DOS TO 19AQMM26F1637 - Xacta_FE.pdf

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 1 of 20

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

NOTE: OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24 & 30 1. REQUISITION NUMBER

1006260010

5. SOLICITATION NUMBER

19AQMM26Q0451

2. CONTRACT NUMBER

GS35F162DA

3. AWARD/EFFECTIVE DATE

10/01/2026

4. ORDER NUMBER

19AQMM26F1637

6. SOLICITATION ISSUE

DATE

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME Annie L. Harlow

b. TELEPHONE NUMBER (No collect calls) 703-875-6059

c. EMAIL harlowal@state.gov

8. OFFER DUE DATE /

LOCAL TIME

CODE GAAM_

BUREAU OF GLOBAL ACQUISITIONS (GA)

1200 Wilson Blvd., SA-6B

ATTN: GA

ARLINGTON, VA 22209

9. ISSUED BY X UNRESTRICTED OR SET ASIDE: % FOR

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISALBED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED WOMEN-

OWNED SMALL BUSINESS (EDWOSB)

8(A)

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS): 541519

SIZE STANDARD:

10. THE ACQUISITION IS

SEE

SCHEDULE

11. DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS BLOCK IS

MARKED

0 Days: 0.00 %

0 Days: 0.00 % 0 Days: 0.00 % 0 Days: 0.00 %

12. DISCOUNT TERMS

13a. THIS CONTRACT IS

RATED ORDER UNDER

DEFENSE PRIORITIES AND

ALLOCATIONS SYSTEM -

DPAS (15 CFR 700)

13b. RATING

X REQUEST

FOR

QUOTE

(RFQ)

INVITATION

FOR BID

(IFB)

REQUEST

FOR

PROPOSAL

(RFP)

14. METHOD OF SOLICITATION

INRTICODE15. DELIVER TO

TECHNOLOGY AND INNOVATION OFFICE (INR/TIO)

2201 C STREET, NW

ATTN: INR/TIO

Washington, DC 20010

CODE GAAM16. ADMINISTERED BY

IT Cyber & Telecom

GA/AM/TSS/ITC/ITCT

Bureau of Global Acquisitions 1200 Wilson Blvd (SA-06B) Arlington, VA 22209

056280621 FACILITY

CODE

99100CODE

Contact: Rachel Fandel Telephone No. 7037243800 x3670 UEI:JLW7WAKPEKD4

17a. CONTRACTOR/

OFFEROR

TELOS CORPORATION

19886 ASHBURN RD

ASHBURN, VA 20147-2358

IPPCODE18a. PAYMENT WILL BE MADE BY

IPP

Invoices to be uploaded to Invoice Processing Platform at http://www.ipp.gov

CHARLESTON, SC 29415

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER SEE ADDENDUM

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS

CHECKED

19. ITEM NUMBER 20. SCHEDULE OF SUPPLIES/SERVICES 21. QUANTITY 22. UNIT 23. UNIT PRICE 24. AMOUNT

See Lines

25. ACCOUNTING AND APPROPRIATION DATA

1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026

$654,191.51

26. TOTAL AWARD AMOUNT (For Government Use Only) $654,191.51

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED.

ADDENDA

ARE ARE NOT ATTACHED

X 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 COPIES TO

ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH

OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE

TERMS AND CONDITIONS SPECIFIED.

29. AWARD OF CONTRACT: REFERENCE _____________________________

OFFER DATED _________________ . YOUR OFFER ON SOLICITATION (BLOCK

5) INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF THE CONTRACTING OFFICER (TYPE OR PRINT) Crystal Johnson

31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

CGFS // CGFS

Rachel Fandel, Contracts Manager 9/24/2026

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 2 of 20

19.

ITEM NUMBER

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

PARTIAL FINAL

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED

CORRECT FOR

COMPLETE PARTIAL FINAL

36. PAYMENT 37. CHECK NUMBER

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 11/2021) BACK

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 3 of 20

Section A - Solicitation/Contract Form

Line Item Summary

Contract Number:

GS35F162DA

Order Number:

19AQMM26F1637

Title: System Inventory and Risk Management - Telos Xacta

Total Funding:

$654,191.51

Date of Order:

10/01/2026

Unison Buy #1213273_01 is the basis of award. All terms and conditions of TELOS CORPORATION DBA TELOS [UEI:

JLW7WAKPEKD4], GSA Schedule GS-35F-162DA are incorporated into this D.O.

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

1.0 LT $74,900.00 $74,900.00

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Xacta 360 12 month subscription Material#: XIAM-360-SUB-12-4

Xacta 360 - 12 Month subscription license for Tier 4 (25 projects and 12,500 devices). Customer Hosted and Customer Managed.

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $74,900.00

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

25.0 LT $99.00 $2,475.00

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Xacta Learning Portal (XLP) - General User Material#: XT-XLP-GEN

1-Year access to the XLP for General Users. The XLP contains meaningful educational resources catered to the Xacta user/practitioner community for self-paced, on-demand learning.

XLP courses are continuously updated to include new and updated functionality as it is introduced into our Xacta applications, allowing our practitioner community to stay well informed and get the most out of their Xacta deployments as they upgrade to newer Xacta builds.

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $2,475.00

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

3.0 LT $199.00 $597.00

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Xacta Learning Platform (XLP) - Admin User Material# :XT-XLP-ADMIN

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 4 of 20

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

1-Year access to the XLP for Xacta Administrators and Solution Architects. The XLP contains meaningful educational resources catered to our Admin and Solution Architects professionals for self-paced, on-demand learning. XLP courses are continuously updated to include new and updated functionality as it is introduced into our Xacta applications, allowing our Admins and Solution Architects to stay well informed so they can better deploy, support, and customize their Xacta deployments.

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $597.00

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

33.0 LT $429.27 $14,165.91

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Xacta Training Credit Unit Material# :XTCU

Virtual Classroom Xacta training in support of Department of State

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $14,165.91

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

960.0 HR $173.40 $166,464.00

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Xacta Subject Matter Expert (Associate Technical Director) The Associate Technical Director possesses expert knowledge of enterprise service applications including Database Schema, Code Development, Data Migration and Custom Template (Business Process or Workflow) Development. The Associate Technical Director develops custom security authorization documentation and custom DB queries. Bachelor’s Degree and two years experience in Implementation, Enterprise Deployment, or Template Development is required.

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $166,464.00

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

PSC: DJ01

PSC Description: IT AND TELECOM - SECURITY AND

COMPLIANCE SUPPORT SERVICES (LABOR)

Type of Contract Pricing: FFP

1,880.0 HR $210.42 $395,589.60

Delivery Schedule:

Delivery Number Delivery Date Quantity FOB Point 1 09/30/2026 1.000000 Other

Period of Performance: 10/01/2026 - 09/30/2027

Description: Security Control Assessor FTE Technical Director Serves as the overall Technical Lead for a deployment of enterprise service application ensuring the optimization of the application to meet the customer’s changing processes, regulations, and requirements associated with the Security Authorization Process. PMP and CISSP desired. Bachelor’s degree and 10 years experience required. Master’s Degree may be substituted for 2 years experience.

Note: Scope of work to include Cyber Compliance Assessment Services-third party security control assessor.

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 5 of 20

Number Supplies or Services Qty Unit Unit Price Total (Inc. disc., tax, and fees)

Reference Line: 19AQMM26Q0451 - 001

CLIN Funding:

1. 1006260010 (1900 - 2026 - 19___X01200000 - INR - 1006 - 100608 - 060110 - 2650 - 2544 - 2026): $395,589.60

Unison Buy #1213273_01 is the basis of award. All terms and conditions of TELOS CORPORATION DBA TELOS [UEI:

JLW7WAKPEKD4], GSA Schedule GS-35F-162DA are incorporated into this D.O.

CLIN Funding: Cost:

Base Totals: $654,191.51 $654,191.51

Exercised Options Totals: $0.00 $0.00

Unexercised Options Totals: $0.00 $0.00

Base and Options Totals: $654,191.51 $654,191.51

Section A - Solicitation/Contract Form Identifier Title Date Number of

Pages 7 Attachment V - RFQ 19AQMM-26-Q-0451 Sol. DD-254.pdf 09/09/2026 8 Attachment I - TO 19AQMM26F1637 SOW Xacta Licensing, Services, and Assessment Support (TRACK

CHANGES).pdf 09/24/2026

9 Attachment I - TO 19AQMM26F1637 SOW Xacta Licensing, Services, and Assessment Support (CLEAN).pdf 09/24/2026 10 Attachment II - TO 19AQMM26F1637 Xacta Pricing Table 09_24_26.xlsx 09/24/2026 11 Attachment III - TO 19AQMM26F1637 C-SCRM_Questionnaire.xlsx 09/24/2026 12 Attachment IV - TO 19AQMM26F1637 Xacta DOS Attestation Form.pdf 09/24/2026

652.239-800 - Cybersecurity Supply Chain Risk Management Requirements (AUG 2026)

(a) Definitions. As used in this clause:

Covered article - The term "covered article" includes-

(1) "Information and Communications Technology" which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

(2) “Operational Technology” (OT) is defined as programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events.

Examples of OT include industrial control systems, building management systems, fire control systems, physical access control mechanisms, and internet of things devices.

(3) “Critical software” refers to any software, firmware, or cloud-based application—including its direct dependencies—that performs

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 6 of 20 functions vital to the organization’s security posture and operational integrity. This includes any tool that manages elevated privileges, possesses direct access to networking and computing resources, or controls access to data and operational technology. Furthermore, any software that performs essential trust functions or operates across security boundaries is classified as critical, as its compromise would grant an attacker significant control or visibility into the broader environment.

(4) "Telecommunications Equipment", which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

(5) "Telecommunications Service", which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

(6) Cybersecurity Supply Chain Risk: The term cybersecurity supply chain risk means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

(7) Incident: The term incident means per the Federal Information Security Modernization Act of 2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

(8) Vulnerability: The term vulnerability which means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

(b) Contractor Cybersecurity Supply Chain Risk Management Responsibilities.

The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

(c) Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 7 of 20 requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

(d) Novation Agreement Notice. FAR 42.1203 requires Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

(e) Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the Contractor must contact the CO or their designee within 72 hours of the incident.

(f) Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

(g) Attestation following Major Version Change. For critical software, as defined by NIST Guidance, provided under the contract that required an approved Secure Software Development Attestation Form, the responses on this form apply to the software’s major version changes (e.g., using a semantic versioning schema of Major.Minor.Patch, the software version number goes from 2.5 to 3.0) unless the Contractor otherwise notifies the Contacting Officer that the form is no longer valid. This notification to the Contracting Officer must be submitted within 15 days of the major version change and must include a new completed and signed Secure Software Development Attestation Form.

(End of clause)

INV-IPP - ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS AND INSTRUCTIONS TO IMPLEMENT

USAGE OF THE INVOICE PROCESSING PLATFORM (IPP).

(a) Definitions. As used in these instructions

(1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of these instructions, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP) at www.ipp.gov. Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with the IPP application can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866)973-3131. The Contractor shall ensure that its supporting documentation conforms to IPP requirements. IPP accommodates up to 25 supporting attachments per invoice, individual attachment file size may not exceed ten megabytes (10mb). If the Contractor assesses that their supporting documentation will not reasonably conform to IPP requirements, the Contractor shall contact the Contracting Officer to explore possible alternatives. In addition, the IPP only allows certain characters to be used as the invoice number. The invoice number shall conform to the IPP convention and the attachments (if used) shall match exactly the invoice number allowed. The allowed characters in the IPP are “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_”

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 8 of 20

(c) If the Contractor wishes to be paid via a foreign bank account, the contractor must properly fill out form GFS-FO-CLM-089 and attach it to each invoice in the IPP where payment to a foreign bank account is requested. The form can obtained by e-mailing CGFSIPPITSForm@state.gov.

(d) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing.

(e) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

[End of instructions]

H-031 - SECURITY REQUIREMENTS (DEVIATION)

H-031 - SECURITY REQUIREMENTS (DEVIATION)

H-031 - SECURITY REQUIREMENTS

(a) A facility security clearance at the TOP SECRET level is required for contract performance in accordance with the DD Form 254, Department of Defense Contract Security Classification Specification, attached to this contract.

(b) Since it will be necessary for some Contractor Personnel to have access to classified material and/or enter into areas requiring security clearances, each Contractor employee requiring such access must have a TOP SECRET personnel security clearance issued by the Defense Counterintelligence and Security Agency (DCSA) prior to contract performance.

(c) The Contractor shall obtain a Department of State building pass for all employees performing under this contract who require frequent and continuing access to Department of State facilities in accordance with Bureau of Diplomatic Security Instructions.

(d) Performance of this contract shall be in accordance with the attached DD Form 254, Department of Defense Contract Security Classification Specification and FAR 52.240-92

"SECURITY REQUIREMENTS."

(e) Classified material received or generated in the performance of this contract shall be safeguarded and disposed of in accordance with the National Industrial Security Program Operating Manual (NISPOM) (32 CFR Part 117)

H-050 - COMPLIANCE WITH FEDERAL ANTI-DISCRIMINATION LAWS - CERTIFICATION (EO 14173, January 2025)

(a) Definition. As used in this provision - Program promoting diversity, equity, and inclusion means a program whose purpose is to promote preferences based on race, color, religion, sex, or national origins, such as in training or hiring.

(b) Certification. By submission of its offer, the Offeror certifies that it does not operate any programs promoting diversity, equity, and inclusion that violate any applicable Federal anti-discrimination laws.

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 9 of 20

(End of provision)

H-051 - COMPLIANCE WITH FEDERAL ANTI-DISCRIMINATION LAWS (EO 14173, January 2025)

(a) The contractor shall comply with all applicable Federal anti-discrimination laws.

(b) Compliance with applicable Federal anti-discrimination laws is material to eligibility for and payment under this contract for purposes of 31 U.S.C 3729(b)(4).

(End of clause)

52.203-17 - Contractor Employee Whistleblower Rights (Nov 2023)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 41 U.S.C. 4712 and Federal Acquisition Regulation (FAR) 3.900 through 3.905.

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in FAR 3.900 through 3.905.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts.

(End of clause)

52.204-13 - System for Award Management-Maintenance (DEVIATION JAN 2026)

(a) Definitions. As used in this clause— Commercial and Government Entity code means—

(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location (referred to as “CAGE code”); or

(2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency to entities located outside the United States and its outlying areas that the DLA CAGE Branch records and maintains in the CAGE master file (referred to as “NCAGE code”).

Unique Entity Identifier (UEI) means an identifier used to identify a specific commercial, nonprofit, or Government entity.

(b) Active registration.

(1) The Contractor shall maintain an active Federal Government contracts registration in the System for Award Management (SAM) at https://www.sam.gov during contract performance and through final payment under this contract. To maintain an active registration in SAM, the Contractor shall review at least annually its registration in SAM and validate that the information is current, accurate, and complete.

(2) The Contractor is responsible for the currency, accuracy, and completeness of the information provided within SAM, and for any liability resulting from the Government’s reliance on inaccurate or incomplete information.

Updating SAM does not alter the terms and conditions of this contract and is not a substitute for a properly executed contractual document.

(c) Novation and change-of-name agreements.

(1) If the Contractor has legally changed its business name or “doing business as” name (whichever is shown on the contract), or has transferred the assets used to perform the contract, but has not completed the necessary requirements regarding novation and change-of-name agreements in part 42 of the Federal Acquisition Regulation (FAR), the Contractor shall provide the responsible Contracting Officer a minimum of one business day’s written notification of its intention to —

(i) Change the legal business name in SAM;

(ii) Comply with the requirements of FAR part 42; and

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 10 of 20

(iii) Agree in writing to the timeline and procedures specified by the responsible Contracting Officer.

The Contractor shall provide with its written notification sufficient documentation to support the legally changed name.

(2) If the Contractor fails to comply with the requirements of paragraph (c)(1) of this clause, or fails to perform the agreement at paragraph (c)(1)(iii) of this clause, and, in the absence of a properly executed novation or change-of-name agreement, the SAM information that shows the Contractor to be other than the Contractor indicated in the contract will be considered to be incorrect information within the meaning of the “Suspension of Payment” paragraph of the electronic funds transfer (EFT) clause of this contract.

(d) Assignees.

(1) The Contractor shall not change the legal business name or address for EFT payments or manual payments, as appropriate, in the SAM record to reflect an assignee for the purpose of assignment of claims (see FAR part 32).

Assignees shall be separately registered in SAM.

(2) Information provided to the Contractor’s SAM record that indicates payments, including those made by EFT, to an ultimate recipient other than that Contractor will be incorrect information within the meaning of the “Suspension of Payment” paragraph of the EFT clause of this contract.

(e) Unique entity identifier (UEI). The Contractor shall ensure that its UEI is maintained throughout the life of the contract.

(f) Commercial and Government Entity (CAGE) code. The Contractor shall ensure that the CAGE code is maintained throughout the life of the contract. To update a CAGE code, the Contractor shall initiate the change by updating its SAM registration.

(g) Communicating changes. The Contractor shall communicate any change to its UEI or CAGE code to the Contracting Officer within 30 days after the change, so a modification can be issued to update the UEI or CAGE code on this contract. A change in the UEI does not necessarily require a novation.

(End of clause)

52.222-90 - Addressing DEI Discrimination by Federal Contractors (DEVIATION APR 2026)

(a) Definitions. As used in this clause—

Program participation means membership or participation in, or access or admission to: training, mentoring, or leadership development programs; educational opportunities; clubs; associations; or similar opportunities that are sponsored or established by the contractor or subcontractor.

Racially discriminatory diversity, equity, and inclusion (DEI) activities means disparate treatment based on race or ethnicity in the recruitment, employment (e.g., hiring, promotions), contracting (e.g., vendor agreements), program participation, or allocation or deployment of an entity's resources.

(b) In connection with the performance of work under this contract, the Contractor agrees as follows:

(1) The Contractor will not engage in any racially discriminatory DEI activities;

(2) The Contractor will furnish all information and reports, including providing access to books, records, and accounts, as required by the Contracting Officer, for purposes of ascertaining compliance with this clause;

(3) In the event of the Contractor's or a subcontractor's noncompliance with this clause, this contract may be canceled, terminated, or suspended in whole or in part, and the Contractor or subcontractor may be declared ineligible for further Government contracts;

(4) The Contractor will report any subcontractor's known or reasonably knowable conduct that may violate this clause to the Contracting Officer and take any appropriate remedial actions directed by the Contracting Officer;

and

(5) The Contractor will inform the Contracting Officer if a subcontractor sues the Contractor and the suit puts at issue, in any way, the validity of this clause.

(6) The Contractor recognizes that compliance with the requirements of this clause are material to the Government's payment decisions for purposes of 31 U.S.C. 3729(b)(4).

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 11 of 20

(c) The Contractor must include the substance of this clause, including this paragraph (c), in subcontracts at any tier, including those for commercial products and commercial services, except those where the place of delivery or performance is outside the United States.

(End of clause)

52.226-7 - Drug-Free Workplace (May 2024)

(a) Definitions. As used in this clause--

"Controlled substance" means a controlled substance in schedules I through V of section 202 of the Controlled Substances Act (21 U.S.C. 812) and as further defined in regulation at 21 CFR 1308.11 - 1308.15.

"Conviction" means a finding of guilt (including a plea of nolo contendere) or imposition of sentence, or both, by any judicial body charged with the responsibility to determine violations of the Federal or State criminal drug statutes.

"Criminal drug statute" means a Federal or non-Federal criminal statute involving the manufacture, distribution, dispensing, possession, or use of any controlled substance.

"Drug-free workplace" means the site(s) for the performance of work done by the Contractor in connection with a specific contract where employees of the Contractor are prohibited from engaging in the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance.

"Employee" means an employee of a Contractor directly engaged in the performance of work under a Government contract. "Directly engaged" is defined to include all direct cost employees and any other Contractor employee who has other than a minimal impact or involvement in contract performance.

"Individual" means an offeror/contractor that has no more than one employee including the offeror/contractor.

(b) The Contractor, if other than an individual, shall--within 30 days after award (unless a longer period is agreed to in writing for contracts of 30 days or more performance duration), or as soon as possible for contracts of less than 30 days performance duration--

(1) Publish a statement notifying its employees that the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance is prohibited in the Contractor's workplace and specifying the actions that will be taken against employees for violations of such prohibition;

(2) Establish an ongoing drug-free awareness program to inform such employees about--

(i) The dangers of drug abuse in the workplace;

(ii) The Contractor's policy of maintaining a drug-free workplace;

(iii) Any available drug counseling, rehabilitation, and employee assistance programs; and

(iv) The penalties that may be imposed upon employees for drug abuse violations occurring in the workplace;

(3) Provide all employees engaged in performance of the contract with a copy of the statement required by paragraph (b)(1) of this clause;

(4) Notify such employees in writing in the statement required by paragraph (b)(1) of this clause that, as a condition of continued employment on this contract, the employee will--

(i) Abide by the terms of the statement; and

(ii) Notify the employer in writing of the employee's conviction under a criminal drug statute for a violation occurring in the workplace no later than 5 days after such conviction;

(5) Notify the Contracting Officer in writing within 10 days after receiving notice under subdivision (b)(4)(ii) of this clause, from an employee or otherwise receiving actual notice of such conviction. The notice shall include the position title of the employee;

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 12 of 20

(6) Within 30 days after receiving notice under subdivision (b)(4)(ii) of this clause of a conviction, take one of the following actions with respect to any employee who is convicted of a drug abuse violation occurring in the workplace:

(i) Taking appropriate personnel action against such employee, up to and including termination; or

(ii) Require such employee to satisfactorily participate in a drug abuse assistance or rehabilitation program approved for such purposes by a Federal, State, or local health, law enforcement, or other appropriate agency; and

(7) Make a good faith effort to maintain a drug-free workplace through implementation of paragraphs (b)(1) through (b)(6) of this clause.

(c) The Contractor, if an individual, agrees by award of the contract or acceptance of a purchase order, not to engage in the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance while performing this contract.

(d) In addition to other remedies available to the Government, the Contractor's failure to comply with the requirements of paragraph

(b) or (c) of this clause may, pursuant to FAR 26.505, render the Contractor subject to suspension of contract payments, termination of the contract or default, and suspension or debarment.

(End of clause)

52.232-39 - Unenforceability of Unauthorized Obligations (Jun 2013)

(a) Except as stated in paragraph (b) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation (31 U.S.C. 1341), the following shall govern:

(1) Any such clause is unenforceable against the Government.

(2) Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an "I agree" click box or other comparable mechanism (e.g., "click-wrap" or "browse-wrap" agreements), execution does not bind the Government or any Government authorized end user to such clause.

(3) Any such clause is deemed to be stricken from the EULA, TOS, or similar legal instrument or agreement.

(b) Paragraph (a) of this clause does not apply to indemnification by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures.

(End of clause)

52.240-91 - Security Prohibitions and Exclusions (DEVIATION JAN 2026)

(a) Definitions. As used in this clause— American Security Drone Act-covered foreign entity means an entity included on a list that the Federal Acquisition Security Council (FASC) develops and maintains and publishes in the System for Award Management (SAM) at https:// www.sam.gov (section 1822 of Pub. L. 118-31, 41 U.S.C. 3901 note prec.).

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Covered article, as defined in 41 U.S.C. 4713(k), means:

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

Covered foreign country means The People’s Republic of China.

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 13 of 20

Covered telecommunications equipment or services means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

FASC-prohibited unmanned aircraft system means an unmanned aircraft system manufactured or assembled by an American Security Drone Act—covered foreign entity.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring removing covered articles from executive agency information systems or excluding one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201-1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders that apply to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders that apply to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders that apply to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Information technology, as defined in 40 U.S.C. 11101(6)—

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use—

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 14 of 20

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy;

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connecting a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Kaspersky Lab-covered article means any hardware, software, or service that—

(1) Is developed or provided by a Kaspersky Lab-covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky Lab-covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky Lab-covered entity.

Kaspersky Lab-covered entity means—

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2) Is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

Sensitive compartmented information means classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence.

Sensitive compartmented information system means a national security system authorized to process or store sensitive compartmented information.

Source means a non-Federal supplier, or potential supplier, of products or services, at any tier.

Subsidiary means an entity in which more than 50 percent of the entity is owned directly by a parent corporation or through another subsidiary of a parent corporation.

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

Unmanned aircraft means an aircraft that is operated without the possibility of direct human intervention from within or on the aircraft (49 U.S.C. 44801(11)).

Unmanned aircraft system means an unmanned aircraft and associated elements (including communication links and the components that control the unmanned aircraft) that are required for the operator to operate safely and efficiently in the national airspace system (49 U.S.C. 44801(12)).

Document Number: 19AQMM26F1637 Contract Number: GS35F162DA Page 15 of 20

(b) Prohibitions on providing or using specific products or services in performance of contract. Unless a waiver or exception applies, the Contractor is prohibited from providing any products or services to the Government or using in the performance of the contract any of the following:

(1) A covered application on any information technology owned or managed by the Government, or on any information technology used or provided by the Contractor under this contract, including equipment provided by the Contractor’s employees (section 102 of Division R of the Consolidated Appropriations Act, 2023 (Pub. L.

117-328));

(2) A Kaspersky Lab-covered article (Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91));

(3) Covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system (paragraphs (a)(1)(A) of section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232)). This does not prohibit contractors from providing—

(i) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Prohibition on unmanned aircraft systems manufactured or assembled by American Security Drone Act—covered foreign entities.

(1) Prohibition. The Contractor is prohibited from—

(i) Delivering any FASC-prohibited unmanned aircraft system, which includes unmanned aircraft (i.e., drones) and associated elements (sections 1823 and 1826 of American Security Drone Act of 2023, within the National Defense Authorization Act for Fiscal Year 2024, Pub. L. 118-31, Div. A, Title XVIII, Subtitle B, 41 U.S.C. 3901 note prec.);

(ii) On or after December 22, 2025, operating a FASC-prohibited unmanned aircraft system in the performance of the contract (section 1824 of Pub. L. 118-31); and

(iii) On or after December 22, 2025, using Federal funds to procure or operate a FASC-prohibited unmanned aircraft system (section 1825 of Pub. L. 118-31).

(2) Procedures. The Contractor shall search SAM for the FASC-maintained list of American Security Drone Act—covered foreign entities before proposing, or using in performance of the contract, any unmanned aircraft system. Also, the Contractor shall ensure any effort or expenditure associated with a FASC-prohibited unmanned aircraft system is consistent with a corresponding exemption, exception, or waiver determination expressly stated in the contract.

(3) Exemptions, exceptions, and waivers. The prohibitions in paragraph (c) of this clause do not apply where the agency has determined an exemption, exception, or waiver applies, and the contract indicates that such a determination has been made.