Combined Synopsis Solicitation for Ford Library Aud. Upgrade 1-21-2025.docx

88310325Q00038 Upgrade A/V System at G.R. Ford Library Page 2 of 2

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is 88310325Q00038 and is issued as a Request for Quotation (RFQ). The solicitation documents and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2025-03 effective January 17, 2025. This is an unrestricted requirement under NAICS Code 334310, Audio Video Equipment Manufacturing. CONTRACT LINE ITEM NUMBER(S): See Attachment 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to Upgrade the Audio Visual Equipment in the Auditorium of the Gerald R. Ford Presidential Library in Ann Arbor, Michigan. PERIOD OF PERFORMANCE: The period of performance will be for six months. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions which will be removed prior to award: FAR 52.212-1. Instructions to Offerors - Commercial Products and Commercial Services (Sep 2023). Addenda: Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR Subpart 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Products and Commercial Services. Selection of the Contractor to perform this contract will be based on NARA’s assessment of the best overall value to the Government. Accordingly, the best value for this procurement will be obtained through a lowest price technically acceptable evaluation. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions.” The Contractor must also include complete rationale, justification, and the cost impact of each exception noted. The Government reserves the right to make an award on the initial quotation without discussions of this procurement. For evaluation purposes, the Total Firm Fixed Price for each CLIN will be determined by multiplying the QTY (Quantity) by the Firm Fixed Unit Price. The evaluated Total Contract Ceiling Price will be determined by summing the Total Firm Fixed Price of each CLIN. The resultant contract will include FAR 52.217-8, Option to Extend Services. Contractors must provide pricing (USD) for each CLIN in accordance with Attachment 1, Schedule of Prices. Failure to submit any of the required information and documentation with the quotation may result in rejection of the quotation. Multiple awards will not be made under this RFQ. Contractors must be registered and active in the System for Award Management. FAR 52.212-3, Offeror Representations and Certifications - Commercial Products and Commercial Services (May 2024) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (v) of this provision. FAR 52.212-4, Contract Terms and Conditions - Commercial Products and Commercial Services (Nov 2023) – see Attachment 4, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Products and Commercial Services (Jan 2025) - see Attachment 6, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. Full text provisions and clauses can be found at https://www.acquisition.gov.

To aid you in your planning and quotation development, the following information is provided as attachments to this Request for Quotation:

Attachment 1: Schedule of Prices Attachment 2: Performance Work Statement (PWS) Attachment 3: NARA Terms and Conditions Attachment 4: Additional NARA Terms and Conditions Attachment 5: Site Visit Attachment 6: Far Clauses Contractors must provide the following documents and information with their quotation:

Attachment 1, Schedule of Prices QUESTIONS: Questions regarding this RFQ must be submitted in writing via email to the Contract Specialist, Sheila Drumheller, at sheila.drumheller@nara.gov no later than 12:00 p.m. eastern time on February 10, 2025 to be considered. Questions submitted in any other manner will not be answered. The Government will answer questions or requests for clarification via a written RFQ amendment.

QUOTATION DUE DATE: Quotations must be submitted to Sheila Drumheller, at sheila.drumheller@nara.gov The deadline for quotations is 12:00 p.m. eastern time on February 20, 2025 Failure to submit quotations by the deadline may result in rejection of the quotation as untimely. Please include Solicitation Number: 88310325Q00038 in the email subject line and allow one extra business day for delivery and receipt, as the email will need to pass through IT security.

An in person site visit (Attachment 5) has been scheduled for February 5, 2025 at 1:00 PM EST. Contractors planning to attend the in person site visit must furnish the name and title of its representative to Sheila Drumheller (Sheila.drumheller@nara.gov) at least one (1) day prior to the site visit. Contractors are limited to a maximum of two (2) representatives.

Contractors are reminded that questions will not be answered during the in person site visit. However, you can forward all written questions to Sheila Drumheller via email sheila.drumheller@nara.gov and an amendment will be issued to address each question.

SHEILA DRUMHELLER

Contracting Officer

ATTACHMENT 1

SCHEDULE OF PRICES

1. SUPPLIES AND/OR SERVICES TO BE FURNISHED

The purpose of this contract is to acquire services to upgrade to our audio visual (A/V) system in the Gerald R. Ford Presidential Library Auditorium that includes adding a PTZ camera, upgrading of the video distribution system, installing and syncing microphones that are OFE (Owner-Furnished Equipment), and unified communication support.

