NAMA-15-Q-0030_Requirements_and_Test_Management_System_CSS_Mod_001.docx

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is NAMA-15-Q-0030 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-80 effective March 2, 2015. This is a full and open RFQ under NAICS 511210, Software Publishers. CONTRACT LINE ITEM NUMBER(S): See Attachment 1, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain a Requirements and Test Management system. See Attachment 2, Requirements. PERIOD OF PERFORMANCE: The period of performance will consist of a base year and four (4) option years. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant purchase order, with the exception of FAR provisions which will be removed prior to award: FAR 52.212-1, Instructions to Offerors - Commercial Items (Apr 2014). Addenda: (1) Change paragraph (c) to read: Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 90 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation. (2) Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR Subpart 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5[footnoteRef:1], Test Program for Certain Commercial Items as prescribed by FAR 12.301(c)(2). Selection of the Contractor to perform this purchase order will be based on NARA’s assessment of the best overall value to the Government. Accordingly, best value for this purchase order will be evaluated based on the following evaluation factors: (1) Technical Approach (Volume I). The Government will assess the Contractor’s demonstrated technical knowledge and competence with regard to the Government’s requirements and program objectives; and approach to the work that the Contractor would have to perform under the prospective purchase order. The Government will assess whether the Contractor exhibits adequate techniques and approaches to meet purchase order needs and provide effective and efficient support. The Government will also assess the Government Product/Service Accessibility Template (GPAT) (See Attachment 6, Government Product/Service Accessibility Template for Application/Operating System Software) or the Contractor’s supplied Vendor Product/Service Accessibility Template (VPAT). Contractors must identify the type of training that will be provided (Web-based or Instructor-led). Contractors must submit documentation that verifies FedRAMP certification. (2) Relevant Past Performance (Volume II). The Contractor will be evaluated to assess the demonstrated quality of performance on similar work, to include the ability to control the quality and cost of work, timeliness of performance, and effectiveness at accomplishing the goals of previous relevant work. Contractors are requested to submit no more than five (5) references for relevant past performance performed during the past five (5) years. Submission should include the entity name, a point of contact, contact information, dollar value of contract/order, brief description of work performed, and an explanation of how any performance difficulties were addressed and resolved. If the interested Contractor has no relevant past performance, an affirmative statement that no relevant past performance exists must be submitted. (3) Price (Volume III). All technical factors are equal in importance. All evaluation factors other than cost or price, when combined, are more important than cost or price. Selection of the Contractor to perform this purchase order will be based on NARA’s assessment of the best overall value to the Government. The Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions”. The Contractor must also include complete rationale, justification, and the cost impact of each exception noted. The Government reserves the right to make an award on the initial quotation without discussions of this procurement. For evaluation purposes, the total ceiling price for each not-to-exceed Contract Line Item Number (CLIN) will be determined by multiplying the maximum quantity by the fixed unit price. The total price for each fixed-price CLIN will be determined by multiplying the quantity by the fixed unit price. The total ceiling price for each performance year will be determined by summing the total prices of each CLIN. The evaluated total purchase order ceiling price will be determined by summing the total ceiling prices of all performance years (base year and all option years). FAR 52.212-3, Offeror Representations and Certifications - Commercial Items (Mar 2015) - The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certificates electronically via the System for Award Management (SAM) Web site accessed through http://www.acquisition.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (p) of this provision. FAR 52.212-4, Contract Terms and Conditions - Commercial Items (Dec 2014) – See Attachment 3, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Mar 2015) - see Attachment 4, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. Full text provisions and clauses can be found at http://www.acquisition.gov/far/. QUESTIONS: Questions regarding this RFQ must be submitted in writing to Mr. Jonathan Santana at jonathan.santana@nara.gov no later than 12:00 PM ET on April 9, 2015 to be considered. Questions submitted in any other manner will not be answered. The Government will answer questions or requests for clarification via a written RFQ amendment. RFQ CLOSE DATE: Quotations should be received by 12:00 PM ET on April 23, 2015. Failure to submit quotations by the due date may result in rejection of the quotation as untimely. Contractors submitting via e-mail are cautioned to allow one extra business day for delivery and confirm receipt of quotation as the e-mail will need to pass through IT security. QUOTATION SUBMISSION INSTRUCTIONS: NARA requests that Contractors email one (1) copy of the quotation (Volumes I, II and III) to: jonathan.santana@nara.gov. However, Contractors may mail one (1) hardcopy and one (1) CD of each quotation. Mailed quotations must be sent to: National Archives and Records Administration, Attention: Mr. Jonathan Santana, 8601 Adelphi Road, Room 3340, College Park, MD 20740-6001. [1: . NARA issued a class deviation to the sunset provision under FAR Subpart 13.500(d) as authorized by the Civilian Agency Acquisition Council (CAAC).]

ATTACHMENT 1

SCHEDULE OF PRICES

Base Year – Months 1-12

10 Max

NTE

25 Max

NTE

37 Max

NTE

(Including Cloud Hosting)

(OPTIONAL CLIN)

NTE

Option Year I – Months 13-24

10 Max

NTE

25 Max

NTE

(Including Cloud Hosting)

(OPTIONAL CLIN)

0 Min/ 2 Max

NTE

(OPTIONAL CLIN)

NTE

Option Year II – Months 25-36

10 Max

NTE

25 Max

NTE

(Including Cloud Hosting

(OPTIONAL CLIN)

0 Min/ 2 Max

NTE

(OPTIONAL CLIN)

NTE

Option Year III – Months 37-48

10 Max

NTE

25 Max

NTE

(Including Cloud Hosting

(OPTIONAL CLIN)

0 Min/ 2 Max

NTE

(OPTIONAL CLIN)

NTE

Option Year IV – Months 49-60

10 Max

NTE

25 Max

NTE

(OPTIONAL CLIN)

0 Min/ 2 Max

NTE

(OPTIONAL CLIN)

NTE

Note: CLIN = Contract Line Item Number; QTY=Quantity, and NTE=Not-to-Exceed

ATTACHMENT 2

REQUIREMENTS

REQUIREMENTS AND TEST MANAGEMENT SYSTEM

1.0 BACKGROUND

1.1 The National Archives and Records Administration (NARA)’s mission is to safeguard and preserve the records of the United States Government, ensuring that the public can discover, use, and learn from this documentary heritage. NARA ensures ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience. The agency meets thousands of information needs daily, ensuring access to records on which the entitlements of citizens, the credibility of the United States Government, and the accuracy of history depend.

1.2 To further its mission, NARA is seeking to improve integration between requirements and test activities for the Office of Information Services’ (I) Quality Assurance Division (IQ).

1.3 NARA currently utilizes Rational RequisitePro version 7.1.1 and Rational Change & Configuration Management Application in Rational Team Concert (RTC) version 5.0.2.

2.0 SCOPE

2.1 NARA has a requirement for an integrated requirements and test management system for IQ’s Systems Requirements Management (IQS) and Test (IQT) Branches. This will allow for increased collaboration between the IQS and IQT teams to develop and review requirements, test cases, test scripts, defects and test procedures prior to release. The tools will also allow for mapping of the requirements to test artifacts. By obtaining these tools, they will provide support for peer reviews and tracking of updates and changes for requirements.

2.2 The system also includes waterfall, iterative and agile development activities for IQS and IQT. This is necessary in order to develop requirements, user stories and tasks, and user stories to test cases and defects.

2.3 The Contractor selected for this requirement shall provide a system with agile capabilities related to creating user stories to test activities. The system shall be hosted in an accredited FedRAMP environment. FedRAMP impact level is Moderate (See Attachment 5, FedRAMP Terms and Conditions for Hosted Solutions and Cloud Computing Services).

2.4 Performance Requirements. The system shall provide the capability to be 99% available, 24 hours a day, 7 days a week.

2.5 The system shall provide the following capabilities for the requirements and test management tools:

2.7 The system will reside in the Contractor’s cloud environment.

3.0 REQUIREMENTS

3.1 Table of Requirements. The system shall provide, at a minimum, the capabilities as listed in Appendix A.

3.2 Additional Functionality. Appendix B lists items that NARA does not consider mandatory, but would prefer.

4.0 TRAINING

4.1 The Contractor shall provide either web-based or instructor-led training for users and administrator support. User training shall support up to thirty-five (35) participants and Administrator Support training shall support up to two (2) participants.

4.2 The Contractor shall provide user manuals and training materials to be utilized during training.

4.3 NARA will provide the Contractor with two (2) weeks advance notice for scheduling and performance of training.

4.4 If provided, instructor-led training will take place at NARA’s Archives II facility, located at: 8601 Adelphi Road, College Park, MD 20740. See Attachment 3, Additional NARA Terms and Conditions, Paragraph VI, Reimbursement of Travel Costs.

5.0 GOVERNMENT FURNISHED INFORMATION (GFI)

Requests for Government Furnished Information, NARA IT Security Requirements, must be submitted in writing prior to the solicitation closing date to the Contract Specialist identified in the Quotation Submission Instructions of the solicitation cover sheet.

APPENDIX A

TABLE OF REQUIREMENTS

REQUIREMENTS MANAGEMENT TOOL

Category #1: Capture and Edit Requirements/User Stories

1.1 Create documents.

1.2 Create requirements.

1.3 Create user stories.

1.4 Edit requirements.

1.5 Edit user stories.

1.6 Import requirements, user stories, attributes, and traceability from an external source.

1.7 Upload a MS Word Document.

1.8 Upload a MS Excel file.

1.9 Delete requirements.

1.10 Delete user stories.

Category #2: Organize Requirements/User Stories

2.1 Create packages (i.e. folders).

2.2 Create a hierarchy between requirements.

2.3 Create a hierarchy between user stories.

2.4 Create requirement attributes.

2.5 Create user story attributes.

2.6 Group documents by project.

2.7 Group requirements by using tags.

2.8 Retain requirement numbering.

2.9 Group user stories by using tags.

2.10 Retain user story numbering.

2.11 Create requirement prefixes.

2.12 Create user story prefixes.

Category #3: Analyze Requirements/User Stories

3.1 Filter requirements by attributes, tags, folders, and types.

3.2 Filter user stories by attributes, tags, folders, and types.

3.3 Establish baselines for individual projects.

3.4 Create a project from an existing project.

3.5 Search requirements.

3.6 Search user stories.

3.7 Sort requirements by attributes, tags, folders, and types.

3.8 Sort user stories by attributes, tags, folders, and types.

Category #4: Change Management

4.1 View changes to requirements traceability.

4.2 View changes to user stories traceability.

4.3 Audit system activity.

4.4 Create versions of requirements.

4.5 Create versions of user stories.

4.6 Notify users of changes to requirements.

4.7 Notify users of changes to user stories.

Category #5: Create and View Requirements/User Stories Traceability

5.1 Create and view backwards and forwards requirements traceability.

5.2 Create and view requirements traceability to documents.

5.3 Create and view backwards and forwards user story traceability.

5.4 Create and view user story traceability to documents.

Category #6: Communicate and Collaborate on Requirements/User Stories

6.1 User(s) to approve or reject requirements.

6.2 User(s) to approve or reject user stories.

6.3 Sign-off on documents.

6.4 View the current status of requirements.

6.5 View the current status of user stories.

6.6 Review requirements as a team.

6.7 Review user stories as a team.

6.8 Review comments on a document as a team.

6.9 Apply comments to requirements.

6.10 Apply comments to user stories.

6.11 Apply comments to a document.

6.12 Assign tasks to users and receive notifications.

6.13 Notify users of new requirements created for a project.

6.14 Notify users of new user stories created for a project.

Category #7: Generate Business Models

7.1 Create use case diagrams.

7.2 Import and link business process diagrams, images, and files to requirements.

7.3 Import and link business process diagrams, images, and files to user stories.

Category #8: Reporting

8.1 Export requirements to MS Word format.

8.2 Export requirements to MS Excel format.

8.3 Export user stories to MS Word format.

8.4 Export user stories to MS Excel format.

8.5 Generate reports based on requirements attribute, traceability, prioritization, and status.

8.6 Generate reports based on a user story attribute, traceability, prioritization, and status.

8.7 Create a dashboard.

Category #9 Data Migration

9.1 Send and receive data from Rational Team Concert (RTC).

Category #10: Accessibility

10.1 Integrate with the NARA Enterprise LDAP server.

Category #11: Testing

11.1 Link requirements to test artifacts, including test cases, defects, test procedures and test scripts.

11.2 View requirements associated with a test defect.

11.3 Link user stories to test artifacts, including test cases, defects, test procedures, acceptance criteria and test scripts.

11.4 View user stories associated with a test defect.

APPENDIX A (Cont’d.)

TEST MANAGEMENT TOOL

Category #1: Create Test Assets

1.1 Create documents (i.e. test plan).

1.2 Create a test case.

1.3 Create a test defect.

1.4 Import a MS Excel file.

1.5 Upload a MS Excel file.

1.6 Create attributes for test assets (i.e. test cases, defects, test procedures and test scripts)

1.7 Generate a unique number for test assets (i.e. test cases, defects, test procedures and test scripts)

Category #2: Analyze Test Assets

2.1 Filter test assets (i.e. test cases, defects, test procedures and test scripts) by attributes, tags, folders, and types.

2.2 Group test assets (i.e. test cases, defects, test procedures and test scripts)

2.3 Establish baselines for individual projects.

Category #3: Test Execution

3.1 Execute a test case.

3.2 Maintain a history of all test runs, execution sessions and defects.

Category #4: Change Management

4.1 Edit test assets (i.e. Test plans, test cases, defects, test procedures and test scripts).

4.2 View changes to requirements traceability.

4.3 View changes to user story traceability.

4.4 View changes to test assets (i.e. test cases, defects, test procedures and test scripts).

4.5 Audit system activity.

4.6 Create versions of test assets (i.e. test cases, defects, test procedures and test scripts)

4.7 Notify users of changes to requirements.

4.8 Notify users of changes to user stories.

4.9 Notify users of changes to test assets (i.e. test cases, defects, test procedures and test scripts).

Category #5: Traceability

5.1 Link requirements to test cases.

5.2 Link user stories to test cases.

5.3 Link requirements to test defects.

5.4 Link user stories to test defects.

5.5 Link requirements to test scripts/procedures.

5.6 Link user stories to test scripts/procedures.

Category #6: Communicate and Collaborate on Test Assets

6.1 Assign tasks to users and receive notifications.

Category #7: Reporting

7.1 Export test data to MS Word format.

7.2 Export test data into a MS Excel format.

7.3 Generate reports.

7.4 Generate graphical reports.

7.5 Distribute reports to internal and external users.

Category #8 Data Migration

8.1 Data from other tools such as Rational Team Concert.

APPENDIX B

ADDITIONAL FUNCTIONALITY

REQUIREMENTS MANAGEMENT TOOL

Category #1: Capture and Edit Requirements/User Stories

1.1 Create requirements as a document.

1.2 Create user stories as a document.

1.3 Generate project templates.

Category #6: Communicate and Collaborate on Requirements/User Stories

6.1 Create user interface mockups and storyboards.

6.2 Export requirements to PDF format.

6.3 Export user stories to PDF format.

6.4 Generate graphical reports.

6.5 Distribute reports to internal and external users.

Category #12: System Environment

12.1 Provide configurable system workflow processes.

APPENDIX B (Cont’d.)

TEST MANAGEMENT TOOL

Category #1: Create Test Assets

1.1 Create test procedures.

1.2 Create test scripts.

Category #3: Test Execution

3.1 Support automated testing.

3.2 Support performance testing.

3.3 Support risk-based testing.

3.4 Synchronize project schedules with test activities.

Category #4: Change Management

4.1 Create multiple versions of test assets and maintain change history.

Category #6: Communicate and Collaborate on Test Assets

6.1 View the current status of requirements.

6.2 View the current status of user stories.

6.3 View the current status of a test defect.

6.4 View the current status of a test execution.

6.5 Assign tasks to users and receive notifications.

Category #7: Reporting

7.1 Create a dashboard.

Category #9: Accessibility

9.1 Integrate with the NARA LDAP server.

ATTACHMENT 3

ADDITIONAL NARA TERMS AND CONDITIONS

(Addenda to FAR clause 52.212-4)

I. GOVERNMENT PURCHASE ORDER ADMINISTRATION

A. This purchase order will be administered by:

National Archives and Records Administration Acquisitions Branch, Code BCN 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

B. Contract Specialist (CS):

Jonathan Santana (Contractor) Telephone: 301-837-0310 Email: jonathan.santana@nara.gov

The Contracting Officer (CO) has the overall responsibility for the administration of this purchase order. Written communication to the Contract Specialist (CS) must make reference to the purchase order number and must be emailed or mailed with postage prepaid, to the above address.

C. Contracting Officer (CO):

Any Warranted BCN CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the purchase order terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from purchase order payments for non-performance or unsatisfactory performance; terminate the purchase order for convenience or default; and issue final decisions regarding purchase order questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

D. NARA Point of Contact (POC): TBD

1. The individual named above is designated as the POC to assist the CS in the discharge of the CS’ responsibilities. The POC is responsible for monitoring, giving progress reports to the CS, and overall technical surveillance of services to be performed under this purchase order and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the purchase order between the Contractor and any person other than the CO be effective or binding upon the Government.

2. When, in the opinion of the Contractor, the POC requests effort outside the existing scope of the purchase order, the Contractor must promptly notify the CS in writing.

3. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

4. The responsibilities of the POC include, but are not limited to, the following:

II. INVOICE SUBMISSION INSTRUCTIONS

A. The preferred method for invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury’s Bureau of the Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

B. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via e-mail at AccountsPayable@bpd.treas.gov or by phone at 304-480-8000, Option 7.

C. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by e-mail to NAR@bpd.treas.gov. Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

D. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

E. For invoice and payment questions call the Fiscal Service AP Help Desk at 304-480-8000, Option 7.

III. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the purchase order, other than claims in stated amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s claim to amounts payable under the purchase order has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. 3727, 41 U.S.C. 6305), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the purchase order is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

IV. SECURITY OF SYSTEMS HANDLING AND PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION (SEPTEMBER 2014)

(a) Applicability

This clause applies to all personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

1. Name.

1. Date of birth.

1. Mailing address.

1. Telephone number.

1. Social Security Number.

1. Email address.

1. Zip code.

1. Account numbers.

1. Certificate/license numbers.

1. Vehicle identifiers including license plates.

1. Uniform resource locators (URLs).

1. Internet protocol addresses.

1. Biometric identifiers (e.g., fingerprints).

1. Photographic facial images.

1. Any other unique identifying number or characteristic.

1. Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this purchase order.

(2) The Contractor, Contractor employees, and subcontractors must physically or electronically secure sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed, as specified in the purchase order, or if not specified in the purchase order, through means that will make the sensitive PII irretrievable.

(4) The Contractor shall only use sensitive PII obtained under this purchase order for purposes of the purchase order; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this purchase order that information to be utilized under this purchase order, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this purchase order, the Contractor shall turn over all sensitive PII obtained under the purchase order that is in its possession.

(d) Systems Access. Work to be performed under this purchase order may require the handling of PII. The Contractor shall provide the Government access to, and information regarding those systems handling sensitive PII for the Government under the purchase order, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this purchase order, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

c) NARA Penalty Guide (Personnel 300, Appendix 752A - Penalty Guide); and

d) NARA’s Media Protection Methodology

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this purchase order until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved;

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current;

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism;

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product;

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology;

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this purchase order;

(vii) Contractor employee annual training and rules of conduct/behavior shall be developed by NARA as part of its annual PII training program. This training will be completed within 30 days of purchase order employees beginning work on a sensitive PII project and thereafter annually. Such completion will be acknowledged by employees in writing and reported to NARA’s Senior Agency Official for Privacy or the SAOP’s designee

(viii) All sensitive PII obtained under this purchase order shall be removed from Contractor-Owned information technology assets upon termination or expiration of Contractor work. Removal must be accomplished in accordance with NARA’s Media Protection Methodology, which the Contracting Officer will provide at the outset of work and later upon request. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of termination/expiration of Contractor work.

(ix) Back up of any systems or files containing PII shall be treated in the same manner as the original data containing PII, with the same protections and obligations.

(3) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(g) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this purchase order, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

V. STOP WORK CANCELLATION (APRIL 2014)

The Contractor is required to report to work and resume full purchase order performance within six (6) hours of receiving notifications of the stop work cancellation unless otherwise instructed by the CO and/or POC.

VI. REIMBURSEMENT OF TRAVEL COSTS

(a) The Government shall reimburse the Contractor for non-local travel costs only in support of this effort upon the Contractor's submission of an invoice in accordance with the purchase order’s "Invoice Submission Requirements" Clause.

(b) Local Travel. The cost of local travel, meal, and/or incidental expenses will not be reimbursed for Contractor performance within a 60-mile radius of Washington D.C.

(c) Non-Local Travel. Areas of travel, the Contractor must travel to in order to support this effort outside of a 60-mile radius of Washington D.C.

(d) Requests for travel related to this effort must be submitted to the COR in writing for approval prior to travel. The Contractor must receive written prior approval by the COR before engaging in non-local travel to support this effort.

(e) All non-local travel must be performed in accordance with Federal Travel Regulations (FTR). Reimbursement of non-local travel costs shall be limited to reasonable coach airfare rates and Federal Travel Directory per diem and car rentals, as applicable, in effect for the area at the time of the travel.

(f) No handling charges, indirect costs, profit, or fee shall be reimbursed for the non-local travel costs.

(g) The Contractor shall notify the COR in the event that travel costs are expected to exceed the NTE price set aside for each performance period. The Contracting Officer must approve any change in the NTE travel price.

(h) Travel expenses (with supporting documentation) shall be submitted with the Contractor’s Invoice.

VII. CONFIDENTIALITY OF INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this purchase order specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the purchase order. Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this purchase order, the Contractor may have access to confidential information and communications, including but not limited to Personally Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Contractor shall preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting Officer. Failure to comply with the provisions of this Paragraph will be grounds for Termination for Default and the Contractor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this purchase order.

(d) If it is established elsewhere in this purchase order that information to be utilized under this purchase order, or a portion thereof, is subject to the Privacy Act, the Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this purchase order, the Contractor may have access to and use of data and information which may be considered proprietary by other Contractors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this purchase order, would be adverse to the interest of NARA and these other Contractors.

(f) Except as may be otherwise agreed to with these other Contractors, the Contractor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other Contractors other than as required in the performance of this purchase order; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Contractor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Contractor and these Contractors which provides for greater rights to the Contractor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Contractor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this purchase order.

(i) The terms of this paragraph apply to all Contractor employees, subcontractors and consultants and must be incorporated into any subcontract.

ATTACHMENT 4

FAR CLAUSES

I. 52.212-5 -- Contract Terms and Conditions Required to Implement Statutes or Executive Orders -- Commercial Items (Mar 2015)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Dec 2014)

(2) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(3) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77, 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the contracting officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

_X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

___ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Apr 2010) (41 U.S.C. 3509).

___ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (Jun 2010) (Section 1553 of Pub L. 111-5) (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009).

_X_ (4) 52.204-10, Reporting Executive compensation and First-Tier Subcontract Awards (Jul 2013) (Pub. L. 109-282) (31 U.S.C. 6101 note).

___ (5) [Reserved] ___ (6) 52.204-14, Service Contract Reporting Requirements (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Jan 2014) (Pub. L. 111-117, section 743 of Div. C).

_X_ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment (Aug 2013) (31 U.S.C. 6101 note).

_X_ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

___ (10) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (May 2012) (section 738 of Division C of Public Law 112-74, section 740 of Division C of Pub. L. 111-117, section 743 of Division D of Pub. L. 111-8, and section 745 of Division D of Pub. L. 110-161).

___ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

___ (ii) Alternate I (Nov 2011) of 52.219-3.

___ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2011) (if the offeror elects to waive the preference, it shall so indicate in its offer)(15 U.S.C. 657a).

___ (ii) Alternate I (Jan 2011) of 52.219-4.

___ (13) [Reserved] ___ (14) (i) 52.219-6, Notice of Total Small Business Aside (Nov 2011) (15 U.S.C. 644).

___ (ii) Alternate I (Nov 2011).

___ (iii) Alternate II (Nov 2011).

___ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

___ (ii) Alternate I (Oct 1995) of 52.219-7.

___ (iii) Alternate II (Mar 2004) of 52.219-7.

_X_ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2014) (15 U.S.C. 637(d)(2) and (3)).

___ (17) (i) 52.219-9, Small Business Subcontracting Plan (Oct 2014) (15 U.S.C. 637 (d)(4)).

___ (ii) Alternate I (Oct 2001) of 52.219-9.

___ (iii) Alternate II (Oct 2001) of 52.219-9.

___ (iv) Alternate III (Oct 2014) of 52.219-9.

___ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

___ (19) 52.219-14, Limitations on Subcontracting (Nov 2011) (15 U.S.C. 637(a)(14)).

___ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

___ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657f).

_X_ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C. 632(a)(2)).

___ (23) 52.219-29, Notice of Set-Aside for Economically Disadvantaged Women-Owned Small Business (EDWOSB) Concerns (Jul 2013) (15 U.S.C. 637(m)).

___ (24) 52.219-30, Notice of Set-Aside for Women-Owned Small Business (WOSB) Concerns Eligible Under the WOSB Program (Jul 2013) (15 U.S.C. 637(m)).

_X_ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

_X_ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2014) (E.O. 13126).

_X_ (27) 52.222-21, Prohibition of Segregated Facilities (Feb 1999).

_X_ (28) 52.222-26, Equal Opportunity (Mar 2007) (E.O. 11246).

_X_ (29) 52.222-35, Equal Opportunity for Veterans (Jul 2014) (38 U.S.C. 4212).

_X_ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

_X_ (31) 52.222-37, Employment Reports on Veterans (Jul 2014) (38 U.S.C. 4212).

_X_ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

_X_ (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

___ (ii) Alternate I (Mar 2015) of 52.222-50, (22 U.S.C. chapter 78 and E.O. 13627).

___ (34) 52.222-54, Employment Eligibility Verification (Aug 2013). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

___ (35) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

___ (36) (i) 52.223-13, Acquisition of EPEAT® -Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514 ___ (ii) Alternate I (Jun 2014) of 52.223-13.

___ (37) (i) 52.223-14, Acquisition of EPEAT® -Registered Television (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-14.

___ (38) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C. 8259b).

___ (39) (i) 52.223-16, Acquisition of EPEAT® -Registered Personal Computer Products (Jun 2014) (E.O.s 13423 and 13514).

___ (ii) Alternate I (Jun 2014) of 52.223-16.

_X_ (40) 52.223-18, Encouraging Contractor Policies to Ban Text…