Network Design Build Cabling PWS_DRAFT.pdf

PERFORMANCE WORK STATEMENT (PWS)

National Science Foundation

New Headquarters – Enhanced Communication Equipment Room Design & Build

Office of the Chief Information Officer

Date: 2 February 2026

Enhanced Computer Equipment Room Design & Build

1.0 BACKGROUND

1.1 The National Science Foundation (NSF), 2415 Eisenhower Ave, Alexandria VA, 22314, is an independent agency of the U.S. Government, established by the National Science Foundation Act of 1950, as amended and related legislation (42 U.S.C. 1861 et seq.). NSF is responsible for advancing all fields of non-medical science, technology, engineering and mathematics research and education in the United States across a broad and ever-expanding frontier.

1.2 NSF carries out its mission primarily by making merit-based grants and cooperative agreements to individual researchers and groups, in partnership with colleges, universities and other public and private institutions throughout the United States. NSF houses all its roughly 3,000 employees and contractors at its headquarters office in Alexandria, VA.

1.3 NSF is reducing the scope of its on-premises enterprise IT infrastructure to allow, combined with Building Automation System, IT Asset Management, and Configuration Management Database (CMDB) tools, to provide visibility into all computer spaces operated by the NSF.

Existing IT Infrastructure topography includes a Co-location Data Center, managed by Equinix located in Ashburn, VA and an Enhanced Communication Equipment Room, located in the NSF Headquarters in Alexandria, VA. The key component of this topography is the Amazon Web Services, Direct Connect, tied to the Equinix data center supporting NSF’s multi-cloud environment.

1.4 The current data center appliances and monitoring equipment provides a system of record for physical relationships among elements in both the on-premises computer equipment room and the colocation data center enabling the interface between management of IT applications & systems and the IT hardware, physical facilities infrastructure, physical networks, and container facilities necessary for sustainable planning and operation of those data centers. The new Enhanced Communication Equipment room will need to communicate with and integrate equipment and support change control management information with other Government-operated information management systems.

1.5 The establishment of a new NSF Headquarters, located at: 401 Dulany Street, Alexandria, VA 22314, beginning 1 January 2026, necessitates the design and build of the network topography on-premises in the new NSF Headquarters. Design of the IT (voice/data) network topography, equipment/performance specifications, and acceptance criteria for all network rooms includes, but not limited to, the IT Service Desk Area, Main Data Facility (MDF) Communication Equipment Rooms (CERs), other network (e.g., audiovisual) closets supporting technologies that integrate with Agency networks and systems, OCIO Imaging Room, and other spaces required by OCIO to support its operations.

This includes:

a) the fiber cabling from the Point of Presence to the Communication equipment rooms, including but not limited to, a plan where rack-level and server-level equipment is to be installed in the Enhanced Communication Equipment Room in the basement and the

Communication Equipment rooms on floors 1-11. The location of racks should be based on physical space and power distribution availability; minimum fiber requirement are primary 24 strand of 50 micron multimode OM4 and secondary 12 strand single-mode fiber optic cable between PoP to the MDF and to the CERs on each respective floor.

b) Installation of new cabling and termination in patch panels. Installation of new patch panels that support minimum copper cabling type. The minimum copper cabling type is Cat 6a.

c) Installation of government furnished indoor and outdoor Wireless Access Points secured to junction boxes in the ceiling or where most feasible to support wireless access signal strength. Heat mapping must be conducted to determine the most optimal location for WAPs. The government will furnish all Wireless Access Points

d) Installation of government furnished floor and core switches in the MDF and CERs.

e) an evaluation of power distribution to IT equipment to the rack location level in normal, planned outage, and contingency outage conditions;

f) cable plant (cable tray) locations including multiple height levels (underfloor and/or suspended), cable (fiber optic & copper) paths, cable interconnectivity information (cable name, cable tray used, equipment connection at each end).

g) Cabling and installation of 4x4 outlets in all Conference rooms (15 total). Cabling will run from nearest CER to the conference room.

1.6 The NSF team will review all designs to ensure they meet/exceed all industry standards and local codes & standards. For example, the OCIO architecture and engineering standards and guidelines will be utilized for equipment, systems, performance capabilities, and cybersecurity which include Approved Products List.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. Office of Management and Budget (OMB) Circular A-130, “Management of

Federal Information Resources,” November 28, 2000

9. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7,

10. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

11. National Institute Standards and Technology (NIST) Special Publications (SP)

12. OMB Memorandum, “Transition to IPv6”, September 28, 2010

13. OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

14. OMB Memorandum 05-24, Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

15. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

16. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

17. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

18. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

19. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

20. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

21. Draft NIST Special Publication 800-157, Guidelines for Derived PIV

Credentials, March 2014

22. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://www.fedramp.gov/files/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

23. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

24. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

25. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

3.0 SCOPE OF WORK

The NSF is moving to a new headquarters location in Alexandria, VA and requires a physical network design and build to establish an enterprise network tied to a co-location data center that supports the NSF core mission and functions for approximately 1,200 federal employees and 1,200 contractors. The design should include an enhanced computer equipment room (data center) and approximately 23 computer equipment rooms (switch closets).

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.1.1 The period of performance shall be for eight (8) months following award.

4.1.2 Date and time of service(s) shall be by mutual consent of the assigned Government OCIO staff (as applicable) and the vendor. Any work performed onsite at NSF facilities shall be accomplished during local core hours (0700-1630, Monday-Friday) unless otherwise coordinated.

https://www.fedramp.gov/files/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

4.1.3 Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). There are ten Federal holidays set by law (USC Title 5 Section 6103) that NSF follows:

4.1.4 Under current definitions, four are set by date:

New Year's Day January 1, 2026 Martin Luther King’s Day January 19, 2026 President’s Day February 16, 2026 Memorial Day May 25, 2026 Juneteenth June 19, 2026 Independence Day July 4, 2026 Labor Day September 7, 2026

4.2 PLACE OF PERFORMANCE

Design support work should generally be performed at/from the vendor’s place of business.

Work satisfying computer room survey work and computer room build generally require the vendor’s physical presence at NSF facilities located in Alexandria, VA.

4.3 TRAVEL

Travel, for the purposes of this PWS, means solely travel from the vendor’s location to NSF Headquarters. Vendor travel within the local commuting area of the vendor’s place(s) of business or in support of physical (classroom) training of Government staff will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 The Contractor shall perform the following:

A. Furnish, install and terminate:

1) The appropriate amount of copper cabling (minimum copper cabling type is Cat 6a) to each work area outlet (WAO), as per the drawing documents. Each WAO will be homerun back to the designated LAN room located on each floor.

B. Design a physical network topography incorporating the use of government furnished equipment, including, but not limited to, management appliances, switches and wireless access points. Cabling minimum:

1) 24 strand of 50 micron multimode OM4 and 12 strand single-mode fiber optic cable between PoP room and the MDF (data center);

2) Minimum 24 strand 50 micron mulitmode OM4 and 12 strand single mode-fiber between the MDF and all computer equipment rooms in the Basement and floors 1-11.

3) Minimum Cat 6a copper cable from the CER to Wireless Access Points (WAP), Conference Rooms and select executive offices, approximately 400 indoor WAPs and 2 outdoor WAPs

A. Build an enhanced communication equipment room in the MDF supporting the physical network topography, including but not limited to, standby spot coolers, automatic transfer switch, cabling & fiber racks, primary and redundant power, and

UPS.

B. Build communication equipment rooms using government furnished equipment, including but not limited to switches and patch panels.

6.0 PROJECT MANAGEMENT

6.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the Contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the Contract. The Contractor shall update and maintain the NSF Project Manager-approved CPMP throughout the period of performance.

Deliverable:

A. Contractor Project Management Plan

6.2 REPORTING REQUIREMENTS

6.2.1 The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

6.2.2 The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also include an itemized list of all Electronic and Information Technology (EIT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with NSF accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. The Monthly Status Report shall include the following data elements:

1) Project Name and Contract Name

2) Overview and description of the Contract

3) Overall high level assessment of Contract progress

4) All work in-progress and completed during the reporting period

5) Identification of any Contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

6) Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

7) Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8) Work planned for the subsequent two (2) reporting periods, when applicable Current Contract schedule overlaid on original Contract schedule showing any delays or advancement in schedule for Firm Fixed Priced efforts provide expenditures based upon your proposed spend plan.

B. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Monthly Status Report shall identify any changes in staffing identifying each person who was added to the Contract or removed from the Contract.

C. The Contractor shall continuously monitor performance and report any deviation from the previous Monthly Status Report to the COR and Program Manager (PM) during routine, regular communications.

6.2.3 Deliverable:

A. Monthly Progress Report

6.3 ADDITIONAL DELIVERABLES

6.3.1 The Contractor shall provide the following deliverables:

A. Gap Analysis Report – Between Current state and desired end state B. Verification & Validation plan C. Site results/certification records D. Cost & Technical Proposal

6.3.2 The vendor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Office 365, AutoCAD, and Adobe Postscript Data Format (PDF).

7.0 GENERAL REQUIREMENTS

7.1 ENTERPRISE AND IT FRAMEWORK

7.1.1 The Contractor shall support the NSF enterprise management framework.

7.1.2 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low / Tier 1 Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) an the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2

Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier 4 Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

7.1.3 The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low / NACI Tier 2 / Moderate /

MBI

Tier 4 / High / BI

5.1

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

7.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

7.2.1 Contractor Responsibilities:

A. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

B. The Contractor shall bear the expense of obtaining background investigations.

C. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the NSF security procedures. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to NSF within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this TO. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1) The Contractor should coordinate the location of the nearest Federal Government fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

2) The Contractor shall ensure the following required forms are submitted to the COR within 5 days after Contract award:

a. Optional Form 306

b. Self-Certification of Continuous Service

c. VA Form 0710

d. Completed SIC Fingerprint Request Form

3) The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

D. The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e- QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

7.2.3 The Contractor shall be responsible for the actions of all personnel provided to work for NSF under this Contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this Contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

A. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the Contract.

7.2.4 Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to NSF facilities and systems by Contractor and Subcontractor employees and/or termination of the Contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with NSF policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with NSF.

7.3 Deliverable:

A. Contractor Staff Roster

7.4 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/Contract.

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with this effort.

Performance Objective Performance Standard Acceptable

Performance Levels A. Technical Needs Demonstrates understanding of requirements Efficient and effective in meeting requirements Meets technical needs and mission requirements Offers quality services/products

Satisfactory or higher

B. Project Milestones and Schedule

Established milestones and project dates are met Products completed, reviewed, delivered in timely manner Notifies customer in advance of potential problems

Satisfactory or higher

C. Project Staffing Currency of expertise Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

D. Value Added Provided valuable service to Government Services/products delivered were of desired quality

Satisfactory or higher

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the Contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment Survey will be used in combination with the QASP to assist the Government in determining acceptable performance levels.

7.5 FACILITY/RESOURCE PROVISIONS

The Government will provide limited office space when authorized Contract staff work at a Government location as required in order to accomplish the Tasks associated with this PWS.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

7.6 GOVERNMENT FURNISHED PROPERTY

See Appendix C

APPENDICES

A3.0 Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508.

These standards have been developed and published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

A4.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all NSF policies, standard operating procedures, applicable laws and regulations while on NSF property. Violations of NSF regulations and policies may result in citation and All Contractor and service provider personnel that travel to NSF's physical headquarters facility shall be required to have at minimum, a public trust clearance. The COR will ensure all requirements are met for Contractor entrance procedures for access to NSF facilities and IT systems. Entrance requirements include background checks and building access.

A4.1 The Contractor shall complete all requested information/forms for each employee and subcontractor requiring site access to NSF in a timely manner and will not engage those persons on the project until receipt of written approval. The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured. Send completed forms to the COR.

A4.2 All Contractor personnel are responsible for recognizing sensitive information and avoiding inappropriate or accidental access, use, or disclosure in accordance with NSF IT policies. the contractor and/or its service provider shall not disclose and must safeguard procurement sensitive information, computer systems and data, Privacy Act data, and government personnel work products which are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature.

A4.3 In the event of any violation or computer security incident or a breach of information, the contractor shall warrant and ensure that both the contractor and its service provider will take immediate action to investigate and secure its service environment in addition to any other notification requirements that may be required by law or this contract, (See https://www.uscert.gov/). The contractor will notify the COR and NSF's Chief Information Security Officer, within forty-eight hours of discovering the breach, concerning the nature of the breach activity, its scope, and efforts taken to prevent further breach of its systems.

A5.0 Confidentiality and Non-Disclosure

The Contractor shall follow all NSF rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

A6.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13514, “Federal Leadership in Environmental, Energy, and Economic Performance,” dated October 5, 2009; Executive Order 13423, “Strengthening Federal Environmental, Energy, and Transportation Management,” dated January 24, 2007; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

The Contractor shall ensure that information technology products are procured and/or services are performed with products that meet and/or exceed ENERGY STAR, FEMP designated, low standby power, and EPEAT guidelines. The Contractor shall provide/use products that earn the ENERGY STAR label and meet the ENERGY STAR specifications for energy efficiency. Specifically, the Contractor shall:

1. Provide/use ENERGY STAR products, as specified at www.energystar.gov/products (contains complete product specifications and updated lists of qualifying products).

2. Provide/use the purchasing specifications listed for FEMP designated products at https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_fe mp_designated_products_procurement_requirements . The Contractor shall use the low standby power products specified at http://energy.gov/eere/femp/low-standby-power-products.

3. Provide/use EPEAT registered products as specified at www.epeat.net. At a minimum, the

Contractor shall acquire EPEAT® Bronze registered products. EPEAT registered products are required to meet the technical specifications of ENERGY STAR, but are not automatically on the ENERGY STAR qualified product lists. The Contractor shall ensure that applicable products are http://www.energystar.gov/products https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements https://www4.eere.energy.gov/femp/requirements/laws_and_requirements/energy_star_and_femp_designated_products_procurement_requirements http://energy.gov/eere/femp/low-standby-power-products http://www.epeat.net/ on both the EPEAT Registry and ENERGY STAR Qualified Product Lists. The acquisition of Silver or Gold EPEAT registered products is encouraged over Bronze EPEAT registered products

4. The Contractor shall use these products to the maximum extent possible without jeopardizing the intended end use or detracting from the overall quality delivered to the end user.

The following is a list of information technology products for which ENERGY STAR, FEMP designated, low standby power, and EPEAT registered products are available:

1. Computer Desktops, Laptops, Notebooks, Displays, Monitors, Integrated Desktop Computers, Workstation Desktops, Thin Clients, Disk Drives

2. Imaging Equipment (Printers Copiers, Multi-Function Devices, Scanners, Fax Machines, Digital

Duplicators, Mailing Machines)

3. Televisions, Multimedia Projectors

This list is continually evolving, and as a result is not all-inclusive.

B6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to NSF assets, or sensitive information, or an action that breaches NSF security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the Contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to

NSF shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the NSF information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the NSF OIG and Security and Law Enforcement. The Contractor, its employees, and its Subcontractors and their employees shall cooperate with NSF and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with NSF in any civil litigation to recover NSF information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

6.3 ADDITIONAL DELIVERABLES