B08_-_140FF027Q0014.pdf

REQUEST FOR QUOTATION

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE

15. DATE OF QUOTATION

16. SIGNER

a. NAME (Type or print)

c. TITLE (Type or print)

b. TELEPHONE

AREA CODE

NUMBER

STANDARD FORM 18 (REV. 6/1995)

Prescribed by GSA-FAR (48 CFR) 53.215-1(a)

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition not usable

8. TO:

b. COMPANYa. NAME

c. STREET ADDRESS

d. CITY e. STATE f. ZIP CODE

9. DESTINATION

a. NAME OF CONSIGNEE

b. STREET ADDRESS

d. STATE e. ZIP CODE

7. DELIVERY

FOB DESTINATION

OTHER

(See Schedule)

10. PLEASE FURNISH QUOTATIONS TO THE

ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it to the address in Block 5a. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or service. Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotation must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NUMBER

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS (%) b. 20 CALENDAR DAYS (%) c. 30 CALENDAR DAYS (%) d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER

a. NAME OF QUOTER

b. STREET ADDRESS

c. COUNTY

d. CITY e. STATE f. ZIP CODE

14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

PAGE OF PAGES

1. REQUEST NUMBER 2. DATE ISSUED 3. REQUISITION/PURCHASE REQUEST NUMBER 4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY 6. DELIVER BY (Date)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

c. CITY

5b. FOR INFORMATION CALL (NO COLLECT CALLS)

698 CONSERVATION WAY-NCTC LAB

FWS, IT Services 5275 Leesburg Pike Falls Church VA 22041

0044059568140FF027Q0014

Lorenzo Aragon

248-6627

FWS ANALYTICAL CONTROL FACILITY

25443

10/15/2026

10/21/2026 1700 ED

SHEPHERDSTOWN

WV

Period of Performance: 11/01/2026 to

10/31/2027

00010 Base Year - DISH Programming

00020 Option Year 1 - DISH Programming

Period of Performance: 11/01/2027 to

10/31/2028

00030 Option Year 2 - DISH Programming

Period of Performance: 11/01/2028 to

10/31/2029

Continued...

1 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGES

NAME OF OFFEROR OR CONTRACTOR

SUPPLIES/SERVICES

(B)

UNIT

(D)

UNIT PRICE

(E)

AMOUNT

(F)

OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

ITEM NO.

(A)

QUANTITY

(C)

NSN 7540-01-152-8067

140FF027Q0014

00040 Option Year 3 - DISH Programming

Period of Performance: 11/01/2029 to

10/31/2030

00050 Option Year 4 - DISH Programming

Period of Performance: 11/01/2030 to

10/31/2031

The U.S. Fish and Wildlife Service, National Conservation Training Center has a need for DISH programming renewal as described in the attached requirements document under RFQ# 140FF027Q0014. The procedures of FAR Part 12 and the Lowest Price Technically Acceptable (LPTA) evaluation methodology will be used for this acquisition.

I. Type of Contract:

The Government contemplates award of a firm-fixed price contract resulting from this solicitation.

II. Quote Instructions:

1) Submission of questions

a) Interested vendors must submit any questions concerning the solicitation by Tuesday October 20, 2026, at 12:00PM EST. Questions may be submitted via email to lawrence_aragon@ios.doi.gov.

2) Submission of quotes

a) Quotes are to be submitted via email to lawrence_aragon@ios.doi.gov by Wednesday

October 21, 2026, at 5:00 PM EST.

3) Period for acceptance of quote

a) The vendor agrees quotes will remain valid for at least 60 calendar days from the RFQ closing date.

4) Late submissions, modifications, revisions, and withdrawals of quotes.

a) Vendors are responsible for submitting quotes, and any modifications, revisions, or withdrawals, so as to reach the Government office designated in the solicitation by the time specified in the solicitation. Any quote, modification, revision, or withdrawal of a quote received at the Government office designated in the solicitation after the exact time specified for receipt of quotes is "late" and will not be considered unless it is received before award is made, the Contracting Officer determines that accepting the late quote would not unduly delay the acquisition.

