Occupational Health Suite SOW - 20230630.pdf

FEDERAL BUREAU OF PRISONS

STATEMENT OF WORK

Occupational Health Suite

A. BACKGROUND:

The Federal Bureau of Prisons (BOP) is an agency of the

Department of Justice (DOJ). The BOP is responsible for the custody and care of approximately 158,000 Federal offenders. It consists of approximately 34,000 employees located at 122 institution sites throughout the United States, including Hawaii and Puerto Rico.

More information about the agency can be found on the BOP’s public site, www.bop.gov.

B. OBJECTIVE

The BOP is seeking a total occupational health, safety, and environmental productivity solution that can be configured to meet BOP’s Occupational Safety & Health (OSH) software needs.

The goal of this system is to enable the BOP to decrease injury rates and associated lost time while providing a proactive communication and reporting tool for management across the agency.

C. PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facilities with frequent visits to the Federal Bureau of Prisons sites as needed. The majority of the site visits would be in the

Washington, D.C. Metro Area.

Other sites that would utilize this Software Suite are located in Alabama, Arkansas, Arizona, California, Colorado, Connecticut, District of Columbia, Florida, Georgia, Hawaii, Illinois, Indiana, Kansas, Kentucky, Louisiana, Massachusetts, Maryland, Michigan, Minnesota, Missouri, Mississippi, North

Carolina, New Hampshire, New Jersey, New York, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, South Carolina, South Dakota, Tennessee, Texas, Virginia, Washington, Wisconsin and West

Virginia.

The contractor must acknowledge/address Place of Service in their proposal.

http://www.bop.gov/

D. DESCRIPTION OF SERVICES

The BOP is seeking a contractor capable of providing an online occupational health suite that would provide the following functionalities at a minimum:

• Provides an easy workflow for automating and managing medical surveillance programs.

• Integrates with safety and case management.

• Offers the ability to create unlimited number of user-defined questionnaires.

• Maintains complete audit trail for any changes made to a record.

• Includes standard reports that demonstrate return on investment (ROI).

• Includes ability to produce user-defined letters to employees.

• Provides the ability to store external documents with employee records.

• Allows the user to produce a complete medical chart for an employee.

• Offers an easy-to-use notes system with template phrases to reduce repetitive keystrokes.

• Includes a user-defined “lock” on notes and medical records, so these cannot be edited.

• Offers additional modules to expand beyond the Medical group (i.e., Safety, Case Management, Industrial Hygiene)

• Offers integration application programming interfaces

(API), which will allow information to be shared with other information systems and software tools.

• System features that promote user efficiency and reduce data redundancy, such as predicted text for data entry, and personalization options for each user.

• A dashboard that provides an instant view of key performance indicators (KPIs) and schedules upon login.

• A robust security component that can be easily managed and maintained by the BOP’s designated system administrators.

• Streamlined regulatory reporting/recordkeeping.

• Track regulatory compliance with applicable OSHA federal regulations and EPA federal and state regulations.

• The system should be able to adhere to data privacy requirements.

• Identify health and injury/illness trends.

• Support effective absence management.

• Provide tools for managing a hearing conservation program.

• Interface between audiometers and the contractor’s EHRS software for automatic download of testing results.

• Identify and modify the baseline audiogram, make age-based adjustments, and calculate STS. There must be an OSHA required written opinion letter that is automatically populated with the test results.

• The contractor’s software shall be able to track the audiometry equipment and calibration information.

The contractor shall provide all labor, material, and equipment necessary to accomplish the following services:

1) Ensure installation of the software system to allow usage to best meet the needs of the BOP.

2) Recommend modifications or changes in equipment and operation procedures as needed.

3) Provide training and ongoing technical support for all BOP facilities, as requested upon approval of the agency or institutional contact.

Contractor’s software shall be an existing and developed system that is current and operational. The contractor’s software shall be easily configurable and shall have the ability to manage a medical surveillance program. The software shall be able to manage many exposure groups including medical surveillance, certification exams, and hazardous environments.

The contractor’s software shall have medical surveillance tables that support exposure, certification, and health examinations.

The software shall include a developed industrial hygiene capability.

The ability of the contractor’s software to complete required questionnaires by employees must meet security, confidentiality, and privacy requirements, e.g., Privacy Act, Health Insurance

Portability and Accountability Act. The questionnaire data must automatically populate the appropriate fields in the software.

The software should provide integration with the organization’s

Human Resource (HR) system as well as between OSH functional areas (medical, safety, etc.). Integration with the HR system allows for efficient, seamless transfer of employee data to OSH, while integration between functional areas allows Medical, Safety, and Occupational Health to communicate with one another, share information and report findings collaboratively, eliminating redundancies.

All data collected within the proposed system is the sole property of the Department of Justice/Federal Bureau of Prisons and will be provided by the contractor at the request of the agency in full at any time during the contract period.

The Contractor must address all areas listed in the Description of Services in their proposal.

E. CONTRACTOR REQUIREMENTS

I. Experience and Qualifications

The contractor shall be in compliance with OSHA, ADA, FMLA, HIPAA and DOT standards.

The contractor shall have a minimum of five years of proven, past experiences in this field to provide the services in accordance with the Statement of Work.

The program shall have an online help tool and technical support available 24 hours per day, 7 days per week.

The program shall provide compliance, competence indicators, and quality measures for documentation.

The program shall be optimized for use in a mobile electronic environment to meet evolving technological advances.

The program shall allow for the creation of customized care plans that have the ability to be integrated into an electronic medical record.

The Contractor must be registered in the System for Award

Management (SAM). Contractors should go to www.sam.gov to find their information. Contractors shall maintain a current and accurate record in the SAM system annually. Registration in no way guarantees that a contract will be awarded.

The Contractor must address all requirements and provide documentation required in Qualifications and Experience with their proposal.

F. BOP Information Technology Requirements:

1. APPLICABILITY

All information systems will be evaluated prior to acquisition and/or deployment to determine that each system supports the technical standards contained in this section. Approval to connect to the BOP's administrative network (BOPNet) will not be granted to any system that cannot support these standards unless a waiver has been granted by the CIO.

Additionally, all systems must acquire an Authority to Operate

(ATO) prior to use, and an Authority to Test (ATT) prior to system testing. Testing will not leverage live data (must use data created for the sole purpose of verifying functional capability and contain neither BOP nor BOP user information). A pilot, if needed, will also be performed without the use of live data. All the system environments, including development, test, quality assurance, integration, production, and any other environment related to the system, must reside within the authorization boundary.

2. OPERATING SYSTEMS, DATABASES, AND APPLICATIONS

2.1 OPERATING SYSTEMS AND DATABASES

All systems shall be developed to use BOP standard workstations, laptops, and servers with versions of operating systems and databases that are supported by the OS/database manufacturer/developer, and will continue to be supported by the manufacturer/developer for at least three years after the BOP system goes live. Any system that will rely on an operating system and/or database that is no longer supported, or will be approaching its end-of-life or the end of extended support date before the contract expires, is prohibited from being installed unless a waiver is granted by the CIO.

All devices must have Defense Information Systems Agency (DISA)

Security Technical Implementation Guide (STIG) Category I and

Category II settings applied. Workstations and laptops with

Windows operating systems must have DISA STIG settings applied for the versions of Windows currently in standard use in the

BOP. Servers, workstations, laptops, and other devices running non-Windows operating systems must be approved for use by the

CIO prior to acquisition and must be the latest supported versions by the vendor. If a DISA STIG exists for any non-

Windows operating system, the operating system must be configured in accordance with that DISA STIG.

2.2 APPLICATIONS

All systems on the BOP network shall be capable of using a BOP standard image for workstations. Systems shall be developed to minimize the installation of new applications directly onto workstations. Systems that require a client application be installed on workstations are strongly discouraged.

Web-based applications shall be installed on standard BOP servers running BOP-approved server operating systems and meet the following requirements:

i. Support TLS (non-deprecated version);

ii. Be browser-agnostic;

iii. Not require browser plug-ins, helper objects, specific

ActiveX controls, or Java dependencies on the client.

All applications must be able to operate with the latest version of any supporting applications or services required to run that application (i.e., Java, Apache, IIS, etc.).

3. AUDITING/LOGGING

All operating systems and/or applications must be capable of auditing events and maintaining logs with sufficient information to be able to account for the actions of individual users and record system events and processes.

4. IDENTIFICATION, AUTHENTICATION, AND AUTHORIZATION

To comply with Homeland Security Presidential Directive 12

(HSPD-12), all information systems must use a centralized directory for identification, authentication, and authorization to control, provision, and de-provision access to those systems.

To connect to the BOP network, all information systems must be capable of supporting Lightweight Directory Access Protocol

(LDAP v3 or successor).

Systems that cannot support either a BOP directory service or

DOJ federated service and require the management of a separate credential store for identification, authentication, and authorization are prohibited.

Each system user must be uniquely identified. Access to information is controlled using a “Least Privilege” role- or assignment-based methodology that provides the user with only the information and access required to perform his/her duties and nothing more. Systems must be capable of tiered-role privileges that distinguish between users and administrators and their authorized functions.

5. ENCRYPTION

5.1 DATA AT REST

All information systems that store data must have the capability to encrypt the drives on which the data is stored using FIPS

140-2 compliant encryption. If the system cannot support encryption of system drives, it must be approved for use by the

CIO prior to acquisition and use.

5.2 DATA IN MOTION

All information systems that transmit data over the BOP network must use protocols that encrypt data as it traverses the network. Information systems must support the most current version of secure protocols and encryption standards, and must be capable of being configured to prevent the use of non-secure protocols.

6. PUBLIC FACING WEBSITES

Any information system that hosts a publicly accessible website and web services must only provide service through a secure connection (HTTPS) and must use HTTP Strict Transport Security

(HSTS) to ensure this connection.

7. ENDPOINT SECURITY AND MANAGEMENT AND VULNERABILITY MANAGEMENT

All networked information systems shall be capable of being managed through an approved endpoint security and management application and be fully operational while being scanned for security vulnerabilities without disruption of service. All networked systems shall also be capable of being patched using a centrally managed patch management application.

Computer workstations, laptops, tablets, servers, and other computing devices using an operating system must employ anti-virus software protection. Anti-virus software and virus definition files must be updated with the most current versions and the anti-virus software must be configured to:

i. Begin protection when the devices are powered on;

ii. Scan daily;

iii. Check all files processed by the system in real time.

8. NETWORK STANDARDS AND PROTOCOLS

8.1 NETWORK STANDARDS AND APPROVED PROTOCOLS

Information systems must meet the following network standards to be deployed on the BOP network:

i. Supports IPv4/v6 Dual Stack and provides full and equal functionality when utilizing IPv6 as when using IPv4;

ii. Does not require or enable wireless of any type (Wi-Fi, Bluetooth, 3G/4G, etc.) unless an exception is granted by the CIO and is implemented per BOP and DOJ guidelines;

iii. All physical devices that make up the system must have a single network connection, only one IPv4 address, one

Globally Unique IPv6 address, and not be capable of routing;

iv. If internet accessible, can transmit traffic thru a proxy server to access the internet;

v. Does not require direct inbound connections from the public internet;

vi. Does not allow out-of-band access (no modems, etc.);

vii. Does not require media converters;

viii. Does not directly connect to other IP networks;

ix. Does not use IPv4 Multicast;

x. Cabling is IEEE Gigabit standard compliant;

xi. Power over Ethernet (POE) devices are IEEE 802.3af compliant;

xii. Cannot act (or is disabled from acting) as a DHCP server.

8.2 NON-SECURE PROTOCOLS

In accordance with current NIST standards, non-secure protocols must be disabled and not planned for use. The information system must have the capability of disabling any non-secure protocols including, but not limited to, the protocols listed below:

i. Telnet

ii. FTP

iii. SNMP v1/2

iv. HTTP

9. CLOUD SERVICES

Any system that will connect to or be hosted in a non-BOP cloud service must use cloud service providers (CSP) that have been independently evaluated by an authorized FedRAMP 3PAO and are

FedRAMP-certified, and the CSP has provided the most current

System Security Plan (SSP), Control Implementation Summary

(CIS), Customer Responsibility Matrix (CRM), Security Assessment

Report (SAR), and list of any open Plans of Actions and

Milestones (POAMs) to the BOP CISO for consideration, and has received an ATO from the BOP Authorizing Official (AO).

9.1 CLOUD APPLICATIONS – REQUIREMENTS FOR COTS AND CUSTOM

DEVELOPED

Contractors must develop or provide administration and user guides for applications, whether the application is custom developed for the BOP or is a Commercial Off the Shelf (COTS) product.

All applications must adhere to Section 508 accessibility standards.

9.2 CLOUD APPLICATIONS – CUSTOM DEVELOPED

The BOP owns any and all source code generated for applications custom developed for the BOP. The source code for any application custom developed for the BOP must be delivered to the BOP before the contract expires.

• Contractors shall use an Agile development strategy (or similar strategy) to enable rapid development with routine opportunities for stakeholders to review progress and provide feedback during the development process.

• Applications shall adhere to usability principles, plain language, and industry best practices.

• Applications shall interface with the BOP's IdP using

SAML2.0 or OAuth 2.0 to appropriately authenticate users and protect sensitive resources.

• Application data shall be made available via webservices that are built using REST APIs, with endpoints appropriately protected.

• Applications intended for deployment in the BOP’s cloud environment shall either be hosted in AWS GovCloud West or

AWS GovCloud East, depending on the FISMA classification of the information contained in the system.

• Contractors shall identify exact cloud services and resources (i.e., Lambda, RDS types, EC2 instance types, etc.) that will be required to build the system, and use the AWS cost estimation tool to provide a breakdown of the anticipated system cost.

• Contractors shall make necessary changes to the application, configuration, or cloud infrastructure/services script (i.e., IaC) if required by the BOP cloud team.

• Contractors shall create CloudFormation scripts that will be used to build the Virtual Private Clouds (VPC) and infrastructure needed, and make necessary changes as identified by the BOP cloud team.

Any exceptions to the above statements must be reviewed and approved by BOP IT Leadership, and under no circumstances will any deviation from these statements that adversely affects the security of the BOP IT environment or data be permitted.

10. MEDICAL SYSTEMS

Medical systems must comply with standards published by the

Office of the National Coordinator for Health Information

Technology (ONC) in regard to data access, storage, and reporting.

11. MOBILE APPLICATIONS

Mobile applications must be designed using HTML5 or operate natively on a version of the Android operating system currently being supported by industry with security patches.

12. PERIPHERAL REQUIREMENTS

12.1 LOCALLY ATTACHED PERIPHERALS

Peripherals that are locally attached to standard BOP workstations must:

i. Not be shared on the network;

ii. Not require software to operate that requires access to the internet or other network resources;

iii. Not require software to operate that requires older versions of software to operate such as Java;

iv. Not broadcast wireless signals (i.e., Bluetooth, WiFi, etc.);

v. Not require a change to the workstation local security policy to operate.

12.2 LOCALLY ATTACHED PRINTERS AND SCANNERS

Locally attached printers and scanners must have 64-bit drivers and cannot be shared to workstations other than the workstation to which it is directly connected.

12.3 NETWORKED-ATTACHED PERIPHERALS

Peripherals that must connect directly to the BOP network shall be part of a larger system or sub-system authorized to operate on that network. Each system or sub-system must provide controls to the peripherals attached to the network that comply with the system standards detailed above or provide mitigating controls for peripherals that cannot meet a system standard.

12.4 MULTI-FUNCTION DEVICES AND NETWORKED PRINTERS

All multi-function devices (MFD) and networked printers must be capable of being configured in accordance with the Multifunction

Device and Network Printers DISA STIG.

MFDs must be capable of supporting PIV authentication either directly or via a peripheral attachment/software but are not required to use PIV authentication at this time.

13. PRIVACY AND RECORDS MANAGEMENT

All systems must be evaluated prior to ATT or ATO for privacy and records management requirements. An Initial Privacy

Assessment (IPA) must be completed and if BOP Privacy and

Records Management Branch, and DOJ Office of Privacy and Civil

Liberties (OPCL) determines that the system collects, processes, stores or disseminates personally identifiable information

(PII), a Privacy Impact Assessment (PIA) must be done to evaluate the impact on the confidentiality, integrity, and availability of the data. If required, the Office of General

Counsel (OGC) will prepare a System of Records Notice (SORN) to be published in the federal register prior to system’s use. All systems must complete a Records and Information Management

Certification (RIMCert) evaluation regardless of PII status.

Contractor should be aware, for planning purposes, that the current BOP ATO process can take 6 to 18 months to complete.

The length of this time is dependent on the outcome of the IPA for the system.

14. SYSTEM INTERCONNECTIONS

DOJ requires that Components must identify all system interconnections, both external and internal to DOJ. A system interconnection is defined as the direct connection of two or more IT systems for the purpose of sharing data and other information resources. All interconnections from one information system to another system outside of the respective accreditation boundaries must have an approved Interconnection

Security Agreement (ISA), and optionally a Memorandum of

Understanding/Agreements (MOU/A). Both parties must mutually agree on terms and conditions and define expiration requirements or timelines. The agreements define how security will be maintained for the interconnection during its operation.

Information systems are only permitted to interconnect with systems that have undergone a system authorization and have a current Authorization to Operate (ATO). If the Authorizing

Official (AO) is the same for both interconnecting systems, an

ISA or MOU/A is not required.

15. PROJECT AND CONTRACT MANAGEMENT REQUIREMENTS

The contractor shall provide the planning, direction, coordination, and control necessary to accomplish all project phases. The contractor shall designate a Project Manager (key personnel) who is responsible for the cost, schedule, and technical performance of the contract and who will serve as the

Contracting Officer’s central point of contact with the government. The Project Manager is not required to be full-time.

Kick-Off Meeting

The contractor shall attend a kick-off meeting between BOP designated staff and the contractor team to discuss approach, policies, and procedure. The contractor shall provide a briefing on their technical approach for accomplishing results that meet the objectives of this task order to the Project Stakeholders.

Project Plan

The contractor shall provide a Project Plan that describes the technical approach, project personnel roles, organizational structure, available resources, and management controls to be employed to meet the cost (monthly planned cost and hours for the period of performance), performance, schedule and milestones, communications, and quality requirements throughout the contract execution. The contractor must periodically update this Project Plan if there are any major changes in the work and/or schedule as bilaterally agreed to by the contractor and

BOP. The contractor must deliver a draft Project Plan within five (5) days after the kick-off meeting. The final Project Plan shall be due within ten (10) days after BOP review and comments.

Project Schedule

Within the Project Plan, the contractor shall provide a Project

Schedule for all tasks assigned under this contract and in line with the agile development approach. The contractor Project

Manager shall ensure that the Project Schedule is developed and presented to the BOP Project Manager/Contracting Officer

Representative (COR) as part of the Project Plan. The Project

Schedule shall identify all tasks, resources, and schedule. The

Project Schedule shall become the schedule for the task and shall be maintained and updated weekly by the contractor for the duration of the contract/task to show progress completed, and must be based on a rolling wave approach to suit agile development. Tasks must have a short enough duration to update the project schedule on a weekly basis.

Progress Reports

The contractor shall provide written progress reports on a weekly and monthly basis for the duration of the project. These reports will be emailed to the COR. The Weekly Progress Report shall cover all work completed during the previous week and shall present the work to be accomplished during the subsequent week. The Weekly Progress Report shall be between one (1) and three (3) pages in length. The Monthly Progress Report shall be a summary of the prior 30 days’ work and the subsequent 30 days’ work to be accomplished. The Monthly Progress Report shall be no longer than ten (10) pages in length. These reports shall also identify any problems that arose and a statement explaining how the problem was resolved. These reports shall also identify any problems that have arisen but have not been completely resolved and provide an explanation. Additionally, status updates shall be provided during bi-weekly project status meetings.

Meetings/Meeting Minutes

The contractor shall provide administrative and technical support for meetings as required. The contractor shall coordinate scheduling and meeting notifications if required. The contractor shall prepare and provide briefing slides, handouts, agendas, meeting minutes, and other supplementary materials as required.

Contractor Information System Security Officer (ISSO)

The contractor is required to have one or more persons dedicated to assisting the BOP in meeting any necessary information security and security remediation requirements related to the system, for the duration of the contract.

Contractor Background Clearances

All contractors must comply with DOJ/BOP background clearance requirements before being permitted to do any work under a BOP contract. Contractors working remotely for the BOP will be issued contractor user accounts and PIV cards. Contractors will be required to use government furnished equipment (computers) to access the BOP network. To prevent loss of BOP data, all email communications between contractor personnel and BOP personnel must be conducted using the BOP’s email system. All virtual meetings between contractor personnel and BOP personnel must be conducted using the BOP’s collaboration/meeting system(s).

NOTE: All proposed IT Hardware, Software and Systems will require a full security and technical review in compliance with the Federal Information Technology Acquisition Reform Act

(FITARA).

The contractor must address all the foregoing BOP Information

Technology requirements in their proposal.

G. PROJECT MANAGER

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW.

The Project Manager shall be a single point of contact for the

Contracting Officer and the COR. It is anticipated that the

Project Manager shall be one of the senior level employees provided by the Contractor for this work effort.

The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the

Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak, and understand

English. Additionally, the Contractor shall not replace the

Project Manager without prior approval from the Contracting

Officer.

The Project Manager shall be available to the COR via telephone between the hours of 07:30 and 16:00 EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 2 hours of notification.

The contractor must address/acknowledge this section in their proposal.

H. SECURITY:

Contractor access to unclassified, but Security Sensitive

Information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

I. PERIOD OF PERFORMANCE:

The contract terms will be for a one-year base period with four one-year option periods as follows:

Base Period: 10/01/2023 through 09/30/2024

Option Period One: 10/01/2024 through 09/30/2025

Option Period Two: 10/01/2025 through 09/30/2026

Option Period Three: 10/01/2026 through 09/30/2027

Option Period Four: 10/01/2027 through 09/30/2028

J. TRAVEL:

Contractor travel may be required to support this requirement.

All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

K. POST AWARD CONFERENCE:

The Contractor shall attend a Post Award Conference with the

Contracting Officer and the COR no later than 15 business days after the date of award. The purpose of the Post Award

Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award

Conference will be held at the Government’s facility, located at

320 First Street, NW Washington DC 20534 or via teleconference.

L. IMPLEMENTATION PLAN:

The Contractor shall provide a draft Implementation Plan at the

Post Award Conference for Government review and comment. The

Contractor shall provide a final Implementation Plan to the COR not later than 15 business days after the Post Award Conference.

M. PROGRESS REPORTS:

The Project Manager shall provide a weekly progress report to the Contracting Officer and COR via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

N. PROGRESS MEETINGS:

The Project Manager shall be responsible for keeping the COR informed about Contractor progress throughout the performance period of this contract, and ensure Contractor activities are aligned with BOP objectives. At a minimum, the Project Manager shall review the status and results of Contractor performance with the COR on a monthly basis via electronic mail.

O. PROTECTION OF INFORMATION:

Contractor access to information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

P. SECTION 508 COMPLIANCE:

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29

U.S.C. 794d) as amended by P.L. 105-220 under Title IV

(Rehabilitation Act Amendments of 1998) all Electronic and

Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the

“Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers

Compliance Board (also referred to as the “Access Board”) in 36

CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

Q. PAST PERFORMANCE

The contractor must provide a minimum of 3 past performance references. The references must include a valid point of contact and telephone number and email address for that individual.

R. INVOICES

The contractor that obtains the award shall mail all invoices to the address below.

Federal Bureau of Prisons

Central Office Business Office

320 First Street, NW

Suite 901-4

Washington, D.C. 20534

CO-BusinessOffice-S@bop.gov http://www.access-board.gov/ http://www.section508.gov/ mailto:CO-BusinessOffice-S@bop.gov