RFQ-FRTIB1-25-Q-0003_ Amendment_0001.pdf

(x)

FRTIB1-25-Q-0003

x x copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE RECEIVED AT

THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

OCFO_ACQ_MGT_DIV ISS

Washington DC DC 20002 Suite 1000 77 K Street NE

FRTIB

11/08/20240001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

11/08/2024

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not, is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment to RFQ-FRTIB1-25-Q-0003 is to issue the following:

1) Include Attachment D to this solicitation which includes the governments responses to the questions submitted by offerors in response to RFQ FRTIB1-25-Q-0003.

2) The proposal due date for this solicitation will be changed from December 2, 2024 at

12:00pm to December 5, 2024 at 12:00pm.

All other solicitation terms and conditions remain unchanged.

Continued ...

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

Ronald Rheinhardt

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA

FAR (48 CFR) 53.243

NSN 7540-01-152-8070

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

TEL: EMAIL: Ronald.Rheinhardt@FRTIB.GOV

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

2 2

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

FRTIB1-25-Q-0003/0001

Period of Performance: 01/01/2025 to 12/31/2029

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

B. CONTINUATION OF SF-1449 (per FAR 12.303 format).

B.1 This document consists of the following sections:

SECTION DESCRIPTION

A Standard Form 1449 B Continuation of the SF-1449 C Contract Clauses D Solicitation Provisions

-Evaluation Factors for Award -Instructions to Offeror(s)

E Attachment A-Statement of Work Attachment B-Pricing Schedule Attachment C- Software Attestation Form Attachment D- Vendor Questions & Government Responses

[End of text]

SECTION B - CONTINUATION OF BLOCK 18a.

Award Type: As a result of this solicitation FRTIB1-25-Q-0003, a Firm-Fixed Price, Single Award Contract is being awarded.

B.1 Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (January 2019) Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice Processing Platform (IPP) system using the “Bill to Agency” of Interior Business Center – FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor.

Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Items include in commercial item contracts. The IPP website address is:

https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment.

The Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973 – 3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Clause) https://www.ipp.gov/

SECTION C - CONTRACT CLAUSES

52.217-7 Option For Increased Quantity-Separately Priced Line Item (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of clause)

52.217-8 Option To Extend Services. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years (5 years 6 months)

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders— Commercial Products and Commercial Services. (Feb 2024)

FAR 52.212-5 Clauses incorporated by reference:

52.203-6 Restrictions on Subcontractor Sales to the Government. (Jun 2020) 52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (Nov 2023) 52.204-14 Service Contract Reporting Requirements. (Oct 2016)

52.204-7 System of Award Management (Oct 2018) 52.204-13 System of Award Management Maintenance (Oct 2018)

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities. (Nov 2021)

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Nov 2021)

52.204-26 Covered Telecommunications Equipment or Services-Representation. (Oct 2020)

52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023) 52.209-6 Protecting the Government-Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Nov 2021) 52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters. (Oct

2018) 52.222-3 Convict Labor. (Jun 2003) 52.222-19 Child Labor-Cooperation with Authorities and Remedies. (Feb 2024) 52.222-21 Prohibition of Segregated Facilities. (April 2015) 52.222-26 Equal Opportunity. (Sept 2016) 52.222-36 Equal Opportunity for Workers with Disabilities (JUN 2020) 52.222-40 Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010) 52.222-50 Combating Trafficking in Persons (NOV 2021) 52.224-3 Privacy Training (Jan 2017) 52.225-13 Restrictions on Certain Foreign Purchases 52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020)

52.222-35 Equal Opportunity for Veterans (JUN 2020) 52.222-37 Employment Reports on Veterans (JUN 2020) 52.222-54 Employment Eligibility Verification (MAY 2022) 52.232-39 Unenforceability of Unauthorized Obligations (June 2013)

Software Attestation

In accordance with 44 U.S.C. § 3554, Executive Order (E.O) 14028, “Improving the Nation’s Cybersecurity,” and OMB Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” as amended by OMB Memorandum M-23-16 “Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices”, Federal Agencies are required to collect secure software development attestations from software producers affirming their software follows the NIST Secure Software Development Framework (SSDF), SP 800-218.

All vendors submitting proposals, or the software producers (where applicable) shall comply with M-22-18 and M-23-16. Software producers shall submit the attestation and necessary artifacts on https://softwaresecurity.cisa.gov and notify the Contractor Officer after doing so. Alternatively, software https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title44-chapter35-subchapter2&edition=prelim https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2022%2F09%2FM-22-18.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM5nHLZIK%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484388988040%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KwXSxqH63KJXceatanm4LWnPD%2B%2BlxEhf3%2Bb7KYfR8eA%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2022%2F09%2FM-22-18.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM5nHLZIK%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484388988040%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KwXSxqH63KJXceatanm4LWnPD%2B%2BlxEhf3%2Bb7KYfR8eA%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://softwaresecurity.cisa.gov/ producers may also complete and submit the attached attestation form titled “Self-Attestation-Common- Form-03082024-FINAL-FRTIB-Fillable” along with a valid 3PAO assessment report (if applicable) to the Contracting Officer.

Any software vendor found not compliant with the above requirement may be determined not eligible for award.

FRTIB Contract Provisions and Clauses

H.1 Safeguarding Controlled Unclassified Information (CUI) (JULY 2020)

(a) Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information.

“Controlled Unclassified Information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Technical information” means technical data or computer software, as those terms are defined in this clause--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of, and Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the Cloud Computing Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)(A) The Contractor shall notify the FRTIB Chief Information Security Officer (CISO), via email, within 30 days of contract award of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the FRTIB Chief Technology Officer (CTO) or CISO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the FRTIB CTO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the time of the execution of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Reporting, including malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(d) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(e) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties.

The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause. (End of Clause)

H.2 Compliance with Controls for Safeguarding Controlled Unclassified Information (CUI) (JULY 2020)

(a) Definitions. As used in this provision—

“Controlled Unclassified Information (CUI),” “covered contractor information system,” “cyber incident,” “information system,” and “technical information” are defined in clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6, Cyber Incident Reporting.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled Unclassified Information (CUI) and Cyber Incident Reporting, shall be implemented for all Controlled Unclassified Information (CUI) on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see (b)(2) of clause H.1, Safeguarding Controlled Unclassified Information (CUI) and H.6 - Cyber Incident Reporting.

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer.

(2) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the CISO, a written explanation of —

(i) Why a particular security requirement is not applicable; or

(ii) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract. (End of Clause)

H.3 Representation of Use of Cloud Computing

(a) Definition. “Cloud computing,” as used in this provision, means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

(c) The Offeror shall indicate by checking the appropriate blank in paragraph (c) of this provision whether the use of cloud computing is anticipated under the resultant contract.

(d) Representation. The Offeror represents that it—

_____ Does anticipate that cloud computing services will be used in the performance of any contract or subcontract resulting from this solicitation.

_____ Does not anticipate that cloud computing services will be used in the performance of any contract or subcontract resulting from this solicitation.

(End Clause)

H.3 Federal Information Security Modernization Act (FISMA) Compliance (JULY 2020)

(a) Contractor shall implement security requirements specified by the Federal Information Security Modernization Act (FISMA) for the relevant covered contractor information systems. Contractor shall implement controls from NIST Special Publication 800-53 Rev. 4 and any subsequent updates as recommended for the [select: low, medium, high] security categorization and in accordance with all FRTIB FISMA Baseline Policies, and the agency’s implementation of the NIST Risk Management Framework.

Deviations from the agency’s FISMA policies must be approved by the CISO and an Authority to Operate must be maintained on an ongoing basis.

(b) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place. (End of Clause)

H.4 Cloud Computing Services (JULY 2020)

(a) Definitions. As used in this clause—

“Authorizing official,” means the senior Federal official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

“Cloud computing” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Government data” means any information, document, media, or machine-readable material regardless of physical form or characteristics, which is created or obtained by the Government in the course of official Government business.

“Government-related data” means any information, document, media, or machine-readable material regardless of physical form or characteristics that is created or obtained by a contractor through the storage, processing, or communication of Government data. This does not include contractor’s business records e.g., financial records, legal records etc. or data such as operating procedures, software coding or algorithms that are not uniquely applied to the Government data.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

“Spillage” security incident that results in the transfer of classified or controlled unclassified information onto an information system not accredited (i.e., authorized) for the appropriate security level.

(b) Cloud computing security requirements. The requirements of this clause are applicable when using cloud computing to provide information technology services in the performance of the contract.

(1) If the Contractor indicated in its offer that it “does not anticipate the use of cloud computing services in the performance of a resultant contract,” in response to provision H No. H.3__, Representation of Use of Cloud Computing, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract.

(2) The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at the time the solicitation is issued or as authorized by the Contracting Officer) found at http://iase.disa.mil/cloud_security/Pages/index.aspx, unless notified by the Contracting Officer that this requirement has been waived by the FRTIB Chief Information Officer.

(3) The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on FRTIB premises, unless the Contractor receives written notification from the Contracting Officer to use another location.

(4) All cloud computing service must meet security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/).

(c) Limitations on access to, and use and disclosure of Government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder.

(i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibitions and obligations.

(iii) These access, use, and disclosure prohibitions and obligations shall survive the expiration or termination of this contract.

(2) The Contractor shall use Government-related data only to manage the operational environment that supports the Government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

(d) Cloud computing services cyber incident reporting. The Contractor shall immediately report all actual or potential cyber incidents that are related to the cloud computing service provided under this contract. Reports shall be submitted to IncidentResponse@tsp.gov.

(e) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with instructions provided by the Contracting Officer.

(f) Media preservation and protection. When a Contractor discovers a cyber-incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in the cyber incident report (see section (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days unless directed otherwise by FRTIB CISO or CTO from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(g) Access to additional information or equipment necessary for forensic analysis. Upon request by FRTIB, the Contractor shall provide FRTIB with access to additional information or equipment that is necessary to conduct a forensic analysis.

(h) Cyber incident damage assessment activities. If FRTIB elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (f) of this clause.

(i) Records management and facility access.

(1) The Contractor shall provide the Contracting Officer all Government data and Government-related data in the format specified in the contract.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures.

(3) The Contractor shall provide the Government, or its authorized representatives, access to all Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, investigations, inspections, or other similar activities, as authorized by law or regulation.

(j) Notification of third-party access requests. The Contractor shall notify the Contracting Officer promptly of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contracting Officer to take all measures to protect Government data and Government-related data from any unauthorized disclosure.

(k) Spillage. Upon notification by the Government of a spillage, or upon the Contractor’s discovery of a spillage, the Contractor shall promptly notify the Contracting Officer and cooperate with the Contracting Officer to address the spillage in compliance with agency procedures.

(l) Subcontracts. The Contractor shall include this clause, including this paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial items. (End of Clause)

H.5 System Development/Engineering Lifecycle (JULY 2020)

(a) Contractor shall implement a System Development Life Cycle (SDLC) or System Engineering Life Cycle (SELC) to manage systems, applying cyber resiliency design principles, constructs, and concepts from NIST Special Publication 800-160 and its associated volumes. Contractor shall attest that all systems have a documented SDLC and provide FRTIB with documentation on an annual basis.

(b) The SDLC/SELC must be designed to receive and incorporate from FRTIB the necessary security requirements, including those outlined in NIST Special Publication 800-53a Rev. 4, control SA-4. (End of Clause)

H.6 Cyber Incident Reporting (JULY 2020)

(a) Definitions. As used in this clause—

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system. “Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which controlled unclassified Information is recorded, stored, or printed within a covered contractor information system.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a Breach or within one

(1) hour of determining with reasonable certainty that there has been an incident or a Breach involving FRTIB data."

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor information system or the controlled unclassified information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to identify and report an incident or breach.

(iii) Conduct a review for evidence of compromise of Controlled Unclassified Information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts, in identifying what information was or may have been accessed and by whom, creating timelines of user activity, determining methods and techniques used to access federal information, and identifying the attack vector.

This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident or breach, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised Controlled Unclassified Information, or that affect the Contractor’s ability to provide operationally critical support.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for FRTIB and shall include, at a minimum, the required elements in accordance with FRTIB Cyber Incident Response Policy and Procedures.

(c) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to FRTIB CIO in accordance with instructions provided by the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(d) Media preservation and protection. When a Contractor discovers a cyber incident or breach has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (b)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(e) Cyber incident damage assessment activities. The Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(f) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(g) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(h) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified Information, including subcontracts for commercial items, without alteration, except to identify the parties.

The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to provide the incident report number assigned by the Security Operations Center or Computer Security Incident Response Team (CSIRT), to the prime Contractor (or next higher tier subcontractor) as soon as practicable, when reporting a cyber-incident to FRTIB as required in paragraph (b) of this clause. (End of Clause)

H.7 Records Management Obligations (JULY 2020)

(a) “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

(b) The term Federal record:

(1) Includes Agency records.

(2) Does not include personal materials.

(3) Applies to records created, received, or maintained by Contractors pursuant to their Agency contract.

(4) May include deliverables and documentation associated with deliverables.

(c) Requirements

(1) Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. Contractor employees may be required to take role based privacy training as provided by FRTIB.

(2) In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters

21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) FRTIB and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FRTIB or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the FRTIB Contracting Officer and COR. The agency must report promptly to NARA in accordance with 36

CFR 1230.

(5) The Contractor shall immediately notify the appropriate Contracting Officer and COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract vehicle. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FRTIB control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer and COR or address prescribed in the contract vehicle. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

(6) The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FRTIB guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

(7) The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FRTIB policy.

(8) The Contractor shall not create or maintain any records containing any non-public Agency information that are not specifically tied to or authorized by the contract.

(9) The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

(10) The FRTIB owns unrestricted and unlimited rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S.