However, a late modification of an otherwise successful quote, that makes its terms more favorable to the Government, will be considered at any time it is received and may be accepted.

III. Specific Quote Instructions

1) The vendor shall submit a complete price quote for all products and services identified in the requirements document. Quote should include:

• A total firm-fixed price covering the full requirement for the base year and option years.

mailto:%20lawrence_aragon@ios.doi.gov.

mailto:%20lawrence_aragon@ios.doi.gov

• Descriptive literature (including pictures when applicable) that clearly identifies the proposed product or service and provides sufficient detail to enable the Government to determine compliance with all requirements specified in the RFQ.

IV. Evaluation Factors (LPTA) This acquisition uses the Lowest Price Technically Acceptable (LPTA) source selection process. Technical and past performance factors will be evaluated on an acceptable/unacceptable basis. No tradeoffs will be made.

1) Factor 1 – Technical Acceptability (Pass/Fail)

The Government will evaluate the offeror’s quote to verify compliance with all requirements in the RFQ and requirements document.

• Pass: Quote meets all mandatory requirements.

• Fail: Quote does not meet one or more mandatory requirements.

2) Factor 2 – Past Performance (Pass/Fail)

Past performance will be evaluated to determine acceptability only. The Government will review past performance information from CPARS, agency records, or other sources.

• Acceptability: Offeror demonstrates satisfactory performance on similar contracts and has no terminations for cause or default within the past three (3) years.

• Unacceptability: Offeror has a record of unsatisfactory performance or one or more terminations for cause or default within the past three (3) years.

• Neutral: If no past performance information is available, the offeror will receive a “neutral” rating, which will be treated as acceptable.

3) Factor 3 – Price Price will be evaluated for reasonableness and completeness. Award will be made to the lowest-priced offeror whose quote is technically acceptable and whose past performance is acceptable.

V. Bais of Award Award will be made to the responsible offeror submitting the lowest-priced, technically acceptable quote. The Government intends to award without discussions; however, the Contracting Officer reserves the right to conduct discussions if necessary.

52.252-2 Clauses Incorporated by Reference. (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

For FAR Clauses: http://acquisition.gov/far/index.html

Clauses Incorporated by Reference

52.203-13 Contractor Code of Business Ethics and Conduct (Nov 2021)

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (Nov 2023)

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017)

52.204-13 System for Award Management - Maintenance (DEVIATION May 2026)

52.204-19 Incorporation by Reference of Representations and Certifications. (Dec 2014)

52.209-6 Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded (DEVIATION May 2026)

52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (DEVIATION May 2026)

52.212-4 Terms and Conditions-Commercial Products and Commercial Services.

(DEVIATION Mar 2026)

52.219-6 Notice of Total Small Business Se-Aside (DEVIATION May 2026)

52.222-3 Convict Labor (DEVIATION May 2026)

52.222-35 Equal Opportunity for Veterans (DEVIATION May 2026)

52.222-36 Equal Opportunity for Workers with Disabilities (DEVIATION May 2026)

52.222-37 Employment Reports on Veterans (DEVIATION May 2026)

52.222-50 Combating Trafficking in Persons (DEVIATION May 2026)

52.222-90 Addressing DEI Discrimination by Federal Contractors (DEVIATION May 2026) http://acquisition.gov/far/index.html

52.226-8 Encouraging Contractor Policies to Ban Tec Messaging While Driving (May 2024)

52.227-14 Rights in Data-General (May 2014)

52.232-33 Payment by Electronic Funds Transfer-System for Award Management (Oct 2018)

52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Mar 2023)

52.233-3 Protest after Award (DEVIATION May 2026)

52.233-4 Applicable Law for Breach of Contract Claim (Oct 2004)

52.240-91 Security Prohibitions and Exclusions (Mar 2026)

52.240-93 Basic Safeguarding of Covered Contractor Information Systems (DEVIATION May 2026)

52.242-15 Stop-Work Order (Aug 1989)

Full Text Clauses

52.217-8 Option to Extend Services.

As prescribed in 17.208(f), insert a clause substantially the same as the following:

OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract.

As prescribed in 17.208(g), insert a clause substantially the same as the following:

OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 15 days provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5-years, 6 months.

52.219-28 Postaward Small Business Program Rerepresentation.

As prescribed in 19.101(a)(2)(iii)(A), insert the following clause:

Postaward Small Business Program Rerepresentation (Deviation Date)

(a) Definitions. As used in this clause— Long-term contract means a contract of more than five years in duration, including options.

However, the term does not include contracts that exceed five years in duration because the period of performance has been extended for a cumulative period not to exceed six months under the clause at 52.217-8, Option to Extend Services, or other appropriate authority.

Small business concern—

(1) Means a concern, including its affiliates, that is independently owned and operated, not dominant in its field of operation, and qualified as a small business under the criteria in 13 CFR part 121 and the size standard in paragraph (c) of this clause.

(2) Affiliates, as used in this definition, means business concerns, one of whom directly or indirectly controls or has the power to control the others, or a third party or parties control or have the power to control the others. In determining whether affiliation exists, consideration is given to all appropriate factors including common ownership, common management, and contractual relationships. SBA determines affiliation based on the factors set forth at 13 CFR 121.103.

(b) If the Contractor represented that it was a small business concern, a small disadvantaged business concern, or a joint venture that was any of the small business concerns identified in 19.000(a)(3) prior to award of this contract, the Contractor shall rerepresent its size and socioeconomic status according to paragraph (e) of this clause or, if applicable, paragraph (g) of this clause, upon occurrence of any of the following:

(1) Within 30 days after execution of a novation agreement or within 30 days after modification of the contract to include this clause, if the novation agreement was executed prior to inclusion of this clause in the contract.

(2) Within 30 days after a merger or acquisition that does not require a novation or within 30 days after modification of the contract to include this clause, if the merger or acquisition occurred prior to inclusion of this clause in the contract.

(3) For long-term contracts-

(i) Within 60 to 120 days prior to the end of the fifth year of the contract; and

(ii) Within 60 to 120 days prior to the date specified in the contract for exercising any option thereafter.

(c) The Contractor shall rerepresent its size status in accordance with the size standard in effect at the time of this rerepresentation that corresponds to the North American Industry Classification System (NAICS) code(s) assigned to this contract. The small business size standard corresponding to this NAICS code(s) can be found at https://www.sba.gov/document/support--table-size-standards.

(d) The small business size standard for a Contractor providing an end item that it does not manufacture, process, or produce itself, for a contract other than a construction or service contract, is 500 employees, or 150 employees for information technology value-added resellers under NAICS code 541519, if the acquisition—

(1) Was set aside for small business and has a value above the simplified acquisition threshold;

(2) Used the HUBZone price evaluation preference regardless of dollar value, unless the Contractor waived the price evaluation preference; or

(3) Was an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(e) Except as provided in paragraph (g) of this clause, the Contractor shall make the representation(s) required by paragraph (b) of this clause by validating or updating all its representations in the Representations and Certifications section of the System for Award Management (SAM) and its other data in SAM, as necessary, to ensure that they reflect the Contractor's current status. The Contractor shall notify the contracting officer in writing within the timeframes specified in paragraph (b) of this clause, that the data have been validated or updated, and provide the date of the validation or update.

(f) If the Contractor represented that it was other than a small business concern prior to award of this contract, the Contractor may, but is not required to, take the actions required by paragraphs

(e) or (g) of this clause.

(g) If the Contractor does not have representations and certifications in SAM, or does not have a representation in SAM for the NAICS code applicable to this contract, the Contractor is required to complete the following rerepresentation and submit it to the contracting office, along with the contract number and the date on which the rerepresentation was completed:

(1) The Contractor represents that it □ is, □ is not a small business concern under NAICS Code _____ assigned to contract number _____.

(2) [Complete only if the Contractor represented itself as a small business concern in paragraph (g)(1) of this clause.] The Contractor represents that it □ is, □ is not, a small disadvantaged business concern as defined in 13 CFR 124.1001.

(3) Women-owned small business (WOSB) joint venture eligible under the WOSB Program. The Contractor represents that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: __.]

(4) Economically disadvantaged women-owned small business (EDWOSB) joint venture. The Contractor represents that it □ is, □ is not a joint venture that complies with the requirements of 13 CFR 127.506(a) through (c). [ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: __ .]

(5) Service-disabled veteran-owned small business (SDVOSB) joint venture eligible under the SDVOSB Program. The Contractor represents that it □ is, □ is not an SDVOSB joint venture eligible under the SDVOSB Program that complies with the requirements of 13 CFR 128.402.

https://www.sba.gov/document/support--table-size-standards

[ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: __.]

(6) HUBZone joint venture eligible under the HUBZone Program.[ Complete only if the offeror is a HUBZone small business concern. ] The offeror represents, as part of its offer, that It □ is, □ is not a HUBZone joint venture that complies with the requirements of 13 CFR 126.616(a) through (c). [ The Contractor shall enter the name and unique entity identifier of each party to the joint venture: _____. ] Each HUBZone small business concern participating in the HUBZone joint venture must be certified as a HUBZone concern. [ Contractor to sign and date and insert authorized signer's name and title.______________________ ]

DEPARTMENT OF THE INTERIOR ACQUISITION REGULATION (DIAR) CLAUSES

INCORPORATED BY FULL TEXT

1452.201-70 Authorities and Delegations (Sep 2011)

(a) The Contracting Officer is the only individual authorized to enter into or terminate this contract, modify any term or condition of this contract, waive any requirement of this contract, or accept nonconforming work.

(b) The Contracting Officer will designate a Contracting Officer's Representative (COR) at time of award. The COR will be responsible for technical monitoring of the contractor's performance and deliveries. The COR will be appointed in writing, and a copy of the appointment will be furnished to the Contractor. Changes to this delegation will be made by written changes to the existing appointment or by issuance of a new appointment.

(c) The COR is not authorized to perform, formally or informally, any of the following actions:

(1) Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change this contract;

(2) Waive or agree to modification of the delivery schedule;

(3) Make any final decision on any contract matter subject to the Disputes Clause;

(4) Terminate, for any reason, the Contractor's right to proceed;

(5) Obligate in any way, the payment of money by the Government.

(d) The Contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum. The Contractor need not proceed with direction that it considers to have been issued without proper authority. The Contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the COR has taken an action or has issued direction (written or oral) that the Contractor considers to exceed the COR's appointment, within 3 days of the occurrence. Unless otherwise provided in this contract, the Contractor assumes all costs, risks, liabilities, and consequences of performing any work it is directed to perform that falls within any of the categories defined in paragraph (c) prior to receipt of the Contracting Officer's response issued under paragraph (e) of this clause.

(e) The Contracting Officer shall respond in writing within 30 days to any notice made under paragraph (d) of this clause. A failure of the parties to agree upon the nature of a direction, or upon the contract action to be taken with respect thereto, shall be subject to the provisions of the Disputes clause of this contract.

(f) The Contractor shall provide copies of all correspondence to the Contracting Officer and the COR.

(g) Any action(s) taken by the Contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the COR acting within his or her appointment, shall be at the Contractor's risk.

(End of clause)

Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP)

(February 2021)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice [Contracting Officer to edit and include the documentation required under this contract]:

The Contractor must use the IPP website to register access and use IPP for submitting requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award date. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Local Clause)

INTERNET PROTOCOL version 6 (June 2012)

1.Any system hardware, software, firmware and/or networked component (voice, video or data) developed, procured, or acquired in support and/or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile ( NIST Special Publication 500267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

2. Specifically, any new IP product or system developed, acquired, or produced must:

a. Interoperate with both IPv6 and IPv4 systems and products, and

b. Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

3. As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to 'the Government. The Contractor shall retrofit all nonIPv6 capable equipment, as defined above, that is fielded under this contract with IPv6 capable equipment, at no additional cost to the Government.

4. The contractor shall provide technical support for both IPv4 and IPv6.

5. Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

6. Any product whose noncompliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified, or replaced to bring it into compliance at no additional cost to the Government.

52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this address: www.acquisition.gov.

Solicitation Provisions Incorporated by Reference

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements-Representation (Jan 2017)

52.204-7 System for Award Management – Registration (DEVIATION May 2026)

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations-Representation (DEVIATION May 2026)

52.229-11 Tax on Certain Foreign Procurements – Notice and Representation (Oct 2025)

52.240-90 Security Prohibitions and Exclusions Representations and Certification (DEVIATION May 2026)

Full Text Provisions

1452.233-2 -- Service of Protest Department of the Interior (Jul 1996) (Deviation)

(a) Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting Officer (addressed as follows) by obtaining written and dated acknowledgment of receipt from U.S. Fish & Wildlife, 4301 Fairfax Drive, Arlington, VA 22203.

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the GAO.

(c) A copy of the protest served on the Contracting Officer shall be simultaneously furnished by the protester to the Department of the Interior Assistant Solicitor, Acquisitions and Intellectual Property, 1849 C Street, NW, Room 6511, Washington, DC 20240.

(End of Provision) http://www.acquisition.gov/

U.S. Fish and Wildlife Service

National Conservation Training Center

DISH AT120 Programming

1. Project Overview: The U.S. Fish and Wildlife Service (USFWS) National Conservation Training Center (NCTC) requires satellite television programming services to support 236 existing housing unit television drops. The Government intends to utilize the existing installed television distribution infrastructure and associated equipment currently located at the facility. Services are not currently active and shall be activated by the contractor upon contract award.

2. Scope: The contractor shall provide all programming subscriptions, activation services, regulatory fees, and technical support necessary to establish and maintain uninterrupted television programming service to 236 existing housing unit drops throughout the period of performance.

The Government will retain and utilize the existing installed equipment and distribution infrastructure. The contractor shall ensure compatibility with the existing system and provide all services necessary to activate and maintain programming on the existing equipment.

The contractor shall be responsible for verifying compatibility of the required programming services with the existing Government-owned infrastructure prior to service activation. Any identified compatibility issues shall be reported to the Contracting Officer before any corrective action is taken.

3. Technical Requirements: The contractor shall provide the following services for 236 existing housing unit drops (exact match only):

Description Quantity

DISH AT120 Programming drop 236

Locals drop 236

HD Software and Technology Fee drop 236

FCC Regulatory Fee drop 236

Housing Unit Drops 236

4. Contractor Responsibilities: The contractor shall:

• Activate television programming services upon award.

• Provide all subscription services required to deliver the specified programming package.

• Provide local channel access for the service location.

• Include all applicable HD technology and FCC regulatory fees.

• Maintain service throughout the contract period.

• Provide customer and technical support for service-related issues.

• Coordinate with Government personnel regarding activation, troubleshooting, and service restoration as necessary.

5. Period of Performance: The period of performance will be for one 12-month base period with four 12-month option periods.

6. Place of Performance:

USFWS NCTC

698 Conservation Way Shepherdstown, WV 25443

Information Technology Baseline Compliance Contract Guidelines

July 2022

Table of Contents Introduction

Section 1.0 – Information Technology and Cybersecurity Requirements

A. Applicability B. Requirements C. Information Systems D. Cloud E. Internet Protocol Version 6 (IPv6) F. Continuous Monitoring G. Security Training and Reviews H. Contractor Reporting Requirements

Section 2.0 – Cybersecurity Incident Response

A. Applicability B. Definitions C. Requirements

Section 3.0 – Privacy Requirements

A. Applicability B. Definitions C. Privacy Act Requirements D. Privacy Controls E. Privacy Breach Reporting Requirements F. Privacy Training Requirements

Section 4.0 – Accessibility Requirements (Section 508)

