RFQ FDA-75F40125Q00007_Revised.pdf

REQUEST FOR QUOTE

FY25 Docker Enterprise Edition Licenses

FDA-75F40125Q00007

The Request for Quote (RFQ) FDA-75F40125Q00007 is a combined synopsis/solicitation issued under FAR Part 12 and Subpart 13.5 procedures. This RFQ is for the Docker Licenses Renewal. This will be a single Firm Fixed Price (FFP) award with a one-year period of performance and will be solicited as a Total Small Business set-aside under NAICS code 541519 on a brand name basis.

The Government is in no way obligated to make an award, nor to pay any costs incurred by the Contractor in preparing and submitting its quote.

BACKGROUND

FDA requires a CaaS (Containers as a Service) solution. The CaaS technology will allow the FDA to modernize its enterprise infrastructure though the use of a leading edge open source container virtualization technology. This will significantly save costs for FDA/OIMT by allowing considerably more containers than VMs per physical server. Furthermore, the infrastructure will be modernized to be able to deploy applications faster and with fewer errors. The goal is to increase customer satisfaction and adaptability by providing a standardized and stable cloud environment throughout all of the FDA.

During FY 16 and 17 FDA piloted a CaaS framework, utilizing the technology from Docker. This pilot was competed competitively under contract number: GS11T08BJD6001. The result of this pilot is the FDA has further refined its CaaS requirements. These requirements are reflected in the SOW and salient characteristics provided in this requisition.

OBJECTIVE

The objective of this contract is to procure the required Docker licenses to continue the development of the FDA CaaS platform. Docker Enterprise Edition (EE) container platform for businesses running critical apps in production at scale. Docker EE is the integrated platform that is optimized and certified for enterprise operating systems and leading cloud providers. With Docker EE, development and IT ops teams can safely build, securely ship, and run any application efficiently on any infrastructure, without lock-in.

SECTION 1 – REQUIREMENTS AND DELIVERY INFORMATION

1.1 REQUIREMENTS

The FDA requires the acquisition of Containers as a Service (CaaS) software. FDA needs these parts to build, configure, and support a Containers as a Service (CaaS) platform for the FDA IT Users community.

Item No.

Manufacture

Part No.

Description Qty. Unit Price

DSUB-EE

ADVANCED-BD

Docker EE Advanced for O/S for Linux and Window Server with Business Day Support

Months

1.2 GENERAL REQUIREMENTS

• It shall be possible to deploy and operate the container solution within both on-prem Air-Gap environment, private cloud, as well as environments that have internet connectivity

• It shall be possible to deploy the various components of the solution in High Availability mode to avoid single point of failure on any component

• The container solution should be easily deployable with zero configuration out of the box by just using default settings

• The container solution software shall allow its various components to be independently upgradable and maintainable

• The container solution shall employ a cluster-based solution

• The container solution shall allow multiple tenant applications to run within the cluster by providing adequate privacy and segregation between tenant applications

• The container solution shall support multiple alternative interfaces for interacting with all its features

& functionalities securely using client bundles, password credentials, and API tokens: GUI, Command

Line, API interfaces

• The container solution shall allow application developers to deploy their application easily & efficiently using any of the above interface options (GUI, Command Line, API interfaces)

• The container solution shall allow platform operators to perform OAM activities easily and efficiently using any of the above interface options (GUI, Command Line, API interfaces)

• The container solution shall allow platform operators to upgrade the solution components right from the solution GUI for online systems/environments (not Air-gapped)

• The container solution shall provide mechanisms to backup the various components of the solution and allow the backups to be used for disaster recovery of the corresponding failed components

• The container solution shall facilitate access to a repository of base images that can be used for application development via a central repository exchange hub. These images are preferred to be

Docker certified images either from docker or third-party vendors

• The container solution shall provide the operator adequate functionalities and command sets to administer and maintain the cluster efficiently

• The container solution shall provide the operator adequate functionalities and command sets to clean up the system of unwanted resources efficiently such as pruning images, volumes, containers

• The container solution shall provide application developers adequate functionalities and command sets to administer and maintainer their application containers

• The container solution shall provide plug and play interface for incorporating the following eco system tools:

o Third-party Monitoring solutions o Third-party security solution o Third-party volume storage solutions o Third-party logging solutions

1.3 NETWORKING AND SECURITY REQUIREMENTS

• The container solution shall support software defined networking

• The container solution shall support multiple network type options (overlay, bridge, MACVLAN, host)

• The container solution shall allow network plugin configuration to configure any compatible networking solution plugin besides what comes by default with the product

• The container solution shall provide firewall between different overlay networks

• The container solution shall allow encryption of container data traffic on the network

• The container solution shall support built-in service discovery and container name resolution functionalities such as resolving services via internal DNS

• The container solution shall be secure out of the box supporting secure internal communication between the solution components as well as with external entities

• The container solution shall support collection of audit logs at multiple layers of verbosity

• The container solution shall support multi-user account-based usage access

• The container solution shall provide Role Based Access Control of resources

• The container solution shall support default roles out of the box as well as operator configurable roles allowing granular assignment of privileges

• The container solution shall allow user configuration and aggregation of users into different hierarchies such as teams and organizations

• The container solution shall support separation of resources by name spaces allowing the operator to create separate name spaces for segregating the resources of different teams/tenants

• The container solution shall allow the operator to fine tune ample security level settings besides what comes set with the product by default. This includes daemon settings, AppArmor security profiles, Seccom security profile, and name space mapping

• The container solution shall adhere to or be working towards important government standard compliance requirements such as NIST, FISMA, FIPS

1.4 APPLICATION ENVIRONMENT REQUIREMENTS

• The container solution shall support both Windows and Linux application workloads

• The container solution shall provide automated health monitoring of application containers

• The container solution shall support automated self-healing of application containers from a container failure on a node

• The container solution shall support automated self-healing of application containers from a node failure

• The Container solution shall support auto scaling of application containers

• The container solution shall support the concept of services and a stack of multiple services

(microservices)

• The container solution shall support monitoring, administration, and control of individual containers

• The container solution shall support monitoring, administration, and control of individual services

• The container solution shall support monitoring, administration, and control of individual stacks

• The container solution shall support logging of events from the platform layer as well as application layer

• The container solution shall support application layer single sign-on

• The container solution shall support plugins for various types of logging mechanisms or drivers:

syslog, Splunk, journaled, etc.

• The container solution shall maintain and provide adequate statistics about running application containers such as memory, CPU, and storage utilization

• The container solution shall maintain and provide adequate statistics about the platform resource utilization such as memory, CPU, and storage utilization

• The container solution shall allow users to create the following resources and be able to easily display hierarchical relationship information and detailed statistics about the resources in a drill-down manner starting from high level information down to detail information.

o Stacks o Services (swarm & Kubernetes) o Containers o Nodes o Volumes o Networks o Secrets o configs o Pods o Controllers o Namespaces

• The container resource shall be able to provide the above statistics breakdown with the following alternatives:

o Individual resource statics as well as cluster level aggregate statistics o Application layer only, platform layer only, both o Active/running resources, inactive/dead resources, both

• The container solution shall display information for the following resources used by application stacks:

o Overview for the stack

▪ Type of stack (swarm/Kubernetes)

▪ Name of stack

▪ Time of creation o Swarm Services: for each service within the stack

▪ Name, status, image, mode, time stamp, error/status, restart-policy, max-attempts, CPU/mem limits/reservations, networks, mounts, secrets, labels, constraints, environments, configurations, CPU/mem metrics, log driver, container running for that service o Containers: for each container running under each service within the stack

▪ ID, image, restart policy, restart count, IP address, collection, entrypoint, ports, networks, mounts, environment variables, labels, processes within the container o Networks: for each network used by the stack

▪ Name, ID, driver, scope, attachable/ingress/internal/collection/ipv6 o Secrets: for each secret used by the stack

▪ ID, timestamp, namespace/collection, labels used, the services associated with the secret o Volumes: for each volume used by the stack

▪ Name, mount-point, node, driver, mount point, options, labels o Configs: for each config used by the Stack

▪ Name, type, timestamps, associated services, labels, collection, config data o Controllers: for each controller used by a kubernetes application service

▪ Name, state, number of PODs, type, namespace, replicas, available/ready/updated replicas, annotations, replica sets, conditions o Kubernetes service: for each Kubernetes service used by an application

▪ Name, namespace, type, clusterIP, annotation, external IPs, labels selectors, ports o Pods: for each pod used by a Kubernetes application or service

▪ Name, state, status, node, timestamp, namespace, POD IP, restart policy, DNS policy, QOS, HostIP, termination grace period, container restart count, service account name, scheduler name, annotations, container names/images, Init containers, container volume mounts, labels, conditions, owner references (owner object kind/api-version/UID/controller) o Namespace: for each name space configured within the system

▪ Name, quotas

• The container solution shall allow both swarm and Kubernetes orchestration alternatives

• The containers solution shall allow developers to deploy their applications via a compose file (for swarm deployments), or via kubernetes yaml files (for Kubernetes workloads)

• The container solution shall allow end users to access the services deployed by app developers within the solution cluster

• The container solution shall provide the following detailed functionalities to application developers o shall allow app developers to push application images o shall allow app developers to pull application images o shall allow app developers to manage application images o shall allow app developers to create repositories o shall allow app developers to deploy applications and application components o shall allow app developers to check the status of applications and application components o shall allow app developers to tear down applications and application components o the container solution infrastructure environment shall be pluggable into external CI/CD pipelines within FDA

• The container solution shall be able to route incoming end-user application traffic for services into the cluster using both layer 7 and layer 4 load balancing

1.5 APPLICATION DATA STORAGE REQUIREMENTS

• The container solution shall provide application storage volume functionality

• The container solution shall provide support for different types of volumes: bind-mount, anonymous, named

• The container solution shall support monitoring, administration, and control of individual volumes

• The container solution shall support secret configuration for storing and maintaining sensitive application layer data. The secret data shall be encrypted at rest as well as in transit

• The container solution shall support config resources for storing and maintaining non-sensitive application layer data.

1.6 CONTAINER IMAGE REPOSITORY REQUIREMENTS

• The container solution shall support integrated image repository

• The image repository component of the solution shall support image scanning in a configurable manner. Both automated and ad-hoc scanning shall be supported

• The image repository component of the solution shall support image signing in a configurable manner by managing multiple signing keys

• The image signing methodology shall employ the following keys:

o Root key o Repository/tagging keys o Server-managed keys: timestamp keys, snapshot keys

• The image repository component of the solution shall support image promotion between repositories using the following multiple types policy setting options:

o number of vulnerabilities: critical, major, minor o tag name o component name o license

• The image repository component of the solution shall support image mirroring

• The image repository component shall support multiple types of backend for the actual image storage o NFS o Bind-mount o volume o S3 bucket

• The image repository component shall support the options for creating repositories “prior” to the image push as well as “at the time” of push

• The image repository component shall support update of the CVE vulnerability database offline as well as online

1.7 OPERATION REQUIREMENTS

The container solution shall provide the following functionalities for the infrastructure platform operators:

• shall allow operators to Install solution infrastructure components

• shall allow operators to Uninstall solution infrastructure components

• shall allow operators to Upgrade solution infrastructure components

• shall allow operators to backup solution infrastructure components

• shall allow operators to Check the status of solution infrastructure components

• shall allow operators to Check the capacity of solution infrastructure components

• shall allow operators to Expand the capacity of solution infrastructure components

• shall allow operators to define, categorize, and calculate solution charge back components and amounts

• shall allow operators to provide container infrastructure service in a resilient and scalable manner

(self-healing and service scalability)

• shall allow operators to monitor the container solution infrastructure components with continual automated state update

• shall allow operators to log the container solution infrastructure system logs to a centralized logging system (suck as Splunk or syslog)

1.8 DELIVERABLES

The following deliverables/reports shall be generated and submitted as follows:

GENERAL DELIVERABLES

Report Name / Deliverable Name

Description Frequency Deliver To Responsible

Kick off meeting Vendor will conduct kick off meeting with FTE Project Lead within two days of the contract award.

Once FTE Project Lead Vendor Acct Mgr.

Kick off meeting minutes/notes

Meeting minutes/notes

Once FTE Project Lead Vendor Acct Mgr.

Delivery Schedules Itemized list of deliveries with specific dates (via email).

Updated weekly FTE Project Lead and FDA Inventory Mgr.

Vendor Acct Mgr.

Delivery Progress Report

Delivery progress report, upcoming activities, % complete (via email)

Updated weekly FTE Project Lead, Branch Chief

Vendor Acct Mgr.

Final Packing List Report

Complete set of all packing lists (via email)

5 days after final delivery

FTE Project Lead, Branch Chief and FDA Inventory Mgr.

Vendor Acct Mgr.

1.9 DELIVERY REQUIREMENTS

The above items shall be delivered according to the below Period of Performance in Section 1.10. The vendor shall deliver all software licenses as detailed in Section 1 of this delivery order as follows:

SHIPPED TO:

U.S. Food and Drug Administration ATTN: (To be Determined) FDA White Flint North (13C48) 11601 Landsdown Street North Bethesda, MD 20852

1.10 PERIOD OF PERFORMANCE

This is a one-time software license purchase only. The anticipated period of performance will consist of one 12-month period of performance running from 02/18/2025 to 02/17/2026.

1.11 CONTRACT TYPE

This order is a firm-fixed-price order.

SECTION 2 – CONTRACT ADMINISTRATION

2.1 CONTRACT MANAGEMENT

Contracting Officer (CO):

(To be entered at time of award)

Contracting Specialist (CS):

Terina Hicks Terina.hicks@fda.hhs.gov

Contracting Officer’s Representative (COR):

(To be entered at time of award)

2.2 CONTRACTING OFFICER’S AUTHORITY

The Contracting Officer (CO) is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the RFQ;

(2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract. No statement, whether oral or written, by anyone other than the Contracting Officer, shall be interpreted as modifying the terms and conditions of this award. It is the Contractor’s responsibility to contact the CO immediately if there is even the appearance of any technical direction that is or may be outside the scope of the award. The Government will not reimburse the Contractor for any work not authorized by the Contracting Officer, including work outside the scope of the award.

The Contracting Officer’s Representative (COR) is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the contract and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

2.3 INTERPRETATIONS OF MODIFICATIONS

No oral or written statement of any person and no written statement of anyone other than the CO shall modify or otherwise affect the terms and conditions of this contract. Requests for interpretations, modifications or changes must be made in writing to the CO. The technical point of contact can only respond to technical matters that do not result in a change of scope to this contract.

2.4 IPP INVOICE REQUIREMENTS

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (Jan 2022)

(a) All Invoice submissions for goods and or services must be made electronically through the U.S.

Department of Treasury’s Invoice Processing Platform System (IPP).

http://www.ipp.gov/vendors/index.html

(b) Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial

Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov .

(c) The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive

Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 – 5 business days of the contract award for new contracts or date of modification for existing contracts.

(1) Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov . or phone (866)

973-3131. Contractor assistance with enrollment can be obtained by contacting the IPP

Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866)

973-3131.

(2) The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

(3) If your company is already registered to use IPP, you will not be required to re-register.

(4) If the Contractors unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the

Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

(d) Invoices that include time and materials, or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and

(2) substantiate material costs incurred (when applicable).

(e) Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts.

http://www.ipp.gov/vendors/index.htm https://www.ipp.gov/ mailto:ipp.noreply@mail.eroc.twai.gov mailto:IPPCustomerSupport@fiscal.treasury.gov

(1) At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

- Direct Labor-include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

- Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other

Indirect)-show rate, base and total amount;

- Consultants (if applicable)-include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

- Travel-include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

- Subcontractors (if applicable)-include, for each subcontractor, the same data as required for the Prime Contractor;

- Other Direct Costs-include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and-

- Fee–amount as allowable in accordance with the Schedule and FAR52.216-8 if applicable.

(f) Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(1) list of all invoices submitted to date under the subject award, including the following:

- invoice number, amount, & date submitted

- corresponding payment amount &date received

- total amount of all payments received to date under the subject contractor order

- and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

(g) Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

(h) If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

(i) Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

(j) The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

(k) Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827- ERIC

(3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov . Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

(END OF CLAUSE)

2.5 PAYMENT TERMS

Payment terms Net 30 days after government acceptance of the supply item / service. Payments shall not be made more frequently than monthly in arrears. Advance payments will not be made.

SECTION 3 – INSPECTION & ACCEPTANCE

Inspection and acceptance will be at destination in accordance with FAR clause 52.212-4(a). In accordance with FAR 52.212-4(a), the Government has the right either to reject or to require correction of nonconforming supplies. Supplies are nonconforming when they are defective in material or workmanship or are otherwise not in conformity with contract requirements. The Government may reject nonconforming supplies with or without disposition instructions.

The COR will perform inspection and acceptance of all products and services. The performance criteria for these products shall be timely delivery and closure of all activities and deliverables listed above and within the established Period of Performance.

Inspection and acceptance will occur at the place of delivery. Inspection will include verifying all parts were received and warranties and services are in place. The Government will accept goods and services only if they conform to all terms and conditions of this order. The Government will provide written notification of acceptance or rejection within ten (10) business days of receiving the delivery.

The Government will reject non-conforming products and services. The Contractor shall correct any deficiencies within thirty (30) days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the COR or technical POC of the reason for the delay and provide a proposed corrective action plan within ten (10) business days.

All quoter’s shall be Authorized reseller and/or servicing agent shall identify and/or provide documentation to confirm their claim as an authorized reseller and/or servicing agent.

All Offerors quote shall clearly state license number, product description, quantity, price, and period of performance for each product. The quotation shall include and match license number, product description, mailto:ERIC@fda.hhs.gov quantity, and period of performance. Offerors are advised that should their quotation conflict with or does not clearly reflect the specified product and requirement of this solicitation, their quotation may be deemed as technically unacceptable and may not be considered for award.

Price: Provide a detailed quote for each item/component proposed to the schedule of items. Discounts are highly encouraged.

The offeror or applicant shall submit all electronic documents for Microsoft Office suite products without the use of macros. If the offeror or applicant submits documents that contain macros the Government will not be able to view or open such documents and the submission will be considered non-responsive to the solicitation. No additional time will be given to an offeror or applicant to correct the document submission and the Government will not inform the offeror or applicant that their submission is non-responsive prior to award. It is the offerors or applicant’s responsibility to ensure all electronic documents are submitted without the use of macros.

SECTION 4 – INSTRUCTIONS

All questions in response to this solicitation shall be submitted on or before December 24, 2024, 1:00PM Washington DC Local Time. All questions shall be submitted via email to Terina Hicks, Contracting Specialist, terina.hicks@fda.hhs.gov

All quotes shall be submitted electronically via email NLT Thursday, January 2, 2025, 1:00PM Washington DC Local Time or sooner to Terina Hicks at terina.hicks@fda.hhs.gov

The Vendor’s quote shall provide the following:

• Vendors shall submit the pricing information requested in Section 1.

• The products shall be quoted as the brand name identified.

• The Vendors Unique Entity Identifier (UEI)

• Vendors shall submit all proposed commercial warranty terms and conditions for the products. If accepted by the Government, these warranty terms and conditions may be incorporated as an attachment to the contract.

SECTION 5 – FAR / HHSAR CLAUSES & PROVISIONS

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998) This solicitation incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the following FAR and HHSAR provisions and clauses, incorporated by reference, apply to this acquisition and can be obtained in full text at: https://www.acquisition.gov/far/ and http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

FAR Clauses:

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) 52.204-13 System for Award Management and Maintenance (Oct 2018) 52.204-18 Commercial and Government Entity Code Maintenance (Jul 2016) 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by

Kaspersky Lab Covered Entities. (Dec 2023) 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or

Equipment (Nov 2021) mailto:terina.hicks@fda.hhs.gov mailto:terina.hicks@fda.hhs.gov https://www.acquisition.gov/far/ http://www.hhs.gov/grants/contracts/contract-policies-regulations/hhsar/index.html

52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023) 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (Nov 2023) 52.227-19 Commercial Computer Software License (Dec 2007) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013) 52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Mar 2023)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders— Commercial Products and Commercial Services. (Nov 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (Mar 2023) (31 U.S.C.

3903and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Jun 2020), with Alternate I (Nov 2021) (41 U.S.C. 4704 and 10 U.S.C. 4655).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712); this clause does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community—see FAR 3.900(a).

_X_ (5) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Jun 2020) (Pub.

L.109-282) (31 U.S.C. 6101 note).

__ (6) [Reserved].

__ (7) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

_X_ (9) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

__ (10) 52.204-28, Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Dec 2023) (Pub. L. 115–390, title II).

__ (11)

(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Dec 2023) (Pub. L. 115– 390, title II).

__ (ii) Alternate I (Dec 2023) of 52.204-30.

_X_ (12) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Nov 2021) (31 U.S.C. 6101 note).

__ (13) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

__ (14) [Reserved].

_X_ (15) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Oct 2022) (15 U.S.C. 657a).

__ (16) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2022) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (17) [Reserved]

__ (18) (i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-6.

__ (19) (i) 52.219-7, Notice of Partial Small Business Set-Aside (Nov 2020) (15 U.S.C. 644).

__ (ii) Alternate I (Mar 2020) of 52.219-7.

__ (20) 52.219-8, Utilization of Small Business Concerns (Feb 2024) (15 U.S.C. 637(d)(2) and (3)).

__ (21) (i) 52.219-9, Small Business Subcontracting Plan (Sep 2023) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Jun 2020) of 52.219-9.

__ (v) Alternate IV (Sep 2023) of 52.219-9.

__ (22) (i) 52.219-13, Notice of Set-Aside of Orders (Mar 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (Mar 2020) of 52.219-13.

__ (23) 52.219-14, Limitations on Subcontracting (Oct 2022) (15 U.S.C. 657s).

__ (24) 52.219-16, Liquidated Damages—Subcontracting Plan (Sep 2021) (15 U.S.C. 637(d)(4)(F)(i)).

__ (25) 52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program (Feb 2024) (15 U.S.C. 657f).

__ (26)(i) 52.219-28, Post Award Small Business Program Re-representation (Feb 2024) (15 U.S.C.

632(a)(2)).

__ (ii) Alternate I (Mar 2020) of 52.219-28.

__ (27) 52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women- Owned Small Business Concerns (Oct 2022) (15 U.S.C. 637(m)).

__ (28) 52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Oct 2022) (15 U.S.C. 637(m)).

__ (29) 52.219-32, Orders Issued Directly Under Small Business Reserves (Mar 2020) (15 U.S.C. 644(r)).

__ (30) 52.219-33, Nonmanufacturer Rule (Sep 2021) (15 U.S.C. 637(a)(17)).

_X_ (31) 52.222-3, Convict Labor (Jun 2003) (E.O.11755).

_X_ (32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (Feb 2024).

_X_ (33) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (34) (i) 52.222-26, Equal Opportunity (Sep 2016) (E.O.11246).

__ (ii) Alternate I (Feb 1999) of 52.222-26.

__ (35) (i) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (Jul 2014) of 52.222-35.

_X_ (36) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

__ (ii) Alternate I (Jul 2014) of 52.222-36.

_X_ (37) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

_X_ (38) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O.13496).

_X_ (39) (i) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (40) 52.222-54, Employment Eligibility Verification (May 2022) (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

__ (41) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (42) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (May2024) (42 U.S.C. 7671, et seq.).

__ (43) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (May 2024) (42 U.S.C. 7671, et seq.).

__ (44) 52.223-20, Aerosols (May 2024) (42 U.S.C. 7671, et seq.).

__ (45) 52.223-21, Foams (May 2024) (42 U.S.C. 7671, et seq.).

__ (46) 52.223-23, Sustainable Products and Services (May 2024) (E.O. 14057, 7 U.S.C. 8102, 42 U.S.C.

6962,42 U.S.C. 8259b, and 42 U.S.C. 7671l).

__ (47) (i) 52.224-3 Privacy Training (Jan 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (Jan 2017) of 52.224-3.

_X_ (48) (i) 52.225-1, Buy American-Supplies (Oct 2022) (41 U.S.C. chapter 83).

__ (ii) Alternate I (Oct 2022) of 52.225-1.

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (NOV 2023) (19 U.S.C. 3301 note, 19U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501- 4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112- 41, 112-42, and 112-43.

__ (ii) Alternate I [Reserved].

__ (iii) Alternate II (Dec 2022) of 52.225-3.

__ (iv) Alternate III (Feb 2024) of 52.225-3.

__ (v) Alternate IV (Oct 2022) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (NOV 2023) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

_X_ (51) 52.225-13, Restrictions on Certain Foreign Purchases (Feb 2021) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

__ (55) 52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (May 2024) (E.O.13513).

__ (56) 52.229-12, Tax on Certain Foreign Procurements (Feb 2021).

__ (57) 52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services (Nov2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

__ (58) 52.232-30, Installment Payments for Commercial Products and Commercial Services (Nov 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

_X_ (59) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (Oct2018) (31 U.S.C. 3332).

__ (60) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (61) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

__ (62) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (63) 52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American Security Drone Act-Covered Foreign Entities (Nov 2024) (Sections 1821-1826, Pub. L. 118-31, 41 U.S.C.

3901 note prec.).

__ (64) 52.242-5, Payments to Small Business Subcontractors (Jan 2017) (15 U.S.C. 637(d)(13)).

__ (65) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Nov 2021) (46 U.S.C.

55305 and10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

__ (iii) Alternate II (Nov 2021) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

__ (1) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter67).

__ (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and41 U.S.C.

chapter 67).

__ (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (Aug 2018) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May 2014) (29U.S.C.206 and 41 U.S.C. chapter 67).

__ (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

__ (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

__ (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at52.215-2, Audit and Records-Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement.

Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e) (1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1), in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021) (41 U.S.C. 3509).

(ii) 52.203-17, Contractor Employee Whistleblower Rights (Nov 2023) (41 U.S.C. 4712).

(iii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iv) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Dec 2023) (Section 1634 of Pub. L. 115-91).

(v) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021) (Section 889(a)(1)(A) of Pub. L. 115-232).

(vi) 52.204-27, Prohibition on a ByteDance Covered Application (Jun 2023) (Section 102 of Division R of Pub. L. 117-328).

(vii) (A) 52.204–30, Federal Acquisition Supply Chain Security Act Orders—Prohibition. (Dec 2023) (Pub. L.

115–390, title II).

(B) Alternate I (Dec 2023) of 52.204–30.

(viii) 52.219-8, Utilization of Small Business Concerns (Feb 2024) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(ix) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

(x) 52.222-26, Equal Opportunity (Sep 2015) (E.O.11246).

(xi) 52.222-35, Equal Opportunity for Veterans (Jun 2020) (38 U.S.C. 4212).

(xii) 52.222-36, Equal Opportunity for Workers with Disabilities (Jun 2020) (29 U.S.C. 793).

(xiii) 52.222-37, Employment Reports on Veterans (Jun 2020) (38 U.S.C. 4212).

(xiv) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O.13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xv) 52.222-41, Service Contract Labor Standards (Aug 2018) (41 U.S.C. chapter 67).

(xvi) (A) 52.222-50, Combating Trafficking in Persons (Nov 2021) (22 U.S.C. chapter 78 and E.O 13627).

(B) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xvii) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xviii) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(xix) 52.222-54, Employment Eligibility Verification (May 2022) (E.O. 12989).

(xx) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (Jan 2022).

(xxi) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2022) (E.O. 13706).

(xxii) (A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xxiii) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

(xxiv) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).

Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxv) 52.232-40, Providing…