NAMA-17-Q-0109_Media_Monitoring.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is NAMA-17-Q-0109 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-95 effective January 13, 2017. This is an Unrestricted full and open RFQ under NAICS code 511210, Software Publishers. CONTRACT LINE ITEM NUMBER(s): See Attachment 1, Schedule of Prices.

REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement to obtain a Media Monitoring Services. See Attachment 2, Requirements. PERIOD OF PERFORMANCE: The period of performance will consist of a base year and two (2) option years. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions, which will be removed prior to award: FAR provision 52.212-1, Instructions to Offerors - Commercial Items (Jan 2017). Addenda: (1) Change paragraph (c) to read: Period for acceptance of offers. The offeror agrees to hold the prices in its offer firm for 60 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation. (2) Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR provision 52.212-2): Evaluation and award will be in accordance with FAR Subpart 13.106-2, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Items as prescribed by FAR 12.301(c)(2). See Attachment 7, Quotation Submission Instructions. The Government reserves the right to award on the initial quotation without discussions. FAR provision 52.212-3, Offeror Representations and Certifications - Commercial Items (Jan 2017) - The offeror shall complete only paragraphs (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) Web site located at http://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u) of this provision. FAR clause 52.212-4, Contract Terms and Conditions - Commercial Items (Jan 2017) -- see Attachment 4, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4).

FAR clause 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Items (Jan 2017) – see Attachment 6, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. Full text provisions and clauses can be found at http://www.acquisition.gov. QUESTIONS: Questions regarding this RFQ must be submitted in writing to the Contract Specialist, Mr. Scott Cox (Contractor) at scott.cox@nara.gov no later than 12:00 PM ET on September 22, 2017 to be considered.

Questions submitted in any other manner will not be answered. Contractors are requested to group and submit questions in the same order found in the RFQ while making reference to the particular paragraph number. The Government will answer questions or requests for clarification via a written RFQ amendment. QUOTATION DUE DATE: Quotations must be received by 12:00 PM ET on September 26, 2017. Failure to submit quotations, in accordance with Attachment 7, Quotation Submission Instructions by the due date and time may result in rejection of the quotation as untimely. QUOTATION SUBMISSION INSTRUCTIONS:

Contractors must submit their pricing in accordance with RFQ Attachment 1, Schedule of

Prices. See Attachment 7, Quotation Submission Instructions.

NARA—NAMA-17-Q-0109, Media Monitoring Services

ATTACHMENT 1

SCHEDULE OF PRICES

1. SERVICES TO BE FURNISHED

(a) The purpose of this contract is to acquire a Media Monitoring Services capable of gathering information about how the agency is portrayed across various media platforms and visualize the resulting information in ways that are useful for decision makers at the National Archives and Records Administration (NARA). All requirements must be provided in accordance with the terms and conditions of this firm-fixed price contract.

(b) Firm-Fixed Price (FFP). The Contractor is required to furnish all the work that can be identified in advance, both in sufficient detail, and for which a fair and reasonable price can be obtained. The FFP must include the fully burdened cost for delivering the services required by this contract. All work for this requirement is considered firm-fixed price work.

2. SCHEDULE OF PRICES

The Schedule of Prices should reflect a summary of all proposed labor categories and/or ODC’s.

To substantiate its pricing, the contractor shall attach a separate spreadsheet with a detailed view of the proposed labor categories, fixed hourly rates, and ODC’s. The Government reserves the right to not pay for ODCs which, are not clearly identified and explained in the Contractor’s quotation. The Government does not guarantee that ODCs will be included in the resulting contract.

CLIN = Contract Line Item Number; IAW = In Accordance With; Mo. = Month; and QTY = Quantity.

Base Year: Months 1-12

CLIN DESCRIPTION QTY

UNIT OF

ISSUE

UNIT

PRICE

TOTAL

PRICE

0001 Media Monitoring Services IAW NARA Requirements 12 Mo. $________ $________

0002 RESERVED 1 -- -- -- --

0003 RESERVED 2 -- -- -- --

TOTAL BASE YEAR PRICE: $____________

Option Year I: Months 13-24

CLIN # DESCRIPTION QTY

UNIT OF

ISSUE

UNIT

PRICE

TOTAL

PRICE

0004 Media Monitoring Services IAW NARA Requirements

12 Mo. $________ $________

0005 RESERVED 1 -- -- -- --

0006 RESERVED 2 -- -- -- --

TOTAL OPTION YEAR I PRICE: $____________

Option Year II: Months 25 - 36

CLIN # DESCRIPTION QTY

UNIT OF

ISSUE

UNIT

PRICE

TOTAL

PRICE

0007 Media Monitoring Services IAW NARA Requirements 12 Mo. $________ $________

0008 RESERVED 1 -- -- -- --

0009 RESERVED 2 -- -- -- --

TOTAL OPTION YEAR II PRICE: $____________

TOTAL CONTRACT PRICE: $____________

ATTACHMENT 2

REQUIREMENTS

1.0 INTRODUCTION

The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.1 PURPOSE

1.2 NARA is pursuing the acquisition of a Media Monitoring Services to collect and aggregate media coverage of NARA and compile entries into comprehensive reports that present the information in a clear, easy-to-understand way.

1.3 Track emerging stories that impact public perception of NARA across multiple media channels.

1.4 Create and share visual reports with senior leaders and other selected staff.

1.5 Compare results over time or between individual media, venues, campaigns, and visualize trends in the data with reporting to cover at least a year of archival analysis on NARA media analytical history.

1.6 Gain a better understanding about NARA’s media marketing analytics, performance and areas of improvement to expand our public interest.

2.0 SCOPE OF WORK: MEDIA MONITORING & ENGAGEMENT

Section Requirements Contractor

Meets

1. Online & Social Media Monitoring

Ability to track global and African online sources for coverage relevant to the Africa Regional Media Hub.

• Ability to track > 6,000 online sources in Africa

• Ability to track > 250,000 online sources globally

• Ability to track Facebook, Twitter and blogs.

• Ability to track media coverage in > 100 languages, including Arabic, Chinese and Russian. Translation function to instantly translate these articles to English.

• Ability to create up to 20 searches with each unlimited keywords

• Unlimited coverage per search (no cap on coverage)

• Ability to change the searches at keywords at any given time.

2. Media Intelligence and Benchmarking Dashboard Platform

24/7 Access to a password protected, online platform for 5 users to access:

• Overview of search results in terms of online articles and social media conversations

• 15 Customized and Interactive Dashboard that provide real-time analysis and benchmark of media coverage.

• Ability to analyze the media coverage in terms of volume, sentiment, geographical spread, top publications, media channels, reach, AVE, top posters, influencers.

• Ability to select time-period of analysis: per day, week, month, and selected dates

• Automated weekly overview of these dashboards sent via email

3. Email Alerts • Daily email alerts with new search results

• Ability to customize these email alerts per user

4. Mobile app 24/7 Access to a password protected, mobile app for 5 users to access:

• Overview of search results in terms of online articles and social media conversations

• Ability to view coverage written in Arabic, Chinese and Russian. Ability to access English translation of this coverage within the mobile app.

• Ability to set up push notifications to be alerted of new search results

• Ability to forward media coverage via email, sms or what’s app

5. Media Engagement

24/7 Access to a password protected, media influencer database, including journalists, editors, correspondents, social media influencers, bloggers etc.

• This database should include > 6,000 media influencers based in Africa

• Ability to browse the database based on location, beat and type of influencer

• Ability to perform ad-hoc searches on the database based on keywords

• Ability to perform searches in other languages including Arabic, Chinese and Russian, in order to find influencers that publish in these languages.

• For each influencer found, present contact details and any other information that could be relevant, including publications this influencer writes for, and an overview of the previous coverage published by the media influencer

• Ability to create up to 100 media lists for specific topics

• Ability to export the contact details of the media influencers per media list.

• Ability to send out press releases via the platform and to monitor the open-rate of the press releases send out.

3.0 Quality Assurance and Surveillance Plan (QASP). This plan is designed to provide an effective surveillance method to promote effective Contractor performance. The QASP provides a method for the Contracting Officer's Representative (COR) to monitor Contractor performance, advise the contractor of unsatisfactory performance, and notify the Contracting Officer of continued unsatisfactory performance. The Contractor, not the Government, is responsible for management and quality control to meet the terms of the contract.

The role of the Government is to conduct quality assurance to ensure that contract standards are achieved.

Performance Objective Section Performance Threshold

Services.

Performs all media monitoring Services as set forth in the Requirements section, without requiring intervention from the customer.

1 thru 5

All required services are performed and no more than two (2) customer complaints received per month.

3.1 SURVEILLANCE. The COR will receive and document all complaints from Government personnel regarding the services provided. If appropriate, the COR will send the complaints to the Contractor for corrective action.

3.2 STANDARD. The performance standard is that the Government receives no more than two (2) customer complaints per month. The COR shall notify the Contracting Officer of the complaints so that the Contracting Officer may take appropriate action to enforce the inspection clause (FAR 52.212-4, Contract Terms and Conditions-Commercial Items), if any of the services fail to meet the standard.

3.3 PROCEDURES

(a) If any Government personnel observe unacceptable services, either incomplete work or required services not being performed they should immediately contact the COR.

(b) The COR will complete appropriate documentation to record the complaint.

(c) If the COR determines the complaint is invalid, the COR will advise the complainant.

The COR will retain the annotated copy of the written complaint for his/her files.

(d) If the COR determines the complaint is valid, the COR will inform the Contractor and give the Contractor additional time to correct the defect, if additional time is available. The COR shall determine how much time is reasonable.

(e) The COR shall, as a minimum, orally notify the Contractor of any valid complaints.

(f) If the Contractor disagrees with the complaint after investigation of the site and challenges the validity of the complaint, the Contractor will notify the COR. The COR will review the matter to determine the validity of the complaint.

(g) The COR will consider complaints as resolved unless notified otherwise by the complainant.

(h) Repeat customer complaints are not permitted for any services. If a repeat customer complaint is received for the same deficiency during the service period, the COR will contact the Contracting Officer for appropriate action under the Inspection clause.

ATTACHMENT 3

NON-DISCLOSURE AGREEMENT

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

*(To Be Completed After Award)

Social Media Analytics Tool

1. NON-DISCLOSURE OF INFORMATION

I hereby certify that I shall not release to anyone not authorized to perform on this contract any information, regardless of medium (e.g., film, tape, photos, documents, etc.), pertaining to any part of this contract unless:

(1) The Contracting Officer has given prior written approval; or

(2) The information is otherwise in the public domain before the date of release.

2. CONFIDENTIALITY OF SENSITIVE INFORMATION

(a) During the course of performance of this contract, I may have access to information and communications considered sensitive by NARA, including but not limited to Personally Identifiable Information (PII). I hereby certify that I shall preserve the confidentiality of all such information and communications and shall not, in any circumstances, disclose any such information or communications for any purposes without the prior written approval of the Contracting Officer.

(b) My failure to abide by the terms of this provision shall be grounds for my immediate removal in accordance with the terms of this contract.

(c) I shall follow all established security safeguards for the protection of all such information and communications.

(d) The details of any safeguards that may be revealed to me by NARA in the course of performance of this contract shall not be published or disclosed in any manner without the Contracting Officer's express written consent.

3. LIMITED DISTRIBUTION OR USE OF PROPRIETARY INFORMATION

(a) During the course of the performance of this contract, I may have access to and use of data and information which may be considered proprietary by other contractors or which may otherwise be of such a nature that its dissemination or use, other than in performance on this contract, would be adverse to the interest of the Agency and these other contractors.

(b) Except as may be otherwise agreed to with these other contractors, I hereby certify that I will not use, disclose or reproduce proprietary data and information belonging to these other contractors other than as required in the performance of this contract; provided, however, that nothing herein shall be construed as precluding the use of any such data or information independently acquired without such limitation.

Name

Signature

Date

ATTACHMENT 4

ADDITIONAL NARA TERMS AND CONDITIONS

(ADDENDA TO FAR CLAUSE 52.212-4)

1. CONTRACTOR RESPONSIBILITY

The Contractor is responsible for the day-to-day inspection and monitoring of the Contractor work performed to ensure compliance with contract requirements. The results of all Contractor quality control inspections conducted must be documented on inspection checklists and be made available to the Government, during the term of the contract.

2. GOVERNMENT CONTRACT ADMINISTRATION

a. This contract will be administered by:

National Archives and Records Administration Office of the Chief Acquisition Officer 8601 Adelphi Road, Room 3340 College Park, MD 20740-6001

b. Contract Specialist (CS):

Scott Cox (Contractor) Telephone: (301) 837-3160 Email: scott.cox@nara.gov

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be emailed or mailed with postage prepaid to the address listed above.

c. Contracting Officer (CO)

Any Z Warranted CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding contract questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

3. DESIGNATION OF CONTRACTING OFFICER'S REPRESENTATIVE

(COR)

a. COR:TBD

b. The individual named above is designated as the Contracting Officer's Representative (COR) to assist the Contracting Officer (CO) in the discharge of the CO's responsibilities. The COR is responsible for monitoring, giving progress reports to the Contract Specialist (CS), and overall technical surveillance of services to be performed under this contract and should be contacted regarding questions or problems of a technical nature. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the CO be effective or binding upon the Government.

c. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the CO in writing.

d. No action will be taken by the Contractor under such technical instruction unless the CO has issued a contractual change.

e. The responsibilities of the COR include, but are not limited to, the following:

(1) Serve as the point of contact through which the Contractor can relay questions or problems of a technical nature to the CS and the CO;

(2) Be responsible for the inspection and acceptance of the services performed and determining the adequacy of performance by the Contractor in accordance with the terms and conditions of this contract;

(3) Confer with representatives of the Contractor regarding any non-performance or unsatisfactory performance; follow through to assure that all non-performance or unsatisfactory performance is performed/corrected or payment adjustment is recommended to the CS/CO;

(4) Review and certify invoices in accordance with invoicing instructions of the contract. Maintain a file with copies of these documents;

(5) Review and evaluate Contractor's deliverables;

(6) Advise the CS of any performance problems and make recommendations for corrective action to correct performance issues;

(7) Furnish the CS with any requests for change, deviation, or waiver (whether generated by Government personnel or Contractor personnel), including all supporting paperwork in connection with such change, deviation, or waiver;

(8) Submit a written evaluation to the CS/CO within 60 days of contract completion or annually on the anniversary date for contracts that include options. The evaluation should include:

(i) The quality and timeliness of the Contractor's performance; and

(ii) A statement as to the uses made of any deliverables furnished by the Contractor.

4. INVOICE SUBMISSION REQUIREMENTS

a. The preferred method for invoicing is through the Invoice Processing Platform (IPP), which is a secure web-based electronic invoicing and payment information system. This service is provided by the U.S. Treasury’s Bureau of the Fiscal Service free of charge to federal agencies and contractors. IPP allows contractors to view information regarding their contracts and orders, electronically submit invoices and view payment information.

b. The IPP website address is https://www.ipp.gov. Contractors can obtain enrollment assistance by contacting the Fiscal Service Accounts Payable Help Desk via e-mail at AccountsPayable@fiscal.treasury.gov or by phone at 304-480-8000, Option 7.

c. Contractors that are not able to utilize the IPP system for submitting payment requests may submit invoices electronically by e-mail to AccountsPayable@fiscal.treasury.gov.

Microsoft Excel, Adobe Acrobat Portable Document Format (PDF) and Microsoft Word are acceptable formats.

d. Invoices for services shall be submitted monthly unless otherwise stated elsewhere in the contract.

e. For invoice and payment questions call the Fiscal Service AP Help Desk at 304-480- 8000, Option 7.

5. FINAL PAYMENT

Before final NARA payment is made, the Contractor must furnish to the CO a written release of all claims against the Government arising by virtue of the contract, other than claims in stated amounts as may be specifically excluded by the Contractor from the operation of the release. If the Contractor’s claim to amounts payable under the contract has been assigned under the Assignment of Claims Act of 1940, as amended (31 U.S.C. § 203, 41 U.S.C. § 15), a release may also be requested of the assignee. To ensure that all necessary adjustments for non-performance or unsatisfactory performance have been made and a release of claims has been submitted before the contract is closed out, the final NARA payment will be made in thirty (30) calendar days after receipt of a proper invoice, date of completion of performance, or receipt of release of claims by the CO, whichever is later.

https://www.ipp.gov/ mailto:AccountsPayable@bpd.treas.gov mailto:AccountsPayable@bpd.treas.gov

6. CONFIDENTIAL INFORMATION

(a) Confidential information is any information that, if subject to unauthorized access, modification, loss, or misuse could adversely affect the national interest, the conduct of Federal programs, or the privacy of individuals, but has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy. Confidential information also includes proprietary data and information for which other restrictions on access apply.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information and/or categories of information which the Government will furnish to the Contractor or that the Contractor is expected to generate which is confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract.

Failure to agree will be settled pursuant to the “Disputes” clause.

(c) While in the course of performance of this contract, the Contractor may have access to confidential information and communications, including but not limited to Personally Identifiable Information (PII). Confidential information may be contained in printed material or on electronic media. The Contractor will preserve the confidentiality of all such information and communications and agrees not to disclose, release, disseminate, or publish any such information or communications for any purposes whatsoever without the prior approval of the Contracting Officer. Failure to comply with the provisions of this paragraph will be grounds for Termination for Cause and the Contractor may be liable for damages. This provision shall survive the expiration or termination of the period of performance of this contract.

(d) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, the Contractor will follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(e) During the course of the performance of this contract, the Contractor may have access to and use of data and information which may be considered proprietary by other contractors, or which may otherwise be of such a nature that its dissemination or use, other than in performance of this contract, would be adverse to the interest of NARA and these other Contractors.

(f) Except as may be otherwise agreed to with these other Contractors, the Contractor agrees that it will not use, disclose or reproduce proprietary data and information belonging to these other Contractors other than as required in the performance of this contract; provided, however, that nothing herein shall be construed as: (1) precluding the use of any such data or information independently acquired by the Contractor without such limitation; or (2) prohibiting an agreement at no cost to NARA between the Contractor and these Contractors which provides for greater rights to the Contractor.

(g) When considering a request to disclose, release, disseminate, or publish confidential information, the Contracting Officer will consult with appropriate program and legal officials.

(h) At the discretion of the Contracting Officer, the Contractor’s employees may be required to sign a non-disclosure agreement prior to performing any work under this contract.

(i) The terms of this paragraph apply to all Contractor employees, subcontractors, and consultants and must be incorporated into any subcontract.

7. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED

UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE

INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic;

requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG,

(1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this Contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608 http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor- Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards.

http://www.archives.gov/foia/directives/nara1608.pdf http://www.archives.gov/foia/directives/nara1608.pdf http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsFIPS.html

Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(ix) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(4) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and ( 4) any other information specifically requested by the NARA. Contractor shall continue to provide written updates to the NARA CO regarding the status of the Security incident at least every three (3) calendar days until informed otherwise by the NARA CO.

(7) Response activities related to any security incident or PII or Security Breach undertaken by NARA, including activities undertaken by Contractor, other federal agencies, and any third-party contractors or firms at the request or direction of NARA, may include inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the Security Incident and/or liability for any additional response activities. Contractor shall be responsible for all costs and related resource a locations required for all such response activities related to any Security Incident or Breach, including the cost of any penetration testing.

(g) Personally Identifiable Information Notification Requirement

Contractor certifies that it has a security policy in place that contains procedures to promptly notify any individual whose Personally Identifiable Information ("Pll") was, or is reasonably determined by NARA to have been, compromised. Any notification shall be coordinated with the NARA CO and shall not proceed until the NARA has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by Contractor shall be coordinated with, and subject to the approval of, NARA. Contractor shall be responsible for taking corrective action consistent with NARA Data Breach Notification Procedures and as directed by the NARA CO, including all costs and expenses associated already covered by above clauses added in PII clause with such corrective action, which may include providing credit monitoring to any individuals whose Pll was actually or potentially compromised.

All determinations regarding whether and when to notify individuals and/or federal agencies potentially affected by a Security Incident, Breach, or PII Breach will be made by NARA senior officials at NARA’s discretion.

(h) Flowdown of security requirements to subcontractors.

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgement of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

8. INTERNET PROTOCOL – AUG 2016

The Contractor shall ensure that all systems, including hardware, software, firmware, and/or network components developed, procured, or acquired in support and/or performance of this contract using the Internet Protocol are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 800-119). In addition, all products or systems using the Internet Protocol shall maintain operability with both Internet Protocol (IP) IPv4 and IPv6.

9. RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. Federal record:

(1) includes NARA records.

(2) does not include personal files.

(3) applies to records created, received, or maintained by Contractors pursuant to their NARA contract.

(4) may include deliverables and documentation associated with deliverables.

C. Requirements

(1) Contractor agrees to comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C.

chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format, or mode of transmission, or state of completion.

(2) In accordance with 36 C.F.R. 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 C.F.R. 1222.32, Contractor must maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) No disposition of Federal records will be allowed without the prior written consent of the Head of the Contracting Activity, acting in accordance with the provisions of a NARA approved agency records schedules. NARA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of NARA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

(5) The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to NARA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

(6) The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and NARA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

(7) The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with NARA policy.

(8) The Contractor shall not create or maintain any records containing any non-public NARA information that are not specifically tied to or authorized by the contract.

(9) The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

(10) The NARA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S.

Government for which NARA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

(11) Initial Training. All Contractor employees assigned to this contract and who work with or otherwise handle Federal records are required to take agency-provided records management training within thirty days after award of the contract or within thirty days of an employee beginning work on the contract.

The Contractor is responsible for maintaining records confirming that all required employees complete the training.

(12) Annual training. All Contractor employees assigned to this contract and who work with or otherwise handle Federal records will be required to complete annual records management training. The Contractor employees will be notified via their [email address] of the deadline for this obligation each year. The Contractor is responsible for maintaining records confirming all required contractor employees completed training.

D. Flowdown of requirements to subcontractors

(1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract, and require written subcontractor acknowledgment of same.

(2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

10. STOP WORK CANCELLATION (APRIL 2014)

The Contractor is required to report to work and resume full performance within 24 hours of receiving notification of the stop work cancellation unless otherwise instructed by the CO…