Attachment I Clauses and Provisions.pdf

Contract Clauses

FAR Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

52.204-13 System for Award Management-Maintenance. (Deviation 2026-O0038) Feb 2026 52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements. Jan 2017 52.222-19 Child Labor-Cooperation with Authorities and Remedies. (Deviation 2026-O0038) Mar 2026 52.222-35 Equal Opportunity for Veterans. (Deviation 2026-O0038) Feb 2026 52.222-37 Employment Reports on Veterans. (Deviation 2026-O0038) Feb 2026 52.222-54 Employment Eligibility Verification. (Deviation 2026-O0038) Feb 2026 52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving. May 2024 52.232-33 Payment by Electronic Funds Transfer-System for Award Management. Oct 2018 52.232-40 Providing Accelerated Payments to Small Business Subcontractors. Mar 2023 52.233-3 Protest after Award. (Deviation 2026-O0038) Feb 2026 52.233-4 Applicable Law for Breach of Contract Claim. (Deviation 2026-O0038) Feb 2026

52.212-4 Terms and Conditions-Commercial Products and Commercial Services. (Deviation 2026- O0038)

Feb 2026

DFARS Clauses Incorporated by Reference

Number Title Effective Date

Alternate/ Deviation

Variation Effective Date

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime. Jan 2023 252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region. Jun 2023 252.246-7003 Notification of Potential Safety Issues. Jan 2023 252.246-7008 Sources of Electronic Parts. Jan 2023 252.203-7000 Requirements Relating to Compensation of Former DoD Officials. Sep 2011 252.203-7002 Requirement to Inform Employees of Whistleblower Rights. Dec 2022 252.204-7004 Antiterrorism Awareness Training for Contractors. Jan 2023 252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support. Jan 2023

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

Jan 2023

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports. Dec 2018 252.232-7010 Levies on Contract Payments. Dec 2006

252.209-7004 Subcontracting with Firms that are Owned or Controlled by the Government of a Country that is a State Sponsor of Terrorism.

May 2019

252.239-7018 Supply Chain Risk. Dec 2022 252.247-7023 Transportation of Supplies by Sea. Oct 2024

FAR Clauses Incorporated by Full Text

52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns. (Deviation 2026-O0038)

(Feb 2026)

NOTICE OF PRICE EVALUATION PREFERENCE FOR HUBZONE SMALL BUSINESS CONCERNS (FEB 2026) (DEVIATION 2026- O0038)

Evaluation preference.(a)

Offers will be evaluated by adding a factor of 10 percent to the price of all offers, except-(1)

(i) Offers from HUBZone small business concerns that have not waived the evaluation preference; and

(ii) Otherwise successful offers from small business concerns.

(b) . A HUBZone small business concern may choose to waive the evaluation preference. If the concern waives Waiver of evaluation preference the preference, the factor will be added to its offer for evaluation purposes.

Offeror chooses to waive the evaluation preference.

(c) A HUBZone joint venture agrees that, in the performance of the contract, at least 40 percent of the aggregate work performed by Joint venture.

the joint venture shall be completed by the HUBZone small business parties to the joint venture. Work performed by the HUBZone small business parties to the joint venture must be more than administrative functions.

(End of provision)

N0018926QL218

52.219-28 Postaward Small Business Program Rerepresentation. (Deviation 2026-O0038) (Feb 2026)

POSTAWARD SMALL BUSINESS PROGRAM REREPRESENTATION (FEB 2026) (DEVIATION 2026-O0038)

(a) . As used in this clause-Definitions

Long-term contract means a contract of more than five years in duration, including options. However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to Extend Services, or other appropriate authority.

Small business concern-

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (c) of this clause.

(2) , as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, Affiliates or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

(b) If the Contractor represented that it was a small business concern, a small disadvantaged business concern, or a joint venture that was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall rerepresent its size and socioeconomic status according to paragraph (e) of this clause or, if applicable, paragraph (g) of this clause, upon occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts-

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) The Contractor shall rerepresent its size status in accordance with the size standard in effect at the time of this rerepresentation that corresponds to the North American Industry Classification System (NAICS) code(s) assigned to this contract. The small business size standard corresponding to this NAICS code(s) can be found at https://www.sba.gov/document/support--table-size-standards.

(d) The small business size standard for a Contractor providing an end item that it does not manufacture, process, or produce itself, for a contract other than a construction or service contract, is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition-

(1) Was set aside for small business and has a value above the simplified acquisition threshold;

(2) Used the HUBZone price evaluation preference regardless of dollar value, unless the Contractor waived the price evaluation preference; or

(3) Was an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(e) Except as provided in paragraph (g) of this clause, the Contractor shall make the representation(s) required by paragraph (b) of this clause by validating or updating all its representations in the Representations and Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The Contractor shall notify the contracting officer in writing within the timeframes specified in paragraph (b) of this clause, that the data have been validated or updated, and provide the date of the validation or update.

(f) If the Contractor represented that it was other than a small business concern prior to award of this contract, the Contractor may, but is not required to, take the actions required by paragraphs (e) or (g) of this clause.

(g) If the Contractor does not have representations and certifications in SAM, or does not have a representation in SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following rerepresentation and submit it to the contracting office, along with the contract number and the date on which the rerepresentation was completed:

(1) The Contractor represents that it is, is not a small business concern under NAICS Code assigned to contract number.____ ____

(2) [ .] The Contractor represents Complete only if the Contractor represented itself as a small business concern in paragraph (g)(1) of this clause that it is, is not, a small disadvantaged business concern as defined in .13 CFR 124.1001

(3) . The Contractor represents that it is, is not a Women-owned small business (WOSB) joint venture eligible under the WOSB Program joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The Contractor shall enter the name and unique entity ____ identifier of each party to the joint venture: __.]

(4) . The Contractor represents that it is, is not a joint Economically disadvantaged women-owned small business (EDWOSB) joint venture venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The Contractor shall enter the name and unique entity identifier ____ of each party to the joint venture: __ .]

(5) . The Contractor represents that it Service-disabled veteran-owned small business (SDVOSB) joint venture eligible under the SDVOSB Program is, is not an SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402. [ The ____ Contractor shall enter the name and unique entity identifier of each party to the joint venture: __.]

(6) [ ] The HUBZone joint venture eligible under the HUBZone Program. Complete only if the offeror is a HUBZone small business concern.

offeror represents, as part of its offer, that It is, is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: .] Each HUBZone small business ____ concern participating in the HUBZone joint venture must be certified as a HUBZone concern. [ Contractor to sign and date and insert authorized ____ signer's name and title.]

(End of clause)

DFARS Clauses Incorporated by Full Text

252.232-7006 Wide Area WorkFlow Payment Instructions. (Jan 2023)

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause- Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as Electronic invoicing.

authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall- WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice WAWF training.

Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry, Electronic Data Interchange, or File Transfer WAWF methods of document submission.

Protocol.

(f) The Contractor shall use the following information when submitting payment requests and receiving reports WAWF payment instructions.

in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the following document type(s): Document type.

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in Document routing.

WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC ____

Issue By DoDAAC ____

Admin DoDAAC ____

Inspect By DoDAAC ____

Ship To Code ____

Ship From Code ____

Mark For Code ____

Service Approver (DoDAAC) ____

Service Acceptor (DoDAAC) ____

Accept at Other DoDAAC ____

LPO DoDAAC ____

DCAA Auditor DoDAAC ____

Other DoDAAC(s) ____

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in Payment request.

accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F. Receiving report.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

252.211-7003 Item Unique Identification and Valuation. (Jan 2023)

ITEM UNIQUE IDENTIFICATION AND VALUATION (JAN 2023)

(a) . As used in this clause- Definitions

"Automatic identification device" means a device, such as a reader or interrogator, used to retrieve data encoded on machine-readable media.

"Concatenated unique item identifier" means-

(1) For items that are serialized within the enterprise identifier, the linking together of the unique identifier data elements in order of the issuing agency code, enterprise identifier, and unique serial number within the enterprise identifier; or

(2) For items that are serialized within the original part, lot, or batch number, the linking together of the unique identifier data elements in order of the issuing agency code; enterprise identifier; original part, lot, or batch number; and serial number within the original part, lot, or batch number.

"Data matrix" means a two-dimensional matrix symbology, which is made up of square or, in some cases, round modules arranged within a perimeter finder pattern and uses the Error Checking and Correction 200 (ECC200) specification found within International Standards Organization (ISO)/International Electrotechnical Commission (IEC) 16022.

"Data qualifier" means a specified character (or string of characters) that immediately precedes a data field that defines the general category or intended use of the data that follows.

"DoD recognized unique identification equivalent" means a unique identification method that is in commercial use and has been recognized by DoD. All DoD recognized unique identification equivalents are listed at . https://www.acq.osd.mil/asda/dpc/ce/ds/unique-id.html

"DoD item unique identification" means a system of marking items delivered to DoD with unique item identifiers that have machine-readable data elements to distinguish an item from all other like and unlike items. For items that are serialized within the enterprise identifier, the unique item identifier shall include the data elements of the enterprise identifier and a unique serial number. For items that are serialized within the part, lot, or batch number within the enterprise identifier, the unique item identifier shall include the data elements of the enterprise identifier; the original part, lot, or batch number; and the serial number.

" Enterprise " means the entity (e.g., a manufacturer or vendor) responsible for assigning unique item identifiers to items.

" Enterprise identifier" means a code that is uniquely assigned to an enterprise by an issuing agency.

"Government's unit acquisition cost" means-

(1) For fixed-price type line, subline, or exhibit line items, the unit price identified in the contract at the time of delivery;

(2) For cost-type or undefinitized line, subline, or exhibit line items, the Contractor's estimated fully burdened unit cost to the Government at the time of delivery; and

(3) For items produced under a time-and-materials contract, the Contractor's estimated fully burdened unit cost to the Government at the time of delivery.

"Issuing agency" means an organization responsible for assigning a globally unique identifier to an enterprise, as indicated in the Register of Issuing Agency Codes for ISO/IEC 15459, located at http://www.aimglobal.org/?Reg_Authority15459.

"Issuing agency code" means a code that designates the registration (or controlling) authority for the enterprise identifier.

"Item" means a single hardware article or a single unit formed by a grouping of subassemblies, components, or constituent parts.

" Lot or batch number" means an identifying number assigned by the enterprise to a designated group of items, usually referred to as either a lot or a batch, all of which were manufactured under identical conditions.

"Machine-readable" means an automatic identification technology media, such as bar codes, contact memory buttons, radio frequency identification, or optical memory cards.

"Original part number" means a combination of numbers or letters assigned by the enterprise at item creation to a class of items with the same form, fit, function, and interface.

"Parent item" means the item assembly, intermediate component, or subassembly that has an embedded item with a unique item identifier or DoD recognized unique identification equivalent.

"Serial number within the enterprise identifier" means a combination of numbers, letters, or symbols assigned by the enterprise to an item that provides for the differentiation of that item from any other like and unlike item and is never used again within the enterprise.

"Serial number within the part, lot, or batch number" means a combination of numbers or letters assigned by the enterprise to an item that provides for the differentiation of that item from any other like item within a part, lot, or batch number assignment.

"Serialization within the enterprise identifier" means each item produced is assigned a serial number that is unique among all the tangible items produced by the enterprise and is never used again. The enterprise is responsible for ensuring unique serialization within the enterprise identifier.

"Serialization within the part, lot, or batch number" means each item of a particular part, lot, or batch number is assigned a unique serial number within that part, lot, or batch number assignment. The enterprise is responsible for ensuring unique serialization within the part, lot, or batch number within the enterprise identifier.

"Type designation" means a combination of letters and numerals assigned by the Government to a major end item, assembly or subassembly, as appropriate, to provide a convenient means of differentiating between items having the same basic name and to indicate modifications and changes thereto.

"Unique item identifier" means a set of data elements marked on items that is globally unique and unambiguous. The term includes a concatenated unique item identifier or a DoD recognized unique identification equivalent.

"Unique item identifier type" means a designator to indicate which method of uniquely identifying a part has been used. The current list of accepted unique item identifier types is maintained at .https://www.acq.osd.mil/asda/dpc/ce/ds/unique-id.html

(b) The Contractor shall deliver all items under a contract line, subline, or exhibit line item.

(c) Unique item identifier.

(1) The Contractor shall provide a unique item identifier for the following:

(i) Delivered items for which the Government's unit acquisition cost is $5,000 or more, except for the following line items:

Contract Line, Subline, or

Exhibit Line Item Number Item Description

(ii) Items for which the Government's unit acquisition cost is less than $5,000 that are identified in the Schedule or the following table:

Contract Line, Subline, or

Exhibit Line Item Number Item Description

(If items are identified in the Schedule, insert "See Schedule in this table.)

(iii) Subassemblies, components, and parts embedded within delivered items, items with warranty requirements, DoD serially managed reparables and DoD serially managed nonreparables as specified in Attachment Number .____

(iv) Any item of special tooling or special test equipment as defined in FAR 2.101 that have been designated for preservation and storage for a Major Defense Acquisition Program as specified in Attachment Number .____

(v) Any item not included in (i), (ii), (iii), or (iv) for which the contractor creates and marks a unique item identifier for traceability.

(2) The unique item identifier assignment and its component data element combination shall not be duplicated on any other item marked or registered in the DoD Item Unique Identification Registry by the contractor.

(3) The unique item identifier component data elements shall be marked on an item using two dimensional data matrix symbology that complies with ISO/IEC International Standard 16022, Information technology - International symbology specification - Data matrix; ECC200 data matrix specification.

(4) The Contractor shall ensure that- Data syntax and semantics of unique item identifiers.

(i) The data elements (except issuing agency code) of the unique item identifier are encoded within the data matrix symbol that is marked on the item using one of the following three types of data qualifiers, as determined by the Contractor:

(A) Application Identifiers (AIs) (Format Indicator 05 of ISO/IEC International Standard 15434), in accordance with ISO/IEC International Standard 15418, Information Technology - EAN/UCC Application Identifiers and Fact Data Identifiers and Maintenance and ANSI MH

10.8.2 Data Identifier and Application Identifier Standard.

(B) Data Identifiers (DIs) (Format Indicator 06 of ISO/IEC International Standard 15434), in accordance with ISO/IEC International Standard 15418, Information Technology - EAN/UCC Application Identifiers and Fact Data Identifiers and Maintenance and ANSI MH

10.8.2 Data Identifier and Application Identifier Standard.

(C) Text Element Identifiers (TEIs) (Format Indicator 12 of ISO/IEC International Standard 15434), in accordance with the Air Transport Association Common Support Data Dictionary; and

(ii) The encoded data elements of the unique item identifier conform to the transfer structure, syntax, and coding of messages and data formats specified for Format Indicators 05, 06, and 12 in ISO/IEC International Standard 15434, Information Technology - Transfer Syntax for High Capacity Automatic Data Capture Media.

(5) . Unique item identifier

(i) The Contractor shall-

(A) Determine whether to-

Serialize within the enterprise identifier; (1)

Serialize within the part, lot, or batch number; or (2)

Use a DoD recognized unique identification equivalent (e.g. Vehicle Identification Number); and (3)

(B) Place the data elements of the unique item identifier (enterprise identifier; serial number; DoD recognized unique identification equivalent; and for serialization within the part, lot, or batch number only: original part, lot, or batch number) on items requiring marking by paragraph (c)(1) of this clause, based on the criteria provided in MIL-STD-130, Identification Marking of U.S. Military Property, latest version;

(C) Label shipments, storage containers and packages that contain uniquely identified items in accordance with the requirements of MIL-STD-129, Military Marking for Shipment and Storage, latest version; and

(D) Verify that the marks on items and labels on shipments, storage containers, and packages are machine readable and conform to the applicable standards. The contractor shall use an automatic identification technology device for this verification that has been programmed to the requirements of Appendix A, MIL-STD-130, latest version.

(ii) The issuing agency code-

(A) Shall not be placed on the item; and

(B) Shall be derived from the data qualifier for the enterprise identifier.

(d) For each item that requires item unique identification under paragraph (c)(1)(i), (ii), or (iv) of this clause or when item unique identification is provided under paragraph (c)(1)(v), in addition to the information provided as part of the Material Inspection and Receiving Report specified elsewhere in this contract, the Contractor shall report at the time of delivery, as part of the Material Inspection and Receiving Report, the following information:

(1) Unique item identifier.

(2) Unique item identifier type.

(3) Issuing agency code (if concatenated unique item identifier is used).

(4) Enterprise identifier (if concatenated unique item identifier is used).

(5) Original part number (if there is serialization within the original part number).

(6) Lot or batch number (if there is serialization within the lot or batch number).

(7) Current part number (optional and only if not the same as the original part number).

(8) Current part number effective date (optional and only if current part number is used).

(9) Serial number (if concatenated unique item identifier is used).

(10) Government's unit acquisition cost.

(11) Unit of measure.

(12) Type designation of the item as specified in the contract schedule, if any.

(13) Whether the item is an item of Special Tooling or Special Test Equipment.

(14) Whether the item is covered by a warranty.

(e) For embedded subassemblies, components, and parts that require DoD item unique identification under paragraph (c)(1)(iii) of this clause or when item unique identification is provided under paragraph (c)(1)(v), the Contractor shall report as part of the Material Inspection and Receiving Report specified elsewhere in this contract, the following information:

(1) Unique item identifier of the parent item under paragraph (c)(1) of this clause that contains the embedded subassembly, component, or part.

(2) Unique item identifier of the embedded subassembly, component, or part.

(3) Unique item identifier type.**

(4) Issuing agency code (if concatenated unique item identifier is used).**

(5) Enterprise identifier (if concatenated unique item identifier is used).**

(6) Original part number (if there is serialization within the original part number).**

(7) Lot or batch number (if there is serialization within the lot or batch number).**

(8) Current part number (optional and only if not the same as the original part number).**

(9) Current part number effective date (optional and only if current part number is used).**

(10) Serial number (if concatenated unique item identifier is used).**

(11) Description.

** Once per item.

(f) The Contractor shall submit the information required by paragraphs (d) and (e) of this clause as follows:

(1) End items shall be reported using the receiving report capability in Wide Area WorkFlow (WAWF) in accordance with the clause at 252.232-7003. If WAWF is not required by this contract, and the contractor is not using WAWF, follow the procedures at http://dodprocurementtoolbox.com/site/uidregistry/.

(2) Embedded items shall be reported by one of the following methods-

(i) Use of the embedded items capability in WAWF;

(ii) Direct data submission to the IUID Registry following the procedures and formats at http://dodprocurementtoolbox.com/site /uidregistry/; or

(iii) Via WAWF as a deliverable attachment for exhibit line item number (fill in) , Unique Item Identifier Report for Embedded ____ Items, Contract Data Requirements List, DD Form 1423.

(g) . If the Contractor acquires by subcontract, any item(s) for which item unique identification is required in accordance with Subcontracts paragraph (c)(1) of this clause, the Contractor shall include this clause, including this paragraph (g), in the applicable subcontract(s), including subcontracts for commercial products or commercial services.

(End of clause)

Additional Regulation or Supplemental Clauses Incorporated by Full Text

204-9400(05-24)

SUPTXT204-9400(05-24) CONTRACTOR UNCLASSIFIED ACCESS TO

FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH

INFORMATION

(Jan 2024)

(a) Insert the following, as applicable, in full text in all solicitations and contracts (including commercial acquisitions) Statement of Work (SOW) or Performance Work Statement (PWS) under the Schedule of Supplies/Services.

To submit recommended contract language to be incorporated into the Naval Supply Systems Command (NAVSUP) Contracts Handbook (CH) as NAVSUP component text, the language must not meet the requirements for a regulation clarification or change. All submissions (utilizing the text template on Contracting Knowledge Site (CKS)) should be reviewed and approved by the activity's Chief of the Contracting Office (CCO) prior to submission.

(1) SUPTXT204-9400 (05-24) Prescription and Alternative Language

The following shall be inserted in full text in all solicitations and contracts (including commercial acquisitions) which require contractor unclassified access to federally controlled facilities, sensitive information, Information Technology (IT) systems or protected health information. For commercial acquisitions, this text shall be incorporated into either the SOW or PWS.

* Consult with your CSM and ISSM/IAM for local policy when Authorized User (non-sensitive) access is required for non-U.S. citizens outside the U.

S.

** Alternative language which may be included as appropriate:

Contractor and all Contractor employees with access to or responsibility for XXXXXX of this contract shall comply with DoD Directive 8500.1E IA, DoDI 8510.01 Risk Management Framework (RMF) for DoD IT, DoD Directive 5400.11 DoD Privacy Program, DoD 5200.2-R Personnel Security Program and HSPD 12

X.1 Be CAC ready at the properly designated IT System Level

X.2 At minimum, all contractor employees must possess/maintain the required background investigation as determined by the PDT and/or IT access user level. This requirement is critical in order to access the government data base systems It is the contractor's responsibility to ensure that 100% of the contractor employees have the ability to acquire a favorably adjudicated background investigation. In addition, interim approval of clearances is not authorized.

X.3 Be citizens of the U.S

X.4 If at any time, any contractor employee requiring a Common Access Card (CAC) is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

X.5 Contractor employees with access to or responsibility for nonpublic government data under this contract must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the CAC.

(1) SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE

INFORMATION, INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps Intranet (NMCI) computers, is not issued a Common Access Card (CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This local text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, IT

SYSTEMS OR PROTECTED HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department, or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete "Level I Antiterrorism Awareness Training" prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol. 1. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of "Level I Antiterrorism Awareness Training" available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. By providing a training certificate for "Level I Antiterrorism Awareness Training" training showing completion within the last calendar year.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, "DoD Operations Security (OPSEC) Program," June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete "OPSEC Awareness for Military Members, DoD Employees and Contractor" training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.

htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. OF-306 signed by contractor employee

b. FD-258 Fingerprint Card (Contingent upon availability of electronic fingerprinting submission)

c. Completed Electronic Investigation (e-QIP)

d. All contractor employees with need for a Common Access Card (CAC) must have an active Defense Information System for Security (DISS) profile.

e. Common Access Card (CAC)

f. DISS Visit Request submitted (Contingent upon classification of work being performed, Confidential, Secret, Top Secret).

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In accordance with DON CIO Memorandum (IT LEVEL DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST) 08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include Protected Health Information (PHI). IT System levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N;

therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM upon contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense's operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP's ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non- DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO

NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. If the Security Office validates the contractor's position is Non-Critical Sensitive or if the IT system user level is determined to be Enhanced, at a minimum, each contractor employee must be a US citizen and have a favorably completed T3, T3R, or equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or Enhanced position. The investigation consists of a standard National Agency Check and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or Enhanced position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product)

Two FD-258 Applicant Fingerprint Cards or electronic fingerprint submission (preferred))

Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) five (5) years) throughout the contract performance period. The Contractor's Security Representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command's ISSM/IAM. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential.