A - Combined Synopsis Solicitation - Extraction and Conversion of Mixed Media Files for FAA 9.11 Project.docx

Combined Synopsis Solicitation No. NARA-883103-26-Q-00014 Extraction and Conversion of Mixed Media Files for FAA 9/11 Project – Digital Formats This is a Combined Synopsis/Solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.201-1, Simplified Procedures, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is NARA-883103-26-Q-00014 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through the Federal Acquisition Regulation (FAR), Part 12, updated April 20, 2026. This is an unrestricted acquisition under NAICS code 518210, Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. CONTRACT LINE ITEM NUMBER(S): See Attachment 2, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement for the extraction and conversion of mixed media files for FAA 9/11 Project. PERIOD OF PERFORMANCE: The period of performance will be until the work required under the resultant contract is completed but no longer than five years. CONTRACTOR SITE VISIT: The Government may assess the Contractor’s facilities and equipment for acceptability. Facilities will be inspected during the evaluation process in accordance with the standards in the Performance Work Statement. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions which will be removed prior to award: FAR 52.212-1, Instructions to Offerors - Commercial Products and Commercial Services (Deviation Date). Addenda: Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION: Evaluation and award will be in accordance with FAR 52.212-2, Evaluation – Commercial Products and Commercial Services (Deviation Date). Selection of the Contractor to perform this contract will be based on NARA’s assessment of the best overall value to the Government. Accordingly, all evaluation factors, Technical Understanding and Approach and Relevant Past Performance, will be significantly more important than price. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions.” The Contractor must also include complete rationale, justification, and the cost impact of each exception noted. The Government reserves the right to make an award on the initial quotation without discussions of this procurement. The Total Firm Fixed Price for each CLIN will be determined by multiplying the QTY (Quantity) by the Firm Fixed Unit Price. The resultant contract will include FAR 52.217-8, Option to Extend Services. NARA will evaluate six additional months of services at the rates for CLINs 0001 through 0010. The evaluated Total Contract Ceiling Price will be determined by summing the Total Contract Ceiling Price plus half of the Total Contract Ceiling Price. Contractors must provide pricing (USD) for each CLIN in accordance with Attachment 2, Schedule of Prices. Failure to submit any of the required information and documentation with the quotation may result in rejection of the quotation. Multiple awards will not be made under this RFQ. Contractors must be registered and active in the System for Award Management (SAM). FAR 52.212-4, Terms and Conditions - Commercial Products and Commercial Services (Deviation Date) – see Attachment 4, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). Full text of provisions and clauses can be found at https://www.acquisition.gov/far-overhaul.

Wage Determinations The place of performance for this contract action is unknown. In accordance with FAR 52.222-49, Service Contract Labor Standards-Place of Performance Unknown, wage determinations for possible places of performance will be obtained if requested in writing. To obtain a wage determination, Contractors must submit their request by the deadline stated below.

Request for Pictures of Samples of the Records Pictures of samples of the records will be provided to Contractors if requested in writing. Pictures will be emailed directly to the Contractor. Samples of records cannot be provided in any other format. To receive pictures of samples of the records, Contractors must submit their request by the deadline stated below.

Contractor Site Visit and Description of Facilities The Government will assess the Contractor’s facilities and equipment for acceptability. Facilities will be inspected during the evaluation process in accordance with the standards in the Performance Work Statement. The Contractor is required to submit a list of all equipment necessary to perform the services required and a brief description of its facilities. The Description of Facilities shall include an overview of security measures, fire suppression and detection system. Note: NARA will only inspect Contractor’s facilities if the remainder of its quotation is deemed technically acceptable.

To aid you in your planning and quotation development, the following information is provided as attachments to this Request for Quotation:

Attachment 1 – Performance Work Statement Attachment 2 – Schedule of Prices Attachment 3 – RFQ Information Sheet Attachment 4 – Additional NARA Terms and Conditions Attachment 5 – Evaluation Factors Attachment 6 – Quotation Submission Instructions Attachment 7 – Relevant Past Performance Questionnaire Attachment 8 – FAR Clauses Attachment 9 – Records Management Obligations Attachment 10 – Confidential and Non-Disclosure Agreement (sample document to be signed at award of contract.)

Contractors must provide the following documents and information along with the requirements in Attachment 6, Quotation Submission Instructions:

- Attachment 3, RFQ Information Sheet -The Place of Performance requirement at FAR 52.215-6 must be filled out See Attachment 8, FAR Clauses, include addresses if applicable -Description of Facilities (see Contractor Site Visit and Description of Facilities above)

QUESTIONS AND REQUEST FOR PICTURES OF SAMPLES OF RECORDS:

Questions regarding this RFQ and requests for pictures of samples of records must be submitted in writing via email to the Contract Specialist, Cynthia Jones, at cynthia.jones@nara.gov no later than 12:00 p.m. eastern time on August 27, 2026 to be considered. Questions submitted in any other manner will not be answered. The Government will answer questions or requests for clarification via a written RFQ amendment. Pictures will be sent directly to Contractor.

REQUEST FOR WAGE DETERMINATIONS: Requests for wage determinations must be submitted in writing via email to the Contract Specialist, Cynthia Jones, at cynthia.jones@nara.gov no later than 12:00 p.m. eastern time on August 27, 2026. The Government will add wage determinations via a written RFQ amendment.

QUOTATION AND PAST PERFORMANCE QUESTIONNAIRES: Quotations and Past Performance Questionnaires must be submitted to Cynthia Jones via email at cynthia.jones@nara.gov. The deadline for quotations and Past Performance Questionnaires is 12:00 p.m. eastern time on September 7, 2026. Failure to submit quotations by the deadline may result in rejection of the quotation as untimely. Please include Solicitation Number: NARA-883103-26-Q-00014 in the email subject line and allow one extra business day for delivery and receipt, as the email will need to pass through IT security. See Attachment 6, Quotation Submission Instructions.

ATTACHMENT 1

PERFORMANCE WORK STATEMENT

for

EXTRACTION AND CONVERSION OF MIXED MEDIA FILES

FOR THE FAA 9/11 PROJECT - DIGITAL FORMAT

1.0 General

1.1 Introduction

1.1.2 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 Objective

1.2.1 The mission of Research Services is to accession, process, describe, preserve, and make accessible Federal records. Research Services has a collection of records from the Federal Aviation Administration (FAA) that are on various media formats. Records consist of textual, audio, and electronic files relating to the September 11, 2001, terrorist attacks, the FAA’s involvement in the monitoring of United Airlines Flights 175 and 93 and American Airlines Flights 11 and 77, and the Federal Government’s subsequent actions in the aftermath of the attacks. Information includes recordings of telephone conversations, radar data, and air traffic control communications, and situation re-creation assessments. Items have not yet been made available for special access review and release to the public.

1.3 Scope

1.3.1 The Contractor must extract files from media in the collection, with the goal of transferring files in formats that are archivally stable and can be uploaded into NARA’s Electronic Records Archive (ERA 2.0). The contractor must access, duplicate, and unencode data, producing readable copies. Items such as radar data were created using proprietary equipment and formats. SATORI: Situation Assessment Through Re-creation of Incidents is a system that graphically recreates the radar data recorded at En Route air traffic control facilities.

1.4 Type of Contract and Period of Performance

1.4.1 This will be a fixed price contract.

1.5.1 The work to be performed under this contract will be performed at the Contractor's work site.

1.5.2 The NARA Contracting Officer’s Representative for this contract is:

Name: TBD Telephone:

Email:

2.0 Specific Requirements/Tasks

2.1 The Contractor must extract data files from media types listed in table 2.6. The Contractor must recover files in their native format and provide NARA with a report of all file types and a format conversion assessment. The assessment must be submitted to the NARA Contracting Officer’s Representative (COR) after the native files are recovered. Assessments may be provided to NARA during the required monthly reporting period or when available.

2.2 NARA will determine format conversions that it requires and specify final deliverables by file type. NARA will rely on the following guidelines for making determinations for deliverables:

· Universal Electronic Records Management Requirements

· NARA Format Guidance for the Transfer of Permanent Electronic Records

· NARA Digital Preservation Framework

2.3 The Contractor must transmit these archivally stable files via high-capacity hard drives or direct upload to NARA approved cloud storage staging areas.

