Combine_Synopsis_Solicitation_-_19-Q-5012_PV_Maintenance.pdf

N62473-19-Q-5012 DUE: 16 October 2018

SMALL BUSINESS SET ASIDE

This is a Request for Quotes (RFQ) from Naval Facilities Engineering Command Southwest

(NAVFAC SW) combined synopsis/solicitation for a services necessary to all labor, management supervision, tools, material and equipment to provide scheduled preventive maintenance, condition assessment, operational testing, and corrective maintenance on Solar Photovoltaic (PV) systems, which may include replacement of components, for various installations within the NAVFAC SW Area of

Responsibility (AOR) to include Navy and Marine Corp installation (MCI) within its geographic AOR of California and Arizona. This procurement is to establish an indefinite delivery indefinite quantity

(IDIQ) performance based contract. This solicitation is prepared in accordance with Federal

Acquisition Regulation (FAR) Part 12, Acquisition of Commercial Items, and FAR Part 13, Simplified

Acquisition Procedures.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. This is a Full and Open procurement for all business concerns. All quotes submitted will be accepted by the Government. Competitive quotes are being requested under

N62473-19-Q-5012. This RFQ is being procured under NAICS code is 811310 and business size standard is $7.5 Million. The Government anticipates awarding IDIQ performance based contract for a base period of 12 months and three 12-month option periods for a total duration of four years/48 months. Task Orders/Modifications will be issued as Firm-Fixed Price (FFP) orders.

Basis for award: The Government anticipates awarding an IDIQ performance based contract for recurring and nonrecurring services as a Lowest Priced Technically Acceptable (LPTA) proposal.

Technical Specification:

Contractor shall be licensed and certified to perform the recurring and nonrecurring preventive maintenance, condition assessment, operational testing, and corrective maintenance on Solar

PV systems as described in the Performance Work Statement (PWS). The contractor shall provide labor, supervision, management, and materials (except those specified as Government furnished), to perform the Sustainment, Restoration, and Modernization (SRM) functions only of Technical Annex 1502000 – Facility.

Quote must include the following:

(1) The solicitation number, reference: N62473-19-Q-5012 PV Maintenance Service

(2) The name, address, and telephone number of the Offeror;

(3) Price and any discount terms;

(4) “Remit to” address, if different than mailing address;

(5) A completed copy of the representations and certifications at FAR 52.212-3 (see FAR 52.212-

3(b) for those representations and certifications that the proposal shall complete electronically);

(6) Acknowledgment of Solicitation Amendments;

(7) Include a statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation.

(8) Individually listed labor categories, direct labor hours, direct/burdened hourly labor rates for each labor category.

(9) Unit price for each required material/complete Exhibit Line Item Number (ELIN) Pricing

Schedule.

(10) Licenses and Certifications. See technical acceptability evaluation factor below for details.

Quotes are due by 30 October 2018, at 2:00 PM, Pacific Time. Questions and quotes shall be E-mail to Nguyen Truong at nguyen.truong@navy.mil and aubry.m.rust@navy.mil . All request for information shall be received by 25 October 2018. The point of contact for this solicitation is Nguyen

Truong at nguyen.truong@navy.mil or (619) 532-2443, Aubry Rust at (619) 532-1669. Please include

RFQ N62473-19-Q-5012 on all inquiries.

Offerors are responsible for submitting quotations so as to reach the Government office designated in the solicitation by the time specified in the solicitation.

Any quotes received at the Government office designated in the RFQ after exact time specified for receipt of quotations is late and will not be considered unless it is received before contract issuance and the Contracting Officer determines that accepting the late quotation would not unduly delay the acquisition.

Offeror must comply with the detailed instructions for the format and content of the proposal; if the proposal does not comply with the detailed instructions for the format and content of the proposal, the proposal may be considered non-responsive and may render the quote ineligible for award.

All responding vendors must have a completed registration in the System for Award Management

(SAM) website prior to award of contract. Information can be found at https://www.sam.gov/.

Complete SAM registration means a registered DUNS and CAGE Code numbers.

Attachments:

1. PWS – PV Maintenance

a. Annex 0100000 - General Information

b. Annex 0200000 - Management and Administration

c. Annex 1502000 - Facility Investment

2. J-0200000-02 Wage Determination

3. J-1502000-02 PV System Inventory

4. J-1502000-05 PM Reports

5. ELIN Pricing Schedule

THE RFQ AND ASSOCIATED DOCUMENTATION WILL BE AVAILABLE IN ELECTRONIC

FORMAT ONLY. No hard copies will be provided. Amendments will be posted on the web site for downloading. Amendments will be posted on Navy Electronic Commerce Online (NECO) https://www.neco.navy.mil/ for downloading. This will be the only method of distributing amendments; therefore, IT IS THE OFFEROR’S RESPONSIBILITY TO CHECK THE WEB SITE

PERIODICALLY FOR ANY AMENDMENTS TO THIS SOLICITATION.

The Government will not pay for information requested nor will it compensate any respondent for any quotations. The Government will award a contract resulting from this RFQ to the responsible Offeror submitting the lowest priced, technically acceptable offer.

https://www.sam.gov/

This solicitation document incorporates provisions and clauses in effect through Federal Acquisition

Circular (FAC) 2005-92, Effective 18 November 2016 and Defense Federal Acquisition

Regulation Supplement (DFARS), Publication Notice 20161104, Effective 04 November 2016 provisions. The clauses can be accessed in full text at www.farsite.hill.af.mil.

FAR Clause 52.212-1, Instructions to Offerors Commercial (Deviation 2018-O0013) and 52.212-4, Contract Terms and Conditions Commercial Items, incorporated by reference, applies to this acquisition. FAR Clause 52.212-3, Offeror Representations and Certifications -- Commercial Items and DFAR S 252.212-7000 Offeror Representations and Certifications – Commercial Item applies to this acquisition, FAR Clause 52.212-5-Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items applies to acquisition and includes:

FAR Clause at 52.212-2 Evaluation – Commercial Items basis for award will be the LPTA.

(a) Basis for award will be the LPTA offer. At the Contracting Officer’s discretion, one or more, but not necessarily all, of the evaluation procedures in FAR Part 15 may be used.

The Government intends to make a single award to the responsible Offeror whose offer is LPTA.

Award will be made upon price reasonableness determination, contractor determination of responsibility within the meaning of FAR Part 9, and acceptance to the provisions set forth herein. The following factors shall be used to evaluate offers:

(i) Price

(ii) Technical Acceptability – Maintain the following licenses and certification:

a. California C-10 Electrical Contractors license

b. California C-46 Renewable Energy Contractors license

c. North American Board of Certified Energy Practitioners (NABCEP) PV Installation

Professional certification

The Government intends to make award on the basis of the lowest evaluated price of quotes meeting the acceptability standards for Factors (i) and (ii), which are the non-price factors. The Government will not provide additional credit for those proposals that may exceed the standards. The technical capability to provide PV Maintenance Services meeting the specifications (Factors ii) are equal to price

(Factor i).

Offerors quotations will be evaluated under Factors (i) and (ii) above, which represents minimum acceptable criteria. Under these factors, the Government will rate the quote as either acceptable or unacceptable. Failure to meet the minimum criteria for this factor will render the entire quote unacceptable and the quote may not be considered for award.

Offerors will be evaluated in an efficient and minimally burdensome fashion per FAR 13.106-2(b)(3).

The lowest priced offer will be evaluated for fair and reasonable. The price will include the total of all options, and recurring and nonrecurring services. If the lowest priced offer is determined to be fair and reasonable, then Factors (ii) will be evaluated for technical acceptability. Failure to meet the minimum criteria for any one of these Factors will render the entire quote unacceptable and the next lowest quote http://www.farsite.hill.af.mil/ will be evaluated for fair and reasonable, and technical acceptability. The evaluation of offers will continue until the lowest priced technically acceptable offer is determined by the contracting officer.

The Government will rate the Factor (ii) as follows:

Rating Description

Acceptable Proposal meets the requirements of the solicitation. All licenses and certifications are provided and current.

Unacceptable Proposal does not meet the requirements of the solicitation. Licenses and certifications are omitted and/or not current.

(b) Price. All vendors shall provide pricing for the ELIN Schedule identified and a total overall price.

See FAR 13.004 Legal Effect of Quotations for information pertaining to offer and acceptance of a binding contract. Please note, funds are not presently available for the following locations: NAF

El Centro, MCAS Yuma, MCLB Barstow, and MCRD Barstow. Offerors shall not propose prices for these locations unless otherwise notified via amendment to the solicitation. The

Government reserves the right to add these locations to the contract via modification in the event funds become available post award subject to FAR 52.232-18, Availability of Funds (Apr 1984).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful

Offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

At the discretion of the Contracting Officer, the Government intends to evaluate proposals and award a contract without discussions with Offerors. Each initial offer should, therefore contain the Offeror’s best terms from both a price and technical standpoint. However, the Contracting Officer reserve the right to enter into discussions if necessary.

Minimum/Maximum: CLIN Delivery/Task Order Minimum/Maximum Quantity and CLIN Order.

This will be an IDIQ delivery type of contract for a period of one twelve-month base period from date of award with a 15 days phase-in period and options to extend for three, twelve-month option periods;

not to exceed a total of four (4) years/48 months. Funding will be allocated on the beginning of each period of performance for the recurring and non-recurring services. Additional non-recurring services may be funded at the task order level. The maximum or NTE value of the contract is $7 million to include all the ELINs and option periods.

Payment Instructions: Standard Payment Instructions: The standard payment instructions identified in the link below are applicable.

https://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/PGI1204_71htm#payment_instructions

52.202-1, Definitions

52.203-6, Restrictions on Subcontractor Sales to the Government--Alternate I

52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements

52.204-2, Security Requirements

52.204-7, System for Award Management

52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards https://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/PGI1204_71htm#payment_instructions

52.204-13, System for Award Management Maintenance

52.204-16, Commercial and Government Entity Code Reporting

52.204-17, Ownership or Control of Offeror

52.204-18, Commercial and Government Entity Code Maintenance

52.204-19, Incorporation by Reference of Representations and Certifications

52.209-2, Prohibition on Contracting with Inverted Domestic Corporations – Representation52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or

Proposed for Debarment. (Dec 2010) (31 U.S.C. 6101 note)

52.209-7 Information Regarding Responsibility Matters

52.209-10, Prohibition on Contracting with Inverted Domestic Corporations

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law

52.215-20, Requirements for Certified Cost or Pricing Data and Data Other than Certified Cost or

Pricing Data

52.216-19, Order Limitations

52.216-20, Definite Quantity

52.216-22, Indefinite Quantity

52.216-24, Limitation of Government Liability

52.217-3, Evaluation Exclusive of Options

52.217-5, Evaluation of Options

52.217-8, Option to Extend Services

52.217-9, Option to Extend the Term of the contract

52.219-6, Notice of Total Small Business Set-Aside

52.219-8, Utilization of Small Business Concerns

52.219-9, Small Business Subcontracting Plan

52.219-14, Limitations on Subcontracting (DEVIATION 2018-O0013)

52.219-16, Liquidated Damages-Subcontracting Plan

52.219-28, Post-Award Small Business Program Representation

52.222-3, Convict Labor

52.222-19, Child Labor—Cooperation with Authorities and Remedies (E.O. 13126)

52.222-21, Prohibition of Segregated Facilities

52.222-26, Equal Opportunity (E.O. 11246)

52.222-35, Equal Opportunity of Veterans

52.222-36, Equal Opportunity for Workers with Disabilities

52.222-37, Employment Reports of Veterans

52.222-40, Notification of Employee Rights Under the National Labor Relations Act

52.222-41, Service Contract Labor Standards

52.222-42, Statement of Equivalent Rates for Federal Hires

52.222-44, Fair Labor Standards Act and Service Contract Labor Standards—Price Adjustment

52.222-50, Combating Trafficking in Persons (22 U.S.C. 7104(g)

52.222-54, Employment Eligibility Verification

52.222-55, Minimum Wages Under Executive Order 13658

52.222-62, Paid Sick Leave Under Executive Order 13706

52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving

52.225-13, Restrictions on Certain Foreign Purchases

52.225-25 Prohibition on Contracting with Entities Engaging in Certain Activities or Transactions

Relating to Iran – Representation and Certifications

52.232-33, Payment by Electronic Funds Transfer—Central Contractor Registration (31 U.S.C. 3332)

52.232-39, Unenforceability of Unauthorized Obligations

52.232-40, Providing Accelerated Payments to Small Business Subcontractors.

52.233-3, Protest After Award (31 U.S.C. 3553)

52.233-4, Applicable Law for Breach of Contract Claim (Pub. L. 108-77, 108-78)

52.243-1, Changes – Fixed-Price, Alternate I

52.252-1, Solicitation Provisions Incorporated by Reference

252.203-7000, Requirements Relating to Compensation of Former DoD Officials

252.203-7002, Requirement to Inform Employees of Whistleblower Rights

252.203-7005, Requirements Relating to Compensation of Former DoD Officials

252.204-7003, Control of Government Personnel Work Product

252.204-7008, Compliance with Safeguarding Covered Defense Information Controls.

252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting

252.204-7015, Notice of Authorized Disclosure of Information and Cyber Incident Reporting

252.211-7003, Item Unique Identification and Valuation (applies to items over $5k)

252.215-7007, Notice of Intent to Resolicit

252.216-7006, Ordering

252.217-7027 Contract Definitization

252.232-7003, Electronic Submission of Payment Requests and Receiving Reports

252.232-7006, Wide Area WorkFlow Payment Instructions

252.232-7010, Levies on Contract Payments

252.237-7010, Prohibition on Interrogation of Detainees by Contractor Personnel

525-243-7002, Requests for Equitable Adjustment

252.244-7000, Subcontracts for Commercial Items

252.246-7003, Notification of Potential Safety Issues

252.246-7004, Safety of Facilities, Infrastructure, and Equipment for Military Operations

252.246-7008, Sources of Electronic Parts

252.247-7004, Pass-Through of Motor Carrier Fuel Surcharge Adjustment to the Cost Bearer

252.203-7005 Representation Relating to Compensation of Former DoD Officials

252.203-7996, Prohibition of Contracting with Entities that Require Certain Internal

Confidentiality Agreements

(a) In accordance with section 101(a) of the Continuing Appropriations Action, 2016 (Pub. L. 114-

53) and any subsequent FY 2016 appropriations act that extends to FY 2016 funds the same restrictions as are contained in section 743 of division E, title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235), none of the funds appropriated (or otherwise made available) by this or any other Act may be used for a contract with an entity that requires employees or subcontractors of such entity seeking to report fraud, waste, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or contractors from lawfully reporting such waste, fraud or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(b) The prohibition in paragraph (a) of this provision does not contravene requirements applicable to Standard Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(c) Representation. By submission of its offer, the Offeror represents that it does not require employees or subcontractors to such entity seeking to report fraud, waste, or abuse to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or contractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(End of Provision).

252.203-7994 Prohibition of Contracting with Entities that Require Certain Internal

Confidentiality Agreements – Representation (Deviation 2017-O0001) (NOV 2016)

(a) In accordance with Continuing Appropriations Act, 2017 (Pub. L. 114-223), or any other

Act that extends to fiscal year 2017 funds the same prohibitions as contained in section 743, division

E, title VII, of the Consolidated Appropriations Act, 2016 (Pub. L. 114-113), none of the funds appropriated (or otherwise made available) by this or any other Act may be used for a contract with an entity that requires employees or subcontractors of such entity seeking to report fraud, waste, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or contactors from lawfully reporting such waste, fraud, or abuse to a designated

(b) The prohibition in paragraph (a) of this provision does not contravene requirements applicable to Standard Form 312, Form 4414, or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(c) Representation. By submission of its offer, the Offeror represents that it does not require employees or subcontractors of such entity seeking to report fraud, waste, or abuse to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or contactors from lawfully reporting such waste, fraud, or abuse to a designated

(End of provision)

252.204-7008 COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE INFORMATION CONTROLS.

(A) Definitions. As used in this provision—

“Controlled technical information,” “covered contractor information system,” and “covered defense information” are defined in clause 252.204-7012, Safeguarding Covered Defense Information and Cyber

Incident Reporting (DEVIATION 2016- O0001) (OCT 2015).

(a) The security requirements required by contract clause 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting (DEVIATION 2016-O0001) (OCT 2015) shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.

(b) If the Offeror anticipates that additional time will be necessary to implement derived security requirement

3.5.3 “Use of multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts” within National Institute of Standards and Technology (NIST) Special

Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations (see http://dx.doi.org/10.6028/NIST.SP.800- 171), the Offeror shall notify the

Contracting Officer that they will implement the requirement within 9 months of contract award.

(c) If the Offeror proposes to deviate from any of the security requirements in NIST SP 800-171that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of—

(1) Why a particular security requirement is not applicable; or

(2) How an alternative, but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(d) An authorized representative of the DoD CIO will approve or disapprove offeror requests to deviate from

NIST SP 800-171 requirements in writing prior to contract award. Any approved deviation from NIST SP

800-171 shall be incorporated into the resulting contract.

(End of provision)

252.204-7012, Safeguarding of Unclassified Controlled Technical Information

Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

“Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.

http://dx.doi.org/10.6028/NIST.SP.800-

“Covered defense information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

(End of Clause)

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

‘‘Operationally critical support’’ means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

“Rapidly report” means within 72 hours of discovery of any cyber incident.

“Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data—

Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of an

Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the clause

252.239-7010, Cloud Computing Services, of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting

Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than

December 31, 2017. For all contracts awarded prior to October 1, 2017, the Contractor shall notify the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting

Officer, for consideration by the DoD CIO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

(C) If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraphs (b)(1) and (2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability.

These measures may be addressed in a system security plan.

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall—

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

(ii) Rapidly report cyber incidents to DoD at http://dibnet.dod.mil.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for

DoD and shall include, at a minimum, the required elements at http://dibnet.dod.mil.

(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see http://iase.disa.mil/pki/eca/Pages/index.aspx.

(d) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DoD Cyber

Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by

DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the

Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(h) DoD safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the

Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(i) Use and release of contractor attributional/proprietary information not created by or for DoD.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for DoD is authorized to be released outside of

DoD—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes

(including with Defense Industrial Base (DIB) participants in the program at 32 CFR part 236); or

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract that includes the clause at 252.204-7009, Limitations on the Use or Disclosure of

Third-Party Contractor Reported Cyber Incident Information.

(j) Use and release of contractor attributional/proprietary information created by or for DoD.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful

Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(l) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(m) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to—

(i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and

(ii) Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD as required in paragraph (c) of this clause.

(End of clause)