CyberArk Integration SOW Solicitation.doc

STATEMENT OF WORK (SOW) FOR CYBERARK INTEGRATION

1 Overview

1.1 Introduction

The U.S. Consumer Product Safety Commission (CPSC) is charged with protecting the public from unreasonable risks of serious injury or death from thousands of types of consumer products under the Commission’s jurisdiction. The CPSC is committed to protecting consumers and families from products that pose a fire, electrical, chemical, or mechanical hazard or can injure children. The CPSC's work to ensure the safety of consumer products - such as toys, cribs, power tools, cigarette lighters, and household chemicals - contributed significantly to the 30 percent decline in the rate of deaths and injuries associated with consumer products over the past 30 years.

The Agency has jurisdiction over 15,000 types of consumer products, from automatic-drip coffee makers to toys to lawnmowers. Some types of products, however, are covered by other federal agencies. For example, cars, trucks, and motorcycles are covered by the Department of Transportation; foods, drugs, and cosmetics are covered by the Food and Drug Administration; and alcohol, tobacco, and firearms are within the jurisdiction of the Department of the Treasury.

CPSC works to reduce the risk of injuries and deaths from consumer products by:

1. Developing voluntary standards with industry;

2. Issuing and enforcing mandatory standards; banning consumer products if no feasible standard would adequately protect the public;

3. Obtaining the recall of products via refund or arranging for their repair or replacement;

4. Researching potential product hazards; and

5. Informing and educating consumers through the media, international, federal, state, and local governments, private organizations, and by responding to consumer inquiries.

1.2 Background and Objective

For Federal Cyber investments, the CDM program fulfills Federal Information Security Management Act (FISMA) mandates. CPSC procured Cyber-Ark's Privileged Account Security (PAS) solutions to mitigate risks of lateral movement and the misuse of privileged accounts through the CDM program. CPSC has utilized Cyber Ark’s Security Professional and Consulting Services to assist with installing, implementing, and deploying the Privileged Account Security (PAS) solution. CPSC has implemented controls to protect Domain administrator accounts.

CPSC is engaged to improve processes and controls surrounding privileged access. As part of this initiative, CPSC is looking to implement the remaining privileged accounts through the use of CyberArk’s Privileged Account Security solutions to mitigate the risks of lateral movement and the misuse of privilege.

CPSC is looking for contracted subject matter expert that will implement the remaining accounts, along with the CyberArk Application Access Manager (AAM). CPSC does not currently have the license for the AAM. The current CyberArk solution is version 10.10.1 and includes both a production and development environment consisting of the: Enterprise Password Vault (EPV), Disaster Recovery Enterprise Password Vault (EPV), Central Policy Manager (CPM), Password Vault Web Access (PVWA), Privileged Session Manager (PSM), and the Privileged Session Manager Proxy. The on boarded accounts use a shared CyberArk shared account model as outlined in the CyberArk solution design document.

The following table represents the current licensing and Agency privileged management requirements.

Table 1 Agency PRIVMGMT Requirements

Number of target devices to be managed, by category:

Servers

Application Consoles

Table 2 Current CyberArk infrastructure

1 disaster recovery

2 disaster recovery

2 disaster recovery, load balanced between both sites.

leveraging existing Agency Splunk hardware

1.3 Scope

CPSC requires a Consultant to on-board and integrate the remaining accounts into CyberArk and to implement the AAM solution, with the required licensing to protect hard-coded credentials, third-party software, and controls for the remainder of account types identified by risk ranking as follows:

· Active Directory Domain Accounts- Any account that is domain-based and has one-to-many access (multiple targets) is susceptible to hash theft, especially if not protected by the CPM and PSM. Accounts that cannot be managed by CPM should have privileges reduced to the minimum required to perform the purpose.

· Local Administrator Accounts- The CPM and PSM must protect a local account that is a member of the local administrator group, including built-in administrators such as “Administrator” given the high level of privilege they possess. Any accounts that cannot be managed by CPM should have privileges reduced to the minimum required to perform the purpose.

· Database Accounts- The CPM and PSM must protect any account that has high privileges in a relational database management system (RDBMS). Least privilege concepts applied to these accounts enable separation between human and non-human usage. Examples include users that have roles equivalent to a DBA such as "sysdba," "sa."

· File Access Accounts- The CPM must protect any account that has the privilege to read or write to a file share with sensitive data. The Application Access Management solution must be used to automate hard-coded static credentials used in scripts and jobs that require file access.

· Application Automation Accounts- Any account that completes inter-system authentications without human intervention must be managed by the Application Access Management to eliminate hard-coded static credentials. Least privilege concepts applied to these accounts enable separation of accounts by application, by service, and host. AAM allows just in time password retrieval and password rotation that will not impact operational systems, eliminating the opportunity for static credential theft.

· Application User Accounts- The CPM and PSM must protect any account that has elevated privileges in a critical application. Least privilege concepts applied to these accounts enable separation of roles into appropriate access for the individual users. PSM enables recording of sessions that ultimately control public-facing websites and applications.

For any accounts that are unable to be managed by CyberArk for technical reasons, the contractor must seek privilege reduction following the least privilege model.

2 Description of Work The contractor must work with qualified and experienced CPSC technical staff, and the contractor must be on-site and granted privileged access for direct access to the government systems. Additionally, the contractor must advise and consult the authorized CPSC technical staff responsible for managing CyberArk.

The contractor must engage with CPSC to conduct a pre-engagement call to verify the scope of work as defined, engagement logistics, and pre-requisites for the engagement. A summary of the engagement will be provided via email. Any open issue for the contractor derived from the engagement will be tracked by the contractor for resolution.

2.1 Environmental Review

The contractor must conduct an environmental review of the CyberArk infrastructure, network, user locations, IT asset locations, and the CyberArk Solutions Design Document. The review must include on premise, hybrid, and cloud infrastructure, and recommendations of using

CyberArk privileged access management solution to secure future cloud platforms.

· Conduct a health check of the CyberArk infrastructure. The health check will be completed by the contractor to ensure that the CyberArk infrastructure is optimized for efficiency and security.

· Work closely with the CPSC Technical Lead and CPSC Project Manager to coordinate CyberArk resources and provide the first-level escalation for the project and technical issues.

· Conduct an enterprise integrations review that includes use case for custom developed applications, directory and authentication methods, monitoring strategies, and other relevant technologies and security tools.

· The contractor must review the system requirements and pre-requisites for deployment readiness, including change management and change approval process.

2.2 Implementation Plan

The contractor must provide an implementation plan with a timeline for a phased approach to achieve the appropriate level of protection for the CyberArk solution implementations based on the risk ranking in 1.3, and the environmental review in 2.3.

The implementation plan must also contain:

· Timeframe for completion of all tasks within Description of Work.

· Defined and prioritized the appropriate level of required protection of identified accounts.

· Roles and responsibilities

· Potential issues and risks

· Deliverables outlined in the Project Management Plan and Implementation Plan.

2.3 Training

The contractor must provide training to the end-user in the following areas:

· User interface and design

· Accessing required accounts using CyberArk.

2.4 CyberArk Upgrade

Upgrade the current CyberArk version 10.10.1 to the most recent CyberArk version. The CyberArk upgrade will be completed after the June 30th, 2020 deliverable date for integration, but no later than September 1, 2020.

2.5 CyberArk Integration

The contractor must configure additional service accounts that are required for use in different resources, such as Windows services or Windows scheduled tasks. The service account plug-ins include Windows IIS application pools, Windows IIS directory security (anonymous access), COM+ applications, configuration files, accounts stored in databases, and private SSH keys.

The contractor must control and manage the storage domain admin account, an account that is used for scheduled tasks and services that support back up functions. Additional instances of the account may require management, and the priority of the accounts management will be based on the results of the environmental review.

The contractor must implement and configure the CyberArk Application Access Manager (AAM) to integrate accounts.

The contractor must control and secure infrastructure accounts identified in the environmental review to include:

· Vault local, domain, and directory admins on:

· Windows Servers

· *NIX servers

· Network devices

· SQL servers

· SYS and SYSTEM on Oracle

· SYBASE servers

2.6 Target Applications and Devices

The contractor must protect credentials for third-party applications and eliminate/manage hardcoded credentials for commercial off-the-shelf (COTS) applications discovered during the environmental review, and defend DevOps secrets in the cloud and on-premise.

The below applications and devices require management and control through CyberArk. The prioritization of the below accounts will be mutually agreed upon by the Contractor and Consumer Product Safety Commission based on its security risk following 1.3, and its level of effort. The accounts will be addressed in the implementation plan.

Target

RSA Authentication Manager 8.4

RSA Netwitness Platform 11.3.1.1

Gigimon GigVue-OS 5.7.01

Splunk

Lansweeper

MID Server ServiceNow

Tenable

Solarwinds Event Manager

Checkpoint Appliances 15000/5000/4000 GAIA R80.20

Cisco Nexus 7000 Series NX-OS 6.2

Cisco Nexus 5672UP NX-OS 7.3

Cisco Catalyst 3800 Series IOS 16.3.8

Citrix Netscaler

Netapp OnCommand 9.1

Aruba ClearPass

Aruba Controller 8.x

Aruba Mobility Master

3PAR 72xx

HPE iLO v3 v4 v5

HPE Onboard Administrator

HPE Virtual Connect

HPE Fiber Channel Switch DN6600B

HPE MSA 2040

HPE OneView

Barracuda Email Security Gateway 400/600

Defender

F5 BIG-IP i5600

XenServer

XenMobile

Vmware ESX

Vmware vRealize Operations Manager

Sybase ASE 15.7

Oracle

MySQL

Solarwinds Orion

Veritas Netbackup Appliances

AZURE AD

MS O365

MicroFocus iMonitor

MicroFocus Remote Manager

MicroFocus User Rights Map

NetIQ Access Manager

Webmin Linux Management Console

Cylance

Wordpress

Facebook

Twitter

Custom-developed API's that currently use a combination of enterprise Single Sign On (SSO) and hard-coded credentials.

Sharepoint; on-prem and cloud

JBoss

Jenkins

Icinga/IcingaWeb/Icinga API

Docker

KIE Server

Active MQ

Keycloak

ElasticSearch

Logstash

Kibana

Sonar Tool

Docker Swarm

SQL Server Databases

Appian

Powerbuilder

Lyris

3 Project Plan The contractor must deliver a comprehensive Project Management Plan after the environmental review that follows the deliverable plan within ten days of the environmental review. The sections of this plan must include but not be limited to:

a. Work Breakdown Structure

b. Project Schedule that reflects, at a minimum, these deliverables

i. Functional and Non-Functional Requirements Development

ii. Development Strategy

iii. Data Migration Plan

iv. Test Plan

v. Project Risk Management Log

vi. Technical Issue Management Log

vii. Technical Documentation and User Guide for the delivered product

viii. Training Plan

ix. All other deliverables listed below within Section 3.2

x. Artifact Delivery Schedule

3.1 Reporting and Delivery Requirements

The contractor must submit all required report(s)/deliverables, to the COR via electronic mail, following the schedule outlined below. All reports must reference and cite the contract/order number.

The Government will apply the following general inspection standards to the reporting and delivery requirements:

· Meeting designated schedule dates.

· Submission of all deliverables as specified.

· Ability to control and deliver quality artifacts and products.

The Government will inspect the work for both quality and timeliness, and notify the contractor regarding problems and any corrections needed within five business days after receipt of deliverables. The contractor shall be notified in writing of the problems with the work, and the contractor must provide an acceptable correction, correction plan, or recommendation within five business days after notification.

The following deliverable items must be performed and delivered per the following schedule:

Due Date and Format

(NLT-No Later Than, measured in calendar days)

CPSC will utilize the Project Kick-Off Checklist to drive the meeting and deliverable outcome NLT 3 business days after contract award

The format must be MS Project, and the Project Schedule (WBS) checklist will be applied to the schedule by the government as a means of assessing and accepting the quality of the project schedule.

NLT 10 business days after environmental review.

4 Contract Management Characteristics 4.1 Contract Type This procurement is a firm-fixed-price, non-personal services contract.

4.2 Period of Performance Date of Award to 01 September 2020 CPSC is requesting service to begin as soon as possible after the contract is executed with an initial kick-off meeting no later than three business days after contract execution to coordinate with other IT projects and establish date and time for the engagement meeting. The completion of the account integration is expected by 30 June 2020.

4.3 Place of Performance Work must be performed at two CPSC locations or the Contractor facilities upon approval of the COR. The two CPSC locations are:

1. CPSC Headquarters located at 4330 East-West Highway, Bethesda, Maryland 20814,

2. CPSC National Product Testing and Evaluation Center located at 5 Research Place in Rockville, MD 20850.

Project work hours shall be:

· Normal project business days/hours: Monday through Friday 7:00 AM – 3:30 PM EST.

· After 5:00 PM EST Monday through Friday as agreed.

· Over the weekend (Saturday or Sunday), as agreed.

4.4 Authorities of Government Personnel Notwithstanding the Contractor’s responsibility for total management during the performance of this order, the administration of the order will require coordination between the Government and the Contractor. The following individuals will be the Government’s points of contact during the performance of the order.

4.6 Contractor Personnel Qualifications

1. The Contractor personnel performing the work must have a minimum of five (5) years of experience in CyberArk Privileged Access Management software.

2. The Contractor must allocate resources that have been trained in CyberArk's products and services applicable to the Statement of Work.

3. All Contractor partners (subcontractors) must possess the same, or higher, contractor qualifications.

4.7 Security Clearance The contractor must work with qualified and experienced CPSC technical staff and will have direct access to the government systems. All contractor personnel must successfully complete CPSC background check and obtain a CPSC issued ID prior to either starting to work within the CPSC offices or accessing CPSC systems. Contractor staff must display the CPSC issued ID badge whenever they are within the CPSC premises.

4.8 Conflict of Interest The Contractor must not employ any person who is an employee of the U.S. Government if employing that person would create a conflict of interest. Additionally, the Contractor must not employ any person who is an employee of the CPSC, unless such a person seeks and receives approval according to CPSC regulations.

4.9 Non-Disclosure Agreement 1.

The Contractor agrees that it and its employees will not disclose any data obtained or developed under this contract to third parties without the consent of the U. S. Consumer Product Safety Commission Contracting Officer Representative (COR).

2.

The Contractor must obtain an agreement of non-disclosure from each employee who will work on this contract or have access to data obtained or developed under this contract.

4.10 Government Furnished Property The Government will provide the following items(s) of Government property to the Contractor for use in the performance of this contract. The Contractor must be responsible and accountable for all government property, either furnished or acquired, and ensure that this property is within their possession and control until formal return to CPSC, upon completion of the contract performance period. The following item(s) of Government property will be available to the Contractor:

The Government will supply:

· Network diagram showing all devices relating to the Products.

· The contractor must provide the appropriate product license for the CyberArk

AAM and the related support agreements.

4.11 Travel The contractor must assume responsibility for all costs of travel related to this project. The CPSC will not reimburse the contractor for any project related travel cost incurred during the period of performance of this contract.

Appendix C: Glossary Term/Acronym

Definition/Description

CLAUSES:

LC1A CONTRACTOR’S NOTE

Deliveries and/or shipments shall not be left at the Loading Dock. All deliveries shall be considered “inside deliveries” to the appropriate room at the Consumer Product Safety Commission (CPSC) and in accordance with the instructions below. When scheduling deliveries the purchase order number shall always be referenced and all packages shall clearly display the Purchase Order Number on the outside of the cartons and/or packages, to include the packing slip.

ATTENTION GOVERNMENT VENDOR

A. DELIVERY INSTRUCTIONS:

1. DELIVERY INSTRUCTIONS FOR LARGE OR HEAVY ITEMS:

If the shipment or item being delivered requires use of a loading dock, advance notification is required. The contractor shall contact the Shipping and Receiving Coordinator at 301-892-0586 or Constantia Demas (301) 504-7544 forty-eight (48) hours in advance of the date the items are to arrive to schedule use of the loading dock.

LOADING DOCK HOURS OF OPERATION:

9:00 am to 11:00 am or 1:30 pm to 4:00 pm

Monday through Friday (except holidays)

Please notify contact person if there is a change in the delivery date. For changes, delays, or assistance please contact CPSC as follows:

Facilities Management Support Services (301) 504-7091 and

The COR – TBD Upon arrival, the driver should contact the CPSC Guard, 301-504-7721, at the loading dock to obtain assistance in using freight elevators and to gain access to CPSC security areas.

2. DELIVERY INSTRUCTION FOR SMALL ITEMS

When delivering or shipping small items, the contractor and/or carrier service shall report to the 4th floor lobby, North Tower, 4330 East West Highway, to sign in with the CPSC guard. Upon completion of signing in, the contractor shall deliver all shipments to the Mail Room, Room 410. After delivery, delivery personnel shall promptly depart the building.

MAIL ROOM HOURS OF OPERATION:

Monday through Friday (except holidays) – 7:30 am to 5:00 pm

B. BILLING INSTRUCTIONS

Pursuant to the Prompt Payment Act (P.L. 97-177) and the Prompt Payment Act Amendments of 1988 (P.L. 100-496) all Federal agencies are required to pay their bills on time, pay interest penalties when payments are made late, and to take discounts only when payments are made within the discount period. To assure compliance with the Act, vouchers and/or invoices shall be submitted through the Invoice Processing Platform (IPP). At a minimum, each invoice document submitted through IPP shall include the documentation required in the contract.

ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS

Invoice Processing Platform (IPP) is a secure web-based electronic invoicing and payment information service available to all Federal agencies and their supplier by the U.S. Treasury's Bureau of Fiscal Service. IPP allows Federal agencies and their suppliers to exchange electronic purchase orders, blanket POs, invoices, and payment information in one easy to access web portal. This service is free of charge to government agencies and their suppliers, including services and support.

(a) Definitions. As used in this clause-

(1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) The Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email ippgroup@stls.frb.org or phone (866)973-3131.

PAYMENT AND INVOICE QUESTIONS

For payment and invoice questions, contact the Accounts Payable Branch at (304) 480-8000 option 7 or via email at AccountsPayable@fiscal.treasury.gov.

Customer Service inquiries may be directed to Adriane Clark at AClark@cpsc.gov.

OVERPAYMENTS

Accounts Receivable Conversion of Check Payments to EFT: If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the government, it will be converted into an electronic funds transfer (EFT). This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within 24 hours and will be shown on the regular account statement.

The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check, but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

C. INSPECTION & ACCEPTANCE PERIOD

Unless otherwise stated in the Statement of Work or Description, the Commission will ordinarily inspect all materials/services within seven (7) business days after the date of receipt. The CPSC representative responsible for inspecting the materials/services will transmit disapproval, if appropriate, to the contractor and the contract specialist listed below. If other inspection information is provided in the Statement of Work or Description, it is controlling.

LC 30 Security and Personal Identity Verification Procedures

a. The performance of this contract requires contractor employees to have access to CPSC facilities and/or systems. In accordance with Homeland Security Presidential Directive-12 (HSPD-12), all such employees must comply with agency personal identity verification (PIV) procedures. Contractor employees who do not already possess a current PIV Card acceptable to the agency shall be required to provide personal background information, undergo a background investigation (NACI or other OPM-required or approved investigation), including an FBI National Criminal History Fingerprint Check prior to being permitted access to any such facility or system. CPSC may accept PIV issued by another Federal Government agency but shall not be required to do so. No contractor employee will be permitted access to a CPSC facility or system without approval under the PIV process.

b. Contracted employees must meet the following citizenship requirements:

1. A United States (U.S.) citizen; or,

2. A national of the United States (see 8. U.S.C. 1408); or,

3. An alien lawfully admitted into the United States for permanent residence as evidenced by an alien Registration Receipt Card form I-151

c. Within five (5) days after contract award, the Contractor shall provide a list of contracted personnel, including full name, social security number, and place (city and state) and date of birth to the designated Contracting Officer’s Representative (COR). This information will be used to determine whether personnel have had a recent Federal background investigation and whether or not further investigation is required.

d. For each contractor employee subject to the requirements of this clause and not in possession of a current PIV Card acceptable to CPSC, the Contractor shall submit the following properly-completed forms: Electronic Standard Form (SF) 85 or 85-P, "Questionnaire for Non-sensitive Positions," SF 87 Fingerprint Chart, Optional Form (OF) 306, and a current resume. The SF-85 is available from the Office of Personnel Management’s (OPM) secure website. The CPSC Office of Human Resources will provide the COR with the other forms that are not obtainable via the internet.

e. The Contractor shall complete the electronic security form and deliver the other completed forms indicated in paragraph d above to the COR within five (5) days of written notification from the COR of those contractor employees requiring background investigations.

f. Upon completion of the investigation, the COR will notify the Contractor in writing of all investigation determinations. If any contractor employees are determined to be unsuitable to be given access to CPSC, the Contractor shall immediately provide identical information regarding replacement employees. The Contractor is responsible for providing suitable candidates and fulfilling staffing requirements under the contract so that there is no break in service. This approval process applies to contract start up and any required replacement personnel. Failure to prequalify potential replacement personnel will not serve as an excuse for failure to provide performance. Non performance due to failure to provide suitable contractor employees may result in a Termination for Cause or Default.

g. CPSC will issue a PIV Card to each on-site contractor employee who is to be given access to CPSC facilities and systems. The employee will not be given access prior to issuance of a PIV Card. CPSC may revoke a PIV card at any time if an investigation or subsequent investigation reveals that the personnel are unsuitable.

h. PIV Cards shall identify individuals as contractor employees. Contractor employees shall display their PIV Cards on their persons at all times while working in a CPSC facility, and shall present cards for inspection upon request by CPSC officials or security personnel. The contractor shall be responsible for all PIV Cards issued to the contractor’s employees and shall immediately notify the COR if any PIV card(s) cannot be accounted for.

i. CPSC shall have and exercise full and complete control over granting, denying, withholding, and terminating access of contractor employees to CPSC facilities and systems. The COR will notify the Contractor immediately when CPSC has determined that an employee is unsuitable or unfit to be permitted access. The Contractor shall immediately notify such employee that he/she no longer has access, shall remove the employee and shall provide a suitable replacement in accordance with contract requirements and the requirements of this clause.

j. By execution of this contract, the Contractor certifies that none of the employees working under this contract have been convicted of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years. During contract performance the contractor shall immediately notify CPSC if one of its employees working under this contract has been convicted of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five years.

k. The Government reserves the right to have removed from service any Contractor employee for any of the following:

1. Conviction of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years.

2. Falsification of information entered on security screening forms or other documents submitted to the Government.

3. Improper conduct during performance of the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government regardless of whether the conduct is directly related to the contract.

4. Any behavior judged to be a threat to personnel or property.

l. The COR shall be responsible for proper separation of contracted employees at the Consumer Product Safety Commission. The COR shall ensure that each contractor employee completes CPSC’s official out processing procedures. The contracted employee shall report to the CPSC Facilities Security Specialist to obtain a Contractor Employee Accountability and Clearance Record. This record shall be completed as part of the official out-processing procedures and returned along with the PIV Card, key fobs, keys and any other previously issued material.

m. Contractor employees shall comply with applicable Federal and CPSC statutes, regulations, policies and procedures governing the security of the facilities and system(s) to which the contractor's employees have access.

n. Failure on the part of the Contractor to comply with the terms of this clause may result in termination of this contract for cause or default.

o. The contractor shall incorporate this clause in all subcontracts.

(End of Clause) LC 37 Security and Privacy

(a) Agency rules of conduct that the Contractor and the Contractor’s employees shall be required to follow:

In performing its duties related to management, operation, and/or access of systems containing sensitive PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct as specified by the following:

1. Contractor employees must comply with agency personal identity verification (PIV) requirements in order to logically access Government systems.

2. System access granted under this contract is only for work required to perform official duties specified in the contract. The performance of any unrelated and/or unauthorized activity is prohibited.

3. Access to Government information systems (where applicable) will only be for the period stated in the contract. Thereafter, all accounts, passwords, and access associated with the contract will be terminated.

4. Disclosure of any system account information or system passwords to any unauthorized third-party is prohibited.

5. Exhibiting or divulging the content of any record or report to any person except in the performance of official duties specified in the contract is prohibited.

6. Using any data accessed with a Government system account for unauthorized purposes is prohibited.

7. No official record, report, database, or copy thereof, may be removed from Government premises or Government systems without prior written permission.

8. Contractor employees are prohibited from modifying, altering, or otherwise changing any Government system component or configuration except in the performance of official duties specified in the contract. Contractor employees are prohibited from issuing any system command or running any software, scripts, or programs on Government systems without prior authorization.

9. Contractor employees must not disclose sensitive or personal privacy-related information to any unauthorized third-party.

10. Contractor must notify the Government Contracting Officer immediately upon the termination of any Contractor or subcontractor employee so that system accounts, remote access, or other forms of system access can be terminated.

11. The use of Contractor-owned laptops or other portable media storage devices to process, transmit, or store sensitive PII is prohibited under this contract [unless the Contractor is authorized to access Government systems through the agency’s virtual desktop infrastructure environment].

12. The Contractor must notify the Government Contracting Officer and the agency’s Information Systems Security Officer (ISSO) immediately upon the discovery—or suspected discovery—of any type of security incident, malicious activity, or data breach affecting or that might potentially affect the Government’s network or specific systems.

13. Contractor employees with access to Government systems must agree to agency Rules of Behavior and shall complete annual security awareness training.

(b) A list of the anticipated threats and hazards that the Contractor must guard against.

The Contractor must use reasonable measures to guard against the following threats and hazards:

1. Unauthorized disclosure or use of sensitive system information—including system architecture, system configuration, system accounts, and system passwords.

2. Unauthorized disclosure or use of the contents of any information obtained from Government systems—including system records, system reports, or databases.

3. Unauthorized modification or alteration of any Government system component or configuration

4. Unauthorized circumvention, avoidance, or deception of any Government security system, measure, or control.

5. Unauthorized installation and/or use of hardware, software, firmware, portable media storage, or mobile devices on Government systems.

6. Unauthorized use of Government systems—including hardware, software, system accounts, Internet access, and email accounts—for activity which is not required to perform official duties under this contract.

(c) A description of the safeguards that the Contractor must specifically provide.

1. The Contractor shall limit access to any information related to this contract to those employees and subcontractors who require the information in order to perform their official duties under this contract.

2. The Contractor, Contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

3. When PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the PII irretrievable.

4. The Contractor shall only use PII obtained under the contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the Contracting Officer.

5. At expiration or termination of this contract, the Contractor shall turn over to the Government, all PII obtained under the contract that is in its possession.

6. In the event of any actual or suspected breach of PII, the Contractor shall immediately report the breach to the Contracting Officer, the Contracting Officer’s Representative (COR), and the agency’s Information Systems Security Officer (ISSO).

7. In the event that a PII breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected persons for a period of at least 18 months from discovery of the breach. If the Government elects to provide and/or procure notification or identity protection services in response to a breach, the Contractor shall be responsible for reimbursing the Government for those expenses. The Contractor shall incorporate the substance of this clause, its terms and requirements in all subcontracts under this contract, and require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

(d) Requirements for a program of Government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards.

Work to be performed under this contract requires the design, development, operation, or disposal of a Federally-controlled information system containing sensitive personally identifiable information or handling sensitive personally identifiable information. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of personally identifiable information, the Contractor shall permit the Government access to, and information regarding, the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases, when requested by the Government, as part of its responsibility to ensure compliance with privacy and security requirements. The Contractor shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General for its reviews.

Definitions.

“Personally Identifiable Information” (PII) means information that can be used to distinguish or trace a person’s identity, such as his or her name, social security number, or biometric records, that alone, or when combined with other personal or identifying information which is linked or linkable to a specific person, such as date and place of birth, or mother’s maiden name.

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, whether physical or electronic.

(End of clause) 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items. (JAN 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2019) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_X_ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5)[Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (10)[Reserved].

__ (11)

(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C.657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)

(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (Jan 2011) of 52.219-4.

__ (13)[Reserved]

__ (14)

(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C.644).

__ (ii) Alternate I (Nov 2011).

__ (iii) Alternate II (Nov 2011).

__ (15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

__ (ii) Alternate I (Oct 1995) of 52.219-7.

__ (iii) Alternate II (Mar 2004) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17) (i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637(d)(4))

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Nov 2016) of 52.219-9.

__ (v) Alternate IV (Aug 2018) of 52.219-9

__ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

__ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C.637(a)(14)).

__ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Oct 2019) (15 U.S.C. 657f).

_X_ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C. 632(a)(2)).

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

_X_ (25) 52.222-3, Convict Labor (June 2003) (E.O.11755).

__ (26) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Jan 2020) (E.O.13126).

_X_ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (28) (i) 52.222-26, Equal Opportunity (Sept 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

_X_ (29) (i) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

__ (ii) Alternate I (July 2014) of 52.222-35.

_X_ (30) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C.793).

__ (ii) Alternate I (July 2014) of 52.222-36.

_X_ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

__ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (33) (i) 52.222-50, Combating Trafficking in Persons (Jan 2019) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (38)

(i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (39) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-14.

__ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

__ (41) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

_X_ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Aug 2011) (E.O. 13513).

__ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (44) 52.223-21, Foams (Jun 2016) (E.O. 13693).

__ (45) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

_X_ (46) 52.225-1, Buy American-Supplies (May 2014) (41 U.S.C. chapter 83).

__ (47) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (May 2014) of 52.225-3.

__ (iii) Alternate II (May 2014) of 52.225-3.

__ (iv) Alternate III (May 2014) of…