HC101321QA072.v0.pdf

PDF 87 KB Posted Dec 10, 2020

Attached to: SUBMIT A QUOTE TO PROVIDE, INSTALL, AND MAINTAIN A NEW 100MB ETHERNET LEASED ACCESS CIRCUIT ON THE IQO (BULLETIN BOARD) CONTRACT BETWEEN BLDG 3650, RM 306, 4255 IH 5N, SAN ANTONIO, TX 78219 AND BLDG 2225, 2ND FLOOR, 1508 STANLEY ROAD, FT SAM HOUSTON, TX 78
Solicitation number: HC101321QA072
Issued by: Defense Information Systems Agency

View the file

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

IQO INQUIRY

FM: PL8211

TO: Contractors

DATE (MM/DD/YYYY): 12/10/2020

SUBJECT: HC101321QA072

A. TYPE ACTION: START

1. PURPOSE: 1. SUBMIT A QUOTE TO PROVIDE, INSTALL, AND MAINTAIN A NEW 100MB

ETHERNET LEASED ACCESS CIRCUIT ON THE IQO (BULLETIN BOARD) CONTRACT

BETWEEN BLDG 3650, RM 306, 4255 IH 5N, SAN ANTONIO, TX 78219 AND BLDG 2225, 2ND

FLOOR, 1508 STANLEY ROAD, FT SAM HOUSTON, TX 78234-5054

THIS REQUIREMENTS HAS THE BELOW MANDATORY TECHNICAL REQUIREMENTS:

-CONTRACTORS MUST COMPLY WITH TESTING & ACCEPTANCE REQUIREMENTS

- VENDOR QUOTE MUST INCLUDE THE A LOC AND Z LOC LEC’S ALONG WITH THE

VENDOR’S SUB-CONTRACTOR/LONG-HAUL PROVIDER/CARRIERS FOR THE SERVICE

-VENDOR QUOTES MUST INDICATE IF LEC’S ARE CURRENTLY ON-NET OR IF A BUILD IS

REQUIRED TO COMPLETE THE SERVICE.

- IF A BUILD IS REQUIRED TO COMPLETE THE SERVICE, VENDOR MUST INDICATE THE

SCOPE OF THE BUILD (LENGTH, BURIED/AERIAL, TRENCHING/DIRECTIONAL BORING, NEW

CONDUIT, ETC), AND VENDOR MUST INDICATE IF THE SITE HAS GRANTED PERMISSION

FOR VENDOR TO BUILD INTO THE SITE (MUST ALSO PROVIDE THE SITE POC’S NAME THAT

GRANTED PERMISSION) AND HAS SUFFICIENT SPACE, POWER AND HVAC CAPACITY TO

SUPPORT THE VENDOR EQUIPMENT AND CABLING

- SEE UNIQUE INSTALLATION FACTORS AND TESTING REQUIREMENTS

- CUSTOMER REQUESTS SOONER IF POSSIBLE SERVICE DATE (SIP)

2. CONTRACTORS ARE RESPONSIBLE FOR READING AND ADDRESSING ALL TECHNICAL

REQUIREMENTS OF THIS SOLICITATION, READING AND AGREEING WITH THE STANDARD

PROVISIONS, PROVIDE PRICE QUOTATION IN ACCORDANCE WITH STANDARD PROVISION 4,

AND MEET THE REQUESTED SERVICE DATE.

3. THE SERVICE DATE TO BE MET IS: 26 APR 21 (SIP) TO COMPLY WITH PROCUREMENT

ACQUISITION LEAD TIME (PALT) FOR THIS TYPE OF SERVICE. THE GOVERNMENT

ASSUMES THAT CONTRACTORS HAVE CONSIDERED ALL ISSUES THAT MAY DELAY THE

DELIVERY OF SERVICE ON REQUESTED SERVICE DATE AND MAY CANCEL, TERMINATE,

OR REQUEST CONSIDERATION IAW STANDARD PROVISION 42 FOR FAILURE TO MEET

CONTRACTUAL SERVICE DATE OR COMPLY WITH ANY CONTRACT TERMS OR CONDITIONS.

HC101321QA072

4. CONTRACTORS MUST ENSURE THAT QUOTES SHALL INCLUDE SUFFICIENT DETAIL

FOR EFFECTIVE EVALUATION AND SHOULD NOT SIMPLY REPHRASE OR RESTATE THE

GOVERNMENT REQUIREMENTS. RATHER, CONTRACTORS MUST PROVIDE CONVINCING

RATIONALE TO ADDRESS HOW THEY INTEND TO MEET THE REQUIREMENT.

5. QUOTES MUST BE UPLOADED TO IDEAS.

If there are more than two locations, their information will be found in Attachment B to this Order.

B. ALLA NUMBER:

C. TSP AUTHORIZATION CODE/RESTORATION CODE: NA

D. DEMANDER'S CODE:

E. SERVICE DATE (MM/DD/YYYY): 4/26/2021

F. TYPE OF CIRCUIT:

1. BANDWIDTH/DATA RATE: 100 Megabits Per Second

2. SIGNALING MODE: No Signaling

G. LOCATION OF TERMINATION A:

1. ADDRESS: BLDG 36504255 IH 35NSAN ANTONIO, TX 78219

2. ROOM: 360

H. LOCAL PART A:

1. EXTENSION OF TELECOMMUNICATIONS SERVICE: All facilities between vendor's commercial communications interface point and termination location shall be provided by vendor. All cables shall be run in accordance with local site standards

2. INTERFACE: 1000BASELX, SM FIBER, SC CONNECTOR

3. DEMARK: BLDG 3650, RM 360

4255 IH 35N

SAN ANTONIO, TX 78219

4. NPA/NXX: 210/299

5. UNIQUE INSTALLATION FACTORS: FOR LOCAL COMMUNICATIONS UNIT: THE LOCAL

COMM UNIT WILL EXTEND SERVICE FROM THE COMMERCIAL DEMARC TO THE SERVICE

DELIVERY POINT (SDP).

FOR CIRCUIT ACTIVATION ASSISTANCE CONTACT DCP COMMERCIAL ACTIVATION TEAM

(CAT) AT D312-850-0820, 614-692-0820.

DISA REQUIRES THAT CIRCUIT VENDOR OBTAIN A SIGNATURE FROM A RESPONSIBLE

SITE POC CERTIFYING THAT THE VENDOR PROVIDED THE CONNECTIVITY AND THAT THE

CIRCUIT IS PROPERLY

TAGGED WITH CIRCUIT ID AND TSR NUMBER OR CCSD.

FOR THE VENDOR: VENDOR WILL DELIVER SERVICE TO THE COMMERCIAL DEMARC

IDENTIFIED IN THE DOCUMENT.

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: CPIWI-NO/CPIWM-NO

7. CONTACT: PRI: DERECK YOUNGBLOOD C210-867-9865

EMAIL: DERECK.D.YOUNGBLOOD.MIL@MAIL.MIL

ALT: RAY CAETANO C512-541-0002 OFFHRS 210-960-7131

EMAIL: RAYMOND.D.CAETANO.CTR@MAIL.MIL

I. TERMINATION EQUIPMENT A: CISCO ONS-15454 MSPP SONET MUX (VENDOR PROVIDED)

J. LOCATION OF TERMINATION B:

1. ADDRESS: BLDG 2221508 STANLEY ROADFT SAM HOUSTON, TX 78234-5054

2. ROOM: 2ND FLOOR

K. LOCAL PART B:

2. INTERFACE: 1000BASELX, SM FIBER, SC CONNECTOR

3. DEMARK: BLDG 2225, 2ND FLOOR

1508 STANLEY ROAD

FT SAM HOUSTON, TX 78234-5054

4. NPA/NXX:210/221

5. UNIQUE INSTALLATION FACTORS: FOR LOCAL COMMUNICATIONS UNIT: THE LOCAL

COMM UNIT WILL EXTEND SERVICE FROM THE COMMERCIAL DEMARC TO THE SERVICE

DELIVERY POINT (SDP).

FOR CIRCUIT ACTIVATION ASSISTANCE CONTACT DCP COMMERCIAL ACTIVATION TEAM

(CAT) AT D312-850-0820, C614-692-0820.

DISA REQUIRES THAT CIRCUIT VENDOR OBTAIN A SIGNATURE FROM A RESPONSIBLE

SITE POC CERTIFYING THAT THE VENDOR PROVIDED THE CONNECTIVITY AND THAT THE

CIRCUIT IS PROPERLY

TAGGED WITH CIRCUIT ID AND TSR NUMBER OR CCSD.

FOR THE VENDOR: VENDOR WILL DELIVER SERVICE TO THE COMMERCIAL DEMARC

IDENTIFIED IN THE DOCUMENT.

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: CPIWI-NO/CPIWM-NO

7. CONTACT: PRI: CARLOS SANTILLAN, D420-7523, C210-808-7523

EMAIL: CARLOS.SANTILLAN1.CIV@MAIL.MIL

ALT: DAVID TENIENTE, D420-6968, C210-808-6968

EMAIL: DAVID.S.TENIENTE.CIV@MAIL.MIL

ALT: JOHNNY CASTILLO, D420-6969, C210-808-6969

EMAIL: JOHNNY.F.CASTILLO.CIV@MAIL.MIL

ORG EMAIL: USARMY.JBSA.106-SIG-BDE.MBX.FSH-NEC-CIR

CUIT-ACTIONS@MAIL.MIL

L. TERMINATION EQUIPMENT B: COMMERCIAL DEMARC

M. ADDITIONAL INFORMATION:

1. DITCO CSA NUMBER:

2. BASIC AGREEMENT NUMBER: TBD

3. TSR NUMBER: XA19DEC196252A

4. CCSD: UPNG7LLL

5. DIVERSITY REQUIREMENTS: NA

6. LOCATIONS TO BE AVOIDED: N/A

7. TRANSMISSION MEDIA TO BE AVOIDED: N/A

8. NETWORKS TO BE AVOIDED: N/A

9. CIRCUIT PARAMETERS: SEE TESTING REQUIREMENTS

10. TESTING REQUIREMENTS: VENDOR WILL PERFORM ACCEPTANCE TESTING IN

ACCORDANCE WITH EITHER RFC-6815 OR ITU-T Y.1564. VENDOR MUST TEST THE CIRCUIT

FOR 24 HOURS IAW ITU-T.Y.1564 SPECIFICALLY, FRAME SIZES OF 64,128,256,512,1024,1280

AND 1518 BYTES MUST BE USED. THE TEST MUST VERIFY LENGTH OF RECEIVED FRAMES,

INDICATE NUMBER OF FRAMES DROPPED, NUMBER OF FRAMES RECEIVED OUT OF

ORDER, AND DUPLICATE FRAMES. TESTS MUST BE BI-DIRECTIONAL USING THE SAME

DATA RATE IN EACH DIRECTION. BURST TESTS MUST BE RUN TO DETERMINE MINIMUM

INTERVAL BETWEEN FRAMES THAT CAN BE PROCESSED WITHOUT FRAME LOSS.A

THROUGHPUT TEST IS REQUIRED INDICATING THE FASTEST RATE AT WHICH TEST

FRAMES CAN BE TRANSMITTED WITHOUT FRAME LOSS. A SEPARATE THROUGHPUT

TEST MUST BE RUN WITH FRAMES ADDRESSED TO THE HARDWARE BROADCAST

ADDRESS CONSTITUTING AT LEAST 1% OF THE TEST STREAM AND BE EVENLY

DISTRIBUTED THROUGHOUT THE TEST. A LATENCY TEST MUST BE RUN FOR A PERIOD

OF NO LESS THAN 120 SECONDS, AND REPEATED NO LESS THAT 20 TIMES. THE TEST

STREAM FOR THE LATENCY TEST SHOULD BE RUN AT THE THROUGHPUT RATE FOR

CORRESPONDING FRAME SIZES FROM THE THROUGHPUT TEST. END TO END. LATENCY

WILL BE CALCULATED AS THE AVERAGE OVER THE 20 TEST RUNS. FRAME LOSS RATE

TESTS SHOULD BE RUN AT THE FRAME RATE CORRESPONDING TO THE MAXIMUM FRAME

RATE, AND REDUCED BY 10% INTERVALS UNTIL THERE ARE AT LEAST TWO CONSECUTIVE

RUNS IN WHICH NO FRAMES ARE LOST.THROUGHPUT TEST RESULTS: PASSING RATE

100% FOR ALL FRAME BYTE SIZES EXERCISED.FRAME LOSS RATE (%) RESULTS: FRAME

LOSS RATE LESS THAN 0.01% FOR ALL FRAME BYTE SIZES EXERCISED. LATENCY WILL BE

MEASURED WILL BE ACCORDING TO THE FOLLOWING MAXIMUM TRANSMISSION DELAY

FOR ANY CIRCUIT UP TO 500 MILES AIR-MILES IN LENGTH SHALL BE NO GREATER THAN

13MS ONE-WAY AND ANY POINT-TO-POINT CIRCUIT LONGER THAN 500 AIR-MILES SHALL

BE NO GREATER THAN 50MS ONE WAY WITHIN THE 48 CONTINENTAL STATES. ANY APS

SWITCHOVER SHALL TAKE LESS THAN 50 MILLISECONDS MONTHLY AVAILABILITY SHALL

BE NO LESS THAN 99.5%.

11. GOVERNMENT ACCEPTANCE ACTIVITY: SANANTON/C210-867-9865

12. SECURITY/ REQUIREMENTS: ESCORT REQUIRED

13. SITE ACCESS REQUIREMENTS: SECURITY CLEARANCE NOT REQUIRED. PLEASE

CONTACT SITE POC FOR BUILDING ACCESS AT LEAST 72 HOURS PRIOR TO SITE VISIT.

14. DITCO STANDARD PROVISIONS: Incorporated in full text below

V. QUOTE DUE DATE AND TIME (MM/DD/YYYY): 1/11/2021 4:00 PM America/Chicago

Z. DITCO CONTACT:

Donna Voss

DONNA.M.VOSS7.CIV@MAIL.MIL

Robert E Spencer

DITCO Contracting Officer

618-418-6181 robert.e.spencer.civ@mail.mil

Section G - Contract Administration Data

Included Clauses

G1 - Points of Contact - JUL 2018 Contracting Officer

Name: Robert E Spencer

Organization/Office Symbol: DISA/DITCO/PL8211

Phone No.: 618-418-6181

E-Mail Address: robert.e.spencer.civ@mail.mil

Contract Specialist

Name: Donna M Voss

Organization/Office Symbol: DISA/DITCO/PL8211

Phone No.: 618-418-6877

E-Mail Address: donna.m.voss7.civ@mail.mil

COR/Mission Partner Point of Contact (Note: To be filled in upon contract award) Name:

Organization/Office Symbol: Phone No.:

E-Mail Address:

Contractor Point of Contact Contractor Legal Business Name: DUNS:

CAGE CODE: Contractor POC: E-Mail Address: Phone Number: Fax Number:

(End of text)

Standard Provisions

252.204-7016 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services—Representation - DEC 2019

(a) Definitions. As used in this provision, covered defense telecommunications equipment or services has the meaning provided in the clause 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM)

(https://www.sam.gov) for entities excluded from receiving federal awards for "covered defense telecommunications equipment or services".

(c) Representation. The Offeror represents that it [ ] does, [ ] does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

(End of provision)

252.204-7017 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services—Representation - DEC 2019 The Offeror is not required to complete the representation in this provision if the Offeror has represented in the provision at

252.204-7016, Covered Defense Telecommunications Equipment or Services--Representation, that it "does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument."

(a) Definitions. Covered defense telecommunications equipment or services, covered mission, critical technology, and substantial or essential component, as used in this provision, have the meanings given in the 252.204-7018 clause, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services, of this solicitation.

(b) Prohibition. Section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits agencies from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

(d) Representation. If in its annual representations and certifications in SAM the Offeror has represented in paragraph (c) of the provision at 252.204-7016, Covered Defense Telecommunications Equipment or Services--Representation, that it "does" provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument, then the Offeror shall complete the following additional representation:

The Offeror represents that it [ ] will [ ] will not provide covered defense telecommunications equipment or services as a part of its offered products or services to DoD in the performance of any award resulting from this solicitation.

(e) Disclosures. If the Offeror has represented in paragraph (d) of this provision that it "will provide covered defense telecommunications equipment or services," the Offeror shall provide the following information as part of the offer:

(1) A description of all covered defense telecommunications equipment and services offered (include brand or manufacturer;

product, such as model number, original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable).

(2) An explanation of the proposed use of covered defense telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition referenced in paragraph (b) of this provision.

(3) For services, the entity providing the covered defense telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known).

(4) For equipment, the entity that produced or provided the covered defense telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

252.204-7018 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services - DEC 2019

(a) Definitions. As used in this clause--

Covered defense telecommunications equipment or services means--

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate of such entities;

(2) Telecommunications services provided by such entities or using such equipment; or

(3) Telecommunications equipment or services produced or provided by an entity that the Secretary of Defense reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Covered foreign country means--

(1) The People's Republic of China; or

(2) The Russian Federation.

Covered missions means--

(1) The nuclear deterrence mission of DoD, including with respect to nuclear command, control, and communications, integrated tactical warning and attack assessment, and continuity of Government; or

(2) The homeland defense mission of DoD, including with respect to ballistic missile defense.

"Critical technology" means--

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms

Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration

Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled--

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part

73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50

U.S.C. 4817).

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. In accordance with section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91), the contractor shall not provide to the Government any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless the covered defense telecommunication equipment or services are covered by a waiver described in Defense Federal Acquisition Regulation Supplement 204.2104.

(c) Procedures. The Contractor shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service, to carry out covered missions, that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

(d) Reporting.

(1) In the event the Contractor identifies covered defense telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, the Contractor shall report at https://dibnet.dod.mil the information in paragraph (d)(2) of this clause.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within one business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered defense telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

(End of clause)

252.204-7019 - Notice of NIST SP 800-171 DoD Assessment Requirements - NOV 2020

(a) Definitions.

"Basic Assessment", "Medium Assessment", and "High Assessment" have the meaning given in the clause 252.204-7020, NIST

SP 800-171 DoD Assessments.

"Covered contractor information system" has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-

7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The

Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment

Methodology located at https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance Risk System (SPRS)

(https://www.sprs.csd.disa.mil/) for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and submit a Basic

Assessment to webptsmh@navy.mil for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic

Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the Offeror shall use the following format for the report:

System Security Plan

CAGE Codes supported by this plan

Brief description of the plan architecture

Date of assessment

Total Score

Date score of 110 will achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to

SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense

Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance

Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

252.204-7020 - NIST SP 800-171 DoD Assessment Requirements - NOV 2020

(a) Definitions.

"Basic Assessment" means a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 that--

(1) Is based on the Contractor's review of their system security plan(s) associated with covered contractor information system(s);

(2) Is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology; and

(3) Results in a confidence level of "Low" in the resulting score, because it is a self-generated score.

"Covered contractor information system" has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, of this contract.

"High Assessment" means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing

Security Requirements for Controlled Unclassified Information that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review;

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP 800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "High" in the resulting score.

"Medium Assessment" means an assessment conducted by the Government that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "Medium" in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition

Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment

Methodology at https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-

171.html, if necessary.

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS)

(https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. A contractor may submit, via encrypted email, summary level scores of Basic Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology to webptsmh@navy.mil for posting to SPRS.

(i) The email shall include the following information:

(A) Version of NIST SP 800-171 against which the assessment was conducted.

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(ii) If multiple system security plans are addressed in the email described at paragraph (b)(1)(i) of this section, the Contractor shall use the following format for the report:

System Security Plan

CAGE Codes supported by this plan

Brief description of the plan architecture

Date of assessment

Total Score

Date score of 110 will achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to

SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense

Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(e) Rebuttals.

(1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS (see SPRS User's

Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility.

(1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance

Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items).

(2) The Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST

SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment, as described in https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST_SP_800-171.html, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.

(3) If a subcontractor does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than

3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the subcontractor may conduct and submit a

Basic Assessment, in accordance with the NIST SP 800-171 DoD Assessment Methodology, to webptsmh@navy.mil for posting to SPRS along with the information required by paragraph (d) of this clause.

252.222-7999 - Combating Race and Sex Stereotyping (DEVIATION 2021-O0001) - NOV

(a) Definitions. As used in this clause--

"Race or sex scapegoating" means assigning fault, blame, or bias to a race or sex, or to members of a race or sex because of their race or sex.

"Race or sex stereotyping" means ascribing character traits, values, moral and ethical codes, privileges, status, or beliefs to a race or sex, or to an individual because of his or her race or sex.

(b) Exemptions. The exemptions that apply to Executive Order (E.O.) 11246 (see FAR 22.807) also apply to E.O. 13950 and the requirements of this clause.

(c) Compliance with E.O. 13950, Combating Race and Sex Stereotyping. Unless exempted under paragraph (b) of this clause, the Contractor shall not use any workplace training that inculcates in its employees any form of race or sex stereotyping or any form of race or sex scapegoating, including the concepts that--

(1) One race or sex is inherently superior to another race or sex;

(2) An individual, by virtue of his or her race or sex, is inherently racist, sexist, or oppressive, whether consciously or unconsciously;

(3) An individual should be discriminated against or receive adverse treatment solely or partly because of his or her race or sex;

(4) Members of one race or sex cannot and should not attempt to treat others without respect to race or sex;

(5) An individual's moral character is necessarily determined by his or her race or sex;

(6) An individual, by virtue of his or her race or sex, bears responsibility for actions committed in the past by other members of the same race or sex;

(7) Any individual should feel discomfort, guilt, anguish, or any other form of psychological distress on account of his or her race or sex; or

(8) Meritocracy or traits such as a hard work ethic are racist or sexist, or were created by a particular race to oppress another race.

(d) Notice. The Contractor shall send, to each labor union or representative of workers with which it has a collective bargaining agreement or other contract or understanding, the notice provided below advising the labor union or workers' representative of the Contractor's commitments under this clause, and post copies of the notice in conspicuous places available to employees and applicants for employment.

NOTICE

E.O. 13950, Combating Race and Sex Stereotyping

Employers Holding Federal Contracts or Subcontracts

Contractors shall not use any workplace training that inculcates in its employees any form of race or sex stereotyping or any form of race or sex scapegoating, including the following concepts that--