HC101322QA442.v1.pdf

IQO INQUIRY

FM: PL8211

TO: Contractors

DATE (MM/DD/YYYY): 7/28/2022

SUBJECT: HC101322QA442

A. TYPE ACTION: START

1. PURPOSE: 1. SUBMIT A QUOTE TO PROVIDE, INSTALL, AND MAINTAIN A NEW LEASED

1GB ETHERNET LEASED CUSTOMER CIRCUIT

ON THE IQO (BULLETIN BOARD) BETWEEN (BLDG) 39; (RM) 1; (FL) 1ST; JEFFERSON

BARRACKS, 39 KEARNEY ST, SAINT LOUIS, MO (JFFRSNBK/CCI)

AND (BLDG) P5; (RM) 138; (FL) 1ST; 411B POW-MIA DRIVE, SCOTT AFB, IL 62225-6345

(SCOTTAFB/CCI).

THIS REQUIREMENTS HAS THE BELOW MANDATORY TECHNICAL REQUIREMENTS:

-CONTRACTORS MUST COMPLY WITH TESTING & ACCEPTANCE REQUIREMENTS. (FOR

ETHERNET)

- OPTICAL ENGINEERING COORDINATION REQUIRED

- VENDOR MUST PROVIDE THE LONG HAUL CIRCUIT NO., LOCAL CIRCUIT IDENTIFIER AND

1-800 TRO

- SEE UNIQUE INSTALLATION FACTORS AND TESTING REQUIREMENTS

- CUSTOMER REQUESTS SOONER IF POSSIBLE SERVICE DATE (SIP)

2. CONTRACTORS ARE RESPONSIBLE FOR READING AND ADDRESSING ALL TECHNICAL

REQUIREMENTS OF THIS SOLICITATION, READING AND AGREEING WITH THE STANDARD

PROVISIONS, PROVIDE PRICE QUOTATION IN ACCORDANCE WITH STANDARD PROVISION 4,

AND MEET THE REQUESTED SERVICE DATE.

3. THE SERVICE DATE TO BE MET IS: 12 Dec 2022 (SIP) TO COMPLY WITH PROCUREMENT

ACQUISITION LEAD TIME (PALT) FOR THIS TYPE OF SERVICE. THE GOVERNMENT

ASSUMES THAT CONTRACTORS HAVE CONSIDERED ALL ISSUES THAT MAY DELAY THE

DELIVERY OF SERVICE ON REQUESTED SERVICE DATE AND MAY CANCEL, TERMINATE,

OR REQUEST CONSIDERATION IAW STANDARD PROVISION 42 FOR FAILURE TO MEET

CONTRACTUAL SERVICE DATE OR COMPLY WITH ANY CONTRACT TERMS OR CONDITIONS.

4. CONTRACTORS MUST ENSURE THAT QUOTES SHALL INCLUDE SUFFICIENT DETAIL

FOR EFFECTIVE EVALUATION AND SHOULD NOT SIMPLY REPHRASE OR RESTATE THE

GOVERNMENT REQUIREMENTS. RATHER, CONTRACTORS MUST PROVIDE CONVINCING

RATIONALE TO ADDRESS HOW THEY INTEND TO MEET THE REQUIREMENT.

5. VENDOR QUOTE MUST INCLUDE THE A LOC AND Z LOC LEC’S ALONG WITH THE

VENDOR’S SUB-CONTRACTOR/LONG-HAUL PROVIDER/CARRIERS FOR THE SERVICE -

HC101322QA442

VENDOR QUOTES MUST INDICATE IF LEC’S ARE CURRENTLY ON-NET OR IF A BUILD IS

REQUIRED TO COMPLETE THE SERVICE. - IF A BUILD IS REQUIRED TO COMPLETE THE

SERVICE, VENDOR MUST INDICATE THE SCOPE OF THE BUILD (LENGTH, BURIED/AERIAL,

TRENCHING/DIRECTIONAL BORING, NEW CONDUIT, ETC), AND VENDOR MUST INDICATE

IF THE SITE HAS GRANTED PERMISSION FOR VENDOR TO BUILD INTO THE SITE (MUST

ALSO PROVIDE THE SITE POC’S NAME THAT GRANTED PERMISSION) AND HAS SUFFICIENT

SPACE, POWER AND HVAC CAPACITY TO SUPPORT THE VENDOR EQUIPMENT AND

CABLING.

6. QUOTES MUST BE UPLOADED TO IDEAS.

If there are more than two locations, their information will be found in Attachment B to this Order.

B. ALLA NUMBER:

C. TSP AUTHORIZATION CODE/RESTORATION CODE: NA

D. DEMANDER'S CODE:

E. SERVICE DATE (MM/DD/YYYY): 12/12/2022

F. TYPE OF CIRCUIT:

1. BANDWIDTH/DATA RATE: 1 Gigabit

2. SIGNALING MODE: No Signaling

G. LOCATION OF TERMINATION A:

1. ADDRESS: BLDG: P5, RM 138; 1ST FLOOR411B POW-MIA DRIVESCOTT AFB, IL

62225-6345

2. ROOM: 138; 1 FL

H. LOCAL PART A:

1. EXTENSION OF TELECOMMUNICATIONS SERVICE: All facilities between vendor's commercial communications interface point and termination location shall be provided by vendor. All cables shall be run in accordance with local site standards

2. INTERFACE: GIGABIT ETHERNET; SNAP CLICK (SC); 1000BASE-LX;

3. DEMARK: (BLDG) P5; (RM) 138; (FL) 1ST; 411B POW-MIA DRIVE, SCOTT

AFB, IL 62225-6345

PRI: STEVE BOMMARITO, D576-5538/7999, C618-256-5538/7999

ALT: DONNA SHORT, D576-6175/7999, C618-256-6175/7999

4. NPA/NXX: 618/256

5. UNIQUE INSTALLATION FACTORS: 1. FOR THE VENDOR: VENDOR WILL DELIVER

SERVICE TO THE COMMERCIAL DEMARC IDENTIFIED IN THE DOCUMENT.

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: CPIWI-NO/CPIWM-NO

7. CONTACT: PRI: STEVE BOMMARITO, D576-5538/7999, C618-256-5538/7999

EMAIL: STEVEN.BOMMARITO@US.AF.MIL

ALT: DONNA SHORT, D576-6175/7999, C618-256-6175/7999

EMAIL: DONNA.SHORT@US.AF.MIL OR 375CS.SCBTCA@US.AF.MIL

ALT: MARK YOST, D576-6175/7999, C618-256-6175/7999

EMAIL: MARK.YOST.1@US.AF.MIL

ORG EMAIL: SCOTTCFP@US.AF.MIL

I. TERMINATION EQUIPMENT A: COMMERCIAL DEMARK

J. LOCATION OF TERMINATION B:

1. ADDRESS: BLDG39; RM 1; 1ST FLOORJEFFERSON BARRACKS, 39 KEARNEY STSAINT

LOUIS, MO

2. ROOM: 1; 1ST FL

K. LOCAL PART B:

1. EXTENSION OF TELECOMMUNICATIONS SERVICE: All facilities between vendor's commercial communications interface point and termination location shall be provided by vendor. All cables shall be run in accordance with local site standards

2. INTERFACE: GIGABIT ETHERNET; SNAP CLICK (SC); 1000BASE-LX;

3. DEMARK: (BLDG) 39; (RM) 1; (FL) 1ST;

JEFFERSON BARRACKS,

39 KEARNEY ST, SAINT LOUIS, MO

4. NPA/NXX:314/527

5. UNIQUE INSTALLATION FACTORS: A. VENDOR MUST TERMINATE CIRCUIT SINGLE

MODE FIBER "SC" CONNECTORS.

B. DISA REQUIRES THAT CIRCUIT VENDOR OBTAIN A SIGNATURE FROM A RESPONSIBLE

SITE POC CERTIFYING THAT THE VENDOR PROVIDED THE CONNECTIVITY AND THAT THE

CIRCUIT IS PROPERLY TAGGED WITH CIRCUIT ID AND TSR NUMBER OR CCSD.

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: CPIWI-NO/CPIWM-NO

7. CONTACT: (PMRY POC) MASTER SERGEANT (AIR FORCE, MARINE) THOMAS

SEPER; (CMCL) 314-527-8703

(UNCLASS ORG) THOMAS.SEPER@US.AF.MIL

(ALT POC) TECHNICAL SERGEANT AIR FORCE STEPHEN D

BRADLEY; (CMCL) 314-527-8693; (DSN) 824-8693

(UNCLASS ORG) STEPHEN.D.BRADLEY18.MIL@MAIL.MIL

(PMRY TECH POC) STAFF SERGEANT (AIR FORCE, MARINE)

MATTHEW MILLER; (CMCL) 314-527-8697

(UNCLASS ORG) MATTHEW.MILLER.161@US.AF.MIL

L. TERMINATION EQUIPMENT B: COMMERCIAL DEMARK

M. ADDITIONAL INFORMATION:

1. DITCO CSA NUMBER:

2. BASIC AGREEMENT NUMBER: TBD

3. TSR NUMBER: CN20JUN225148

4. CCSD: DPNG7XMX

5. DIVERSITY REQUIREMENTS: NA

6. LOCATIONS TO BE AVOIDED: N/A

7. TRANSMISSION MEDIA TO BE AVOIDED: N/A

8. NETWORKS TO BE AVOIDED: N/A

9. CIRCUIT PARAMETERS: SEE TESTING REQUIREMENTS

10. TESTING REQUIREMENTS: VENDOR WILL PERFORM ACCEPTANCE TESTING IN

ACCORDANCE WITH EITHER RFC-6815 OR ITU-T Y.1564 FOR A DURATION OF 24 HOURS.

SPECIFICALLY, FRAME SIZES OF 64,128,256,512,1024,1280 AND 1518 BYTES MUST BE USED.

THE TEST MUST VERIFY LENGTH OF RECEIVED FRAMES, INDICATE NUMBER OF FRAMES

DROPPED, NUMBER OF FRAMES RECEIVED OUT OF ORDER, AND DUPLICATE FRAMES.

TESTS MUST BE BI-DIRECTIONAL USING THE SAME DATA RATE IN EACH DIRECTION.

BURST TESTS MUST BE RUN TO DETERMINE MINIMUM INTERVAL BETWEEN FRAMES

THAT CAN BE PROCESSED WITHOUT FRAME LOSS. A THROUGHPUT TEST IS REQUIRED

INDICATING THE FASTEST RATE AT WHICH TEST FRAMES CAN BE TRANSMITTED WITHOUT

FRAME LOSS.A SEPARATE THROUGHPUT TEST MUST BE RUN WITH FRAMES ADDRESSED

TO THE HARDWARE BROADCAST ADDRESS CONSTITUTING AT LEAST 1% OF THE TEST

STREAM AND BE EVENLY DISTRIBUTED THROUGHOUT THE TEST. A LATENCY TEST

MUST BE RUN FOR A PERIOD OF NO LESS THAN 120 SECONDS, AND REPEATED NO LESS

THAT 20 TIMES. THE TEST STREAM FOR THE LATENCY TEST SHOULD BE RUN AT THE

THROUGHPUT RATE FOR CORRESPONDING FRAME SIZES FROM THE THROUHPUT TEST.

END TO END LATENCY WILL BE CALCULATED AS THE AVERAGE OVER THE 20 TEST RUNS.

FRAME LOSS RATE TESTS SHOULD BE RUN AT THE FRAME RATE CORRESPONDING TO

THE MAXIMUM FRAME RATE, AND REDUCED BY 10% INTERVALS UNTIL THERE ARE AT

LEAST TWO CONSECUTIVE RUNS IN WHICH NO FRAMES ARE LOST. TROUGHPUT TEST

RESULTS: PASSING RATE 100% FOR ALL FRAME BYTER. THE AGENCY REQUESTING THE

SERVICE PRIOR TO DISA FINALIZING THE REQUIREMENT. DISCLAIMER: IF YOU CHANGE

THE TYPE OF SERVICE, BANDWIDTH, OR SERVICE POINTS (GEOLOC CODE), THEN THE

TR IS REROUTED TO THE DISA ENGINEERING OFFICE.; COMMENTS: FUNDING PROVIDED

BY CUSTOMER PDCFRAME LOSS RATE (%) RESULTS: FRAME LOSS RATE LESS THAN

0.01% FOR ALL FRAME BYTE SIZES EXERCISED. LATENCY WILL BE MEASURED WILL BE

ACCORDING TO THE FOLLOWING MAXIMUM TRANSMISSION DELAY FOR ANY CIRCUIT UP

TO 500 MILES AIR-MILES IN LENGTH SHALL BE NO GREATER THAN 13MS ONE-WAY AND

ANY POINT-TO-POINT CIRCUIT LONGER THAN 500 AIR-MILES SHALL BE NO GREATER THAN

50MS ON WAY WITHIN THE 48 CONTINENTAL STATES.ANY APS SWITCHOVER SHALL TAKE

LESS THAN 50 MILLISECONDS. MONTHLY AVAILABILITY SHALL BE NO LESS THAN 99.5%.

11. GOVERNMENT ACCEPTANCE ACTIVITY: DISA/C703-681-8899

12. SECURITY/ REQUIREMENTS: SECURITY CLEARANCE NOT REQUIRED, VENDOR MUST

CONTACT SITE POC AT LEAST 72 HOURS PRIOR TO ANY SITE VISIT OR INSTALLATION.

13. SITE ACCESS REQUIREMENTS: ESCORT NOT REQUIRED, VENDOR MUST CONTACT

SITE POC AT LEAST 72 HOURS PRIOR TO SITE VISIT.

14. DITCO STANDARD PROVISIONS: Incorporated in full text below

V. QUOTE DUE DATE AND TIME (MM/DD/YYYY): 8/29/2022 4:00 PM America/Chicago

Z. DITCO CONTACT:

Tammy Basson

TAMMY.A.BASSON.CIV@MAIL.MIL

Robert E Spencer

DITCO Contracting Officer

618-418-6181 robert.e.spencer.civ@mail.mil

Section G - Contract Administration Data

Included Clauses

G1 - Points of Contact - MAY 2022

Contracting Officer

Name: Robert E. Spencer

Organization/Office Symbol: DISA/DITCO/PL8211

Phone No.: 618-418-6181

E-Mail Address: Robert.e.spencer.civ@mail.mil

Contract Specialist

Name: Tammy Basson

Organization/Office Symbol: DISA/DITCO/PL8211

Phone No.: 618-418-6871

E-Mail Address: tammy.a.basson.civ@mail.mil

COR/Mission Partner Point of Contact (Note: To be filled in upon contract award)

Name:

Organization/Office Symbol:

Phone No.:

E-Mail Address:

Contractor Point of Contact

Contractor Legal Business Name:

DUNS:

CAGE CODE:

Contractor POC:

E-Mail Address:

Phone Number:

Fax Number:

(End of text)

Standard Provisions

252.204-7016 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services—Representation - DEC 2019

(a) Definitions. As used in this provision, covered defense telecommunications equipment or services has the meaning provided in the clause 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

(b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM)

(https://www.sam.gov) for entities excluded from receiving federal awards for "covered defense telecommunications equipment or services".

(c) Representation. The Offeror represents that it [ ] does, [ ] does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument.

(End of provision)

252.204-7017 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services—Representation - MAY 2021

The Offeror is not required to complete the representation in this provision if the Offeror has represented in the provision at

252.204-7016, Covered Defense Telecommunications Equipment or Services--Representation, that it "does not provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument."

(a) Definitions. Covered defense telecommunications equipment or services, covered mission, critical technology, and substantial or essential component, as used in this provision, have the meanings given in the 252.204-7018 clause, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services, of this solicitation.

(b) Prohibition. Section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits agencies from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

(d) Representation. If in its annual representations and certifications in SAM the Offeror has represented in paragraph (c) of the provision at 252.204-7016, Covered Defense Telecommunications Equipment or Services--Representation, that it "does" provide covered defense telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument, then the Offeror shall complete the following additional representation:

The Offeror represents that it [ ] will [ ] will not provide covered defense telecommunications equipment or services as a part of its offered products or services to DoD in the performance of any award resulting from this solicitation.

(e) Disclosures. If the Offeror has represented in paragraph (d) of this provision that it "will provide covered defense telecommunications equipment or services," the Offeror shall provide the following information as part of the offer:

(1) A description of all covered defense telecommunications equipment and services offered (include brand or manufacturer;

product, such as model number, original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable).

(2) An explanation of the proposed use of covered defense telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition referenced in paragraph (b) of this provision.

(3) For services, the entity providing the covered defense telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known).

(4) For equipment, the entity that produced or provided the covered defense telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

252.204-7018 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services - JAN 2021

(a) Definitions. As used in this clause--

Covered defense telecommunications equipment or services means--

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate of such entities;

(2) Telecommunications services provided by such entities or using such equipment; or

(3) Telecommunications equipment or services produced or provided by an entity that the Secretary of Defense reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Covered foreign country means--

(1) The People's Republic of China; or

(2) The Russian Federation.

Covered missions means--

(1) The nuclear deterrence mission of DoD, including with respect to nuclear command, control, and communications, integrated tactical warning and attack assessment, and continuity of Government; or

(2) The homeland defense mission of DoD, including with respect to ballistic missile defense.

Critical technology means--

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in

Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration

Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled--

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50

U.S.C. 4817).

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. In accordance with section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91), the contractor shall not provide to the Government any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless the covered defense telecommunication equipment or services are covered by a waiver described in Defense Federal Acquisition Regulation Supplement 204.2104.

(c) Procedures. The Contractor shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service, to carry out covered missions, that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

(d) Reporting.

(1) In the event the Contractor identifies covered defense telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, the Contractor shall report at https://dibnet.dod.mil the information in paragraph (d)(2) of this clause.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within 3 business days from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 30 business days of submitting the information in paragraph (d)(2)(i) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered defense telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

(End of clause)

252.204-7019 - Notice of NIST SP 800-171 DoD Assessment Requirements - MAR 2022

(a) Definitions.

Basic Assessment, Medium Assessment, and High Assessment have the meaning given in the clause 252.204-7020, NIST SP

800-171 DoD Assessments.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-

7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The

Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment

Methodology located at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171.

(c) Procedures.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance Risk System (SPRS)

(https://www.sprs.csd.disa.mil/) for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and submit a Basic

Assessment to webptsmh@navy.mil for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic

Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph (d)(1)(i) of this section, the Offeror shall use the following format for the report:

Brief

CAGE codes description of Date of Total Date score of

System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity

Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product

Performance Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

252.204-7020 - NIST SP 800-171 DoD Assessment Requirements - MAR 2022

(a) Definitions.

Basic Assessment means a contractor's self-assessment of the contractor's implementation of NIST SP 800-171 that-

(1) Is based on the Contractor's review of their system security plan(s) associated with covered contractor information system(s);

(2) Is conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology; and

(3) Results in a confidence level of "Low" in the resulting score, because it is a self-generated score.

Covered contractor information system has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting, of this contract.

High Assessment means an assessment that is conducted by Government personnel using NIST SP 800-171A, Assessing

Security Requirements for Controlled Unclassified Information that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review;

(iii) Verification, examination, and demonstration of a Contractor's system security plan to validate that NIST SP 800-171 security requirements have been implemented as described in the contractor's system security plan; and

(iv) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "High" in the resulting score.

Medium Assessment means an assessment conducted by the Government that--

(1) Consists of--

(i) A review of a contractor's Basic Assessment;

(ii) A thorough document review; and

(iii) Discussions with the contractor to obtain additional information or clarification, as needed; and

(2) Results in a confidence level of "Medium" in the resulting score.

(b) Applicability. This clause applies to covered contractor information systems that are required to comply with the National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, in accordance with Defense Federal Acquisition

Regulation System (DFARS) clause at 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this contract.

(c) Requirements. The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment

Methodology at https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, if necessary.

(d) Procedures. Summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS)

(https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. A contractor may submit, via encrypted email, summary level scores of Basic Assessments conducted in accordance with the NIST SP 800-171 DoD Assessment Methodology to webptsmh@navy.mil for posting to SPRS.

(i) The email shall include the following information:

(A) Version of NIST SP 800-171 against which the assessment was conducted.

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract--

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than one plan exists.

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each requirement).

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(ii) If multiple system security plans are addressed in the email described at paragraph (b)(1)(i) of this section, the

Contractor shall use the following format for the report:

Brief

CAGE codes description of Date of Total Date score of

System security plan supported by this the plan assessment score 110 will plan architecture achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High Assessment summary level scores to SPRS for each system security plan assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity

Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on

(e) Rebuttals. (1) DoD will provide Medium and High Assessment summary level scores to the Contractor and offer the opportunity for rebuttal and adjudication of assessment summary level scores prior to posting the summary level scores to SPRS

(see SPRS User's Guide https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf).

(2) Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

(f) Accessibility.

(1) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance

Information (PI).

(2) Authorized representatives of the Contractor for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User's Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

(3) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this clause. DoD will retain and protect any such documentation as "Controlled Unclassified Information (CUI)" and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

(g) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (g), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items).

(2) The Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST

SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171

DoD Assessment, as described in https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.

(3) If a subcontractor does not have summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the subcontractor may conduct and submit a Basic

Assessment, in accordance with the NIST SP 800-171 DoD Assessment Methodology, to webptsmh@navy.mil for posting to SPRS along with the information required by paragraph (d) of this clause.

252.239-7098 - Prohibition on Contracting to Maintain or Establish a Computer Network

Unless Such Network is Designed to Block Access to Certain Websites—Representation

(Deviation 2021-O0003) - APR 2021

(a) In accordance with section 8116 of Division C of the Consolidated Appropriations Act, 2021 (Pub. L. 116-260), or any other

Act that extends to fiscal year 2021 funds the same prohibitions, none of the funds appropriated (or otherwise made available) by this or any other Act for DoD may be used to enter into a contract to maintain or establish a computer network unless such network is designed to block access to pornography websites. This prohibition does not limit the use of funds necessary for any

Federal, State, tribal, or local law enforcement agency or any other entity carrying out criminal investigations, prosecution, or adjudication activities, or for any activity necessary for the national defense, including intelligence activities.

(b) Representation. By submission of its offer, the Offeror represents that it is not providing as part of its offer a proposal to maintain or establish a computer network unless such network is designed to block access to pornography websites.

52.204-24 - Representation Regarding Certain Telecommunications and Video

Surveillance Services or Equipment - NOV 2021 The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services--Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Products or Commercial Services. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision--

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on

Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-

232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM)

(https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services".

(d) Representation. The Offeror represents that--

(1) It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that--

It [ ] does, [ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as

OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered

(include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as

OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered

(include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

52.204-25 - Prohibition on Contracting for Certain Telecommunications and Video

Surveillance Services or Equipment - NOV 2021

(a) Definitions. As used in this clause--

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered foreign country means The People's Republic of China.

Covered Telecommunications Equipment or Services means-

(1) Telecommunications equipment produced by Huawei Technologies company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera

Communications Corporation, Hangzhou Hikvision Digital Technology company, or Dahua Technology company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the Government of a Covered foreign country.

critical technology means-

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration

Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled-

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, Materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018

(50 U.S.C. 4817).

Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of Covered Telecommunications Equipment or Services used by the entity that excludes the need to include an internal or third-party audit.

Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high.

substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain national defense authorization Act for fiscal year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses Covered Telecommunications Equipment or Services as a substantial or essential component of any system, or as critical technology as part of any system. The contractor is prohibited from providing to the Government any equipment, system, or service that uses Covered Telecommunications

Equipment or Services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104.

(2) Section 889(a)(1)(B) of the John S. McCain national defense authorization Act for fiscal year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses Covered Telecommunications Equipment or

Services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of Covered Telecommunications Equipment or Services, regardless of whether that use is in performance of work under a Federal contract.

(c) Exceptions. This clause does not prohibit contractors from providing--

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements;

or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement.

(1) In the event the contractor identifies Covered Telecommunications Equipment or Services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the contractor is notified of such by a subcontractor at any tier or by any other source, the contractor shall report the information in paragraph

(d)(2) of this clause to the contracting officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the contractor shall report to the contracting officer for the indefinite delivery contract and the contracting officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The contractor shall report the following information pursuant to paragraph (d)(1) of this clause

(i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier Unique Entity Identifier (if known); supplier Commercial and Government Entity

(CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the contractor shall describe the efforts it undertook to prevent use or submission of Covered Telecommunications Equipment or Services, and any additional efforts that will be incorporated to prevent future use or submission of Covered Telecommunications Equipment or Services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e) and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services.

52.204-26 - Covered Telecommunications Equipment or Services-Representation - OCT

(a) Definitions. As used in this provision, "covered telecommunications equipment or services" and "reasonable inquiry" have the meaning provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video

Surveillance…