B08_-_140F1S26Q0054.pdf

REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE

15. DATE OF QUOTATION

16. SIGNER

a. NAME (Type or print)

c. TITLE (Type or print)

b. TELEPHONE

AREA CODE

NUMBER

STANDARD FORM 18 (REV. 6/1995)

Prescribed by GSA-FAR (48 CFR) 53.215-1(a)

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition not usable

8. TO:

b. COMPANYa. NAME

c. STREET ADDRESS

d. CITY e. STATE f. ZIP CODE

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

d. STATE e. ZIP CODE

7. DELIVERY

FOB DESTINATION

OTHER

(See Schedule)

10. PLEASE FURNISH QUOTATIONS TO THE

ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5a. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or service. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotation must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NUMBER

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS (%) b. 20 CALENDAR DAYS (%) c. 30 CALENDAR DAYS (%) d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER

a. NAME OF QUOTER

b. STREET ADDRESS

c. COUNTY

d. CITY e. STATE f. ZIP CODE

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

PAGE OF PAGES

1. REQUEST NUMBER 2. DATE ISSUED 3. REQUISITION/PURCHASE REQUEST NUMBER 4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY 6. DELIVER BY (Date)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

c. CITY

5b. FOR INFORMATION CALL (NO COLLECT CALLS)

698 CONSERVATION WAY

FWS IT Services FWS, IT Services 5275 Leesburg Pike Falls Church VA 22041

0044033179140F1S26Q0054

Lorenzo Aragon

248-6627

FWS NATL CONSERV TRNG CTR

25443-4024

06/05/2026

06/17/2026 1700 ED

SHEPHERDSTOWN

WV

Period of Performance: 07/01/2026 to

12/31/2026

00010 Base Year - BioOne Scientific Journal

Subscription

Period of Performance: 07/01/2026 -

12/31/2026

00020 Option Year 1 - BioOne Scientific

Journal Subscription

Period of Performance: 01/01/2027 -

12/31/2027

Period of Performance: 01/01/2027 to

Continued...

1 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

140F1S26Q0054

12/31/2027

00030 Option Year 2 - BioOne Scientific Journal

Subscription

Period of Performance: 01/01/2028 - 12/31/2028

Period of Performance: 01/01/2028 to

12/31/2028

00040 Option Year 3 - BioOne Scientific Journal

Subscription

Period of Performance: 01/01/2029 - 12/31/2029

Period of Performance: 01/01/2029 to

12/31/2029

00050 Option Year 4 - BioOne Scientific Journal

Subscription

Period of Performance: 01/01/2030 - 12/31/2030

Period of Performance: 01/01/2030 to

12/31/2030

Contracting POC: Lorenzo Aragon; E-Mail:

lawrence_aragon@ios.doi.gov; Ph# 505-248-6627

The U.S. Fish and Wildlife Service has a need for Brand Name Only - BioOne Complete Scientific Journal Subscription as described in the attached statement of work (SOW) under RFQ# 140F1S26Q0054. The procedures of FAR Part 12 and the Lowest Price Technically Acceptable (LPTA) evaluation methodology will be used for this acquisition.

I. Type of Contract:

The Government contemplates award of a firm-fixed price contract resulting from this solicitation.

II. Quote Instructions:

1) Submission of questions

a) Interested vendors must submit any questions concerning the solicitation by Wednesday 06/10/2026 at 12:00PM EST. Questions may be submitted via email to laawrence_aragon@ios.doi.gov.

2) Submission of quotes

a) Quotes are to be submitted via email to lawrence_aragon@ios.doi.gov by Wednesday

06/17/2026 at 5:00 PM EST.

3) Period for acceptance of quote

a) The vendor agrees quotes will remain valid for at least 60 calendar days from the RFQ closing date.

4) Late submissions, modifications, revisions, and withdrawals of quotes.

a) Vendors are responsible for submitting quotes, and any modifications, revisions, or withdrawals, so as to reach the Government office designated in the solicitation by the time specified in the solicitation. Any quote, modification, revision, or withdrawal of a quote received at the Government office designated in the solicitation after the exact time specified for receipt of quotes is "late" and will not be considered unless it is received before award is made, the Contracting Officer determines that accepting the late quote would not unduly delay the acquisition.

However, a late modification of an otherwise successful quote, that makes its terms more favorable to the Government, will be considered at any time it is received and may be accepted.

III. Specific Quote Instructions

1) The vendor shall submit a complete price quote for all products and services identified in the requirements document. Quote should include:

• A total firm-fixed price covering the full requirement.

mailto:%20laawrence_aragon@ios.doi.gov.

mailto:%20laawrence_aragon@ios.doi.gov.

mailto:%20lawrence_aragon@ios.doi.gov

• Descriptive literature (including pictures when applicable) that clearly identifies the proposed product or service and provides sufficient detail to enable the Government to determine compliance with all requirements specified in the RFQ.

• Pricing shall be for an abbreviated base period plus 4, 12-month option years.

IV. Evaluation Factors (LPTA) This acquisition uses the Lowest Price Technically Acceptable (LPTA) source selection process. Technical and past performance factors will be evaluated on an acceptable/unacceptable basis. No tradeoffs will be made.

1) Factor 1 – Technical Acceptability (Pass/Fail)

The Government will evaluate the offeror’s quote to verify compliance with all requirements in the RFQ and requirements document.

• Pass: Quote meets all mandatory requirements.

• Fail: Quote does not meet one or more mandatory requirements.

2) Factor 2 – Past Performance (Pass/Fail)

Past performance will be evaluated to determine acceptability only. The Government will review past performance information from CPARS, agency records, or other sources.

• Acceptability: Offeror demonstrates satisfactory performance on similar contracts and has no terminations for cause or default within the past three (3) years.

• Unacceptability: Offeror has a record of unsatisfactory performance or one or more terminations for cause or default within the past three (3) years.

• Neutral: If no past performance information is available, the offeror will receive a “neutral” rating, which will be treated as acceptable.

3) Factor 3 – Price Price will be evaluated for reasonableness and completeness. Award will be made to the lowest-priced offeror whose quote is technically acceptable and whose past performance is acceptable.

V. Bais of Award Award will be made to the responsible offeror submitting the lowest-priced, technically acceptable quote. The Government intends to award without discussion; however, the Contracting Officer reserves the right to conduct discussions if necessary.

52.252-2 Clauses Incorporated by Reference. (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

For FAR Clauses: http://acquisition.gov/far/index.html

Clauses Incorporated by Reference

52.203-13 Contractor Code of Business Ethics and Conduct (Nov 2021)

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (Nov 2023)

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017)

52.204-13 System for Award Management - Maintenance (Mar 2026)

52.204-14 Service Contract Reporting Requirements (Mar 2026)

52.204-19 Incorporation by Reference of Representations and Certifications. (Dec 2014)

52.209-6 Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded (May 2026)

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (May 2026)

52.212-4 Terms and Conditions-Commercial Products and Commercial Services. (Mar 2026)

52.222-3 Convict Labor (May 2026)

52.222-35 Equal Opportunity for Veterans (May 2026)

52.222-36 Equal Opportunity for Workers with Disabilities (May 2026)

52.222-37 Employment Reports on Veterans (May 2026)

52.222-50 Combating Trafficking in Persons (May 2026)

52.222-90 Addressing DEI Discrimination by Federal Contractors (May 2026)

52.222-62 Paid Sick Leave Under Executive Order 13706 (DEVIATION DATE) http://acquisition.gov/far/index.html

52.226-8 Encouraging Contractor Policies to Ban Tec Messaging While Driving (May 2024)

52.227-14 Rights in Data-General (May 2014)

52.232-33 Payment by Electronic Funds Transfer-System for Award Management (Oct 2018)

52.233-3 Protest after Award (DEVIATION DATE)

52.233-4 Applicable Law for Breach of Contract Claim (DEVIATION DATE)

52.240-91 Security Prohibitions and Exclusions (DEVIATION DATE)

52.240-93 Basic Safeguarding of Covered Contractor Information Systems (DEVIATION

DATE)

52.242-15 Stop-Work Order (Aug 1989)

Full Text Clauses

52.217-8 Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

As prescribed in 17.208(g), insert a clause substantially the same as the following:

OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 15 days provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5-years, 6 months.

DEPARTMENT OF THE INTERIOR ACQUISITION REGULATION (DIAR) CLAUSES

INCORPORATED BY FULL TEXT

1452.201-70 Authorities and Delegations (Sep 2011)

(a) The Contracting Officer is the only individual authorized to enter into or terminate this contract, modify any term or condition of this contract, waive any requirement of this contract, or accept nonconforming work.

(b) The Contracting Officer will designate a Contracting Officer's Representative (COR) at time of award. The COR will be responsible for technical monitoring of the contractor's performance and deliveries. The COR will be appointed in writing, and a copy of the appointment will be furnished to the Contractor. Changes to this delegation will be made by written changes to the existing appointment or by issuance of a new appointment.

(c) The COR is not authorized to perform, formally or informally, any of the following actions:

(1) Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change this contract;

(2) Waive or agree to modification of the delivery schedule;

(3) Make any final decision on any contract matter subject to the Disputes Clause;

(4) Terminate, for any reason, the Contractor's right to proceed;

(5) Obligate in any way, the payment of money by the Government.

(d) The Contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum. The Contractor need not proceed with direction that it considers to have been issued without proper authority. The Contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the COR has taken an action or has issued direction (written or oral) that the Contractor considers to exceed the COR's appointment, within 3 days of the occurrence. Unless otherwise provided in this contract, the Contractor assumes all costs, risks, liabilities, and consequences of performing any work it is directed to perform that falls within any of the categories defined in paragraph (c) prior to receipt of the Contracting Officer's response issued under paragraph (e) of this clause.

(e) The Contracting Officer shall respond in writing within 30 days to any notice made under paragraph (d) of this clause. A failure of the parties to agree upon the nature of a direction, or upon the contract action to be taken with respect thereto, shall be subject to the provisions of the Disputes clause of this contract.

(f) The Contractor shall provide copies of all correspondence to the Contracting Officer and the COR.

(g) Any action(s) taken by the Contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the COR acting within his or her appointment, shall be at the Contractor's risk.

(End of clause)

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

(February 2021)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice [Contracting Officer to edit and include the documentation required under this contract]:

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award date. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Local Clause)

INTERNET PROTOCOL version 6 (June 2012)

1.Any system hardware, software, firmware and/or networked component (voice, video or data) developed, procured, or acquired in support and/or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile ( NIST Special Publication 500267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

2. Specifically, any new IP product or system developed, acquired, or produced must:

a. Interoperate with both IPv6 and IPv4 systems and products, and

b. Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

3. As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to 'the Government. The Contractor shall retrofit all nonIPv6 capable equipment, as defined above, that is fielded under this contract with IPv6 capable equipment, at no additional cost to the Government.

4. The contractor shall provide technical support for both IPv4 and IPv6.

5. Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

6. Any product whose noncompliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified, or replaced to bring it into compliance at no additional cost to the Government.

52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this address: www.acquisition.gov.

Solicitation Provisions Incorporated by Reference

52.204-7 System for Award Management – Registration (Mar 2026)

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations-Representation (May 2029) http://www.acquisition.gov/

52.240-90 Security Prohibitions and Exclusions Representations and Certification (Mar 2026)

Full Text Provisions

1452.233-2 -- Service of Protest Department of the Interior (Jul 1996) (Deviation)

(a) Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting Officer (addressed as follows) by obtaining written and dated acknowledgment of receipt from U.S. Fish & Wildlife, 4301 Fairfax Drive, Arlington, VA 22203.

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the GAO.

(c) A copy of the protest served on the Contracting Officer shall be simultaneously furnished by the protester to the Department of the Interior Assistant Solicitor, Acquisitions and Intellectual Property, 1849 C Street, NW, Room 6511, Washington, DC 20240.

(End of Provision)

US Fish and Wildlife Service National Conservation Training Center

STATEMENT OF WORK

BioOne Complete

Scientific Journal Database

1. General:

1.1 The U.S. Fish and Wildlife Service’s (USFWS) Conservation Library, located at the National

Conservation Training Center, seeks access to brand name only - BioOne Complete product, a full-text, online database of 587 specific, high quality, proprietary journals (curated collection of independently-published subscribed journals from a community of publishers) and eBooks focused on ecology, plant sciences, zoology, entomology, biodiversity conservation, and other natural and environmental sciences. This BioOne Complete online database should be delivered via a unique web-based interface that allows for easy searching, enhanced zoom capability for viewing images and figures, and customized account features for citation management. In short, the USFWS Conservation Library is seeking both unique content in the natural sciences (see complete list of required journals below) and specialized delivery via online platform that will be accessible to FWS employees – researchers and managers – throughout the agency and around the country.

Subscription access to full text content from journals which include (but are not limited to) the following subset of independently published periodicals through BioOne Complete:

• Acta Ornithologica

• The American Biology Teacher

• Avian Diseases

• BioScience

• The Botanical Review

• Canadian Journal of Animal Science

• Canadian Journal of Plant Science

• The Condor

• Current Herpetology

• Economic Botany

• Ecoscience

• Entomological News

• Environmental Entomology

• Fieldana

• Freshwater Reviews

• Freshwater Science

• Herpetologica

• Integrated Environmental Assessment and Management

• Integrative and Comparative Biology

• Invasive Plant Science and Management

• Journal of Coastal Conservation

• Journal of Field Ornithology

• Journal of Great Lakes Research

• Journal of Herpetology

• Journal of Mammalogy

• Journal of Raptor Research

• Journal of the Lepidopterists’ Society

• Journal of Wildlife Management

• Mammal Study

• Mammalian Species

• Natural Areas Journal

• Southeastern Naturalist

• Systematic Botany

• Ursus

• Waterbirds

• Weed Science

• Wetland Science and Practice

• Wildlife Biology

• Wildlife Research

1.2 Purpose/End Application: The USFWS Conservation Library seeks to provide FWS employees with continued access to the BioOne Complete collection of specifically curated, proprietary natural science journals and eBooks.

2. Place of Performance and Period of Performance (Where and When) the project is being completed.

2.1 Subscription is fulfilled online using the vendor’s website, and USFWS employees from any field station are able to access it directly via VPN on the Library’s catalog at library.fws.gov.

2.2 Annotate the Performance start and end date. July 1, 2026 – December 31, 2026

2.3 Normal duty hours Monday thru Friday 8:00 a.m. – 5:00 p.m. In the event of emergencies, Contractor shall provide contact information.

2.4 Services are available 24 hrs per day, 7 days per week. Technical support non-duty hours include week nights, weekends, and Government holidays (New Year’s Day, Martin Luther King Junior’s Birthday, Memorial Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day).

3. Scope

3.1 The vendor shall provide the services described in section 4.2 below for all publications published in calendar year 2026. The vendor shall also provide annual usage metrics reporting using COUNTER compliant data.

4. Deliverables and/or Delivery Schedule: (for extended list a bid schedule and/or use of line item detail on the PR is recommended)

4.1 The USFWS Conservation Library’s annual subscription to science journals (see list above) includes full text access to proprietary journals, dowloadable PDF’s of individual articles, and the ability to subscribe to content alerts for select journals.

4.2 Identify the type of documentation: Specifically, deliverables shall include:

• Full text access to all proprietary journals listed above in section 1.1.

• Full text access to all 587 periodicals and eBooks in the 2026 BioOne Complete collection.

• The web-based interface must interate with the existing USFWS WorldShare

Management Services catalog.

Information Technology Baseline Compliance Contract Guidelines

July 2022

Table of Contents Introduction

Section 1.0 – Information Technology and Cybersecurity Requirements

A. Applicability B. Requirements C. Information Systems D. Cloud E. Internet Protocol Version 6 (IPv6) F. Continuous Monitoring G. Security Training and Reviews H. Contractor Reporting Requirements

Section 2.0 – Cybersecurity Incident Response

A. Applicability B. Definitions C. Requirements

Section 3.0 – Privacy Requirements

A. Applicability B. Definitions C. Privacy Act Requirements D. Privacy Controls E. Privacy Breach Reporting Requirements F. Privacy Training Requirements

Section 4.0 – Accessibility Requirements (Section 508)

A. Applicability B. Requirements

Section 5.0 – Records Management Requirements

A. Applicability B. Definitions C. Requirements

Section 6.0 – Contractor Personnel Security Requirements

Section 7.0 – Controlled Unclassified Information Requirements

A. Applicability B. Definitions C. Authorities D. Requirements E. Training

Section 8.0 – Paperwork Reduction Act of 1995

Section 9.0 – Reference Documents

Section 10.0 – Glossary

DOI Baseline Compliance Contract Guidelines 2 | Page

DOI Baseline Compliance Contract Guidelines 3 | Page

Introduction This document provides guidance regarding requirements that must be reviewed and considered for incorporation, where applicable, in all Department of the Interior (DOI, Department) contract actions that involve information technology (IT) products or services. Contracting Officer Representatives (CORs) and/or the requirement owners should work closely with their Bureau or Office Associate Chief Information Officer and Contracting Officer (CO) to ensure the below requirements are properly addressed in IT contracts within the appropriate sections. Any referenced regulation or policy should be provided to the Contractor via hypertext link or other means.

Section 1.0 – Information Technology and Cybersecurity Requirements A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements Information systems and system services provided to the Department by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance. Contracts that involve Industrial Control System (ICS) products and services should be evaluated on an individual basis and contain language specific to ICS. Please contact the Bureau of Reclamation (BOR) at ICSsecurity@usbr.gov for ICS issues and guidance.

The Contractor and the contractor-managed systems shall comply with all federal regulations and guidance, including but not limited to:

1. Federal Information Security Modernization Act of 2014 (FISMA) accessible at https://www.cisa.gov/federal-information-security-modernization-act

2. Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems accessible at https://www.fedramp.gov

3. Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW- 107publ347.pdf

4. Privacy Act of 1974 accessible at https://www.justice.gov/opcl/privacy-act-1974

5. Federal Information Processing Standards (FIPS) and the National Institute of

Standards and Technology (NIST) 800-Series Special Publications (SP) accessible at https://www.nist.gov

6. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, accessible at https://www.cio.gov/policies-and-priorities/circular-a-130/

C. Information Systems The Contractor shall manage information in accordance with applicable laws, regulations, executive orders, and policies regarding the marking, safeguarding, and dissemination of mailto:ICSsecurity@usbr.gov mailto:ICSsecurity@usbr.gov https://www.cisa.gov/federal-information-security-modernization-act https://www.cisa.gov/federal-information-security-modernization-act https://www.fedramp.gov/ https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.nist.gov/ https://www.nist.gov/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/

DOI Baseline Compliance Contract Guidelines 4 | Page

Controlled Unclassified Information (CUI). Personally Identifiable Information (PII) is a subset of information designated as CUI, and Sensitive PII is a subset of PII that requires additional controls and safeguards. (See section 3, Privacy Requirements)

The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

Contractor Information Systems shall comply with FISMA. The Contractor shall provide an Assessment and Authorization (A&A) documentation package for each system that complies with Federal Information Processing Standard (FIPS) 199, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, NIST SP 800-37, NIST SP 800-53, NIST SP 800-60, et al.

The Contractor cryptographic modules used to protect DOI information shall comply with the current NIST FIPS 140 version and be validated by the Cryptographic Module Validation Program.

Access to all government data stored outside the confines of a DOI-managed data center shall comply with Trusted Internet Connections (TIC) requirements.

All Contractor personnel requiring access to DOI information data and/or systems shall be cleared at appropriate levels as set forth:

1. Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation.

2. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI).

3. High Risk position will require a Background Investigation (BI).

Vulnerability Scanning - All IT systems providing services to or on behalf of the Department or storing, processing, or routing DOI CUI information must be scanned monthly with a vulnerability analysis tool using authenticated scans that are acceptable to DOI. Vulnerabilities and weaknesses shall be remediated in accordance with (IAW) Department-mandated time frames commensurate with the level of risk.

D. Cloud All Contractor cloud-hosted Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) or other “as a Service” offerings shall comply with applicable language within the DOI cloud hosting program guidelines.

E. Internet Protocol Version 6 (IPv6) The applicability of IPv6 to DOI-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the Department Acquisition, Arts, and Asset Policy DOI-AAAP-0055, Procuring Internet Protocol Version 6 (IPv6), (per OMB Memorandum M-05-22, August 2, 2005) and with subsequent federal requirements (OMB Memorandum M 21-07 Transition to IPv6, September 28, 2010) regardless of whether the

DOI Baseline Compliance Contract Guidelines 5 | Page acquisition is for modification, upgrade, or replacement. All Enterprise Architecture related component acquisitions shall be IPv6-compliant as defined in the U.S. Government Version 6 (USGv6) Profile (NIST SP 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program. In cloud service procurements, IPv6 compliance should be pursued where practicable.

F. Continuous Monitoring All Contractor-operated systems that input, store, process, output, and/or transmit DOI CUI shall meet or exceed the continuous monitoring requirements identified in the DOI Continuous Monitoring Plan or the Bureau or Office Continuous Monitoring Plan, whichever best fits mission, security, and risk management needs.

Contractor-managed systems are required to have an assigned Information System Security Officer (ISSO) and System Owner (SO) to support the processes described in the contract. While the procuring organization designates government personnel to serve in these roles, the contractor must provide functionally equivalent personnel to enable effective day-to-day operation, management, and monitoring of the system. The Contractor ISSO and SO resources are required to comply with DOI- or other-approved annual and Role Based Security Training (RBST) requirements.

Contractors managing systems on behalf of the Department are required to submit Continuous Monitoring Reports per the Continuous Monitoring Plan to the federal point of contact designated in the contract per the timelines prescribed in the Continuous Monitoring Plan. The Contractor-managed systems may be required to submit to a penetration test (at the discretion of the awarding program) in coordination with DOI cybersecurity personnel or approved contract officials.

When required by the contract, the Contractor must provide the following in alignment with DOI’s continuous monitoring strategy:

1. account management

2. vulnerability management

3. patch management

4. antivirus

5. malware detection

6. event management

7. configuration management

8. license management

9. incident management

G. Security Training and Reviews All users of federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing federal information systems under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and

DOI Baseline Compliance Contract Guidelines 6 | Page be completed on an annual basis thereafter. New Contractor employees assigned to the contract shall complete the training before accessing federal information systems under the contract. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty

(30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification each year. The e-mail notification shall state that all Contractor and subcontractor employees have completed the required training.

The government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced, particularly when contractors build and operate or maintain systems on behalf of the Department. In such cases, the Contractor shall afford DOI, the Office of the Inspector General, and other government organizations access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor shall provide access, to the extent necessary as determined by the government, for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of the contract and to preserve evidence of computer crime. Cloud Service Providers should not be expected to grant physical access to government inspectors.

H. Contractor Reporting Requirements The Contractors operating information systems on behalf of the Department shall comply with FISMA reporting requirements. Department system owners shall coordinate annual and quarterly data collection. Contractors must provide DOI with the requested information based on the timeframes provided with each request. The Contractor systems shall comply with near real time feeds in accordance with Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) requirements as coordinated by DOI. Reporting requirements are determined by OMB and may change each reporting period.

The Contractor-managed systems shall adhere to NIST 800-53 and submit to an annual assessment performed in coordination with DOI cybersecurity personnel or approved contract officials. All results of the annual assessment become the property of the Department.

The Contractor shall comply with DHS or other government oversight bodies regarding cybersecurity-related mandates and directives (Binding Operational Directives [BOD], etc.) or any additional ad-hoc reporting requirements.

Section 2.0 – Cybersecurity Incident Response A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

DOI Baseline Compliance Contract Guidelines 7 | Page

As used in this term-

“Incident” means an occurrence that

1. actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

2. constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

C. Requirements All Contractor employees and information system service providers shall be responsible for recognizing and reporting security incidents. Information system service providers shall receive the current version of the DOI Incident Response Plan, Policy, and Handbook at the time of award, in addition to bureau- or office-specific guidance for appropriate reporting and response at all levels. All suspected or confirmed information security incidents shall be reported in accordance with the requirements listed below, even if it is believed the incident may be limited, small, or insignificant. For hosting environments, including cloud systems and services, this includes incidents occurring on the service provider’s underlying infrastructure supporting containers utilized by the Department. In such cases, the vendor’s primary security operations and/or incident response unity shall engage directly with the DOI Cyber Security Operations (CSO) Section and provide DOI CSO with security and event logs covering the period of the incident and up to six months prior. The DOI CSO and Bureau or Office Incident Response Teams will determine when an incident requires additional focus and attention.

All Contractor employees and information system service providers shall report all information security incidents to the appropriate Bureau or Office Incident Response Team and to the DOI Computer Incident Response Center (DOI CIRC) immediately, no later than 1 hour after “becoming aware of the incident,” at DOICIRC@ios.doi.gov, (703) 648-5655, regardless of day or time. Any contractor action to investigate, identify, respond to, contain, remediate, or recover from a security event (which includes “suspected” incidents) constitutes “becoming aware of the incident.”

When notifying the DOI CIRC and the appropriate Bureau or Office Incident Response Team, the Contractor shall include the CO and COR on the correspondence email to DOICIRC@ios.doi.gov and the appropriate Bureau or Office Incident Response Team. If the Contractor reported the incident by phone, then immediately following the reporting, the Contractor shall notify the CO and COR via e-mail. The Contractor is responsible for verifying that all notification was received and acknowledged by the CO or COR. If the Contractor has any questions regarding these procedures, they shall contact the CO or the COR.

The Contractor shall not include any controlled information in the subject or body of any e-mail.

Contractor shall transmit controlled information using validated encryption methods compliant with the current NIST FIPS 140 version to protect controlled information in e-mail attachments.

Passwords must not be communicated in the same email as the attachment. Contractor shall contact the CO or COR if encryption software is needed for guidance on appropriate, federally approved encryption methods.

mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov

DOI Baseline Compliance Contract Guidelines 8 | Page

Section 3.0 – Privacy Requirements A. Applicability.

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

As used in this term-

Breach: the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other-than-authorized purpose.

1. PII - information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

2. Sensitive PII (SPII) is a subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII is CUI and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. SPII includes but is not limited to full or truncated Social Security Number (SSN), driver's license or state identification number; financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; and system authentication information such as passwords, personal identification numbers or mother's maiden name.

C. Privacy Act Requirements The Contractor shall comply with the requirements of the Privacy Act of 1974 and shall not remove PII or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity. When Privacy Act records, information, data, documentary material, and equipment is no longer required, the Contractor shall return it to the Department’s control or hold it until otherwise directed. Items returned to the government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO.

D. Privacy Controls The Contractor shall meet the privacy requirements of the E-Government Act, FISMA, applicable federal privacy laws, NIST, OMB, and DOI (including but not limited to those listed in the contract table of authorities) for the collection, handling, processing, and sharing of PII, and ensure compliance with the privacy controls requirements of NIST SP 800- 53, FIPS 199, DOI Baseline Compliance Contract Guidelines 9 | Page

FIPS 200, and DOI Privacy Control standards as appropriate for the sensitivity of the system.

The Contractor shall monitor the information system and update controls for continued privacy compliance on an ongoing basis and shall provide status reports to the Department upon request.

The Contractor shall be required to provide all necessary support to assist the Department in meeting the requirements of the Privacy Act and related laws and shall provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes timely responding to requests for information from the Department about the access, creation, collection, use, storage, maintenance, transmission, sharing, or disposition of PII on the Contractor’s system or processes, and providing timely review of relevant compliance documents for factual accuracy.

E. Privacy Breach Reporting Requirements The Contractor shall provide notice to DOI CIRC or the appropriate Bureau or Office Incident Response Team of any known or suspected breach of PII and meet breach reporting and mitigation requirements in accordance with the DOI Privacy Breach Response Plan or bureau or office applicable response plan. The report of a breach of PII shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information or has otherwise failed to meet the requirements of the contract.

The Contractor shall report all known or suspected breaches in electronic or physical form to the CO, COR, and the DOI CIRC or bureau or office point of contact no later than one hour following discovery via email at DOICIRC@ios.doi.gov or (703) 648-5655, regardless of day or time and as specified within the DOI Privacy Breach Response Plan and the applicable bureau or office response plan.

The Contractor shall not include any controlled information in the subject or body of any e-mail and shall not include any SPII. Where necessary, SPII shall be transmitted using encryption methods to protect CUI in attachments in accordance with cryptographic requirements prescribed by the current NIST FIPS 140 version. Passwords shall be securely communicated separately.

The Contractor shall not contact individuals impacted by a breach involving PII until directed by the government. Department officials will make all determinations related to response activities, appropriate notifications to individuals and federal agencies and other organizations, and any remedial actions.

The Contractor shall take immediate action to contain and mitigate the impact of the breach and cooperate with DOI officials to investigate the breach and determine remedial measures as follows:

• The Contractor shall provide full access and cooperation for all activities—determined by the Department to be required—to ensure an effective breach response, including providing all requested images, log files, and event information to facilitate rapid resolution of breaches.

• Breach response activities—determined to be required by the Department—may include but are not limited to inspections, investigations, forensic reviews, data analyses and

DOI Baseline Compliance Contract Guidelines 10 | Page processing, and final determinations of responsibility for the breach and/or liability for any additional response activities.

• The Department, at its sole discretion, may obtain the assistance of federal agencies and/or third-party firms to aid in breach response activities, as needed.

The Contractor shall provide a detailed written analysis with the following data elements available at the time of the breach, and a follow up report with any additional information or updates within 24 hours of the initial breach report, that shall address all relevant information concerning the compromise:

• Government programs, platforms, or systems involved

• Location(s) of the breach

• Date and time the breach was discovered

• Nature of the event (loss, theft, or unauthorized access)

• Description or summary of events

• Description of PII involved, such as name, Social Security number, date of birth, etc.

• Number of potentially impacted individuals

• Estimated number of records exposed or compromised

The Contractor shall collaborate with DOI officials on breach remedial activities to include notifications, credit monitoring, establishing a call center, or other relief to affected individuals as appropriate under the circumstances of the breach as prescribed in the contract. The Contractor shall have the capability to notify individuals whose PII resided in the Contractor system at the time of the breach not later than five business days after being directed by DOI officials to notify affected individuals. The Contractor shall not proceed with notifications unless the CO has directed in writing that notification is appropriate, subject to prior approval by DOI Privacy Officials, in accordance with the DOI Privacy Breach Response Plan. Notification may require the Contractor’s use of address verification and/or address location services. All determinations, including response activities, notifications to affected individuals and/or federal agencies, and related services will be made by authorized DOI officials at DOI’s discretion.

If an SPII or PII breach occurs because of the violation of a term of the contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the CO and at no cost to the government, without delay correct or mitigate the violation. If the Department incurs a cost for individual notifications and remediation services procured as the result of a breach of SPII or PII, the COR will contact the CO to coordinate appropriate remedies per contract terms and conditions.

F. Privacy Training Requirements All Contractor and subcontractor employees are required to take privacy awareness training prior to accessing DOI information or information systems. All Contractor and subcontractor employees must also complete role-based privacy training prior to accessing PII or Privacy Act data. All required privacy training shall be completed within 30 days of contract award and prior

DOI Baseline Compliance Contract Guidelines 11 | Page to granting access to DOI information systems or any PII, and must be completed on an annual basis thereafter, not later than September 30th of each year. Any new Contractor employees assigned to the contract shall also meet these privacy training requirements. Privacy training shall meet the requirements of FAR 52.224-3 Privacy Training (January 2017).

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance.