RFP_OPM32-17-R-0003_Amendment_1.pdf

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 1 of 26

United States Office of Personnel Management

Office of Procurement Operations

Request for Proposal (RFP) for Microsoft Enterprise License Agreement

RFP Number: OPM32-17-R-0003 Amendment 1

Date: June 28, 2017

U.S. Office of Personnel Management Office of Procurement Operations (OPO)

600 Arch Street, Room 3400 Philadelphia, PA 19106

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 1 of 26

TABLE OF CONTENTS

1.0 INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS 2

1.1 Purpose 2

1.2 Background 2

1.3 Method of Acquisition 2

1.4 Date of Award 2

1.5 Period of Performance 2

1.6 Commitment of Public Funds 3

1.7 Communications Prior to Award 3

1.8 Required Offer Contents 3

1.9 Preparation Costs 3

1.10 Offer Due Date 3

1.11 Contract Terms and Conditions 3

2.0 CONTRACT CLAUSES 4

3.0 CONTRACT DOCUMENTS, EXHIBITS OR ATTACHMENTS 23

4.0 SOLICITATION PROVISIONS 23

4.1 FAR Clause 52.212-1 – Instructions to Offerors Commercial Items (Jan 2017) 23

4.2 Addenda to FAR 52.212-1 Instructions to Offerors – Commercial Items 23

4.3 FAR 52.212-2 Evaluation – Commercial Items (Oct 2014) 24

4.4 FAR 52.212-3 Offeror Representations and Certifications – Commercial Items (Jan 2017) 25

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 2 of 26

OFFICE OF PERSONNEL MANAGEMENT

RFP OPM32-17-R-0003

Microsoft Enterprise License Agreement

1.0 INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

1.1 Purpose

This Request for Proposal (RFP) outlines a procurement action for the acquisition of a Microsoft Enterprise License Agreement. This acquisition is being conducted in accordance with FAR Part 12 – Acquisition of Commercial Items in conjunction with the policies and procedures for solicitation, evaluation and award prescribed in Part 19.8 – Contracting with the Small business Administration (The 8(a) Program) and in FAR Part 15 – Contracting by Negotiation, as appropriate for this acquisition. This is a 100% set aside for the 8(a) program.

1.2 Background

The Chief Information Officer /Operations Technology Management/Network Management (OCIO/EIS/NM) provides support to the Office of Personnel Management (OPM) by managing and operating OPM's IT infrastructure including personal computers/workstations, local and wide area networks and data communications, and designing, developing, and maintaining application systems in support of program offices and e-Government projects.

OCIO/EIS/NM utilizes a large number of Microsoft brand software applications that support agency infrastructure management and provide a common operating environment for all end users. This includes Microsoft Office Enterprise and all software operating systems for new servers, desktops, and laptops.

OCIO/EIS/NM seeks to procure a new Microsoft Enterprise License Agreement for support known as Microsoft Software Assurance for the Microsoft products outlined in the attached Bill of Materials (BOM) (Attachment 1). The performance period for the current Microsoft ELA ends July 31, 2017. (updated Amendment 1)

1.3 Method of Acquisition

The U.S. Office of Personnel Management, Office of Procurement Operations (OPM/OPO) anticipates award of a firm-fixed contract for a base period of one year plus two, one year option periods on the basis of competition limited to eligible 8(a) participants.

The North American Industry Classification System (NAICS) category, NAICS Code 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing will be used to determine the size standard and 8(a) certification.

1.4 Date of Award

It is anticipated that an award will be made on or before July 21, 2017.

1.5 Period of Performance (updated Amendment 1)

BASE: August 01, 2017 to July 31, 2018 Option Period 1: August 01, 2018 to July 31, 2019

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 3 of 26

Option Period 2: August 01, 2019 to July 31, 2020

1.6 Commitment of Public Funds

The Contracting Officer is the only individual who can legally commit the Government to the expenditure of public funds in connection with the proposed acquisition. Any other commitment, either explicit or implied, is invalid.

1.7 Communications Prior to Award

All communications shall be directed, via email, to the attention of:

Name: Lucy Tascone Title: Contract Specialist Email: Lucy.Tascone@opm.gov

All questions must be submitted to the individual identified above via e-mail no later than 5:00 p.m.

Eastern Daylight Time (EDT) on June 30, 2017. Responses to questions will be provided on fbo.gov.

Communications with officials other than the OPM Contract Specialist may compromise the competitiveness of this acquisition; may result in the cancellation of the solicitation and/or exclusion of your quotation from this competitive procurement action.

1.8 Required Proposal Contents

a) The Offerer must specify the firm-fixed unit and extended price for each item listed on the BOM (Attachment 1). Contractor’s price shall be inclusive of all the contractor’s direct costs, indirect costs and profit and shall include all costs associated with providing the products or services described in the BOM.

b) Documentation of authorization to sell Microsoft Software and support products.

1.9 Preparation Costs

This RFP does not commit the Government to pay for the preparation and/or submission of a quotation.

1.10 Offer Due Date

The proposal is due by 12:00 pm EDT on July 12, 2017 and should be electronically submitted to the attention of Lucy Tascone at Lucy.Tascone@opm.gov.

1.11 Contract Terms and Conditions

Any contract awarded as a result of this RFP shall be subject to the terms and conditions of this RFP including the FAR and OPM-Specific Clauses which will be incorporated into and made a part of any resulting award.

The Government shall not be responsible for compensating the contractor for any costs tied to solicitation requirements but not factored into the proposed prices, either by the Contractor’s intention or by mistake.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 4 of 26

The terms and conditions presented within the solicitation and ultimate award apply to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).

2.0 CONTRACT CLAUSES

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: https://www.acquisition.gov/

Clause Title Date 52.204-7 System for Award Management Maintenance Oct 2016 52.212-4 Contract Terms and Conditions – Commercial Items Jan 2017

52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Jun 2016)

(a) Definitions. As used in this clause– “Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

“Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

“Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C.

3502).

“Safeguarding” means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures.

(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 5 of 26

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—

Commercial Items (Jan 2017) applies to this acquisition. The selected FAR clauses cited in 52.212-5 are:

_X_(16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3))..

_X_ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

_X_ (22) 52.219-28, Post Award Small Business Program Representation (Jul 2013) (15 U.S.C.

632(a)(2)).

_X_ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

_X_ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Oct 2016) (E.O. 13126).

_X_ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

_X_ (28) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

_X_ (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015)(38 U.S.C. 4212).

_X_ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

_X_ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec

2010) (E.O. 13496).

_X_ (33) (i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O.

13627).

_X_ (36) 52.222-60, Paycheck Transparency (Executive Order 13673) (OCT 2016).

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 6 of 26

_X_ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (AUG 2011) (E.O. 13513).

_X_ (51) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

_X_(57) 52.232-33, Payment by Electronic Funds Transfer—System for Award Management (Jul 2013) (31 U.S.C. 3332).

52.217-8 Option to Extend Services (November 1999) The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor at least 15 days before the end of the period of performance.

52.217-9 Option to Extend the Term of the Contract. (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 3 years.

52.219-17 Section 8(a) Award (Jan 2017)

(a) By execution of a contract, the Small Business Administration (SBA) agrees to the following:

(1) To furnish the supplies or services set forth in the contract according to the specifications and the terms and conditions by subcontracting with the Offeror who has been determined an eligible concern pursuant to the provisions of section 8(a) of the Small Business Act, as amended (15 U.S.C. 637(a)).

(2) Except for novation agreements, delegates to the Office of Personnel Management the responsibility for administering the contract with complete authority to take any action on behalf of the Government under the terms and conditions of the contract; provided, however that the contracting agency shall give advance notice to the SBA before it issues a final notice terminating the right of the subcontractor to proceed with further performance, either in whole or in part, under the contract.

(3) That payments to be made under the contract will be made directly to the subcontractor by the contracting activity.

(4) To notify the Office of Personnel Mangement, Contracting Officer immediately upon notification by the subcontractor that the owner or owners upon whom 8(a) eligibility was based plan to relinquish ownership or control of the concern.

(5) That the subcontractor awarded a subcontract hereunder shall have the right of appeal from decisions of the cognizant Contracting Officer under the “Disputes” clause of the subcontract.

(b) The offeror/subcontractor agrees and acknowledges that it will, for and on behalf of the SBA, fulfill and perform all of the requirements of the contract.

(c) The offeror/subcontractor agrees that it will not subcontract the performance of any of the requirements of this subcontract to any lower tier subcontractor without the prior written approval of the SBA and the cognizant Contracting Officer of the Office of Personnel Management.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 7 of 26

(End of clause)

52.219-18 Notification of Competition Limited to Eligible 8(a) Participants (Jan 2017) NOTE: Clause has fill-in lines

(a) Offers are solicited only from small business concerns expressly certified by the Small Business Administration (SBA) for participation in the SBA’s 8(a) Program and which meet the following criteria at the time of submission of offer—

(1) The Offeror is in conformance with the 8(a) support limitation set forth in its approved business plan; and

(2) The Offeror is in conformance with the Business Activity Targets set forth in its approved business plan or any remedial action directed by the SBA.

(b) By submission of its offer, the Offeror represents that it meets all of the criteria set forth in paragraph (a) of this clause.

(c) Any award resulting from this solicitation will be made to the Small Business Administration, which will subcontract performance to the successful 8(a) offeror selected through the evaluation criteria set forth in this solicitation.

(d)(1) Agreement. A small business concern submitting an offer in its own name shall furnish, in performing the contract, only end items manufactured or produced by small business concerns in the United States or its outlying areas. If this procurement is processed under simplified acquisition procedures and the total amount of this contract does not exceed $25,000, a small business concern may furnish the product of any domestic firm. This paragraph does not apply to construction or service contracts.

(2) The ___TBD_______ [insert name of SBA's contractor] will notify the Office of Personnel Contracting Officer in writing immediately upon entering an agreement (either oral or written) to transfer all or part of its stock or other ownership interest to any other party.

(End of clause)

OPM-SPECIFIC CLAUSES

1752.205-70 Announcement of Contract Award (July 2006)

OPM complies with FAR 5.3, Synopses of Contract Awards, in terms of synopsizing and publicly announcing contract awards. These actions take place at the time of, and not before, the contract is awarded. Contract award, in this case, means signature of the contractual document by the Contracting Officer and forwarding of the contractual document to the contract awardee. If the contract awardee wishes to make a separate public announcement, the awardee must obtain the approval of the Contracting Officer prior to releasing the announcement, and must plan to make announcement only after the contract has been awarded.

1752.209-74 Organizational Conflicts of Interest (July 2005)

(a) The Contractor warrants that, to the best of the Contractor’s knowledge and belief, there are no relevant facts or circumstances which could give rise to an organizational conflict of interest (OCI), as defined in FAR 9.5, Organizational and Consultants Conflicts of Interest, or that the Contractor has disclosed all such relevant information.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 8 of 26

(b) The Contractor agrees that if an actual or potential OCI is discovered after award, the Contractor shall make a full disclosure in writing to the Contracting Officer. This disclosure must include a description of actions, which the Contractor has taken or proposes to take, after consultation with the Contracting Officer, to avoid, mitigate, or neutralize the actual or potential conflict.

(c) The Contracting Officer may terminate this contract for convenience, in whole or in part, if it deems such termination necessary to avoid an OCI. If the Contractor was aware of a potential OCI prior to award or discovered an actual or potential conflict after award and did not disclose or misrepresented relevant information to the Contacting Office, the Government may terminate the contract for default, debar the Contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(d) The Contractor must include this clause in all subcontracts and in lower tier subcontracts unless a waiver is requested from, and granted by, the Contracting Officer.

(e) In the event that a requirement changes in such a way as to create a potential conflict of interest for the Contractor, the Contractor must:

(1) Notify the Contracting Officer of a potential conflict, and;

(2) Recommend to the Government an alternate approach which would avoid the potential conflict, or

(3) Present for approval a conflict of interest mitigation plan that will:

(i) Describe in detail the changed requirement that creates the potential conflict of interest; and

(ii) Outline in detail the actions to be taken by the Contractor or the Government in the performance of the task to mitigate the conflict, division of subcontractor effort, and limited access to information, or other acceptable means.

(4) The Contractor must not commence work on a changed requirement related to a potential conflict of interest until specifically notified by the Contracting Officer to proceed.

(5) If the Contracting Officer determines that it is in the best interest of the Government to proceed with work, notwithstanding a conflict of interest, a request for waiver must be submitted in accordance with FAR 9.503.

1752.209-75 Reducing Text Messaging While Driving (Oct 2009)

(a) In accordance with Section 4 of the Executive Order, “Federal Leadership on Reducing Text Messaging While Driving,” dated October 1, 2009, you are hereby encouraged to:

(1) Adopt and enforce policies that ban text messaging while driving company-owned or -rented vehicles or Government-owned, -leased or –rented vehicles, or while driving privately-owned vehicles when on official Government business or when performing any work for or on behalf of the Government; and

(2) Consider new company rules and programs, and reevaluating existing programs to prohibit text messaging while driving, and conducting education, awareness, and other outreach for company employees about the safety risks associated with texting while driving. These initiatives should encourage voluntary compliance with the company’s text messaging policy while off duty.

(b) For purposes of complying with the Executive Order:

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 9 of 26

(1) "Texting" or "Text Messaging" means reading from or entering data into any handheld or other electronic device, including for the purpose of SMS texting, e-mailing, instant messaging, obtaining navigational information, or engaging in any other form of electronic data retrieval or electronic data communication.

(2) "Driving" means operating a motor vehicle on an active roadway with the motor running, including while temporarily stationary because of traffic, a traffic light or stop sign, or otherwise.

It does not include operating a motor vehicle with or without the motor running when one has pulled over to the side of, or off, an active roadway and has halted in a location where one can safely remain stationary.

1752.219-71 Requirements of Partnership Agreement between SBA and OPM (Feb 2013) Solicitations and contracts/BPAs/ orders/calls with 8(a) firms subject to the Partnership Agreement with SBA NOTE: Clause has fill-in lines

This contract is subject to the terms and conditions of the current Partnership Agreement (PA) between the U.S. Small Business Administration (SBA) and OPM, signed on November 26, 2012. You may request a copy of the PA from the Contracting Officer or from the Director of OPM’s Office of Small and Disadvantaged Business Utilization at Small.Business@opm.gov. In accordance with the PA, you are hereby notified that:

(a) Even though SBA may not be identified in section A of the contract, it is still the prime contractor on the contract;

(b) You must obtain SBA’s approval of any novation agreements that you submit;

(c) OPM must provide advance notice to SBA (as the prime contractor) prior to issuance of a final notice terminating the contract in whole or in part; and

(d) Your SBA district office is:

____________________District Office

[Street Address]__________________ [City, State, Zip Code]______________

Phone:__________________________ E-mail: __________________________

1752.222-70 Notice of Requirement for Certification of Nonsegregated Facilities (July 2005)

By signing this offer or contract, the contractor will be deemed to have signed and agreed to the provisions of Federal Acquisition Regulations (FAR) Clause 52.222-21, Certification of Nonsegregated Facilities, incorporated by reference in this solicitation/contract. The certification provides that the bidder or offeror does not maintain or provide for its employees, facilities which are segregated on a basis of race, color, religion, or national origin, whether such facilities are segregated by directive or on a de facto basis. The certification also provides that the bidder/offeror does not and will not permit its employees to perform their services at any location under its control where segregated facilities are maintained. FAR Clause 52.222-21 must be included in all subcontracts as well.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 10 of 26

1752.222-71 Special Requirements for Employing Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans (July 2005)

(a) If this contract contains FAR Clause 52.222-35 (Equal Opportunity for Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans), your company must comply with the requirements of this clause, including the listing of employment opportunities with the local office of the state employment service system.

(b) If this contract contains FAR clauses 52.222-37 (Employment Reports on Special Disabled Veterans, Veterans of the Vietnam Era, and Other Eligible Veterans) or 52.222-38 (Compliance with Veterans’ Employment Reporting Requirements), you are reminded that your company must comply with the special reporting requirements described in those clauses. Your company must submit information on several aspects of its employment and hiring of special disabled and Vietnam era veterans or other veterans who served on active duty during a war or in a campaign or expedition for which a campaign badge has been authorized. You must submit this information no later than September 30 of each year, in the “Federal Contractor Veterans’ Employment Report” or VETS-100 Report. The U.S. Department of Labor has established a web site for submitting this report. The address is:

http://www.vets100.cudenver.edu.

1752.223-71 Environmentally Preferable Products and Services (January 2017)

(a) Executive Order 13693, Planning for Federal Sustainability in the Next Decade, requires in agency acquisitions of goods and services (i) use of sustainable environmental practices, including acquisition of biobased, environmentally preferable, energy-efficient, water-efficient, and recycled-content products, and (ii) use of paper of at least 30 percent post-consumer fiber content.

(a) By signing this offer or contract, the contractor will be deemed to have signed and agreed that all goods and services provided under this contract will comply with the above requirements of Executive Order 13693.

1752.224-70 Definition of Terms (Dec 2015)

The following definitions apply to this contract:

a. Information: This term is synonymous with the term Data. Both terms refer to single or multiple instances of any recorded or communicated fact or opinion being stored or transferred in any digital or analog format or medium.

b. Controlled Unclassified Information (CUI): This term refers to that sub-category of Information where the loss, misuse, or unauthorized access or modification could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 USC Section 552a (the Privacy Act) that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

c. Personally Identifiable Information (PII): This term refers to that sub-category of CUI that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

d. Information System: This term refers to a system composed of people and equipment that processes or interprets Information.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 11 of 26

e. Information Technology (IT) System: This term refers to that sub-category of Information System composed of hardware, software, data, and networks that processes or interprets Information.

f. Information Security Incident (ISI): This term refers to any event that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government Information or Information Systems.

g. Record:

(1) For the purpose of Records Management, this term refers to all recorded Information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transactions of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the US Government or because of the informational value of the data in them.

(2) For the purpose of the Privacy Act, this term refers to any item, collection, or grouping of

Information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, or criminal or employment history, and that contains the person's name, or the identifying number, symbol, or other identifier assigned to the individual, such as a fingerprint, voiceprint, or a photograph.

h. System of Records on individuals: This term refers to a group of any Records from which Information is retrieved by the name of the individual or by some identifying number, symbol, or other identifier assigned to the individual.

i. Operation of a System of Records: This term refers to the performance of any of the activities associated with maintaining the System of Records, including the collection, use, and dissemination of Records.

j. Privileged User: This term refers to a user that is assigned an organization-defined privileged role that allows that individual to perform certain security-relevant functions that ordinary users are not authorized to perform. These privileged roles include, but are not limited to, IT system development, key management, account management, network and system administration, database administration, and web administration.

(End of Clause)

1752.224-71 Freedom of Information Act Requests (Sep 2009)

(a) Offerors are reminded that information furnished under this solicitation may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore:

(1) All items that are confidential to business, or contain trade secrets, proprietary, or personnel information must be clearly marked in all documents submitted to the U.S. Office of Personnel Management (OPM or The Government). Marking of items will not necessarily preclude disclosure when the OPM determines disclosure is warranted by FOIA. However, if such items are not marked, all information contained within the submitted documents will be deemed to be releasable.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 12 of 26

(2) No later than five (5) business days after award of a contract, blanket purchase agreement (BPA), or order, the Contractor must provide OPM a redacted copy of the contract/BPA/order in electronic format. This copy will be used to satisfy any requests for copies of the contract/BPA/order under the FOIA. If the Contracting Officer believes that any redacted information does not require protection from public release, the issue will be resolved in accordance with paragraph 3.104-4(d) of the Federal Acquisition Regulation.

(b) Any information made available to the Contractor by the Government must be used only for the purpose of carrying out the provisions of this contract and must not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

(c) In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor's responsible employees.

(d) Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for a purpose and to the extent authorized herein, and that further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 19 U.S.C. 641.

That section provides, in pertinent part, that whoever knowingly converts to their use or the use of another, or without authority, sells, conveys, or disposes of any record of the United States or whoever receives the same with intent to convert it to their use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine of up to $10,000, or imprisoned up to ten years, or both.

1752.224-73 Protecting Information (Dec 2015)

a. Applicability

(1) This clause applies to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).

(2) These requirements are applicable to all Information, regardless of medium, maintained by the Contractor for the performance of this contract.

(3) These requirements are in addition to all applicable requirements established by the Privacy Act of 1974 (5 U.S.C. 552a); and to all other requirements established by various Federal statutes, mandates, and Executive Orders for the management and security of Information and Information Systems. The following additional requirements should not be construed to alter or diminish civil and/or criminal liabilities provided under the Privacy Act or any other applicable Federal statutes.

b. Authorization to Handle Controlled Unclassified Information (CUI)

(1) Prior to receiving, collecting, transmitting, storing, using, accessing, sharing, or removing CUI from any approved locations; the Contractor must receive approval in writing from the Chief Information Officer (CIO) through the Contracting Officer (CO) or Contracting Officer’s Representative (COR).

(2) If the Contractor should begin to receive, collect, transmit, store, use, access, or share CUI without appropriate approval, it should be reported as an Information Security Incident

(ISI).

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 13 of 26

(3) Prior to removing CUI from any approved location, electronic device, removable media, or storage container, approval must be received in writing from the CO or COR.

c. Authorization to Use Information Technology (IT) Systems

(1) Prior to designing, developing, operating, accessing, or using an IT system that will store or process Information other than general information necessary to manage the contract (such as billing), the Contractor must receive approval in writing from the CIO through the CO or COR.

(2) The time required to obtain approval may be lengthy, and the Contractor should identify this requirement as soon as possible.

(3) If the Contractor should begin to operate, access, or use an IT system without appropriate approval, it must be reported as an ISI.

d. Retention of Authorizing Documentation

(1) The Contractor must maintain a current and complete file of all documentation authorizing handling of CUI during the period of performance of the contract, unless otherwise instructed by the Contracting Officer. Documentation will be made accessible during inspections or upon written request by the CO or the COR.

(End of Clause)

1752.224-77 Information Security Incidents (ISI) (Dec 2015)

a. ISI Reporting Activities

(1) Contractors must report any and all ISI involving OPM Information to the OPM Security Monitoring Center (SMC) at CyberSolutions@opm.gov , (844) 377-6109. The SMC is available 24 hours per day, 365 days per year.

(2) Contractors must report any and all ISI involving information technology (IT) systems and Controlled Unclassified Information (CUI) immediately upon becoming aware of the ISI but no later than 30 minutes after becoming aware of the ISI, regardless of day or time; regardless of internal investigation, evaluation, or confirmation of procedures or activities; and regardless of whether the ISI is suspected, known, or determined to involve IT systems operated in support of this contract.

(3) Contractors reporting an ISI to the SMC by email or phone must copy the Contracting Officer (CO) or Contracting Officer’s Representative (COR) if possible; but if not, must notify the CO or COR immediately after reporting to the SMC.

(4) When reporting an ISI to the SMC by email:

(a) Do not include any CUI in the subject or body of any email;

(b) Use FIPS 140-2 compliant encryption methods to protect CUI to be included as an email attachment, and do not include passwords in the same email as the encrypted attachment;

and

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 14 of 26

(c) Provide any supplementary information or reports related to a previously reported incident directly to the OPM SMC with the following text in the subject line of the email:

“Supplementary Information / Report related to previously reported incident # [insert number].”

b. ISI Review and Response Activities

(1) The Contractor must provide full access and cooperation for all activities determined by CO or COR to be required to ensure an effective review and response to protect OPM’s Information and Information Systems operated in support of this contract.

(2) The Contractor must promptly respond to all requests by the CO or COR for ISI and system-related information, including but not limited to disk images, log files, event information, and any other information determined by OPM to be required for a rapid but comprehensive technical and forensic review.

(3) OPM, at its sole discretion, may obtain the assistance of Federal agencies and/or third party firms to aid in ISI Review and Response activities.

c. ISI Determination Activities

(1) The Contractor must not make any determinations related to an ISI associated with Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract, including determinations related to notification of affected individuals and/or Federal agencies (except reporting criminal activity to Law Enforcement Organizations) and offering of services, such as credit monitoring.

(2) The Contractor must not conduct any internal ISI-related review or response activities that could modify or eliminate any existing technical configuration or information or forensic technical evidence existing at the time of the ISI without approval from the OPM Chief Information Officer (CIO) through the CO or COR.

(3) All determinations related to an ISI associated with Information Systems or Information maintained by the Contractor in support of the activities authorized by this contract will be made only by the OPM CIO through the CO or COR.

(4) The Contractor must report criminal activity to Law Enforcement Organizations upon becoming aware of such activity.

(End of Clause)

1752.224-78 Information Security Inspections (Dec 2015)

a. The Contractor must permit and cooperate with any mutually agreed upon pre-scheduled onsite or offsite information security inspections, such as:

(1) Before initiation of the performance period;

(2) As periodically scheduled for contract oversight and compliance purposes;

(3) As determined by the OPM Chief Information Officer (CIO) through the Contracting

Officer (CO) or Contracting Officer’s Representative (COR) to be required for evaluation of or in response to any reported Information Security Incident (ISI); or

(4) As determined by the OPM CIO through the CO or COR to be required to address any risk of non-compliance with the requirements of this contract.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 15 of 26

b. OPM will provide the Contractor with a Post-Inspection Report, which will state findings and specify the Contractor’s requirement for remediating findings to maintain compliance with this contract.

c. The Contractor must provide a formal response to the OPM Post-Inspection Report within fifteen

(15) days of receipt of the report for critical/high risk findings and within thirty (30 days for all other findings.

(End of Clause)

1752.224-79 Suspension of Contract for Security Concerns (Dec 2015) If at any time during Contract performance it is determined that the Contractor is not in full compliance with the security requirements of this Contract, the Government may immediately suspend performance under this Contract and require the immediate return of all Controlled Unclassified Information (CUI) materials and information to the Government at full Contractor expense. Any work suspension resulting from a security lapse will not be subject to equitable adjustment; all costs incurred will be borne by the Contractor.

(End of Clause)

1752.232-71 Method of Payment (July 2005)

(a) Payments under this contract will be made either by check or by wire transfer through the Treasury Financial Communications System at the option of the Government.

(b) The Contractor must forward the following information in writing to the Contracting Officer not later than seven (7) days after receipt of notice of award:

(1) Full Name (where practicable), title, telephone number, and complete mailing address of responsible official(s):

(i) to whom check payments are to be sent, and

(ii) who may be contacted concerning the bank account information requested below.

(2) The following bank account information required to accomplish wire transfers:

(i) Name, address, and telegraphic abbreviation of the receiving financial institution.

(ii) Receiving financial institution's 9-digit American Bankers Association (ABA) identifying number for routing transfer of funds. (Provide this number only if the receiving financial institution has access to the Federal Reserve Communications System.)

(iii) Recipient's name and account number at the receiving financial institution to be credited with the funds. If the receiving financial institution does not have access to the Federal Reserve Communications System, provide the name of the correspondent financial institution through which the receiving institution receives electronic funds transfer messages. If a correspondent financial institution is specified, also provide:

(A) Address and telegraphic abbreviation of the correspondent financial institution.

(B) The correspondent financial institution's 9-digit ABA identifying number for routing transfer of funds.

(c) Any changes to the information furnished under paragraph (b) of this clause shall be furnished to the Contracting Officer in writing at least 30 days before the effective date of the change. It is the Contractor’s responsibility to furnish these changes promptly to avoid payments to erroneous addresses or bank accounts.

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 16 of 26

(d) The document furnishing the information required in paragraphs (b) and (c) must be dated and contain the signature, title, and telephone number of the Contractor official authorized to provide it, as well as the Contractor's name and contract number

1752.232-73 Small Business Invoice Requirements (October 2012)

(a) A proper invoice must include the following items (except for interim payments on cost reimbursement contracts for services):

(1) Name and address of the contractor.

(2) Invoice date and invoice number. (Contractors should date invoices as close as possible to the date of transmission.)

(3) Contract number or other authorization for supplies delivered or services performed (including order number and contract line item number).

(4) Description, quantity, unit of measure, unit price, and extended price of supplies delivered or services performed.

(5) Shipping and payment terms (e.g., shipment number and date of shipment, discount for prompt payment terms). Bill of lading number and weight of shipment will be shown for shipments on Government bills of lading.

(6) Name and address of contractor official to whom payment is to be sent (must be the same as that in the contract or in a proper notice of assignment).

(7) Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice.

(8) Taxpayer Identification Number (TIN). The contractor must include its TIN on the invoice only if required by agency procedures. (See 4.9 TIN requirements.)

(9) Electronic funds transfer (EFT) banking information.

(i) The contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision (e.g., 52.232-38, Submission of Electronic Funds Transfer Information with Offer), contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer- Central Contractor Registration, or 52.232-34, Payment by Electronic Funds Transfer-Other Than Central Contractor Registration), or applicable agency procedures.

(ii) The last four digits of the contractor’s bank account must be shown on each invoice submitted for payment. This information will be used as a cross-reference in situations where the EFT banking information in the Central Contract Registration is suspect.

(iii) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(10) The vendor’s certification that their EFT banking information in the Central Contractor Registration is current, accurate and complete as of the date of the invoice.

(11) Any other information or documentation required by the contract (e.g., evidence of shipment).

(b) Any invoice that does not contain all of the information listed in paragraph (a) above will be rejected as improper, and a new complete corrected invoice must be submitted. The payment due date for the corrected invoice will be calculated from the date it is received in the Prompt Pay e-mail box.

(c) ALL small business invoices—without exception—must have unique identifying numbers, and be submitted via e-mail to OPM’s Small Business Invoice e-mail box at:

SmallBusinessInvoices@opm.gov

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 17 of 26

Please note that OPM cannot guarantee payment of invoices sent by any other means, such as regular mail or e-mail to other addresses.

(d) Please attach ONLY one invoice to each e-mail, and use the following format for the subject line of the e-mail:

<Contractor name>&<Invoice no>&<Amount>&<Contract Number>/<Call or Order Number>

Example:

ABC Co&AB-1298433&10000.00&OPM00-00-X-0000/X0000

(e) Payment due dates will only be calculated from the date that invoices are received in the Small Business Invoice e-mail box.

(f) Inquiries regarding payment of invoices should be e-mailed to InvoiceInquiries@opm.gov.

The relevant invoice must be attached to the inquiry e-mail, and the subject line of the e-mail must state “INQUIRY,” followed by the information described in paragraph (d) above.

Example:

INQUIRY: ABC Co&AB-1298433&10000.00&OPM00-00-X-0000/X0000

Do NOT use the Prompt Pay e-mail box for inquiries.

(g) If the supplies, services, technical or other reports are rejected for failure to conform to the technical requirements of the contract, or for damage in transit or otherwise, the invoice will be rejected and returned to the Contractor.

1752.232-74 Providing Accelerated Payment to Small Business Subcontractors (Oct 2012)

(a) This clause implements the temporary policy provided by OMB Policy Memorandum M-12-16, Providing Prompt Payment to Small Business Subcontractors, dated July 11, 2012. (Note: OMB Policy Memorandum M-12-16 is accessible on line at:

http://www.whitehouse.gov/sites/default/files/omb/memoranda/2012/m-12-16.pdf.)

(b) Upon receipt of accelerated payments from the Government, the contractor is required to pay all small business subcontractors on an accelerated timetable to the maximum extent practicable after receipt of invoice and all proper documents.

(c) Include the substance of this clause, including this paragraph (b), in all subcontracts with small business.

1752.233-70 OPM Protest Procedures [Applicable to Solicitations Only] (January 2017)

(a) An interested party who files a protest with OPM has the option of requesting review and consideration of the protest by either the Contracting Officer (CO) or the Senior Procurement Executive (SPE). The protest must clearly indicate the official to whom it is directed.

(b) If the protest is directed to the SPE, a copy of the protest must be sent to the Director of Contracts at the same time the protest is filed with the CO in accordance with FAR 52.233-2. The address of the Director of Contracts is:

OCIO/EIS/NM Microsoft Enterprise License Agreement - RFP: OPM32-17-T-0003 – Page 18 of 26

Elijah Anderson Acting Director of Contracts, Office of Procurement Operations U.S. Office of Personnel Management 1900 E Street N.W., Room 1342 Washington, DC 20415

(c) Review and consideration of a protest by the SPE is an alternative to…