CO323-24.pdf

Page 1 of 50ORDER NUMBER:

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME b. TELEPHONE NUMBER (No collect calls)

8. OFFER DUE DATE/

LOCAL TIME

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NAICS:

SIZE STANDARD:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

Coll. No.

8 (A)

EDWOSB

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

CO323-24

Kimberly Schwinn 202-305-3730

COCO

COCO

321000101

Misc 400 First Street NW Washington DC 20534

UNICOR FPI CENTRAL ACCOUNTS PAYABLE

PO BOX 11849

LEXINGTON, KY 40578-1849

1620000183 See Section B

UNICOR FUNDS 15X4500 FUNDS SHALL BE OBLIGATED BY INDIVIDUAL DELIVERY ORDERS AND NOT BY THE CONTRACT ITSELF

Kimberly Schwinn

X

513210

01/03/2024

02/16/2024

2:00 PM

COCO

UNICOR, FPI CENTRAL OFFICE

400 1ST ST NW

WASHINGTON DC 20534-0004

UNICOR, FPI CENTRAL OFFICE

400 1ST ST NW

WASHINGTON DC 20534-0004

01/03/2024

UNICOR, FPI CENTRAL OFFICE

400 1ST ST NW

WASHINGTON DC 20534-0004

01/03/2024

Page 2 of 50ORDER NUMBER:

Terms:

Solicitation is issued as a one (1) base year of twelve (12) months and three (3) twelve (12) month option years if exercised, indefinite delivery/indefinite quantity fixed price type contract.

SOLICITATION IS UNRESTRICTED

A. GUARANTEED MINIMUM FOR THE LIFE OF THE CONTRACT: $50,000.00

B. NOT TO EXCEED MAXIMUM FOR THE LIFE OF THE CONTRACT: $2.4M

C. THE NOT TO EXCEED MAXIMUM IS NOT A GUARANTEED AMOUNT

SUBCONTRACTING PLAN: Large Businesses submitting a proposal are required to submit their subcontracting plan as part of their proposal by the scheduled closing date and time. Failure to submit a subcontracting plan may result in the proposal being found technically unacceptable and may not be considered for further evaluation.

QUESTIONS PERTAINING TO THIS SOLICITATION WILL ONLY BE ADDRESSED IN

WRITING VIA EMAIL TO: Kimberly.Schwinn2@usdoj.gov

QUESTIONS DEADLINE IS FRIDAY, JANUARY 26, 2024 @ 2:00 PM EST.

ALL QUESTIONS/ANSWERS WILL BE POSTED VIA AN AMENDMENT PRIOR TO BID

CLOSING.

NO PHONE CALLS PLEASE.

For a list, description and total estimated quantities of all items, refer to Section B.

SAP License must be supplied by SAP or a certified SAP Reseller.

Vendors shall submit signed and dated offers by email to

Kimberly.Schwinn2@usdoj.gov

The date and time for receipt of proposals is FRIDAY, FEBRUARY 16, 2024

<(>,<)> at 2:00 PM EST. Offer must indicate Solicitation No. CO323-24, time specified for receipt of offer, name, address and telephone number

Page 3 of 50ORDER NUMBER:

SECTION B

SUPPLIES OR SERVICES AND PRICES/COSTS

Item No. SUPPLIES OR SERVICE Quantity U/M UNIT PRICE AMOUNT IN US$ Delivery Date of offeror, technical description of the items being offered in sufficient detail to evaluate compliance with the requirements in the solicitation, terms of any expressed warranty, price and any discount terms. Offer must include acknowledgment of all amendments, if any.

THE FOLLOWING INFORMATION IS REQUIRED TO BE COMPLETED BY THE OFFEROR:

SAM UNIQUE ENTITY NUMBER:_______________________________________

VENDOR'S POINT OF CONTACT: _____________________________________

VENDOR'S TELEPHONE & FAX NUMBER: _____________________________

VENDOR'S EMAIL ADDRESS: ________________________________________

VENDOR'S BUSINESS SIZE (i.e. SMALL, LARGE, ETC.): __________________

By submission of an offer, the offeror acknowledges the requirement that a prospective awardee shall be registered in the SAM database (System

Award Management) prior to submitting a proposal, during performance and through final payment of any contract resulting from this solicitation.

_______________________________________________ Signature

The Administrative Contracting officer is Kimberly Schwinn at

Kimberly.Schwinn2@usdoj.gov

00001 Secure Enterprise Maintenance & Support1 EA 03/01/2024

Secure Enterprise Maintenance & Support

Base Year __$____________________________

Page 4 of 50ORDER NUMBER:

Option Year 1 __$________________________

Option Year 2 __$________________________

Option Year 3 __$________________________

8 UN - SAP Data Services

8 UN - SAP Advanced Data Migration by Back Office

SAP License must be supplied by SAP or a certified SAP Reseller.

00002 SAP Secure Enterprise Maintenance & Supp1 EA 03/01/2024

SAP Secure Enterprise Maintenance & Support

Base Year __$____________________________

Option Year 1 __$________________________

Option Year 2 __$________________________

Option Year 3 __$________________________

Page 5 of 50ORDER NUMBER:

4 UN - SAP Enable Now, author option

1200 UN - SAP Enable Now, consumption option

50 UN - SAP Knowledge, Acceleration Bundle for ERP

SAP License must be supplied by SAP or a certified SAP Reseller.

00003 Maintenance & Support 1 EA 03/01/2024

Maintenance & Support

Base Year __$____________________________

Option Year 1 __$________________________

Option Year 2 __$________________________

Option Year 3 __$________________________

70 UN - SAP Invoice Management by OpenText for SAP S/4HANA

70 UN - OCR option for SAP Invoice Management by OpenText

100 UN - SAP Document Access by OpenText for SAP/4HANA

SAP License must be supplied by SAP or a certified SAP Reseller.

Page 6 of 50ORDER NUMBER:

00004 Maintenance & Support 1 EA 03/01/2024

Maintenance & Support

Base Year __$____________________________

Option Year 1 __$________________________

Option Year 2 __$________________________

Option Year 3 __$________________________

200 LICENSE QTY - SAP Knowledge Acceleration Bundle for ERP

1 LICENSE QTY - SAP Enable Now, author option

200 LICENSE QTY- SAP Enable Now, consumption option

SAP License must be supplied by SAP or a certified SAP Reseller.

00005 Maintenance & Support 1 EA 03/01/2024

Maintenance & Support

Base Year __$____________________________

Page 7 of 50ORDER NUMBER:

Option Year 1 __$________________________

Option Year 2 __$________________________

Option Year 3 __$________________________

SAP S4/HANA 1 UN - SAP S/4HANA Enterprise Management for ERP customers

1 UN - SAP S/4HANA Advanced Available-to-Promise

2 CS - SAP BusinessObjects Enterprise, professional edition (CS, Blocks of 10)

2 USR- SAP BusinessObjects Enterprise, professional edition (User)

340 UN - SAP Extended Procurement, Public Sector and Regulated

Industries extension

340 UN - SAP Extended Procurement

525 UN - SAP Interactive Forms by Adobe

1 UN - SAP HANA, Runtime edition for Applications & SAP BW - Install

Base

1 UN - SAP HANA, Runtime edition for Applications & SAP BW -

New/Subsequent

32 UN - SAP Netweaver Single Sign On

SAP License must be supplied by SAP or a certified SAP Reseller.

Page 8 of 50ORDER NUMBER:

PART I: INFORMATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; offers are being requested and a written solicitation will not be issued. The solicitation number is

CO323-24 and this solicitation is issued as a Request For Proposals

(RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2023-06. The

North American Industry Classification System code is 513210 Software

Publishers. This requirement is unrestricted. UNICOR, Federal Prison

Industries, Inc., intends to enter into a one (1) base year of twelve

(12) months and three (3) twelve (12) month option years if exercised, indefinite delivery/indefinite quantity fixed price type contract for the following commercial item(s):

SEE SECTION B FOR LIST OF ITEMS

Any contract resulting from this solicitation will not be an obligation.

