Draft Agreement GC Trout River LPOE.pdf

Sol. Reference No. 47PC0324R0010 GSA Contract No: TBD

Construction Contract for: General Construction Services for the

Trout River U.S. Land Port of Entry

The Agreement

Document: C101/MAY 2025 (The Agreement)

Table of Contents

I. Project Information A. Project Summary B. The Contract C. Period Of Performance D. Work Conditions/Site Requirements E. Authorized Representatives F. Contract Liquidated Damages Rate G. Buy American Exceptions H. Statement of Work, Specifications, Drawings, Exhibits and Other Attachments

II. Prices

A. Basis of Pricing B. Contract Price Form

III. Terms and Conditions

A. Contractor Responsibilities B. Project Schedule C. Submittals D. Finality of Contract Modifications E. Liquidated Damages F. Insurance Requirements G. Order of Precedence H. Administrative Matters I. Non-Compliance with Contract Requirements J. Requirements for GSA Information Systems K. Options and Allowances L. Additional Terms and Conditions

i. Inflation Reduction Act (IRA) Low Embodied Carbon (LEC) Material Contract Requirements

ii. IRA LEC Submittal Requirements

iii. GSAR 552.236-74, Evaluation of Options

iv. GSAR 552.236-77, Government’s Right to Exercise Options

IV. Contract Clauses

A. Clauses Incorporated in Full Text

1. FAR 52.204-30 Federal Acquisition Supply Chain Security Act

Orders-Prohibition, Alternate I

2. FAR 52.223-2 Reporting of Biobased Products Under Service and

Construction Contracts

3. FAR 52.223-9 Estimate of Percentage of Recovered Material Content for

EPA-Designated Items

4. GSAR 552.204-9 Personal Identity Verification Requirements (APR 2023)

5. RESERVED

6. FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

7. Buy American Requirements

8. FAR 52.228-11, Pledges of Assets (DEVIATION)

9. FAR 52.232-40, Providing Accelerated Payments to Small Business

Subcontractors

10. Additional Clauses

i. FAR 52.222-30, Construction Wage Rate Requirements-Price Adjustment (None or Separately Specified Method)

B. Clauses Incorporated by Reference C. Subcontract Requirements

I. Project Information

I.A. Project Summary

The U.S. General Services Administration (GSA), Public Buildings Service, Northeast and Caribbean Region, needs a General Contractor (GC) for the construction of the modernization and expansion of the historic Land Port of Entry (LPOE), located at the border on New York State Route 30 in Constable, New York.

The project scope includes expansion and modernization of the existing LPOE facility with approximately 9,917 square feet of new additions and 7,748 square feet of historic renovation.

The project is expected to include commercial and non-commercial vehicle inspection facilities on the New York Department of Transportation Route 30 Right of Way.

The construction of the facility will be performed as follows:

Construction:

The construction as specified in the Construction Documents shall be adhered to, except for any discrepancies that may be discovered. In such situations, the GSA Contracting Officer shall provide direction and clarification. The construction work includes, but is not limited to: concrete footings, foundations, slabs, walkways, roadways, vehicle inspection canopies and inspection booths. Structural framing and the installation of walls, ceilings, flooring, lighting, interior finishes, historic preservation, HVAC, electrical, plumbing, fire protection, and customer required infrastructure for IT, AV and electronic security systems.

Testing and Commissioning:

New HVAC systems shall be tested and balanced per design requirements. Life Safety systems shall be tested and approved by GSA, the Construction Manager as Agent, Commissioning Agent and Design Team.

There will be a total of one Option for this project.

I.B. The Contract

(1) The Contract consists of the SF1442, the Agreement, the Statement of Work, Specifications, Drawings, Exhibits, Amendments, Modifications and other Attachments identified herein (collectively, the Contract Documents). The Contract contains the entire agreement between the Government and GC, and no prior written or oral agreement, express or implied, shall be admissible to contradict or modify any part of the Contract.

(2) The Contractor shall provide and pay for all labor, materials, equipment, tools, water, heat, utilities, transportation, and other facilities and services necessary for the proper execution of the work described in and reasonably inferable from the Contract Documents (the Work), whether temporary or permanent. In consideration for, and upon condition of, the Contractor's completion of the Work, GSA shall pay the Contractor the price or prices established in Section II, subject to the terms and conditions set forth in this Contract.

I.C. Period of Performance

(1) Commencement. The Contractor shall commence performance within ten (10) days after the Contractor receives the Notice to Proceed.

(2) Substantial Completion. The Contractor shall achieve Substantial Completion of the Work, as that term is defined in this Agreement, no later than 761 calendar days from issuance of the Notice to Proceed.

(3) Contract Completion. The Contractor shall achieve Contract Completion, as the term is defined in this Agreement, within sixty (60) calendar days of Substantial Completion.

I.D. Work Conditions/Site Requirements

Refer to Division 1 specifications.

I.E. Authorized Representatives

(1) This Contract is between the United States of America, acting by and through the Administrator of General Services and the Contractor (the Parties). References in this Contract to "the Owner" or "the Government" shall be understood to refer to GSA. The following individual is designated as the only authorized GSA representative under this Contract, unless other warranted contracting officers are designated in writing:

Authorized Representative Information:

Contracting Officer’s Information

Name: Lisa Zalar

Address: One World Trade Center 55W09, New York, NY 10007

Telephone: Telephone: 347-217-3643

Email: lisa.zalar@gsa.gov

(2) For the applicable authorities and limitations see Section IV of this Agreement, GSAR 552.236-70.

I.F. Contract Liquidated Damages Rate In accordance with GSAR 552.211-12, Liquidated Damages – Construction, in Section IV of this Agreement, liquidated damages shall be calculated at the rate of $1605.50 per calendar day.

I.G. Buy American Exceptions

For the applicable Buy American clause and any exceptions, see Section IV of this Agreement, GSAR 552.236-70.

I.H. Statement of Work, Specifications, Drawings, Exhibits, and Other Attachments

The following documents are incorporated by reference into this Contract.

(1) Specifications for GSA Contract No. XXXXXX, Dated X

(2) Construction Drawings for GSA Contract No. XXXXXX, Dated X

(3) Wage Determination No. NY20250035 Heavy and Highway in Franklin County, NY dated January 3, 2025, and Wage Determination No. NY20250120 Building in Franklin County, NY dated January 3, 2025.

(4) Small Business Subcontracting Plan, Dated X [contractor proposed copy will be incorporated after U.S. Small Business Administration approval is received].

(5) A list of IRA-Eligible Materials referenced in the Solicitation.

II. Prices

II.A. Basis of Pricing

(1) Contract Prices. All Contract prices set forth in this Section include all costs necessary to complete the work for which the price is established (e.g., Base Contract, Unit Price, Options) in accordance with the Contract Documents, including, but not limited to, the cost of work performed by subcontractors and consultants, indirect costs, fees, expenses, taxes, and profit.

(2) Knowledge of Conditions Affecting Price. FAR 52.236-3, Site Investigations and Conditions Affecting the Work, is incorporated by reference in this Contract. The Contractor shall be presumed to have established all prices with knowledge of general and local conditions that may affect the cost of Contract performance at the site where the Work is to be performed, to the extent that such information is reasonably obtainable.

(3) Unit Prices and Allowances. If any portion of the Work is to be performed on a unit price basis, the Unit Price shall include all costs of coordinating and incorporating the unit-priced portion of the Work into the Base Contract Work. The Contractor shall only be obligated to perform unit-priced work to the extent that an Allowance has been established. The Contractor shall be obligated to perform such work in excess of a unit quantity for which an Allowance is established only if directed by the Contracting Officer in writing. The Contractor shall be bound to the unit price or prices set forth herein in all equitable adjustments for changes including unit priced work, and no markups shall be applied to such unit prices.

(4) Options. If any portion of the Work is to be performed upon the timely exercise of an Option, the Option Price shall include all costs of coordinating and incorporating the Option-priced portion of the Work into the Base Contract Work. An adjustment to the Contract price for such additional work shall be computed solely on the basis of the Option price or prices set forth herein. Unless otherwise specified, all options may be exercised within ninety (90) days of Contract award.

(5) Bid Rates. If this Contract includes Bid Rates to be used in determination of equitable adjustments (e.g., overhead, profit, daily rates for time-related costs), such rates shall be deemed to include all costs recoverable as components of an equitable adjustment consistent with the requirements, definitions, and exclusions applicable to equitable adjustments set forth in this Contract, and consistent with the Contractor's cost accounting practices. Unless otherwise specified, the bid rates shall be deemed to include only the Contractor's costs, and not the costs of any subcontractors.

II.B. Contract Price Form

See attached SF1442 and excel spreadsheet titled “Trout River LPOE GC Pricing Sheet”

III. Terms and Conditions

III.A. Contractor Responsibilities

GSAR 552.236-71, Contractor Responsibilities is located in Section IV.A. of this Agreement and is supplemented as follows:

(1) For the purposes of FAR 52.236-1, Performance of Work by the Contractor, the Contractor shall perform at least twelve (12) percent of the construction work.

(2) The Contractor shall secure and pay for all necessary permits and governmental fees, licenses, and inspections that are customarily secured after award of the Contract and that are legally required at the time of award. The Contractor shall provide a copy of the permits required for execution of the work to the Contracting Officer prior to commencement of any related work.

(3) FAR 52.211-10, Commencement, Prosecution, and Completion of Work, and GSAR 552.211-10, Commencement, Prosecution and Completion of Work is supplemented as follows:

The Contractor shall diligently prosecute the Work so as to achieve Substantial Completion of the Work, as defined in GSAR 552.211-70 Substantial Completion (Mar 2019) and the time specified in Section I (Project Information), “Period of Performance” clause. If the Contract specifies different completion dates for different phases or portions of the Work, the Contractor shall diligently prosecute the Work so as to achieve Substantial Completion of such phases or portions of the Work within the times specified.

