OPM Specific Clauses.docx

OPM Specific Clauses:

1752.205-70 Announcement of Contract Award (July 2006) OPM complies with FAR 5.3, Synopses of Contract Awards, in terms of synopsizing and publicly announcing contract awards. These actions take place at the time of, and not before, the contract is awarded. Contract award, in this case, means signature of the contractual document by the Contracting Officer and forwarding of the contractual document to the contract awardee. If the contract awardee wishes to make a separate public announcement, the awardee must obtain the approval of the Contracting Officer prior to releasing the announcement, and must plan to make announcement only after the contract has been awarded.

(b) The Contractor agrees that if an actual or potential OCI is discovered after award, the Contractor shall make a full disclosure in writing to the Contracting Officer. This disclosure must include a description of actions, which the Contractor has taken or proposes to take, after consultation with the Contracting Officer, to avoid, mitigate, or neutralize the actual or potential conflict.

(c) The Contracting Officer may terminate this contract for convenience, in whole or in part, if it deems such termination necessary to avoid an OCI. If the Contractor was aware of a potential OCI prior to award or discovered an actual or potential conflict after award and did not disclose or misrepresented relevant information to the Contacting Office, the Government may terminate the contract for default, debar the Contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(a) If this contract contains FAR Clause 52.222-35 (Equal Opportunity for Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans), your company must comply with the requirements of this clause, including the listing of employment opportunities with the local office of the state employment service system.

(b) If this contract contains FAR clauses 52.222-37 (Employment Reports on Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans) or 52.222-38 (Compliance with Veterans’ Employment Reporting Requirements), you are reminded that your company must comply with the special reporting requirements described in those clauses. Your company must submit information on several aspects of its employment and hiring of special disabled and Vietnam era veterans or other veterans who served on active duty during a war or in a campaign or expedition for which a campaign badge has been authorized. You must submit this information no later than September 30 of each year, in the “Federal Contractor Veterans’ Employment Report” or VETS-4212 Report. The U.S. Department of Labor has established a web site for submitting this report. The address is:.

1752.224-70 Definition of Terms (Dec 2015)

The following definitions apply to this contract:

a. Information: This term is synonymous with the term Data. Both terms refer to single or multiple instances of any recorded or communicated fact or opinion being stored or transferred in any digital or analog format or medium.

b. Controlled Unclassified Information (CUI): This term refers to that sub-category of Information where the loss, misuse, or unauthorized access or modification could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 USC Section 552a (the Privacy Act) that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

c. Personally Identifiable Information (PII): This term refers to that sub-category of CUI that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

d. Information System: This term refers to a system composed of people and equipment that processes or interprets Information.

e. Information Technology (IT) System: This term refers to that sub-category of Information System composed of hardware, software, data, and networks that processes or interprets Information.

f. Information Security Incident (ISI): This term refers to any event that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government Information or Information Systems.

g. Record:

(1) For the purpose of Records Management, this term refers to all recorded Information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transactions of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the US Government or because of the informational value of the data in them.

(2) For the purpose of the Privacy Act, this term refers to any item, collection, or grouping of Information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, or criminal or employment history, and that contains the person's name, or the identifying number, symbol, or other identifier assigned to the individual, such as a fingerprint, voiceprint, or a photograph.

h. System of Records on individuals: This term refers to a group of any Records from which Information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier assigned to the individual.

i. Operation of a System of Records: This term refers to the performance of any of the activities associated with maintaining the System of Records, including the collection, use, and dissemination of Records.

j. Privileged User: This term refers to a user that is assigned an organization-defined privileged role that allows that individual to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, but are not limited to, IT system development, key management, account management, network and system administration, database administration, and web administration.

(a) Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 19 U.S.C. 641. That section provides, in pertinent part, that whoever knowingly converts to their use or the use of another, or without authority, sells, conveys, or disposes of any record of the United States or whoever receives the same with intent to convert it to their use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine of up to $10,000, or imprisoned up to ten years, or both.

1752.224-73 Protecting Information (Dec 2023)

The contractor must ensure its policies and procedures address compliance with all information protection requirements of this contract. The policies and procedures must address the following:

(a) Proper identification, marking, control, storage, transmission, use, and handling of Controlled Unclassified Information (CUI), regardless of medium.

(b) Proper control, storage, and protection of mobile devices, portable data storage devices, and communication devices containing CUI.

(c) Proper use of FIP-140-3. 3,4 compliant encryption, redaction, and masking methods to protect CUI while at rest and in transit throughout Contractor networks, and on server and client platforms.

(d) Proper use of FIP-140-3. 3,4 compliant encryption methods to protect CUI transmitted in email attachments, including policy that passwords must not be communicated in the same email as the attachment.

(e) Roles, responsibilities, and proper actions to be taken during Information Security Incidents (ISIs).

(f) Proper procedures for obtaining authorized access to information technology (IT) systems.

(g) General IT security and protection training for all employees.

(h) Specialized IT security and protection training for IT security staff.

Information Systems policy compliance requirements and procedures 1752.224-77 Information Security Incidents (ISI) (Dec 2015)

a. ISI Reporting Activities

(1) Contractors must report any and all ISI involving OPM Information to the OPM Security Monitoring Center (SMC) at CyberSolutions@opm.gov, 844-377-6109. The SMC is available 24 hours per day, 365 days per year.

(2) Contractors must report any and all ISI involving information technology (IT) systems and Controlled Unclassified Information (CUI) immediately upon becoming aware of the ISI but no later than 30 minutes after becoming aware of the ISI, regardless of day or time; regardless of internal investigation, evaluation, or confirmation of procedures or activities; and regardless of whether the ISI is suspected, known, or determined to involve IT systems operated in support of this contract.

(3) Contractors reporting an ISI to the SMC by email or phone must copy the Contracting Officer (CO) or Contracting Officer’s Representative (COR) if possible; but if not, must notify the CO or COR immediately after reporting to the SMC.

(4) When reporting an ISI to the SMC by email:

(a) Do not include any CUI in the subject or body of any email;

(b) Use FIPS 140-2 compliant encryption methods to protect CUI to be included as an email attachment, and do not include passwords in the same email as the encrypted attachment; and

(c) Provide any supplementary information or reports related to a previously reported incident directly to the OPM SMC with the following text in the subject line of the email: “Supplementary Information / Report related to previously reported incident # [insert number].”

b. ISI Review and Response Activities

(1) The Contractor must provide full access and cooperation for all activities determined by CO or COR to be required to ensure an effective review and response to protect OPM’s Information and Information Systems operated in support of this contract.

(2) The Contractor must promptly respond to all requests by the CO or COR for ISI and system-related information, including but not limited to disk images, log files, event information, and any other information determined by OPM to be required for a rapid but comprehensive technical and forensic review.

(3) OPM, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in ISI Review and Response activities.

c. ISI Determination Activities

(1) The Contractor must not make any determinations related to an ISI associated with Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract, including determinations related to notification of affected individuals and/or Federal agencies (except reporting criminal activity to Law Enforcement Organizations) and offering of services, such as credit monitoring.

(2) The Contractor must not conduct any internal ISI-related review or response activities that could modify or eliminate any existing technical configuration or information or forensic technical evidence existing at the time of the ISI without approval from the OPM Chief Information Officer (CIO) through the CO or COR.

(3) All determinations related to an ISI associated with Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract will be made only by the OPM CIO through the CO or COR.

(4) The Contractor must report criminal activity to Law Enforcement Organizations upon becoming aware of such activity.

1752.224-78 Information Security Inspections (Dec 2015)

a. The Contractor must permit and cooperate with any mutually agreed upon pre-scheduled onsite or offsite information security inspections, such as:

b. OPM will provide the Contractor with a Post-Inspection Report, which will state findings and specify the Contractor’s requirement for remediating findings to maintain compliance with this contract.

c. The Contractor must provide a formal response to the OPM Post-Inspection Report within fifteen (15) days of receipt of the report for critical/high risk findings and within thirty (30 days for all other findings.

1752.224-79 Suspension of Contract for Security Concerns (Dec 2015)

If at any time during Contract performance it is determined that the Contractor is not in full compliance with the security requirements of this Contract, the Government may immediately suspend performance under this Contract and require the immediate return of all Controlled Unclassified Information (CUI) materials and information to the Government at full Contractor expense. Any work suspension resulting from a security lapse will not be subject to equitable adjustment; all costs incurred will be borne by the Contractor.

a) The Office of Personnel Management (OPM) will only accept electronic invoices submitted through the Delphi eInvoicing system.

b) Payment system registration. All persons accessing the Delphi eInvoicing web portal shall have a unique user Delphi eInvoicing ID and be authenticated through login.gov.

1. Vendors must provide opmisupplieraccess@opm.gov the full name, valid email address, and current phone number of users who require access to the Delphi eInvoicing web portal for invoice submission and payment tracking purposes. Each email address must be unique for each user.

2. To make changes to vendor users who will have access to the Delphi eInvoicing webportal, the vendor must notify opmisupplieraccess@opm.gov and include the full name, valid email address, and current phone number of any new vendor users.

3. Vendors are responsible to contact the Delphi Help Desk when their firm's points of contacts will no longer be submitting invoices so they can be removed from the system. Instructions for contacting the Delphi Help Desk can be found at http://einvoice.esc.gov.

4. Designated vendor users will be notified via e-mail when the account is created. The vendor user will be provided detailed instructions for logging into their Delphi eInvoicing account.

5. Electronic authentication. Click on the following link to create a login.gov account: https://login.gov.

6. To create a login.gov account, the user will need a valid email address and a working phone number. The user will create a password and establish a secondary authentication method to keep their account secure.

c) Training on Delphi. To facilitate use of DELPHI, comprehensive user information is available at http://einvoice.esc.gov.

d) The Delphi eInvoicing system is managed by the Enterprise Services Center (ESC). In order to receive payment and in accordance with the Prompt Payment Act, all invoices and required supporting documentation must be attached in the Delphi eInvoicing web-portal and must contain the information specified in the appropriate clause in the vendor's contract, for example, FAR 52.212-4 or 52.232-25.

e) If the contract includes allowances for travel on a reimbursable basis, all invoices for charges pertaining to travel expenses must catalog a breakdown of reimbursable expenses with the appropriate receipts to substantiate the travel expenses.

1752.233-70 OPM Protest Procedures [Applicable to Solicitations Only] (July 2023)

(a) An interested party who files a protest with OPM has the option of requesting review and consideration of the protest by either the Contracting Officer (CO) or the Senior Procurement Executive (SPE). The protest must clearly indicate the official to whom it is directed.

(b) If the protest is directed to the SPE, a copy of the protest must be sent to the Head of the Contracting Activity at the same time the protest is filed with the CO in accordance with FAR 52.233-2. The address of the Head of the Contracting Activity is:

Head of the Contracting Activity, Office of Procurement Operations U.S. Office of Personnel Management 1900 E Street N.W., Room 1342 Washington, DC 20415

(c) Review and consideration of a protest by the SPE is an alternative to review and consideration by the CO.

a. Within thirty (30) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, unless otherwise instructed by the Contracting Officer, the Contractor must return all original OPM-provided and OPM-Activity-Related Information, such as records, files, and metadata in electronic or hardcopy format, including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract with OPM;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

(4) received from the Contractor by any other related organization and/or any other component or separate business entity.

b. Within forty-five (45) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, unless otherwise instructed by the Contracting Officer, the Contractor must provide the Contracting Officer and COR with an associated Certification of Verified Return of all original OPM and OPM-Activity-Related Information, such as records, files, and metadata in electronic or hardcopy format, including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract with OPM;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

(4) received from the Contractor by any other related organization and/or any other component or separate business entity.

1752.242-72 Secure Destruction of All OPM and OPM-Activity-Related Information (Dec 2015)

a. Within sixty (60) days after the end of the contract performance period or after the contract is suspended or terminated by the Contracting Officer, BUT ONLY after the Contracting Officer (CO) or Contracting Officer’s Representative (COR) has accepted and approved the Contractor’s compliance with the Certification of Verified Return, the Contractor must execute secure destruction of all copies of all OPM and OPM-activity-related files and information (including but not limited to all records, files, and metadata in electronic or hardcopy format) not returned to OPM and held in possession by the Contractor, by procedures approved by the CO or COR in advance and in accordance with applicable OPM IT Security Policy Requirements, including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

(4) received from the Contractor by any other related organization and/or any other component or separate business entity.

b. Within seventy-five (75) days after the end of the contract performance period or after the contract is suspended or terminated by the CO, BUT ONLY after the CO or COR has accepted and approved the Contractor’s compliance with the Certification of Verified Return, the Contractor must provide the CO or COR with Certification of Secure Destruction of all existing active and archived originals and/or copies of all OPM and OPM-activity-related files and information, (including but not limited to all records, files, and metadata in electronic or hardcopy format); by procedures approved by OPM in advance and in accordance with applicable OPM IT Security Policy Requirements; including but not limited to the following:

(1) provided by OPM;

(2) obtained by the Contractor while conducting activities in accordance with the contract;

(3) distributed for any purpose by the Contractor to any other related organization and/or any other component or separate business entity; or

(4) received from the Contractor by any other related organization and/or any other component or separate business entity.

(b) Contractor Testimony All requests for the testimony of the Contractor or its employees, and any intention to testify as an expert witness relating to: (a) any work required by, and or performed under, this contract: or (b) any information provided by any party to assist the Contractor in the performance of this contract, must be immediately reported to the Contracting Officer. Neither the Contractor nor its employees must testify on a matter related to work performed or information provided under this contract, either voluntarily or pursuant to a request, in any judicial or administrative proceeding unless approved by the Contracting Officer or required by a judge in a final court order.

Deliverables associated with each OPM IT contract clause are identified in the table below.

Solicitation No: 24322624Q0025 Page 1 of 2