operating Systems ☒ 1194.22 – Web Based Intranet and Internet Information and Applications ☐ 1194.23 – Telecommunications Products ☒ 1194.24 – Video and Multimedia Products ☐ 1194.25 – Self-Contained, Closed Products ☐ 1194.26 – Desktop and Portable Computers ☒ 1194.41 – Information, Documentation and Support

3.1.3.2 Functional Performance Criteria are the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

☒ 1194.31 – Section 508 Standards and Functional Performance Criteria

3.1.3.3 The Contractor shall keep its Voluntary Product Accessibility Template (VPAT) 2.0 updated to reflect any modifications that have changed the 508 compliance status of the product – whether enhanced or diminished (if diminished, the GPAT(s) or VPAT(s) must include the Contractor’s mitigation plan).

3.1.3.4 All Electronic and Information Technology components are subject to Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998 and are subject to the associated Section 508 Standards as set forth by the U.S. Access Board. Functional Performance Criteria shall correspond to the WCAG 2,0 Level A and Level AA standards.

https://www.access-board.gov/ict/#about-the-ict-accessibility-standards https://www.access-board.gov/ict/#302-functional-performance-criteria https://www.section508.gov/content/mapping-wcag-to-fpc/

4.0 PROJECT MANAGEMENT

4.1 Kickoff Meeting. The Contractor shall lead a Kickoff Meeting with the Government Program Manager, Project Manager, the Contracting Officer’s Representative (COR) and Contracting Officer (CO), within five (5) business days after the award date of the contract to prepare NARA and the Contractor for the work described in this PWS.

4.2 Requirements discussion. The Contractor shall meet with the COR and NARA stakeholders to review the requirements prior to system configuration of the HH.

4.3 Project Management Plan (PMP). The PMP shall include reference to all tasks listed in this PWS, as well as, draft and final deliverables enumerated in PWS paragraph 10.0, Deliverables. The PMP is required for the deployment phase for the HH solution. The Contractor shall, after the kickoff meeting, provide a PMP that includes at a minimum:

4.3.1 Description of technical approach;

4.3.2 Organizational Resources;

4.3.3 Tasks and deliverables under this PWS, with due dates;

4.3.4 Contractor assignments (resource);

4.3.5 Milestone schedule that shows dependencies and critical path, as applicable; and

4.3.6 Management Controls to meet the cost, and schedule requirements throughout project execution

4.4 Monthly Status Report. The Contractor must provide a Monthly Status Report during migration and deployment until all system functionality has been deployed and accepted by NARA. The Monthly Status Report must describe work accomplished for each calendar month, work planned, the status of work, and significant problems, risks or issues encountered or anticipated. Where applicable, the Contractor shall identify a solution for any unresolved problems or issues. The status report shall be provided to the COR the last business day of each month. An updated project schedule shall be provided with each Monthly Status Report.

4.5 Weekly Status Updates. During the migration and deployment period, the Contractor shall meet weekly with the NARA Project Manager, the COR, and the Project Team to provide status on the progress of work and to discuss any significant problems, risks or issues encountered or anticipated.

4.6 Progress Briefings. Progress briefings shall be provided as requested by the COR.

4.7 Project Schedule. The Project Schedule shall provide all tasks and deliverables required to successfully complete each requirement under this PWS. The schedule shall also include planned start and end dates, task dependencies, and assigned resources. The project schedule shall be developed in Microsoft Project. An updated project schedule with completion status, milestones, critical path and actual start and finish dates shall be provided with each Monthly Status Report.

4.8 Release Roadmap. The release roadmap shall provide a schedule for requirements not met at initial release. The release roadmap dictates the schedule for customer acceptance testing for all requirements not met at initial deployment. Customer acceptance testing will begin at the date of release and will conclude within 10 business days of release.

4.9 Risk Management

4.9.1 Risk Management Plan. The Risk Management Plan documents the Contractor’s approach to managing risk for the project; to include, at a minimum, risk management planning, identification, analysis, response planning, and controlling risks on a project. The plan must also define the roles and responsibilities for each team member for leading and supporting each type of activity as described in the plan.

4.9.2 Risk Register. The risk register must be delivered and updated as needed. The Risk Register documents and tracks all risks identified for the project as a result of the risk identification, analysis, and response planning activities.

4.10 System Development Life Cycle (SDLC). All Project Management activities performed by the Contractor shall be in accordance with NARA’s System Development Life Cycle.

5.0 SYSTEM SETUP, CONFIGURATION, INTEGRATION, AND DEPLOYMENT

5.1 Solution Deployment

5.1.1 The solution shall be deployed for use no later than August 30th, 2022. Initial deployment must include data migration, user account load with account role configuration, and availability of the system to all users. The solution shall not go to production until granted Authorization to Operate (ATO) by NARA (see PWS paragraph 6.0, Security).

5.1.2 The solution shall meet all “MUST” requirements listed in Appendix 4 RVTM (HH) within 120 calendar days of initial deployment. Acceptance testing for requirements releases will be conducted in accordance with the Release Roadmap provided in PWS paragraph 4.8, Release Roadmap.

5.1.3 Deployment Plan. The Contractor shall provide a Deployment Plan to document its approach for deploying the HH. This plan shall provide details for data migration; system setup; configuration; and integration, as applicable. The Deployment Plan shall also identify all activities, resources, and timelines to execute deployment of the solution.

5.2 Data Migration

5.2.1 The Contractor shall migrate all data from the legacy HH (approximately 22,000 files, 5 gigabytes (GB) of files, and 7 megabytes (MB) of analytics) into the new solution, without corruption or loss.

5.2.1.1 The Contractor shall migrate all data for user acceptance testing (UAT) purposes and then migrate all data or the delta of any missing data prior to system launch.

5.2.1.2 The Contractor shall notify the COR of areas where legacy data will need reconfiguration, such as combined field assignments, areas where inter-module links may not be retained, any data truncation, corruption, or loss is likely, and/or what follow-up manual data entry or clean-up will be needed.

5.2.1.3 The Contractor must work with the COR and other NARA personnel to resolve data migration issues to ensure data can be saved into an appropriate field that maintains the intent of the original record.

5.2.1.4 The Contractor shall be responsible for full documentation of migration, deployment, and configuration of the new system.

5.2.2 Data Migration Plan. The Contractor shall provide a Data Migration Plan to document its approach for preparing data, migrating, and verifying migrated data.

5.2.3 Data Mapping Document. The Contractor shall provide a Data Mapping Document that shows the mapping of data (elements, fields) from the legacy HH physical implementation (schema, tables) to the new solution. NARA will work with the Contractor to validate a cross-map and to adjust the cross-map to each system’s specific data as needed prior to each conversion.

5.3 Configuration Management: The Contractor shall provide support for configuration management activities and follow the established IQ CM Processes and procedures to maintain the integrity of the system and its data. The Contractor shall update the Configuration Management Plan (CMP) as required and as per the CMP template.

5.4 The Contractor shall ensure that only components that have been tested and debugged are installed onto operational systems and that all changes, upgrades, or replacements have followed the established System Configuration Control processes. The Contractor shall assist in conducting Functional Configuration Audit (FCA) and Physical Configuration Audit (PCA) as requested by NARA. NARA furnished documents may be used by the Contractor for the basis of their documentation; however, it is the responsibility of the Contractor to verify the accuracy of the data before incorporating it into any work product..

6.0 TRAINING

6.1 Currently, 2 individuals within NARA’s staff have and must continue to have Application Administrator role based access to maintain user accounts and to provide other general administration of the system and content. Prior to solution deployment to production, the Contractor shall provide training for up to 15 Application Administrators for the HH. The Contractor furnished training shall instruct Application Administrators how to perform administration tasks at all operational levels.

6.2 Application Administrator Training Manual. The Contractor shall furnish its online Application Administrator Training Manual and any related materials that document the HH’s full functionality to help Application Administrators understand the HH features and capabilities. The Contractor shall also furnish an electronic copy to the COR.

6.3 NARA will provide the Contractor with two (2) weeks advance notice for scheduling and performance of the training. The instructor-led training must take place via webinar.

7.0 SECURITY

7.1 Applicability to Contractors and Subcontractors

The below requirements apply to all contractors and subcontractors, including cloud service providers ("CSPs"), and personnel of contractors, subcontractors, and CSPs that may access, collect, store, process, maintain , use, share, retrieve, disseminate, transmit, or dispose of NARA Information. These requirements establish and implement specific NARA security requirements applicable to the reference contract.

7.2 NARA Security Policy Requirement

All hardware, software, and services provided under this contract must be compliant with NARA 804 IT Systems Security Policy and associated policies, procedures & standards, and ensure the confidentiality, integrity, and availability of the NARA Information under this contract.

7.2.1 Contractor shall develop and maintain a System Security Plan, Security Assessment Report, and Plan of Action & Milestones that reflects the security posture of the system.

7.2.1.1 Contractor shall develop and maintain a system capable of supporting a Confidentiality=Low; Integrity=Low, and Availability=Moderate; Overall rating=Moderate FISMA rating.

7.2.2 Contractor shall comply with all security requirements, including but not limited to the regulations and guidance found in the:

· Federal information Security Management Act of 2014 ("FISMA");

· Privacy Act of 1974, E-Government Act of 2002;

· National Institute of Standards and Technology ("'NIST") Special Publications ("SP") including NIST SP 800-37, 800-53, and 800-60 Volumes I and II;

· Federal Information Processing Standards ("FIPS") Publications 140-2, 199, and 200;

· Office of Management and Budget (OMB) Circular A-130;

· OMB Memoranda;

· Federal Risk and Authorization Management Program ("'FedRAMP"); and

· NARA IT Security Standards, including NARA Order 2640.2, as amended.

7.2.3 In order to adhere to the laws, regulations, and NARA policies delineated above, the Contractor shall:

7.2.3.1 Limit access to NARA Information and Information Systems to authorized users and to transactions and functions that authorized users are permitted to exercise;

7.2.3.2 Provide security awareness training including, but not limited to, recognizing and reporting potential indicators of insider threats to users and managers of NARA Information and Information Systems;

7.2.3.3 Create, protect, and retain Information System audit records, reports, and supporting documentation to enable review, monitoring, analysis, investigation, reconstruction, and reporting of unlawful , unauthorized, or inappropriate activity related to any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information;

7.2.3.4 Maintain authorizations to operate for any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information;

7.2.3.5 Perform continuous monitoring on any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information;

7.2.3.6 Establish and maintain baseline configurations and inventories of any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, including hardware, software, firmware, and documentation, throughout the Information System Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed information Systems;

7.2.3.7 Ensure appropriate contingency planning has been performed;

7.2.3.8 Identifying the users, processes acting on behalf of users, or devices of any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, and authenticating and verifying the identities of such users, processes, or devices, using multifactor authentication or HSPD-12 compliant authentication methods where required;

7.2.3.9 Establish an operational incident handling capability for any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information that includes adequate preparation , detection, analysis, containment, recovery , and user response activities, and tracking, documenting, and reporting incidents to appropriate officials and authorities within Contractor's organization and NARA;

7.2.3.10 Perform periodic and timely maintenance on any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, and provide effective controls on tools, techniques, mechanisms, and personnel used to conduct such maintenance;

7.2.3.11 Protect media for any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, including paper, digital and electronic media; limit access to NARA Information to authorized users; and sanitize or destroy Information System media containing NARA Information before disposal, release or reuse of such media;

7.2.3.12 Limit physical access to any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, equipment, and physical facilities housing such Information Systems to authorized U.S. citizens unless a waiver has been granted by the Contracting Officer (''CO"), and protect the physical facilities and support infrastructure for such Information Systems;

7.2.3.14 Screen individuals prior to authorizing access to any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information to ensure compliance with NARA Security standards;

7.2.3.15 Assess the risk to NARA Information in any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information periodically, including scanning for vulnerabilities and remediating such vulnerabilities in accordance with NARA policy and ensuring the timely removal of assets no longer supported by the Contractor;

7.2.3.16 Assess the security controls of any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information periodically to determine if the controls are effective in their application, developing and implementing plans of action designed to correct deficiencies and eliminate or reduce vulnerabilities in such Information Systems, and monitoring security controls on an ongoing basis to ensure the continued effectiveness of the controls;

7.2.3.17 Monitor. control, and protect information transmitted or received by any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information at the external boundaries and key internal boundaries of such Information Systems, and employing architectural designs, software development techniques, and systems engineering principles that promote effective security; and

7.2.3.18 Identify, report, and correct security flaws in any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information in a timely manner, providing protection from malicious code at appropriate locations, monitoring security alerts and advisories and taking appropriate action in response

7.2.3.19 Contractor shall not process, store, or transmit NARA Information with any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information without first obtaining an Authority to Operate ('”ATO") for each Information System. The ATO shall be signed by the Authorizing Official for NARA responsible for maintaining the security, confidentiality, integrity, and availability of the NARA Information under this contract.

7.2.3.20 Contractor shall ensure that no Non-U.S. citizen accesses or assists in the development, operation, management, or maintenance of any NARA Information System, unless a waiver has been granted by the CO.

7.2.3.21 When requested by the NARA CO or COR, or other NARA official as described below, in connection with NARA's efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, the Contractor shall provide NARA, including the Office of Inspector General ("OIG") and Federal law enforcement components, (1 ) access to any and all information and records, including electronic information, regarding any information system used for, involved with, or allowing, the processing, storing, or transmitting of NARA Information, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, Contractor shall cooperate with NARA's efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA Information.

7.2.4 The use of Contractor-owned laptops or other portable digital or electronic media to process or store NARA Information is prohibited until Contractor provides a letter to the NARA CO, and obtains the CO's approval, certifying compliance with the following requirements:

7.2.4.1 Media must be encrypted using a NIST FIPS 140-2 approved product;

7.2.4.2 Contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

7.2.4.3 Where applicable, media must utilize antivirus software and a host-based firewall mechanism;

7.2.4.4 Contractor must log all computer-readable data extracts from databases holding NARA Information and verify that each extract including such data has been erased within 90 days of extraction or that its use is still required. All NARA Information is sensitive information unless specifically designated as non -sensitive by NARA; and

7.2.4.5 A Rules of Behavior ("ROB") form must be signed by users. These rules must address, at a minimum, authorized and official use, prohibition against unauthorized users and use, and the protection of NARA In formation. The form also must notify the user that he or she has no reasonable expectation of privacy regarding any communications transmitted through or data stored on Contractor-owned laptops or other portable digital or electronic media.

7.2.4.6 Contractor-owned removable media containing NARA Information shall not be removed from NARA facilities without prior approval of the NARA CO or COR.

7.2.4.7 When no longer needed, all media must be processed (sanitized, degaussed, or destroyed) in accordance with NARA security requirements.

7.2.4.8 Contractor must keep an accurate inventory of digital or electronic media used in the performance of NARA contracts.

7.2.4.9 Contractor must remove all NARA Information from Contractor media and return all such information to NARA within 15 days of the expiration or termination of the contract, unless otherwise extended by the CO, or waived (in part or whole) by the CO, and all such information shall be returned to NARA in a format and form acceptable to NARA. The removal and return of all NARA Information must be accomplished in accordance with NARA IT Security Standard requirements, and an official of the Contractor shall provide a written certification certifying the removal and return of all such information to the CO within 15 days of the removal and return of all NARA Information.

7.2.4.10 NARA, at its discretion, may suspend Contractor's access to any NARA Information, or terminate the contract, when NARA suspects that Contractor has failed to comply with any security requirement, or in the event of an Information System Security Incident, where NARA determines that either event gives cause for such action. The suspension of access to NARA Information may last until such time as NARA, in its sole discretion, determines that the situation giving rise to such action has been corrected or no longer exists. Contractor understands that any suspension or termination in accordance with this provision shall be at no cost to NARA, and that upon request by the CO, Contractor must immediately return all NARA Information to NARA, as well as any media upon which NARA Information resides, at Contractor's expense.

7.3 Cloud Computing

7.3.1.2 If not certified under FedRAMP, the Cloud System and CSP have received an ATO signed by the NARA Authorizing Official responsible for maintaining the security, confidentiality, integrity, and availability of the NARA Information under the contract.

7.3.2 Authorization To Operate

7.3.2.1 Immediately after award, for security controls that are the agency’s responsibility, the Contractor must also implement those system-specific NIST 800-53, rev 5, security controls for the system at the FISMA 'Moderate’ rating.

7.3.2.2 The Contractor must assist the NARA assigned Information System Security Officer (ISSO) and the independent security assessor to complete an updated System Security Plan (SSP) for History Hub containing implementation statements for controls identified as NARA’s responsibility to implement, validate these security controls and functions within the system during the independent security assessment that NARA is required to conduct, and to help develop mitigation plans for weaknesses found during the assessment in the system Plan of Action and Milestones (POA&M). The Contractor shall remediate security vulnerabilities or findings per NARA’s IT security requirements:

7.3.3 The Contractor must ensure that the CSP allows NARA to access and retrieve any NARA Information processed, stored or transmitted in a Cloud system under this Contract within a reasonable time of any such request, but in no event less than 48 hours from the request. To ensure that NARA can fully and appropriately search and retrieve NARA Information from the Cloud system, access shall include any schemas, meta-data, and other associated data artifacts.

7.4 Security Review Requirement

On a periodic basis, NARA, including the NARA Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the contractor under these requirements. Evaluation could include, but is not limited to vulnerability scanning. NARA reserves the right to conduct audits at its discretion. With ten working days’ notice, at the request of the Government, the contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein NARA information is processed or stored, or information systems are developed or operated. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by NARA in the event of a security incident.

7.5 Interconnection Security Agreement (ISA)

The following Interconnection Security Agreement Requirements are applicable if the service being supplied requires a connection to a non-NARA, Contractor system, or NARA system of different sensitivity. Interconnections between NARA and non-NARA IT systems shall be established only through controlled interfaces and via approved service providers.

7.6 Continuous Monitoring

7.6.1 The contractor shall participate in NARA’ Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that NARA determines acceptable. At a minimum, the contractor shall implement the following processes:

7.6.1.1 Asset Management;

7.6.1.2 Vulnerability Management;

7.6.1.3 Configuration Management;

7.6.1.4 Malware Management;

7.6.1.5 Log Integration;

7.6.1.6 Security Information Event Management (SIEM) Integration; and

7.6.1.7 Patch Management.

7.6.1 Specific Protections. Specific protections that shall be provided by the contractor include, but are not limited to the following:

7.6.1.1 Computer Incident Response Services. The Contractor shall provide Computer Incident Response Team (CIRT) services. The contractor shall notify the NARA IT Security Management Division of any incident within one hour of detection and work with NARA throughout the incident duration.

7.6.1.2 Vulnerability Assessments. The Contractor shall provide all information from any managed device to NARA, as requested, and shall assist, as needed, to perform periodic vulnerability assessments of the network, operating systems, and applications to identify vulnerabilities and propose mitigations. Vulnerability assessments shall be included as part of compliance with the continuous monitoring of the system.

7.6.1.3 IPv6 requirements. Contractor shall comply with Federally mandated IPv6 requirements.

7.7 Supply Chain Risk Management

The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number or, after April 4, 2022, the Unique Entity Identifier (UEI), for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state and/or domain of registration and DUNs number or UEI of those suppliers must also be provided.

7.7.1 Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

7.7.2 The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

7.7.3 Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

7.7.4 The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

7.7.5 The Supply Chain Risk Management Plan shall address the following elements:

7.7.5.1 How risks from the supply chain will be identified,

7.7.5.2 What processes and security measures will be adopted to manage these risks…