All work must be performed under the terms and conditions of the contract as Firm Unit Price for service. ALL work in the Performance Work Statement (PWS), is considered Fixed Unit Price for service priced work. The Contractor is required to furnish all the work that can be identified in advance, both in sufficient detail and quantities, and for which a fair and reasonable price can be obtained. The firm-fixed prices must include the fully burdened cost for delivering the services required by this contract.

(A) The Contractor must identify the base period "Unit Price" and "Total Price" for the fixed-priced supplies/services described in Paragraph 3, Schedule of Prices.

(B) The “Total Base Period Firm-fixed Contract Price” must be the base period firm-fixed-price of CLINs 0001 through 0003.

(b) Total Base Period Contract Price. The Total Base Period Contract Price is the sum of “Total Base Period Firm-fixed Contract Price”.

3. SCHEDULE OF PRICES

In accordance with this contract, the Contractor must provide all management, supervision, labor, materials, supplies, transportation, and equipment described herein [except as specified to be furnished by the Government in the PWS (RFQ Attachment 2), and must plan, schedule, coordinate, and assure effective performance at the NARA National Archives at the Gerald R. Ford Presidential Library in Ann Arbor, Michigan.

NOTE: Contractors must provide a schedule in the price quotation that clearly details the breakdown of the proposed monthly prices by labor category, labor hours, labor rates, materials, equipment, supplies, etc. Finally, any other direct costs must also be detailed for each proposed expense for the base period. Contractors must submit an electronic copy via email. Please provide a Microsoft Excel spreadsheet. NARA utilizes the data during the review of quoted prices for such things as math checks, the use of correct escalation, and other evaluation procedures. The Contractor must include the formulas and factors used in calculation of the data.

For evaluation purposes, the Price will be determined by multiplying the Quantity by the Unit Price. The Total Price for the base period will be determined by adding the individual CLIN prices for base period. The Contract Price will be determined by summing the base period Total Prices.

CLIN = Contract Line Item Number PWS = Performance Work Statement NTE = Not-to-Exceed

Base Period – March 1, 2025 through September 30, 2025

EA

EA

- Source selects

- Destination selects

- Volume UP/DOWN

- Microphone MUTE

- Microphone level controls

- Camera controls

- DVD controls

- Cable box controls in accordance with the Performance Work Statement (PWS).

ATTACHMENT 2

PERFORMANCE WORK STATEMENT

Upgrade to A/V System in the Gerald R. Ford Presidential Library Auditorium

· Install a new video distribution system to support the OFE projector and display, with scaling endpoints at display locations.

· An HDMI wall plate at the podium to be provided for local presentations only.

· An HDMI and USB connection in the control booth to be provided for local presentation and UC connections.

· One (1) gang wall plate in the control booth for the DM cable to the lobby display with a 100’ CAT6A STP cable to be provided for connection as needed.

· A new ceiling mounted camera in the control booth to be used for UC conferencing by an OFE device in the control booth, control of the PTZ camera to be through the touch panels.

· A USB hub, USB capture and AVB>USB devices to be mounted either on or under the desk/furniture in the control booth as close as possible to where the client operator will be using the OFE laptop for running meetings.

· An OFE cable box and DVD/Blu-Ray player to be sourced to the system.

2.2.3 Audio:

· Install an OFE Shure MXW system that will replace the OFE outdated microphones. A new DSP and expander to also be included, adding the extra inputs needed and AEC (Acoustic Echo Canceling) for audio management.

OFE equipment being installed:

· Shure MXWAPT4

· Shure MXWAPT8

· Shure MXWANI4

· Shure MXWANI8

· Shure MXWNCS4

· Shure MXWNCS8

· Shure MXW8 (x6)

· Shure MXW1 (x4)

· Shure MXW2/BETA 58 (x4)

· Account for 12 channels of microphones total.

· Four (4) OFE analog microphones to be removed and the OFE DSP (NEXIA).

· A new Forte AVB CI to be installed, the MXW outs 1 – 8 then 1 – 4 will populate the 12 inputs on the DSP.

· The 2 access point transceivers to be wall mounted in the room at least 20’ apart from each other and as close to where the microphones will primarily be used. Field judgment should be used.

· A new assisted listening technology system to replace the original OFE system. An OFE LAN connection is required for the Wi-fi listening feature, users should be able to use one of the supplied (x4) audio packs or download a free app and listen using OFE smart phone.

· The new audio system's programming and microphone setup to be designed to match the existing use/case as closely as possible. A small Netgear network switch should be installed in the OFE rack for connectivity between devices.

2.2.4 Video/Audio Combined:

· A new processor to be installed as the OFE processor (AV2) is not compatible.

· With the new DSP programming. 2 new 10” table-top touch panels (1 in the control booth and 1 at the podium) to be provided and mimic each other. Touch panel to include:

· Power ON/OFF

· Source selects

· Destination selects

· Volume UP/DOWN

· Microphone MUTE

· Microphone level controls

· Camera controls

· DVD controls

· Cable box controls

2.2.5 EQUIPMENT RACK AND FURNITURE:

· The OFE rack will be re-used/configured for the new system.

2.2.6 INSTALLATION SUPPLIES:

· All cable and installation supply necessary to complete the project. Must provide an itemized list in EXCEL format.

2.2.7 INSTALLATION LABOR:

· All engineering, installation, programming and project management labor necessary to complete the project. Must provide an itemized list in EXCEL format. Need to show the hourly wage of each position and how many total hours for each position for the total project.

· Any training of Library staff needed. Show how many hours of training are needed.

· Any shipping expenses.

· Any expense to remove old equipment from the premises and the conclusion of the work.

A. The Gerald R. Ford Library has functional speakers, projector, and screen. None of these items need to be replaced.

2.3 SPECIAL CONSIDERATIONS:

A. The targeted completion date is April 25, 2025.

B. Onsite work will be planned, coordinated, and scheduled through the library designated employee via a contract kick-off meeting, a preconstruction (PRECON) meeting, and various phasing meetings as applicable.

· EVID Ceiling Speaker System

· 6' metal equipment rack on casters

· Christie APS Series Projector

· Projection screen

· LG DVD/Blu Ray Player

THE FOLLOWING MICROPHONES:

Shure MXWAPT4 Shure MXWAPT8 Shure MXWAPT8 Shure MXWANI4 Shure MXWANI8 Shure MXWNCS4 Shure MXWNCS8 Shure MXW8 (x6) Shure MXW1 (x4) Shure MXW2/BETA 58 (x4)

ATTACHMENT 3

NARA TERMS AND CONDITIONS

1. CONTRACTOR RESPONSIBILITY

The Contractor is responsible for the day-to-day inspection and monitoring of the Contractor work performed to ensure compliance with purchase order requirements. The results of all Contractor quality control inspections conducted must be documented on inspection checklists and be made available to the Government during the term of the purchase order.

2. GOVERNMENT PURCHASE ORDER ADMINISTRATION

(a) This purchase order will be administered by:

National Archives and Records Administration Office of the Chief Acquisitions Officer, Code Z Room 3340 8601 Adelphi Road College Park, MD 20740-6001

(b) Purchase order Administration:

Sheila Drumheller, Contract Specialist (CS) Telephone: (301) 837-1859

The Contracting Officer (CO) has the overall responsibility for the administration of this purchase order. Written communication to the Contract Specialist (CS) must make reference to the purchase order number and must be mailed, postage prepaid, to the above address.

(c) Contracting Officer (CO)

Any Z Warranted Contracting Officer (CO)

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the purchase order terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from purchase order payments for non-performance or unsatisfactory performance; terminate the purchase order for convenience or default; and issue final decisions regarding purchase order questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

3. CONTRACTING OFFICER’S REPRESENTATIVE (COR) LEVEL 2:

a. COR: See award document

b. The individual named above is designated as the Contracting Officer’s Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The COR is responsible for monitoring, giving progress reports to the Contract Specialist (CS), and overall technical surveillance of services to be performed under this purchase order and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the purchase order between the Contractor and any person other than the CO be effective or binding upon the Government.

c. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the purchase order, the Contractor must promptly notify the CO in writing.

d. No action will be taken by the Contractor under such technical instruction unless the CO has issued a purchase order change.

e. The responsibilities of the COR include, but are not limited to, the following:

(1) Serve as the point-of-contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO;

(2) Be responsible for the inspection and acceptance of the services performed and determining the adequacy of performance by the Contractor in accordance with the terms and conditions of this purchase order;

(3) Confer with representatives of the Contractor regarding any non-performance or unsatisfactory performance; following through to assure that all non-performance or unsatisfactory performance is performed/corrected, or payment adjustment is recommended to the CS and the CO;

(4) Review and certify invoices in accordance with invoicing instructions of the purchase order. Maintain a file with copies of these documents;

(5) Review and evaluate Contractor’s cost estimates, furnish comments, and recommendations to the CS and the CO;

(6) Advise the CS of any performance problems and make recommendations for corrective action to correct performance issues;

(7) Furnish the CS with any requests for change, deviation, or waiver (whether generated by Government personnel or Contractor personnel), including all supporting paperwork in connection with such change, deviation, or waiver; and

(8) Submit a written evaluation to the CS and the CO within 60 days of purchase order completion or annually on the anniversary for purchase orders that include options. The evaluation must include:

(i) The quality and timeliness of the Contractor’s performance; and

(ii) A statement as to the uses made of any deliverables furnished by the Contractor.

f. In addition to the specific duties as listed above, the COR is also responsible for knowing the employment status of the Contractor’s employees working at the Gerald Ford Presidential library and Museum . When the COR is notified that the Contractor’s employee is leaving the purchase order or the work site has changed, the COR must notify the NARA Security Office of the new status. The COR shall also ensure that the Contractor’s employee returns the NARA issued identification when they no longer need access to the buildings. The COR’s signature is required on the Contractor’s Identification Card Authorization in order for the Contractor’s employee to be issued a NARA identification badge and a proximity card. An identification badge a proximity card will not be issued without a signed Authorization that includes an expiration date. Please refer to NARA Notice 2007-275 for more information on Contractor’s employees’ identification badge issuance.

4. INVOICE SUBMISSION REQUIREMENTS

ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – INVOICE PROCESSING PLATFORM (IPP) (JANUARY 2020)

(a) Payment request must be submitted electronically through the U.S. Department of the Treasury’s Invoice Processing Platform System (IPP).

(b) “Payment request” means any request for purchase order/purchase order financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract/purchase order, or the clause 52.212-4, Contract Terms and Conditions – Commercial Items include commercial item contracts. The IPP website address is https://www.ipp.gov.

(c) Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice. Invoices shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

(d) Contractor invoice to include:

1. Award Number

2. CLIN/Item Number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection, if applicable

7. Serial Number/Part Number, if applicable

(e) The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

5. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the purchase order, other than claims in stated amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s claim to amounts payable under the purchase order has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. § 203, 41 U.S.C. § 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the purchase order is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

6. FAR 52.217-8, OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the purchase order. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days before the contract expires.

7. FAR 52.217-9, OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within thirty (30) days of the expiration of the term; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 66 months (Five Years and 6 Months).

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if --

(1) The stop-work order results in an increase in the time required for, or in the Contractor’s cost properly allocable to, the performance of any part of this contract; and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

(c) If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

(d) If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

9. STOP WORK CANCELLATION (APRIL 2014)

The Contractor is required to report to work and resume full contract performance within six (6) hours of receiving notifications of the stop work cancellation unless otherwise instructed by the CO and/or COR.

10. FAR 52.252-2, CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): www.acquisition.gov/far.

The following clause is hereby incorporated by reference:

(a) FAR clause 52.232-18, Availability of Funds (APR 1984)

(b) FAR clause 52.203-17, Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (Apr 2014)

(c) FAR clause 52.223-99, Ensuring Adequate COVID-19 Safety Protocols for Federal Contractors in Multiple Award or Federal Supply Schedule Contracts for Products and Services.

(d) The Whistleblower Protection Enhancement Act Of 2012.

ATTACHMENT 4

ADDITIONAL NARA TERMS AND CONDITIONS

I. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above. \

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other information specifically requested by the NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised. All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

II. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of…