III.B. Project Schedule

GSAR 552.236-15, Schedules for Construction Contracts is supplemented as follows:

(1) Within ten (10) calendar days of notice to proceed, the Contractor shall develop and provide a detailed schedule in widely used, commercially available software such as Microsoft Project and Primavera P6 for completion of all activities, tasks, and submissions required herein.

III.C. Submittals

FAR 52.236-21, Specifications and Drawings for Construction, and GSAR 552.236-72, Submittals located in Section IV.A. of the Agreement are supplemented as follows:

(1) The Contractor shall prepare and submit to the Contracting Officer shop drawings, samples, calculations, product information, mockups, and other submittals (collectively, "submittals") demonstrating compliance with Contract requirements for all Work components as specified elsewhere in this Contract.

III.D. Finality of Contract Modifications

As set forth elsewhere in this Contract, the Contractor is entitled to additional consideration under certain conditions, including the issuance of change orders. It is the Contractor's duty to include in proposals for equitable adjustment or other consideration all compensation to which it may be entitled, including cost and time. Unless otherwise explicitly stated in a modification to the Contract providing such consideration, adjustments to the Contract price or time agreed upon therein shall be deemed to provide all compensation to which the Contractor is entitled, and shall constitute final settlement of the Contractor's entitlement to compensation on account of the change or other condition giving rise to the modification.

III.E. Liquidated Damages

The Contractor acknowledges that time is of the essence for the performance of the Work, and that determining actual damages from delay would be extremely difficult and impractical. If the Contractor fails to achieve Substantial Completion of the Work in accordance with FAR 52.211-12, Liquidated Damages, GSAR 552.211-12, Liquidated Damages and within the time specified in this Contract, the Contractor shall be liable to the Government for liquidated damages at the rate specified in Section I (Project Information), paragraph entitled, “Liquidated Damages Rate,” for each calendar day following the required completion date that the Work is not Substantially Complete.

III.F. Insurance Requirements

(1) The Contractor shall obtain and maintain for the entire life of the Contract, in addition to any insurance required by law, the following minimum kinds and amounts of insurance required pursuant to FAR clause 52.228-5, Insurance – Work on a Government Installation, and GSAR 552.228-5, Government as Additional Insured.

(a) Workers' compensation insurance in the amount required by the jurisdiction in which the Contract is performed. The Contractor shall obtain Employers' liability coverage of at least $2,000,000. If occupational diseases are not covered by workers' compensation insurance, Employers' liability coverage shall include occupational diseases.

(b) Broad form comprehensive commercial general liability insurance in the amount of at least $5,000,000 per occurrence. Such insurance shall include, but not be limited to, contractual liability, bodily injury and property damage.

(c) Comprehensive automobile liability covering the operation of all automobiles used in connection with performing the Contract in the amount of at least $1,000,000 per person and $2,500,000 per occurrence for bodily injury and $1,000,000 per occurrence for property damage.

(2) The Contractor shall require that the licensed design professionals it retains for the Project acquire and maintain professional liability insurance in the amount of $5,000,000 per claim and shall provide proof to the Contracting Officer.

(3) The Contractor shall promptly provide to the Contracting Officer proof that it has obtained insurance required by the Contract in the form of certificates of insurance. The Contractor shall submit to the Contracting Officer all renewal certificates issued during the life of this Contract immediately upon issuance.

III.G. Order of Precedence

Different requirements within this Contract shall be deemed inconsistent only if compliance with both cannot be achieved. In case of inconsistency between Contract Documents, the following order of precedence shall apply:

(1) Section IV of the Agreement

(2) Sections I, II, and III of the Agreement

(3) The Statement of Work

(4) The Specifications

(5) The Drawings

(6) Exhibits and Other Attachments

III.H. Administrative Matters

(1) Project Meetings. The Contractor shall attend a preconstruction conference and shall participate in regularly scheduled Project meetings.

(2) Payments. FAR clause 52.232-5, Payments under Fixed-Price Construction Contracts, is supplemented by GSAR 552.232-5 Payments under Fixed-Price Construction Contracts located in Section IV.A. of this Agreement. In accordance with the relevant FAR and GSAR clauses, GSA requires the following data be included with each invoice:

(a) Invoices shall be submitted electronically to the designated billing office specified in this Contract or in individual delivery/work. An electronic copy of the invoice shall be sent to the GSA Contracting Officer (CO) and GSA Contracting Officer’s Representative as designated after award.

(b) Invoices must include the Account Document Number assigned at award.

(c) The Contractor shall submit the following information or documentation with each invoice:

(i) Updated Schedule of Values upon which the payment request is based;

(ii) GSA Form 2419 - Certification of Progress Payments Under Fixed-Price Construction Contract;

(iii) The payment terms that apply for the particular services rendered;

(iv) Additional documentation:

1. IRA Invoice Requirements The Contractor shall provide an itemized invoice detailing the amounts requested under each firm-fixed price Contract Line Item Number (CLIN) and SubCLIN set forth in the Contract Price Form. Itemized invoices shall reflect progress on each CLIN and SubCLIN and the latest Schedule of Values.

(3) Prompt Payment. In accordance with FAR clause 52.232-27, the period for payments is as follows:

(a) Progress Payments: fourteen (14) days

(b) Subsequent Subcontractor Payments: seven (7) days

(4) Payment Information. GSA makes information on contract payments available electronically at the Office of the Chief Financial Officer website. The Contractor may register at the site and review its record of payments. This site provides information only on payments made by GSA, not by other Federal agencies.

(5) Security Clearances. Contractors shall comply with the following requirements pertaining to security clearances.

(a) All personnel performing work under the Contract on the Project site must obtain an Enter on Duty (EOD) determination before they will be granted access to the site.

(b) To obtain an EOD determination, Contractor shall submit for all such personnel fingerprints on Form SF87 and a completed Contractor Information Worksheet. Detailed information is available at GSA Access Card. USAccess Credentialing Centers can be located at US Access Centers.

(c) In addition, all such personnel who will be on site six (6) months or longer must apply for and receive clearance in accordance with Homeland Security Presidential Directive 12 (HSPD-12). See Section IV, Contract Clauses, GSAR 552.204-9.

(6) Safeguarding and Dissemination of Controlled Unclassified Information Building Information

This clause applies to all recipients of Controlled Unclassified Information (CUI) building information (which falls within the CUI Physical Security category), including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

Marking CUI. Contractors must submit any contractor-generated documents that contain building information to GSA for review and identification of any CUI building information that may be included. In addition, any documents GSA identifies as containing CUI building information must be marked in accordance with the Order and the Marking Controlled Unclassified Information Handbook (the current version may be found at www.archives.gov/files/cui/20161206-cui-marking-handbook-v1-1.pdf) before the original or any copies are disseminated to any other parties. If CUI content is identified, the CO may direct the contractor, as specified elsewhere in this contract, to imprint or affix CUI document markings to https://finance.ocfo.gsa.gov/pii/piinotice.aspx?token=PI002 https://www.gsa.gov/resources/for-federal-employees/process-to-get-a-gsa-access-card?_gl=1*jgl2cm*_ga*NzA3MjEzNS4xNzA3NDg4ODE2*_ga_HBYXWFP794*MTcxOTQ5MjgwOS43NC4xLjE3MTk0OTI5MTQuMC4wLjA.

http://www.fedidcard.gov/centerlist.aspx https://www.archives.gov/files/cui/20161206-cui-marking-handbook-v1-1.pdf the original documents and all copies, before any dissemination, or authorized GSA employees may mark the documents.

1. Authorized recipients.

a. Building information designated as CUI must be protected with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information, as defined in 32 C.F.R. § 2002.4(bb). Those with such a Lawful Government Purpose may include Federal, State and local government entities, and non-governmental entities engaged in the conduct of business on behalf of or with GSA. Non-governmental entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, utilities, and others submitting an offer or bid to GSA, or performing work under a GSA contract or subcontract.

Recipient contractors must be registered as “active” in the System for Award Management (SAM) database at www.sam.gov, and have a Lawful Government Purpose to access such information. If a subcontractor is not registered in the SAM database and has a Lawful Government Purpose to possess CUI building information in furtherance of the contract, the subcontractor must provide to the contractor its DUNS number or its tax ID number and a copy of its business license. The contractor must keep this information related to the subcontractor for the duration of the contract and subcontract.

b. All GSA personnel and contractors must be provided CUI building information when needed for the performance of official Federal, State, and local government functions, such as for code compliance reviews and the issuance of building permits. Public safety entities such as fire and utility departments may have a Lawful Government Purpose to access CUI building information on a case-by-case basis. This clause must not prevent or encumber the necessary dissemination of CUI building information to public safety entities.

2. Dissemination of CUI building information:

a. By electronic transmission. Electronic transmission of CUI information outside of the GSA network must use session encryption (or alternatively, file encryption) consistent with National Institute of Standards and Technology (NIST) SP 800- 171. Encryption must be through an approved NIST algorithm with a valid certification, such as Advanced Encryption Standard or Triple Data Encryption Standard, in accordance with Federal Information Processing Standards Publication 140-2, Security Requirements for Cryptographic Modules, as required by GSA policy.

b. By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include CDs, DVDs, and USB drives. Nonelectronic forms of CUI building information include paper documents, photographs, and film, among other formats.

i. By mail. Contractors must only use methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt. CUI markings must not appear on the exterior of packages.

ii. In person. Contractors must provide CUI building information only to authorized recipients with a Lawful Government Purpose to access such information. Further information on authorized recipients is found in section 1 of this clause.

3. Record keeping. Contractors must maintain a list of all entities to which CUI is disseminated, in accordance with sections 2 and 3 of this clause. This list must include, at a minimum: (1) the name of the Federal, State or local government entity, utility, or firm to which CUI has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the CUI building information, with access strictly controlled and limited to those individuals having a Lawful Government Purpose to access such information; (3) contact information for the named individual; and (4) a description of the CUI building information provided. Once “as built” drawings are submitted, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and suppliers, and submit them to the CO. For Federal buildings, final payment may be withheld until the lists are received.