A. Applicability B. Requirements

Section 5.0 – Records Management Requirements

A. Applicability B. Definitions C. Requirements

Section 6.0 – Contractor Personnel Security Requirements

Section 7.0 – Controlled Unclassified Information Requirements

A. Applicability B. Definitions C. Authorities D. Requirements E. Training

Section 8.0 – Paperwork Reduction Act of 1995

Section 9.0 – Reference Documents

Section 10.0 – Glossary

DOI Baseline Compliance Contract Guidelines 2 | Page

DOI Baseline Compliance Contract Guidelines 3 | Page

Introduction This document provides guidance regarding requirements that must be reviewed and considered for incorporation, where applicable, in all Department of the Interior (DOI, Department) contract actions that involve information technology (IT) products or services. Contracting Officer Representatives (CORs) and/or the requirement owners should work closely with their Bureau or Office Associate Chief Information Officer and Contracting Officer (CO) to ensure the below requirements are properly addressed in IT contracts within the appropriate sections. Any referenced regulation or policy should be provided to the Contractor via hypertext link or other means.

Section 1.0 – Information Technology and Cybersecurity Requirements A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements Information systems and system services provided to the Department by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance. Contracts that involve Industrial Control System (ICS) products and services should be evaluated on an individual basis and contain language specific to ICS. Please contact the Bureau of Reclamation (BOR) at ICSsecurity@usbr.gov for ICS issues and guidance.

The Contractor and the contractor-managed systems shall comply with all federal regulations and guidance, including but not limited to:

1. Federal Information Security Modernization Act of 2014 (FISMA) accessible at https://www.cisa.gov/federal-information-security-modernization-act

2. Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems accessible at https://www.fedramp.gov

3. Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW- 107publ347.pdf

4. Privacy Act of 1974 accessible at https://www.justice.gov/opcl/privacy-act-1974

5. Federal Information Processing Standards (FIPS) and the National Institute of

Standards and Technology (NIST) 800-Series Special Publications (SP) accessible at https://www.nist.gov

6. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, accessible at https://www.cio.gov/policies-and-priorities/circular-a-130/

C. Information Systems The Contractor shall manage information in accordance with applicable laws, regulations, executive orders, and policies regarding the marking, safeguarding, and dissemination of mailto:ICSsecurity@usbr.gov mailto:ICSsecurity@usbr.gov https://www.cisa.gov/federal-information-security-modernization-act https://www.cisa.gov/federal-information-security-modernization-act https://www.fedramp.gov/ https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.nist.gov/ https://www.nist.gov/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.cio.gov/policies-and-priorities/circular-a-130/

DOI Baseline Compliance Contract Guidelines 4 | Page

Controlled Unclassified Information (CUI). Personally Identifiable Information (PII) is a subset of information designated as CUI, and Sensitive PII is a subset of PII that requires additional controls and safeguards. (See section 3, Privacy Requirements)

The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

Contractor Information Systems shall comply with FISMA. The Contractor shall provide an Assessment and Authorization (A&A) documentation package for each system that complies with Federal Information Processing Standard (FIPS) 199, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, NIST SP 800-37, NIST SP 800-53, NIST SP 800-60, et al.

The Contractor cryptographic modules used to protect DOI information shall comply with the current NIST FIPS 140 version and be validated by the Cryptographic Module Validation Program.

Access to all government data stored outside the confines of a DOI-managed data center shall comply with Trusted Internet Connections (TIC) requirements.

All Contractor personnel requiring access to DOI information data and/or systems shall be cleared at appropriate levels as set forth:

1. Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation.

2. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI).

3. High Risk position will require a Background Investigation (BI).

Vulnerability Scanning - All IT systems providing services to or on behalf of the Department or storing, processing, or routing DOI CUI information must be scanned monthly with a vulnerability analysis tool using authenticated scans that are acceptable to DOI. Vulnerabilities and weaknesses shall be remediated in accordance with (IAW) Department-mandated time frames commensurate with the level of risk.

D. Cloud All Contractor cloud-hosted Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) or other “as a Service” offerings shall comply with applicable language within the DOI cloud hosting program guidelines.

E. Internet Protocol Version 6 (IPv6) The applicability of IPv6 to DOI-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the Department Acquisition, Arts, and Asset Policy DOI-AAAP-0055, Procuring Internet Protocol Version 6 (IPv6), (per OMB Memorandum M-05-22, August 2, 2005) and with subsequent federal requirements (OMB Memorandum M 21-07 Transition to IPv6, September 28, 2010) regardless of whether the

DOI Baseline Compliance Contract Guidelines 5 | Page acquisition is for modification, upgrade, or replacement. All Enterprise Architecture related component acquisitions shall be IPv6-compliant as defined in the U.S. Government Version 6 (USGv6) Profile (NIST SP 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program. In cloud service procurements, IPv6 compliance should be pursued where practicable.

F. Continuous Monitoring All Contractor-operated systems that input, store, process, output, and/or transmit DOI CUI shall meet or exceed the continuous monitoring requirements identified in the DOI Continuous Monitoring Plan or the Bureau or Office Continuous Monitoring Plan, whichever best fits mission, security, and risk management needs.

Contractor-managed systems are required to have an assigned Information System Security Officer (ISSO) and System Owner (SO) to support the processes described in the contract. While the procuring organization designates government personnel to serve in these roles, the contractor must provide functionally equivalent personnel to enable effective day-to-day operation, management, and monitoring of the system. The Contractor ISSO and SO resources are required to comply with DOI- or other-approved annual and Role Based Security Training (RBST) requirements.

Contractors managing systems on behalf of the Department are required to submit Continuous Monitoring Reports per the Continuous Monitoring Plan to the federal point of contact designated in the contract per the timelines prescribed in the Continuous Monitoring Plan. The Contractor-managed systems may be required to submit to a penetration test (at the discretion of the awarding program) in coordination with DOI cybersecurity personnel or approved contract officials.

When required by the contract, the Contractor must provide the following in alignment with DOI’s continuous monitoring strategy:

1. account management

2. vulnerability management

3. patch management

4. antivirus

5. malware detection

6. event management

7. configuration management

8. license management

9. incident management

G. Security Training and Reviews All users of federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing federal information systems under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and

DOI Baseline Compliance Contract Guidelines 6 | Page be completed on an annual basis thereafter. New Contractor employees assigned to the contract shall complete the training before accessing federal information systems under the contract. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty

(30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification each year. The e-mail notification shall state that all Contractor and subcontractor employees have completed the required training.

The government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced, particularly when contractors build and operate or maintain systems on behalf of the Department. In such cases, the Contractor shall afford DOI, the Office of the Inspector General, and other government organizations access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor shall provide access, to the extent necessary as determined by the government, for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of the contract and to preserve evidence of computer crime. Cloud Service Providers should not be expected to grant physical access to government inspectors.

H. Contractor Reporting Requirements The Contractors operating information systems on behalf of the Department shall comply with FISMA reporting requirements. Department system owners shall coordinate annual and quarterly data collection. Contractors must provide DOI with the requested information based on the timeframes provided with each request. The Contractor systems shall comply with near real time feeds in accordance with Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) requirements as coordinated by DOI. Reporting requirements are determined by OMB and may change each reporting period.

The Contractor-managed systems shall adhere to NIST 800-53 and submit to an annual assessment performed in coordination with DOI cybersecurity personnel or approved contract officials. All results of the annual assessment become the property of the Department.

The Contractor shall comply with DHS or other government oversight bodies regarding cybersecurity-related mandates and directives (Binding Operational Directives [BOD], etc.) or any additional ad-hoc reporting requirements.

Section 2.0 – Cybersecurity Incident Response A. Applicability

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

DOI Baseline Compliance Contract Guidelines 7 | Page

As used in this term-

“Incident” means an occurrence that

1. actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

2. constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

C. Requirements All Contractor employees and information system service providers shall be responsible for recognizing and reporting security incidents. Information system service providers shall receive the current version of the DOI Incident Response Plan, Policy, and Handbook at the time of award, in addition to bureau- or office-specific guidance for appropriate reporting and response at all levels. All suspected or confirmed information security incidents shall be reported in accordance with the requirements listed below, even if it is believed the incident may be limited, small, or insignificant. For hosting environments, including cloud systems and services, this includes incidents occurring on the service provider’s underlying infrastructure supporting containers utilized by the Department. In such cases, the vendor’s primary security operations and/or incident response unity shall engage directly with the DOI Cyber Security Operations (CSO) Section and provide DOI CSO with security and event logs covering the period of the incident and up to six months prior. The DOI CSO and Bureau or Office Incident Response Teams will determine when an incident requires additional focus and attention.

All Contractor employees and information system service providers shall report all information security incidents to the appropriate Bureau or Office Incident Response Team and to the DOI Computer Incident Response Center (DOI CIRC) immediately, no later than 1 hour after “becoming aware of the incident,” at DOICIRC@ios.doi.gov, (703) 648-5655, regardless of day or time. Any contractor action to investigate, identify, respond to, contain, remediate, or recover from a security event (which includes “suspected” incidents) constitutes “becoming aware of the incident.”

When notifying the DOI CIRC and the appropriate Bureau or Office Incident Response Team, the Contractor shall include the CO and COR on the correspondence email to DOICIRC@ios.doi.gov and the appropriate Bureau or Office Incident Response Team. If the Contractor reported the incident by phone, then immediately following the reporting, the Contractor shall notify the CO and COR via e-mail. The Contractor is responsible for verifying that all notification was received and acknowledged by the CO or COR. If the Contractor has any questions regarding these procedures, they shall contact the CO or the COR.

The Contractor shall not include any controlled information in the subject or body of any e-mail.

Contractor shall transmit controlled information using validated encryption methods compliant with the current NIST FIPS 140 version to protect controlled information in e-mail attachments.

Passwords must not be communicated in the same email as the attachment. Contractor shall contact the CO or COR if encryption software is needed for guidance on appropriate, federally approved encryption methods.

mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov mailto:DOICIRC@ios.doi.gov

DOI Baseline Compliance Contract Guidelines 8 | Page

Section 3.0 – Privacy Requirements A. Applicability.

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

As used in this term-

Breach: the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other-than-authorized purpose.

1. PII - information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

2. Sensitive PII (SPII) is a subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII is CUI and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. SPII includes but is not limited to full or truncated Social Security Number (SSN), driver's license or state identification number; financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; and system authentication information such as passwords, personal identification numbers or mother's maiden name.

C. Privacy Act Requirements The Contractor shall comply with the requirements of the Privacy Act of 1974 and shall not remove PII or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity. When Privacy Act records, information, data, documentary material, and equipment is no longer required, the Contractor shall return it to the Department’s control or hold it until otherwise directed. Items returned to the government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO.

D. Privacy Controls The Contractor shall meet the privacy requirements of the E-Government Act, FISMA, applicable federal privacy laws, NIST, OMB, and DOI (including but not limited to those listed in the contract table of authorities) for the collection, handling, processing, and sharing of PII, and ensure compliance with the privacy controls requirements of NIST SP 800- 53, FIPS 199, DOI Baseline Compliance Contract Guidelines 9 | Page

FIPS 200, and DOI Privacy Control standards as appropriate for the sensitivity of the system.

The Contractor shall monitor the information system and update controls for continued privacy compliance on an ongoing basis and shall provide status reports to the Department upon request.

The Contractor shall be required to provide all necessary support to assist the Department in meeting the requirements of the Privacy Act and related laws and shall provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes timely responding to requests for information from the Department about the access, creation, collection, use, storage, maintenance, transmission, sharing, or disposition of PII on the Contractor’s system or processes, and providing timely review of relevant compliance documents for factual accuracy.

E. Privacy Breach Reporting Requirements The Contractor shall provide notice to DOI CIRC or the appropriate Bureau or Office Incident Response Team of any known or suspected breach of PII and meet breach reporting and mitigation requirements in accordance with the DOI Privacy Breach Response Plan or bureau or office applicable response plan. The report of a breach of PII shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information or has otherwise failed to meet the requirements of the contract.

The Contractor shall report all known or suspected breaches in electronic or physical form to the CO, COR, and the DOI CIRC or bureau or office point of contact no later than one hour following discovery via email at DOICIRC@ios.doi.gov or (703) 648-5655, regardless of day or time and as specified within the DOI Privacy Breach Response Plan and the applicable bureau or office…