HC102120PA072 - GNET000008EBM.v0.pdf

ORDER

IQO CONTRACT

FM: PL52

TO: GULFNET COMMUNICATIONS - SJH75

DATE (MM/DD/YYYY): 8/6/2020

SUBJECT: HC102120PA072

A. TYPE ACTION: START

1. PURPOSE: Start a Start a DISN 10MPS MPLS layer 2 circuit between Al Dhafra, UAE to the US Embassy in Abu Dhabi, UAE.

2. TP shall submit detailed circuit/path connectivity diagrams (.pdf format) that identifies all points of presence and repeater points as final record of the installed path.

3. The service date is August 16, 2020, but not later than six (6) weeks after receipt of order.

Customer will accept soonest possible service date.

4. TP shall conduct a kick-off teleconference meeting within 10 business days after task order award with DITCO, COR, and local POCs. If there are more than two locations, their information will be found in Attachment B to this Order.

B. ALLA NUMBER:

C. TSP AUTHORIZATION CODE:

D. DEMANDER'S CODE:

E. SERVICE DATE (MM/DD/YYYY): 8/16/2020

F. TYPE OF CIRCUIT/BANDWIDTH/DATA RATE: 10 Megabits Per Second

G. LOCATION OF TERMINATION A:

1. ADDRESS: 2328; 380 ECS/SCOIA, AL DHAFRA AB, AELONGITUDE: 0543200ELATITUDE:

241400N

2. ROOM: 110; 1 FL

H. LOCAL PART A:

1. EXTENSION OF TELECOMMUNICATIONS SERVICE: All facilities between vendor's commercial communications interface point and termination location shall be provided by vendor. All cables shall be run in accordance with local site standards

2. INTERFACE: 10/100/1000BASELX, SM Fiber, SC Connector

3. DEMARK: BLDG110; 1 FL 2328; 380 ECS/SCOIA,

HC102120PA072 / GNET000008EBM

AL DHAFRA AB, AE

LONGITUDE: 0543200E

LATITUDE: 241400N

4. NPA/NXX:

5. UNIQUE INSTALLATION FACTORS:

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: INSIDE WIRE INSTL/MAINT:

CPIWI-YES/CPIWM-YES

7. CONTACT: (PMRY POC) Mr. Jason Muir

380ECS.CIRCUIT.ACTIONS@ADAB.AFCENT.AF.MIL; JASON.MUIR.CTR@ADAB.AFCENT.AF.MIL

(CMCL) 971-02-504-6801X4342150

I. TERMINATION EQUIPMENT A: (A) CISCO 9010 IPT-PE ASR ROUTER (DISA PROVIDED)

J. LOCATION OF TERMINATION B:

1. ADDRESS: UNITED STATES EMBASSY,AIRPORT ROAD AT RABDAN 29TH STREET, ABU

DHABI, UNITED ARAB EMIRATES

2. ROOM: DEMARC ROOM

K. LOCAL PART B:

1. EXTENSION OF TELECOMMUNICATIONS SERVICE: All facilities between vendor's commercial communications interface point and termination location shall be provided by vendor. All cables shall be run in accordance with local site standards

2. INTERFACE: RJ-45

3. DEMARK: UNITED STATES EMBASSY,

AIRPORT ROAD AT RABDAN 29TH STREET,

ABU DHABI, UNITED ARAB EMIRATES

4. NPA/NXX:

5. UNIQUE INSTALLATION FACTORS: FOR CIRCUIT ACTIVATION ASSISTANCE OR

SERVICE IMPLEMENTATION INQUIRIES/SCHEDULING, CONTACT THE DISA CONUS

GLOBAL RF ACTIVATIONS TEAM VIA EMAIL, DISA.SCOTT.CONUS.MBX.RF-CIRCUIT-

ACTIVATIONS@MAIL.MIL, OR CALL DSN 418-8627, COML 618-418-8627.

6. INSIDE WIRE INSTALLATION/MAINTENANCE REQUIRED: CPIWI-Yes/CPIWM-Yes

7. CONTACT: FOR SITE QUESTIONS AND ACCESS:

PRI: ROBERT GLUNT

GLUNTRD@STATE.GOV

OFFICE: +971-2-414-2380

MOBILE: +971-50-642-1392

GREGORY.BANDISH@WHMO.MIL

ALT: TYLER HAMMOND

OFFICE: 202-757-2597

MOBILE: 202-814-9560

TYLER.HAMMOND@WHMO.MIL

ORG: MEMBERSWHCAWACCTELCOMHOS@WHMO.MIL

L. TERMINATION EQUIPMENT B:

M. ADDITIONAL INFORMATION:

1. CSA NUMBER: GNET000008EBM

2. BASIC AGREEMENT NUMBER: HC102119H2014

3. TSR NUMBER: DO01FEB190104

4. CCSD: WIPDZBU0

5. DIVERSITY REQUIREMENTS: N/A

6. LOCATIONS TO BE AVOIDED: N/A

7. TRANSMISSION MEDIA TO BE AVOIDED: Circuit must avoid Satellite Links, Terrestrial Fiber is the preferred path.

8. NETWORKS TO BE AVOIDED: N/A

9. CIRCUIT PARAMETERS: Monthly availability shall be no less than 99.95%.

10. TESTING REQUIREMENTS: All Ethernet except jumbo frame, vendors/telecommunication provider (TP) shall perform acceptance testing in accordance with RFC 2544. If optical fiber is used a delivery method testing must be done in accordance with either RFC 6815 or ITU-T Y.1564. Testing shall be conducted for 24 hours with all results provided. Tests covered in sections 9.1, 10, 11.1, 14, 20, 21, 26.1, 26.2, and 26.3 of the RFC 2544 must be performed and results reported in the format specified by the RFC. Specifically, frame sizes of 64, 128, 256, 512, 1024, 1280 and 1518 bytes must be used. The test must verify length of received frame indicate number of frame dropped, number of frame received out of order and duplicate frames.

Tests must be Bi-Directional using the same data rate in each direction. Burst test must be run to determine minimum interval between frames that can be processed without frame loss. A throughput test is required indicating the fastest rate at which test frames can be transmitted without frame loss. A separate throughput test must be run with frames addressed to the hardware broadcast address constituting at least 1% of the test stream and be evenly distributed throughout the test. A latency test must be run for a period of no less than 120 seconds and repeated no less than 20 times.

The test stream for the latency test should be run at the throughput test. End to end latency will be calculated as the average over the 20 test runs. Frame loss rate tests should be run at the frame rate corresponding to the maximum frame rate, and reduced by 10% intervals until there are at least two consecutive runs in which no frames are lost.

Throughput Test Results: passing rate 100% for all frame byte sizes exercised.

Frame Loss Rate (%) Results: frame loss rate less than 0.01% for all frame byte sizes exercised.

Latency, measured round-trip, will be according to the following guidelines:

within country, less than 25MS;

within Europe, less than 75MS;

outside Europe, less than 150MS.

Any APS switchover shall take less than 50 milliseconds.

11. GOVERNMENT ACCEPTANCE ACTIVITY: WHCA-NOSC/202-757-6001

12. SECURITY REQUIREMENTS: In accordance with site, all visitors must contact the site POCs for access at least 72 hours prior to any site visits.

13. SITE ACCESS REQUIREMENTS: For site access or questions, please contact the site POC.

14. STANDARD PROVISIONS: Incorporated in full text below

15. CHARGES: See Attachment

16. DITCO FUND CITE: 97X4930.5F20 000 C1013 0 068142 2F 233003

17. EXPIRATION DATE: Telecommunications service provided under this contract will continue until 60 months, unless sooner discontinued.

18. SIMULTANEOUS ACTION TSR NUMBER:

N. ADDRESS FOR SUBMISSION OF INVOICES: As per contract

Z. DITCO CONTACT:

Josefino Mascarenas

00973 1785 6228 josefino.t.mascarenas.ln@mail.mil

Anh T. Carlton

DITCO Contracting Officer

318-439-6229 anh.t.carlton.civ@mail.mil

Attachment A - CLINs and Charges

Currency: USD

CLIN/SLIN Item # Description Qty Unit NRC MRC EXT Price PoP From PoP To Location

0001 MRC -

Telecommuni cations

Services

8/16/2020 8/5/2025 ALDHFR

AB; 6CC;

AE

0001AA MRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE - Base

Year

1 LO $4,636.80 $4636.80 8/16/2020 8/15/2021 ALDHFR

AB; 6CC;

AE

0001AB MRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE - 2nd

Year

1 LO $4,636.80 $4636.80 8/16/2021 8/15/2022 ALDHFR

AB; 6CC;

AE

0001AC MRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE - 3rd

Year

1 LO $4,636.80 $4636.80 8/16/2022 8/15/2023 ALDHFR

AB; 6CC;

AE

0001AD MRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE - 4th

Year

1 LO $4,636.80 $4636.80 8/16/2023 8/15/2024 ALDHFR

AB; 6CC;

AE

0001AE MRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE - 5th

Year

1 LO $4,636.80 $4636.80 8/16/2024 8/5/2025 ALDHFR

AB; 6CC;

AE

0002 Non-

Recurring

Cost

8/5/2020 8/15/2020 ALDHFR

AB; 6CC;

AE

0002AA NRC -

Telecommuni cations

Services –

10MPS MPLS

Layer 2

Circuit from Al

Dhafra, UAE to US

Embassy, Abu Dhabi, UAE

1 LO $2,589.30 $2589.30 8/6/2020 8/15/2020 ALDHFR

AB; 6CC;

AE

Total EXT MRC: $4636.80 for POP from 8/16/2020 to 8/15/2021

Total EXT NRC: $2589.30

Section G - Contract Administration Data

Included Clauses

G1 - Points of Contact - JUL 2018 Contracting Officer

Name: Anh T. Carlton

Organization/Office Symbol: HC1021

Phone No.: 00973 1785 6229

E-Mail Address: Anh.T.Carlton.civ@mail.mil

Contract Specialist

Name: Donn Mascarenas

Organization/Office Symbol: HC1021

Phone No.: 00973 1785 6228

E-Mail Address: Josefino.T.Mascarenas.LN@mail.mil

Contractor Point of Contact Contractor Legal Business Name: Gulfnet Communications Co. W.L.L.

DUNS: 534728733

CAGE CODE: SJH75

Contractor POC: Tahseen Mubarak

E-Mail Address: t.mubarak@bonline.com.kw

Phone Number: +965 6960 0491

(End of text)

G23 - Outage Credits - Jul 2018

(a) Credits for outage (interruption) of service will be provided to the Government by the contractor in accordance with its tariff provisions. In the event such tariff provisions do not exist, the following schedule shall be used to determine the credit (one day equals 1/30th of the Monthly Recurring Charge (MRC)) due the Government during each monthly billing period:

INTERRUPTIONS OF 24 HOURS OR LESS (Not less than 30 Minutes)

None

30 Minutes but less than 3 Hours 1/8 Day

3 Hours but less than 6 Hours 1/4 Day

6 Hours but less than 9 Hours 1/3 Day

9 Hours but less than 12 Hours 1/2 Day

12 Hours but less than 24 Hours One Day

INTERRUPTIONS OVER 24 HOURS

Credit of 1/30th of the MRC (or the foreign dollar equivalent) for each day of outage until service is restored.

(b) Outage credits do not apply for:

1) Interruptions caused by the negligence of the Government or others authorized by the

Government to use the Government's service.

2) Interruptions due to the failure of power, equipment, systems or connections not provided by Contractor or subcontractors.

3) Interruptions during any period when the Government or User has released a private line service for maintenance or rearrangement purposes, or for the implementation of a

Government order.

4) Interruptions that continue because of the Government's failure to authorize replacement of any element of special construction. The period for which credit is not allowed begins on the seventh day after the Government receives the contractor's written notification of the need for such replacement. It ends on the day after receipt of the Government's written authorization for such replacement.

5) Interruptions during periods when the Government elects not to release the private line service for testing and/or repair.

6) An interruption, or group of interruptions, resulting from a common cause, for amounts less than $50.00 (or the foreign dollar equivalent).

(c) Outage credits will be due no later than the next Billing Cycle/Month following the outage. Each credit will identify the

Communication Service Authorization (CSA) and Commercial Circuit Number (CCN) as well as the time, date and duration of the outage/outages.

G24 - Contract Billing Dates for Services - JUL 2018 For invoicing purposes, the Effective Billing Date (EBD) is the date the contracted service is delivered to the Government in accordance with the contract and the Final Billing Date (FBD) is the date the Government requests the service to be discontinued via contract modification.

Section H - Special Contract Requirements

Included Clauses

H1 - Organizational and Consultant Conflicts of Interest (OCCI) - JUL 2018

(a) An offeror shall identify in its proposal, quote, bid or any resulting contract, any potential or actual Organizational and

Consultant Conflicts of Interest (OCCI) as described in FAR Subpart

9.5. This includes actual or potential conflicts of interests of proposed subcontractors. If an offeror identifies in its proposal, quote, bid or any resulting contract, a potential or actual conflict of interests the offeror shall submit an Organizational and

Consultant Conflicts of Interest Mitigation Plan to the contracting officer. The Organizational and Consultant Conflicts of Interest

Mitigation Plan shall describe how the offeror addresses potential or actual conflicts of interest and identify how they will avoid, neutralize, or mitigate present or future conflicts of interest.

(b) Offerors must consider whether their involvement and participation raises any OCCI issues, especially in the following areas when:

(1) Providing systems engineering and technical direction.

(2) Preparing specifications or work statements and/or objectives.

(3) Providing evaluation services.

(4) Obtaining access to proprietary information.

(c) If a prime contractor or subcontractor breaches any of the OCCI restrictions, or does not disclose or misrepresents any relevant facts concerning its conflict of interest, the government may take appropriate action, including terminating the contract, in additional to any remedies that may be otherwise permitted by the contract or operation of law.

Standard Provisions

252.203-7000 - Requirements Relating to Compensation of Former DoD Officials - SEP

(a) Definition. "Covered DoD official," as used in this clause, means an individual that--

(1) Leaves or left DoD service on or after January 28, 2008; and

(2)(i) Participated personally and substantially in an acquisition as defined in 41 U.S.C. 131 with a value in excess of $10 million, and serves or served--

(A) In an Executive Schedule position under subchapter II of chapter 53 of Title 5, United States Code;

(B) In a position in the Senior Executive Service under subchapter VIII of chapter 53 of Title 5, United States Code; or

(C) In a general or flag officer position compensated at a rate of pay for grade O-7 or above under section 201 of Title 37, United

States Code; or

(ii) Serves or served in DoD in one of the following positions: program manager, deputy program manager, procuring contracting officer, administrative contracting officer, source selection authority, member of the source selection evaluation board, or chief of a financial or technical evaluation team for a contract in an amount in excess of $10 million.

(b) The Contractor shall not knowingly provide compensation to a covered DoD official within 2 years after the official leaves

DoD service, without first determining that the official has sought and received, or has not received after 30 days of seeking, a written opinion from the appropriate DoD ethics counselor regarding the applicability of post-employment restrictions to the activities that the official is expected to undertake on behalf of the Contractor.

(c) Failure by the Contractor to comply with paragraph (b) of this clause may subject the Contractor to rescission of this contract, suspension, or debarment in accordance with 41 U.S.C. 2105(c).

(End of clause)

252.203-7002 - Requirement to Inform Employees of Whistleblower Rights - Sep 2013

(a) The Contractor shall inform its employees in writing, in the predominant native language of the workforce, of contractor employee whistleblower rights and protections under 10 U.S.C. 2409, as described in subpart 203.9 of the Defense Federal

Acquisition Regulation Supplement.

(b) The Contractor shall include the substance of this clause, including this paragraph (b), in all subcontracts.

252.203-7003 - Agency Office of the Inspector General - DEC 2012 The agency office of the Inspector General referenced in paragraphs (c) and (d) of FAR clause 52.203-13, Contractor Code of

Business Ethics and Conduct, is the DoD Office of Inspector General at the following address:

Department of Defense Office of Inspector General

Investigative Policy and Oversight

Contractor Disclosure Program

4800 Mark Center Drive, Suite 11H25

Alexandria, VA 22350-1500

Toll Free Telephone: 866-429-8011

252.204-7003 - Control Of Government Personnel Work Product - Apr 1992 The Contractor’s procedures for protecting against unauthorized disclosure of information shall not require Department of

Defense employees or members of the Armed Forces to relinquish control of their work products, whether classified or not, to the Contractor.

252.204-7009 - Limitations on the Use or Disclosure of Third-Party Contractor Reported

Cyber Incident Information - OCT 2016

(a) Definitions. As used in this clause--

"Compromise" means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

"Controlled technical information" means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD

Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

"Covered defense information" means unclassified controlled technical information or other information (as described in the

Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is--

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of

DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

"Cyber incident" means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

"Information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

"Media" means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

"Technical information" means technical data or computer software, as those terms are defined in the clause at DFARS

252.227-7013, Rights in Technical Data-Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Restrictions. The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract that is information obtained from a third-party's reporting of a cyber incident pursuant to DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (or derived from such information obtained under that clause):

(1) The Contractor shall access and use the information only for the purpose of furnishing advice or technical assistance directly to the Government in support of the Government's activities related to clause 252.204-7012, and shall not be used for any other purpose.

(2) The Contractor shall protect the information against unauthorized release or disclosure.

(3) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.

(4) The third-party contractor that reported the cyber incident is a third-party beneficiary of the non-disclosure agreement between the Government and Contractor, as required by paragraph (b)(3) of this clause.

(5) A breach of these obligations or restrictions may subject the Contractor to--

(i) Criminal, civil, administrative, and contractual actions in law and equity for penalties, damages, and other appropriate remedies by the United States; and

(ii) Civil actions for damages and other appropriate remedies by the third party that reported the cyber incident, as a third party beneficiary of this clause.

(c) Subcontracts. The Contractor shall include this clause, including this paragraph (c), in subcontracts, or similar contractual instruments, for services that include support for the Government's activities related to safeguarding covered defense information and cyber incident reporting, including subcontracts for commercial items, without alteration, except to identify the parties.

252.204-7012 - Safeguarding Covered Defense Information and Cyber Incident Reporting -

OCT 2016

"Adequate security" means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

"Compromise" means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

"Contractor attributional/proprietary information" means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

"Controlled technical information" means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD

Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

"Covered contractor information system" means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.

"Covered defense information" means unclassified controlled technical information or other information, as described in the

Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is--

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of

DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

"Cyber incident" means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

"Forensic analysis" means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

"Information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

"Malicious software" means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

"Media" means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

''Operationally critical support'' means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed

Forces in a contingency operation.

"Rapidly report" means within 72 hours of discovery of any cyber incident.

"Technical information" means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data--

Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of an

Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the clause 252.239-7010, Cloud

Computing Services, of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations" (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017. For all contracts awarded prior to October 1, 2017, the Contractor shall notify the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD CIO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the

DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

(C) If the DoD CIO has previously adjudicated the contractor's requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management

Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraphs (b)(1) and (2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall--

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor's network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor's ability to provide operationally critical support; and

(ii) Rapidly report cyber incidents to DoD at http://dibnet.dod.mil.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements at http://dibnet.dod.mil.

(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see http://iase.disa.mil/pki/eca/Pages/index.aspx.

(d) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(h) DoD safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(i) Use and release of contractor attributional/proprietary information not created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for DoD is authorized to be released outside of DoD--

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes (including with Defense

Industrial Base (DIB) participants in the program at 32 CFR part 236); or

(5) To a support services contractor ("recipient") that is directly supporting Government activities under a contract that includes the clause at 252.204-7009, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

(j) Use and release of contractor attributional/proprietary information created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government's use and release of such information.

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(l) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor's responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(m) Subcontracts. The Contractor shall--

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting

Officer; and

(2) Require subcontractors to--

(i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and

(ii) Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD as required in paragraph (c) of this clause.

****With regard to 252.204-7012, the Government does not have any "covered defense information" on a "covered contractor information system" at this time. The Government shall not use "covered defense information" with the services provided by the vendor, unless it is specifically identified via an amendment to this solicitation or a modification to the resulting contract, and the vendor provides a proposal in response to that request.

252.204-7015 - Notice of Authorized Disclosure of Information for Litigation Support -

MAY 2016

"Computer software" means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae, and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

"Litigation support" means administrative, technical, or professional services provided in support of the Government during or in anticipation of litigation.

"Litigation support contractor" means a contractor (including its experts, technical consultants, subcontractors, and suppliers) providing litigation support under a contract that contains the clause at 252.204-7014, Limitations on the Use or Disclosure of

Information by Litigation Support Contractors.

"Sensitive information" means controlled unclassified information of a commercial, financial, proprietary, or privileged nature. The term includes technical data and computer software, but does not include information that is lawfully, publicly available without restriction.

"Technical data" means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Notice of authorized disclosures. Notwithstanding any other provision of this solicitation or contract, the Government may disclose to a litigation support contractor, for the sole purpose of litigation support activities, any information, including sensitive information, received--

(1) Within or in connection with a quotation or offer; or

(2) In the performance of or in connection with a contract.

(c) Flowdown. Include the substance of this clause, including this paragraph (c), in all subcontracts, including subcontracts for commercial items.

252.204-7018 - Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services - DEC 2019

Covered defense telecommunications equipment or services means--

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate of such entities;

(2) Telecommunications services provided by such entities or using such equipment; or

(3) Telecommunications equipment or services produced or provided by an entity that the Secretary of Defense reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Covered foreign country means--

(1) The People's Republic of China; or

(2) The Russian Federation.

Covered missions means--

(1) The nuclear deterrence mission of DoD, including with respect to nuclear command, control, and communications, integrated tactical warning and attack assessment, and continuity of Government; or

(2) The homeland defense mission of DoD, including with respect to ballistic missile defense.

"Critical technology" means--

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms

Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration

Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled--

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part

73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50

U.S.C. 4817).

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. In accordance with section 1656 of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91), the contractor shall not provide to the Government any equipment, system, or service to carry out covered missions that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless the covered defense telecommunication equipment or services are covered by a waiver described in Defense Federal Acquisition Regulation Supplement 204.2104.

(c) Procedures. The Contractor shall review the list of excluded parties in the System for Award Management (SAM) at https://www.sam.gov for entities that are excluded when providing any equipment, system, or service, to carry out covered missions, that uses covered defense telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless a waiver is granted.

(d) Reporting.

(1) In the event the Contractor identifies covered defense telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, the Contractor shall report at https://dibnet.dod.mil the information in paragraph (d)(2) of this clause.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within one business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered defense telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

252.225-7041 - Correspondence in English - JUN 1997 The Contractor shall ensure that all contract correspondence that is addressed to the United States Government is submitted in

English or with an English translation.

252.225-7043 - Antiterrorism/Force Protection for Defense Contractors Outside the United

States - JUN 2015

(a) Definition. "United States," as used in this clause, means, the 50 States, the District of Columbia, and outlying areas.

(b) Except as provided in paragraph (c) of this clause, the Contractor and its subcontractors, if performing or traveling outside the United States under this contract, shall

(1) Affiliate with the Overseas Security Advisory Council, if the Contractor or subcontractor is a U.S. entity;

(2) Ensure that Contractor and subcontractor personnel who are U.S. nationals and are in-country on a non-transitory basis, register with the U.S. Embassy, and that Contractor and subcontractor personnel who are third country nationals comply with any security related requirements of the Embassy of their nationality;

(3) Provide, to Contractor and subcontractor personnel, antiterrorism/force protection awareness information commensurate with that which the Department of Defense (DoD) provides to its military and civilian personnel and their families, to the extent such information can be made available prior to travel outside the United States; and

(4) Obtain and comply with the most current antiterrorism/force protection guidance for Contractor and subcontractor personnel.

(c) The requirements of this clause do not apply to any subcontractor that is

(1) A foreign government;

(2) A representative of a foreign government; or

(3) A foreign corporation wholly owned by a foreign government.

(d) Information and guidance pertaining to DoD antiterrorism/force protection can be obtained from (Contracting Officer to insert applicable information cited in

PGI 225.372-1).

252.225-7048 - Export-Controlled Items - Jun 2013

(a) Definition. “Export-controlled items,” as used in this clause, means items subject to the Export Administration Regulations

(EAR) (15 CFR Parts 730-774) or the International Traffic in Arms Regulations (ITAR) (22 CFR Parts 120-130). The term includes:

(1) “Defense items,” defined in the Arms Export Control Act, 22 U.S.C. 2778(j)(4)(A), as defense articles, defense services, and related technical data, and further defined in the ITAR, 22 CFR Part 120.

(2) “Items,” defined in the EAR as “commodities”, “software”, and “technology,” terms that are also defined in the EAR, 15 CFR 772.1.

(b) The Contractor shall comply with all applicable laws and regulations regarding export-controlled items, including, but not limited to, the requirement for contractors to register with the Department of State in accordance with the ITAR. The Contractor shall consult with the Department of State regarding any questions relating to compliance with the ITAR and shall consult with the Department of Commerce regarding any questions relating to compliance with the EAR.

(c) The Contractor's responsibility to comply with all applicable laws and regulations regarding export-controlled items exists independent of, and is not established or limited by, the information provided by this clause.

(d) Nothing in the terms of this contract adds, changes, supersedes, or waives any of the requirements of applicable Federal laws, Executive orders, and regulations, including but not limited to—

(1) The Export Administration Act of 1979, as amended (50 U.S.C. App. 2401, et seq.);

(2) The Arms Export Control Act (22 U.S.C. 2751, et seq.);

(3) The International Emergency Economic Powers Act (50 U.S.C. 1701, et seq.);

(4) The Export Administration Regulations (15 CFR Parts 730-774);

(5) The International Traffic in Arms Regulations (22 CFR Parts 120-130); and

(6) Executive Order 13222, as extended.

(e) The Contractor shall include the substance of this clause, including this paragraph (e), in all subcontracts.

252.225-7979 - Additional Access to Contractor and Subcontractor Records in the United

States Central Command Theater of Operations (DEVIATION 2018-O0008) - DEC 2017

(a) In addition to any other existing examination-of-records authority, the Government is authorized to examine any records of the Contractor and its subcontractors to the extent necessary to ensure that funds, supplies, or services available under this contract are not provided, directly or indirectly, to a person or entity that is actively opposing United States or coalition forces involved in a contingency operation in which members of the Armed Forces are actively engaged in hostilities.

(b) The substance of this clause, including this paragraph (b), is required to be included in subcontracts, including subcontracts for commercial items, under this contract that have an estimated value over $50,000 and will be performed, in whole or in part, in the United States central Command Theater of Operations.

252.225-7995 - Contractor Personnel Performing in the United States Central Command

Area of Responsibility (DEVIATION 2017-O0004) - SEP 2017

"Combatant Commander" means the Commander of the United States Central Command Area of Responsibility.

"Contractors authorized to accompany the Force," or "CAAF," means contractor personnel, including all tiers of subcontractor personnel, who are authorized to accompany U.S. Armed Forces in applicable operations and have been afforded CAAF status through a letter of authorization. CAAF generally include all U.S. citizen and third-country national employees not normally residing within the operational area whose area of performance is in the direct vicinity of U.S. Armed Forces and who routinely are collocated with the U.S. Armed Forces (especially in non-permissive environments). Personnel collocated with U.S. Armed

Forces shall be afforded CAAF status through a letter of authorization. In some cases, Combatant Commander subordinate commanders may designate mission-essential…