IT-16-554_SOWCybersecurity__Assessment.docx

Reference# IT-16-554

STATEMENT OF WORK

Cybersecurity Assessment

GENERAL

The contractor shall furnish the necessary personnel and services to perform assignments within the technical requirements defined in the scope below. The contractor shall supply all consumable supplies required for full operations of the provided scope.

ORDER TYPE/PERIOD OF PERFORMANCE

The US Census Bureau (USCB) intends to establish a single award, fixed price contract. The period of performance will from September 1, 2016 through a period of 1 year.

ORDER VALUE

The value of this contract is $TBD.

BACKGROUND

The U. S. Census Bureau is the primary source of basic statistics about the population and economy of the nation. These statistics assist Congress, the executive branch of the Federal Government, state and local governments, the general public and the private sector in the development and evaluation of social and economic activities. The Census Bureau’s major programs are the periodic censuses, current surveys, interdental estimates and a wide range of reimbursable work for other agencies. The programs cover a broad spectrum of demographic and economic statistics.

The Office of Information Security (OIS) is responsible for ensuring the cybersecurity of the Census Bureau’s network, information and information systems used in performance of the Census Bureau's mission. OIS operates and maintains a number of security applications and platforms, with which it fulfills its mission of protecting the Census Bureau. Due to the ever changing and evolving risk and threat environment, the Census Bureau requires expertise in assessing the security of the Census Bureau network and identifying sophisticated Advance Persistent Treats and Indicators of Compromise. As a government agency and holder of sensitive information on respondents, any attack against the Census Bureau could have significant impact on response rates

OBJECTIVE

The purpose of this acquisition is to obtain the services of a contractor who will provide expert advice and assistance in assessing the Census Bureau network for Indicators of Compromise (IOC) requiring action to prevent a breach.

SCOPE OF WORK

Description of Tasks

The Contractor shall furnish the necessary personnel, material and services (except as otherwise specified) to perform a compromise assessment. The compromise assessment shall include a host-based assessment and a network-based assessment. The host-based assessment focuses on assessing host systems and the network-based assessment focuses on assessing all ingress and egress network traffic.

Host-Based Assessment

The host-based assessment involves planning for agent deployment to endpoint systems. Initial planning is required to understand and address potential network segmentation issues, identify high priority systems or segments that may be scanned first, select the indicators that will be used in the scan, prepare the agent deployment mechanisms, develop investigative steps to address non-Windows systems and identify any other aspects of the deployment that may require attention.

In the execution and analysis phase, trace evidence host-based indicators of compromise shall be determined and researched. New indicators of compromise emerge each time the Advanced Persistent Threat (APT) intruders attack a network. These new indicators are critical to understanding the scope of the compromise.

When searching for the Host-Based Indicators of Compromise, each system shall be inspected for any indicators, including but not limited to:

1. Looking for specific file MD5 signatures

2. Finding specific file names

3. Analyzing file import tables of each executable file for specific indicators of compromise

4. Reviewing running processes and active network connections for references to over 100 known “hostile” domains

5. Inspecting critical registry keys and values

6. Identifying specific global mutexes used by processes

7. Detecting rootkits, hidden files and hidden processes

8. Finding compressed or encrypted executable files

9. Searching for network-based indicators in memory

The approach to identify evidence of the APT shall include the following steps:

· Deploy the scanning technology

· Conduct scanning, analyze results and reassess as needed

· Document the results of the scanning activity

· Provide a report discussing all results

Network-Based Assessment

Network sensors provide a network-based capability built on modern network intrusion detection technologies to monitor an enterprise network for advanced threat activity.

The vendor shall deliver all necessary hardware (most commonly network taps and sensor systems) for selected U.S.-based physical network traffic points of presence. It is the vendor’s responsibility to preconfigure all hardware shipped to U.S.-based physical points of presence. The sensors should therefore only require minor configuration changes once physically installed by Census. The vendor shall provide initial setup instructions for all hardware procured by Census for non-U.S. based physical points of presence. Once configured and physically installed, the vendor shall test alerting for all installed sensors.

Once testing is complete, the vendor shall configure the sensors to send alerts to selected personnel and to a predefined group of persons at Census.

The vendor shall supply real-time network traffic alerts, by e-mail, as hardware sensors are deployed. This task includes working with Census to tune alerts to prevent false positives and to enhance network security.

The network-based assessment shall include the delivery of a daily malicious traffic report. This report includes all communication between known malicious Command & Control (C2) servers and compromised systems, actual data stolen (if available) and an unencrypted listed of commands executed by the attacker (if available).

When searching for the Network-Based Indicators of Compromise, each system shall be inspected for any indicators, including but not limited to:

1. Looking for specific file MD5 signatures

2. Finding specific file names

3. Analyzing file import tables of each executable file for specific indicators of compromise

4. Reviewing running processes and active network connections for references to over 100 known “hostile” domains

5. Inspecting critical registry keys and values

6. Identifying specific global mutexes used by processes

7. Detecting rootkits, hidden files and hidden processes

8. Finding compressed or encrypted executable files

9. Searching for network-based indicators in memory

Requirements

The vendor must:

· Summarize activities completed, issues requiring attention and plans. This includes key statistics and information such as scan progress, indicators of compromise identified and compromised systems.

· Provide a Compromise Assessment Report that details activities and results. It must include:

· An Executive Summary - encompasses key findings from scans with statistics

· Agent Deployment Status – contains number of agents deployed and scan progress

· Compromised System Data – lists host and network-based Indicators of Compromise identified and a summary of compromised assets

· Complete a Remediation Plan, as needed, with recommendations that include both short term (<6 months) tactical recommendations and long term (>6 months) strategic recommendations.

· Deliver Investigative Reports providing the results of any incident investigation. These reports include but are not limited to the following:

· Executive Summary - Provides high-level managers and non-technical stakeholders the details of any investigation.

· Investigative Details - Provides the technical details of the incident.

· Investigative Procedures - Lists the methodology used to preserve and analyze any data collected.

· Computer Forensic Reports - Provides the in-depth results of any forensic analysis.

· Malware Analysis Reports - Provides a detailed description of the malicious code found on the network.

· Network-Based Indicators of Compromise: A full list of the network-based signatures that are unique to the incident, along with the appropriate IDS rule sets.

· Host-Based Indicators of Compromise: A full list of the host-based signatures of the attack, including filenames, MD5 sums, registry keys, event logs and specific strings in memory.

· Data Exposure: Where appropriate, provide a detailed list of the data stolen by any intruders.

· Submit daily Detailed Status Reports during ongoing incidents.

Other Deliverables

The vendor will be responsible for the following, listed in ensuing table:

Description of Other Deliverables

The following are mandatory for the deliverables listed in the preceding table:

· Startup and Kick-off Meeting - The objectives of the meeting shall include introducing key task participants, explaining their roles, and reviewing the tasks to ensure a common understanding of task requirements and objectives for all participants.

· Monthly Status Report (MSR) - The Contractor shall provide the Monthly Status Report to the Contracting Officer's Representative (COR). The report shall summarize activities and review current state and potential changes to meet the evolving threat environment. The report should be in Microsoft Word format unless directed otherwise by the COR.

Contract Management

The Contractor shall designate a technical lead that serves as a single point of contact for the Government. The technical lead shall be considered Key Personnel and shall be subject to the terms and conditions of CAR 1352.237-75 Key Personnel described in delivery order paragraph H.1.

The Technical Lead, or their identified designee, shall be the primary "single point of contact" for all technical matters, and that there may be other points of contact provided for non-technical matters (i.e., invoicing, customer service, contractual matters).

MARKING DELIVERABLES

The contract number shall be placed on or adjacent to all exterior mailing or shipping labels of deliverable items called for by the contract, except for reports.

Mark deliverables for:

Benjamin Saunders U.S. Census Bureau 4600 Silver Hill Road Room3J240C Washington DC 20233 (regular mail) Suitland MD 20746 (FedEx)

Delivery locations for deliverables specified in this contract (such as reports, papers, and documentation) will be communicated to the Contractor, as needed, by the Contracting Officer’s Representative (COR).

CAR 1352.246-70 PLACE OF ACCEPTANCE (APR 2010)

(a) The Contracting Officer or the duly authorized representative will accept supplies and services to be provided under this contract.

(b) The place of acceptance will be:

Benjamin Saunders U.S. Census Bureau 4600 Silver Hill Road Room 3J240C Washington DC 20233 (regular mail) Suitland MD 20746 (FedEx)

(End of clause)

DOCUMENT ACCEPTANCE CRITERIA AND INSPECTION

The COR, or other persons designated by the COR, will review all draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance with contract or Contract requirements. The Contractor shall ensure the accuracy and completeness of all deliverables. The government will consider errors, misleading statements, incomplete, irrelevant information, excessive rhetoric, or repetition as deficiencies and the Contractor shall make corrections at no additional cost for firm fixed price orders.

The stated objectives in E.3 Performance Requirements Summary must be met or exceeded by the Contractor. To ensure that the minimum performance levels are met, the COR will monitor performance and review the required status reports. Any deviations from the stated objectives must be fully documented and explained by the contractor.

The Contractor shall provide work products and deliverables within the acceptance criteria and quality measures identified below:

· Value – Work products shall directly address objectives as jointly agreed-to by the COR and TM/TPOC.

· Accuracy – Work products and deliverables shall be free from errors and mistakes and be developed in accordance with applicable laws, regulations, policies, standards and procedures.

· Completeness – Work products and deliverables shall address all content as mutually agreed-to by the Contractor Project Manager (PM), COR, and TM/TPOC.

· Clarity – Work products and deliverables shall be designed to achieve agreed-to objectives, tailored to identified audience(s), avoid materials not germane to the objective, and be of high quality with regard to grammar and sentence structure.

· Timeliness – Work products and deliverables shall be available in complete form on or before specified and mutually agreed-to due dates.

· Format – Work products and deliverables shall be submitted in hard and/or soft copy, as agreed-to between the COR, Contractor PM and TM/TPOC. Both hard and soft copy formats shall follow specified guidance, directives, and/or policies.

PERFORMANCE REQUIREMENTS SUMMARY

Performance Standards

Evaluation of the Contractor's overall performance shall be in accordance with the performance standards set forth below and will be conducted by the COR. The COR is required to document any negative findings with Contractor’s performance as outlined below.

· All tasks are completed and deliverables are submitted on time according to agreed upon due dates in accordance with the Deliverables Schedule.

· All tasks and deliverables are completed / delivered in accordance with the respective performance standard identified in the Performance Requirements Summary.

· Technical content of written documents are acceptable to the COR and Task Manager.

· All errors in work products and deliverables are identified and corrective measures are completed within 10 business days.

· Any vacancies must be filled within 30 days of departure.

· Less than 10% employee turnover.

PLACE OF PERFORMANCE

The current expectation is that the majority of the work performed under this contract shall be performed at U.S. Census Bureau headquarters in Suitland, Maryland.

In accordance with and as approved, in advance, by the COR, services provided under this contract may be performed off-site at the Contractor’s designated place of business (authorized off-site place of performance). If it is determined that the place of performance will be off-site, remote Virtual Desktop Infrastructure (VDI) access may be granted. Accessing VDI at any location other than the authorized place of performance or in a public place is prohibited. When VDI access is granted, Contractors must adhere to all applicable Census Bureau Data Stewardship and IT Security Policies, as well as, complete the Census Bureau’s VDI and Data Stewardship and IT Security Awareness training prior to accessing any Census Bureau networks, and annually thereafter. All required training shall be coordinated with the COR. The COR is responsible for keeping a signed copy of the Remote VDI Access Pledge for Contractors for every contractor authorized to work remotely.

HOURS OF OPERATION

The following general guidelines apply to the Census Bureau on-site hours of operation; however, exceptions to these guidelines may be required.

Census Bureau work hours are from 8:00 am to 5:30 pm Monday - Friday (except for Federal Holidays), assuming a minimum of a 30-minute lunch break (i.e., 8:00 am to 4:30 pm for someone taking a 30 minute lunch break).

Lunch breaks must be taken anywhere between the hours of 11:00 am and 2:00 pm. At the discretion of the COR/ACOR, flexible work hours may be available. Flexible work hours may include:

· 8 hours per day on a flexible work schedule, beginning as early as 7:00 am or as late as 9:00 am; or

· An alternative work schedule (AWS), which allows for eight 9-hour days and one 8-hour day within a 2-week period. The allowable starting times for the AWS schedule are the same as for the flexible work schedule. The stated work hours do not include 30 minutes of time spent for lunch.

Any deviations from the approved work schedule requires written notification to the COR/ACOR or prior approval, if applicable. The Contractor may be required to perform work during other than normal working hours. Work shall not be performed during non-working hours without prior approval from the COR/ACOR or CDM Task Manager.

GOVERNMENT HOLIDAYS

(a) Following are the annual federal holidays:

(b) In addition to the annual holidays, the Government may observe additional days as holidays, those to include:

· Any other day designated by Federal Statue

· Any other day designated by Executive Order

· Any other day designated by the President’s Proclamation

(c) Unless otherwise authorized by the Contracting Officer, observance of holidays by Government personnel shall not otherwise be a reason for an extension to the period of performance, delivery schedule, or entitlement of payment by the Government to the Contractor. In the event the Contractor’s personnel (including subcontractor) work during the holiday, they may be compensated for the work in accordance with the Contractor’s operational/employee/business procedures; however, no form of holiday or other premium compensation will be paid by the Government, either as an additional direct or indirect cost, over the payments authorized in the contract.

(d) When the Government grants excused absence to its employees (example: office closing due to inclement weather), onsite Contractor personnel may be dismissed by the Contractor at its discretion. However, such a dismissal shall not be an excuse to change any service or delivery requirements under the contract. For T&M or LH contracts, the Contractor is cautioned that only those hours actually worked may be billed to the Government. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, unless otherwise authorized by the Contracting Officer.

(e) Extension of a contract period of performance or delivery schedule will not be provided for federal holidays in paragraph (a) or (b) above. However, if necessary, and with approval of the COR, extension of the period of performance or delivery schedule may be granted by the Contracting Officer on a case-by-case basis for closings described in paragraph (d) above.

MILESTONES/DELIVERABLES

Listed below are the deliverables due to the COR and Task Manager/TPOC during the period of performance.

After acceptance all deliverables and their associated exclusive rights become the property of the Government.

MONTHLY PROGRESS REPORTS

The Contractor shall prepare and submit a Monthly Status Report to the COR, TM and TPOC. The report should be in Microsoft Word format unless directed otherwise by the COR.

The Monthly Status Report shall address the prior calendar month and be delivered to the COR no later than the 10th of each month.

SPECIAL INSTRUCTIONS

The contractor agrees that upon termination of the contract, they shall have no property or possessive right to any of the correspondence, files or materials of whatever kind or description, or any copies or duplicates of such, whether developed or prepared by them or furnished to them by the Government in connection with the performance of the contract and that, upon demand, they shall surrender immediately to the COR such items, matters, materials and copies.

In addition to the provisions, terms, and conditions relating to the deliverables stated in this contract (including hardware, software, and algorithmic code), the Government has the rights set forth in FAR 52.227-17 Rights in Data-Special Works.

NOTICE REGARDING LATE DELIVERY

In the event the Contractor anticipates that it will not meet the schedule as specified in the Milestones/Deliverables listing and/or performance requirements identified in the contract, the Contractor shall immediately notify the Contracting Officer, and the Contracting Officer’s Representative (COR) orally and in writing giving pertinent rationale and proposed corrective action(s) and adequate consideration. This data shall not be construed as a waiver by the Government of any of its rights or remedies available under the Contract including termination.

CAR 1352.201-70 CONTRACTING OFFICER’S AUTHORITY (APR 2010)

The Contracting Officer is the only person authorized to make or approve any changes in any of the requirements of this contract, and, notwithstanding any provisions contained elsewhere in this contract, the said authority remains solely in the Contracting Officer. In the event the contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract terms and conditions, including price.

CAR 1352.201-72 CONTRACTING OFFICER’S REPRESENTATIVE (COR) (APR 2010)

Benjamin Saunders is hereby designated as the Contacting Officer’s Representative (COR) for this contract. The COR may be changed at any time by the Government without prior notice to the Contractor by a unilateral modification to the contract.

The Contractor shall provide the deliverables to the Government as set forth in the table below:

4600 Silver Hill Road Suitland, MD 20746

301-763-3777

301-763-3518

(a) The responsibilities and limitations of the COR are as follows:

(1) The COR is responsible for the technical aspects of the contract and serves as technical liaison with the contractor. The COR is also responsible for the final inspection and acceptance of all deliverables and such other responsibilities as may be specified in the contract.

(2) The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the contract price, terms or conditions. Any contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the express written prior authorization of the Contracting Officer. The Contracting Officer may designate assistant or alternate COR(s) to act for the COR by naming such assistant/alternate(s) in writing and transmitting a copy of such designation to the contractor.

GOVERNMENT PROVIDED SUPPLIES AND EQUIPMENT

For contractor personnel located at the Suitland Federal Center (U.S. Census Bureau HQ in Suitland, MD), the Government shall provide all supplies and materials needed for the performance of this contract. The contractor shall inventory and provide periodical updates on the status of such property to the COR. All government provided equipment would be maintained by the Government. The contractor shall determine operational status of all equipment. It shall be the contractor’s responsibility to notify the COR of any malfunctions or suspected improper equipment performance. Other Government furnished items will be identified as part of work assignments.

The Government shall provide all working space, furniture, office supplies, and telephones for contractor personnel located in the government facilities.

PROCEDURES FOR INVOICING

The Federal Acquisition Regulations (FAR) under Subpart 32.905 requires that payment will be made based on the receipt of a proper invoice and satisfactory contract performance. FAR 32.905(b) specifically states the minimum information an invoice must include to be considered a “proper” invoice for payment. The following listing incorporates the FAR cited information and additional information required for payment under this contract.

In accordance with FAR 32.903(a) (3), the U.S. Census Bureau has supplemented these requirements. Contractors may use Standard Form 1034 – Public Voucher for Purchases and Services Other than Personal (Part 53 of the Federal Acquisition Regulation under FAR 53.301-1034) or they may submit a company-generated invoice. However, no matter which type of instrument is used to request payment, it must contain the information described in Section G.7 below.

PROPER INVOICE INFORMATION

To constitute a proper invoice, the invoice must include, at a minimum, the following information:

1) Title: [ Title ]

2) Contract Number

3) Name and Address of Contractor

4) Contact Name, Title and Telephone Number

5) Government Contract Number or Other Authorization for Delivery of Goods or Services

6) Date of the Invoice

7) Invoice Number, Account Number, or any other identifying number agreed to by the contract (At a minimum an invoice number.).

8) Include the exact delivery date of services performed or goods delivered.

9) Include the Period of Performance on all invoices.

10) Description – Including, for example, contract line/subline number, price, and quantity of goods and services rendered.

11) Invoice Total for the Current Month

12) Projected Cost for the Current Month

13) Invoice Total to Date

14) Funds Remaining

15) Percent of Allocated Funds Invoiced to Date

16) Percent of Funds Remaining

17) Projected Costs for Next Month

18) Projected Surplus or Deficit for Current Period of Performance

19) Include discount terms

20) Other substantiating documentation or information required by the contract.

21) Shipping and Payment Terms (Required unless mutually agreed that this information is only required in the contract – Contact the Contracting Officer or Contract Specialist for clarification.)

22) Taxpayer Identifying Number (TIN) (Required unless agency procedures provide otherwise.)

23) Address for mailing payment

24) Banking Information such as name and address of bank, routing & account number (Required unless agency procedures provide otherwise, or except in situations where the EFT requirements is waived under 31 CFR, 208.4.)

There shall also be three statements and signature lines included in the invoice. The wording for these statements is as follows:

Statement below shall be signed by a representative of the Contractor:

I hereby certify, to the best of my knowledge and belief that the services set forth herein were performed during the period stated above are current, accurate, and complete.

Statement below shall be signed by a government representative, usually the COR with authority to certify:

I certify that to the best of my knowledge and belief that the services/supplies shown on the invoice have been performed/furnished and are accepted.

Statement below shall be signed by a government representative with authority to approve the invoice, usually the Contracting Officer.

Pursuant to authority vested in me, I certify that this voucher is correct and proper for payment.

If there is insufficient space in the Standard Form 1034 to provide all of the required information the Contractor may include the remaining information on bond paper. However, if bond paper is used the contract and contract numbers, invoice number, and date of invoice must be listed at the top of the second and subsequent pages.

An original plus one copy of the voucher shall be submitted to:

U.S. Census Bureau Finance Division (Vouchers) 4600 Silver Hill Road Room 2K419 Washington D.C. 20233-4400 U.S. Census Bureau Finance Division (Vouchers) 4600 Silver Hill Road Room 2K419 Suitland, MD. 20746-4400

To comply with the above requirements, two (2) sets of each voucher/invoice submitted as hardcopies must be delivered to the Finance Division at the U.S. Census Bureau before it is considered ‘received’ by the Government. This is a Time and Material type contract, as such one of the two sets of a voucher/invoice must have copies of the timesheets or other substantiation attached and must be clearly marked “COR Copy.” The second set of a voucher/invoice does not require that the timesheets or other substantiation be attached. However, the second set must be clearly marked “Original for Finance”.

Only one copy (with timesheets or other substantiation) is necessary for electronic submissions. The preferable method of submission is electronically to the following email addresses:

fin.finance.invoice.claim.submission@census.gov cc: issro.cmb.invoice.submissions.inquiries@census.gov

Invoices, which are submitted to an incorrect office, or which do not contain the information specified above, will be returned to the Contractor for corrections.

The final invoice under this contract shall be marked “FINAL”.

THE CONTRACTOR IS HEREBY NOTIFIED THAT IT IS THEIR RESPONSIBILITY FOR ENSURING THE VOUCHERS/INVOICES ARE DELIVERED TO THE FINANCE DIVISION. THE COR OR ACOR ARE NOT RESPONSIBLE FOR ENSURING THAT ADVANCED COPIES OF THE VOUCHERS/INVOICES ARE PROVIDED TO THE FINANCE DIVISION.

G.8 METHOD OF PAYMENT

(a) Payments under this contract will be made by wire transfer through the Treasury Financial Communications System.

(b) Not later than seven (7) days after receipt of notice of award, the Contractor shall forward the following information in writing to:

U.S. Census Bureau Finance Division 4600 Silver Hill Road, Room 2K419 Washington, DC 20233-4400

(1) Full name (where practicable), title, phone number, and complete mailing address of responsible official(s),

(i) To whom check payment are to be sent, and

(ii) The contact concerning the bank account information requested below.

(2) The following bank account information required to accomplish wire transfers:

(i) Name, address, and telegraphic abbreviation of the receiving financial institution.

(ii) Receiving financial institution’s 9-digit American Bankers Association (ABA) identifying number for routing transfer of funds. Provide this number only if the receiving financial institution has access to the Federal Reserve Communications System (FRCS).

(iii) Recipient's name and account number at the receiving financial institution to be credited with the funds.

(iv) If the receiving financial institution does not have access to the FRCS, provide the name of the correspondent financial institution through which the receiving financial institution receives electronic funds transfer messages. If a correspondent financial institution is specified, also provide:

(a) Address and telegraphic abbreviation of the correspondent financial institution.

(b) The correspondent financial institution's 9-digit ABA identifying number for routing transfer of funds.

(c) Any changes to the information furnished under paragraph (b) of this clause shall be furnished to the Finance Office in writing at least 30 days before the effective date of the change. It is the Contractor's responsibility to furnish these changes thirty (30) days before submitting invoices to avoid payments to erroneous addresses or bank accounts.

(d) The document furnishing the information required in paragraphs (b) and (c) must be dated and contain the signature, title, and telephone number of the Contractor official authorized to provide it, as well as the Contractor's name and contract number.

CAR 1352.237-75 KEY PERSONNEL (APR 2010)

(a) The contractor shall assign to this contract the following key personnel:

Technical Lead

(b) The contractor shall obtain the consent of the Contracting Officer prior to making key personnel substitutions. Replacements for key personnel must possess qualifications equal to or exceeding the qualifications of the personnel being replaced, unless an exception is approved by the Contracting Officer.

(b) Requests for changes in key personnel shall be submitted to the Contracting Officer at least 15 working days prior to making any permanent substitutions. The request should contain a detailed explanation of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any additional information requested by the Contracting Officer. The Contracting Officer will notify the contractor within 10 working days after receipt of all required information of the decision on substitutions. The contract will be modified to reflect any approved changes.

CAR 1352.208-70 RESTRICTIONS ON PRINTING AND DUPLICATING

(APR 2010)

(a) The contractor is authorized to duplicate or copy production units provided the requirement does not exceed 5,000 production units of any one page or 25,000 production units in the aggregate of multiple pages. Such pages may not exceed a maximum image size of 10-3/4 by 14-1/4 inches. A "production unit" is one sheet, size 8-1/2 x 11 inches (215 x 280 mm), one side only, and one color ink. Production unit requirements are outlined in the Government Printing and Binding Regulations.

(b) This clause does not preclude writing, editing, preparation of manuscript copy, or preparation of related illustrative material as a part of this contract, or administrative duplicating/copying (for example, necessary forms and instructional materials used by the contractor to respond to the terms of the contract).

(c) Costs associated with printing, duplicating, or copying in excess of the limits in paragraph (a) of this clause are unallowable without prior written approval of the Contracting Officer. If the contractor has reason to believe that any activity required in fulfillment of the contract will necessitate any printing or substantial duplicating or copying, it shall immediately provide written notice to the Contracting Officer and request approval prior to proceeding with the activity. Requests will be processed by the Contracting Officer in accordance with FAR 8.802.

(d) The contractor shall include in each subcontract which may involve a requirement for any printing, duplicating, and copying in excess of the limits specified in paragraph (a) of this clause, a provision substantially the same as this clause, including this paragraph (d).

(End of clause)

CAR 1352.209-74 ORGANIZATIONAL CONFLICT OF INTEREST (APR 2010)

(a) Purpose. The purpose of this clause is to ensure that the contractor and its subcontractors:

(b) Scope. The restrictions described herein shall apply to performance or participation by the contractor, its parents, affiliates, divisions and subsidiaries, and successors in interest (hereinafter collectively referred to as “contractor”) in the activities covered by this clause as a prime contractor, subcontractor, co-sponsor, joint venturer, consultant, or in any similar capacity. For the purpose of this clause, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both.

(c) Warrant and Disclosure. The warrant and disclosure requirements of this paragraph apply with full force to both the contractor and all subcontractors. The contractor warrants that, to the best of the contractor’s knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, and that the contractor has disclosed all relevant information regarding any actual or potential conflict. The contractor agrees it shall make an immediate and full disclosure, in writing, to the Contracting Officer of any potential or actual organizational conflict of interest or the existence of any facts that may cause a reasonably prudent person to question the contractor’s impartiality because of the appearance or existence of bias or an unfair competitive advantage. Such disclosure shall include a description of the actions the contractor has taken or proposes to take in order to avoid, neutralize, or mitigate any resulting conflict of interest.

(d) Remedies. The Contracting Officer may terminate this contract for convenience, in whole or in part, if the Contracting Officer deems such termination necessary to avoid, neutralize or mitigate an actual or apparent organizational conflict of interest. If the contractor fails to disclose facts pertaining to the existence of a potential or actual organizational conflict of interest or misrepresents relevant information to the Contracting Officer, the Government may terminate the contract for default, suspend or debar the contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(e) Subcontracts. The contractor shall include a clause substantially similar to this clause, including paragraphs (f) and (g), in any subcontract or consultant agreement at any tier expected to exceed the simplified acquisition threshold. The terms “contract,” “contractor,” and “Contracting Officer” shall be appropriately modified to preserve the Government’s rights.

(f) Prime Contractor Responsibilities. The contractor shall obtain from its subcontractors or consultants the disclosure required in FAR Part 9.507-1, and shall determine in writing whether the interests disclosed present an actual, or significant potential for, an organizational conflict of interest. The contractor shall identify and avoid, neutralize, or mitigate any subcontractor organizational conflict prior to award of the contract to the satisfaction of the Contracting Officer. If the subcontractor’s organizational conflict cannot be avoided, neutralized, or mitigated, the contractor must obtain the written approval of the Contracting Officer prior to entering into the subcontract. If the contractor becomes aware of a subcontractor’s potential or actual organizational conflict of interest after contract award, the contractor agrees that the Contractor may be required to eliminate the subcontractor from its team, at the contractor’s own risk.

(g) Waiver. The parties recognize that this clause has potential effects which will survive the performance of this contract and that it is impossible to foresee each circumstance to which it might be applied in the future. Accordingly, the contractor may at any time seek a waiver from the Head of the Contracting Activity by submitting such waiver request to the Contracting Officer, including a full written description of the requested waiver and the reasons in support thereof.

(End of clause)

CAR 1352.209-73 COMPLIANCE WITH LAWS (APR 2010)

The contractor shall comply with all applicable laws, rules and regulations which deal with or relate to performance in accord with the terms of the contract.

CAR 1352.231-71 DUPLICATION OF EFFORT (APR 2010)

The Contractor hereby certifies that costs for work to be performed under this contract and any subcontracts hereunder are not duplicative of any cost charged against any other Government contract, subcontract, or other Government source. The Contractor agrees to advise the Contracting Officer, in writing, of any other Government contract or subcontract it has performed or is performing which involves work directly related to the purpose of this contract. The Contractor also certifies and agrees that any and all work performed under this contract shall be directly and exclusively for the use and benefit of the Government, and not incidental to any other work, pursuit, research, or purpose of the Contractor, whose responsibility it will be to account for it accordingly.

CONFIDENTIAL INFORMATION

Any designs, equipment, and concepts that evolve from performance hereunder shall be considered as "Confidential Information." The contractor shall not disclose any confidential information obtained in the performance of this contract. Any presentation of any designs, equipment, or concepts based on information obtained will be subject to review and approval by the Government before publication or dissemination for accuracy of factual data and interpretation.

During the course of this contract, the contractor shall have access to Government data relevant to this project as required. Any information, not previously published, received from the Government in connection with this contract or furnished to the contractor from other sources in response to the Government's requirements under this contract, will be restricted to this project, and may not be disclosed or used for any other purpose without the prior written approval of the Contracting Officer. Title to Government-owned data shall remain with the Government. The contractor shall use the Government-owned data only in connection with this contract. These restrictions do not apply to information which:

KEY CONTROL

The contractor shall ensure that all keys issued to contractor support personnel are accounted for and controlled. At a minimum the contractor shall be responsible for the following:

1) Ensuring keys are only used by the contractor's employees.

2) Prohibiting the opening of locked areas by the contractor's employees to permit entrance of persons other than the contractor or Census Bureau employees engaged in the performance of assigned work in those areas.

3) Ensuring keys issued to the contractor by the Government are not duplicated.

4) Ensuring keys issued by the Government are not lost or misplaced.

5) Reporting the loss of any key in writing to the task manager within eight (8) clock hours of occurrence or at the beginning of the next scheduled workday, whichever occurs first.

SAFETY

The contractor shall:

1. Comply with all applicable safety and occupational health requirements, to include OSHA's 29 CFR 1910. If the contractor fails or refuses to promptly comply with safety requirements, the Contracting Officer may issue an order stopping all or part of the work until satisfactory corrective action has been taken.

2. Verbally inform the COR of any unsafe/hazardous conditions within thirty (30) minutes of becoming aware of the condition, and in writing within one (1) workday.

3. Verbally inform the COR within two (2) clock hours of the occurrence of all types of injuries and illnesses (first aid, limited duty, lost time and fatality) sustained by a contractor employee arising out of and in the course of his/her employment. A detailed written report shall be submitted to the task manager within 24 clock hours.

4. Report to the COR all incidents where contractor employees damage government property. A verbal report shall be made within four (4) clock hours of an occurrence, and a written report of the facts and extent of damage shall be submitted within three (3) workdays.

The Contractor shall be responsible for all damages caused by the negligence of its employees.

CAR 1352.209-72 – RESTRICTIONS AGAINST DISCLOSURE (APR 2010)

(a) The contractor agrees, in the performance of this contract, to keep the information furnished by the Government or acquired/developed by the contractor in performance of the contract and designated by the Contracting Officer or Contracting Officer’s Representative, in the strictest confidence. The contractor also agrees not to publish or otherwise divulge such information, in whole or in part, in any manner or form, nor to authorize or permit others to do so, taking such reasonable measures as are necessary to restrict access to such information while in the contractor’s possession, to those employees needing such information to perform the work described herein, i.e., on a “need to know” basis. The contractor agrees to immediately notify the Contracting Officer in writing in the event that the contractor determines or has reason to suspect a breach of this requirement has occurred.

(b) The contractor agrees that it will not disclose any information described in subsection (a) to any person unless prior written approval is obtained from the Contracting Officer. The contractor agrees to insert the substance of this clause in any consultant agreement or subcontract hereunder.

HSPD-12 IMPLEMENTATION

The performance of this contract requires contractors to have physical access to Federal premises for more than 180 days or access to a Federal information system. Any items or services delivered under this contract shall comply with the Department of Commerce personal identity verification procedures that implement HSPD-12, FIPS PUB 201, and OMB Memorandum M-05-24. The contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a Federally controlled facility or access to a Federal information system.

CAR 1352.209-75 TITLE 13 AND NON-DISCLOSURE REQUIREMENTS (APR 2010)

The Census Bureau’s data are protected by Title 13 of the United States Code. The contractor may not use Title 13 data for any purpose other than the intended purpose for which it is supplied or obtained. All contractor personnel who will have access to Title 13 data must take an oath and complete the Census Bureau Form BC-1759 (Special Sworn Status) that requires nondisclosure of Title 13 data. An authorized Census employee or a Notary Public must administer the oath of nondisclosure. The Census Bureau has clarified its requirement for the Special Sworn Status policy and will only require it if a CSP employee must have logical access to Census Bureau Title 13 data. If a CSP employee must have logical access to Census Bureau Title 13 data, the CSP employee will complete the application paperwork for obtaining SSS within 10 business days of notification. Logical access is considered to be system accounts, application accounts, or other non-physical access.

VIRUS-FREE CHECK AND CERTIFICATION OF DATA DELIVERED VIA ELECTRONIC MEDIA

All data delivered via electronic media (by disk, telecommunications transmission, or any other manner of electronic medium) shall be checked and certified as virus-free at data point of origin. Virus-free electronic media data certification shall be required to accompany all such delivered data identifying the specific certifying party, telephone number, data generation location, date certified, a list of each data item being certified, and the following certifying statement, "All data provided for by this delivery is virus-free".

OBTAINING ACCESS TO PROPRIETARY INFORMATION

Prior to gaining access to proprietary information of any other company (which may occur in performing advisory services for the Government), the contractor shall protect each company's information from unauthorized use or disclosure for as long as such information remains proprietary, and refrain from using the information for any purpose other than that for which it was furnished and required by contract performance. The contractor shall provide the Government copies of all such agreements and await written approval by the CO, or their designee, to ensure that such agreements have been completed and properly executed prior to the contractor gaining access to proprietary information.

SYSTEM OF RECORDS NOTICE (SORN)

DOC SORN: Dept-25, Access Control and Identity management System

CAR 1352.228-70 INSURANCE COVERAGE (APR 2010)