ATTACHMENT 6 - Reps and Certs.pdf

ATTACHMENT 6 – Representations & Certifications

52.204-16 – Commercial and Government Entity Code Reporting (AUG 2020)

(a) Definition. As used in this provision –

Commercial and Government Entity (CAGE) code means–

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

(b) The Offeror shall provide its CAGE code with its offer with its name and location address or otherwise include it prominently in its proposal. The CAGE code must be for that name and location address. Insert the word "CAGE" before the number. The CAGE code is required prior to award.

(c) CAGE codes may be obtained via–

(1) Registration in the System for Award Management (SAM) at www.sam.gov. If the Offeror is located in the United States or its outlying areas and does not already have a CAGE code assigned, the DLA Commercial and Government Entity (CAGE) Branch will assign a CAGE code as a part of the SAM registration process. SAM registrants located outside the United States and its outlying areas shall obtain a NCAGE code prior to registration in SAM (see paragraph (c)(3) of this provision).

(2) The DLA Contractor and Government Entity (CAGE) Branch. If registration in SAM is not required for the subject procurement, and the Offeror does not otherwise register in SAM, an Offeror located in the United States or its outlying areas may request that a CAGE code be assigned by submitting a request at https://cage.dla.mil.

(3) The appropriate country codification bureau. Entities located outside the United States and its outlying areas may obtain an NCAGE code by contacting the Codification Bureau in the foreign entity's country if that country is a member of NATO or a sponsored nation.

NCAGE codes may be obtained from the NSPA at https://eportal.nspa.nato.int/AC135Public/scage/CageList.aspx if the foreign entity’s country is not a member of NATO or a sponsored nation. Points of contact for codification bureaus, as well as additional information on obtaining NCAGE codes, are available at http://www.nato.int/structur/AC/135/main/links/contacts.htm.

https://www.sam.gov/ https://cage.dla.mil/ https://eportal.nspa.nato.int/AC135Public/scage/CageList.aspx http://www.nato.int/structur/AC/135/main/links/contacts.htm

(d) Additional guidance for establishing and maintaining CAGE codes is available at https://cage.dla.mil.

(e) When a CAGE code is required for the immediate owner and/or the highest-level owner by Federal Acquisition Regulation (FAR) 52.204-17 or 52.212-3(p), the Offeror shall obtain the respective CAGE code from that entity to supply the CAGE code to the Government.

(f) Do not delay submission of the offer pending receipt of a CAGE code.

(g) If the solicitation includes FAR clause 52.204-2, Security Requirements, a subcontractor requiring access to classified information under a contract shall be identified with a CAGE code on the DD Form 254. The Contractor shall require a subcontractor requiring access to classified information to provide its CAGE code with its name and location address or otherwise include it prominently in the proposal. Each location of subcontractor performance listed on the DD Form 254 is required to reflect a corresponding unique CAGE code for each listed location unless the work is being performed at a Government facility, in which case the agency location code shall be used. The CAGE code must be for that name and location address.

Insert the word "CAGE" before the number. The CAGE code is required prior to award.

(End of provision)

52.204-24 – Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services—Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications- Commercial Products or Commercial Services . The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision—

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

https://cage.dla.mil/ https://www.acquisition.gov/far/part-52#FAR_52_204_17 https://www.acquisition.gov/far/part-52#FAR_52_212_3 https://www.acquisition.gov/far/part-52#FAR_52_204_2 https://www.acquisition.gov/far/part-52#FAR_52_204_26 https://www.acquisition.gov/far/part-52#FAR_52_212_3 https://www.acquisition.gov/far/part-52#FAR_52_204_26 https://www.acquisition.gov/far/part-52#FAR_52_212_3 https://www.acquisition.gov/far/part-52#FAR_52_204_25

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.

Nothing in the prohibition shall be construed to—

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) ( https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

(d) Representation. The Offeror represents that—

(1) It □ will, □ will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and https://www.sam.gov/

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that—

It □ does, □ does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number;

and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment—

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number;

and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services—

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided;

and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

52.209-7 – Information Regarding Responsibility Matters (OCT 2018)

(a) Definitions. As used in this provision—

“Administrative proceeding” means a non-judicial process that is adjudicatory in nature in order to make a determination of fault or liability (e.g., Securities and Exchange Commission Administrative Proceedings, Civilian Board of Contract Appeals Proceedings, and Armed Services Board of Contract Appeals Proceedings). This includes administrative proceeding at the Federal and State level but only in connection with performance of a Federal contract or grant. It does not include agency actions such as contract audits, site visits, corrective plans, or inspection of deliverables.

“Federal contracts and grants with total value greater than $10,000,000” means—

(1) The total value of all current, active contracts and grants, including all priced options; and

(2) The total value of all current, active orders including all priced options under indefinite-delivery, indefinite-quantity, 8(a), or requirements contracts (including task and delivery and multiple-award Schedules).

“Principal” means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager; head of a division or business segment; and similar positions).

(b) The offeror [ ] has [ ] does not have current active Federal contracts and grants with total value greater than $10,000,000.

(c) If the offeror checked “has” in paragraph (b) of this provision, the offeror represents, by submission of this offer, that the information it has entered in the Federal Awardee Performance and Integrity Information System (FAPIIS) is current, accurate, and complete as of the date of submission of this offer with regard to the following information:

(1) Whether the offeror, and/or any of its principals, has or has not, within the last five years, in connection with the award to or performance by the offeror of a Federal contract or grant, been the subject of a proceeding, at the Federal or State level that resulted in any of the following dispositions:

(i) In a criminal proceeding, a conviction.

(ii) In a civil proceeding, a finding of fault and liability that results in the payment of a monetary fine, penalty, reimbursement, restitution, or damages of $5,000 or more.

(iii) In an administrative proceeding, a finding of fault and liability that results in—

(A) The payment of a monetary fine or penalty of $5,000 or more;

or

(B) The payment of a reimbursement, restitution, or damages in excess of $100,000.

(iv) In a criminal, civil, or administrative proceeding, a disposition of the matter by consent or compromise with an acknowledgment of fault by the Contractor if the proceeding could have led to any of the outcomes specified in paragraphs (c)(1)(i), (c)(1)(ii), or (c)(1)(iii) of this provision.

(2) If the offeror has been involved in the last five years in any of the occurrences listed in (c)(1) of this provision, whether the offeror has provided the requested information with regard to each occurrence.

(d) The offeror shall post the information in paragraphs (c)(1)(i) through (c)(1)(iv) of this provision in FAPIIS as required through maintaining an active registration in the System for Award Management database via https://www.sam.gov/SAM/ (see 52.204-7).

52.209-13 Violation of Arms Control Treaties or Agreements-Certification (NOV 2021)

(a) This provision does not apply to acquisitions at or below the simplified acquisition threshold or to acquisitions of commercial products and commercial services as defined in Federal Acquisition Regulation 2.101.

(b) Certification. [Offeror shall check either (1) or (2).]

__ (1) The Offeror certifies that–

(i) It does not engage and has not engaged in any activity that contributed to or was a significant factor in the President's or Secretary of State's determination that a foreign country is in violation of its obligations undertaken in any arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state.

The determinations are described in the most recent unclassified annual report provided to Congress pursuant to section 403 of the Arms Control and Disarmament Act ( 22 U.S.C. 2593a).

The report is available at https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/;

and

(ii) No entity owned or controlled by the Offeror has engaged in any activity that contributed to or was a significant factor in the President's or Secretary of State's determination that a foreign country is in violation of its obligations undertaken in any arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. The determinations are described in the most recent unclassified annual report provided to Congress pursuant to section 403 of the Arms Control and Disarmament Act ( 22 U.S.C. 2593a). The report is available at https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/; or

__ (2) The Offeror is providing separate information with its offer in accordance with paragraph (d)(2) of this provision.

(c) Procedures for reviewing the annual unclassified report (see paragraph (b)(1) of this provision). For clarity, references to the report in this section refer to the entirety of the annual unclassified report, including any separate reports that are incorporated by reference into the annual unclassified report.

https://www.sam.gov/SAM/ https://www.acquisition.gov/far/2.101#FAR_2_101 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title22-section2593a&num=0&edition=prelim https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/ https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/ http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title22-section2593a&num=0&edition=prelim https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/ https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/ https://www.state.gov/bureaus-offices/under-secretary-for-arms-control-and-international-security-affairs/bureau-of-arms-control-verification-and-compliance/

(1) Check the table of contents of the annual unclassified report and the country section headings of the reports incorporated by reference to identify the foreign countries listed there.

Determine whether the Offeror or any person owned or controlled by the Offeror may have engaged in any activity related to one or more of such foreign countries.

(2) If there may have been such activity, review all findings in the report associated with those foreign countries to determine whether or not each such foreign country was determined to be in violation of its obligations undertaken in an arms control, nonproliferation, or disarmament agreement to which the United States is a party, or to be not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. For clarity, in the annual report an explicit certification of non-compliance is equivalent to a determination of violation. However, the following statements in the annual report are not equivalent to a determination of violation:

(i) An inability to certify compliance.

(ii) An inability to conclude compliance.

(iii) A statement about compliance concerns.

(3) If so, determine whether the Offeror or any person owned or controlled by the Offeror has engaged in any activity that contributed to or is a significant factor in the determination in the report that one or more of these foreign countries is in violation of its obligations undertaken in an arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. Review the narrative for any such findings reflecting a determination of violation or non-adherence related to those foreign countries in the report, including the finding itself, and to the extent necessary, the conduct giving rise to the compliance or adherence concerns, the analysis of compliance or adherence concerns, and efforts to resolve compliance or adherence concerns.

(4) The Offeror may submit any questions with regard to this report by email to NDAA1290Cert@state.gov. To the extent feasible, the Department of State will respond to such email inquiries within 3 business days.

(d) Do not submit an offer unless—

(1) A certification is provided in paragraph (b)(1) of this provision and submitted with the offer; or

(2) In accordance with paragraph (b)(2) of this provision, the Offeror provides with its offer information that the President of the United States has

(i) Waived application under 22 U.S.C. 2593e(d) or (e); or mailto:NDAA1290Cert@state.gov http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title22-section2593e&num=0&edition=prelim

(ii) Determined under 22 U.S.C. 2593e(g)(2) that the entity has ceased all activities for which measures were imposed under 22 U.S.C. 2593e(b).

(e) Remedies. The certification in paragraph (b)(1) of this provision is a material representation of fact upon which reliance was placed when making award. If it is later determined that the Offeror knowingly submitted a false certification, in addition to other remedies available to the Government, such as suspension or debarment, the Contracting Officer may terminate any contract resulting from the false certification.

(End of provision)

252.203-7005 Representation Relating to Compensation of Former DoD Officials (NOV 2011)

(a) Definition. “Covered DoD official” is defined in the clause at 252.203-7000, Requirements Relating to Compensation of Former DoD Officials.

(b) By submission of this offer, the offeror represents, to the best of its knowledge and belief, that all covered DoD officials employed by or otherwise receiving compensation from the offeror, and who are expected to undertake activities on behalf of the offeror for any resulting contract, are presently in compliance with all post-employment restrictions covered by 18 U.S.C. 207, 41 U.S.C. 2101-2107, and 5 CFR parts 2637 and 2641, including Federal Acquisition Regulation 3.104-2.

252.204-7008 Compliance with Safeguarding Covered Defense Information Controls (OCT 2016)

(a) Definitions. As used in this provision—

“Controlled technical information,” “covered contractor information system,” and “covered defense information” are defined in clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

(b) The security requirements required by contract clause 252.204-7012, Covered Defense Information and Cyber Incident Reporting, shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see 252.204- 7012(b)(2)—

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title22-section2593e&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title22-section2593e&num=0&edition=prelim

(NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171), that are in effect at the time the solicitation is issued or as authorized by the contracting officer not later than December 31, 2017.

(2)(i) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of—

(A) Why a particular security requirement is not applicable; or

(B) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(ii) An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services-Representation (MAY 2021)

The Offeror is not required to complete the representation in this provision if the Offeror has represented in the provision at 252.204-7016 , Covered Defense Telecommunications Equipment or Services—Representation, that it “does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.”

(a) Definitions. “Covered defense telecommunications equipment or services,” “covered mission,” “critical technology,” and “substantial or essential component,” as used in this provision, have the meanings given in the 252.204-7018 clause, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services, of this solicitation.

(b) Prohibition. Section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits agencies from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

https://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses#DFARS-252.204-7016 https://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses#DFARS-252.204-7018

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

Representation. If in its annual representations and certifications in SAM the Offeror has represented in paragraph (c) of the provision at 252.204-7016 , Covered Defense Telecommunications Equipment or Services—Representation, that it “does” provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument, then the Offeror shall complete the following additional representation:

The Offeror represents that it [ ] will [ ] will not provide covered defense telecommunications equipment or services as a part of its offered products or services to DoD in the performance of any award resulting from this solicitation.

(e) Disclosures. If the Offeror has represented in paragraph (d) of this provision that it “will provide covered defense telecommunications equipment or services,” the Offeror shall provide the following information as part of the offer:

(1) A description of all covered defense telecommunications equipment and services offered (include brand or manufacturer; product, such as model number, original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable).

(2) An explanation of the proposed use of covered defense telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition referenced in paragraph (b) of this provision.

(3) For services, the entity providing the covered defense telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known).

(4) For equipment, the entity that produced or provided the covered defense telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

https://www.sam.gov/ https://www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses#DFARS-252.204-7016

252.204-7019 Notice of NIST SP 800-171 DOD Assessment Requirements (MAR 2022)

(a) Definitions.

“Basic Assessment”, “Medium Assessment”, and “High Assessment” have the meaning given in the clause 252.204-7020, NIST SP 800-171 DoD Assessments.

“Covered contractor information system” has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order.

The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171 .

(c) Procedures.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance Risk System (SPRS) () for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and submit a Basic Assessment to for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract— https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the Offeror shall use the following format for the report:

System Security Plan CAGE Codes supported by this plan Brief description of the plan architect

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User’s Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section. DoD will retain and protect any such documentation as “Controlled Unclassified Information (CUI)” and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

252.225-7973 Prohibition on the Procurement of Foreign-Made Unmanned Aircraft System-Representation (MAY 2020) (DEVIATION 2020-O0015)

(a) Prohibition. Section 848 of the National Defense Authorization Act for Fiscal Year 2020 (Pub. L. 116-92) prohibits DoD from using or procuring—

(1) An unmanned aircraft system (UAS), or any related services or equipment, that—

(i) Is manufactured in the People’s Republic of China or by an entity domiciled in the People’s Republic of China;

(ii) Uses flight controllers, radios, data transmission devices, cameras, or gimbals manufactured in the People’s Republic of China or by an entity domiciled in the People’s Republic of China;

(iii) Uses a ground control system or operating software developed in the People’s Republic of China or by an entity domiciled in the People’s Republic of China; or https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf

(iv) Uses network connectivity or data storage located in, or administered by an entity domiciled in, the People’s Republic of China; or

(2) A system for the detection or identification of a UAS, or any related services or equipment, that is manufactured—

(i) In the People’s Republic of China; or

(ii) By an entity domiciled in the People’s Republic of China.

(b) Representations. By submission of its offer, the Offeror represents that it will not provide or use—

(1) A UAS, as described in paragraph (a)(1) of this provision, in the performance of any contract, subcontract, or other contractual instrument resulting from this solicitation; and

(2) A system for the detection or identification of a UAS, as described in paragraph

(a)(2) of this provision, in the performance of any contract, subcontract, or other contractual instrument resulting from this solicitation.

252.225-7974 Representation Regarding Business Operations with the Maduro Regime

(FEB 2020) (DEVIATION 2020-O0005)

(a) Definitions. As used in this provision—

“Agency or instrumentality of the government of Venezuela” means an agency or instrumentality of a foreign state as defined in section 28 U.S.C. 1603(b), with each reference in such section to “a foreign state” deemed to be a reference to “Venezuela.”

“Business operations” means engaging in commerce in any form, including acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business or commerce.

“Government of Venezuela” means the government of any political subdivision of Venezuela, and any agency or instrumentality of the government of Venezuela.

“Person” means—

(1) A natural person, corporation, company, business association, partnership, society, trust, or any other nongovernmental entity, organization, or group;

(2) Any governmental entity or instrumentality of a government, including a multilateral development institution (as defined in section 1701(c)(3) of the International Financial Institutions Act (22 U.S.C. 262r(c)(3)); and

(3) Any successor, subunit, parent entity, or subsidiary of, or any entity under common ownership or control with, any entity described in paragraphs (1) or (2) of this definition.

(b) Prohibition. In accordance with section 890 of the National Defense Authorization Act for Fiscal Year 2020 (Pub. L. 116-92), contracting officers are prohibited from entering into a contract for the procurement of products or services with any person that has business operations with an authority of the government of Venezuela that is not recognized as the legitimate government of Venezuela by the United States Government, unless the person has a valid license to operate in Venezuela issued by the Office of Foreign Assets Control of the Department of the Treasury.

(c) Representation. By submission of its offer, the Offeror represents that the Offeror—

(1) Does not have any business operations with an authority of the Maduro regime or the government of Venezuela that is not recognized as the legitimate government of Venezuela by the United States Government; or

(2) Has a valid license to operate in Venezuela issued by the Office of Foreign Assets Control of the Department of the Treasury.

Date:

Name and Title:

Signature: ___________________________

52.209-13 Violation of Arms Control Treaties or Agreements-Certification (NOV 2021)