Attachment 2- Provision and Clauses.pdf

Provisions and Clauses

52.252-1 Solicitation Provisions Incorporated by Reference.

As prescribed in 52.107(a), insert the following provision:

Solicitation Provisions Incorporated by Reference (Feb 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

https://www.acquisition.gov/far/

(End of provision)

FAR

Provision No. Title Date

52.204-7 System for Award Management NOV 2024

52.204-16 Commercial and Government Entity Code Reporting AUG 2020

52.204-17 Ownership or Control of Offeror AUG 2020

52.204-24

Representation Regarding Certain Telecommunications and Video

Surveillance Services or Equipment NOV 2021

52.204-26 Covered Telecommunications Equipment or Services-Representation OCT 2020

52.204-29

Federal Acquisition Supply Chain Security Act Orders—Representation and Disclosures DEC 2023

52.209-2

Prohibition on Contracting with Inverted Domestic Corporations—

Representation NOV 2015

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a

Felony Conviction under any Federal Law

FEB 2016

52.212-1 Instructions to Offerors—Commercial Products and Commercial Services SEP 2023

52.212-2 Evaluation—Commercial Products and Commercial Services NOV 2021

52.212-3

Offeror Representations and Certifications—Commercial Products and

Commercial Services MAR 2025

52.212-3-

Alternate 1

Offeror Representations and Certifications—Commercial Products and

Commercial Services--Alternate I JAN 2024

52.217-5 Evaluation of Options JUL 1990

52.223-22 Public Disclosure of Greenhouse Gas Emissions and Reduction Goals—

Representation

DEC 2016

52.225-18 Place of Manufacture AUG 2018

52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or

Transactions Relating to Iran—Representation and Certifications

JUN 2020

FAR PROVISIONS

52.252-5 Authorized Deviations in Provisions NOV 2020

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

As prescribed in 4.2105(a), insert the following provision:

Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment

(Nov 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications

Equipment or Services—Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror

Representations and Certifications-Commercial Products or Commercial Services. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it

"does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at

52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision—

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for

Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019

(Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award

Management (SAM) ( https://www.sam.gov) for entities excluded from receiving federal awards for

"covered telecommunications equipment or services".

(d) Representation. The Offeror represents that—

(1) It □ will, □ will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It □ does, □ does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds

"does" in paragraph (d)(2) of this section.

(e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided;

and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded

"does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

52.204-26 Covered Telecommunications Equipment or Services-Representation.

As prescribed in 4.2105(c), insert the following provision:

Covered Telecommunications Equipment or Services-Representation (Oct 2020)

(a) Definitions. As used in this provision, "covered telecommunications equipment or services" and

"reasonable inquiry" have the meaning provided in the clause 52.204-25, Prohibition on Contracting for

Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award

Management (SAM) ( https://www.sam.gov) for entities excluded from receiving federal awards for

"covered telecommunications equipment or services".

(c) (1) Representation. The Offeror represents that it □ does, □ does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

(2) After conducting a reasonable inquiry for purposes of this representation, the offeror represents that it

□ does, □ does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services.

52.217-5 Evaluation of Options.

As prescribed in 17.208(c), insert a provision substantially the same as the following:

https://www.acquisition.gov/far/17.208#FAR_17_208

Evaluation of Options (July 1990)

Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the

Government to exercise the option(s).

52.252-2 Clauses Incorporated by Reference.

As prescribed in 52.107(b), insert the following clause:

CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

(End of clause)

FAR Clause

No. Title Date

52.203-17

Contractor Employee Whistleblower Rights, DHS-USCG DEVIATION

14-01, Revision 1 APR 2024

52.203-19

Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements JAN 2017

52.204-9 Personal Identity Verification of Contractor Personnel JAN 2011

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards JUN 2020

52.204-13 System for Award Management Maintenance OCT 2018

52.204-18 Commercial and Government Entity Code Maintenance AUG 2020

52.204-23 Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab Covered Entities

(DEVIATION 20-05)

JUL 2024

52.204-25

Prohibition of Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment NOV 2021

52.204-27 Prohibition on a ByteDance Covered Application JUN 2023

52.209-6

Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment JAN 2025

52.212-4

Contract Terms and Conditions—Commercial Products and

Commercial Services NOV 2023

52.212-5

Contract Terms and Conditions Required To Implement Statutes or

Executive Orders—Commercial Products and Commercial Services JAN 2025

52.217-8 Option to Extend Services NOV 1999

FAR CLAUSES

https://www.acquisition.gov/far/17.206#FAR_17_206

52.217-9 Option to Extend the Term of the Contract MAR 2000

52.219-28 Post-Award Small Business Program Rerepresentation JAN 2025

52.219-4

Notice of Price Evaluation Preference for HUBZone Small Business

Concerns OCT 2022

52.222-50 Combating Trafficking in Persons NOV 2021

52.223-5 Pollution Prevention & Right-To-Know Information MAY 2024

52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving MAY 2024

52.223-5 Pollution Prevention & Right-To-Know Information MAY 2024

52.232-33

Payment by Electronic Funds Transfer—System for Award

Management OCT 2018

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013

52.232-40 Providing Accelerated Payments to Small Business Subcontractors NOV 2021

52.233-3 Protest after Award JUN 1985

52.233-4 Applicable Law for Breach of Contract Claim OCT 2004

52.237-2 Protection of Government Buildings, Equipment, and Vegetation APR 1984

52.252-6 Authorized Deviations in Clauses NOV 2020

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities.

As prescribed in 4.2004 , insert the following clause:

Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky

Lab Covered Entities. (Dec 2023)

(e) Definitions. As used in this clause—

Kaspersky Lab covered article means any hardware, software, or service that–

(e) Is developed or provided by a Kaspersky Lab covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky

Lab covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky

Lab covered entity.

Kaspersky Lab covered entity means–

(e) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year

2018 (Pub. L. 115-91) prohibits Government use of any Kaspersky Lab covered article. The Contractor is prohibited from—

(e) Providing any Kaspersky Lab covered article that the Government will use on or after October 1, 2018; and

(2) Using any Kaspersky Lab covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

has Reporting requirement.

(e) In the event the Contractor identifies a Kaspersky Lab covered article provided to the

Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph has(1) of this clause:

(e) Within 3 business days from the date of such identification or notification: the contract number;

the order number(s), if applicable; supplier name; brand; model number (Original Equipment

Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph has(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the

Contractor shall describe the efforts it undertook to prevent use or submission of a Kaspersky Lab covered article, any reasons that led to the use or submission of the Kaspersky Lab covered article, and any additional efforts that will be incorporated to prevent future use or submission of Kaspersky Lab covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts including subcontracts for the acquisition of commercial products or commercial services.

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance

Services or Equipment.

As prescribed in 4.2105(b), insert the following clause:

Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or

Equipment (Nov 2021)

(e) Definitions. As used in this clause— https://dibnet/

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered foreign country means The People’s Republic of China.

Covered telecommunications equipment or services means–

(e) Telecommunications equipment produced by Huawei Technologies Company or ZTE

Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology

Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment;

or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means–

(e) Defense articles or defense services included on the United States Munitions List set forth in the

International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of

Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export

Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(e) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal

Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control

Reform Act of 2018 (50 U.S.C. 4817).

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Reasonable inquiry means an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for

Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The

Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR

4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019

(Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

has Exceptions. This clause does not prohibit contractors from providing—

(e) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement. (1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph

(d)(2) of this clause to the Contracting Officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause

(e) Within one business day from the date of such identification or notification: the contract number;

the order number(s), if applicable; supplier name; supplier unique entity identifier (if known);

supplier Commercial and Government Entity (CAGE) code (if known); brand; model number

(original equipment manufacturer number, manufacturer part number, or wholesaler number);

item description; and any readily available information about mitigation actions undertaken or

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

has Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph has and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services.

52.217-8 Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within five (5) days of the contract expiration.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

As prescribed in 17.208(g), insert a clause substantially the same as the following:

Option to Extend the Term of the Contract (Mar 2000)

(a)The Government may extend the term of this contract by written notice to the Contractor within five (5) days of the contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

https://www.acquisition.gov/far/17.208#FAR_17_208

(b)If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c)The total duration of this contract, including the exercise of any options under this clause, shall not exceed 12 months.

3052.204-71 Contractor employee access.

As prescribed in (HSAR) 48 CFR 3004.470–4(a), insert the following clause with appropriate alternates:

Contractor Employee Access (JUL 2023)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility

Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual

“Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated

September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information

Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L.

116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of

Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security

Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation

Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD

2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of

2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its

HSAR

immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of

Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally

Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not

PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability.

Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting

Officer's request, the Contractor's employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the

Government's activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

3052.204-71Contractor employee access. Alternate II (JUL 2023)

When the Department has determined contract employee access to controlled unclassified information or

Government facilities must be limited to U.S. citizens and lawful permanent residents, but the contract will not require access to information resources, add the following paragraphs:

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident

Card (USCIS I-551). Any exceptions must be approved by the Department's Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE, AND

SERVICES DEVELOPED OR PROVIDED BY KASPERSKY LAB COVERED ENTITIES

(DEVIATION 20-05) (JUL 2024)

(a) Definitions. As used in this clause-

Kaspersky Lab covered article means any hardware, software, or service that– (1)

Is developed or provided by a Kaspersky Lab covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a

Kaspersky Lab covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a

Kaspersky Lab covered entity.

Kaspersky Lab covered entity means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”; (3)

Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal

Year 2018 (Pub. L. 115-91) prohibits Government use of any Kaspersky Lab covered article. The

Contractor is prohibited from—

(1) Providing any Kaspersky Lab covered article that the Government will use on or after October

1, 2018; and

DEVIATIONS

(2) Using any Kaspersky Lab covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event the Contractor identifies covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report, in writing, via email, to the Contracting Officer, Contracting

Officer's Representative, and the Enterprise Security Operations Center (SOC) at NDAA

Incidents@hq.dhs.gov, with required information in the body of the email. In the case of the

Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Enterprise SOC, Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) and Contracting Officer's

Representative(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 3 business days from the date of such identification or notification:

the contract number; the order number(s), if applicable; supplier name;

brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or

(ii) Within 10 business days of submitting the report pursuant to paragraph

(c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a Kaspersky Lab covered article, any reasons that led to the use or submission of the Kaspersky Lab covered article, and any additional efforts that will be incorporated to prevent future use or submission of Kaspersky Lab covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

FAR Class Deviation 25-01 applies to all solicitations and contracts to implement Executive Order

(E.O.) 14173, Ending Illegal Discrimination and Restoring Merit-Based Opportunity, and E.O. 14168, Defending Women From Gender Ideology Extremism and Restoring Biological Truth to the Federal

Government. This class deviation supersedes Acquisition Alert 25-06, Revoked: E.O. 11246, Equal

Opportunity Employment.

The following provisions and clauses SHALL NOT be included:

• 52.222-9, Apprentices and Trainees https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://dibnet.dod.mil/ https://www.acquisition.gov/far/2.101

• 52.222-21, Prohibition of Segregated Facilities

• 52.222-22, Previous Contracts and Compliance Reports

• 52.222-23, Notice of Requirement for Affirmative Action to Ensure Equal Employment Opportunity for Construction

• 52.222-24, Preaward On-Site Equal Opportunity Compliance Evaluation

• 52.222-25, Affirmative Action Compliance

• 52.222-26, Equal Opportunity

• 52.222-27, Affirmative Action Compliance Requirements for Construction

• 52.222-29, Notification of Visa Denial

The following provisions and clauses SHALL be included, if applicable:

• 52.204-8, Annual Representations and Certifications (JAN 2025) (DEVIATION FEB 2025)

• 52.222-6, Construction Wage Rate Requirements (AUG 2018) (DEVIATION FEB 2025)

• 52.222-11, Subcontracts (Labor Standards) (MAY 2014) (DEVIATION FEB 2025)

• 52.222-12, Contract Termination—Debarment (MAY 2014) (DEVIATION FEB 2025)

• 52.244-6, Subcontracts for Commercial Products and Commercial Services (JAN 2025)

(DEVIATION FEB 2025)

System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in agency solicitations. Examples include 52.222-25, Affirmative Action Compliance, and paragraph (d) of 52.212-

3, Offeror Representations and Certifications—Commercial Products and Commercial Services.

Additional examples include 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Products and Commercial Services, and 52.213-4, Terms and

Conditions—Simplified Acquisitions (Other Than Commercial Products and Commercial Services).

Contracting officers will not consider the following representations when making award decisions or enforce requirements:

• Paragraph (d) of 52.212-3, Offeror Representations and Certifications—Commercial Products and

Commercial Services;

• Paragraphs (b)(33), (b)(34), (e)(1)(ix), and (e)(1)(x) of 52.212-5, Contract Terms and Conditions

Required To Implement Statutes or Executive Orders—Commercial Products and Commercial

Services;

• Paragraphs (e)(1)(ii)(I) and (e)(1)(ii)(J) of Alternate II of 52.212-5, Contract Terms and Conditions

Required To Implement Statutes or Executive Orders—Commercial Products and Commercial

Services; and

• Paragraphs (a)(1)(vii) and (a)(1)(viii) of 52.213-4, Terms and Conditions—Simplified Acquisitions

(Other Than Commercial Products and Commercial Services).

Entities are not required to, nor are they able to, update their entity registration to remove these representations in SAM.

FAR Class Deviation 25-02 waives the FAR requirement to use project labor agreements for large-scale construction projects.

FAR Class Deviation 25-03 addresses contracting officer actions to implement E.O. 14148 Initial

Rescissions of Harmful Executive Orders and Action and E.O.14208 Ending Procurement and Forced

Use of Paper Straws.

The following provisions and clauses SHALL NOT be included:

● 52.204-8 Annual Representations and Certifications (JAN 2025)

● 52.223-1 Biobased Product Certification (MAY 2024)

● 52.223-2 Reporting of Biobased Products Under Service and Construction Contracts (MAY 2024)

● 52.223-10 Waste Reduction Program (MAY 2024)

● 52.223-19, Compliance with Environmental Management Systems (MAY 2011)

● 52.223-22, Public Disclosure of Greenhouse Gas Emissions and Reduction Goals—Representation

(DEC 2016)

● 52.223-23, Sustainable Products and Services (MAY 2024)

The following provisions and clauses SHALL be included, if applicable:

● 52.204-8 Annual Representations and Certifications (JAN 2025) (DEVIATION FEB 2025)

● 52.223-1 Biobased Product Certification (MAY 2024) (DEVIATION FEB 2025)

● 52.223-2 Reporting of Biobased Products Under Service and Construction Contracts (MAY 2024)

(DEVIATION FEB 2025)

● 52.223-10 Waste Reduction Program (MAY 2024) (DEVIATION FEB 2025)

● 52.223-23, Sustainable Products and Services (MAY 2024) (DEVIATION FEB 2025)

System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in agency solicitations, including 52.223-22, Public Disclosure of Greenhouse Gas Emissions and Reduction

Goals—Representation, and paragraph (t) of 52.212-3, Offeror Representations and Certifications—

Commercial Products and Commercial Services. Components shall not consider or use these representations.

Contracting officers will not consider the following representations when making award decisions or enforce requirements:

• Paragraph (d) and (t) of 52.212-3, Offeror Representations and Certifications—Commercial Products and Commercial Services;

• Paragraphs (b)(33), (b)(34), (e)(1)(ix), and (e)(1)(x) of 52.212-5, Contract Terms and Conditions

Required To Implement Statutes or Executive Orders—Commercial Products and Commercial

Services. Additionally, per this deviation, in paragraph (b)(46), E.O. 14057 does not apply;

• Paragraphs (e)(1)(ii)(I) and (e)(1)(ii)(J) of Alternate II of 52.212-5, Contract Terms and Conditions

Required To Implement Statutes or Executive Orders—Commercial Products and Commercial

Services; and

• Paragraphs (a)(1)(vii) and (a)(1)(viii) of 52.213-4, Terms and Conditions—Simplified Acquisitions

(Other Than Commercial Products and Commercial Services). Additionally, per this deviation, in paragraph (b)(1)(xvii), E.O. 14057 does not apply.

Entities are not required to, nor are they able to, update their entity registration to remove these representations in SAM.