Draft 19AQMM24R0120.pdf

19AQMM24R0120

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE RATING

2. AMENDMENT/MODIFICATION NO. 3. EFFECTIVE DATE

08/30/2024

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

LMAQMCODE

OFFICE OF ACQUISITION MANAGEMENT (A/LM/AQM)

PO BOX 9115, ROSSLYN STATION

US DEPARTMENT OF STATE

ARLINGTON, VA 22219

Khoa D Tran

NAME

703-875-5854

TEL.

TranKD@state.gov

EMAIL

6. ISSUED BY CODE

OFFICE OF ACQUISITION MANAGEMENT (A/LM/AQM)

PO BOX 9115, ROSSLYN STATION

US DEPARTMENT OF STATE

ARLINGTON, VA 22219

7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

19AQMM24R0120

CONTACT: UEI:

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

08/30/2024

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning ____copies of the amendment;(b)By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

Khoa D Tran

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

08/30/2024

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

CGFS // CGFS

Line Item Summary

Solicitation Number:

19AQMM24R0120

Contract Number: Title: Cybersecurity Support for At Risk Countries

Date of Solicitation:

08/30/2024

Line Item No.

Description Quantity Unit Unit Price Total Cost

001 Base Period: SMEs Support Type of Contract Pricing: LH

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

BASE PERIOD

002 Base Period: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

BASE PERIOD

003 Base Period: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

BASE PERIOD

101 Option Period 1: SMEs Support Type of Contract Pricing: LH

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

102 Option Period 1: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

103 Option Period 1: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

201 Option Period 2: SMEs Support Type of Contract Pricing: LH

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

202 Option Period 2: Travel Type of Contract Pricing: CNF

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

203 Option Period 2: ODCs Type of Contract Pricing: FFP

Doc Ref No:

Delivery Date FOB:

1.00 0.00 1.00

LT $0.00

$0.00

$0.00

$0.00 $0.00

$0.00

Line Item Summary

Solicitation Number:

19AQMM24R0120

Contract Number: Title: Cybersecurity Support for At Risk Countries

Date of Solicitation:

08/30/2024

Line Item No.

Description Quantity Unit Unit Price Total Cost

Section A - Solicitation/Contract Form Identifier Title Date Number of

Pages 1 AQS 19AQMM24R0120.pdf 07/13/2024

B-015 - TRAVEL COSTS (Cost-Reimbursement)

(a) Except as otherwise provided herein, the Contractor shall be reimbursed for its reasonable actual travel costs in accordance with its usual accounting practices consistent with FAR Subpart 31.2, specifically FAR31.205-46. Travel must be directly related to and required for performance of this contract, and authorized in advance and in writing by the Contracting Officer's Representative (COR).

In no event shall costs associated with employee commuting be reimbursable as a direct cost under this contract.

(b) The Contractor shall include a breakout of all authorized travel expenses as an attachment to its invoices.

(c) Administrative support (coordination of travel arrangements, etc.) will be the responsibility of the Contractor.

(d) Should any Contractor personnel be requested to perform in any area which has been determined by the Department of State to be a hazardous duty area, hazardous duty premium pay may be payable at the same rate as would be given to Department of State direct-hire employees pursuant to Chapter 650 of the U.S. Department of State Standardized Regulations (Government Civilians, Foreign Areas). Each employee will be notified upon arrival at any hazardous duty area of the applicable rates, terms and conditions at the time of performance. Hazardous duty premium pay shall not be burdened with any indirect costs (e.g., overhead, G and A) or fee/ profit.

(e) When local travel between the Contractor employee's regular place of performance and other locations is specifically authorized by the COR, transportation expenses shall be allowable costs under this contract. For the purposes of this clause, local travel means travel within a 50 mile radius of the Contractor employee's regular place of performance and does not include daily commuting or associated costs.

