S6. RFP.pdf

CODE

(Hour)

PAGE(S)

until 03:00 PM local time 13 Sep 2019

X

A X B X C X D

EX

X

G F 41 - 46

47 - 55 X H 56 - 58 megan.ashley@navy.mil

RATING PAGE OF PAGES

7. ISSUED BY

(Date)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

Previous Edition is Unusable 33-134 STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA FAR (48 CFR) 53.214(c)

1 58

(If other than Item 7)

15A. NAME 16. NAME AND TITLE OF PERSON AUTHORIZED TO

AND

ADDRESS

SIGN OFFER (Type or print)

OF

OFFEROR

AMENDMENT NO. DATE

15B. TELEPHONE NO (Include area code) 17. SIGNATURE15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

18. OFFER DATE

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

2. CONTRACT NO.

N00039 8. ADDRESS OFFER TO

See Item 7

9. Sealed offers in original and 1 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME (NO COLLECT CALLS)

MEGAN, M. ASHLEY (858) 537-0287

11. TABLE OF CONTENTS

SOLICITATION/ CONTRACT FORM

SUPPLIES OR SERVICES AND PRICES/ COSTS

2 - 7

X I CONTRACT CLAUSES

DESCRIPTION/ SPECS./ WORK STATEMENT X

PACKAGING AND MARKING

8 - 9

J LIST OF ATTACHMENTS

INSPECTION AND ACCEPTANCE

DELIVERIES OR PERFORMANCE

12 - 13

X K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORS

CONTRACT ADMINISTRATION DATA 14 - 17 X

SPECIAL CONTRACT REQUIREMENTS

OFFER (Must be fully completed by offeror) 18 - 19 X M

L INSTRS., CONDS., AND NOTICES TO OFFERORS

EVALUATION FACTORS FOR AWARD

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

(See Section I, Clause No. 52.232-8)

14. ACKNOWLEDGMENT OF AMENDMENTS

(The offeror acknowledges receipt of amendments

AMENDMENT NO. DATE

to the SOLICITATION for offerors and related documents numbered and dated):

FACILITY

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period

SOLICITATION, OFFER AND AWARD

X

(X) SEC. DESCRIPTION (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

EMAIL:TEL: (Signature of Contracting Officer)

CODE CODE

B. TELEPHONE (Include area code) C. E-MAIL ADDRESS

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) 41 U.S.C. 253(c)( ) (4 copies unless otherwise specified)

23. SUBMIT INVOICES TO ADDRESS SHOWN IN ITEM

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

PART IV - REPRESENTATIONS AND INSTRUCTIONS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

20 - 39

PART II - CONTRACT CLAUSES

COMMANDER, NAVAL INFORMATION WARFARE

SYSTEMS COMMAND

02 CONTRACTS

4301 PACIFIC HIGHWAY

SAN DIEGO CA 92110-3127

FAX:

TEL:

FAX:

TEL:

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

SOLICITATION

6. REQUISITION/PURCHASE NO.5. DATE ISSUED

24 Oct 2019

4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

[ X ]

3. SOLICITATION NO.

N0003920R0012

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

FFP

1 Each

User/Entity Behavioral Analysis (EUBA) User and Entity Behavioral Analytics (UEBA) and data visualization software in accordance with the Salient Software Characteristics in Section C. One each is defined as:

1. One year of software licensing for development, testing, and Risk Management Framework (RMF) authorization purposes only (no operational network endpoints or users or entities).

- The Government may use simulated endpoints, users or entities; or real endpoints, users or entities that are connected exclusively for testing and evaluation purposes. If a contractor’s licensing model requires charging for simulated or non-operational endpoints or users or entities, then the specification of the Optional Laboratory Hardware is appropriate (5,000 network endpoints and 10,000 users or entities).

2. Licensing terms of proposed software shall permit the Navy to install unlimited instances of the ITS for non-production purposes including development, testing, and baseline management and up to three production implementations in the event the Navy decides to deploy separate implementations for the NIPRNet, SIPRNet, and JWICS networks, subject to the limitation of the cumulative number of networks or entities in the monitored population.

3. Software license agreement shall not limit volume of data ingested by the UEBA suite.

4. Software shall be capable of, and license terms shall allow for, use of the software suite in Amazon Web Services (AWS) environments and on hardware specified in Optional Production Hardware. AWS environments includes AWS Secret Region, AWS Top Secret Region, and unclassified environments through the Intelligence Community (IC) Commercial Cloud Services (C2S).

5. Software shall comply with applicable Defense Information Systems Agency (DISA) Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs) with Committee on National Security Systems Instruction (CNSSI) 1253 overlays for privacy and classified information. The Contractor shall assist the Government to make necessary configuration changes to comply with the above and shall resolve all non-compliant items identified in the Assessment and Authorization process. Information and tools on security requirements can be found at:

- https://public.cyber.mil/

- https://www.dss.mil/Portals/69/documents/io/rmf/CNSSI_No1253.pdf

6. Requirements for software licenses covered under the DEPARTMENT OF THE NAVY ORACLE ENTERPRISE LICENSE AGREEMENT Core Products List (https://www.doncio.navy.mil/ContentView.aspx?id=5412) or the DEPARTMENT OF THE NAVY ENTERPRISE SOFTWARE LICENSING AGREEMENT for RED HAT Core Products List (https://www.public.navy.mil/spawar/PEOEIS/technology/Documents/ESL_AwardedContract_Red%20Hat_Dec_20 17.pdf) shall be identified in proposals but shall NOT be priced as part of this contract.

7. System documentation (Contract Data Requirements List (CDRL) A005) shall include:

- Steps to verify proper operation of the system and to perform configuration changes, administration, maintenance, and diagnostics.

- Initial system configuration and installation prerequisites including hardware requirements, operating system requirements (including recommended patch levels), and additional third-party software requirements.

- Written troubleshooting guidance for common issues with the operation, administration, and maintenance of the system.

FOB: Destination

FFP

1 Each

Training Services Training Services in accordance with Performance Work Statement, Section 4.1.

FFP

1 Each

OPTION Production Hardware Production User and Entity Behavioral Analytics (UEBA) appliance (software installed on hardware) sized to accommodate user activity monitoring of 75,000 network endpoints and 150,000 users or entities.

- Instructions for connecting hardware and all Original Equipment Manufacturer (OEM) hardware documentation shall be included. (CDRL A005)

- Hardware shall conform to Hardware Specifications identified in Hardware Specifications in accordance with Section C.

FFP

1 Each

OPTION Laboratory Hardware Laboratory UEBA appliance similar to CLIN 0003, except the hardware shall be scaled down to accommodate 5,000 network endpoints and 10,000 users or entities.

- Instructions for connecting hardware and all OEM hardware documentation shall be included. (CDRL A005)

- Hardware shall conform to Hardware Specifications in accordance with Section C.

FFP

1 Each

OPTION Laboratory Hardware Laboratory UEBA appliance identical to CLIN 0004.

- Instructions for connecting hardware and all OEM hardware documentation shall be included. (CDRL A005)

- Hardware shall conform to Hardware Specifications in accordance with Section C.

FFP

1 Each

Help Desk (Base) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

FFP

1 Each

OPTION License Renewals (OY1) O&M,N: Renew licenses procured in CLIN 0001 for one additional year.

FFP

1 Each

OPTION Licenses (OY1) UEBA software suite for cumulative 10,000 network endpoints and 20,000 users or entities.

- OPN

FFP

1 Each

OPTION Help Desk (OY1) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

FFP

1 Each

OPTION License Renewals (OY2) O&M,N: Renew licenses procured in CLIN 0001 and CLIN 0008 for one additional year.

FFP

1 Each

OPTION Licenses (OY2) OPN: UEBA software suite for cumulative 40,000 network endpoints and 80,000 users/entities.

FFP

1 Each

OPTION Help Desk (OY2) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

FFP

1 Each

OPTION License Renewals (OY3) O&M,N: Renew licenses procured in CLIN 0001, CLIN 0008 and CLIN 0011 for one additional year.

FFP

1 Each

OPTION Licenses (OY3) OPN: UEBA software suite for cumulative 25,000 network endpoints and 50,000 users/entities

FFP

1 Each

OPTION Help Desk (OY3) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

FFP

1 Each

OPTION License Renewals (OY4) O&M,N: Renew licenses procured in CLIN 0001, CLIN 0008, CLIN 0011 and CLIN 0014 for one additional year.

FFP

1 Each

OPTION Help Desk (OY4) The Contractor shall include help desk support for at least eight hours per day, Monday through Friday, by phone and email. Helpdesk support shall be able to provide support up to SECRET classification via SIPRNet email.

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

The work under this contract shall be performed in accordance with Attachment 1, Performance Work Statement.

(End of text)

Salient Software Characteristics Integration

1. Software solutions may consist of a suite of Commercial-off-the-shelf (COTS) software components or a hybrid of COTS and Government-off-the-shelf (GOTS) components. Solutions that include multiple software applications or components shall be provided by the Contractor as an integrated software suite. Proposals shall include a description of how software components interact to include a simple use case that demonstrates how an analyst would interact with the multiple applications.

Data Acquisition

2. Software shall automatically ingest data from Forcepoint-brand User Activity Monitoring products at a maximum data ingestion rate of at least 1 MB per hour per endpoint.

3. Software shall provide the capability to ingest data from multiple data sources of various structured and unstructured data formats, via manual import and automatically using application programming interfaces (APIs).

Data Analysis

4. Software shall include out of the box a suite of pre-built analytics to detect use cases such as data exfiltration, compromised user credentials, malicious user, illicit behavior, etc.; proposals shall include a full list of included analytics to enable the Government to determine technical acceptability of the proposed software.

5. Software shall allow for user customization of analytics, risk models, and visualizations that can be performed by general analysts without platform-specific expertise or contractor support.

6. Software shall generate customizable alerts based on single events, patterns, and sequences of events.

7. Software shall provide customizable risk scoring models for assigning risks to entities.

8. Software shall perform automated fusion of all data sources to correlate collected information to a specific user or entity.

Data Export

9. Software shall provide the ability for operators to develop, print, and save custom reports.

10. Software shall provide the capability to export reports; acceptable formats include CSV, XML, HTML, PDF, RTF, or text.

11. Software shall provide API or web interface to export data.

12. Software shall support exporting of all system logs to a remote Internet Protocol (IP)-connected device.

Installation, Maintenance, Configuration, and Documentation

13. Software shall provide an administration interface and documentation of the functions that can be performed in the interface (CDRL A005).

14. Software shall provide a password recovery option and a system configuration, user database, and policy backup option in the event system restoration is necessary.

Licensing and Support

15. Major version releases shall be supported for a minimum of three years. Alternatively, the Contractor may provide updated software to the Government, in which case the Contractor shall support the current version and one version prior.

16. Expiration of the licensing shall not prevent access to any data acquired or created by the system prior to expiration of licenses.

17. Data shall not be stored in proprietary formats or otherwise rendered inaccessible to third-party tools.

Security

18. Software shall provide individual accountability with respect to authorized user activity and include a mechanism to track, log, and report operator actions.

19. Software shall support group-based, role-based, or attribute-based access controls to simplify granting privileges to user accounts and scaling user account management.

Hardware Specifications The Contractor shall provision hardware that meets all requirements specified by the software vendor and shall ensure the hardware is adequate to support efficient and responsive operation of the software with the maximum number of specified endpoints and users.

1. Proposals shall include resource requirements (memory, Central Processing Unit, etc.) of proposed software and specifications of the proposed hardware including a full bill of materials.

2. Hardware shall support maximum data ingestion rate of 1 MB per hour per endpoint.

3. Hardware shall be provisioned to accommodate fast storage (Input and output Operations per section as recommended by software vendor), at least 50 TB, expandable to 100 TB.

Equipment shall include:

4. At least four (4) USB ports

5. DVD and CD ROM drive

6. Ethernet adaptors shall support one (1) GBPS speed or higher

7. One (1) C13 PDU power adaptor per power supply,

8. VGA or HDMI port and KVM kit with HP AP 628 cable

9. Smart un-interruptible power supply (UPS) that conducts graceful shutdown of the equipment

10. 250 TB Storage Area Network (SAN) for backups, expandable to at least 500 TB for production system

11. 50 TB Storage Area Network (SAN) for backups for laboratory systems

12. Proposals shall include an equipment list or bill of materials

Warranty shall include five years of hardware support including defective media retention (DMR) and comprehensive defective material retention (CDMR) service; in the event of a hard drive failure, the failed drive or memory capable component shall not be required to be sent back to the hardware vendor for replacement or to allow for proper handling and disposal of sensitive data.

13. Proposals shall include terms of warranties.

All equipment shall be rack-mountable and production and laboratory systems shall each occupy 35 rack units

(35U) or less.

14. Proposals shall document power consumption, heat generation, size and weight, of the provisioned equipment.

Section D - Packaging and Marking

The data to be furnished hereunder shall be in accordance with Exhibit A, Contract Data Requirements List (CDRLs)

– DD Form 1423. All unclassified data shall be prepared for shipment in accordance with best commercial practice.

Classified reports, data and documentation, if any, shall be prepared for shipment in accordance with the National Industry Security Program Operation Manual, DoD 5220.22-M.

Section E - Inspection and Acceptance

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government 0004 Destination Government Destination Government 0005 Destination Government Destination Government 0006 Destination Government Destination Government 0007 Destination Government Destination Government 0008 Destination Government Destination Government 0009 Destination Government Destination Government 0010 Destination Government Destination Government 0011 Destination Government Destination Government 0012 Destination Government Destination Government 0013 Destination Government Destination Government 0014 Destination Government Destination Government 0015 Destination Government Destination Government 0016 Destination Government Destination Government 0017 Destination Government Destination Government

CLAUSES INCORPORATED BY REFERENCE

52.246-2 Inspection Of Supplies--Fixed Price AUG 1996 52.246-16 Responsibility For Supplies APR 1984

Section F - Deliveries or Performance

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 02-NOV-2019 TO

01-NOV-2020

N/A NIWC PACIFIC

TINA MCENERNEY

4297 PACIFIC HIGHWAY, BLDG OT7

SAN DIEGO CA 92110

619-524-7589

N66001

0002 POP 02-NOV-2019 TO

01-NOV-2020

N/A (SAME AS PREVIOUS LOCATION)

0003 90 dys. ADC 1 (SAME AS PREVIOUS LOCATION)

0004 90 dys. ADC 1 (SAME AS PREVIOUS LOCATION)

0005 90 dys. ADC 1 (SAME AS PREVIOUS LOCATION)

0006 POP 02-NOV-2019 TO

01-NOV-2020

N/A N/A

0007 02-NOV-2020 1 N/A

0008 02-NOV-2020 1 N/A

0009 POP 02-NOV-2020 TO

01-NOV-2021

0010 02-NOV-2021 1 N/A

0011 02-NOV-2021 1 N/A

0012 POP 02-NOV-2021 TO

01-NOV-2022

0013 02-NOV-2022 1 N/A

0014 02-NOV-2022 1 N/A

0015 POP 02-NOV-2022 TO

01-NOV-2023

0016 02-NOV-2023 1 N/A

0017 POP 02-NOV-2023 TO

01-NOV-2024

52.242-15 Stop-Work Order AUG 1989 52.242-17 Government Delay Of Work APR 1984 52.247-34 F.O.B. Destination NOV 1991

Section G - Contract Administration Data

PAYMENT INSTRUCTION LINK

PAYMENT INSTRUCTION LINK (PGI 204.7108)

The payment office shall allocate and record the amounts paid to the accounting classification citations in the contract using the linked table below based on the type of payment request submitted (see DFARS 252.232-7006) and the type of effort:

https://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/current/PGI204_71.htm#payment_instructions

CLAUSES INCORPORATED BY FULL TEXT

252.204-7006 BILLING INSTRUCTIONS (OCT 2005)

When submitting a request for payment, the Contractor shall--

(a) Identify the contract line item(s) on the payment request that reasonably reflect contract work performance; and

(b) Separately identify a payment amount for each contract line item included in the payment request.

(End of clause)

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (DEC 2018)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232- 7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

Invoicing and Receiving Report (COMBO)

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial item financing, submit a commercial item financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

Not Applicable

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC N0039B

Issue By DoDAAC N00039

Admin DoDAAC** N00039

Inspect By DoDAAC N00039

Ship To Code N/A

Ship From Code N/A

Mark For Code N/A

Service Approver (DoDAAC) N00039

Service Acceptor (DoDAAC) N00039

Accept at Other DoDAAC N/A

LPO DoDAAC N/A

DCAA Auditor DoDAAC N/A

Other DoDAAC(s) N/A

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

Not Applicable

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

SUPPLEMENTAL INSTRUCTIONS FOR WAWF

The following Procurement Integrated Enterprise Environment (PIEE) (formally Wide Area WorkFlow (WAWF)) payment instructions supplement DFARS 252.232-7006:

(a) Interim Voucher costs are to be broken down in a clear and logical manner with fully burdened cost information (inclusive of fee). Cost information shall include identification of:

1) All labor categories and individuals utilized during the billing period;

2) Number of hours and fully burdened hourly labor rates (including fee), per individual;

3) Material (consumable and non-consumables) description and fully burdened costs, separated by type;

4) Fully burdened travel costs itemized by trip, date and individual;

5) Other fully burdened direct costs not separately identified; e.g., reproduction, cell phones, equipment rentals, etc.;

6) Subcontractor costs itemized with the same level of detail; and

7) Average actual hourly labor rates (total actual fully burdened labor cost/total # hours performed).

Attachments shall be created with any Microsoft Office product or Adobe (.pdf files) and are to be attached to the invoice in PIEE. The total size limit for files per invoice in PIEE is 5 megabytes. A separate copy of the invoice with back-up documentation shall be emailed to the COR/TOM.

(b) Contractors who are approved by DCAA for direct billing will not process vouchers through DCAA, but will submit directly to DFAS. Vendors are still to provide a copy of the invoice and any applicable cost back-up documentation supporting payment to the Acceptor/Contracting Officer's Representative (COR) if applicable.

Additionally, a copy of the invoice(s) and attachment(s) at time of submission in PIEE shall also be provided to each point of contact identified in section (g) of DFARS clause 252.232-7006 by email. If the invoice and/or receiving report are attached to the email, the attachment must be an Adobe (.pdf file), Microsoft Office product or other mutually agreed upon form between the Contracting Officer and vendor.

(c) A separate invoice will be prepared no more frequently than for every two weeks. Do not combine the payment claims for services provided under this contract.

(d) In accordance with DFARS 204.7104-1 Informational subline item numbers (e.g., 000101, 000102, etc.) shall not be priced separately for payment purposes, delivery, identified separately for shipment or performance.

Therefore, you are reminded to bill at the CLIN level using the applicable ACRN, e.g., AA, AB, AC, etc. DFAS will reject invoices that contain informational subline items.

CONTRACTING OFFICER REPRESENTATIVE (COR)

Name: LCDR Jamie Mason Phone: 619-524-7641 Email: jamie.mason@navy.mil Address: 4301 Pacific Highway San Diego, CA 92110

Section H - Special Contract Requirements

APPOINTMENT OF ORDERING OFFICER(S)

(a) The contracting officer and/or his duly authorized representative at the following activity(ies) are designated as Ordering Officers:

Activity: SPAWAR HQ Code: 2.3 Address: 4301 Pacific Highway San Diego, CA 92110

(b) The above individual(s) is/are responsible for issuing and administering any orders placed hereunder. Ordering Officers may negotiate revisions/modifications to orders, but only within the scope of this contract. Ordering Officers have no authority to modify any provision of this basic contract. Any deviation from the terms of the basic contract must be submitted to the Procuring Contracting Officer (PCO) for contractual action. Ordering Officers may enter into mutual no-cost cancellations of orders under this contract and may reduce the scope of orders/tasks, but Terminations for Convenience or Terminations for Default shall be issued only by the PCO.

LIMITED RELEASE OF CONTRACTOR CONFIDENTIAL BUSINESS INFORMATION

(a) Definition.

“Confidential Business Information,” (Information) as used in this text, is defined as all forms and types of financial, business, economic or other types of information other than technical data or computer software/computer software documentation, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if -- (1) the owner thereof has taken reasonable measures to keep such Information secret, and (2) the Information derives independent economic value, actual or potential from not being generally known to, and not being readily ascertainable through proper means by, the public.

Information does not include technical data, as that term is defined in DFARS 252.227-7013(a)(14), 252.227- 7015(a)(4), and 252.227-7018(a)(19). Similarly, Information does not include computer software/computer software documentation, as those terms are defined in DFARS 252.227-7014(a)(4) and 252.227-7018(a)(4).

(b) The Naval Information Warfare Systems Command (NAVWAR) may release to individuals employed by NAVWAR support contractors and their subcontractors Information submitted by the contractor or its subcontractors pursuant to the provisions of this contract. Information that would ordinarily be entitled to confidential treatment may be included in the Information released to these individuals. Accordingly, by submission of a proposal or execution of this contract, the offeror or contractor and its subcontractors consent to a limited release of its Information, but only for purposes as described in paragraph (c) of this text.

(c) Circumstances where NAVWAR may release the contractor’s or subcontractors’ Information include the following:

(1) To other NAVWAR contractors and subcontractors, and their employees tasked with assisting NAVWAR in handling and processing Information and documents in the administration of NAVWAR contracts, such as file room management and contract closeout; and,

(2) To NAVWAR contractors and subcontractors, and their employees tasked with assisting NAVWAR in accounting support services, including access to cost-reimbursement vouchers.

(d) NAVWAR recognizes its obligation to protect the contractor and its subcontractors from competitive harm that could result from the release of such Information. NAVWAR will permit the limited release of Information under paragraphs (c)(1) and (c)(2) only under the following conditions:

(1) NAVWAR determines that access is required by other NAVWAR contractors and their subcontractors to perform the tasks described in paragraphs (c)(1) and (c)(2);

(2) Access to Information is restricted to individuals with a bona fide need to possess;

(3) Contractors and their subcontractors having access to Information have agreed under their contract or a separate corporate non-disclosure agreement to provide the same level of protection to the Information that would be provided by NAVWAR employees. Such contract terms or separate corporate non-disclosure agreement shall require the contractors and subcontractors to train their employees on how to properly handle the Information to which they will have access, and to have their employees sign company nondisclosure agreements certifying that they understand the sensitive nature of the Information and that unauthorized use of the Information could expose their company to significant liability. Copies of such employee non-disclosure agreements shall be provided to the Government;

(4) NAVWAR contractors and their subcontractors performing the tasks described in paragraphs (c)(1) or (c)(2) have agreed under their contract or a separate non-disclosure agreement to not use the Information for any purpose other than performing the tasks described in paragraphs (c)(1) and (c)(2); and,

(5) Before releasing the Information to a non-Government person to perform the tasks described in paragraphs (c)(1) and (c)(2), NAVWAR shall provide the contractor a list of the company names to which access is being granted, along with a Point of Contact for those entities.

(e) NAVWAR’s responsibilities under the Freedom of Information Act are not affected by this text.

(f) The contractor agrees to include, and require inclusion of, this text in all subcontracts at any tier that requires the furnishing of Information.

CONTRACTOR PICTURE BADGE

(a) A contractor picture badge may be issued to contractor personnel by the Government upon receipt of a valid visit request from the Contractor and a picture badge request from the COR. A list of personnel requiring picture badges must be provided to the COR to verify that the contract or delivery/task order authorizes performance at the Government installation prior to completion of the picture badge request.

(b) The contractor assumes full responsibility for the proper use of the identification badge and is responsible for the return of the badge upon termination of personnel or expiration or completion of the contract.

(c) At the completion of the contract, the contractor shall forward to the COR a list of all unreturned badges with a written explanation of any missing badges.

CONTRACTOR PERFORMANCE ASSESSMENT REPORTING SYSTEM (CPARS)

(a) The Contractor Performance Assessment Reporting System (CPARS) has been established to collect past performance information on defense contractors as required by FAR 42.1502 (Class Deviation 2013-O0018). The frequency and type of CPARS reports (initial, intermediate, final, out-of-cycle, and addendum) shall be as required in the CPARS Policy Guide that is available at: https://www.cpars.gov/pdfs/CPARS-Guidance.pdf

(b) For orders placed against contracts and agreements the contractor’s performance shall be assessed on an order-by-order basis [____] or total contract/agreement basis [X].

Section I - Contract Clauses

52.202-1 Definitions NOV 2013 52.203-3 Gratuities APR 1984 52.203-5 Covenant Against Contingent Fees MAY 2014 52.203-12 Limitation On Payments To Influence Certain Federal

Transactions

OCT 2010

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights

APR 2014

52.204-2 Security Requirements AUG 1996 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-9 Personal Identity Verification of Contractor Personnel JAN 2011 52.204-13 System for Award Management Maintenance OCT 2018 52.212-4 Contract Terms and Conditions--Commercial Items OCT 2018 52.215-8 Order of Precedence--Uniform Contract Format OCT 1997 52.215-17 Waiver of Facilities Capital Cost of Money OCT 1997 52.215-23 Limitations on Pass-Through Charges OCT 2009 52.222-21 Prohibition Of Segregated Facilities APR 2015 52.242-13 Bankruptcy JUL 1995 52.243-1 Changes--Fixed Price AUG 1987 52.243-1 Alt II Changes--Fixed-Price (Aug 1987) - Alternate II APR 1984 52.244-6 Subcontracts for Commercial Items AUG 2019 52.245-1 Government Property JAN 2017 52.245-9 Use And Charges APR 2012 52.249-2 Termination For Convenience Of The Government (Fixed-

Price)

APR 2012

52.249-8 Default (Fixed-Price Supply & Service) APR 1984 52.253-1 Computer Generated Forms JAN 1991 252.201-7000 Contracting Officer's Representative DEC 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.203-7003 Agency Office of the Inspector General AUG 2019 252.204-7000 Disclosure Of Information OCT 2016 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7004 Antiterrorism Awareness Training for Contractors. FEB 2019 252.204-7009 Limitations on the Use or Disclosure of Third-Party

Contractor Reported Cyber Incident Information

OCT 2016

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support

MAY 2016

252.205-7000 Provision Of Information To Cooperative Agreement Holders DEC 1991 252.209-7004 Subcontracting With Firms That Are Owned or Controlled By

The Government of a Country that is a State Sponsor of Terrorism

MAY 2019

252.211-7003 Item Unique Identification and Valuation MAR 2016 252.211-7007 Reporting of Government-Furnished Property AUG 2012 252.211-7008 Use of Government-Assigned Serial Numbers SEP 2010 252.219-7003 Small Business Subcontracting Plan (DOD Contracts) MAY 2019 252.223-7004 Drug Free Work Force SEP 1988 252.225-7001 Buy American And Balance Of Payments Program-- Basic DEC 2017 252.225-7002 Qualifying Country Sources As Subcontractors DEC 2017

252.225-7012 Preference For Certain Domestic Commodities DEC 2017 252.227-7000 Non-estoppel OCT 1966 252.227-7001 Release Of Past Infringement AUG 1984 252.227-7004 License Grant AUG 1984 252.227-7005 Alt I License Term Alternate I OCT 2001 252.231-7000 Supplemental Cost Principles DEC 1991 252.232-7010 Levies on Contract Payments DEC 2006 252.239-7010 Cloud Computing Services OCT 2016 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.243-7002 Requests for Equitable Adjustment DEC 2012 252.244-7000 Subcontracts for Commercial Items JUN 2013 252.244-7001 Contractor Purchasing System Administration MAY 2014 252.245-7003 Contractor Property Management System Administration APR 2012 252.245-7004 Reporting, Reutilization, and Disposal DEC 2017

CLAUSES INCORPORATED BY FULL TEXT

52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS (JUN 2016)

(a) Definitions. As used in this clause--

Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

52.204-25 PROHIBITION ON CONTRACTING FOR CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (AUG 2019)

Covered foreign country means The People's Republic of China.

Covered telecommunications equipment or services means--

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means--

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled--

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service.

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in Federal Acquisition Regulation 4.2104.

(c) Exceptions. This clause does not prohibit contractors from providing--

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(d) Reporting requirement.

(1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause to the Contracting Officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause:

(i) Within one business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services.

(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items.

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS--COMMERCIAL ITEMS (MAY 2019)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L.

113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

X (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

X (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

____ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

X (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L. 109-

282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div.

C).

____ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L.

111-117, section 743 of Div. C).

X (8) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

X (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

____ (10) [Reserved]

____ (11)(i) 52.219-3, Notice…