Print Shop Outsourcing DRAFT PWS 01032025.pdf

Performance Work Statement (PWS)

Rural Development (RD) Automated Mail Services Outsourced Operations

Blanket Purchase Agreement (BPA)

As of 01/03/2025

I. DEFINITIONS/ACRONYMS:

• ACIO: RD Assistant Chief Information Officer

• AMP: Automated Mail Processing

• BC: Business Center

• BPA: Blanket Purchase Agreement

• CASS: Coding Accuracy Support System – certification program established and maintained by the United States Postal Service (USPS) that validates addresses accuracy against the USPS database.

• CFO: Chief Financial Officer

• CISO: RD Chief Information Security Officer

• CO: Contracting Officer, a person with authority to enter, administer, and/or terminate contracts, and make related determinations and findings on behalf of the government. A CO is the only individual who can legally bind the government.

• COR: Contracting Officer's Representative, a representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does

NOT have authority to change the terms and conditions of the contract.

• COTS: Commercial-off-the-shelf, for the purpose of the performance work statement, COTS refer to commercially developed software.

• CLIN: Contract Line-Item Number

• DISC: Digital Infrastructure Services Center (formerly National Information Technology Center

(NITC))

• DJDE: Dynamic Job Descriptor Entry

• DOL: Department of Labor

• FAR: Federal Acquisition Regulation

• HIPAA: Health Insurance Portability and Accountability Act

• IMB: Intelligent Mail Barcode

• IC: Innovation Center

• IPP: Invoice Processing Platform

• ISA: Interconnection Security Agreement

• MRDF: Mail Run Data File

• NCOA: National Change of Address (NCOA)

• O&M: Operations and Maintenance

• OSB: Operations Scheduling Branch

• OCI: Organizational Conflict of Interest

• OMB: Office of Management and Budget

• PRS: Performance Requirement Summary

• PII: Personally, identifiable information

• PIV: Personal Identity Verification Card, all employees and contractors working for USDA must be issued a PIV card, known as LincPass

• PMO: Procurement Management Office

• PWS: Performance Work Statement

• QA: Quality Assurance

• QASP: Quality Assurance Surveillance Plan - An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance to assure services meets the requirements of the PWS.

• QCP: Quality Control Plan

• RBCS: Rural Business and Cooperative Service

• RD: Rural Development

• RDTO: Rural Development Technology Office

• RHS: Rural Housing Service

• SED: Systems Engineering Division

• RUS: Rural Utilities Service

• SFTP: Secure File Transfer Protocol

• SO: Servicing Office

• Shall: denotes a mandatory duty or obligation

• USDA: United States Department of Agriculture

• USPS: United States Postal Service

II. GENERAL REQUIREMENTS:

1. Introduction

As a critical component of United States Department of Agriculture (USDA), the Rural

Development (RD) Mission Area is driven by a mission to stimulate, grow, and protect the

American rural economy by providing loans, grants, and loan guarantees to individuals and commercial entities engaged in the betterment of rural life. As such, RD generates numerous mailings.

The USDA RD Assistant Chief Information Officer (ACIO) is responsible for developing, maintaining, and operating enterprise-level solutions in support of all RD business users. These business users include: Business Center (BC), Innovation Center (IC), Office of External Affairs

(OEA), Civil Rights Office, Chief Risk Office, Rural Business and Cooperative Service (RBCS), Rural Housing Service (RHS), and Rural Utilities Service (RUS). These business areas function to support the delivery of RD loan, grant, and technical assistance programs to rural communities. In addition, RD supports automated mailings for the Farm Production and Conservation (FPAC) agency also.

Rural Development has a need to acquire full automated mail processing operations and other print shop operational services.

2. Background

RD provides financial enterprise print and mail-handling services to the entire RD mission area, the St. Louis Farm Production and Conservation (FPAC) and other on-demand Federal agencies that are crucial to effective and efficient program delivery. RD and FPAC depend on these enterprise print and mail-handling services to produce and distribute financial and management reports, as well as loan servicing and customer notification correspondence for all program areas.

The RD Automated Mail Processing (AMP) is an enterprise print and mail-handling service that produces and distributes financial and management reports, as well as loan servicing and customer notification correspondence as outlined in the above paragraph. The volume of printed material is approximately 16 million images per year and supports an average of 380,000 pieces of metered mail per month.

The Contractor will be deemed as the full RD automated mail processing operations and other print shop operational services provider. The Contractor will be responsible for having a disaster recovery/business continuity plan and perform a disaster recovery test at least annually.

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

The following reference materials or appropriate portions thereof can be found online and are publicly available or will be made available after award upon written request by the contractor.

The Contractor must be familiar with and use the versions/revisions in effect as of the effective date of each Call order issued under the Blanket Purchase Agreement (BPA), and the Contractor is required to comply with the policies and procedures set forth in all such references.

• Agriculture Acquisition Regulation (AGAR)

• Federal Acquisition Regulations (FAR)

• General Services Administration Acquisition Manual (GSAM)

• Clinger-Cohen Act (also known as the “Information Technology Management Reform Act of 1996”) (40 U.S.C. § 11101-11704);

• E-Government Act of 2002 (44 U.S.C. Chapters 35 and 36);

• Federal Information Security Modernization Act of 2014 (44 U.S.C. Chapter 35, Subchapter II);

• Federal Information Technology Acquisition Reform Act (FITARA) (Pub. L. 113-291);

• Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork Reduction Act of

1995 (44 U.S.C. Chapter 35);

• Privacy Act of 1974, as amended (5 U.S.C. § 552a);

• Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101);

• Electronic Signatures in Global and National Commerce Act (E-Sign) (15 U.S.C. Chapter

96);

• Government Paperwork Elimination Act of 1998 (44 U.S.C. § 3504);

• Government Performance and Results Act (GPRA) of 1993, as amended by the

Government Performance and Results Modernization Act (GPRA Modernization Act) of

2010 (5 U.S.C. § 306 and 31 U.S.C. §§ 1115 et seq.);

• Office of Federal Procurement Policy Act (41 U.S.C. Chapter 7);

• Budget and Accounting Procedures Act of 1950, as amended (31 U.S.C. Chapter 11);

• Chief Financial Officers Act (31 U.S.C. § 3512 et seq.)

• USDA RD Resources, Directives, and Regulations: https://www.rd.usda.gov/resources

• USDA Departmental Regulations, Notices, Manuals, and Secretary Memoranda:

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

• USDA Digital Strategy: https://www.usda.gov/digital-strategy

• CIO.gov Policies and Priorities: https://www.cio.gov/policies-and-priorities/ https://www.rd.usda.gov/resources https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.usda.gov/digital-strategy https://www.cio.gov/policies-and-priorities/

3. Type of Contract

In accordance with FAR 8.405-3 Blanket Purchase Agreements, RD intends to establish a single award BPA under the GSA Multiple Award Supply Schedule Program to issue Call Orders for services as defined in the PWS Scope and identified by CLINs.

• This BPA will not obligate any funds.

• The Government is obligated only to the extent of an authorized BPA Call Order is placed against the BPA by a warranted Contracting Officer.

• The Government does not guarantee to acquire a minimum or a maximum quantity/dollar amount under this BPA.

• The BPA agreement may be terminated upon 30 days written notice by the Government .

• Any RD contracting officer, acting within the scope of their delegated procurement authority, may place Call orders against this BPA. RD Call Order COs will place orders via email.

Call Order information

• Call Order types allowed under this BPA will be Firm Fixed Price.

• All Call Orders are subject to the terms and conditions of the BPA

• Call Order(s) will be issued when requirements are required by an USDA RD ordering activity

• Only a USDA RD CO is authorized to place a Call Order under this agreement

• A payment schedule will be specified in each Call Order

• Each Call Order shall specify its period of performance

• Contractor shall complete a BLANKET PURCHASE AGREEEMENT STATUS REPORT for each Call Order

• BPA Holders are not required to bid on every call order

• Contractor shall be provided up to 45 days to begin work on a Call Order after its issuance.

• Call Order awardee may only invoice for quantity completed of prints, images, postage, etc...

4. Non-personal and Not Inherently Governmental Services

All services requested under this acquisition and PWS are non-personal and not inherently governmental in nature.

5. Place(s) of Performance

The Contactor shall perform the Call order requirements of this BPA at the authorized work location unless otherwise specifically stated in this PWS.

The current government work location is:

a) Remote - Contractor Facility. The facility must comply with the appropriate safety regulations as per NIST SP 800-171.

i. The purpose of this publication is to provide federal agencies with recommended security requirements for protecting the confidentiality of controlled unclassified information

(CUI): (1) when the CUI is resident in a nonfederal system and organization; (2) when the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency; and (3) where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or governmentwide policy for the CUI category listed in the CUI Registry.

Changes in Authorized Work Locations:

Work locations are subject to change when it is advantageous to the Government to eliminate or add a work location or change work locations to remote. Should a change occur, the contractor will be notified in writing by the Call order CO.

Should the Contractor decide to relocate existing employees due to a change, employee relocation will be done at no cost to the Government.

The Contractor may propose contractor work locations in addition to those identified in

Place(s) of Performance when it is advantageous to the Government. This includes contractor employee telework locations during specified periods when the government facilities are closed due to weather and other emergency situations or when Government facilities are unavailable due to other events making a Government facility uninhabitable. The alternate work locations will be coordinated with the Call order Contracting Officer’s Representative

(COR) in advance and shall be at no additional cost to the government.

The Contractor shall ensure all Government furnished equipment (GFE) assigned to individual employees are safely and securely operated and maintained regardless of the location where the work is performed.

Note: Currently all requirement tasks are being supported remote/virtually in support of efforts to combat COVID 19. USDA expects to have a mixed (virtual/in person) workforce, but largely does not expect any contractors to perform work onsite at government locations unless requested to attend in-person meeting, which would be infrequent. The government has limited space available to house Vendor’s workforce, for this acquisition efforts, in its new

DC or MO locations.

6. Days and Hours of Performance

The Contractor is required to be available on non-government holidays from 9:00 am EST until

5:00 pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the CO, COR, and the Program/Technical Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

Federal Holiday Schedule

New Year’s Day

Martin Luther King, Jr. Birthday

Washington’s Birthday

Memorial Day

Juneteenth National Independence Day

Independence Day

Labor Day

Columbus Day

Federal Holiday Schedule

Veterans Day

Thanksgiving Day

Christmas Day

7. Performance Period

This BPA will be effective from the date of establishment for a base period of 12 months, with four 12-month option periods (e.g., if a BPA is established on March 25, 2025, the full performance period would run through March 24, 2030), unless an option is not exercised, or the

BPA is cancelled.

Work on issued call orders may extend beyond 364 days of the effective period of this BPA.

However, no new call orders may be issued once the BPA performance period has expired. Should a BPA Award Holder contractor’s GSA schedule contract expire during the period of performance, AND any available option periods are not exercised, the BPA award for that contractor shall expire on the same date as its GSA schedule contract expired, and no new call orders for that BPA Award Holder may be issued after that date.

If an option period on the BPA Award Holder Schedule contract is exercised, the end of a

Schedule contract period will be not considered an “expiration” for purposes of this BPA or call orders hereunder. (See FAR 8.405-3(c) for details). The BPA CO will perform yearly reviews of the BPAs in accordance with FAR 8.405-3(d).

The Contractor BPA Award Holder shall notify the BPA CO no less than sixty (60) days prior to the expiration of the Contractor's Multiple Award Schedule contract that its contract is about to expire.

The Government may cancel the BPA at any time by notifying the Contractor at least thirty (30) days in advance. BPA cancellation does not release the contractor from the duty to continue call order performance. Ongoing orders continue in accordance with their own period of performance, even if the BPA is cancelled. Termination procedures for call orders are addressed in the underlying schedule contract.

A Call order must be awarded before the Period of Performance (POP) for the base or option period ends. A Call order could be issued for the time length of a year. Therefore, it is possible that a Call order could have a POP date that is 364 days past the end dated of an BPA POP.

8. Kickoff Meeting

Upon award of the initial BPA, and subsequent BPA Call orders, a kickoff meeting will be held within 10 days of BPA award. Contractor shall initiate work on this BPA by meeting with key government agency representatives to ensure a common understanding of the requirements, expectations, and ultimate end products. Contractor shall discuss the overall understanding of the initial and overall projects and review the background information and materials provided by the government. Discussions will also include the scope of work, deliverables to be produced, how the efforts will be organized, and project conducted, assumptions made/expected results. A concerted effort shall be made to gain a thorough understanding of the government agency expectations.

However, nothing discussed in this or in any subsequent meeting(s) or discussions between the

Government and Contractor shall be construed as adding, deleting, or modifying any BPA Call order requirements, including deliverable specifications and due dates. Any additions, deletions, or modifications to any BPA Call order requirement must be approved by the CO. Similar

“kickoff” meetings shall be accomplished with each subsequent Call Order placed.

9. Travel

There will be no travel reimbursement provided under the BPA or subsequent Call orders.

10. Government Furnished Property, Equipment, and/or Services

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide transition support as defined in this Performance Work Statement (PWS) except for those items specified below as government furnished property and services:

• Laptops – Receipt of government issued laptops are contingent upon Contractor employees passing Suitability Requirements.

• PIV Card – A USDA Personal Identity Verification (PIV) card, which contains the necessary data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications will need to be obtained by Contractor employees. The COR will work with Contractor to obtain PIV cards for Contractor’s employees.

• Workspace and utilities shall be provided at USDA, if applicable.

a) USDA Rural Development, 1400 Independence Ave, Washington, DC 20250

b) USDA Rural Development, 211 North Broadway, St. Louis, MO 63102

c) Other government offices as required under acquisition work performance

11. Identification of Contractor Employees

All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. When performing work outlined in this PWS while in USDA facilities or

RD sites, contractor is required to wear Federal government-issued personal identification card.

12. Non-Disclosure and Confidentiality

The work to be performed under this acquisition and the data released to the Contractor’s personnel shall be treated as sensitive and confidential in nature and is not to be discussed with or released to anyone except USDA employees assigned to work with the contractor and other contractor personnel working on this acquisition. The Contractor is responsible for requiring all its employees working under this acquisition, who have access to privileged information, to sign the

USDA Non-Disclosure Agreement, provided as an attachment to the solicitation and contract.

USDA, as it deems appropriate, may require additional certifications be completed by the contractor at any time during acquisition performance.

The Contractor is required to develop and utilize procedures for custody, use/handling, reproduction, preservation, storage, safeguarding, and disposition of all documents/files and information of this nature so that there is no unauthorized disclosure of such documents/files and information throughout the course of performance. The Contractor shall be responsible for the security of all documents provided to them for work under this acquisition. It is essential that this information be properly handled, stored, and protected from the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction. The

Contractor shall protect and not disclose any PII.

Contractor-generated preliminary and final deliverables, all associated working papers, and other material RD deems relevant in the performance of Call orders are the property of the U.S.

Government and must be submitted to the Call order CO/COR by the conclusion of the Call order and shall not be reproduced or retained by the Contractor. The Contractor shall not release any information without the written consent of the Call order CO.

When no longer required, this information, data, or equipment shall be returned to Government control, destroyed, or held until otherwise directed by the Call order CO. Items returned to the

Government shall be mailed or emailed, as applicable, to the Call order CO/COR or other designee. The Contractor shall destroy unneeded items by burning, shredding or any other method that precludes the reconstruction of the material.

The Contractor shall immediately notify the appropriate CO/COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment.

Training. If applicable, all Contractor employees assigned to this acquisition who create, work with, or otherwise handle records are required to take USDA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training. To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.

Proprietary Information

In the event that performance of any work under this acquisition causes the Contractor to gain access to proprietary or confidential information of other firms/contractors, the Contractor is required to immediately execute Technology Exchange Agreements/Non-Disclosure Agreements with those firms/contractors, in order to protect the information from unauthorized use. The

Contractor is required to refrain from using any such information for any purposes other than for which it was furnished. The Contractor must immediately provide the CO with a copy of any such agreements with original signatures affixed.

13. Homeland Security Presidential Directive (HSPD)-12 Credentials

Contractor personnel must complete necessary requirements to obtain HSPD‐12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD‐12 credentials is grounds for removal/suspension of contractor personnel from the contract.

https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

14. Contractor Personnel Staffing and Assignments

• Information Technology Systems Requirements

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in

Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Management Act of 2002

(FISMA).

The Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally controlled information system, including a Rural

Development- issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed

Computer Security Awareness training and submit this listing to the COR with a copy to the

Contracting Officer within ten calendar days of an individual starting work on this contract.

• Access Requirements

Contractor Access to USDA’s Network/Systems. The Contractor shall require access to the

USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

• Information Assurance

The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB

Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source that, when combined with other available information, could be used to identify an individual.

15. On-Boarding Process

The Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the

COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide, to the COR, an Onboarding Status Report for any staff with outstanding onboarding requests.

Additional information regarding the on-boarding process is addressed in the attachment “PWS

BACKGROUND INVESTIGATION REQUIREMENTS”.

Deliverable:

A. Onboarding Status Report – due weekly.

This report is to include:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

16. Contractor Personnel Staffing and Assignments

(a) In the event that any of the key personnel named in the Contractor’s quotation, as accepted by the Government at award, are unable to perform because of death, illness, resignation from the

Contractor’s employ, dissolution of agreement, or other reasons, the Contractor shall submit within 24 hours to the CO/COR, detailed written explanations of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any other information that the CO/COR deems pertinent to approve the substitution. No substitution is to be made without the prior written approval of the CO/COR. No increases in pricing will be allowed when substitutions are authorized by the Government.

(b) Personnel possessing unique technical specialties may be required for certain services related to the acquisition tasks. Such personnel shall have qualifications as required by the applicable tasks and approved by the CO/COR, which are appropriate to the nature of the services that will be provided.

(c) The CO will have the right to effect removals of any Contractor employees working under the awarded acquisition, if those employees are deemed not to possess the proper level of competence or abilities, or otherwise found to be unsuitable for work required. In such cases, the Contractor must promptly submit the names and any other information pertinent to approvals of substitutions if requested.

(d) Failure or delays by the Contractor in providing qualified personnel who meet the stated requirements of this acquisition, may be deemed sufficient reason by the COR to recommend termination for cause to the CO.

The Contractor shall provide the CO with a primary and alternate administrative point of contact

(POC) after award. One of these points of contact must be a Contract Executive. The Contractor shall notify USDA RD of any changes in contact information as expeditiously as possible.

17. Compliance with IT Security Policies

• Information systems and system services provided to USDA by the Contractor must comply with the current USDA/ IT security and privacy policies, specifically the 3500 –

3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

• Contractors are also required to comply with current Federal regulations and guidance found in the:

o Federal Information Security Modernization act of 2014 (FISMA);

o Privacy Act of 1974; E-Government Act of 2002, Section 208;

o National Institute of Standards and Technology (NIST) Federal Information

Processing Standards (FIPS) o 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise

Patch Management Technologies;

o Office of Management and Budget (OMB) memoranda;

o USDA Information Security Program policies, o and other relevant Federal laws and regulations with which USDA must comply.

• USDA departmental regulation DR 3575-002, System and Information Integrity

(08/16/18), mandates that information technology development projects follow the

Agency’s accepted System Development Lifecycle (SDLC). All projects with congressional visibility can expect to be audited for compliance. Other projects may be audited at Agency discretion. Audits may occur at any time.

• Contractors are required to protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the

Contractor must review and remediate the vulnerabilities and then present the results for

Government approval within the timeframes documented in USDA IT security policies.

18. Special Considerations

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors. In addition, the Contractor may be required to meet and work with said other vendors regularly. However, it is expected that vendor collaboration working meetings would not be more frequent than twice a week at a duration of not more than 3 hours per meeting. These meetings may be obligatory to address project issues/concerns/improvements, etc.

Collaboration working meetings are in addition to the meetings listed in the deliverables table. At the CO’s direction, the Contractor may be required to provide PMO ad hoc status reports in addition to any status reports in the deliverable table. This authority shall not be delegated to any

COR.

Meetings: Please be advised that most acquisition meetings are held in Microsoft TEAMS.

Meetings may be recorded for the contract file. The COR or CO is to set up meetings in TEAMS to facilitate meeting transcripts.

19. Organizational Conflict of Interest (OCI)

Contractor and subcontractor personnel performing work under this acquisition may receive, have access to proprietary or information (e.g., cost/pricing, specifications, work statements, etc.) or perform services which may create a current or subsequent OCI as defined in FAR Subpart 9.5.

The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the

CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent acquisition requirements which may be affected by the OCI.

An example of preclusion of participation/bidding on a subsequent acquisition requirement may be the following scenario: Contractor One, per Contract One developed the architectural structure, strategic plan, etc. (aka PWS Tasks/Plan) for Requirement Two which will be competed in order to award Contract Two. Because of Contractor One created/wrote the PWS Tasks/Plan, Contractor

One will be precluded from bidding on Requirement Two solicitation. Preclusion in this instance helps to ensure best value for the government while keeping a fair and unbiased acquisition competition environment.

20. Data Rights

The Government has unlimited rights to all documents/material produced under this BPA and subsequent BPA Call orders. All documents and materials produced under this acquisition shall be

Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting

Officer. This right does not abrogate any other Government rights.

21. USDA Visual Identity Guidelines

All visual materials intended for release to the public, both electronic and printed, delivered in the performance of this contract, must wholly conform to the current USDA Rural Development

Visual Identity Guidelines. See attachment, “USDA Visual Identity Guidelines”.

22. Constraints or Assumptions

Contractor shall adhere to USDA Digital Strategy, US Web Design Standards, and Chief

Information Officers Council (CIO.gov) policies and priorities.

23. Order of Precedence

In the event of inconsistencies, between the Contractor’s proposal/quote and PWS, the required work specified in this PWS will take precedence over the Contractor’s proposal/quote.

24. Service Contract Labor Standards (SCLS) (formerly known as the Service Contract Act of

1965) Applicability

Contractors are to quote based on any wage determination that may be applicable per SCLS. It is the Contractor’s responsibility to review its employee roles that may be employed during administration of the ensuing contract and/or its tasks orders in context of the SCLS for potential labor categories covered under the SCLS.

This is not a labor hour contract. The contractor is to propose its own labor category mix based on the tasks included in this PWS.

Contractor awardee may want to contact its legal advisor to provide itself more information.

FAR 52.222-41 and FAR 52.222-43 are included as clauses in this acquisition that will carry over to the BPA.

Wage determinations will be provided to the awardee based on the Contractor awardee’s proposed locations, as well as any updated ones as required per any exercised option.

The Contractor awardee will be responsible for ensuring that its personnel subject to the SCLS meet or exceed the corresponding minimum wages established by the Department of Labor (DoL) for the corresponding region (State/county) in which the call order is performed.

USDA will not be liable for any increased costs due to the Contractor awardee’s failure to identify

SCLS categories or failure to pay minimum wages established by DoL.

25. Attachments that are incorporated into this PWS

• PWS Attach 1_508 Compliance, Internet Protocol, EVM Reporting

• PWS Attach 2_Application Security Baseline Requirements_2023-06

• PWS Attach 3_Background Investigation Requirements - 2023-05

• PWS Attach 4_Conflict-of-Interest Disclosure-Form Contractor

• PWS Attach 5_Defect Management - Acceptance and Defect Rubric 1.2_2023-06

• PWS Attach 6_Deliverables-Schedule Pricing Example

• PWS Attach 7_Interconnection Security Agreement (ISA)_Department Template

SOP-3540-003D June 2022

• PWS Attach 8_Network Access Security Policy

• PWS Attach 9_Non-Disclosure Agreement

• PWS Attach 10_RD Memorandum of Understanding (MOU)_Template July 2022

• PWS Attach 11_Software Development Lifecycle SDLC Process Guide

• PWS Attach 12_USDA_Visual_Identity_V4-4_2022 - 2023-05

• PWS Attach 13_Letters by Folds – Master 06-27-23.

• PWS Attach 14_Letters to be Mailed or PDF to RD - 06-27-23.

• PWS Attach 15_AMS BPA – Sample Call Order 1

III. SCOPE OF WORK

1. General Scope

RD provides financial enterprise print and mail-handling services to the entire RD mission area, the St. Louis Farm Production and Conservation (FPAC) and other on-demand Federal agencies that are crucial to effective and efficient program delivery. RD and FPAC depend on these enterprise print and mail-handling services to produce and distribute financial and management reports, as well as loan servicing and customer notification correspondence for all program areas.

The RD Automated Mail Processing (AMP) is an enterprise print and mail-handling service that produces and distributes financial and management reports, as well as loan servicing and customer notification correspondence as outlined in the above paragraph. The volume of printed material is approximately 16 million images per year and supports an average of 380,000 pieces of metered mail per month.

The Contractor will be deemed as the full RD automated mail processing operations and other print shop operational services provider. The Contractor will be responsible for having a disaster recovery/business continuity plan and perform a disaster recovery test at least annually.

Other possible services are defined in the BPA in the tasks below. A Call order will be initiated based on the services required by RD.

2. General Requirements

Contractor shall demonstrate compatibility with USPS Intelligent Mail Barcode (IMB) requirements while incorporating the ability to provide high-volume print and mail services. The contractor shall use Government-provided templates, forms, fonts, Dynamic Job Descriptor Entry

(DJDE), and Postscript data streams as input into AMP. The Contractor must establish a secure site at the onsite printing location for RD staff to proof outgoing communications, if requested, and have a clearly established procedure for validation of documents. The contractor shall process/finish mail by sorting, folding, inserting into non-windowed envelopes; spray on addresses and return addresses; apply postage; and arrange for pickup or delivery of mail to USPS. The contractor must ensure processed mail enters the mail stream within the time-sensitive windows as defined is Call order and at the best postage rate available. The Contractor shall facilitate occasional oversight by representatives of the RD. if requested.

The Contractor must maintain the integrity of the RD IMB barcode.

The Contractor shall work with RD to establish secure connection between contractor and RD

(e.g., virtual private network (VPN), secure file transfer protocol (SFTP)).

With the performance of this contract, RD expects the contractor to meet the following objectives:

• Support of all file types (identified by IT including Mail Run Data File (MRDF) and flat files)

• Cut sheet and roll paper products

• 8½ X 11 and 8½ X 14 standard size

• Various optional sizes if identified (e.g., inserts to mailing)

• Multi-language printing

• Perforated paper, as requested

• Various envelope sizes and types

• Ability to spray on addresses (No windowed envelopes)

• Ability to include envelopes within mailing

• Half-fold and tri-fold product and flat products

• Reprints of product

• Multiple paper weight

• Inserts in various sizes and weights

• Forms/Letters

• Certified mail return receipt

The Contractor shall perform all mailings in an accurate manner in accordance with the delivery schedule defined in the Call order. The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract.

Materials

The Contractor shall furnish materials, such as 8 1/2 x 11, 20 lb. paper, perforated 24 lb. paper or colored paper, where applicable, toners, necessary office supplies, and other consumable materials as deemed necessary to fulfill the PWS. Pre-printed envelopes for jobs that require specific addresses or return addresses.

Equipment

The Contractor shall furnish high-volume printers, inserters, postage meters, mailing trays, containers, and other equipment necessary to meet the requirements under this PWS.

Responsibilities

The Contractor shall contact the RD COR, or other designated points of contact, when issues are identified involving file transmission and structure. Additionally, within 2 hours of identification of disruptions/problems that affect the Contractor's ability to meet performance standards, the Contractor should notify in writing the CO/COR and follow-up within 24 hours with an Incident Report.

The Contractor shall also notify in writing the appropriate CO and COR of any security issues

(including privacy act breaches) within four hours of occurrence and follow-up within 24 hours with an Incident Report (to include the resolution and associated time frame). In the event of a security breach, the Contractor shall cooperate with RD Security Staff by providing information, reports, and access, as deemed necessary to investigate. Failure to fully cooperate during an investigation could result in termination of the Contractor and/or Contract for default/cause.

Upon notification of any changes to future workload and print/mail changes to mail deliverables the Contractor shall coordinate contract changes with the CO and COR.

Additionally, the Contractor shall engage resources to discuss necessary requirements and perform QA testing with the applicable RD business area.

The Contractor shall establish a central email box for correspondence with the RD COR, RD business areas, and technical operations staff.

Provide Calendar Year End Support

Contractor will attend calendar year end planning meetings prior to CYE and be able to surge printing capabilities during the approximate two-month period. The Contractor must establish agreed to procedure for proofing and validation of documents.

Prepare Mail

The Contractor shall pre-sort mail for optimal discounts and print documents in compliance with industry standards for contrast and readability, utilize the correct IMB compliant fonts, and duplex format (two-sided). The Contractor shall inspect printed documents prior to preparing mail for distribution ensuring documents comply with the performance requirements listed in the Quality Assurance Plan (QASP). Mail with incomplete or invalid address information will be returned to the Government. The Contractor, in conjunction with the RD, will establish procedures for return. If the Contractor is requested to process any test prints of communications, the Government requires immediate destruction of communications to avoid accidental entry into the mail stream. Additionally, the Government requests that all test prints be processed on colored paper to make them immediately identifiable for destruction at test completion. The Contractor shall insert communications into appropriately marked envelopes utilizing an automated insertion process.

Present Mail to U.S. Postal Service

The Contractor shall present prepared mail to USPS, properly sorted, and ready for delivery within designated timeframe for each type of mail.

Destruction and Removal of Information

The Government requires that transmitted data files are properly discarded or erased 10 days after the data transmission files entered the mail stream. It is RD’s policy to destroy documents containing PII when no longer required. Documents containing PII must be placed in locked shredding containers, and documents containing PII Must Not be placed in recycle bins or trash receptacles.

Loss and/or Disclosure of Personally Identifiable Information (PII), Notification of Data

Breach

The Contractor shall be responsible for reporting all incidents involving the loss and/or disclosure of PII in electronic or physical form. A breach is defined as the "actual or possible loss of control, unauthorized disclosure, or unauthorized access of personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected."

In cases where a Contractor processes, stores, possesses, or otherwise handles the PII that is the subject of a data breach, any notification to individuals affected by the data breach must be coordinated promptly with USDA. No notification by the Contractor may proceed until the

Department has decided that notification would not impede law enforcement investigation or jeopardize national security. The method and content of any notification by the Contractor must be coordinated with, and is subject to the approval of, the Department.

Following the determination that a PII data breach has occurred, the Contractor shall provide complimentary credit monitoring and restoration services for its breach victim(s) for a period of one year following the date of the breach as a means of protecting against identity theft.

Any service offered should provide individuals with alerts to any changes in their credit, updated credit reports, ongoing monitoring, identity theft insurance, and access to fraud prevention experts.

The Contractor shall adhere to the reporting and response requirements set forth above and in accordance with the following document: OMB Memorandum M-07-16, "Safeguarding

Against and Responding to the Breach of Personally Identifiable Information," dated May 22, 2007.

Printed Reports

The Contractor shall deliver all printed reports to the St. Louis site within timeframe identified in the Call order.

Quality Control

The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall implement a Quality

Control Plan (QCP) to identify compliance with contract requirements, prevent defective services and ensure non-recurrence of poor or defective service. The QCP shall be submitted with the Contractor’s proposal to be reviewed as an evaluation factor. Subsequent changes to the comprehensive QCP will require submission of three copies to the CO and COR five working days in advance of the change. Emergency changes can be sought through a procedure established in collaboration with the Government and included in the QCP. After acceptance of the QCP, the Contractor shall receive the CO's acceptance in writing of any proposed change to his quality control system.

Quality Assurance

The government shall evaluate the Contractor's performance under this contract in accordance with BPA Deliverables/Schedule and Quality Assurance Plan. These exhibits describe what the Government must do to ensure the Contractor has performed in accordance with the performance standards, defining how the performance standards will be applied, the frequency of surveillance and the minimum acceptable defect rate(s).

The government will provide validation of modified communications prior to mail preparation.

At the government's discretion, representatives may be sent to the Contractor's facility to oversee the annual processes and perform spot checks and validations for specific mailings.

RD may also perform periodic on-site quality checks with no prior notice to the Contractor.

These site visits will consist of personnel and physical site security surveys to ensure the

Contractor is adhering to the requirements for handling and protecting sensitive information as well as programmatic service and quality reviews.

COR will establish meetings or conferences as necessary to review performance and ensure specific work requirements are accomplished.

USDA expects an adequate Project Team labor mix to be addressed in the BPA quote and at each resulting Call order.

If a team possesses additional skill sets that will be beneficial to RD, please explain how these skill sets will add value (e.g., by increasing efficiency, improving quality, reducing delivery times, and reducing cost).

3. Specific Requirements

Contractor may be requested to perform the following tasks:

Task 1 – Set Up and Validation of Secure File Transfer Protocol (SFTP) Bidirectional

Connection

The Contractor shall work with RD to develop and establish secure bidirectional connection between contractor and RD.

o In conjunction with the RD/Technology Office/Production Support Operations and

Cyber Security resources, Contractor shall document, develop, test, verify secure connection, and implement secure bidirectional connection between RD and Contractor that meets operability requirements of both RD and USA.

o The secure connection must comply with USDA security requirements and standards.

The Contractor shall execute an Interconnection Security Agreement (ISA) and/or Memorandum of Understanding (MOU) within 15 days of agreed secure connection design.

o The secure connection must comply with USDA security standards and requirements and be documented in the ISA.

o Contractor must review the ISA on an annual basis to verify accuracy, along with execution of a new ISA every 3 years.

The Contractor shall establish a central email box for correspondence with the RD CO/COR, RD business areas, and technical operations staff.

Task 2 – Perform Validation of Resources and Documents

The contractor shall work in conjunction with RD to load the RD resources (printer resources;

e.g., forms, fonts, Job Source Library (JSL), and templates) on their equipment and develop test cases to validate, document, and provide evidence for the following capabilities: print, insert, and have available for mailing test documents Contractor will provide evidence that all mail inserted would process at the appropriate mail postage rate (no actual mailings). RD and Contractor will develop a project plan, which will be requested as a deliverable in the Call order, to provide a schedule for validation of RD resources and output. Project Plan will be coordinated between the

Contractor and COR.

C…