(f) For travel where use of a personal automobile has been specifically authorized by the COR, reimbursement shall be computed on the basis of actual miles traveled from stat starting point to destination. Other related miscellaneous expenses, such as tolls and parking fees, incurred in the performance of tasks authorized under this contract, will be reimbursed. Car rentals require advance approval by the COR and will be authorized only when consistent with good business practice. Allowable costs shall not exceed the actual cost of renting a compact automobile (a maximum of one for four Contractor personnel), unless extenuating circumstances (e.g., excess baggage) require other arrangements and subsequent COR approval is obtained.

(g) The Government will reimburse the Contractor for Contractor employee's travel time to or from other authorized work locations, except that for labor categories which are exempt from the Fair Labor Standards Act (FSLA),, a reimbursement will be allowed only for travel during the employee's regular working hours. The Contractor will not be reimbursed for time spent in stand down or temporary layovers by FLSA exempt contractor employees for the convenience of the Contractor except as authorized by the Federal Travel Regulations.

(h) The Contractor shall be responsible for ensuring that all personnel who will be required to travel outside the United States have current and valid passports. The Contractor shall also be responsible for obtaining any visas required for travel to foreign countries under this contract. The Contractor shall make no direct labor charges for obtaining/maintaining passports and/or visas.

(end of clause)

C-001 - STATEMENT OF WORK

U.S. Department of State

COMMISSIONING GLOBAL SUPPORT FOR CYBERSECURITY SUPPORT IN THE

INTERNATIONAL FINANCIAL SECTOR AND AMONG VIRTUAL ASSET SERVICE PROVIDERS

SCOPE

Pursuant to the terms of the Contract and at the direction of and within frameworks established by the Government, the Contractor shall provide cybersecurity subject matter expertise to foreign governments, financial sector entities, and virtual asset service providers.

A. At the direction of the Government, the Contractor shall begin providing remote cyber incident response support, cybersecurity consultancy, and forensic analysis services to foreign governments, financial institutions, virtual asset service providers, or other victim entities within at least 48 hours of notification.

B. At the direction of the Government, the Contractor shall deploy a minimum of two cybersecurity subject matter experts (SMEs) worldwide within 14 calendar days of notification. The cybersecurity SMEs need not be the same SMEs for each deployment, or the SMEs identified as Key Personnel. At its discretion, the Contractor may deploy different SMEs to meet the circumstances of each deployment.

C. Deployment requirements will vary based on circumstances, but may include:

1. i. Supporting cybersecurity, information technology (IT), and cyber incident response personnel in identifying, analyzing, responding to, and/or preventing potentially malicious cyber operations targeting private sector or government networks.

ii. Conducting an assessment or audit of the IT design architecture of foreign entities to identify vulnerabilities and recommend solutions.

iii. Providing hands-on assistance in implementing recommended solutions.

iv. Providing training and material detailing cybersecurity best practices.

v. Actively mitigating the effects of an ongoing network intrusion or cyber operation.

vi. Conducting analyses of malicious cyber operations, including collecting forensic evidence and assessing damage to support government or victim efforts to attribute cyber intrusions to specific advanced persistent threats.

vii. Providing reports to victim entities to raise awareness of the attack lifecycle, cybersecurity vulnerabilities, and likely perpetrators.

viii.Producing sanitized incident reports for foreign entities. The Government may require specific reports to be prepared for public release. At the request of the Government, the Contractor may be required to arrange translation of individual reports.

D. The Contractor shall arrange interpretation services as necessary for virtual engagements and deployments.

E. The Contractor shall maintain cybersecurity standards that are, at a minimum, comparable to the NIST Cybersecurity Framework.

F. The Contractor shall demonstrate experience responding to cyber incidents involving nation state Advanced Persistent Threats (APTs). Specific experience responding to origin threats is desirable, but not required.

G. The Contractor shall explain how it will proceed in a diplomatically sensitive manner.

H. The Contractor shall possess a demonstratable cyber forensic analysis experience for entirely post-incident engagement.

I. The Contractor shall possess experience responding to ransomware incidents. Specific experience responding to origin ransomware threats is desirable, but not required.

J. The Contractor shall possess demonstrated experience providing cyber incident response assistance to government and private sector entities. Demonstrated experience supporting blockchain development companies and/or virtual asset exchanges is preferred.

K. The Contractor shall possess demonstrated experience offering post-incident remediation guidance and attribution evidence.

E-004 - INSPECTION AND ACCEPTANCE (Services)

Inspection and acceptance of the services to be provided hereunder shall be made by the Contracting Officer's Representative.

(end of clause)

F-001 - Deliverables

Deliverables Deliverable Recipient Deadline Formal After-Action Report Describing the Virtual Engagement

COR & GTM 10 days following the conclusion of a virtual engagement

Informal E-Mail Describing the Individual Formal Deployments

COR & GTM 3 days following the conclusion of an individual deployment

Formal After-Action Report Describing the Individual Foreign Deployments

COR & GTM 30 days following the conclusion of an individual deployment

Formal After-Action Report Describing Actions Taken, Findings, and Recommended Actions for Foreign Beneficiaries

COR, GTM & Foreign Beneficiaries

30 days following the conclusion of an individual engagement

652.242-70 - CONTRACTING OFFICER'S REPRESENTATIVE (COR) (AUG 1999)

(a) The Contracting Officer may designate in writing one or more Government employees, by name and position title, to take action for the Contracting Officer under this contract. Each designee shall be identified as a Contracting Officer's Representative (COR).

Such designation(s) shall specify the scope and limitations of the authority so delegated; provided, that the designee shall not change the terms or conditions of the contract, unless the COR is a warranted Contracting Officer and this authority is delegated in the designation.

(b) The COR is [insert job title of COR] .

(End of clause)

INV-IPP - ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS AND INSTRUCTIONS TO IMPLEMENT

USAGE OF THE INVOICE PROCESSING PLATFORM (IPP).

(a) Definitions. As used in these instructions

(1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of these instructions, the Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP) at www.ipp.gov. Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with the IPP application can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866)973-3131. The Contractor shall ensure that its supporting documentation conforms to IPP requirements. IPP accommodates up to 25 supporting attachments per invoice, individual attachment file size may not exceed ten megabytes (10mb). If the Contractor assesses that their supporting documentation will not reasonably conform to IPP requirements, the Contractor shall contact the Contracting Officer to explore possible alternatives. In addition, the IPP only allows certain characters to be used as the invoice number. The invoice number shall conform to the IPP convention and the attachments (if used) shall match exactly the invoice number allowed. The allowed characters in the IPP are “abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_”

(c) If the Contractor wishes to be paid via a foreign bank account, the contractor must properly fill out form GFS-FO-CLM-089 and attach it to each invoice in the IPP where payment to a foreign bank account is requested. The form can obtained by e-mailing CGFSIPPITSForm@state.gov.

(d) The Contractor may submit payment requests using other than IPP only when the Contracting Officer authorizes alternate procedures in writing.

(e) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting Officer’s written authorization with each payment request.

[End of instructions]

H-016 - KEY PERSONNEL

(1) The Contractor shall assign to this contract the following key personnel:

Project Manager Lead Technical Subject Matter Expert (SME) Deputy Technical Subject Matter Expert (SME)

---Project Manager shall possess active SECRET clearances---

(2) The Contractor agrees that a partial basis for award of this contract is the list of key personnel proposed. Accordingly, the Contractor agrees to assign to this contract those key persons whose resumes were submitted with the proposal necessary to fulfill the requirements of the contract. No substitution shall be made without prior notification to and concurrence of the Contracting Officer. During the first ninety days of performance, the Contractor shall make no substitutions of key personnel unless the substitution is necessitated by illness, death, or termination of employment.

(3) All proposed substitutes shall meet or exceed the qualifications of the person to be replaced. The Contracting Officer shall be notified in writing of any proposed substitution at least forty-five days, or ninety days if a security clearance is to be obtained, in advance of the proposed substitution. Such notification shall include:

(1) an explanation of the circumstances necessitating the substitution;

(2) a complete resume of the proposed substitute; and

(3) any other information requested by the Contracting Officer to enable him to judge whether or not the Contractor is maintaining the same high quality of personnel that provided the partial basis for award.

(end of clause)

H-020 - SAFEGUARDING INFORMATION

The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the Contracting Officer. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of the U.S. Government. Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media without the prior written authorization of the Contracting Officer. These obligations do not cease upon the expiration or termination of this contract. The Contractor shall include the substance of this provision in all contracts of employment and in all subcontracts hereunder.

(end of clause)

H-043 - Cybersecurity Supply Chain Risk Management Requirements (AUG 2023)

a. Definitions. As used in this clause:

Covered article - The term "covered article" includes:

1. "Information and Communications technology," which is an industry term for information technology that is involved in integrating telecommunications (e.g., telephone lines and wireless signals) and computers to enable users to access, store, manipulate, transmit, and receive digital information. This includes software, software as a service, digital and data services, and hardware components that support information creation, storage, transfer, and management, like computers and smartphones.

2. "Telecommunications Equipment," which means equipment, other than customer premises equipment, used by a carrier to provide telecommunications services, and includes software integral to such equipment (including upgrades).

3. "Telecommunications Service," which means the offering of telecommunications for a fee directly to the public, or to such classes of users as to be effectively available directly to the public, regardless of the facilities used.

4. “Cybersecurity Supply Chain Risk,” which means the risk that a person may sabotage, maliciously introduce unwanted function, extract data, or otherwise manipulate the design, integrity, manufacturing, production, distribution, installation, operation, maintenance, disposition, or retirement of covered articles to surveil, deny, disrupt, or otherwise manipulate the function, use, or operation of the covered articles or information stored or transmitted on the covered articles.

1. “Incident,” which means, per the Federal Information Security Modernization Act of 2014, “an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

1. "Vulnerability,” means any weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.

a. Contractor Cybersecurity Supply Chain Risk Management Responsibilities. The Contractor must regularly identify, assess, monitor, and mitigate cybersecurity supply chain risks when providing covered articles or services to the Government. The Contractor shall maintain artifacts (i.e., any byproduct of hardware or software development that helps describe the architecture, design, and function of that hardware or software) that document its compliance with this paragraph and shall provide these artifacts to the Government within 48 hours of request, which may be redacted to remove sensitive proprietary information.

b. Supporting Government Cybersecurity Supply Chain Risk Assessments. No more than an estimated once per year, the Contractor must provide any requested information related to its supply chain within 10 business days except information that is protected by a non-disclosure agreement with its customers (e.g., another federal agency).

a. Novation Agreement Notice. FAR 42.1203 require Government approval of novation agreements. For proposed novation agreements for this contract, the Contractor shall provide any information requested by the Government regarding the proposed successor’s identity and information regarding its supply chain.

a. Notification procedures for cybersecurity supply chain incidents. When an incident occurs, the Contractor must contact the CO or their designee within 72 hours of the incident.

a. Subcontracts. The Contractor shall insert the substance of this clause in all subcontracts and other contractual instruments in support of this contract.

a. Attestation following Major Version Change. Critical Software, as defined by NIST Guidance, that is provided by the Contractor or subcontractors and is modified during the contract’s period of performance by a major version change (e.g., using a semantic versioning schema of Major. Minor.

Patch, the software version number goes from 2.5 to 3.0) requires a new self-attestation. For indefinite delivery contract vehicles, this self-attestation must be provided for all critical software available for ordering on the contract vehicle when the software is modified during the contract vehicle’s ordering period of performance by a major version change. The Contractor shall either (i) post the new attestation in a publicly available internet location within 14 days of the major version change and provide the Contracting Officer’s Representative (COR), or CO if a COR is not appointed, with the internet link or shall contact the COR, or CO if a COR is not appointed, and request the agency’s current software self-attestation form and submit it to the Government within 15 days of the major version change. The self-attestation form must contain the following elements: (i) the software producer's name; (ii) a description of which product or products the statement refers to including the number of the major version change; and (iii) a statement attesting that the software producer follows secure development practices and tasks consistent with NIST Guidance.

(End of clause)

52.212-5 - Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Services (May 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004)(Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub. L. 109-282) (31 U.S.C.

6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

X (8) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Jun 2020) (31 U.S.C. 6101 note).

X (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Mar 2020) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Mar 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (Mar 2020) of 52.219-4.

__ (13) [Reserved]

__ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Jun 2020) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Jun 2020) of 52.219-9.

__ (18)(i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (19) 52.219-14, Limitations on Subcontracting (Mar 2020) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages--Subcon-tracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Mar 2020) (15 U.S.C. 657f).

__ (22)(i) 52.219-28, Post Award Small Business Program Rerepresentation (Nov 2020) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Mar 2020) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Mar 2020) (15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (Mar 2020) (15 U.S.C. 637(a)(17)).

__ (27) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

X (28) 52.222-19, Child Labor--Cooperation with Authorities and Remedies (Jan 2020) (E.O. 13126).

X (29) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

X (30)(i) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

X (31)(i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (July 2014) of 52.222-35.

X (32)(i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (July 2014) of 52.222-36.

X (33) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

X (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

X (35)(i) 52.222-50, Combating Trafficking in Persons (Oct 2020) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (36) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (37)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c) (3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

X (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O.

13693).

__ (40)(i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (41)(i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (May 2020) (42 U.S.C. 8259b).

__ (43)(i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

X (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Jun 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun 2016) (E.O. 13693).

__ (47)(i) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

__ (48) 52.225-1, Buy American--Supplies (Jan 2021) (41 U.S.C. chapter 83).

__ (49)(i) 52.225-3, Buy American--Free Trade Agreements--Israeli Trade Act (Jan 2021) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (Jan 2021) of 52.225-3.

__ (iii) Alternate II (Jan 2021) of 52.225-3.

__ (iv) Alternate III (Jan 2021) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (Oct 2019) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

X (51) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

__ (55) 52.229-12, Tax on Certain Foreign Procurements (Jun 2020).

__ (56) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (57) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

X (58) 52.232-33, Payment by Electronic Funds Transfer--System for Award Management (Oct 2018) (31 U.S.C. 3332).

__ (59) 52.232-34, Payment by Electronic Funds Transfer--Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (60) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

X (61) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (62) 52.242-5, Payments to Small Business Subcontractors (Jan 2017)(15 U.S.C. 637(d)(13)).

__ (63)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Feb 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

X (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

X (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

X (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

X (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards--Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment--Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-- Requirements (May 2014) (41 U.S.C. chapter 67).

X (7) 52.222-55, Minimum Wages Under Executive Order 13658 (Nov 2020).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2017) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract and does not contain the clause at 52.215-2, Audit and Records--Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause--

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Jun 2020) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(iv) 52.204–25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(v) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(vi) 52.222-21, Prohibition of Segregated Facilities (Apr 2015)

(vii) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

(viii) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212)

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(xiii) (A) 52.222-50, Combating Trafficking in Persons (Oct 2020) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (Oct 2015) (E.O. 12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Nov 2020).

(xviii) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2017) (E.O. 13706).

(xix)(A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C.

2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

52.217-8 - Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 - Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 45 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 24 months.

(End of clause)

52.228-3 - Workers' Compensation Insurance (Defense Base Act) (July 2014)

(a) The Contractor shall--

(1) Before commencing performance under this contract, establish provisions to provide for the payment of disability compensation and medical benefits to covered employees and death benefits to their eligible survivors, by purchasing workers' compensation insurance or qualifying as a self-insurer under the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 932) as extended by the Defense Base Act (42 U.S.C. 1651, et seq.), and continue to maintain provisions to provide such Defense Base Act benefits until contract performance is completed;

(2) Within ten days of an employee's injury or death or from the date the Contractor has knowledge of the injury or death, submit Form LS-202 (Employee's First Report of Injury or Occupational Illness) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 930(a), 20 CFR 702.201 to 702.203);

(3) Pay all compensation due for disability or death within the time frames required by the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914, 20 CFR 702.231 and 703.232);

(4) Provide for medical care as required by the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 907, 20 CFR 702.402 and 702.419);

(5) If controverting the right to compensation, submit Form LS-207 (Notice of Controversion of Right to Compensation) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914(d), 20 CFR 702.251);

(6) Immediately upon making the first payment of compensation in any case, submit Form LS-206 (Payment Of Compensation Without Award) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C.

914(c), 20 CFR 702.234);

(7) When payments are suspended or when making the final payment, submit Form LS-208 (Notice of Final Payment or Suspension of Compensation Payments) to the Department of Labor in accordance with the Longshore and Harbor Workers' Compensation Act (33 U.S.C. 914(c) and (g), 20 CFR 702.234 and 702.235); and

(8) Adhere to all other provisions of the Longshore and Harbor Workers' Compensation Act as extended by the Defense Base Act, and Department of Labor regulations at 20 CFR Parts 701 to 704.

(b) For additional information on the Longshore and Harbor Workers' Compensation Act requirements see http://www.dol.gov/owcp/ dlhwc/lsdba.htm.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts to which the Defense Base Act applies.

(End of clause)

52.232-39 - Unenforceability of Unauthorized Obligations (Jun 2013)

(a) Except as stated in paragraph (b) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation (31 U.S.C. 1341), the following shall govern:

(1) Any such clause is unenforceable against the Government.

(2) Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an "I agree" click box or other comparable mechanism (e.g., "click-wrap" or "browse-wrap" agreements), execution does not bind the Government or any Government authorized end user to such clause.

(3) Any such clause is deemed to be stricken from the EULA, TOS, or similar legal instrument or agreement.

(b) Paragraph (a) of this clause does not apply to indemnification by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures.

(End of clause)

52.239-1 - Privacy or Security Safeguards (Aug 1996)

(a) The Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government.

(b) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases.

(c) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

(End of clause)

52.204-2 - Security Requirements (Mar 2021)

(a) This clause applies to the extent that this contract involves access to information classified "Confidential," "Secret," or "Top Secret."

(b) The Contractor shall comply with--

(1) The Security Agreement (DDForm441), including the National Industrial Security Program Operating Manual (32 CFR part 117);

and

(2) Any revisions to that manual, notice of which has been furnished to the Contractor.

(c) If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

(d) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

(End of clause)

52.203-17 - Contractor Employee Whistleblower Rights (Nov 2023)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 41 U.S.C. 4712 and Federal Acquisition Regulation (FAR) 3.900 through 3.905.

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 41 U.S.C. 4712, as described in FAR 3.900 through 3.905.

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts.

(End of clause)

52.204-13 - System for Award Management Maintenance (Oct 2018)

(a) Definitions. As used in this clause-- "Electronic Funds Transfer (EFT) indicator" means a four-character suffix to the unique entity identifier. The suffix is assigned at the discretion of the commercial, nonprofit, or Government entity to establish additional System for Award Management (SAM) records for identifying alternative EFT accounts (see subpart 32.11) for the same entity.

"Registered in the System for Award Management (SAM)" means that--

(1) The Contractor has entered all mandatory information, including the unique entity identifier and the EFT indicator (if applicable), the Commercial and Government Entity (CAGE) code, as well as data required by the Federal Funding Accountability and Transparency Act of 2006 (see subpart 4.14), into the SAM;

(2) The Contractor has completed the Core, Assertions, Representations and…