Funds will be obligated by delivery orders.

NOTICE TO GOVERNMENT WHEN CONTRACTOR(S) DELAYS:

In the event the contractor(s) encounter difficulty in meeting performance requirements, or when there is an anticipated difficulty in complying with the delivery terms or completion dates, or whenever the contractor has knowledge that any actual or potential situation is delaying or threatens to delay the timely delivery/performance of this contract, the contractor must immediately notify the Administrative

Contracting Officer in writing, giving pertinent details. This information will not be construed as a waiver by the Government of the required delivery schedule, or the Governments rights to impose consideration against delinquencies or other remedies provided by this contract.

Page 9 of 50ORDER NUMBER:

Contractor agrees that FPI is in the category of the most favored or best commercial customer category of the Contractor and as such, the

Contractor will:

During the contract period, the Contractor shall report to the

Contracting Officer all price reductions offered to the category of customers that are considered by the Contractor to be their most favored or best commercial customer.

1. A price reduction shall apply to purchases under this contract if, after the award date, the Contractor-

,,i) Revises downward its commercial catalog, price list, schedule, etc., to its best commercial customers (or category of customers) below the awarded price under this contract;

,,ii) Grants more favorable discounts or terms and conditions to its best commercial customers than those contained in this contract that would result in prices below the awarded price under this contract, an/or

,,iii) Grants special discounts to its best commercial customer (or category of customers) that would result in prices lower than the awarded price under this contract.

2. The Contractor shall offer the price reduction to FPI with the same effective date, and for the same time period, as extended to the commercial customer (or category of customers).

The Contractor may offer the Contracting Officer a voluntary price reduction at any time during the contract period.

The Contractor shall notify the Contracting Officer of any price reduction subject to this clause as soon as possible, but not later than

15 calendar days after its effective date.

Future requirements for these or similar items from this or other UNICOR factories may be added to the resulting contract if considered to fall within the scope of work and the price is determined to be fair and reasonable.

INVOICES ARE TO BE EMAILED TO:

margaret.jenkins@usdoj.gov

Page 10 of 50ORDER NUMBER:

jonathan.hoskins@usdoj.gov

PART II: FAR CLAUSES

52.204-4, Printed or Copied Double-Sided on Recycled Paper, MAY 2011)

52.211-16 Variation in Quantity.

Variation in Quantity (Apr 1984)

(a) A variation in the quantity of any item called for by this contract will not be accepted unless the variation has been caused by conditions of loading, shipping, or packing, or allowances in manufacturing processes, and then only to the extent, if any, specified in paragraph

(b) of this clause.

(b) The permissible variation shall be limited to: 10% +/-.

This increase or decrease shall apply to Each quantity specified in the delivery schedule.

52.212-4, Contract Terms and Conditions - Commercial Items (DEC 2022).

52.212-5 Contract Terms and Conditions Required To Implement Statutes or

Executive Orders—Commercial Products and Commercial Services (DEC 2023)

(a) The Contractor shall comply with the following

Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality

Agreements or Statements (Jan 2017) (section 743 of Division E, Title

VII, of the Consolidated and Further Continuing Appropriations Act, 2015

(Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by Kaspersky Lab Covered Entities (Dec

Page 11 of 50ORDER NUMBER:

2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section

889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic

Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business

Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct

2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph

(b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

_X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government

(June 2020), with Alternate I (JUN 2020) (41 U.S.C. 4704 and

10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (NOV 2023) (Section 1553 of Pub. L. 111-5).

(Applies to contracts funded by the American Recovery and Reinvestment

Act of 2009.)

_X_ (4) 52.203-17, Contractor Employee Whistleblower Rights (NOV 2023) (

41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

_X_ (5) 52.204-10, Reporting Executive Compensation and First-Tier

Subcontract Awards (OCT 2018) (Pub. L. 109-282) (31 U.S.C. 6101 note).

Page 12 of 50ORDER NUMBER:

__ (6) [Reserved].

__ (7) 52.204-14, Service Contract Reporting Requirements (Oct 2016)

(Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for

Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (9) 52.204-27, Prohibition on a ByteDance Covered Application (Jun

2023) (Section 102 of Division R of Pub. L. 117-328).

___(10) 52.204–28, Federal Acquisition Supply Chain Security Act

Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (DEC 2023) ( Pub. L. 115–390, title II).

__ (11) (i) 52.204–30, Federal Acquisition Supply Chain Security Act

Orders—Prohibition. (DEC 2023) ( Pub. L. 115–390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204–30.

X__ (12) 52.209-6, Protecting the Government’s Interest When

Subcontracting with Contractors Debarred, Suspended, or Proposed for

Debarment. (NOV 2021) (31 U.S.C. 6101note).

_X_ (13) 52.209-9, Updates of Publicly Available Information Regarding

Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (14) [Reserved].

__ (15) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award

(OCT 2022) (15 U.S.C.657a).

_X_ (16) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone

Small Business Concerns (OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved]

__ (18) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov

Page 13 of 50ORDER NUMBER:

2020) (15 U.S.C.644).

__ (ii) Alternate I (Mar 2020) (52.219-6)

__ (19) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov

2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

X__ (20) 52.219-8, Utilization of Small Business Concerns (Sep 2023)

(15 U.S.C. 637(d)(2) and (3)).

_X_ (21) (i) 52.219-9, Small Business Subcontracting Plan (Sep 2023)

(15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (SEP 2023) of 52.219-9.

__ (22) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020)

(15 U.S.C. 644(r)).

(ii) Alternate I (Mar 2020) of 52.219-13.

__ (23) 52.219-14, Limitations on Subcontracting (OCT 2022)

(15 U.S.C.637(a)(14)).

_X_ (24) 52.219-16, Liquidated Damages-Subcontracting Plan (SEPT 2021)

(15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Service-Disabled Veteran-Owned Small

Business Set-Aside (OCT 2022) (15 U.S.C. 657f).

_X_ (26) (i) 52.219-28, Post Award Small Business Program Representation

(SEP 2023) (15 U.S.C. 632(a)(2)).

(ii) Alternate I (MAR 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (OCT

2022) (15 U.S.C. 637(m)).

Page 14 of 50ORDER NUMBER:

__ (28) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small

Business Program (OCT 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves

(Mar 2020) (15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (SEP 2021) (15 U.S.C.

637(a)(17)).

_X_ (31) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

_X_ (32) 52.222-19, Child Labor-Cooperation with Authorities and

Remedies (NOV 2023) (E.O.13126).

_X_ (33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (34) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

_X_ (35) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020)

(38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

_X_ (36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities

(Jun 2020) (29 U.S.C.793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

_X_ (37) 52.222-37, Employment Reports on Veterans (Jun 2020)

(38 U.S.C. 4212).

_X_ (38) 52.222-40, Notification of Employee Rights Under the National

Labor Relations Act (Dec 2010) (E.O. 13496).

X_(39) (i) 52.222-50, Combating Trafficking in Persons (NOV 2021)

(22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50

(22 U.S.C. chapter78 and E.O. 13627).

Page 15 of 50ORDER NUMBER:

__ (40) 52.222-54, Employment Eligibility Verification (MAY 2022).

(Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (41) (i) 52.223-9, Estimate of Percentage of Recovered Material

Content for EPA–Designated Items (May 2008) (42 U.S.C. 6962(c)(3)

(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9

(42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming

Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of

Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (44) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging

Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (45) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun

2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-14.

__ (46) 52.223-15, Energy Efficiency in Energy-Consuming Products (MAY

2020) (42 U.S.C. 8259b).

__ (47) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal

Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

_X (48) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging

While Driving (Jun 2020) (E.O. 13513).

__ (49) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

Page 16 of 50ORDER NUMBER:

__ (50) 52.223-21, Foams (Jun 2016) (E.O. 13693).

_X_ (51) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (52) 52.225-1, Buy American-Supplies (OCT 2022)

(41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__(53) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade

Act (NOV 2023) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C.

3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections

4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Dec 2022) of 52.225-3.

__ (iv) Alternate III (NOV 2023) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

_X_ (54) 52.225-5, Trade Agreements (NOV 2023) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X (55) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021)

(E.O.’s, proclamations, and statutes administered by the Office of

Foreign Assets Control of the Department of the Treasury).

__ (56) 52.225-26, Contractors Performing Private Security Functions

Outside the United States (Oct 2016) (Section 862, as amended, of the

National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

2302 Note).

__ (57) 52.226-4, Notice of Disaster or Emergency Area Set-Aside

(Nov 2007) (42 U.S.C. 5150).

__ (58) 52.226-5, Restrictions on Subcontracting Outside Disaster or

Emergency Area (Nov 2007) (42 U.S.C. 5150).

Page 17 of 50ORDER NUMBER:

__ (59) 52.229-12, Tax on Certain Foreign Procurements (FEB 2021).

__ (60) 52.232-29, Terms for Financing of Purchases of Commercial Items

(NOV 2021)

(41 U.S.C.4505, 10 U.S.C.2307(f)).

___ (61) 52.232-30, Installment Payments for Commercial Items (NOV 2021)

(41 U.S.C.4505, 10 U.S.C.2307(f)).

_X_ (62) 52.232-33, Payment by Electronic Funds Transfer-System for

Award Management (Oct 2018) (31 U.S.C. 3332).

__ (63) 52.232-34, Payment by Electronic Funds Transfer-Other than

System for Award Management (Jul 2013) (31 U.S.C.3332).

_X_ (64) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C.3332).

_X_ (65) 52.239-1, Privacy or Security Safeguards (Aug 1996)

(5 U.S.C. 552a).

_X_ (66) 52.242-5, Payments to Small Business Subcontractors (Jan 2017)

(15 U.S.C. 637(d)(13)).

__ (67) (i) 52.247-64, Preference for Privately Owned U.S.-Flag

Commercial Vessels (NOV 2021) (46 U.S.C. Appx. 1241(b) and 10 U.S.C.

2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (NOV 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting

Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

,,,, [Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018)

(41 U.S.C. chapter 67).

Page 18 of 50ORDER NUMBER:

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May

2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor

Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug

2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor

Standards-Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.

S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract

Labor Standards to Contracts for Maintenance, Calibration, or Repair of

Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract

Labor Standards to Contracts for Certain Services-Requirements (May

2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages Under Executive Order 13658 (JAN 2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022)

(E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit

Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and

Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for

Page 19 of 50ORDER NUMBER:

examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart

4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph

(e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov

2021) ( 41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) ( 41

U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal

Confidentiality Agreements or Statements (Jan 2017) (section 743 of

Division E, Title VII, of the Consolidated and Further Continuing

Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and

Services Developed or Provided by KasperskyLab Covered Entities (Dec

2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section

889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (Jun

2023) (Section 102 of Division R of Pub. L. 117-328).

Page 20 of 50ORDER NUMBER:

(vii)

(A) 52.204–30, Federal Acquisition Supply Chain Security Act

Orders—Prohibition. (Dec 2023) ( Pub. L. 115–390, title II).

(B) Alternate I (Dec 2023) of 52.204–30.

(viii) 52.219-8, Utilization of Small Business Concerns (Sep 2023)

( 15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in

FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(x) 52.222-26, Equal Opportunity (Sep 2015) (E.O.11246).

(xi) 52.222-35, Equal Opportunity for Veterans (Jun

2020) ( 38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun

2020) ( 29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (Jun

2020) ( 38 U.S.C. 4212).

(xiv) 52.222-40, Notification of Employee Rights Under the National

Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (Aug

2018) ( 41 U.S.C. chapter 67).

(xvi)

(A) 52.222-50, Combating Trafficking in Persons (Nov

2021) ( 22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar

2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract

Labor Standards to Contracts for Maintenance, Calibration, or Repair of

Certain Equipment-Requirements (May 2014) ( 41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract

Labor Standards to Contracts for Certain Services-Requirements

(May 2014) ( 41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (May 2022) (E.O.

12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive

Page 21 of 50ORDER NUMBER:

Order 14026 (Jan 2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan

2022) (E.O. 13706).

(xxii)

(A) 52.224-3, Privacy Training (Jan 2017) ( 5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions

Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit

Organizations (Jun 2020) ( 42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing Accelerated Payments to Small Business

Subcontractors (Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxvi) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial

Vessels (Nov 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

52.216-18, Ordering (AUG 2020).

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the Schedule. Such orders may be issued from date of award through four years, if exercised .

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c) If mailed, a delivery order or task order is considered “issued” when the Government deposits the order in the mail. Orders may be issued orally, by facsimile, or by electronic commerce methods only if authorized in the Schedule.

Page 22 of 50ORDER NUMBER:

52.216-19, Order Limitation (OCT 1995).

(a) minimum delivery order of 1 each for a single line item; (b)(1) max delivery order for a single item in excess of 1 each; (b)(2) any order for a combination of items in excess of 5 each (quantity or dollar value), contractor will not be obligated to honor. Contractor will not be obligated to honor a series of orders from the same ordering office, within a 15 day period that together call for quantities exceeding the maximum order limitations. However, the contractor shall honor orders exceeding the maximum order limitations unless the order(s) are returned to the ordering office within seven calendar days after issuance with a written statement expressing the contractor’s intent not to ship.

52.216-22, Indefinite Quantity (Oct 1995

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the “maximum.” The Government shall order at least the quantity of supplies or services designated in the Schedule as the

“minimum.”

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the

Contractor’s and Government’s rights and obligations with respect to that order to the same extent as if the order were completed during the contract’s effective period; provided, that the Contractor shall not be

Page 23 of 50ORDER NUMBER:

required to make any deliveries under this contract after thirty (30) calendar days after contract validity end date.

52.217-9 Option to Extend the Term of the Contract (Mar 2000).

(a) The Government may extend the term of this contract by written notice to the Contractor within ten (10) days; provided that the

Government gives the Contractor a preliminary written notice of its intent to extend at least thirty (30) days before the contract expires.

The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed four (4) years.

52.229-3 Federal, State, and Local Taxes. (Feb 2013);

52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004);

52.252-2, Clauses Incorporated By Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

___________www.acquisition.gov__________________

Security of Department Information and Systems DOJ-05 (OCT 2023)

I. ,,Applicability to Contractors and Subcontractors

Section 2839.102 of the Justice Acquisition Regulation (JAR), (48 C.F.R.

§ 2839.102), applies to this contract. Accordingly, all contractors are obligated to comply with all applicable DOJ security policies, directives, or guidance documents, including the security requirements in the provisions in this contract clause. This contract clause applies to all contractors and subcontractors, including cloud service providers

(“CSPs”), and personnel of the contractors and subcontractors

(hereinafter collectively, “Contractor”) that may access, collect, store, process, maintain, use, share, retrieve, disseminate, transmit, Page 24 of 50ORDER NUMBER:

or dispose of DOJ Information. The security requirements set forth herein are in addition to those required by the Federal Acquisition

Regulation (“FAR”), and any other applicable laws, mandates, contract clauses, DOJ policies, directives or guidance documents and Executive

Orders pertaining to the development and operation of Information

Systems and/or the protection of Government Information. This clause does not alter or diminish any existing rights, obligations, or liability under any other civil and/or criminal law, rule, regulation, or mandate.

II. ,,General Definitions

The following general definitions apply to this clause. Specific definitions also apply as set forth in other paragraphs.

A.,,Authorization to Operate (“ATO”), as defined in National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-37

Revision 2, is the official management decision given by a senior

Federal official or officials to authorize operation of an information system and to explicitly accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security and privacy controls.

B.,,Cloud Computing, as defined in DOJ Order 0904 Cybersecurity Program, is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models in accordance with NIST SP 800-145.

C.,,Covered Contract is any contract, order or other agreement under which the contractor, or a subcontractor at any tier, including a cloud service provider, may access, collect, store, process, maintain, use, share, retrieve, disseminate, transmit, or dispose of DOJ Information

(as defined below) in the course of providing a product or service to the Department, with the exception of acquisitions under the

Page 25 of 50ORDER NUMBER:

micro-purchase threshold.

D.,,Covered Information System means any information system used for, involved with, or allowing, the processing, storing, or transmitting of

DOJ Information under a Covered Contract.

E.,,Data means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data, computer software, and personally identifiable information (PII) (defined below).

The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

F.,,DOJ Information, as defined in DOJ Order 0904, means any Information that is owned, produced, controlled, protected by, or otherwise within the custody or responsibility of the DOJ, including, without limitation, information related to DOJ programs or personnel. It includes, without limitation, Information (1) provided by or generated for the DOJ, (2) managed or acquired by the Contractor for the DOJ in connection with the performance of the contract, and/or (3) acquired to perform the contract.

G.,,Information, as defined in DOJ Order 0904, is any communication or representation of knowledge such as facts, data, or opinions, in any form or medium, including textual, numerical, graphic, cartographic, narrative, or audiovisual. This includes any communication or representation of knowledge in an electronic format that allows it to be stored, retrieved, or transmitted.

H.,,Information System, means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502(8)).

I.,,Personally Identifiable Information (“PII”), as defined in the FAR

24.101, means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. It includes but is not limited to common data elements such as names, Page 26 of 50ORDER NUMBER:

addresses, dates of birth, and places of employment, to identity documents, Social Security numbers or other government-issued identifiers, precise location information, medical history, and biometric records. This definition covers all PII that is created by or becomes available to the contractor, including its employees, subcontractors, or affiliates, as a result of performing under this contract. PII, as supplementally defined in DOJ Order 0904, also includes information about an individual maintained by an agency, including, but not limited to, information related to education, financial transactions, medical history, and criminal or employment history and information, which can be used to distinguish or trace an individual’s identity.

J.,,Private Cloud, as defined in NIST SP 800-145, is the deployment model for cloud infrastructure provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

K.,,Security Breach means any security incident (as defined below) that directly relates to the loss of control, compromise, exfiltration, manipulation, unauthorized disclosure, unauthorized acquisition, unauthorized exposure or unauthorized access or any similar occurrence of any Covered Information System or any DOJ Information or any PII accessed by, retrievable from, processed by, stored on, or transmitted within, to or from any such system. This includes incidents where (1) a person other than an authorized user accesses or potentially accesses

PII or DOJ Information or (2) an authorized user accesses or potentially accesses PII or DOJ Information for an unauthorized purpose.

a.,,Potential Security Breach (hereinafter, “Potential Breach”) means any suspected, but unconfirmed security breach (as defined above).

b.,,Confirmed Security Breach (hereinafter, “Confirmed Breach”) means any confirmed security breach (as defined above).

L.,,Security Incident means any occurrence that (1) may actually or imminently jeopardize, without lawful authority, the availability, integrity, authentication, confidentiality, or nonrepudiation of DOJ

Page 27 of 50ORDER NUMBER:

Information or a Covered Information System; or (2) may constitute a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

a.,,Potential Security Incident means any suspected, but unconfirmed security incident (as defined above).

b.,,Confirmed Security Incident means any confirmed security incident

(as defined above).

M.,,Vulnerability, as defined in DOJ Vulnerability Management Plan, and the OCIO Information Security Management Procedure, means a weakness or flaw discovered in the design of a system that, when exploited, may result in a loss of confidentially, integrity, or availability of DOJ

Information or an Information System.

III. ,,Confidentiality and Non-Disclosure of DOJ Information

A.,,Preliminary and final contract deliverables and all associated working papers and material generated by the Contractor developed using

DOJ Information, product, source code, and/or methods of operations, are the property of the U.S. Government and must be submitted to the

Contracting Officer (“CO”) or the CO’s Representative (“COR”) at the conclusion of the contract. The U.S. Government has unlimited data rights to all such deliverables and associated working papers and materials in accordance with FAR 52.227-14 (Rights in Data-General).

The Contractor will define a method of monitoring the development activity to include any activity associated with DOJ Information, product, source code, and methods of operations. The data rights and development details shall be defined within the Contract.

If the Contractor intends to utilize its existing data, for which it has a patent or copyright, to develop a contract deliverable, it is incumbent upon the Contractor to negotiate with the CO the proper FAR

Part 27 clauses in the contract to protect its existing data.

B.,,Pursuant to FAR 52.227-14(d)(2), all documents and data produced in the performance of this contract containing DOJ Information, product code, source code, and/or methods of operations are the property of the

U.S. Government and, without the prior written permission of the CO, the

Page 28 of 50ORDER NUMBER:

Contractor shall neither reproduce nor release such information to any third-party at any time, including during performance or following expiration and/or termination of the contract.

C.,,Any DOJ Information made available to the Contractor under this contract shall be used only for the purpose of performance of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of this contract.

In performance of this contract, the Contractor assumes responsibility for the protection of the confidentiality of all DOJ Information processed, stored, or transmitted by the Contractor. The Contractor shall comply with information security responsibilities and duties throughout the contract and after expiration/termination as appropriate per contract close-out activities. When requested by the CO (typically no more than annually), the Contractor shall provide a report to the CO identifying, to the best of the Contractor’s knowledge and belief, the type, amount, and level of sensitivity of the DOJ Information processed, stored, or transmitted under the Contract, including an estimate of the number of individuals for whom PII has been processed, stored or transmitted under the Contract and whether such information includes social security numbers (in whole or in part).

IV. ,,Compliance with Information Technology Security Policies, Procedures and Requirements

A.,,For all Covered Information Systems, in addition to any other applicable requirements, as set forth in Part I, the Contractor shall comply with the security requirements of the Federal Information

Security Modernization Act of 2014 (“FISMA”), Privacy Act of 1974, E-Government Act of 2002, National Institute of Standards and Technology

(“NIST”) Special Publications (“SP”), including NIST SP 800-37, 800-53, and 800-60 Volumes I and II, Federal Information Processing Standards

(“FIPS”) Publications 140-2, 199, and 200, Federal Risk and

Authorization Management Program (“FedRAMP”), DOJ IT Security Standards as amended, and OMB Memoranda relating to the security of information and/or Federal Information Systems.

B.,,In addition, for all Covered Information Systems, the Contractor shall comply with the following requirements, which are listed here only

Page 29 of 50ORDER NUMBER:

to highlight certain specific applicable requirements from one of the sources identified in the first paragraph of this Section. This is not an exhaustive list of all such requirements with which the Contractor is obligated to comply, and the omission of a requirement from this list should not be construed as negating the materiality of that requirement.

These requirements and those in the authorities in the prior paragraph should be read together.

1. ,,Limiting access to DOJ Information and Covered Information Systems to authorized users and to transactions and functions that authorized users are permitted to exercise.

2.,,Providing security awareness training at least annually to all

Contractor employees and contractors involved with the Covered Contract.

Such training shall include, but not be limited to, recognizing and reporting potential indicators of insider threats to users and managers of DOJ Information and Covered Information Systems.

3. ,,Creating, protecting, and retaining, in accordance with applicable requirements but in any event at least until the expiration of the contract, Covered Information System audit records, reports, and supporting documentation to enable reviewing, monitoring, analysis, investigation, reconstruction, and reporting of unlawful, unauthorized, or inappropriate activity related to such Covered Information Systems and/or DOJ Information.

4. ,,Maintaining authorizations to operate any Covered Information

System.

5. ,,Performing continuous monitoring on all Covered Information

Systems, to include but not be limited to, collecting, reviewing, and analyzing appropriate logs and timely investigating security alerts and potential security incidents.

6. ,,Establishing and maintaining baseline configurations and current inventories of Covered Information Systems, including hardware, software, firmware, and documentation, throughout the Information System

Development Lifecycle, and establishing and enforcing security configuration settings for IT products employed in Covered Information

Systems.

7. ,,Ensuring appropriate contingency planning has been performed, including DOJ Information and Covered Information System backups.

8. ,,Identifying Covered Information System users, processes acting on

Page 30 of 50ORDER NUMBER:

behalf of users, or devices, and authenticating and verifying the identities of such users, processes, or devices, using multifactor authentication or…