IBM FBO RFP JUN 2012.pdf

TABLE OF CONTENTS

SECTION B SCHEDULE OF SUPPLIES

SECTION C. CONTRACT ADMINISTRATIVE DATA

SECTION D. CONTRACT CLAUSES

SECTION E ATTACHMENTS

OIT SECURITY ATTACHMENT

WAGE DETERMINATION

SECTION B SCHEDULE OF SUPPLIES

Part number

BASE YEAR

IBM SUBSCRIPTION AND SUPPORT SERVICES

PERIOD OF PERFORMANCE 6/30/2012-6/30/2013

*Quantity (RVU/Device)

UNIT

PRICE

BASE YR

EXTENDED

PRICE

D0HSILL

IBM Tivoli Endpoint Manager for Lifecycle Management Client Device License + SW Subscription & Support 12 Months

600 $________ $_________

D0HSGLL

Management Resource Value Unit License + SW Subscription & Support 12 Months

240 $________ $_________

D0HSVLL

IBM Tivoli Endpoint Manager for Power Management Client Device License + SW Subscription & Support 12 Months

D0HSMLL

IBM Tivoli Endpoint Manager for Software Use Analysis Client Device License + SW Subscription & Support 12 Months

D0HSKLL

Analysis Resource Value Unit License + SW Subscription & Support 12 Months

D0HSZLL

IBM Tivoli Endpoint Manager for Security & Compliance Client Device License + SW Subscription & Support 12 Months

D0HSXLL

Compliance Resource Value Unit License + SW Subscription & Support 12 Months

BASE YEAR TOTAL PRICE $___________

OPTION PERIOD 1 TOTAL PRICE $______________

Part number

OPTION YEAR ONE

IBM SUBSCRIPTION AND SUPPORT SERVICES

PERIOD OF PERFORMANCE 6/30/2013-6/30/2014

*Quantity

(RVU/Device)

UNIT

PRICE

OPTION

PERIOD 1

EXTENDED

E0BDDLL

IBM Tivoli Endpoint Manager for Lifecycle Management Client Device Annual SW Subscription & Support Renewal

E0BDCLL

Resource Value Unit Annual SW Subscription & Support

E0BDJLL

IBM Tivoli Endpoint Manager for Power Management

E0BDFLL

IBM Tivoli Endpoint Manager for Software Use Analysis

E0BDELL

Renewal

E0BDLLL

IBM Tivoli Endpoint Manager for Security & Compliance

E0BDKLL

IBM Tivoli Endpoint Manager for Security & Compliance

SECTION B SCHEDULE OF SUPPLIES CONTINUED

OPTION YEAR TWO

IBM SUBSCRIPTION AND SUPPORT SERVICES

PERIOD OF PERFORMANCE 6/30/2014-6/30/2015

*Quantity (RVU/Device)

UNIT

OPTION

PERIOD 2

EXTENDED

Resource Value Unit Annual SW Subscription & Support Renewal

Resource Value Unit Annual SW Subscription &

Compliance Client Device Annual SW Subscription &

Compliance Resource Value Unit Annual SW Subscription & Support Renewal

OPTION PERIOD 2 TOTAL PRICE $______________

OPTION YEAR THREE

IBM SUBSCRIPTION AND SUPPORT SERVICES

PERIOD OF PERFORMANCE 6/30/2015-6/30/2016

*Quantity (RVU/Device)

UNIT

PRICE

OPTION 3

EXTENDED

Management Client Device Annual SW Subscription &

Management Resource Value Unit Annual SW

Analysis Client Device Annual SW Subscription &

Analysis Resource Value Unit Annual SW Subscription & Support Renewal

Compliance Client Device Annual SW Subscription &

Compliance Resource Value Unit Annual SW

OPTION PERIOD 3 TOTAL PRICE $0.00

SECTION C. CONTRACT ADMINISTRATIVE DATA

The Government intends to award a single multiyear fixed price contract. The award shall be provided to a responsible responsive offeror whose proposal provides the Government the lowest price and is technically acceptable.

The Offerors should structure and calculate their proposals so the costs are paid by the Government the first three years of the contract; and there are no remaining costs to the Government the fourth year.

INVOICING

a. Invoices shall be submitted on a net 30 payment basis upon the completion of all services or the delivery of all items required by the contract or order. For contracts or orders requiring services or the delivery of items over several months, the contractor shall invoice on a monthly basis. All official invoices must be sent directly to the PSA Office of Financial Management (OFM). Invoices sent to locations or individuals other than OFM are not considered officially received until actually received and date stamped by OFM. Hard copy invoices shall be submitted only to the address below;

Pretrial Services Agency for the District of Columbia

Office of Financial Management Attn: Accounts Payable

633 Indiana Ave, NW, Suite 1100 Washington DC 20004-2902

b. The contractor may also submit an official invoice electronic email to the following email address:

KEVIN.WILLIAMS@PSA.GOV

c. The following information must be contained on the invoice:

1. Contractor Tax Identification Number

2. Contractor Mailing Address

3. Contractor Phone Number

4. Date of Invoice

5. Contractor Invoice Number

6. PSA Contract / Order Number (important)

7. PSA Contract Line item Number (CLIN) or item number (if applicable)

8. Description of services performed for or merchandise provided to PSA

9. Date(s) of services performed or merchandise provided to PSA

d. The contractor invoice must identify the specific Contract Line Item Number (CLIN) or item number for which the contractor is seeking payment under the contract or order. If the invoice covers multiple CLIN or item numbers, the invoice must identify specific amounts and activity applicable to each.

e. PSA is bound by the Prompt Payment Act (5 CFR Part 1315) to reimburse vendors on the 30th calendar day after a proper and valid invoice is officially received by the Agency. Invoices submitted without required information are not considered proper. If the invoice is disputed / rejected by PSA, the Contracting Officer Technical Representative (COTR) appointed to the contract or order will notify the mailto:KEVIN.WILLIAMS@PSA.GOV contractor of the dispute within seven (7) calendar days of the PSA invoice receipt date. The COTR’s dispute / rejection notice will identify the specific invoice items and amounts being disputed, reason the items or amounts are disputed, a reference to the specific terms of the contract which supports the government’s dispute and a request for an immediate explanation and / or corrected invoice. Properly disputed invoice amounts are not subject to late payment interest computations during the period of dispute.

f. Contractor inquiries concerning an invoice payment may be made to the COTR at any time or to OFM thirty (30) calendar days after a proper invoice has been submitted. The contractor may make payment inquiries to the OFM email address identified above in paragraph (b) or to Natalie Burgess, Contracting Officer, 202-220-5647.

g. Contractors must inform OFM of any changes in banking information using the OFM email address identified above in paragraph (b) or to Natalie Burgess, Contracting Officer, by calling 202-220-5647.

SECTION D. CONTRACT CLAUSES

I.1 52.212-4 CONTRACT TERMS AND CONDITIONS - COMMERCIAL ITEMS

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or performance of nonconforming services at no increase in contract price. The Government must exercise its post-acceptance rights-

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Government wide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to the Contract Disputes Act of 1978, as amended (41 U.S.C. 601-613).

Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice.

(1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice must include-

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Contract number, contract line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice; and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer-Central Contractor Registration, or 52.232-34, Payment by Electronic Funds Transfer-Other Than Central Contractor Registration), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR part 1315

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract. The Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and OMB prompt payment regulations at 5 CFR part 1315. In connection with any discount offered for early payment, time shall be computed from the date of the invoice.

For the purpose of computing the discount earned, payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall immediately notify the Contracting Officer and request instructions for disposition of the overpayment.

(j) Risk of loss. Unless the contract specifically provides otherwise, risk of loss or damage to the supplies provided under this contract shall remain with the Contractor until, and shall pass to the Government upon:

(1) Delivery of the supplies to a carrier, if transportation is f.o.b. origin; or

(2) Delivery of the supplies to the Government at the destination specified in the contract, if transportation is f.o.b. destination.

(k) Taxes. The contract price includes all applicable Federal, State, and local taxes and duties.

(l) Termination for the Government's convenience. The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience. In the event of such termination, the Contractor shall immediately stop all work hereunder and shall immediately cause any and all of its suppliers and subcontractors to cease work. Subject to the terms of this contract, the Contractor shall be paid a percentage of the contract price reflecting the percentage of the work performed prior to the notice of termination, plus reasonable charges the

Contractor can demonstrate to the satisfaction of the Government using its standard record keeping system, have resulted from the termination. The Contractor shall not be required to comply with the cost accounting standards or contract cost principles for this purpose. This paragraph does not give the Government any right to audit the Contractor's records. The Contractor shall not be paid for any work performed or costs incurred which reasonably could have been avoided.

(m) Termination for cause. The Government may terminate this contract, or any part hereof, for cause in the event of any default by the Contractor, or if the Contractor fails to comply with any contract terms and conditions, or fails to provide the Government, upon request, with adequate assurances of future performance.

In the event of termination for cause, the Government shall not be liable to the Contractor for any amount for supplies or services not accepted, and the Contractor shall be liable to the Government for any and all rights and remedies provided by law. If it is determined that the Government improperly terminated this contract for default, such termination shall be deemed a termination for convenience.

(n) Title. Unless specified elsewhere in this contract, title to items furnished under this contract shall pass to the Government upon acceptance, regardless of when or where the Government takes physical possession.

(o) Warranty. The Contractor warrants and implies that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract.

(p) Limitation of liability. Except as otherwise provided by an express warranty, the Contractor will not be liable to the Government for consequential damages resulting from any defect or deficiencies in accepted items in performance of the contract.

(q) Other compliances. The Contractor shall comply with all applicable Federal, State and local laws, executive orders, rules and regulations applicable to its performance under this contract.

(r) Compliance with laws unique to Government contracts. The Contractor agrees to comply with 31 U.S.C.

1352 relating to limitations on the use of appropriated funds to influence certain Federal contracts; 18 U.S.C.

431 relating to officials not to benefit; 40 U.S.C. 327, et seq., Contract Work Hours and Safety Standards Act;

41 U.S.C. 51-58, Anti-Kickback Act of 1986; 41 U.S.C. 265 and 10 U.S.C. 2409 relating to whistleblower protections; 49 U.S.C. 40118, Fly American; and 41 U.S.C. 423 relating to procurement integrity.

(s) Order of precedence. Any inconsistencies in this solicitation or contract shall be resolved by giving precedence in the following order:

(1) The schedule of supplies/services.

(2) The Assignments, Disputes, Payments, Invoice, Other Compliances, and Compliance with Laws Unique to Government Contracts paragraphs of this clause.

(3) The clause at 52.212-5.

(4) Addenda to this solicitation or contract, including any license agreements for computer software.

(5) Solicitation provisions if this is a solicitation.

(6) Other paragraphs of this clause.

(7) The Standard Form 1449.

(8) Other documents, exhibits, and attachments.

(9) The specification.

(t) Central Contractor Registration (CCR). Contractors and Contractors may obtain information on registration and annual confirmation requirements via the internet at http://www.ccr.gov or by calling 1-888- 227-2423 or 269-961-5757.

I.2 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—

Commercial Items. (Aug 2011)

The following contract clauses pertinent to this section are hereby incorporated by reference (by Citation Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" in Section I of this contract. See FAR 52.252-2 for an internet address (if specified) for electronic access to the full text of a clause.

NUMBER TITLE DATE

52.202-1 DEFINITIONS DEC 2001

52.203-3 GRATUITIES APR 1984

52.203-5 COVENANT AGAINST CONTINGENT FEES APR 1984

52.203-6 RESTRICTIONS ON SUBCONTRACTOR SALES TO JUL 1995

THE GOVERNMENT

52.203-7 ANTI-KICKBACK PROCEDURES JUL 1995

52.203-8 CANCELLATION, RESCISSION, AND RECOVERY JAN 1997

OF FUNDS FOR ILLEGAL OR IMPROPER ACTIVITY

52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR JAN 1997

IMPROPER ACTIVITY

52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE JUN 1997

CERTAIN FEDERAL TRANSACTIONS

52.204-4 PRINTED OR COPIED DOUBLE-SIDED AUG 2000

ON RECYCLED PAPER

52.209-6 PROTECTING THE GOVERNMENT'S INTEREST JUL 1995

WHEN SUBCONTRACTING WITH CONTRACTORS

DEBARRED, SUSPENDED, OR PROPOSED FOR

DEBARMENT

52.211-5 MATERIAL REQUIREMENTS AUG 2000

52.215-2 AUDIT AND RECORDS--NEGOTIATION JUN 1999

52.215-8 ORDER OF PRECEDENCE--UNIFORM CONTRACT OCT 1997

FORMAT

52.216-22 INDEFINITE QUANTITY OCT 1995

52.217-8 OPTION TO EXTEND SERVICES NOV 1999

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT MAR 2000

52.215-14 INTEGRITY OF UNIT PRICES OCT 1997

52.222-1 NOTICE TO THE GOVERNMENT OF LABOR FEB 1997

DISPUTES

52.222-19 CHILD LABOR - COOPERATION WITH DEC 2001

AUTHORITIES AND REMEDIES

52.222-20 WALSH-HEALEY PUBLIC CONTRACTS ACT DEC 1996

52.222-21 PROHIBITION OF SEGREGATED FACILITIES FEB 1999

52.222-26 EQUAL OPPORTUNITY FEB 1999

52.222-35 EQUAL OPPORTUNITY FOR SPECIAL DISABLED DEC 2001

VETERANS, OF THE VIETNAM ERA, AND OTHER

ELIGIBLE VETERANS

52.222-36 AFFIRMATIVE ACTION FOR WORKERS WITH JUN 1998

DISABILITIES

52.222-37 EMPLOYMENT REPORTS ON SPECIAL DISABLED DEC 2001

VETERANS, VETERANS OF THE VIETNAM ERA,

AND OTHER ELIGIBLE VETERANS

52.222-38 COMPLIANCE WITH VETERANS' EMPLOYMENT DEC 2001

REPORTING REQUIREMENTS

52.223-6 DRUG-FREE WORKPLACE MAY 2001

52.225-13 RESTRICTIONS ON CERTAIN FOREIGN JUL 2000

PURCHASES

52.227-1 AUTHORIZATION AND CONSENT JUL 1995

52.227-2 NOTICE AND ASSISTANCE REGARDING PATENT AUG 1996

AND COPYRIGHT INFRINGEMENT

52.227-14 RIGHTS IN DATA--GENERAL JUN 1987

52.232-7 PAYMENTS UNDER TIME-AND-MATERIALS AND FEB 2002

LABOR-HOUR CONTRACTS

52.232-17 INTEREST JUN 1996

52.232-23 ASSIGNMENT OF CLAIMS JAN 1986

52.232-33 PAYMENT BY ELECTRONIC FUNDS--CENTRAL MAY 1999

CONTRACTOR REGISTRATION

52.233-1 DISPUTES DEC 1998

52.233-3 PROTEST AFTER AWARD AUG 1996

52.242-1 NOTICE OF INTENT TO DISALLOW COSTS APR 1984

52.242-3 PENALTIES FOR UNALLOWABLE COSTS MAY 2001

52.242-13 BANKRUPTCY JUL 1995

52.246-2 INSPECTION OF SUPPLIES—FIXED PRICE AUG 1996

52.246-4 INSPECTION OF SERVICES—FIXED-PRICE AUG 1996

52.244-6 SUBCONTRACTS FOR COMMERCIAL ITEMS DEC 2001

52.246-23 LIMITATION OF LIABILITY FEB 1997

52.246-25 LIMITATION OF LIABILITY--SERVICES FEB 1997

52.247-34 F.O.B. DESTINATION NOV 1991

52.249-14 EXCUSABLE DELAYS APR 1984

52.249-2 TERMINATION FOR CONVENIENCE APR 2012

52.249-8 DEFAULT (FIXED-PRICE SUPPLY AND SERVICE) APR 1984

52.253-1 COMPUTER GENERATED FORMS JAN 1991

(End of clauses)

SECTION E ATTACHMENTS

OIT SECURITY ATTACHMENT

WAGE DETERMINATION

Pretrial Services Agency for the D.C.

Office of Information Technology (OIT)

System Development and IT Security Team

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 1 -

Table of Contents

1. INTRODUCTION

1.1. BACKGROUND

Personnel

ADMINISTRATIVE MATTERS

1.2. SECURITY

1.3. CONFIDENTIAL TREATMENT OF SENSITIVE INFORMATION

2. OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS

2.1. ENVIRONMENT AND TOOLS

2.2. SECTION 508 COMPLIANCE STATEMENT

2.3. INFORMATION EXCHANGE AND RIGHTS TO DATA OR FEDERALLY DEVELOPED SYSTEM

2.4. RECORDS MANAGEMENT

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 2 -

1. Introduction

1.1. Background

The D.C. Pretrial Services Agency (PSA) is an independent entity within the Court Services and Offender Supervision Agency (CSOSA) in the Executive Branch of the Federal government.

PSA has served the District of Columbia for more than 40 years and is widely recognized as a leader in the pretrial field. PSA’s mission is to assess, supervise and provide services for defendants, and collaborate with the justice community, to assist the courts in making pretrial release decisions. The agency promotes community safety and return to court while honoring the constitutional presumption of innocence.

PSA plays a vital role in the District of Columbia’s criminal justice system. The Agencies vision is to thrive as a leader within the justice system by developing an empowered workforce that embodies integrity, excellence, accountability, and innovation in the delivery of the highest quality services. PSA gathers and presents information about newly arrested defendants and about available release options for use by judicial officers in deciding what, if any, conditions are to be set for released defendants (the diagnostic function). Additionally, PSA supervises defendants released from custody during the pretrial period by monitoring their compliance with conditions of release and by helping to ensure that they appear for scheduled court hearings.

PSA supervision gives the defendants the opportunity to participate in a variety of pro-social interventions that decrease the likelihood of future criminal behavior (the supervision and treatment functions).

The mission of the Office of Information Technology (OIT) is to support PSA’s automation objectives in a reliable, timely, and cost-effective manner, providing access to the state-of-the-art technology and assisting staff in achieving their mission and realizing their strategic goals.

Our vision is to be an advisor and provide sound technical solutions to PSA management, PSA staff, the justice community, our clients, and the public.

Personnel

The contractor shall provide fully qualified personnel, skilled in the necessary computer system environments and tools described in this PWS. The contractor shall also ensure that technical contractors and subcontractors have experience developing applications using the tools listed in the section titled “Environment and Tools” in this PWS.

The contractor shall be responsible for the compliance with all Federal laws and regulations affecting software development projects. The contractor shall be responsible for the staffing and management of all contractor employees. Unscheduled employee absences shall be covered by the contractor at no additional cost to the government and at no decrease in contract performance.

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 3 -

Administrative Matters

1.2. Security

PSA mission critical systems require information assurance controls to be in place as prescribed by the Federal Information Security Management Act of 2002 (FISMA) Title III, E-Government Act of 2002, PL No. 107-347 (Dec. 17, 2002); http://csrc.nist.gov/drivers/documents/FISMA-final.pdf. FISMA and OMB policy require external providers handling federal information or operating information systems on behalf of the federal government to meet the same security requirements as federal agencies. PSA requires external providers to implement all steps in the Risk Management Framework (RMF) with the exception of the security authorization, which remains an inherent federal responsibility.

According to NIST publication 800-37, revision 1, dated February 2010 “Guide for Applying the Risk Management Framework to Federal Information Systems” Appendix H, the RMF applies to federal information systems in two distinct types of operational scenarios:

• Information systems used or operated by federal agencies; and

• Information systems used or operated by other organizations on behalf of federal agencies.

Systems whether developed, and/or housed internally, or are in force via a service provider must be secure and the agency must have a level of confidence and assurance that risk to people and the ability to perform PSA’s mission, is minimized. Two mandatory security standards FIPS-199, "Standards for Security Categorization of Federal Information and Information Systems," dated February 2004 and FIPS-200, "Minimum Security Requirements for Federal Information and Information Systems," dated March 2006 are available at the NIST Computer Security Division website (http://csrc.nist.gov/publications/PubsFIPS.html).

This Performance Work Statement (PWS) requires the contractor to (1) develop, (2) have the ability to access, or (3) host and/or maintain a Federal information system(s). Pursuant to Federal and PSA Security Program Policies, the contractor and any subcontractor performing under this contract shall comply with the following requirements:

The PSA Global Information Technology Security Policy statement # 5500 establishes the agency’s commitment to require and ensure business and mission critical systems accomplish the security-related objectives of FISMA and to adequately protect these systems from compromise to the confidentiality, integrity, and availability of the agency's systems and information.

a. Information Type

[ ] Administrative, Management and Support Information:

[X] Mission Based Information:

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://csrc.nist.gov/publications/PubsFIPS.html

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 4 -

b. Security Categories and Levels Confidentiality Level: [x ] Low [ ] Moderate [ ] High Integrity Level: [x ] Low [ ] Moderate [ ] High Availability Level: [x ] Low [ ] Moderate [ ] High Overall Level: [x ] Low [ ] Moderate [ ] High

c. Position Sensitivity Designations

At the discretion of the PSA Office of IT Security, all Contractor personnel are subject to a Government background investigation. The intent and purpose of the background investigation is to preclude the assignment of any individual who poses a threat to the Government or successful work completion due to past unlawful or inappropriate behavior. Contractor personnel must be U.S. citizens, or be lawfully permitted to reside in the United States and possess a valid work permit. Background investigations may be required prior to performance under this contract.

(1) The following position sensitivity designations and associated clearance and investigation requirements apply under this contract. N/A

[ ] Level 6: Public Trust - High Risk (Requires Suitability Determination with a BI).

Contractor employees assigned to a Level 6 position are subject to a Background Investigation (BI).

[ ] Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI). Contractor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non Sensitive (Requires Suitability Determination with an NACI).

Contractor employees assigned to a Level 1 position are subject to a National Agency Check and Inquiry Investigation (NACI).

(2) The contractor shall submit a roster, by name, position and responsibility, of all staff

(including subcontractor staff) working under the contract who will develop, have the ability to access, or host and/or maintain a Federal information system(s). The roster shall be submitted to the COTR, with a copy to the Contracting Officer, within 5 calendar days of the effective date of the contract –AND– at least 10 calendar days before beginning any work on the project. Any revisions to the roster as a result of staffing changes shall be submitted within 5 calendar days of the change. The Contracting Officer shall notify the contractor of the appropriate level of suitability investigations to be performed. An electronic template, "Roster of Employees Requiring Suitability Investigations," is attached to this PWS as PSA-Security- Suitability-Roster.xls as required by Human Resources.

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 5 -

According to PSA policy statement # 4060, dated 9/20/2005 PSA will ensure identity proofing and perform a preliminary background check on all contractors and consultants before they begin work. This check, covering law enforcement databases, fingerprint records and security checks with OPM and the Department of Defense, will be conducted and any derogatory information resolved before the individual starts working for the Agency.

(3) PSA will initiate through OPM a background investigation on each contractor and consultant within 14 days of his/her beginning work. The level of the investigation will be commensurate with the sensitivity level of the employee’s position.

(4) Contractor shall have a background check policy to ensure applicants and employees undergo a security screening in order to be gainfully employed with the company.

d. Information Security Training

(1) PSA policy requires contractors/subcontractors receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements. The contractor shall ensure that each local contractor/subcontractor employee has completed the CSOSA/PSA Computer Security Awareness Training within 20 calendar days of beginning work in the project.

The contractor shall maintain a listing by name and title of each contractor/subcontractor employee working under this contract that has completed the required training. Any additional security training completed by contractor/subcontractor staff shall be included on this listing. The listing of completed training shall be included in the first technical progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required technical progress report

(2) All contractors/subcontractors shall have been trained in securing and protecting sensitive law enforcement information before commencing operations.

e. Rules of Behavior

The contractor/subcontractor employees shall comply with the “Rules of behavior for PRISM” as provided by Human Resources.

f. Personnel Security Responsibilities

The contractor shall perform and document the actions identified in the "Employee Separation Checklist" as required by Human Resources, when a contractor/subcontractor employee terminates work under this contract. All

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 6 -documentation shall be made available to the COTR and/or Contracting Officer upon request.

g. Commitment to Protect Non-Public Departmental Information Systems and Data

(1) Contractor Agreement

The Contractor and its subcontractors performing under this PWS shall not release, publish, or disclose non-public Agency information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

□ 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

□ 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

□ Public Law 96-511 (Paperwork Reduction Act)

(2) Contractor-Employee Non-Disclosure Agreements

Each contractor/subcontractor employee who may have access to non-public agency information under this contract shall complete the “Contractor Employee Non- Disclosure Agreement” attached as PSA-Security-Non-Disclosure.doc (Attachment 11). A copy of each signed and witnessed agreement shall be submitted to the COTR prior to performing any work under the contract as required by Human Resources.

h. Prospective Offeror Non-Disclosure Agreement

If a prospective offeror, in order to prepare an offer, needs access to information the Government has determined to be sensitive follow this procedure. In other words, to be considered for access to sensitive Federal information, a prospective offeror must:

(a) Submit a written request to the Contracting Officer identified in the solicitation;

(b) Receive written approval from the Contracting Officer.

Any individual having access to this information must possess a valid and current suitability determination at the following level:

[ ] Level 6: Public Trust - High Risk [X] Level 5: Public Trust - Moderate Risk

Prospective offerors are required to process their requests for access, receive Government approval, and then access the sensitive Federal information within the period of time provided in the solicitation for the preparation of offers.

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 7 -

Nothing in this provision shall be construed, in any manner, by a prospective offeror as an extension to the stated date, time, and location in the solicitation for the submission of offers.

i. Security References

(1) Federal Information Security Management Act of 2002 (FISMA), Title III, E- Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002):

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

(2) NIST Special Publication 800-16, Information Technology Security Training Requirements: http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf Appendix A-D: http://csrc.nist.gov/publications/nistpubs/800-16/AppendixA-D.pdf

(3) NIST SP 800-18, Guide for Developing Security Plans for Information Technology Systems: http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

(4) NIST SP 800-53, Recommended Security Controls for Federal Information Systems: http://csrc.nist.gov/publications/drafts/800-53/800-53-rev3-FPD-clean.pdf

(5) NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, Volume I: http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf; Volume II, Appendices to Guide For Mapping Types of Information and Information Systems To Security Categories, Appendix C at: http://csrc.nist.gov/publications/nistpubs/800-60/SP800-60V2-final.pdf and Appendix D at: http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800- 60_Vol2-Rev1.pdf

(6) NIST SP 800-64, Security Considerations in the Information System Development Life Cycle: http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64- Revision2.pdf

(7) FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

(8) FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems: http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

1.3. Confidential Treatment of Sensitive Information

The Contractor shall guarantee strict confidentiality of the information/data that it is provided by the Government during the performance of the contract. The Government has determined that the information/data that the Contractor will be provided during the performance of the contract is of a sensitive nature.

Disclosure of the information/data, in whole or in part, by the Contractor can only be made after the Contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the contract, the Contractor shall obtain a written determination from the Contracting Officer.

http://csrc.nist.gov/publications/nistpubs/800-16/800-16.pdf http://csrc.nist.gov/publications/nistpubs/800-16/AppendixA-D.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf http://csrc.nist.gov/publications/drafts/800-53/800-53-rev3-FPD-clean.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol1-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60/SP800-60V2-final.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 8 -

2. Other Pertinent Information or Special Considerations

2.1. Environment and Tools

The contractor shall use the PSA .NET Core Enterprise Library - .Net Library and follow the PSA .NET Coding Standards & Best Practices document guidelines. In addition, the contractor shall make sure all technical contractors and subcontractors have experience developing .NET applications using the following tools and technologies:”

Environment

□ MS Windows Windows 7 and Server 2008

□ MS Internet Explorer IE 8.0

□ <list more if needed>

Tools

□ MS Visual Studio 2010

□ NIEM – National Information Exchange Model, which absorbed/replaced Global

JXDM (Global Justice XML Data Model version 3.0.3) shall be used over XML/XLST.

However, if authorized XML/XLST may be used.

□ SQL Server 2010

□ <list more if needed>

The government reserves the right to upgrade to a newer version of the tools and technologies listed above. The government will do so in consultation with the contractor.

2.2. Section 508 Compliance Statement

The software shall be developed to comply with section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d). Section-508 compliance shall apply to any screen or report, modified or added by this effort. In other words, any screen or report touched by this effort shall be written for Section 508 compliance. The contractor shall provide a written Section-508 certification during product acceptance stating the system’s compliance. The system shall conform to the technical standards put forth in Subpart B of such section.

§ 1194.22 Web-based intranet and Internet information and applications.

The purpose of this law states: “Section 508 requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.”

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 9 -

For more information visit http://www.access-board.gov/

2.3. Information exchange and rights to Data or Federally developed system

The federal government will have sole rights to all versions of the project in all its versions and documentation. Any use of outside this project shall be authorized in writing by the government.

Pursuant section § 23-1303(h), “Interviews with detainees; investigations and reports;

information as confidential; consideration and use of reports in making bail determinations” of the PSA statute the agency shall:

• supervise all persons released on nonsurety release, including release on personal recognizance, personal bond, nonfinancial conditions, or cash deposit or percentage deposit with the registry of the court;

• inform the judicial officer and the United States attorney for the District of Columbia or the Corporation Counsel of the District of Columbia of any failure to comply with pretrial release conditions or the arrest of persons released under its supervision and recommend modifications of release conditions when appropriate;

PSA, as a law enforcement agency, is charged with supervising defendants and reporting to the court any failure to comply with pretrial release conditions. Sharing information is part of the agency’s mission. The contractor shall provide flexible and secure information sharing (IS) infrastructure for the electronic exchange of data captured in its system.

PSA has successfully employed the use of secure web services and must have the ability to integrate data within its client management system (CMS) PRISM. The vendor shall provide existing secure web services to exchange data in real or near-real time with the agency. The data model shall be flexible enough to accommodate supplemental data coming from and to PSA. The data exchange shall be XML based or National Information Exchange Model (NIEM) compliant.

2.4. Records Management

In accordance to records management policy the following pertinent laws, codes and regulations; 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552);

Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228. In addition:

a) Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

b) Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

http://www.access-board.gov/

M:\SECURITY\OIT SECURITY ATTACHMENT.doc - 10 -

c) Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

d) Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

e) The Government Agency owns the rights to all data/records produced as part of this contract.

f) The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

g) Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

h) No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

i) Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

WAGE DETERMINATION MAY 2012