D Attachment 4 FAR 52.212-5 and Other Terms and Conditions.pdf

FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAR 2023)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or

Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or

Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

X (4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV

2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (MAR

2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (AUG 1996) ( 31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws

108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the

Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN

2020), with Alternate I (NOV 2021) ( 41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) ( 41 U.S.C. 3509)).

https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.209-10#FAR_52_209_10 https://www.acquisition.gov/far/52.232-40#FAR_52_232_40 https://www.govinfo.gov/link/uscode/31/3903 https://www.govinfo.gov/link/uscode/10/3801 https://www.acquisition.gov/far/52.233-3#FAR_52_233_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.233-4#FAR_52_233_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-6#FAR_52_203_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/4655 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and

Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract

Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-

117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment. (NOV

2021) ( 31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility

Matters (OCT 2018) ( 41 U.S.C. 2313).

__ (10) [Reserved].

__ (11) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (OCT 2022)

( 15 U.S.C. 657a).

X__ (12) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business

Concerns (OCT 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer)

( 15 U.S.C. 657a).

__ (13) [Reserved]

__ (14) (i) 52.219-6, Notice of Total Small Business Set-Aside (NOV

2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (15)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV

2020) ( 15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-7.

https://www.acquisition.gov/far/52.203-15#FAR_52_203_15 https://www.acquisition.gov/far/52.204-10#FAR_52_204_10 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.204-14#FAR_52_204_14 https://www.acquisition.gov/far/52.204-15#FAR_52_204_15 https://www.acquisition.gov/far/52.209-6#FAR_52_209_6 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section6101&num=0&edition=prelim https://www.acquisition.gov/far/52.209-9#FAR_52_209_9 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section2313&num=0&edition=prelim https://www.acquisition.gov/far/52.219-3#FAR_52_219_3 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637a&num=0&edition=prelim https://www.acquisition.gov/far/52.219-4#FAR_52_219_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-6#FAR_52_219_6 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7 https://www.acquisition.gov/far/52.219-7#FAR_52_219_7

__ (16) 52.219-8, Utilization of Small Business Concerns (OCT 2022)

( 15 U.S.C. 637(d)(2) and (3)).

__ (17) (i) 52.219-9, Small Business Subcontracting Plan (OCT 2022)

( 15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (NOV 2016) of 52.219-9.

__ (iii) Alternate II (NOV 2016) of 52.219-9.

__ (iv) Alternate III (JUN 2020) of 52.219-9.

__ (v) Alternate IV (SEP 2021) of 52.219-9.

__ (18) (i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) ( 15 U.S.C. 644(r)).

__ (ii) Alternate I (MAR 2020) of 52.219-13.

__ (19) 52.219-14, Limitations on Subcontracting (OCT 2022) ( 15 U.S.C. 637s).

__ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (SEP

2021) ( 15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside

(OCT 2022) ( 15 U.S.C. 657f).

X__ (22) (i) 52.219-28, Post Award Small Business Program Rerepresentation (MAR

2023)( 15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (MAR 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically

Disadvantaged Women-Owned Small Business Concerns (OCT 2022) ( 15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned

Small Business Concerns Eligible Under the Women-Owned Small Business Program (OCT

2022) ( 15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR

2020) ( 15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (SEP 2021) ( 15U.S.C. 637(a)(17)).

X__ (27) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-9#FAR_52_219_9 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-13#FAR_52_219_13 https://www.acquisition.gov/far/52.219-14#FAR_52_219_14 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-16#FAR_52_219_16 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-27#FAR_52_219_27 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-28#FAR_52_219_28 https://www.acquisition.gov/far/52.219-29#FAR_52_219_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-30#FAR_52_219_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.219-32#FAR_52_219_32 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec644.htm https://www.acquisition.gov/far/52.219-33#FAR_52_219_33 https://www.govinfo.gov/content/pkg/USCODE-2018-title15/html/USCODE-2018-title15-chap14A-sec637.htm https://www.acquisition.gov/far/52.222-3#FAR_52_222_3

X__ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (DEC

2022) (E.O.13126).

X__ (29) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

X__ (30) (i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

__ (ii) Alternate I (FEB 1999) of 52.222-26.

__ (31) (i) 52.222-35, Equal Opportunity for Veterans (JUN 2020) ( 38 U.S.C. 4212).

__ (ii) Alternate I (JUL 2014) of 52.222-35.

X__ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN

2020) ( 29 U.S.C. 793).

__ (ii) Alternate I (JUL 2014) of 52.222-36.

__ (33) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

__ (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010) (E.O. 13496).

X__ (35) (i) 52.222-50, Combating Trafficking in Persons (NOV

2021) ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (MAR 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

__ (36) 52.222-54, Employment Eligibility Verification (MAY 2022) (Executive Order

12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in

FAR 22.1803.)

__ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–

Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (MAY 2008) of 52.223-9 ( 42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential

Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (JUN 2016) (E.O. 13693).

https://www.acquisition.gov/far/52.222-19#FAR_52_222_19 https://www.acquisition.gov/far/52.222-21#FAR_52_222_21 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-35#FAR_52_222_35 https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section793&num=0&edition=prelim https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 https://www.acquisition.gov/far/52.222-37#FAR_52_222_37 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title38-section4212&num=0&edition=prelim https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-54#FAR_52_222_54 https://www.acquisition.gov/far/22.1803#FAR_22_1803 https://www.acquisition.gov/far/52.223-9#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.223-9#FAR_52_223_9 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.223-11#FAR_52_223_11 https://www.acquisition.gov/far/52.223-12#FAR_52_223_12

__ (40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (JUN

2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (OCT 2015) of 52.223-13.

__ (41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (JUN 2014) (E.O.s

13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (MAY

2020) ( 42 U.S.C. 8259b).

__ (43) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer

Products (OCT 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (JUN 2014) of 52.223-16.

X__ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While

Driving (JUN 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (JUN 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

__ (47) (i) 52.224-3 Privacy Training (JAN 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (JAN 2017) of 52.224-3.

__ (48) (i) 52.225-1, Buy American-Supplies (OCT 2022) ( 41 U.S.C. chapter 83).

__ (ii) Alternate I (OCT 2022) of 52.225-1.

X__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (DEC

2022) ( 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19

U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-

302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

X__ (ii) Alternate I [Reserved].

X__ (iii) Alternate II (DEC 2022) of 52.225-3.

X__ (iv) Alternate III (JAN 2021) of 52.225-3.

X__ (v) Alternate IV (Oct 2022) of 52.225-3.

https://www.acquisition.gov/far/52.223-13#FAR_52_223_13 https://www.acquisition.gov/far/52.223-13#FAR_52_223_13 https://www.acquisition.gov/far/52.223-14#FAR_52_223_14 https://www.acquisition.gov/far/52.223-14#FAR_52_223_14 https://www.acquisition.gov/far/52.223-15#FAR_52_223_15 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.223-16#FAR_52_223_16 https://www.acquisition.gov/far/52.223-16#FAR_52_223_16 https://www.acquisition.gov/far/52.223-18#FAR_52_223_18 https://www.acquisition.gov/far/52.223-20#FAR_52_223_20 https://www.acquisition.gov/far/52.223-21#FAR_52_223_21 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.225-1#FAR_52_225_1 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.225-1#FAR_52_225_1 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.govinfo.gov/link/uscode/19/3301 https://www.govinfo.gov/link/uscode/19/2112 https://www.govinfo.gov/link/uscode/19/3805 https://www.govinfo.gov/link/uscode/19/4001 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3 https://www.acquisition.gov/far/52.225-3#FAR_52_225_3

X__ (50) 52.225-5, Trade Agreements (DEC 2022) ( 19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

X__ (51) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the

Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United

States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for

Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007)

( 42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area

(Nov2007) ( 42 U.S.C. 5150).

__ (55) 52.229-12, Tax on Certain Foreign Procurements (FEB 2021).

__ (56) 52.232-29, Terms for Financing of Purchases of Commercial Products and

Commercial Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

__ (57) 52.232-30, Installment Payments for Commercial Products and Commercial

Services (NOV 2021) ( 41 U.S.C. 4505, 10 U.S.C. 3805).

X__ (58) 52.232-33, Payment by Electronic Funds Transfer-System for Award

Management (OCT2018) ( 31 U.S.C. 3332).

__ (59) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award

Management (Jul 2013) ( 31 U.S.C. 3332).

__ (60) 52.232-36, Payment by Third Party (MAY 2014) ( 31 U.S.C. 3332).

__ (61) 52.239-1, Privacy or Security Safeguards (AUG 1996) ( 5 U.S.C. 552a).

__ (62) 52.242-5, Payments to Small Business Subcontractors (JAN

2017) ( 15 U.S.C. 637(d)(13)).

__ (63) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial

Vessels (NOV 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631).

__ (ii) Alternate I (APR 2003) of 52.247-64.

__ (iii) Alternate II (NOV 2021) of 52.247-64.

https://www.acquisition.gov/far/52.225-5#FAR_52_225_5 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section2501&num=0&edition=prelim http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title19-section3301&num=0&edition=prelim https://www.acquisition.gov/far/52.225-13#FAR_52_225_13 https://www.acquisition.gov/far/52.225-26#FAR_52_225_26 https://www.acquisition.gov/far/52.226-4#FAR_52_226_4 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.226-5#FAR_52_226_5 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.229-12#FAR_52_229_12 https://www.acquisition.gov/far/52.232-29#FAR_52_232_29 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/3805 https://www.acquisition.gov/far/52.232-30#FAR_52_232_30 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.govinfo.gov/link/uscode/10/3805 https://www.acquisition.gov/far/52.232-33#FAR_52_232_33 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3332&num=0&edition=prelim https://www.acquisition.gov/far/52.232-34#FAR_52_232_34 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.232-36#FAR_52_232_36 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.239-1#FAR_52_239_1 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim https://www.acquisition.gov/far/52.242-5#FAR_52_242_5 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.247-64#FAR_52_247_64 https://www.govinfo.gov/content/pkg/USCODE-2019-title46/html/USCODE-2019-title46-subtitleV-partD-chap553-subchapI-sec55305.htm http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.247-64#FAR_52_247_64

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[Contracting Officer check as appropriate.]

__ (1) 52.222-41, Service Contract Labor Standards (AUG 2018) ( 41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (MAY

2014) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price

Adjustment (Multiple Year and Option Contracts) (AUG

2018) ( 29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price

Adjustment (May 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May

2014) ( 41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014) ( 41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order

14026 (JAN 2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O.

13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020)

( 42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the

Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final https://www.acquisition.gov/far/52.222-41#FAR_52_222_41 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-42#FAR_52_222_42 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-43#FAR_52_222_43 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-44#FAR_52_222_44 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-51#FAR_52_222_51 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-53#FAR_52_222_53 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-55#FAR_52_222_55 https://www.acquisition.gov/far/52.222-62#FAR_52_222_62 https://www.acquisition.gov/far/52.226-6#FAR_52_226_6 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/2.101#FAR_2_101 https://www.acquisition.gov/far/52.215-2#FAR_52_215_2 payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor

Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the

Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (NOV

2021) ( 41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services

Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021) (Section 1634 of Pub. L. 115-91).

(iv) 52.204-25, Prohibition on Contracting for Certain Telecommunications and

Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115-

232).

(v) 52.219-8, Utilization of Small Business Concerns (OCT 2022)

( 15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities.

If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(vi) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

(vii) 52.222-26, Equal Opportunity (SEP 2015) (E.O.11246).

(viii) 52.222-35, Equal Opportunity for Veterans (JUN 2020) ( 38 U.S.C. 4212).

https://www.acquisition.gov/far/subpart-4.7#FAR_Subpart_4_7 https://www.acquisition.gov/far/52.203-13#FAR_52_203_13 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.203-19#FAR_52_203_19 https://www.acquisition.gov/far/52.204-23#FAR_52_204_23 https://www.acquisition.gov/far/52.204-25#FAR_52_204_25 https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section637&num=0&edition=prelim https://www.acquisition.gov/far/19.702#FAR_19_702 https://www.acquisition.gov/far/52.219-8#FAR_52_219_8 https://www.acquisition.gov/far/52.222-21#FAR_52_222_21 https://www.acquisition.gov/far/52.222-26#FAR_52_222_26 https://www.acquisition.gov/far/52.222-35#FAR_52_222_35

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN

2020) ( 29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (JUN 2020) ( 38 U.S.C. 4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (AUG

2018) ( 41 U.S.C. chapter 67).

(xiii) (A) 52.222-50, Combating Trafficking in Persons (NOV

2021) ( 22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (MAR 2015) of 52.222-50 ( 22 U.S.C. chapter 78 and E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor

Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-

Requirements (May 2014) ( 41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014) ( 41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (MAY 2022) (E.O. 12989).

(xvii) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order

14026 (JAN 2022).

(xviii) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O.

13706).

(xix) (A) 52.224-3, Privacy Training (Jan 2017) ( 5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the

United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. Subtitle A, Part V, Subpart G Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN

2020) ( 42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

https://www.acquisition.gov/far/52.222-36#FAR_52_222_36 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-37#FAR_52_222_37 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-40#FAR_52_222_40 https://www.acquisition.gov/far/52.222-41#FAR_52_222_41 http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-chapter67-front&num=0&edition=prelim https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-50#FAR_52_222_50 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-51#FAR_52_222_51 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-53#FAR_52_222_53 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.222-54#FAR_52_222_54 https://www.acquisition.gov/far/52.222-55#FAR_52_222_55 https://www.acquisition.gov/far/52.222-62#FAR_52_222_62 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3 https://www.acquisition.gov/far/52.224-3#FAR_52_224_3 https://www.acquisition.gov/far/52.225-26#FAR_52_225_26 https://www.acquisition.gov/far/52.226-6#FAR_52_226_6 https://www.acquisition.gov/far/52.226-6#FAR_52_226_6

(xxii) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors

(Mar 2023) ( 31 U.S.C. 3903 and 10 U.S.C. 3801). Flow down required in accordance with paragraph (c) of 52.232-40.

(xxiii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial

Vessels (NOV 2021) ( 46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause) https://www.acquisition.gov/far/52.232-40#FAR_52_232_40 https://www.govinfo.gov/link/uscode/31/3903 https://www.govinfo.gov/link/uscode/10/3801 https://www.acquisition.gov/far/52.232-40#FAR_52_232_40 https://www.acquisition.gov/far/52.247-64#FAR_52_247_64 https://www.govinfo.gov/content/pkg/USCODE-2019-title46/html/USCODE-2019-title46-subtitleV-partD-chap553-subchapI-sec55305.htm

E. CONTRACT INITIATION AND EXPIRATION

1. General Security Requirements- The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology or and in accordance with the HHS Contract Closeout Guide (2012).

HHS EA requirements may be located here: https://www.hhs.gov/ocio/ea/documents/proplans.html

2. System Documentation- Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800- 64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3. Sanitization of Government Files and Information- As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Notification- The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within fifteen days before an employee stops working under this contract.

5. Contractor Responsibilities Upon Physical Completion of the Contract- The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

6. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this contract within 2 days of the employee's exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

F. Contractor Non-Disclosure Agreement (NDA)- Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf , as applicable.

A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

G. Vulnerability Scanning Reports The Contractor shall report the results of the required monthly special vulnerability scans no later than 10 days following the end of each reporting period. If required monthly, this report may be included as part of the Technical Progress Report. Otherwise, this report shall be submitted under a separate cover on monthly basis.

H. Government Access for Security Assessment. In addition to the Inspection Clause in the contract, the Contractor (and/or any subcontractor) shall afford the Government access to the Contractor's facilities, installations, operations, documentation, information systems, and personnel used in performance of this contract to the extent required to carry out a program of security assessment (to include vulnerability testing), investigation, and audit to safeguard against threats and hazards to the confidentiality, integrity, and availability of federal data or to the protection of information systems operated on behalf of HHS, including but are not limited to:

https://www.hhs.gov/ocio/ea/documents/proplans.html https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

a. At any tier handling or accessing information, consent to and allow the Government, or an independent third party working at the Government's direction, without notice at any time during a weekday during regular business hours contractor local time, to access contractor and subcontractor installations, facilities, infrastructure, data centers, equipment (including but not limited to all servers, computing devices, and portable media), operations, documentation (whether in electronic, paper, or other forms), databases, and personnel which are used in performance of the contract.

The Government includes but is not limited to the U.S. Department of Justice, U.S. Government Accountability Office, and the HHS Office of the Inspector General (OIG). The purpose of the access is to facilitate performance inspections and reviews, security and compliance audits, and law enforcement investigations. For security audits, the audit may include but not be limited to such items as buffer overflows, open ports, unnecessary services, lack of user input filtering, cross site scripting vulnerabilities, SQL injection vulnerabilities, and any other known vulnerabilities.

b. At any tier handling or accessing protected information, fully cooperate with all audits, inspections, investigations, forensic analysis, or other reviews or requirements needed to carry out requirements presented in applicable law or policy. Beyond providing access, full cooperation also includes, but is not limited to, disclosure to investigators of information sufficient to identify the nature and extent of any criminal or fraudulent activity and the individuals responsible for that activity. It includes timely and complete production of requested data, metadata, information, and records relevant to any inspection, audit, investigation, or review, and making employees of the contractor available for interview by inspectors, auditors, and investigators upon request. Full cooperation also includes allowing the Government to make reproductions or copies of information and equipment, including, if necessary, collecting a machine or system image capture.

c. Segregate Government protected information and metadata on the handling of Government protected information from other information. Commingling of information is prohibited. Inspectors, auditors, and investigators will not be precluded from having access to the sought information if sought information is commingled with other information.

d. Cooperate with inspections, audits, investigations, and reviews.

Privacy Clauses

ARTICLE H.36. PRIVACY ACT, HHSAR 352.224-70 (December 2015)

This contract requires the Contractor to perform one or more of the following: (a) Design; (b) develop; or (c) operate a Federal agency system of records to accomplish an agency function in accordance with the Privacy Act of 1974 (Act) (5 U.S.C. 552a(m)(1)) and applicable agency regulations.

The term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. Violations of the Act by the Contractor and/or its employees may result in the imposition of criminal penalties (5 U.S.C. 552a(i)).

The Contractor shall ensure that each of its employees knows the prescribed rules of conduct in CFR 45 part 5b and that each employee is aware that he/she is subject to criminal penalties for violation of the Act to the same extent as Department of Health and Human Services employees. These provisions also apply to all subcontracts the Contractor awards under this contract which require the design, development or operation of the designated system(s) of records [5 U.S.C. 552a(m)(1)]. The contract work statement:

(a) identifies the system(s) of records and the design, development, or operation work the Contractor is to perform; and

(b) specifies the disposition to be made of such records upon completion of contract performance.

ARTICLE H.51. HHS SECURITY AND PRIVACY LANGUAGE FOR INFORMATION AND IT PROCUREMENTS

ARTICLE H.51.1. INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

A. Baseline Security Requirements

1. Applicability- The requirements herein apply whether the entire contract or order (hereafter "contract"), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor)will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality , which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity , which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability , which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less , bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov .

d. Comply with the Privacy Act requirements.

3. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ X ] Low [ ] Moderate [ ] High Integrity: [ X ] Low [ ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Risk Level: [ X ] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ X ] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ X ] Low [ ] Moderate [ ] High

4. Controlled Unclassified Information (CUI)- CUI is defined as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg.

63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

mailto:fisma@hhs.gov

a. Marked appropriately;

b. Disclosed to authorized personnel on a Need-To-Know basis;

c. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the "Commitment to Protect Non-Public Information - Contractor Employee Agreement" located at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf . A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer/COR prior to performing any work under this acquisition.

7. Internet Protocol Version 6 (IPv6)- All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8. Government Websites- All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9. Contract Documentation- The Contractor shall use provided templates, policies, forms and other agency documents provided by the Contracting Officer and the Contracting Officer's Representative to comply with contract deliverables as appropriate.

10. Standard for Encryption- The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements.