ATT_05_RFQ_VideoSurv_ADDM_07072016.docx

NAMA-16-Q-0003, Video Surveillance System Software and Expansion

ATTACHMENT 5 - NARA TERMS AND CONDITIONS

(Addenda to FAR 52.212-4, Contract Terms and Conditions)

1. ORIGIN OF MANUFACTURE

Supplies furnished under this request for quotation are of domestic origin unless otherwise indicated by the Vendor. Vendor shall complete the table in Attachment 8, Volume 3 and submit it with Vendor’s quote.

2. KEY PERSONNEL

a. The Vendor agrees to assign to the task order those key personnel whose resumes were submitted with the Vendor’s quotation as required to fill the requirements of the task order. No substitution or addition of personnel will be made except in accordance with this clause or by written permission by the Contracting Officer.

b. The Vendor agrees that during the first 12 months of the task order, no personnel substitutions will be permitted, unless such substitutions are necessitated by an individual's sudden illness, death or termination of employment. In any of these events, the Vendor shall promptly notify the Contracting Officer and provide the information required by paragraph (d) below.

c. If key personnel, for whatever reason, become unavailable for work under this task order for a continuous period exceeding thirty (30) working days, or are expected to devote substantially less effort to the work than indicated in its quotation, the Vendor shall propose a substitution of such personnel, in accordance with paragraph (d) below.

d. All proposed key personnel substitutions shall be submitted, in writing, to the Contracting Officer at least thirty (30) days, or ninety (90) days if a security clearance is to be obtained, in prior to the proposed substitution. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution; a complete resume(s) for the proposed substitute(s); and any other information required by the Contracting Officer to approve or disapprove the proposed substitution(s). Resumes for key personnel substitutions must be submitted in accordance with the format specified. All proposed substitutes (no matter when they are proposed during the performance period) shall have qualifications that are equal to or higher than the qualifications of the person being replaced.

e. In the event the Vendor designates additional key personnel as deemed appropriate for the requirement, the Vendor shall submit to the Contracting Officer for approval the information required in paragraph (d) above.

f. The Contracting Officer shall evaluate requests for substitution and addition of personnel and promptly notify the Vendor, in writing, whether a request is approved or disapproved.

g. If the Contracting Officer determines that suitable and timely replacement of key personnel who have been reassigned, terminated, or have otherwise become unavailable to perform under the task order is not reasonably forthcoming, or that a resultant reduction of productive effort would impair the successful completion of the task order, the task order may be terminated by the Contracting Officer for default or for the convenience of the Government, as appropriate. Alternatively, at the Contracting Officer's discretion, if the Contracting Officer finds the Vendor to be at fault for the condition, the CO may equitably adjust (downward) the task order price to compensate the Government for any delay, loss or damage as a result of the Vendor's action.

3. PAYMENT

a. Payments must be made upon submission of a proper invoice. Payments will be due on the 30th calendar day after receipt of a proper invoice, or on the 30th calendar day after the date the supplies were accepted by the Government, whichever is later.

b. No payments will be made by check. Invoice payments will be made electronically in accordance with FAR 52.232-33, Payment by Electronic Funds Transfer—System for Award Management.

c. The date of payment by wire transfer through the Treasury Financial Communications System must be considered the date payment is made.

d. Payment for delivered supplies will be made upon submission of the Vendor’s properly certified invoice.

e. All invoices will be paid using information from the System for Award Management (SAM). Therefore, payment will be made to the EFT information that matches the Dunn and Bradstreet Number (DUNS) for this award.

4. INVOICE SUBMISSION REQUIREMENTS (IPP)

a. The Contract Specialist assigned to this contract is:

Name:

1 Archives Drive Saint Louis, MO 63122 Telephone:

Email:

b. The Government Point Of Contact (POC) for this requirement is:

Name: TBD 1 Archives Drive Saint Louis, MO 63122 Telephone:

Email:

c. MARK FOR INFORMATION. The vendor must include the following information clearly on the shipping container address label:

Award Number:

Accepting POC:

Code:

Room:

d. The preferred method for invoicing is through the Invoice Processing Platform (IPP) which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury's Bureau of the Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

e. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via e-mail at AccountsPayable@fiscal.treasury.gov or by phone at 304-480-8000, Option 7.

f. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by e-mail to AccountsPayable@fiscal.treasury.gov. Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

g. The contractor's invoice shall include the following information and/or attached documentation:

1. Name of the business concern and invoice date;

2. The complete contract number and/or delivery/task order number preceded by the letters NAMA;

3. Description, price, and quantity of services actually delivered or rendered and segregated by CLIN and/or SUBCLIN number (s);

4. Payment Terms;

5. DUNS number;

6. Taxpayer's Identification Number (TIN);

7. Government Fund Cite; and (8) Government Organization ordering the items

h. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

i. All invoices will be paid using information from the System for Award Management (SAM). Therefore, payment will be made to the EFT information that matches the DUNS number for this award.

j. For invoice and payment questions call the Fiscal Service AP Help Desk at 304-480-8000, Option 7.

k. The Vendor shall submit invoices for discrete work efforts (for example, system expansion) at the completion of that work. For continuous services (for example, system service and assistance), the Vendor may submit invoices at intervals no more frequently than once a month.

(End of Clause)

5. NARA - SECURITY OF SYSTEMS HANDLING AND PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2014) A. Applicability This clause applies to all personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

B. Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

1. Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

2. Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

a) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

b) Date of birth (month, day, and year);

c) Citizenship or immigration status;

d) Financial information such as account numbers or electronic funds transfer information;

e) Medical information; and/or

f) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

3. Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

C. Data Security

1. The Vendor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this task order.

2. The, Vendor employees, and subcontractors must physically or electronically secure sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

3. When sensitive PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed, as specified in the task order, or if not specified in the task order, through means that will make the sensitive PII irretrievable.

4. The Vendor shall only use sensitive PII obtained under this task order for purposes of the task order; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

5. If it is established elsewhere in this task order that information to be utilized under this task order, or a portion thereof, is subject to the Privacy Act, The Vendor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

6. At expiration or termination of this task order, the Vendor shall turn over all sensitive PII obtained under the task order that is in its possession.

A. Systems Access.

Work to be performed under this task order may require the handling of PII. The Vendor shall provide the Government access to, and information regarding those systems handling sensitive PII for the Government under the task order, when requested by the Government, as part of the Vendor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

B. Systems Security

1. In performing its duties related to management, operation, and/or access of systems containing PII under this task order, the Vendor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608;

b) NARA Notice 2010-045;

c) NARA Penalty Guide (Personnel 300, Appendix 752A - Penalty Guide); and

d) NARA’s Media Protection Methodology

2. In addition, the use of Vendor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this task order until the Vendor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy or the SAOP’s designee, approves the Vendor’s written acknowledgment that the following requirements are met:

a) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor), and approved;

b) The Vendor has developed and implemented a process to ensure that security and other applications software are kept current;

c) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism;

d) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product;

e) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology;

f) The Vendor shall maintain an accurate inventory of devices used in the performance of this task order;

g) Vendor employee annual training and rules of conduct/behavior shall be developed by NARA as part of its annual PII training program. This training will be completed within 30 days of task order employees beginning work on a sensitive PII project and thereafter annually. Such completion will be acknowledged by employees in writing and reported to NARA’s Senior Agency Official for Privacy or the SAOP’s designee.

h) All sensitive PII obtained under this task order shall be removed from Vendor-Owned information technology assets upon termination or expiration of Vendor work. Removal must be accomplished in accordance with NARA’s Media Protection Methodology, which the Contracting Officer will provide at the outset of work and later upon request. Certification of data removal will be performed by the Vendor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of termination/expiration of Vendor work.

i) Back up of any systems or files containing PII shall be treated in the same manner as the original data containing PII, with the same protections and obligations.

3. The Vendor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

C. Breach Notification to Government

1. The Vendor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

2. In the event of any actual or suspected breach of sensitive PII, the Vendor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

3. The Vendor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

D. Flowdown of security requirements to subcontractors

1. The Vendor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this task order, and require written subcontractor acknowledgement of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Vendor.

(End of Clause)

6. NARA KEEP HARD DRIVE (KHD) CLAUSE

In accordance with NARA policy, NARA will take title to all electronic storage devices, including but not limited to hard drives that may contain Personally Identifiable Information (PII). NARA will not allow the removal of any electronic storage device that may contain PII data from its facilities by a contractor, including individuals performing maintenance on equipment, devices or systems. This provision applies even in the event the equipment is leased. NARA will handle the destruction of this hardware internally. This provision must flow down to all subcontracts, including those for maintenance.

If the Vendor comes into possession of an electronic storage device that may contain PII, the Vendor will immediately notify the Contracting Officer and return the electronic storage device to NARA. Vendor will protect the confidentiality of the electronic storage device and will not access, disclose, release, disseminate, or publish any of the information on the electronic storage device.

7. PERMITS AND LICENSES (SEPT 1998)

In performance of work under this contract, the Contractor shall, without additional expense to the Government, be responsible for obtaining any necessary licenses and permits, and for complying with any Federal, State, and municipal laws, codes, and regulations applicable to the performance of the work.

8. INSURANCE REQUIREMENTS (SEPT 1998)

a. In accordance with the clause of this contract entitled “INSURANCE--WORK ON A GOVERNMENT INSTALLATION” (FAR 52.228-5), the Contractor shall acquire and maintain during the entire performance period of this contract insurance of at least the following kinds and minimum amounts set forth below.

Workmen's Compensation and all occupational disease $100,000 except as provided for in FAR 28.307(a)

Employees' Liability Insurance and all occupational disease when not covered by Workmen's Compensation above $100,000 per accident

General Liability Insurance (Comprehensive)

Vehicle Liability Insurance (Comprehensive)

b. The amount of liability coverage on other policies shall be commensurate with any legal requirements of the locality and sufficient to meet normal and customary claims.

9. OVERTIME (SEPT 1998)

All overtime cost is included in the contract price. The Contractor is obligated, at no additional compensation, to meet all requirements of this contract. The Contractor shall pay overtime premiums to all employees as required by the terms and conditions of this contract, and all applicable State and Federal laws at no increase in the contract fixed price and no additional expense to the Government.

10. COOPERATION WITH OTHER ONSITE NARA CONTRACTORS

a. When the Government undertakes or awards other contracts for additional work at the facilities the Contractor shall: (1) fully cooperate with the other Contractors and Government employees and (2) carefully fit its own work to such other additional contracted work as may be directed by the COR. The Contractor shall not commit or permit any act, which will interfere with the performance of work awarded to another Contractor or with the performance of other Government employees.

b. In any case where, in the course of fulfilling the contract requirements, the Contractor disturbs any work guaranteed under another separate contract, the Contractor shall restore such disturbed work to a condition satisfactory to the COR and guarantee such restored work to the same extent as it was guaranteed under the other contract.

11. STOP WORK CANCELLATION (APR 2014)

The Contractor is required to report to work and resume full Contract performance within 24 hours of receiving notification of the stop work cancellation unless otherwise instructed by the CO and/or COR.