2.4 A Comma-Separated Values (.CSV) file with the appropriately labeled and defined fields and field headers is an acceptable format for delivery of extracted metadata. The final output and delivery of the .CSV file(s) must be constructed for NARA’s review and approval. File inventories must also identify the number of files and their associated file extension(s) for which no file format(s) has been determined. Samsung T7 SSD is an example of acceptable media for data delivery.

2.5 The delivered files must be coherently and logically named and/or numbered and must be placed in delivery directories with prescribed characteristics. NARA will determine any changes to required file naming upon assessment of native files, in consultation with the Contractor. The information must be delivered in specified formats.

2.6 The Contractor must extract data from the following media:

2.7 The Contractor must log metadata descriptive of the extent of the record. NARA will determine metadata requirements upon assessment of native files.

2.8 The Contractor may provide data recovery services. Data recovery services must be approved in advance by a NARA Contracting Officer.

2.8.1 The Contractor must notify the NARA COR if damaged materials are found. The NARA COR must be contacted before incurring additional expenses. If the material will require data recovery, the Contractor must provide the NARA COR with a written cost estimate for the data recovery services.

2.8.2 Data recovery services must not be made without a written approval from a NARA Contracting Officer. The NARA COR is not authorized to approve data recovery services.

2.8.3 If data recovery services are approved, the services will be priced separately and added to the contract via a modification signed by a NARA Contracting Officer and the Contractor. Any data recovery service performed in advance of receiving a fully executed contract modification is at the Contractor’s risk.

3.0 Deliverables

3.1 Timely submission of deliverables and reports is essential to successfully complete this requirement. Schedules for deliverables are specified below.

3.1.1 The Contractor must provide a quality assurance plan to the NARA COR within ten business days after receipt of the materials.

3.1.2 The Contractor must submit monthly written reports. The reports must be submitted to the NARA COR by the 5th of each month. The reports must detail progress of the work, including:

· The total number of files produced in a readable format on archivally stable media

· The specific items reproduced

· Periodic Format conversion assessment (as stated in Section 2.1)

· Any duplicates found

· Any challenges or problems identified during the course of work, and proposed solutions

It is understood that the number of files does not necessarily equate to the number of records.

3.1.3 The Contractor must submit a signed NA Form 14111, Receipt for National Archives and Records Administration Holdings. The NA Form 14111 is due no later than 24 hours after the arrival of shipment of records at the Contractor’s premises. The form must be submitted via email to the NARA COR.

3.1.4 The Contractor must prepare and submit a shipment log. The shipment log must be provided at the final return of records to the NARA COR. NARA may request the shipment log at any time. The shipment log must detail incoming and outgoing shipments of original and reformatted materials. The log must contain:

· A manifest of shipped materials

· The date the materials were received/sent

· The date outgoing shipments were received at their destination and the name of the individual who signed for it

3.1.5 The Contractor must transmit archivally stable files via high-capacity hard drives or direct upload to NARA approved cloud storage staging areas.

4.0 Quality Control Provisions

4.1 The Contractor must initiate, document, and maintain a quality control program specific to this contract throughout the life of this contract.

4.2 The Contractor quality review of extracted and converted files must include, but is not limited to, the following criteria:

· Complete files have been captured

· Files are not corrupted nor password protected

· Files have been virus scanned

· Files open and render properly

4.3 Other factors related to the performance of the contract specifications must include:

· capture and delivery of all items presented to contractor for recovery

· accuracy of file-naming, directory structure, delivery media marking or naming

· completeness and accuracy of documentation in the form of associated databases and quality review reports

4.4 The Contractor must perform quality control for 100 percent of deliverables. The Contractor must be responsible for inspecting the accuracy of filenames and directories for all digital objects produced under this contract. The Contractor must provide a report listing corrective actions that were taken. The quality assurance plan must address all specification and reporting requirements associated with each phase of performance, beginning with receipt of the original materials through delivery and acceptance by NARA.

4.5 The Contractor must be responsible for performing all inspections or evaluations of the quality of all re-work during production to ensure that the quality of the re-work conforms to the guidelines and requirements specified. Inspection equipment must be of appropriate quality, accuracy, and quantity to ensure that all requirements are met. The program must also include procedures that address requirements for data entry, labeling, containers for records (if any), and delivery.

4.6 NARA will conduct audits and any errors identified during this process must be corrected by the Contractor.

4.7 The Contractor will perform corrections of identified errors within 60 days of notification.

4.8 The Contractor will inform the NARA COR via email when the work required under this contract is 80% complete.

5.0 Storage, Security, Handling, and Shipment of Records

5.1 Storage and Security

5.1.1 The NARA materials must be safeguarded against theft, vandalism, unauthorized use, damage, and alteration of any kind.

5.1.2 Storage, transportation, and use temperatures must not exceed 75 degrees Fahrenheit and must not exceed 50 percent relative humidity.

5.1.3 The Contractor’s facility must have a fire detection system and be wired to an emergency signal company that will bring the fire department to the laboratory expeditiously.

5.1.4 The Contractor’s facility must have good ventilation and be free from gaseous fumes such as those emitted from chemical stores or freshly painted rooms.

5.1.5 NARA’s records must not be sent to any other facility except NARA’s without the written authorization of the NARA Contracting Officer.

5.2 Handling

5.2.1 NARA records must be handled in a clean work environment with dust-free and clutter-free worktables.

5.2.2 Smoking, beverages, and food must be prohibited in the receiving and shipping areas, the media storage area, technical equipment facility, and the work area where the materials are digitized.

5.2.3 The work environment must avoid extreme heat, high humidity, rapid temperature or humidity changes, and prolonged sunlight or other sources of ultraviolet light.

5.2.4 Optical media must be handled by the center hold or edges of the disc to avoid fingerprints on the disc surface that may affect drive performance.

5.2.5 If the Contractor is working with original records and finds any materials in poor condition such that digitization may result in further damage, the contractor must notify the NARA COR immediately. NARA will then assess the condition and make a determination for the correct action.

5.3 Pickup and Delivery of Records and Deliverables to NARA

5.3.1 NARA will prepare and pack materials for pick-up or shipping from NARA's Archives II site in College Park, MD. Original records will be provided when material cannot be duplicated.

5.3.2 The materials must be picked up by the Contractor or the Contractor’s licensed and bonded courier at NARA no more than 30 days after being notified via email by the NARA COR that they are available for pickup. The materials may also be shipped, at NARA's expense, to the Contractor via a NARA-approved shipper. The NARA COR will notify the Contractor via email when materials are shipped by NARA. NARA has final approval over the method of shipment.

5.3.3 Each shipment will be accompanied by an inventory that lists each original record by item number. The Contractor must validate shipments and sign a receipt for them. The Contractor must return a receipt that lists all items received to the NARA COR via email within seven business days.

5.3.4 A written record must be made of any deviation(s) from the NARA-furnished inventory and the NARA COR must be notified immediately. To minimize the potential for loss or damage to the original recordings, NARA will ship materials in batches.

5.3.5 The Contractor must carefully perform a complete inspection and inventory upon receipt of all materials with respect to quality as well as quantity. The Contractor must contact the NARA COR immediately if there are any items listed on the NA Form 14111, Receipt for National Archives and Records Administration Holdings, but not included with the materials received. Damaged materials must be reported to the NARA COR.

5.3.6 Upon completion of the required work to copy and encode the items, all material must be shipped or delivered to NARA in an expeditious fashion. All materials must be returned to NARA. For shipments of originals to NARA, the Contractor must return the records in their original boxes, package them securely, and ship or deliver them to the National Archives at College Park.

5.3.7 The records must be shipped to the attention of the NARA COR and all shipments must be coordinated with the NARA COR in advance of shipping.

5.3.8 If the Contractor transports the records directly, only a secure, enclosed vehicle will be permitted to carry the records. Trunks of private cars are not acceptable. Smoking, eating, and drinking must not be allowed in the travel compartment with shipments of records.

5.3.9 If the Contractor transports the records directly, the items must be transported directly to the Contractor’s facility without stops for other client’s goods, for meal breaks, refueling stops, etc. The intent is to minimize the amount of time the Government’s materials are on the road.

5.3.10 If the Contractor uses UPS "Next Day Air Early" with signature and receipt, the Contractor is responsible for ensuring the following:

5.3.10.1 Overnight shipments must originate on Monday through Thursday. The intent is to ensure that the materials do not languish in a delivery vehicle or a warehouse over a weekend or holiday period.

5.3.10.2 The Contractor must take into account that there are Federal Government holidays during the year and must ensure that delivery days will not fall on one of these days. The Federal Government holidays are New Year’s Day, Martin Luther King Jr.’s Birthday, Inauguration Day, Washington’s Birthday, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day. Some of these holidays “float” from year-to-year so the dates must be researched for each calendar year.

5.3.10.3 Each shipment must be accompanied by a Contractor created shipping inventory that lists each item by its number and the order number that it is a part of, as well as the original, signed NA Form 14111, Receipt for National Archives and Records Administration Holdings. Upon receipt of a shipment, NARA will verify the inventory and send an email with a Word attachment that lists the items received. Receipt of the email and the Word attachment will then constitute a written record of the acceptance of the shipment by the NAR COR. Therefore, any deviation(s) must be known by both the Contractor and by the NARA COR immediately.

6.0 Performance Specifications / Additional Requirements

6.1 The Contractor must be responsible for safeguarding all government furnished equipment, information, and property provided for Contractor use.

6.2 The Government has unlimited rights to all documents/material produced under this contract. All information, data, and material related to this contract that the contractor gathers or obtains will be both protected from unauthorized release and considered the property of the government. The contracting officer will be the sole authorized official to release verbally or in writing any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. Press releases, marketing material, or any other printed or electronic documentation related to this contract must not be publicized without the written approval of the contracting officer. This right does not abrogate any other Government rights.

6.3 Contractor must comply with NARA’s Records Management Obligations.

6.4 If, in accordance with FAR 52.242-15, Stop-Work Order, the Contractor is required to stop the work called for in this contract, the Contractor must return all records to NARA within two business days.

6.5 Travel expenses will not be paid.

7.0 Government Furnished Property

7.1 The Government will provide the records to be digitized and unencoded.

7.2 Records must be returned to NARA.

8.0 Contractor Furnished Property and Services

8.1 The Contractor must provide all personnel, supplies, facilities, transportation, materials, supervision, and other items and services necessary to perform the services as defined in this performance work statement except for those items specified as government furnished property.

8.2 The Contractor must provide all tools and equipment necessary to meet the requirements of this contract.

8.3 NARA reserves the right to inspect the Contractor’s facilities and equipment during the term of the contract. During the term of the contract, the Contractor also agrees to allow for periodic re-inspection by NARA with prior notification to the Contractor. In addition, NARA and all its designees must have access at all reasonable times to the Contractor premises in which any NARA records and materials are located for purposes of inspecting the Government’s property. This inspection may include its receiving, storage, work, laboratory, and shipping areas.

ATTACHMENT 2

SCHEDULE OF PRICES

OF

ISSUE

Manufacturer Stock Identifier:

3M DC6150 Data Cartridge Tape 150 MB 620 ft.

Each

Manufacturer Stock Identifier:

3M Imation Black Watch 3480 210MB 1/2" Tape Cartridge

Attachment 1, Performance Work Statement

Castlewood ORB 2.2GB removable magnetic disk

Graham Magnetics 9-track mainframe Magnetic Tape 6250 CPI 170 MB

Manufacturer Stock Identifier:

Hewlett Packard 92279T 1.2GB rewritable optical disks

Manufacturer Stock Identifier:

Imation Royal Guard 3490E 810 MB cartridge

Attachment 1, Performance Work Statement

Attachment 1, Performance Work Statement

Not to Exceed

Attachment 1, Performance Work Statement

Not to Exceed

TOTAL CONTRACT CEILING PRICE: $_____________

Note: The sum of the Total Contract Ceiling Price should include the Not to Exceed prices shown.

NARA will evaluate submitted pricing in accordance with FAR 52.217-5.

ATTACHMENT 3

RFQ INFORMATION SHEET

Contractors must complete all applicable information on this sheet and submit it with their quotation. Failure to do so may render the quotation unacceptable for receipt of the order.

Specific Terms, Conditions, and Administrative Information

PAYMENT TERMS: _________________________________________________

DELIVERY DATE: _____________________________________________________

WARRANTY INFORMATION: ___________________________________________

NAME AND ADDRESS OF QUOTER:

TELEPHONE NO (INCLUDE AREA CODE): __________________________

E-MAIL ADDRESS: _____________________________________

ENROLLED IN SYSTEM FOR AWARD MANAGEMENT? Yes____ No____

CAGE CODE NUMBER: _____________________________________

UNIQUE ENTITY ID: _______________________________________

Contractor Certification: [By signing the Contractor acknowledges that the information provided in response to this RFQ is correct.]

NAME AND TITLE OF SIGNER: __________________________________

DATE OF QUOTATION: ___________________________________

SIGNATURE OF PERSON AUTHORIZED TO SIGN: ______________________________

ATTACHMENT 4

ADDITIONAL NARA TERMS AND CONDITIONS

(Addenda to FAR clause 52.212-4)

I. GOVERNMENT CONTRACT ADMINISTRATION

A. This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer, Code Z 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

B. Contract Specialist (CS):

Cynthia Jones Telephone: 301-837-1860 Email: cynthia.jones@nara.gov

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be emailed or mailed with postage prepaid, to the above address.

C. Contracting Officer (CO):

Any Z Warranted CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding delivery questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

A. COR: See award document

B. The individual named above is designated as the Contracting Officer’s Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The COR serves as the point of contact through which the Contractor can relay questions or problems of a technical nature to the Contract Specialist and the Contracting Officer. The COR is responsible for the inspection and acceptance of the contract requirements and for the review and certification of invoices for the contract requirements.

C. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the Contracting Officer be effective or binding upon the Government.

D. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the Contracting Officer in writing.

E. No action will be taken by the Contractor under such technical instruction unless the Contracting Officer has issued a contractual change.

III. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – INVOICE PROCESSING PLATFORM (IPP) (July 2020)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Products and Commercial Services included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice: Invoices shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

Contractor Invoice to include:

1. Award number

2. CLIN//Item number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection if applicable

7. Serial number/part number if applicable

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

IV. CONFIDENTIALITY OF INFORMATION

By agreeing to this contract and/or any amendments, the Contractor acknowledges, understands, and accepts the following:

A. All information regarding the procedures developed under this contract must be regarded as sensitive information by the Contractor and not to be disclosed to anyone outside the Contractor’s organization without the written permission of the Contracting Officer.

B. The Contractor may have access to and use of data or information, which may be considered proprietary or confidential. Dissemination or use of the data or information, other than in performance of this contract, would be adverse to the interests of the Government and others.

C. The Contractor agrees in the performance of this contract to keep all information supplied by the Government and all information obtained in conducting research in the strictest confidence; this information being the sole property of the Government.

D. The Contractor agrees that its personnel will not divulge or release data or information developed or obtained in connection with the performance of this contract. The Contractor agrees not to publish, reproduce, or otherwise divulge such information in whole or in part, in any manner or form, nor authorize others to do so, taking such reasonable measures as are necessary to restrict the information to those personnel who must have the information to perform the work provided herein.

E. The Contractor must establish policies and procedures to implement the substance of this clause at the individual employee level which will assure that affected personnel are made aware of contract provisions and terms and conditions and the Contractor’s implementing policies and procedures. Particular attention will be given to keeping personnel advised of the statutes and regulations applicable to the handling of other Contractor confidential financial data.

F. The Contractor must not refer to this contract in commercial advertising, or similar promotions and the Contractor is restricted from reproducing the image(s) of NARA in any form of commercial advertising or similar promotion without the expressed written permission of the Contracting Officer. This includes images of official seals and buildings, which is controlled by NARA.

G. The Contractor must not release confidential IRS information unless the disclosure is authorized under the provisions of the IRC, the Privacy Act, Title 18 U.S.C., and the terms of the respective IRS Contract. Unauthorized disclosures by any Contractor employee could subject him/her to civil and criminal penalties under Title 26 U.S.C. sections 7213, 7213A, and 7431, Title 5, U.S.C. section 552a of the Privacy Act, and Title 18 U.S.C. sections 641 and 3571.

V. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or…