4. Safeguarding CUI documents. CUI building information (both electronic and paper formats) must be stored within controlled environments that prevent unauthorized access. GSA contractors and subcontractors must not take CUI building information outside of GSA or their own facilities or network, except as necessary for the performance of that contract. Access to the information must be limited to those with a Lawful Government Purpose for access.

5. Destroying CUI building information. When no longer needed, CUI building information must either be returned to the CO or destroyed in accordance with guidelines in NIST Special Publication 800-88, Guidelines for Media Sanitization.

6. Notice of disposal. The contractor must notify the CO that all CUI building information has been returned or destroyed by the contractor and its subcontractors or suppliers in accordance with paragraphs 4 and 5 of this clause, with the exception of the contractor's record copy. This notice must be submitted to the CO at the completion of the contract to receive final payment.

For leases, this notice must be submitted to the CO at the completion of the lease term.

7. CUI security incidents. All improper disclosures or receipt of CUI building information must be immediately reported to the CO and the GSA Incident Response Team Center at gsa-ir@gsa.gov. If the contract provides for progress payments, the CO may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of CUI building information. Progress payments may also be withheld for failure to comply with any provision in this clause until the contractor provides a corrective action plan explaining how the contractor will rectify any noncompliance and comply with the clause in the future.

8. Subcontracts. The contractor and subcontractors must insert the substance of this clause in all subcontracts.

[End of clause]

III.I. Non-Compliance with Contract Requirements mailto:gsa-ir@gsa.gov

In the event the Contractor, after receiving written notice from the Contracting Officer of non-compliance with any requirement of this Contract, fails to initiate promptly such action as may be appropriate to comply with the specified requirement within a reasonable period of time, the Contracting Officer shall have the right to order the Contractor to stop any or all work under the Contract until the Contractor has complied or has initiated such action as may be appropriate to comply within a reasonable period of time. The Contractor will not be entitled to any extension of Contract time or payment for any costs incurred as a result of being ordered to stop work for such cause.

III.J. Requirements for GSA Information Systems

1.0 Security Requirements

The contractor for this project is required to meet the Security and Privacy requirements identified in the ensuing sections.

1.1 Security Assessment and Authorization Requirements

Contractors must obtain an Authorization to Operate (ATO) for the proposed solution at the FIPS 199 Moderate impact level. Service Providers offering solutions delivered as-a-service in the cloud, meeting the NIST 800-145 cloud definition, consistent with the U.S. Office of Management and Budget (OMB) FedRAMP Policy memo, are subject to FedRAMP cloud information security and privacy requirements. Vendors with traditional on-premise or cloud deployments (not delivered as SaaS) are required to meet traditional GSA Assessment and Authorization requirements. Vendors having mobile application components are required to meet the additional mobile application security requirements as defined in Section 9.2.5.

Further, any software required for installation on Government Furnished Equipment or hardware required for deployment in GSA Facilities is subject to GSA software and device testing processes as defined in section 9.2.4.

1.2 Cloud Delivered as-a-Service (Requires FedRAMP)

Cloud computing offers an opportunity for the Federal Government to take advantage of cutting edge information technologies to dramatically reduce procurement and operating costs and greatly increase the efficiency and effectiveness of services provided to its agencies and citizens. Established by OMB in 2011, The Federal Risk and Authorization Management Program (FedRAMP) is a Government-wide program that promotes the adoption of secure cloud services across the Federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

FedRAMP empowers agencies to use modern cloud technologies, with emphasis on security and protection of Federal information. Federal executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information systems that support the operations and assets of the departments and agencies are required to ensure applicable contracts appropriately require cloud service providers to comply with FedRAMP security authorization requirements. This includes systems across all cloud deployment models (e.g., Public Clouds, Community Clouds, Private Clouds); Hybrid Clouds) and all cloud service models (e.g., Infrastructure as a Service, Platform as a Service, Software as a Service) as defined per NIST 800-145, The NIST Definition of Cloud Computing.

The Cloud Information Systems – IT Security and Privacy Requirements identified in Chapter 5 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level. Personally Identifiable Information (PII) is https://www.fedramp.gov/ https://www.fedramp.gov/ https://www.fedramp.gov/assets/resources/documents/FedRAMP_Policy_Memo.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf not in the scope of acquisition and PII is not expected to be stored in the service provider's cloud solution.

Vendors are required to submit and receive GSA’s approval of documentation as evidence of complying with the security requirements listed in Chapter 5 prior to being able to accept any orders.

Changes to the platform that impact the security authorization throughout the period of performance will require attendant changes to maintain the security authorization.

Vendors are required to either be already FedRAMP authorized or be able to achieve a FedRAMP Moderate authorization within One (1) year of the contract award. If not already FedRAMP authorized at the FIPS 199 Moderate impact level, GSA can work with the vendor to obtain a GSA MiSaaS (Moderate Impact Software as a Service) ATO from GSA IT-Security within 150 days of the notice to proceed. Onboard base year projects within 30 days of obtaining MiSaaS ATO. No Government data can be uploaded into the production software application until the GSA ATO is obtained. See 3.1.1.A for anticipated volume of projects.

