Combined Synopsis Solicitation - Decryption of Mixed Media Files for FAA 9-11 Project - Digital Format.doc

Solicitation Number: NARA-883103-25-Q-00050 Decryption of Mixed Media Files for the FAA 9/11 Project – Digital Format

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR Subpart 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. The solicitation number is NARA-883103-25-Q-00050 and is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2025-05 effective August 7, 2025. This is an unrestricted requirement under NAICS Code 518210, Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. CONTRACT LINE ITEM NUMBER(S): See Attachment 2, Schedule of Prices. REQUIREMENT: The National Archives and Records Administration (NARA) has a requirement for the decryption of mixed media files for the FAA 9/11 Project – Digital Format. PERIOD OF PERFORMANCE: The period of performance will be until the work required under the resultant contract is completed but no longer than five years. CONTRACTOR SITE VISIT: The Government may assess the Contractor’s facilities and equipment for acceptability. Facilities will be inspected during the evaluation process in accordance with the standards in the Performance Work Statement. The following Federal Acquisition Regulation (FAR) clauses are incorporated and are to remain in full force in any resultant contract, with the exception of FAR provisions which will be removed prior to award: FAR 52.212-1. Instructions to Offerors - Commercial Products and Commercial Services (Sep 2023). Addenda: Delete paragraph (h), Multiple Awards. - see below for additional quotation submission instructions. EVALUATION (In lieu of FAR 52.212-2): Evaluation and award will be in accordance with Simplified Acquisition Procedures at FAR Subpart 13.106, Soliciting Competition, Evaluation of Quotations or Offers, Award and Documentation authorized by FAR Subpart 13.5, Simplified Procedures for Certain Commercial Products and Commercial Services. Selection of the Contractor to perform this contract will be based on NARA’s assessment of the best overall value to the Government. Accordingly, all evaluation factors, Technical Understanding and Approach and Relevant Past Performance, will be significantly more important than price. Exceptions taken to any terms and conditions stated in the RFQ must be clearly outlined on a separate page of the Contractor’s quotation entitled “Exceptions.” The Contractor must also include complete rationale, justification, and the cost impact of each exception noted. The Government reserves the right to make an award on the initial quotation without discussions of this procurement. the Total Firm Fixed Price for each CLIN will be determined by multiplying the QTY (Quantity) by the Firm Fixed Unit Price. The resultant contract will include FAR 52.217-8, Option to Extend Services. NARA will evaluate six additional months of services at the rates for CLINs 0001 through 0006 by dividing them in half. The evaluated Total Contract Ceiling Price will be determined by summing the Total Firm Fixed Price of each CLIN plus half the rates for CLINs 0001 through 0006. Contractors must provide pricing (USD) for each CLIN in accordance with Attachment 2, Schedule of Prices. Failure to submit any of the required information and documentation with the quotation may result in rejection of the quotation. Multiple awards will not be made under this RFQ. Contractors must be registered and active in the System for Award Management. FAR 52.212-3, Offeror Representations and Certifications - Commercial Products and Commercial Services (May 2024) - The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (v) of this provision. FAR 52.212-4, Contract Terms and Conditions - Commercial Products and Commercial Services (Nov 2023) – see Attachment 4, Additional NARA Terms and Conditions (Addenda to FAR clause 52.212-4). FAR 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Products and Commercial Services (Jan 2025) - see Attachment 8, FAR Clauses for the full text of this clause and for additional applicable FAR clauses. Full text provisions and clauses can be found at https://www.acquisition.gov.

Wage Determinations

The place of performance for this contract action is unknown. In accordance with FAR 52.222-49, Service Contract Labor Standards-Place of Performance Unknown, wage determinations for possible places of performance will be obtained if requested in writing. To obtain a wage determination, Contractors must submit their request by the deadline stated below.

Request for Pictures of Samples of the Records Pictures of samples of the records will be provided to Contractors if requested in writing. Pictures will be emailed directly to the Contractor. Samples of records cannot be provided in any other format. To receive pictures of samples of the records, Contractors must submit their request by the deadline stated below.

Contractor Site Visit and Description of Facilities

The Government will assess the Contractor’s facilities and equipment for acceptability. Facilities will be inspected during the evaluation process in accordance with the standards in the Performance Work Statement. The Contractor is required to submit a list of all equipment necessary to perform the services required and a brief description of its facilities. The Description of Facilities shall include an overview of security measures, fire suppression and detection system. Note: NARA will only inspect Contractor’s facilities if the remainder of its quotation is deemed technically acceptable.

To aid you in your planning and quotation development, the following information is provided as attachments to this Request for Quotation:

Attachment 1 – Performance Work Statement Attachment 2 – Schedule of Prices Attachment 3 – RFQ Information Sheet

Attachment 4 – Additional NARA Terms and Conditions

Attachment 5 – Evaluation Factors

Attachment 6 – Quotation Submission Instructions

Attachment 7 – Relevant Past Performance Questionnaire

Attachment 8 – FAR Clauses

Attachment 9 – Records Management Obligations

Attachment 10 – Confidential and Non-Disclosure Agreement (sample document to be signed at award of contract.)

Contractors must provide the following documents and information with their quotation:

- Attachment 3, RFQ Information Sheet

- The Representations at FAR 52.204-24 must be filled out

-The Representations at FAR 52.204-26 must be filled out

See Attachment 8, FAR Clauses, sections VII and VIII. The Representations are highlighted for your convenience.

-The Place of Performance requirement at FAR 52.215-6 must be filled out

See Attachment 8, FAR Clauses, section IX, include addressees if applicable

-Description of Facilities (see Contractor Site Visit and Description of Facilities above)

QUESTIONS AND REQUEST FOR PICTURES OF SAMPLES OF RECORDS:

Questions regarding this RFQ and requests for pictures of samples of records must be submitted in writing via email to the Contract Specialist, Cynthia Jones, at cynthia.jones@nara.gov no later than 12:00 p.m. eastern time on September 15, 2025 to be considered. Questions submitted in any other manner will not be answered. The Government will answer questions or requests for clarification via a written RFQ amendment. Pictures will be sent directly to Contractor.

REQUEST FOR WAGE DETERMINATIONS: Requests for wage determinations must be submitted in writing via email to the Contract Specialist, Cynthia Jones, at cynthia.jones@nara.gov no later than 12:00 p.m. eastern time on September 15, 2025. The Government will add wage determinations via a written RFQ amendment.

QUOTATION AND PAST PERFORMANCE QUESTIONNAIRES: Quotations and Past Performance Questionnaires must be submitted to Cynthia Jones via email at cynthia.jones@nara.gov. The deadline for quotations and Past Performance Questionnaires is 12:00 p.m. eastern time on September 19, 2025. Failure to submit quotations by the deadline may result in rejection of the quotation as untimely. Please include Solicitation Number: NARA-883103-25-Q-00050 in the email subject line and allow one extra business day for delivery and receipt, as the email will need to pass through IT security. See Attachment 6, Quotation Submission Instructions.

ATTACHMENT 1

PERFORMANCE WORK STATEMENT

for

DECRYPTION OF MIXED MEDIA FILES FOR THE FAA 9/11 PROJECT

- DIGITAL FORMAT

1.0

BACKGROUND INFORMATION

1.1 The National Archives and Records Administration (NARA) is an independent Federal agency that helps safeguard and preserve our nation's history by overseeing the management of all Federal records. The stories of our nation and our people are told in the records and artifacts cared for in NARA facilities around the country and people can discover, use, and learn from this documentary heritage. The mission is to ensure ready access to the essential evidence that documents the rights of American citizens, the actions of Federal officials, and the national experience.

1.2 The mission of Research Services is to accession, process, describe, preserve, and make accessible Federal records. Research Services has a collection of records from the Federal Aviation Administration (FAA) that are on various media formats. Records consist of textual, audio, and electronic files relating to the September 11, 2001, terrorist attacks, the FAA’s involvement in the monitoring of United Airlines Flights 175 and 93 and American Airlines Flights 11 and 77, and the Federal Government’s subsequent actions in the aftermath of the attacks. Information includes recordings of telephone conversations, radar data, and air traffic control communications, and situation re-creation assessments. Items have not yet been digitized for special access review and release to the public.

2.0

SCOPE

2.1 The Contractor shall transfer media in the collection to formats that are archivally stable and can be uploaded into NARA’s Electronic Records Archive (ERA). The contractor shall access, duplicate, and unencode data, producing readable copies. Items such as radar data were created using proprietary equipment and formats. SATORI: Situation Assessment Through Re-creation of Incidents is a system that graphically recreates the radar data recorded at En Route air traffic control facilities.

2.2 The Contractor shall reproduce radar data files in pdf and txt, and audio files to specifications in Audio Born Digital [AUD-P2] (uncompressed WAV files to match original in sample rate and bit depth). For files in other formats, the Contractor shall recover them in their native format and provide NARA with a format conversion assessment. The assessment shall be submitted to the NARA Contracting Officer’s Representative (COR) after the native files are recovered.

2.2.1 The Contractor shall transmit these archivally stable files via high capacity hard drives or direct upload to approved cloud storage staging areas.

2.2.2 .CVS file with the appropriately labeled and defined fields and field headers is an acceptable format for delivery of extracted metadata. Samsung T7 SSD is an example of acceptable media for data delivery.

2.2.3 The delivered files shall be coherently and logically named and/or numbered, and shall be placed in delivery directories with prescribed characteristics. The information shall be delivered in specified formats.

2.2.4 The Contractor shall convert data from the following media:

2.2.5 The Contractor shall log metadata descriptive of the extent of the record, e.g., timestamp, channel, audio duration, average audio level, or peak audio levels.

2.2.6 The Contractor shall identify any duplicates within the provided records on the monthly report.

2.2.7 The Contractor shall provide data recovery services. Data recovery services shall be approved in advance by a NARA Contracting Officer.

2.2.7.1 The Contractor shall notify the NARA COR if damaged materials are found. The NARA COR shall be contacted before incurring additional expenses. If the material will require data recovery, the Contractor shall provide the NARA COR with a written cost estimate for the data recovery services.

2.2.7.2 Data recovery services shall not be made without a written approval from a NARA Contracting Officer. The NARA COR is not authorized to approve data recovery services.

2.2.7.3 If data recovery services are approved, the services will be priced separately and added to the contract via a modification signed by a NARA Contracting Officer and the Contractor. Any data recovery service performed in advance of receiving a fully executed contract modification is at the Contractor’s risk.

2.3 Report Submissions 2.3.1 The Contractor shall submit monthly written reports detailing progress of the work, including the total number of items produced in a readable format on archivally stable media and identifying the specific items reproduced, format conversion assessment, and any duplicates found.

2.3.2 The report shall be submitted to the NARA Contracting Officer’s Representative (COR) by the 5th of each month.

2.3.3 Receipt of Materials Form. A signed NA Form 14111, Receipt for National Archives and Records Administration Holdings, is due no later than 24 hours after the arrival of shipment of records at the Contractor’s premises.

2.3.4 The Contractor shall prepare a shipment log. A copy shall be provided at the final return of records to the NARA COR and/or at any time, if requested by NARA. The shipment log shall detail incoming and outgoing shipments of original and reformatted materials. The log shall contain:

· A manifest of shipped materials

· The date the materials were received/sent

· The date outgoing shipments were received at their destination and the name of the individual who signed for it

2.4 Quality Control Provisions 2.4.1 The Contractor shall provide a quality assurance plan to the NARA COR within ten business days after receipt of the materials.

2.4.2 The Contractor shall initiate, document, and maintain a quality control program specific to this contract throughout the life of this contract.

2.4.3 Using automated batch-processing software tools, the Contractor shall develop a test plan for each format and/or each appropriate project. The test plan shall allow for some characteristics, such as sampling frequency (Hz), number of audio channels and number of bits per sample, to be evaluated on an actionable basis (warning, fail or pass depending on the defined parameters). Aim points for these benchmarks shall be evaluated against NARA's product specifications as well as NARA defined aim points, which may change depending on specific project goals and formats encountered.

2.4.4 The Contractor quality review of audio shall include, but is not limited to, the following criteria:

· complete item has been captured

· re-recordings are not flawed by noise or distortion beyond that present in the source recordings

· all files open and play properly

· re-recordings meet specifications for resolution, sampling frequency, and other formatting requirements

· recorded calibration tone sets meet requirements for reproduction quality

· embedded metadata must comply with the FADGI Embedded Metadata in Broadcast WAVE File Guidelines. NARA will provide the Contractor with a list of mandatory metadata fields.

2.4.5 Other factors related to the performance of the contract specifications shall include:

· capture and delivery of all items presented to contractor for recovery?

· accuracy of file-naming, directory structure, delivery media marking or naming

· completeness and accuracy of documentation in the form of associated databases and quality review reports

2.4.6 The Contractor shall perform quality control for 100 percent of deliverables. The Contractor shall be responsible for inspecting the accuracy of filenames and directories for all digital objects produced under this contract. The contractor shall provide a report listing corrective actions that were taken. The quality assurance plan shall address all specification and reporting requirements associated with each phase of performance, beginning with receipt of the original materials through delivery and acceptance by NARA.

2.4.7 The Contractor shall be responsible for performing all inspections or evaluations of the quality of all re-work during production to ensure that the quality of the re-work conforms to the guidelines and requirements specified. Inspection equipment shall be of appropriate quality, accuracy, and quantity to ensure that all requirements are met. The program shall also include procedures that address requirements for data entry, labeling, containers for records (if any), and delivery.

2.4.8 Contractor shall submit quality review reports to the NARA COR by the 5th of each month.

2.4.9 NARA shall conduct audits and any errors identified during this process shall be corrected by the Contractor.

2.4.10 The Contractor shall perform corrections of identified errors within 60 days of notification.

2.4.11 The Contractor shall inform the NARA COR via email when the work required under this contract is 80% complete.

3.0

PLACE OF PERFORMANCE AND NARA CONTRACTING OFFICER’S REPRESENTATIVE (COR)

3.1 The work to be performed under this contract will be performed at the Contractor's work site.

3.2 The NARA Contracting Officer’s Representative for this contract is:

Name: TBD Telephone:

Email:

4.0

STORAGE, SECURITY, HANDLING, AND SHIPMENT OF RECORDS

4.1 Storage and Security 4.1.1 The NARA materials shall be safeguarded against theft, vandalism, unauthorized use, damage, and alteration of any kind.

4.1.2 Storage, transportation, and use temperatures shall not exceed 75 degrees Fahrenheit and shall not exceed 50 percent relative humidity.

4.1.3 The Contractor’s facility shall have a fire detection system and be wired to an emergency signal company that will bring the fire department to the laboratory expeditiously.

4.1.4 The Contractor’s facility shall have good ventilation and be free from gaseous fumes such as those emitted from chemical stores or freshly painted rooms.

4.1.5 NARA’s records shall not be sent to any other facility except NARA’s without the written authorization of the NARA Contracting Officer.

4.2 Handling 4.2.1 NARA records shall be handled in a clean work environment with dust-free and clutter-free worktables.

4.2.2 Smoking, beverages, and food shall be prohibited in the receiving and shipping areas, the media storage area, technical equipment facility, and the work area where the materials are digitized.

4.2.3 The work environment shall avoid extreme heat, high humidity, rapid temperature or humidity changes, and prolonged sunlight or other sources of ultraviolet light.

4.2.4 Optical media will be handled by the center hold or edges of the disc to avoid fingerprints on the disc surface that may affect drive performance.

4.2.5 If the Contractor is working with original records and finds any materials in poor condition such that digitization may result in further damage, the contractor shall notify NARA COR immediately. NARA will then assess the condition and make a determination for the correct action.

4.3 Pickup and Delivery of Records and Deliverables to NARA 4.3.1 NARA will prepare and pack duplicates of the original records, where possible, for pick-up or shipping from NARA's Archives II site in College Park, MD. Original records will be provided when material cannot be duplicated.

4.3.2 The materials shall be picked up by the Contractor or the Contractor’s licensed and bonded courier at NARA no more than 30 days after being notified via email by the NARA COR that they are available for pickup. The materials may also be shipped, at NARA's expense, to the Contractor via a NARA-approved shipper. The NARA COR will notify the Contractor via email when materials are shipped by NARA. NARA has final approval over the method of shipment.

4.3.3 Each shipment will be accompanied by an inventory that lists each original record by item number. The Contractor shall validate shipments and sign a receipt for them. The Contractor shall return a receipt that lists all items received to the NARA COR via email within seven business days.

4.3.4 A written record shall be made of any deviation(s) from the NARA-furnished inventory and the NARA COR shall be notified immediately. To minimize the potential for loss or damage to the original recordings, NARA will ship materials in batches.

4.3.5 The Contractor shall carefully perform a complete inspection and inventory upon receipt of all materials with respect to quality as well as quantity. The Contractor shall contact the NARA COR immediately if there are any items listed on the NA Form 14111, Receipt for National Archives and Records Administration Holdings, but not included with the materials received. Damaged materials shall be reported to the NARA COR.

4.3.6 Upon completion of the required work to copy and encode the items, all material will be shipped or delivered to NARA in an expeditious fashion. All materials shall be returned to NARA. For shipments of originals to NARA, the Contractor shall return the records in their original boxes, package them securely, and ship or deliver them to the National Archives at College Park.

4.3.7 The records shall be shipped to the attention of the NARA COR and all shipments shall be coordinated with the NARA COR in advance of shipping.

4.3.8 If the Contractor transports the records directly, only a secure, enclosed vehicle will be permitted to carry the records. Trunks of private cars are not acceptable. Smoking, eating, and drinking shall not be allowed in the travel compartment with shipments of records.

4.3.9 If the Contractor transports the records directly, the items shall be transported directly to the Contractor’s facility without stops for other client’s goods, for meal breaks, refueling stops, etc. The intent is to minimize the amount of time the Government’s materials are on the road.

4.3.10 If the Contractor uses UPS "Next Day Air Early" with signature and receipt, the Contractor is responsible for ensuring the following:

4.3.11 Overnight shipments should originate on Monday through Thursday. The intent is to ensure that the materials do not languish in a delivery vehicle or a warehouse over a weekend or holiday period.

4.3.12 The Contractor must take into account that there are Federal Government holidays during the year and must ensure that delivery days will not fall on one of these days. The Federal Government holidays are New Year’s Day, Martin Luther King Jr.’s Birthday, Inauguration Day, Presidents’ Day, Memorial Day, Juneteenth, July 4th, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, and Christmas Day. Some of these holidays “float” from year-to-year so the dates must be researched for each calendar year.

4.3.13 Each shipment shall be accompanied by a Contractor created shipping inventory that lists each item by its number and the order number that it is a part of, as well as the original, signed NA Form 14111, Receipt for National Archives and Records Administration Holdings. Upon receipt of a shipment, NARA shall verify the inventory and send an email with a Word attachment that lists the items received. Receipt of the email and the Word attachment shall then constitute a written record of the acceptance of the shipment by the NAR COR. Therefore, any deviation(s) shall be known by both the Contractor and by the NARA COR immediately.

5.0

PERIOD OF PERFORMANCE

5.1 The period of performance will be until the work required under this contract is completed but no longer than five years. A specific period of performance will be provided in the award.

6.0

TASKS AND DELIVERABLES

6.1 Tasks and deliverables are discussed in paragraph 2.0.

7.0

PERFORMANCE SPECIFICATIONS/ADDITIONAL REQUIREMENTS:

7.1 The Contractor shall be responsible for safeguarding all government furnished equipment, information, and property provided for Contractor use.

7.2 The Government has unlimited rights to all documents/material produced under this contract. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

7.3 Contractor shall comply with NARA’s Records Management Obligations.

7.4 If, in accordance with FAR 52.242-15, Stop-Work Order, the Contractor is required to stop the work called for in this contract, the Contractor shall return all records to NARA within two business days.

7.5 Travel expenses will not be paid.

8.0

GOVERNMENT FURNISHED PROPERTY

8.1 The Government shall provide the records to be digitized and unencoded.

8.2 Records shall be returned to NARA.

9.0

CONTRACTOR FURNISHED PROPERTY AND SERVICES

9.1 The Contractor shall provide all personnel, supplies, facilities, transportation, materials, supervision, and other items and services necessary to perform the services as defined in this performance work statement except for those items specified as government furnished property.

9.2 The Contractor shall provide all tools and equipment necessary to meet the requirements of this contract.

9.3 NARA reserves the right to inspect the Contractor’s facilities and equipment during the term of the contract. During the term of the contract, the Contractor also agrees to allow for periodic re-inspection by NARA with prior notification to the Contractor. In addition, NARA and all its designees shall have access at all reasonable times to the Contractor premises in which any NARA records and materials are located for purposes of inspecting the Government’s property. This inspection may include its receiving, storage, work, laboratory, and shipping areas.

ATTACHMENT 2

SCHEDULE OF PRICES

OF

ISSUE

Manufacturer Stock Identifier:

3M DC6150 Data Cartridge Tape 150 MB 620 ft.

Manufacturer Stock Identifier:

3M Imation Black Watch 3480 210MB 1/2" Tape Cartridge

Attachment 1, Performance Work Statement

Manufacturer Stock Identifier:

Castlewood ORB 2.2GB removable magnetic disk

Manufacturer Stock Identifier:

Graham Magnetics 9-track mainframe Magnetic Tape 6250 CPI 170 MB

Manufacturer Stock Identifier:

Hewlett Packard 92279T 1.2GB rewritable optical disks

Manufacturer Stock Identifier:

Imation Royal Guard 3490E 810 MB cartridge

Attachment 1, Performance Work Statement

Each

Attachment 1, Performance Work Statement

Not to Exceed

TOTAL CONTRACT CEILING PRICE: $_____________

*Note: The sum of the Total Contract Ceiling Price should include the Not to Exceed price shown.

NARA will evaluate submitted pricing in accordance with FAR 52.217-5.

ATTACHMENT 3

RFQ INFORMATION SHEET

Contractors must complete all applicable information on this sheet and submit it with their quotation. Failure to do so may render the quotation unacceptable for receipt of the order.

Specific Terms, Conditions, and Administrative information

PAYMENT TERMS: _________________________________________________

DELIVERY DATE: _____________________________________________________

WARRANTY INFORMATION: ___________________________________________

NAME AND ADDRESS OF QUOTER:

TELEPHONE NO (INCLUDE AREA CODE): __________________________

FAX NUMBER: ___________________________

E-MAIL ADDRESS:

ENROLLED IN SYSTEM FOR AWARD MANAGEMENT? Yes____ No____

CAGE CODE NUMBER: _____________________________________

UNIQUE ENTITY ID: _______________________________________

Contractor Certification: [By signing the Contractor acknowledges that the information provided in response to this RFQ is correct.]

NAME AND TITLE OF SIGNER: __________________________________

DATE OF QUOTATION: ___________________________________

SIGNATURE OF PERSON AUTHORIZED TO SIGN: ______________________________

ATTACHMENT 4

ADDITIONAL NARA TERMS AND CONDITIONS

(Addenda to FAR clause 52.212-4)

I. GOVERNMENT CONTRACT ADMINISTRATION

A. This contract will be administered by:

National Archives and Records Administration

Office of the Chief Acquisition Officer, Code Z

8601 Adelphi Road, Room 3340

College Park, MD 20740-6001

B. Contract Specialist (CS):

Cynthia Jones

Telephone: 301-837-1860

Email: cynthia.jones@nara.gov

The Contracting Officer (CO) has the overall responsibility for the administration of this contract. Written communication to the Contract Specialist (CS) must make reference to the contract number and must be emailed or mailed with postage prepaid, to the above address.

C. Contracting Officer (CO):

Any Z Warranted CO

The CO alone, without delegation, is authorized to take actions on behalf of the Government to amend, modify, or deviate from the contract terms, conditions, requirements, specifications, details and/or delivery schedules; make final decisions on disputed deductions from contract payments for non-performance or unsatisfactory performance; terminate the contract for convenience or default; and issue final decisions regarding delivery questions or matters under dispute. However, the CO may delegate certain other responsibilities to authorized representatives.

II. CONTRACTING OFFICER’S REPRESENTATIVE (COR)

A. COR: See award document

B. The individual named above is designated as the Contracting Officer’s Representative (COR) to assist the CO in the discharge of the CO’s responsibilities. The COR serves as the point of contact through which the Contractor can relay questions or problems of a technical nature to the Contract Specialist and the Contracting Officer. The COR is responsible for the inspection and acceptance of the contract requirements and for the review and certification of invoices for the contract requirements.

C. In no event will any understanding or agreement, modification, change order, or other matter deviating from the terms of the contract between the Contractor and any person other than the Contracting Officer be effective or binding upon the Government.

D. When, in the opinion of the Contractor, the COR requests effort outside the existing scope of the contract, the Contractor must promptly notify the Contracting Officer in writing.

E. No action will be taken by the Contractor under such technical instruction unless the Contracting Officer has issued a contractual change.

III. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – INVOICE PROCESSING PLATFORM (IPP) (July 2020)

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and Conditions – Commercial Products and Commercial Services included in commercial item contracts. The IPP website address is: https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice: Invoices shall be submitted after Government’s acceptance of all deliverables. The invoice shall contain information required by FAR 52.212-4(g).

Contractor Invoice to include:

1. Award number

2. CLIN//Item number of deliverable

3. Description of deliverable

4. Price of deliverable

5. Quantity of deliverable

6. Date deliverable was provided to the Government for inspection if applicable

7. Serial number/part number if applicable

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment. Contractor assistance with enrollment can be obtained by contacting the IPP Customer Support Helpdesk by sending an email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

IV. CONFIDENTIALITY OF INFORMATION

By agreeing to this contract and/or any amendments, the Contractor acknowledges, understands, and accepts the following:

A. All information regarding the procedures developed under this contract must be regarded as sensitive information by the Contractor and not to be disclosed to anyone outside the Contractor’s organization without the written permission of the Contracting Officer.

B. The Contractor may have access to and use of data or information, which may be considered proprietary or confidential. Dissemination or use of the data or information, other than in performance of this contract, would be adverse to the interests of the Government and others.

C. The Contractor agrees in the performance of this contract to keep all information supplied by the Government and all information obtained in conducting research in the strictest confidence; this information being the sole property of the Government.

D. The Contractor agrees that its personnel will not divulge or release data or information developed or obtained in connection with the performance of this contract. The Contractor agrees not to publish, reproduce, or otherwise divulge such information in whole or in part, in any manner or form, nor authorize others to do so, taking such reasonable measures as are necessary to restrict the information to those personnel who must have the information to perform the work provided herein.

E. The Contractor must establish policies and procedures to implement the substance of this clause at the individual employee level which will assure that affected personnel are made aware of contract provisions and terms and conditions and the Contractor’s implementing policies and procedures. Particular attention will be given to keeping personnel advised of the statutes and regulations applicable to the handling of other Contractor confidential financial data.

F. The Contractor must not refer to this contract in commercial advertising, or similar promotions and the Contractor is restricted from reproducing the image(s) of NARA in any form of commercial advertising or similar promotion without the expressed written permission of the Contracting Officer. This includes images of official seals and buildings, which is controlled by NARA.

G. The Contractor must not release confidential IRS information unless the disclosure is authorized under the provisions of the IRC, the Privacy Act, Title 18 U.S.C., and the terms of the respective IRS Contract. Unauthorized disclosures by any Contractor employee could subject him/her to civil and criminal penalties under Title 26 U.S.C. sections 7213, 7213A, and 7431, Title 5, U.S.C. section 552a of the Privacy Act, and Title 18 U.S.C. sections 641 and 3571.

V. SECURITY OF INFORMATION AND PROTECTION OF CONTROLLED UNCLASSIFIED INFORMATION, INCLUDING PERSONALLY IDENTIFIABLE INFORMATION (APRIL 2017)

(a) Applicability

This clause applies to all controlled unclassified information, which may include personally identifiable information, as defined in Section B, regardless of the medium in which it is found and includes paper records.

(b) Definitions. As used in this clause:

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to personally identifiable information, in usable form whether physical or electronic.

“Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.

“Personally identifiable information (PII)” means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual is a citizen of the United States, legal permanent resident, or a visitor to the United States. Examples of PII include the following:

(1) Name.

(2) Date of birth.

(3) Mailing address.

(4) Telephone number.

(5) Social Security Number.

(6) Email address.

(7) Zip code.

(8) Account numbers.

(9) Certificate/license numbers.

(10) Vehicle identifiers including license plates.

(11) Uniform resource locators (URLs).

(12) Internet protocol addresses.

(13) Biometric identifiers (e.g., fingerprints).

(14) Photographic facial images.

(15) Any other unique identifying number or characteristic.

(16) Any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive personally identifiable information (sensitive PII)” means a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

(1) Complete social security numbers, alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered sensitive PII even if they are not coupled with additional PII.

(2) Additional examples include any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Driver’s license number, passport number, or truncated social security number (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Financial information such as account numbers or electronic funds transfer information;

(v) Medical information; and/or

(vi) System authentication information such as mother’s maiden name, account passwords or personal identification numbers.

(3) Other PII may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but it is not sensitive.

(c) Data Security.

(1) The Contractor shall limit access to the data covered by this clause to those employees and subcontractor who require the information in order to perform their official duties under this contract.

(2) The Contractor employees, and subcontractors must physically or electronically secure CUI, which may include sensitive PII, when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

(3) When CUI is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed in accordance with NIST 800-88 standards.

(4) The Contractor shall only use CUI obtained under this contract for purposes of the Contractor; it shall not be disclosed, released, disseminated, or published without the prior written consent of the Contracting Officer.

(5) If it is established elsewhere in this contract that information to be utilized under this contract, or a portion thereof, is subject to the Privacy Act, The Contractor shall follow the rules and procedures of disclosure set forth in the Privacy Act of 1974, 5 U.S.C. 552a, and implementing regulations and policies, with respect to systems of records determined to be subject to the Privacy Act.

(6) At expiration or termination of this contract, the Contractor shall turn over all CUI obtained under the Contractor that is in its possession.

(d) Systems Access. Work to be performed under this contract may require the handling of CUI, including PII. The Contractor shall provide the Government access to, and information regarding those systems handling CUI, including sensitive PII for the Government under the Contractor, when requested by the Government, as part of the Contractor’s responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General (IG) for IG reviews.

When requested by the NARA CO or COR or other NARA official as described herein, in connection with NARA’s efforts to ensure compliance with security requirements and to maintain and safeguard against threats and hazards to the security, confidentiality, integrity, and availability of NARA Information, Contractor shall provide NARA, including the NARA OIG, (1) access to any and all information and records, including electronic information, regarding a Covered Information System, and (2) physical access to Contractor's facilities, installations, systems, operations, documents, records, and databases. Such access may include independent validation testing of controls, system penetration testing, and FISMA data reviews by NARA or agents acting on behalf of NARA, and such access shall be provided within 72 hours of the request. Additionally, the Contractor shall cooperate with NARA’s efforts to ensure, maintain, and safeguard the security, confidentiality, integrity, and availability of NARA information.

(e) Systems Security.

(1) In performing its duties related to management, operation, and/or access of systems containing PII under this contract, the Contractor, its employees and subcontractors shall comply with all applicable security requirements and rules of conduct applicable to the agency’s systems as described in:

a) NARA Directive 1608

HYPERLINK "http://www.archives.gov/foia/directives/nara1608.pdf" \h http://www.archives.gov/foia/directives/nara1608.pdf and

b) FedRAMP baseline controls for moderate IT systems.

(2) In addition, the use of Contractor-Owned laptops or other portable storage devices to process or store sensitive PII is prohibited under this contract until the Contractor provides, and the Contracting Officer, in coordination with the Senior Agency Official for Privacy (SAOP) or the SAOP’s designee, approves the Contractor’s written acknowledgment that the following requirements are met:

(i) Laptops and other portable storage devices must employ encryption that is NIST Federal Information Processing Standard (FIPS) 140-2 validated (or its successor) http://csrc.nist.gov/publications/PubsFIPS.html, and approved.

(ii) The Contractor has developed and implemented a process to ensure that security and other applications software are kept current.

(iii) Mobile computing devices utilize anti-virus software and a host-based firewall mechanism.

(iv) Removable media, such as hard drives, flash drives, devices with flash memory, CDs and floppy disks containing CUI, which may include sensitive PII shall not be removed from a Government facility unless they are encrypted using a NIST FIPS 140-2 or successor approved product.

(v) When no longer needed, all removable media, hard drives, and flash memory shall be destroyed in accordance with Government security requirements identified in NARA’s Media Protection Methodology.

(vi) The Contractor shall maintain an accurate inventory of devices used in the performance of this contract.

(3) All NARA information obtained under this contract shall be removed from Contractor-Owned information technology assets at the direction of the Contracting Officer or Contracting Officer’s Representative. Removal must be accomplished in accordance with standard FedRAMP controls for media protection in moderate IT systems and NIST 800-88 standards. Certification of data removal will be performed by the Contractor’s Project Manager and written notification confirming acknowledgment will be delivered to the Contracting Officer within 30 days of the direction to remove the information.

(4) Back up or mirrors of any systems or files containing CUI shall be treated in the same manner as the original data containing CUI, with the same protections and obligations.

(5) The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the Internet or other public works.

(f) Breach Notification to Government.

(1) The Contractor has been provided with: NARA Directive 1608, and is aware of its roles, responsibilities, and relationship with the Government in case of data breach.

(2) In the event of any actual or suspected breach of sensitive PII, the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer, the COR, the Senior Agency Official for Privacy (currently NARA’s General Counsel garymstern@nara.gov) and the Chief Information Officer (only for IT requirements) in accordance with NARA Directive 1608.

(3) The Contractor is responsible for positively verifying that notification is received and acknowledged by appropriate Government parties identified in subparagraph (2) above.

(4) In the event of a confirmed, potential or suspected Security Breach, involving unauthorized exposure, loss of control, compromise, exfiltration, manipulation, disclosure, acquisition, or accessing of any Covered Information System or any NARA Information accessed by, retrievable from, processed by stored on, or transmitted within, to or from any such system, Contractor shall immediately (and in no event later than within 1 hour of discovery) report any Confirmed Breach to the NARA CO and the CO's Representative (''COR").

(5) NARA, at its sole discretion, may obtain, and Contractor will permit, the assistance of other federal agencies and/or third party contractors or firms to aid in response activities related to any security incident, PII or Security Breach. Additionally. NARA, at its sole discretion, may require Contractor to retain, at Contractor's expense, a Third Party Assessing Organization (3PAO) acceptable to NARA, with expertise in incident response, compromise assessment, and federal security control requirements, to conduct a thorough vulnerability and security assessment of all affected Information Systems.

(6) Any report submitted in accordance with paragraphs (1), (2) and (3) above, shall identify (I) both the Information Systems and NARA Information involved or at risk, including the type, amount, and level of sensitivity of the NARA Information and, if the NARA Information contains PII, the estimated number of unique instances of Pll, (2) all steps and processes being undertaken by Contractor to minimize, remedy, and/or investigate the Security Incident, (3) any and all other information as required by the USCERT Federal Incident Notification Guidelines, including the functional impact, information impact, impact to recoverability, threat vector, mitigation details, and all available incident details; and (4) any other…