P03- FY24 CoStar - SOW Final.pdf

1 | P a g e

Statement of Work CoStar Licenses

July 22, 2024

OBJECTIVES

FPAC seeks to decrease CoStar Licenses from 9 to 8 to assist with required market research and analysis needed for the Lease Acquisition and Administration Branch. The period of performance would consist of one base year starting FY24 and four option years.

DELIVERY

• Electronic Delivery of Licenses:

SM.FPAC.BC.SDT.LICENSEMANAGEMENT@USDA.GOV

PERIOD OF PERFORMANCE

Base Year 9/30/2024 - 9/29/2025 Option Year 1 9/30/2025 - 9/29/2026 Option Year 2 9/30/2026 - 9/29/2027 Option Year 3 9/30/2027 - 9/29/2028 Option Year 4 9/30/2028 - 9/29/2029

REQUIREMENTS

Product Qty CoStar Licenses 8 mailto:%3cSM.FPAC.BC.SDT.LICENSEMANAGEMENT@USDA.GOV

2 | P a g e

SPECIAL IT REQUIREMENTS

Cyber-Security Supply Chain Risk Management (C-SCRM) See Attachment A (USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language – Version 1.0). Sections 2, 4, 5 and 6 are incorporated by reference.

Data Rights Data collected, generated or managed The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements, and rendering other assistance as deemed necessary.

Privacy Act The Contractor Agrees To –

• Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies— o The systems of records; and o The design, development, or operation work that the contractor is to perform;

• Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

3 | P a g e

• Include this clause, including this paragraph, in all subcontracts awarded under this contract, which requires the design, development, or operation of such a system of records.

• In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

• Definitions of the clause:

o “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

o “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

Confidentiality and Non-Disclosure Any USDA proprietary information, data, and/or equipment that the Contractor has been granted access by USDA to perform work under this order, will be returned to the USDA when no longer required to perform work under this order. The public release of USDA proprietary information must be authorized in writing by the Contracting Officer.

The component parts of this effort and reports are expected to contain highly sensitive information that may act as a guide for hostile entities to cause harm to the Department’s critical infrastructure. Any such information made available in any format shall be used only for the purpose of carrying out the provisions of this agreement. Such information shall not be divulged or made known in any manner to any person.

The Contractor shall immediately notify the Contractor Program Manager, the Contractor on-site Manager, the COR, the Government TPM and the Contracting Officer upon discovery of any inadvertent disclosures of information. The Contractor shall not retain any information regarding vulnerabilities, to include summaries, the actual vulnerability report, etc., at the end of the task order. All information arising from this task, both hard copy and electronic, shall be returned to the COR and Government TPM at task completion.

The Contractor must agree that:

4 | P a g e

• The draft and final deliverables and all associated working papers and other materials deemed relevant by the USDA TPMs that have been generated by the Contractor in the performance of this task order are the property of the U.S. Government and must be submitted to the USDA TPMs at the conclusion of the tasks.

• All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor. All appropriate project documentation will be given to the Government TPM during and at the end of this contract. The Contractor will release no information. Any request for information relating to this Statement of Work presented to the Contractor must be submitted in writing to the USDA TPMs and the CO, who in turn will 12.3 under assignment of this contract.

Sensitive Information Storage and Disclosure Sensitive information, data, and/or equipment will be disclosed only to authorize personnel on a Need-To-Know basis. The holder shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment will be returned to Government control; destroyed; or held until otherwise directed. Destruction of items shall be accomplished by tearing into small parts; burning; shredding or other method that precludes the reconstruction of the material.

Work on this contract may require that personnel have access to Privacy Information.

Personnel shall adhere to the Privacy Act, Title 5 of the U. S. Code, Section 552a and applicable agency rules and regulations.

The Contractor Program Manager shall ensure that all contract personnel take the required USDA Security Awareness and Rules of Behavior Training.

Release of Information No USDA data shall be divulged to any unauthorized person, for any purpose. Therefore, the Contractor shall clear with the Contracting Officer any public release of any information. Information includes news stories, articles, sales and marketing information, advertisements, etc. All requests for public release of information shall be submitted via email to the COR and Government Technical Program Manager (TPM) and the Contracting Officer and addressed to:

United States Department of Agriculture Office of Communications (OC) 1400 Independence Avenue, SW Washington, DC 20250 The Contracting Officer shall submit the Contractor’s Request for Press Release to the Office of Communications for approval. The Contractor shall not release any information to the public without official OC approval from the Contracting Officer.

5 | P a g e

Return of Data Data and information developed, entered, and processed under this contract shall be considered Government property. All data and/or materials provided to the contractor to accomplish individual deliverables, or data generated as a result of accomplishing individual deliverables, shall be returned to the Government or destroyed at the end of each applicable deliverable, unless the contractor specifically requests and receives approval from the COR to maintain copies of this data. The Contractor is responsible for distributing data and/or materials given to members of the contractor’s team. None of this data will be released to any other Government organization or other organizations of individuals without the express written approval of USDA unless otherwise specified.

Compliance With Internet Protocol Version 6 (IPv6) In Acquiring Information

Technology Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract must be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system must maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

• Specifically, any new IP product or system developed, acquired, or produced must:

o Interoperate with both IPv6 and IPv4 systems and products, and o Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

• As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

• The Contractor must provide technical support for both IPv4 and IPv6.

• Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

• Any product whose non-compliance is discovered and made known to the

Contractor within one year after acceptance must be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

Section 508 Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220 requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities

6 | P a g e must have access to, and use of, information on data that is comparable to people without disabilities.

E201.1 Scope ICT that is procured, developed, maintained, or used by agencies shall conform to the Revised 508 Standards.

E205.1 General Electronic content shall comply with E205.

E205.2 Public Facing Electronic content that is public facing shall conform to the accessibility requirements specified in E205.4.

E205.3 Agency Official Communication Electronic content that is not public facing shall conform to the accessibility requirements specified in E205.4 when such content constitutes official business and is communicated by an agency through one or more of the following:

- A. An emergency notification;

- B. An initial or final decision adjudicating an administrative claim or proceeding;

- C. An internal or external program or policy announcement;

- D. A notice of benefits, program eligibility, employment opportunity, or personnel action;

- E. A formal acknowledgement of receipt;

- F. A survey questionnaire;

- G. A template or form;

- H. Educational or training materials; or

- I. Intranet content designed as a Web page.

E205.4 Accessibility Standard (WCAG 2.0) - Electronic content shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (Incorporated by reference, see 702.10.1).

E205.4.1 Word Substitution when Applying WCAG to Non-Web Documents. For non- Web documents, wherever the term "Web page" or "page" appears in WCAG 2.0 Level A and AA Success Criteria and Conformance Requirements, the term "document" shall be substituted for the terms "Web page" and "page". In addition, in Success Criterion in 1.4.2, the phrase "in a document" shall be substituted for the phrase "on a Web page".

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E207.1 General Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter

7 | P a g e

Exception from E207.1 General: Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to the requirements in Chapter 5.

E207.2 WCAG Conformance User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

Exceptions from E207.2 WCAG Conformance:

- Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to E207.2.

- Non-web software shall not be required to conform to the following four Success Criteria in WCAG 2.0: 2.4.1 Bypass Blocks; 2.4.5 Multiple Ways; 3.2.3 Consistent Navigation; and 3.2.4 Consistent Identification.

- Non-Web software shall not be required to conform to Conformance Requirement 3 Complete Processes in WCAG 2.0.

E207.3 Complete Process for Non-Web Software Where non-Web software requires multiple steps to accomplish an activity, all software related to the activity to be accomplished shall conform to WCAG 2.0 as specified in E207.2.

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

E301 General

E301.1 Scope. The requirements of Chapter 3 shall apply to ICT where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

E302 Functional Performance Criteria

302.1 Without Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision.

302.2 With Limited Vision. Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

302.3 Without Perception of Color. Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

302.4 Without Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

8 | P a g e

302.5 With Limited Hearing. Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

302.6 Without Speech. Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

302.7 With Limited Manipulation. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

302.8 With Limited Reach and Strength. Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

302.9 With Limited Language, Cognitive, and Learning Abilities. ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

502.4 Platform Accessibility Features. Platforms and platform software shall conform to the requirements in ANSI/HFES 200.2, Human Factors Engineering of Software User Interfaces — Part 2: Accessibility (2008) (incorporated by reference, see 702.4.1) listed below:

- A. Section 9.3.3 Enable sequential entry of multiple (chorded) keystrokes;

- B. Section 9.3.4 Provide adjustment of delay before key acceptance;

- C. Section 9.3.5 Provide adjustment of same-key double-strike acceptance;

- D. Section 10.6.7 Allow users to choose visual alternative for audio output;

- E. Section 10.6.8 Synchronize audio equivalents for visual events;

- F. Section 10.6.9 Provide speech output services; and

- G. Section 10.7.1 Display any captions provided.

503.1 General Applications shall conform to 503.

503.2 User Preferences Applications shall permit user preferences from platform settings for color, contrast, font type, font size, and focus cursor.

Exception from E503.2 User Preferences: Applications that are designed to be isolated from their underlying platform software, including Web applications, shall not be required to conform to 503.2.

503.3 Alternative User Interfaces. Where an application provides an alternative user interface that functions as assistive technology, the application shall use platform and other industry standard accessibility services.

503.4 User Controls for Captions and Audio Description Where ICT displays video with synchronized audio, ICT shall provide user controls for closed captions and audio descriptions conforming to 503.4.

9 | P a g e

503.4.1 Caption Controls Where user controls are provided for volume adjustment, ICT shall provide user controls for the selection of captions at the same menu level as the user controls for volume or program selection.

503.4.2 Audio Description Controls. Where user controls are provided for program selection, ICT shall provide user controls for the selection of audio descriptions at the same menu level as the user controls for volume or program selection.

504.1 General Where an application is an authoring tool, the application shall conform to 504 to the extent that information required for accessibility is supported by the destination format.

504.2 Content Creation or Editing Authoring tools shall provide a mode of operation to create or edit content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for all supported features and, as applicable, to file formats supported by the authoring tool.

Authoring tools shall permit authors the option of overriding information required for accessibility.

504.2.1 Preservation of Information Provided for Accessibility in Format Conversion.

Authoring tools shall, when converting content from one format to another or saving content in multiple formats, preserve the information required for accessibility to the extent that the information is supported by the destination format.

504.2.2 PDF Export. Authoring tools capable of exporting PDF files that conform to ISO 32000-1:2008 (PDF 1.7) shall also be capable of exporting PDF files that conform to ANSI/AIIM/ISO 14289-1:2016 (PDF/UA-1) (incorporated by reference, see 702.3.1).

504.3 Prompts. Authoring tools shall provide a mode of operation that prompts authors to create content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for supported features and, as applicable, to file formats supported by the authoring tool.

504.4 Templates. Where templates are provided, templates allowing content creation that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) shall be provided for a range of template uses for supported features and, as applicable, to file formats supported by the authoring tool.

602.1 General. Documentation that supports the use of ICT shall conform to 602.

602.2 Accessibility and Compatibility Features. Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5.

Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

10 | P a g e

602.3 Electronic Support Documentation. Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

602.4 Alternate Formats for Non-Electronic Support Documentation. Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

Instructions to Offerors

- Provide an Accessibility Conformance Report (ACR) for each commercially available Information and Communication Technology (ICT) item offered through this contract.

Create the ACR using the Voluntary Product Accessibility Template Version 2.1 or later, located at https://www.itic.org/policy/accessibility/vpat. Complete each ACR in accordance with the instructions provided in the VPAT template. Each ACR must address the applicable Section 508 requirements referenced in the Work Statement. Each ACR shall state exactly how the ICT meets the applicable standards in the remarks/explanations column, or through additional narrative. All "Not Applicable" (N/A) responses must be explained in the remarks/explanations column or through additional narrative. Address each standard individually and with specificity, and clarify whether conformance is achieved throughout the entire ICT Item (for example - user functionality, administrator functionality, and reporting), or only in limited areas of the ICT Item. Provide a description of the evaluation methods used to support Section 508 conformance claims. The agency reserves the right, prior to making an award decision, to perform testing on some or all of the Offeror’s proposed ICT items to validate Section 508 conformance claims made in the ACR.

- Describe your approach to incorporating universal design principles to ensure ICT products or services are designed to support disabled users.

- Describe plans for features that do not fully conform to the Section 508 Standards.

- Describe "typical" user scenarios and tasks, including individuals with disabilities, to ensure fair and accurate accessibility testing of the ICT product or service being offered.

Acceptance Criteria

- Prior to acceptance, the government reserves the right to perform testing on required ICT items to validate the offeror’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the offeror represent an inaccurate level of conformance than what is actually delivered to the agency, the government shall, at its option, require the offeror to remediate the delivered item to align with the required Section 508 conformance claims prior to acceptance.

11 | P a g e

Software Line-Item Data In accordance with Office of Management and Budget Memorandum M-16-12, Category Management Policy 16-1: Improving the Acquisition and Management of Information Technology: Software Licensing, USDA must maintain an inventory of its software licenses, including pricing data.

The contractor shall provide line item pricing data on all software licenses provided to USDA at award and/or during performance of the contract/order by completing the Software License Line Item Data form found at https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS 4u

The form shall be completed within 10 days of award or 10 days of activation for licenses provided after the award date.

Software Attestation Requirement The Contractor shall provide completed Attestation Forms for all software components delivered under this contract. This requirement applies to both custom-developed software and third-party software integrated into the final deliverables. The Contractor must submit the completed Attestation Forms at the following milestones:

• Prior to contract award.

• With each major software update or release.

• Upon request by the Contracting Officer.

The Contractor must submit the attestation to all of the following:

• Online at https://softwaresecurity.cisa.gov/software and associate USDA with the submittal.

• And send an email to FY24VendorAttestations@usda.gov with the signed attestation form with a copy (cc) to the CO when complete.

The Contractor is responsible for ensuring the accuracy and completeness of the Software Attestation Forms. Any discrepancies or issues identified in the attestation must be promptly addressed and resolved by the Contractor at no additional cost to the Government. The Government reserves the right to validate the submitted Software Attestation Forms and request additional documentation or evidence to verify compliance. The Contractor shall cooperate fully and provide any requested information within ten (10) business days of the request. Failure to submit the completed Software Attestation Forms in accordance with the requirements outlined herein may result in failure to receive a contract, withholding of payments, termination of the contract for default, or other remedies as deemed appropriate by the Government.

https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u https://softwaresecurity.cisa.gov/software mailto:FY24VendorAttestations@usda.gov