Vendors pursuing award under this solicitation are required to partner with a Third-Party Assessment Organization (3PAO) to facilitate an independent assessment of the offeror’s documented and implemented NIST 800-53 security controls. Vendors are encouraged to also attain 3PAO services for documentation preparation.

Vendor shall adhere to a milestone schedule to ensure compliance with first year FedRAMP requirement.

If at any time, the vendor is either unwilling or unable to meet any of the process requirements, GSA may choose to terminate the award.

1.3 Traditional On-Premise or Cloud Delivered (not SaaS)

● 1.3.1 External hosted or Cloud Delivered o Vendors choosing to offer a solution hosted on their system should reference The

External Information Systems – IT Security and Privacy Requirements identified in Chapter 2 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level.

The vendor shall be required to obtain a GSA IT-Security ATO For further guidance on ATO, reference. GSA-IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30.

● 1.3.2 On-Premise (GSA) hosted o Vendors choosing to offer a solution hosted within GSA environment should reference the Internal Information Systems - IT Security and Privacy Requirements identified in Chapter 3 of the GSA IT Security Procedural Guide 09-48, Security Language for IT Acquisition Efforts is applicable at the FIPS 199 Moderate impact level.The vendor shall be required to obtain a GSA IT-Security ATO For further guidance on ATO, reference. GSA-IT Security Procedural Guide: Managing Enterprise Cybersecurity Risk CIO-IT Security-06-30.

https://insite.gsa.gov/system/files/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-24%5D-06-26-2023.pdf https://insite.gsa.gov/system/files/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-24%5D-06-26-2023.pdf https://insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-22%5D-12-23-2021_%281%29docx_%281%29.pdf https://insite.gsa.gov/cdnstatic/insite/Managing-Enterprise-Cybersecurity-Risk-%5BCIO-IT-Security-06-30-Rev-22%5D-12-23-2021_%281%29docx_%281%29.pdf o Additionally for any smart buildings or IoT components, the vendor should adhere to the Building Technologies Technical Reference Guide (version 2.0 or the latest posted version).

Vendors pursuing award under this solicitation are required to partner with an independent assessor (GSA is required to approve) to facilitate an independent assessment of the offeror’s documented and implemented NIST 800-53 security controls. Vendors are encouraged to leverage a 3PAO for assessment services and for documentation preparation.

1.4 Hardware Device and Software Security Testing for Components Required for Deployment in GSA Facilities/Networks (If any)

Per GSA policy 16-76, all IP addressable devices, appliances and software applications that will communicate over the GSA network shall be scanned by GSA-IT Security. Before any hardware, software or IT device/system is connected to its network, a security risk assessment of selected management, operational, and technical security controls is performed, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. A security assessment report is produced by GSA IT Security, which will be shared within GSA and with the vendor. The assessment report will allow GSA to understand and accept the risk to agency operations (including mission, functions, image, or reputation), agency assets, or individuals, based on the implementation of an agreed-upon set of security controls. The contractor/vendor shall therefore be held responsible for mitigating all security risks identified.

Vulnerabilities shall be mitigated, within the following timeframes:

Severity Expected resolution

Critical and high vulnerabilities ≤ 30 business days

Moderate vulnerabilities ≤ 90 business days

The GSA IT Security team performs security control reviews utilizing a systematic, repeatable approach, which is utilized to uniformly evaluate any device, application or general support system.

Once the device/application has completely gone through the remediation process and has a remediation/hardening plan in place, all other projects can use that report to configure the named device, or application accordingly. This assessment is revisited every three years, or upon release of any major new revision of the solution, at any stage when new vulnerabilities are uncovered and reported (i.e ICS-CERT advisories). The contractor(s) will therefore need to have a strategy to address evolving vulnerabilities in timelines set by GSA.

● 1.4.1

Per Memorandum M-21-07 the Federal Government will deliver information services, operate networks and access services of others using only IPv6. Starting no later than https://drive.google.com/file/d/1H6UTXpB2mnZ09SiqRVdzFK9s4hHOBG1Z/view?usp=sharing https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

FY23, all new networked Federal BMC systems must be IPv6 enabled when deployed.

The intent is to phase out IPV4 for all Federal BMC systems. Currently, our network and client devices are IPv6-enabled, but the applications and the systems they run on, including servers and databases are likely not capable based on their current configuration. GSA must accept only IPv6 enabled systems when deploying new networked Federal BMC systems. The intent is to phase out all IPv4 systems over the next several years. IPv4 will no longer be allowed for new projects/assessments starting July 2023. Break/Fix replacements of existing (deployed) hardware should prioritize utilizing an IPv6 capable replacement when possible.

1.5 Mobile Application Security Requirements (If any)

The contractor shall adhere to the following requirements and guidelines for developing mobile applications. All requirements and guidelines are found in the GSA IT Security Procedural Guide 12-67, “Securing Mobile Devices and Applications,” which will be provided upon contract award.

A mobile application, most commonly referred to as an app, is a type of application software designed to run on a mobile device, such as a smartphone or tablet computer. Mobile applications frequently serve to provide users with similar services to those accessed on PCs.

Apps are generally small, individual software units with limited capabilities and isolated functionality. The simplest apps are developed to utilize the web browser of the mobile device to provide a feature set integration much like what is found on a user’s PC. However, as mobile app development has grown, a more sophisticated approach involves developing applications specifically for the mobile environment, taking advantage of both its limitations and advantages.

For example, apps that use location-based features are inherently built from the ground up with an eye to mobile devices given that you do not have the same concept of location on a PC. With this new paradigm in both mobile platforms and the applications loaded on them, GSA will concentrate security focus on the following goals:

● That all apps loaded have an initial assessment by GSA for acceptability and then a security assessment & authorization, when required

● That all apps are deployed from only trusted sources, following their security/assessment process – This presently is the Apple ITunes store for iOS and the Google Play store for Android. MaaS360 may also be used, once retrieved from these sources, for enterprise deployment

● That Terms of Service discipline is adhered to, based on acceptability of an app – either as an individual user or for GSA as an Agency

● That apps deemed to be unacceptable are blacklisted, using MaaS360

● That a mobile app inventory for all devices be maintained

● That GSA developed apps are assessed, evaluated and approved by the Authorizing

Official for the system they support before deployment

1.6 Identification and Authentication Requirements

● The vendor shall support configurable integrations with GSA operated, and Government-wide operated, identity and authentication / single sign on services. The vendor shall support SAML 2.0 and/or OpenID Connect integrations. GSA will identify and provide the services upon award.

● The vendor shall support multi-factor authentication for GSA administrator users (privileged users) through integrations with a GSA managed identity and authentication service. The vendor shall support SAML 2.0 and/or OpenID Connect integrations.

1.7 Other Security and Privacy Requirements

● Compliance with Section 889 Part 1 and Part 2 of the John S. McCain National Defense Authorization Act

● No third party integrations are authorized without the expressed permission of the GSA CISO and/or Authorizing Official and an assessment and authorization of the third party offering having been completed prior to the integration.

● The Contractor shall comply with GSA administrative, physical, and technical security controls to ensure that all Government’s security requirements are met. The Contractor is responsible for addressing any issues or concerns raised by GSA within five (5) workdays.

● Safeguarding Sensitive Data and Information Technology Resources

(a) In accordance with FAR 39.105 and GSAM Subpart 539.70 , this section is included in the contract.

(b) This section applies to all who access or use GSA IT resources or sensitive data, including awardees, Contractors, subcontractors, lessors, suppliers and manufacturers.

(c) The GSA policies as identified in paragraphs (d), (e) and (f) of this section are applicable to the contract. These policies can be found at https://www.gsa.gov/directives or https://insite.gsa.gov/directives.

(d) All of the GSA policies listed in this paragraph shall be followed.

(1) CIO P 1878.3 Conducting Privacy Impact Assessments in GSA

(2) CIO P 2100.1N GSA Information Technology Security Policy

(3) CIO P 2180.2 GSA Rules of Behavior for Handling Personally Identifiable Information (Pll)

(4) 2231.1 CIO GSA Data Release Policy

(5) CIO 9297.2C CHGE 1 GSA Information Breach Notification Policy

(e) All of the GSA policies listed in this paragraph shall be followed, when inside a GSA building or inside a GSA firewall.

(1) CIO P 2100.2B GSA Wireless Local Area Network Security

(2) CIO 2104.1B GSA Information Technology IT General Rules of Behavior

(4) CIO 2182.2 Mandatory Use of Personal Identity Verification Credentials

(5) ADM P 9732.1 E Suitability and Personnel Security

(f) The GSA Policies listed in this paragraph shall be followed. The contractor shall assume that all policies are applicable unless otherwise stipulated by the GSA Office of the Chief Information Security Officer.

1. CIO 2101.2 GSA Enterprise Information Technology Management (ITM) Policy

(2) CIO 2105.1 D GSA Section 508: Managing Electronic and Information Technology for Individuals with Disabilities

(3) OSC 2106.2 GSA Social Media Policy

(4) CIO 2107.1 Implementation of the Online Resource Reservation

Software

(5) CIO 2108.2 Software License Management

(6) CIO 2160.2B CHGE 2 GSA Electronic Messaging and Related Services

(7) CIO 2160.4A CIO Provisioning of Information Technology Devices

(8) CIO 2162.2 GSA Digital Signature Policy

(9) CIO P 2165.2 GSA Telecommunications Policy

(g) The Contractor and subcontractors shall insert the substance of this section in all subcontracts.

● Relevant FAR Clauses o 552.239-70 Information Technology Security Plan and Security Authorization.

Information Technology Security Plan and Security Authorization (Jun 2011) “All offers/bids submitted in response to this solicitation must address the approach for completing the security plan and certification and security authorization requirements as required by the clause at 552.239-71, Security Requirements for Unclassified Information Technology Resources. (End of clause)”

● FAR Clauses Incorporated by Reference

● 52.239-1 Privacy or Security Safeguards

● 552.239-71 Security Requirements for Unclassified Information

Technology Resources

III.K. Options and Allowances

Option 1: Photovoltaic (solar panels)

III.L. Additional Terms and Conditions

(i) Inflation Reduction Act (IRA) Low Embodied Carbon (LEC) Material Contract Requirements Where this Agreement requires provision of construction materials that are listed in GSA’s IRA LEC Material Requirements (each an IRA-Eligible Material), the contractor shall provide materials with global warming potential (GWP) values that are below GSA’s Top 20% value for each material, provided each IRA-Eligible Material entails no more than a 5% cost premium as compared to equivalent conventional materials.

To the extent that “Top 20%”-compliant IRA-Eligible Materials are not available at a cost premium of 5% or less, the contractor shall provide IRA-Eligible materials with GWP values that are below GSA’s Top 40% value for each material, provided each such IRA-Eligible Material entails no more than a 5% cost premium as compared to equivalent conventional materials.

To the extent that “Top 40%”-compliant IRA-Eligible Materials also are not available at a cost premium of 5% or less, the contractor shall provide IRA-Eligible materials with GWP values that are below GSA’s Better Than Average value for that IRA-Eligible Material, provided each such IRA-Eligible Material entails no more than a 5% cost premium as compared to equivalent conventional materials.

For purposes of material cost premium calculations, include cost of materials and costs associated with delivery of materials (transport to job site, including any mobile batch plants needed for concrete mixes).

GWP thresholds and compliance documentation are specified in GSA’s LEC Material Requirements.

(ii) IRA LEC Submittal Requirements Contractor shall submit the following information to the GSA CO and ira-lec-epd-review@gsa.gov within 180 days of contract award:

(1) Compliant environmental product declarations (EPDs) for each IRA-Eligible Material to be installed, per Compliance Documentation section of GSA’s LEC Material Requirements.

(a) U.S. EPA’s Sustainable Marketplace Technical Assistance page includes a searchable library of resources to support EPD research and Development, and an EPD Basics Guide for manufacturers.

(2) The total anticipated or actual quantity of each IRA Eligible Material required for performance of the Agreement (e.g. cubic yards or metric tons from the bill of materials).

(3) A brief description of how each IRA Eligible Material will be used (e.g., roadway replacement, concrete reinforcement).

If material selections change (e.g. due to value engineering or other action that impacts project materials or technologies), submit updated EPDs and quantities within 30 days.

(iii) GSAR 552.236-74, Evaluation of Options (MAR 2019) The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s). (End of provision)

(iv) GSAR 552.236-77, Government’s Right to Exercise Options (MAR 2019) (a)The Government may exercise any option in writing in accordance with the terms and conditions of the contract within 180 days.

(b)If the Government exercises the option, the contract shall be considered to include this option clause.

(End of clause)

IV. Contract Clauses

Notice 1: Clause and provision deviations dated February 2025 do not affect the following:

1. Any FAR subparts that are based on statute or are not covered by E.O. 11246 such as:

a. FAR subparts 22.13, Equal Opportunity for Veterans and its related clauses and provisions; and

b. FAR subpart 22.14, Employment of Workers and Disabilities.

2. Existing U.S. laws on civil rights, nondiscrimination, or any laws that generally apply to a company regardless of whether it is a Government contractor.

End of Notice

Notice 2:

System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in agency solicitations, including FAR 52.222-25, Affirmative Action Compliance, 52.223-22, Public Disclosure of Greenhouse Gas Emissions and Reduction Goals—Representation and paragraph (t) of FAR 52.212-3, Offeror Representations and Certifications—Commercial Products and Commercial Services..

GSA will not consider or use these representations. Entities are not required to, nor are they able to, update their entity registration to remove these representations in

SAM.

End of Notice

NOTICE 3: February 2025 clause or provision deviations are available in class deviations CD-2025-04 (February 15, 2025) and CD-2025-05 with Supplement 1 (March 7, 2025), available at www.gsa.gov/policy-regulations/policy/acquisiti2on-policy/acquisition-policy-library-and-r esources#tab--Class-deviations)

End of Notice

IV.A. Clauses Incorporated in Full Text

1. FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition (DEC 2023) Alternate I (DEC 2023)

(a) Definitions. As used in this clause—

Covered article, as defined in 41 U.S.C. 4713(k), means—

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

https://www.gsa.gov/policy-regulations/policy/acquisition-policy/acquisition-policy-library-and-resources#tab--Class-deviations https://www.gsa.gov/policy-regulations/policy/acquisition-policy/acquisition-policy-library-and-resources#tab--Class-deviations https://www.govinfo.gov/link/uscode/41/4713 https://www.govinfo.gov/link/uscode/40/11101

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring the removal of covered articles from executive agency information systems or the exclusion of one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201–1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders applicable to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition.