GSA_QMAE-EV-180001-D_Solicitation_06_07_2018.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

1. REQUISITION NUMBER PAGE 1 OF

2. CONTRACT NO. 3. AWARD/EFFECTIVE

DATE

4. ORDER NUMBER 5. 6.

7. FOR SOLICITATION

INFORMATION CALL:

a. b. TELEPHONE NUMBER (No collect 8. OFFER DUE DATE/

9. ISSUED BY

13b. RATING

14. METHOD OF SOLICITATION

CODE

15. DELIVER TO 16. ADMINISTERED BY CODE

18a. PAYMENT WILL BE MADE BY CODE17a. CONTRACTOR/

OFFEROR

CODE

FACILITY

CODE

CODE

TELEPHONE NO.

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN

OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK

BELOW IS CHECKED

RFQ IFB RFP

SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

29. AWARD OF CONTRACT: REF. OFFER

DATED . . YOUR OFFER ON SOLICITATION

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR

30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA - FAR (48 CFR) 53.212

10. THIS ACQUISITION IS UNRESTRICTED OR

NAICS:

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

SET ASIDE: % FOR:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

ARE ARE NOT ATTACHED

ARE ARE NOT ATTACHED

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

8 (A)

EDWOSB

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SMALL BUSINESS

SOLICITATION NUMBER

QMAE-EV-180001-D

NAME

Eric VanderVeen, Contracting Officer eric.vanderveen@gsa.gov calls)

NET 30 DAYS

SAME AS BLOCK 9

ELECTRONIC MAINTENANCE AND

REPAIR AUTHORIZATION SYSTEM

(EMRAS)

one (1) è

811198

SIZE STANDARD:

$7.5M è è è è

SOLICITATION ISSUE

DATE

06/07/2018

LOCAL TIME

06/19/2018 2:00pm ET

U.S. GENERAL SERVICES ADMINISTRATION

MEDIUM & HEAVY VEHICLES BRANCH (QMAAB)

1800 F STREET NW

WASHINGTON, DC 20405

è

202-394-2799

SEE STATEMENT OF WORK (SOW)

GSA Federal Acquisition Service

June 7, 2018

Dear Prospective Offeror:

The General Services Administration (GSA) appreciates your interest in Solicitation Number QMAE-EV-180001-D for an Electronic Maintenance and Repair Authorization System (EMRAS) for a base period of one (1) year, with four (4), one-year option periods. Please pay particular attention to Section 4 as hard copy proposals are not required and will not be accepted.

This solicitation is being released via the Government-wide Point of Entry located via the FedBizOpps site at www.fbo.gov. In order to conduct this acquisition most effectively, all notices and postings will be made at this location. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-95 effective January 13, 2017. Please be aware that the solicitation, questions and answers, comments or any other information will not be disseminated in any other format.

Offerors are encouraged to submit a complete offer. Offerors should propose their best price with their initial offer, as it is GSA’s goal to award without discussions. Note that substantially incomplete offers will be rejected.

NOTE: Pursuant to FAR 2.101, “day” means, unless otherwise specified, a calendar day in all references throughout this solicitation.

Should you have any questions, please contact me at 202-394-2799 or eric.vanderveen@gsa.gov.

I look forward to receiving your proposal!

Sincerely, Eric VanderVeen Contracting Officer Medium and Heavy Duty Vehicles Branch (QMAAB) http://www.fbo.gov/ mailto:eric.vanderveen@gsa.gov

SOLICITATION QMAE-EV-180001-D

GENERAL INFORMATION

PLEASE READ THE SOLICITATION IN ITS ENTIRETY AND FOLLOW ALL

INSTRUCTIONS.

SOLICITATION NUMBER: QMAE-EV-180001-D

SET ASIDE STATUS: Unrestricted

CONTRACTING OFFICE ADDRESS: General Services Administration

Federal Acquisition Service Medium and Heavy Vehicles (QMAAB) 1800 F Street NW, Floor 3 Washington, DC 20405

PSC GROUP: 70

PRODUCT: General purpose information technology equipment

NAICS: 811198 - All Other Automotive Repair and Maintenance

PERIOD OF

PERFORMANCE: The performance period of this contract will be one (1) year with the potential of four (4) one-year options for a total of five (5) years, inclusive of all options.

Base Period: Date of Award (DOA) – 12 Months after DOA

(Exact dates to be determined at time of award) Option Period I: Month 13 – Month 24

(Exact dates to be determined at time of award) Option Period II: Month 25 – Month 36

(Exact dates to be determined at time of award) Option Period III: Month 37 – Month 48

(Exact dates to be determined at time of award) Option Period IV: Month 49 – Month 60

(Exact dates to be determined at time of award)

CP-FSS-3 NOTICE: REQUESTS FOR EXPLANATION OR INFORMATION

(MAR 1996)

Oral or written requests for explanation or information regarding this solicitation should be directed to:

U.S. GENERAL SERVICES ADMINISTRATION

Medium and Heavy Vehicles Branch (QMAAB) eric.vanderveen@gsa.gov with a carbon copy to amanda.vance@gsa.gov mailto:amanda.vance@gsa.gov

CP-FSS-4-A SOLICITATION COPIES (MAR 1996)

In order to conduct this procurement most effectively and at the lowest costs, all information – including the solicitation, solicitation amendments, and any comments – will be posted only via the Internet at: http://www.fbo.gov.

CONTRACT ADMINISTRATION INFORMATION

POINTS OF CONTACT---

Contracting Officer: Eric VanderVeen

GSA/FAS/QMAAB

1800 F St, NW

(202) 394-2799 or eric.vanderveen@gsa.gov

Contracting Specialist: Amanda Vance

GSA/FAS/QMAAB

1800 F St, NW

(202) 969-7212 or amanda.vance@gsa.gov

Administrative Contracting Officer: TBD at contract award

Contracting Officer's Representative (COR): TBD at contract award http://www.fbo.gov/ mailto:amanda.vance@gsa.gov

SECTION 1 – PRICING/SCHEDULE OF ITEMS

PRICING

Commercial pricing structures are desired to the maximum extent practicable. Offerors are encouraged to provide their best pricing up-front, to include any and all discounts offered to the Government. Offerors must refer to Section 2 for a complete description of the Statement of Work (SOW) and Section 4 for submission instructions.

Understanding that there may be cost implications for the provision of the sought after services depending upon the nature of the maintenance and repair service provider’s structure and/or national footprint, pricing is sought for two (2) distinct Contract Line Items (CLINs):

EMRAS – National Account Transactions – transactions involving service providers that are national/regional (multi-store) in size EMRAS – Independent Account Transactions – transactions involving service providers that are single entity operations

SCHEDULE OF ITEM(S)

Base Period: Date of Award (DOA) – 12 Months after DOA (Exact dates to be determined at time of award)

CLIN

No.

Description Units Unit of

Measure Unit Price

GSA

Discount (%)

Total Price

0001 EMRAS-National Account Transactions

12 Months

0002 EMRAS-Independent Account Transactions

12 Months

Option Period I: Month 13 – Month 24 (Exact dates to be determined at time of award)

CLIN

No.

Description Units Unit of Measure

Unit Price

GSA

Discount (%)

Total Price

1001 EMRAS-National Account Transactions

12 Months

1002 EMRAS-Independent

Option Period II: Month 25 – Month 36 (Exact dates to be determined at time of award)

No.

Description Units Unit of Measure

Unit Price

GSA

Discount (%)

Total Price

2001 EMRAS-National Account Transactions

12 Months

2002 EMRAS-Independent

Option Period III: Month 37 – Month 48 (Exact dates to be determined at time of award)

No.

Description Units Unit of

Measure Unit Price

GSA

Discount (%)

Total Price

3001 EMRAS-National Account Transactions

12 Months

3002 EMRAS-Independent

Option Period IV: Month 49 – Month 60 (Exact dates to be determined at time of award)

No.

Description Units Unit of Measure

Unit Price

GSA

Discount (%)

Total Price

4001 EMRAS-National Account Transactions

12 Months

4002 EMRAS-Independent

SECTION 2 – STATEMENT OF WORK

BACKGROUND

The General Services Administration (GSA), Federal Acquisition Service (FAS), Office of Travel, Transportation, and Logistics (TTL), Office of Fleet Management (GSA Fleet) provides motor vehicle products and services to the Federal Government. Excellent service and professional conduct are the norm and customer service excellence is a minimum expectation.

The services listed in this Request for Proposal (RFP) pertain to the Leasing Support Division, Accident Management and Maintenance Control Branch, which operates at the GSA Headquarters Building in Washington, D.C., as well as centers in Atlanta, GA, Fort Worth, TX, Kansas City, MO, and Lompoc, CA. This division, through the actions of over 80 procurement technicians at the Accident Management Center (AMC) and Maintenance Control Center (MCC), oversees the maintenance and repair for all of the vehicles in the GSA leased fleet. GSA Fleet AMC and MCC technicians, on an annual basis, approve 240,000 repair purchase orders – the vast majority over the phone. It is anticipated that another 100,000 transactions currently covered by GSA Fleet’s Service Card may also be coverable by this system. GSA Fleet has a current vendor database of approximately 100,000 vendors. These vendors range from large national chains (e.g., Pep Boys, Jiffy Lube, and Goodyear) to small independent local repair and body shops.

PURPOSE

The purpose of this requirement is to obtain a currently available, commercial off-the-shelf (COTS) electronic real-time maintenance and repair (M&R) authorization system. It is anticipated that this solution will take the form of a cloud based Software-as-a-Service (SaaS), however; GSA is not restricted from considering other alternative delivery mechanisms. This system will be used by GSA Fleet to manage all maintenance and repair orders processed through the MCC and AMC.

The system shall, at a minimum, provide the follow functionalities:

• Allow the electronic transmission of M&R records between GSA Fleet and commercial repair vendors.

• The system shall integrate with GSA Fleet’s Fleet Management System (FMS) and crosswalk external vendor codes into GSA Fleet’s existing code structure (to be provided during implementation).

• The system shall allow for GSA Fleet’s existing vehicle inventory and maintenance history to be loaded so that a complete M&R history is available upon demand.

• GSA Fleet’s existing asset identifiers (vehicle tag number) will be an available field within the vendor system.

• The system shall allow for single sign on by users.

• The system shall allow for differing levels of permission, to include:

o Manager – user who can authorize other users and has full use of the system o Analyst - user who cannot authorize repairs, but can access the system for viewing and for reports o Technician – user who can view and authorize repair orders, but not authorize users

• The system shall allow for Maintenance Control Center (MCC) technicians to be grouped by skill type

• The system shall provide a clean, intuitive, and user friendly interface for users.

• The system shall present a main screen listing open repair orders, items of note, and a search functionality/capability for finding repair orders - current or archived/closed.

• The system shall have a “quick pick” functionality for selecting common repair items when creating a repair order (RO).

• The system shall allow for GSA Fleet technicians to accept/decline repair orders at the line item level.

• The system shall allow for GSA Fleet technicians to view the available maintenance history for a vehicle - in the repair order screen or as a result of a direct query/search.

• The system shall allow for preventive maintenance schedules to be established/maintained by varying vehicle classes (e.g., sedans, light trucks - gas, light trucks - diesel, medium truck, reefer truck, hybrids/EVs, buses, ambulances, etc.).

• The system shall capture wear measurements for repairs involving the replacement of tires and brakes. These measurements shall be visible/available to the technician and retained in the repair record.

• The system shall allow for “reason for repair” to be captured at the repair order level.

• The system shall capture vendor product codes (e.g. tire brand/model, battery brand/model, etc.).

• The system shall provide vehicle schematics at the component level.

• The system shall allow for notes/comments to be entered by the technician at a repair order level. These notes shall be visible to GSA Fleet technicians and, at the technician's discretion, be able to be made available to the vendor.

• The system shall allow for vehicle warranty information to be maintained.

• Technicians shall be able to flag RO line items for possible coverage under warranty.

• The system shall include a post-warranty capability.

• The system shall allow ROs to be edited, amended, or corrected prior to payment.

• The system shall maintain an audit trail of all actions and communication between

GSA Fleet and the vendor for every M&R transaction recorded by the system. This data shall be maintained for a minimum of 75 months.

• The system shall allow for automated approvals of repair items at thresholds set, and managed, by GSA Fleet.

• The system shall integrate with commercially available price guides (e.g., Mitchells, All-Data, etc.).

• For each repair, the system shall provide real-time aggregated (cross-account) pricing information based on historical transactions.

• The system shall be capable of providing reports (scheduled and/or ad hoc) to include but not limited to:

o RO by shop type (national vs independent/local) o RO # by month o # of vendors registered but still calling (e.g., not using the system) o ROs created by shop type o Downtime o Shop created RO response time - how long we take to get a response back to the shop o Shop created rejection % o Auto-approval by vendors o Vehicle fleet breakout, by make, then by model, model year, actual repair, spend o Open repair status - count o Total auto-approvals o Live RO status monitor - a report on ROs by current status o Top independent shops - numbers, savings in cost and time o Top national shops - numbers, savings in cost and time o Total savings

• The offeror shall provide a listing of their current (as of response submittal) vendor network, to include corporate (business) name, number of locations, and type of integration (vendor Point-of-Sale or double entry keying).

• The offeror shall identify for which, if any, of their vendors does the system contain the vendor’s sales catalog (of items, services, prices).

• The system shall allow for repair orders to be added/created by technicians in response to repairs phoned in (external to the system).

• The system shall allow for new vendors to be added/created by technicians in response to repairs phoned in (external to the system).

• The system shall be able to display all vendors existing within GSA Fleet’s vendor database.

• The system shall possess a search function by which vendors can be researched.

• The offeror shall describe the process by which new vendors may be added to their network and made participating vendors in their system.

• The system shall allow for the integration with GSA Fleet’s fleet card provider payment information. The system shall NOT capture nor retain payment information.

• The system shall NOT retain personally identifiable information (PII) aside from that information provided by the vendor as the POC for the repair order.

• The system shall allow for integration of the incoming RO tickets into GSA Fleet’s call/workflow (ACD) system.

Understanding that technology is ever evolving, GSA Fleet leaves open the possibility that the selected product may undergo future evolutions that add or remove functionality. To the extent that the basic functionality of the product - the electronic transfer of maintenance and repair information in order to effect an authorization decision of said repair - does not change, GSA Fleet hopes that future changes will only enhance the provision of service.

GSA Fleet would entertain discussions on such changes should they occur.

Implementation Schedule As a deliverable, GSA requires a written response that addresses the above stated system requirements. The response shall provide specific information on how the proposed solution meets each stated requirement. In addition, we will require an implementation plan and schedule for the awarded offeror. This schedule will be couched in terms of Award date +30, +60, etc. and should include dependencies if needed - e.g. GSA IT Security’s Authority to Operate (ATO) +30, ATO +60, etc.

Automated Data Transfer and Information Technology Security GSA requires the vendor to have an established web service in order to accommodate an automated data exchange. The vendor must provide a Web service that is either SOAP based or RESTFul service, independent of platform, and with a loosely coupled software component designed to support interoperable machine-to-machine interaction over a network interacting with the Web service in a manner prescribed by means of JSON or XML-based messages conveyed using Internet transport protocols in conjunction with other Web-related standards. The vendor must allow for HTTPS, TLS > 1.1 and SSL security certificates for data encryption purposes. Vendor must provide GSA a Web Services Description Language (WSDL) specification that provides a framework for describing a Web service with HTTPS basic authentication specific to GSA (e.g., a user id and password). Each operation specifies the types of messages that the service can send or receive as part of that operation including specification for a message exchange pattern that indicates the sequence in which the associated messages are transmitted between the parties. Upon selection, the vendor must adhere to service level agreements between GSA on performance or response time.

The system shall comply with all applicable GSA and U.S. Government IT Security requirements as follows:

CLOUD INFORMATION SYSTEMS – IT SECURITY REQUIREMENTS

The U.S. General Services Administration (GSA) must provide information security for the information systems that support the operations and assets of the agency, including those provided or managed by GSA, another agency, contractor, or other source. The Federal Information Security Modernization Act of 2014 (FISMA of 2014) describes Federal agency security and privacy responsibilities as including “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency.” This includes services which are either fully or partially provided; including other agency hosted, outsourced, and cloud computing solutions. Agency information security programs apply to all organizations (sources) which possess or use Federal information – or which operate, use, or have access to Federal information systems (whether automated or manual) – on behalf of a Federal agency, information systems used or operated by an agency or other organization on behalf of an agency.

Office of Management and Budget (OMB) Memorandum M-14-04 asserts that agencies are responsible for ensuring information technology acquisitions comply with the information technology security requirements in FISMA of 2014, OMB’s implementing policies including OMB Circular A-130 and guidance and standards from the National Institute of Standards and Technology (NIST).

The offeror shall provide an indication of their willingness to, ability to, and experience with obtaining a GSA IT Security Low Impact Software as a Service (LiSaaS) certification (for a

SaaS or other cloud-based solution). This is an ANNUAL certification requirement undertaken by GSA IT Security. The offeror agrees to collaborate with GSA IT Security to facilitate this annual examination. This authorization is in lieu of the FedRAMP Tailored LiSaaS program – although a FedRAMP Tailored LiSaaS authorization would be an acceptable substitute for the GSA IT Security LiSaaS authorization at any time. Should, at some time forward, GSA’s LiSaaS process be discontinued, GSA will notify the awarded vendor of said discontinuation and the offeror understands and agrees that they will move to a FedRAMP Tailored LiSaaS authorization within one year. If at any time, the vendor is either unwilling or unable to meet any of the process requirements, GSA may choose to cancel the contract and terminate any outstanding orders.

Low Impact Software as a Service (LiSaaS) – IT Security and Privacy Requirements

To be considered for award, the contractor must comply with GSA IT’s Low-Impact SaaS (LiSaaS) review. The successful vendor will need to ensure any software-as-a-service provided under this contract meets GSA security and privacy requirements prior to invoicing the government for services received under this contract. This includes working with GSA to ensure the Software-as-a-Service (SaaS) passes the current Low-impact-software-as-a-service (LiSaaS) approval process, as outlined in GSA IT Security Procedural Guide 17-75, “Security Reviews for Low Impact Software as a Service (SaaS) Solutions.” The review process is made up of two main parts: Voluntary Product Accessibility Template (VPAT) for 508 accessibility and security scanning/process reviews. These reviews are detailed in Section 6 of the aforementioned GSA IT Security Procedural Guide 17-75, “Security Reviews for Low Impact Software as a Service (SaaS) Solutions.” which is provided as a supplement to this SOW.

1 - Assessment of the System

Maintenance of the security authorization to operate will be through continuous monitoring of security controls of the contractors system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to GSA per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. They allow GSA Authorizing Officials (AOs) to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur.

The contractor shall provide evidence in support of meeting the requirements for the review activities stated in GSA IT Security Procedural Guide 17-75 and as listed below.

• Unique IDs for each person using the SaaS. Two factor authentication should be used.

• System and security parameters deferred to customers, default settings must be changed.

• Encryption of authentication credentials during transmission.

• Results of web application vulnerability scans.

• Results of operating system vulnerability scans.

• Vendor’s flaw remediation process.

• Results of one of the following audits/certifications:

• Service Organization Control (SOC) 2/Statements on Standards for Attestation Engagements (SSAE) 18

• SysTrust/WebTrust

• ISO/IEC 27001

• Payment Card Industry Data Security Standard (PCI DSS)

2 - Authorization of the System

The LiSaaS ATO will be valid for no longer than one (1) year. The vendor agrees to undergo the LiSaaS ATO process annually. If at any time, the vendor is either unwilling or unable to meet any of the process requirements, GSA may choose to cancel the contract and terminate any outstanding orders.

3 - Reporting and Continuous Monitoring

In support of continuous monitoring the vendor shall maintain its audit report/certification, perform web application and operating system scans, and remediate flaws per the vendor’s flaw remediation process. The vendor shall report if its audit report/certification renews or expires and if any of the other required activities cannot be supported.

4 - Protection of Information

The contractor shall be responsible for properly protecting all information used, gathered, disclosed, or developed as a result of work under this contract. The contractor shall also protect all Government data, etc. by treating the information as sensitive. All information gathered or created under this contract should be considered as confidential information. It is anticipated that this information will be gathered, created and stored within the primary work location. If contractor personnel must remove any information from the primary work area they should protect it to the same extent they would their proprietary data and/or company trade secrets. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information. Personnel shall adhere to the Privacy Act, Title 5 of the U. S. Code, Section 552a and applicable agency rules and regulations.

5 - Data Ownership and Unrestricted Rights to Data

All Government data collected in the system is the property of the Federal Government. The Government will retain unrestricted rights to government data. The ordering activity retains all data collected by the system shall be provided by the Contractor (system provider) as requested during the contract period and at the completion of the contract period.

Government data rights of software deliverables shall be in accordance with FAR 52. 227-19 http://www.aicpa.org/InterestAreas/FRC/AssuranceAdvisoryServices/Pages/CPAs.aspx http://www.aicpa.org/InterestAreas/FRC/AssuranceAdvisoryServices/Pages/CPAs.aspx http://www.webtrust.org/ https://www.iso.org/standard/54534.html https://www.pcisecuritystandards.org/

Commercial Computer Software License and/or FAR 52. 227-14 Rights in Data - General.

Ownership of data entered into any and all systems, system documentation, all deliverables produced in the performance of this contract, and other related system information shall reside with the Government.

The Contractor shall place the following copyright notice on all materials, documents, deliverables, etc. developed during the performance of this contract:

For purposes of clarity, the intent of the government is for intellectual property to be vested in the federal government for work paid for by the federal government. All documents, graphics, and code created under this contract are the intellectual property of the federal government including, but not limited to, plans, reports, schedules, software code, software designs, graphics, etc. In the event that the federal government implements under this contract open-source software and pays for the cost of the implementation of open-source software, the final changes and edits to the code and configuration (such as work to integrate plug-ins) are the intellectual property of the federal government.

6 - Personally Identifiable Information

Personally identifiable information (PII) data is not in the scope of the acquisition and PII data is not expected to be stored in the vendor's SaaS solution. The contractor shall prepare a Privacy Threshold Analysis (PTA) to either document PII is not in scope, or determine which categories of information will be stored, processed, or transmitted by the system. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

Privacy data (should it come into scope) will require that the vendor’s SaaS solution be FedRAMP authorized at least at the FIPS PUB 199 Moderate level.

7 - Data Availability

The data must be available to the Government upon request within one business day or within the timeframe negotiated with the Contractor, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

8 - Data Release

Contractor will not disclose Customer Data to any government or third party or access or use Customer Data; except in each case as necessary to maintain the SaaS solution or to provide the SaaS solution to Customer in accordance with this contract, or as necessary to comply with the law or a valid and binding order of a governmental or regulatory body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, Contractor will give Government reasonable notice of any such legal requirement or order, to allow Government to seek a protective order or other appropriate remedy.

https://www.gsa.gov/portal/content/104256

9 - Confidentiality and Nondisclosure

Personnel (contractor/subcontractor employee) working on any of the described tasks, may at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents. The Contractor shall submit to the COR a completed confidentiality and non-disclosure agreement form for each individual contractor/subcontractor.

Additionally, any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U. S. C. §§ 1030.

10 - Section 508 Compliancy

The Contractor(s) shall provide accessibility based on Section 508 of the Rehabilitation Act of 1973 (29 U. S. C. 794d). All electronic and information technology (EIT) delivered must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. The 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. All deliverables will be Section 508 compliant, and will be reviewed for compliance by the government which reserves the right to reject the deliverable(s) until remediation of deficiencies has been successfully completed by the Contractor. Complete technical descriptions are provided on the following website: http://www.section508.gov.

Where appropriate, the Contractor(s) shall indicate whether each product or service is compliant or noncompliant with the accessibility standards at 36 CFR 1194. Further, the quote must indicate where full details of compliance can be found (e. g., vendor’s website or other exact location).

Hardware and/or software acquired under this procurement will be reviewed for compliance with Section 508 of the Rehabilitation Act of 1973 using the GSA 508 Technical Tools and Resources found here: https://www.gsa.gov/portal/content/103534.

11 - Additional Stipulations

1. Deliverables shall be labeled Sensitive but Unclassified (SBU) or contractor selected designation per document sensitivity. External transmission/dissemination of SBU to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security Requirements for Cryptographic https://www.gsa.gov/portal/content/103534

Modules.”

2. The contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government’s agent.

3. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. The Contractor shall be responsible for the following privacy and security safeguards:

a. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. Access to support incident investigations, shall be provided as soon as possible but not longer than 72 hours after request.

b. Physical Access Considerations – If the SaaS provider is operated within an IaaS that is FedRAMP authorized (e. g., AWS); physical access to the physical datacenter environment will be governed by the terms of access allowed by the underlying infrastructure provider as defined in the FedRAMP A&A authorization package.

c. The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Authenticated and unauthenticated database application vulnerability scans

• Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. If the vendor chooses to run its own automated scans or audits, results from these scans may at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans.

In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor-conducted scans shall be provided in full to the Government.

d. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

4. The Contractor shall comply with Section 1634 of Public Law 115-91 that prohibits use of any hardware, software, or services developed or provided, in whole or in part, by—

(1) Kaspersky Lab (or any successor entity); (2) any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (3) any entity of which Kaspersky Lab has majority ownership.

12 - Terms of Service (ToS)

Many terms found in commercial ToS or End User License Agreements (EULA) are not acceptable when the Government is the end user. Office of Chief Information Officer (OCIO) https://www.congress.gov/bill/115th-congress/house-bill/2810/text#toc-HC791755DF28D4E2BA0A5C4418094E922 requires that software and services within the GSA Enterprise have approved ToS or EULA.

The Contractor’s SaaS will undergo a formal review by GSA as part of the review/approval process. The Contractor’s ToS shall be found to be acceptable to the government or a modified ToS negotiated as part of the approval review, prior to final authorization.

13 - References GSA IT Security Procedural Guide 17-75, “Security Reviews for Low Impact Software as a Service (SaaS) Solutions” FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems” Guide to Understanding FedRAMP https://www.gsa.gov/about-us/organization/office-of-the-chief-information-officer/chief-information-security-officer-ciso/it-security-procedural-guides https://www.gsa.gov/about-us/organization/office-of-the-chief-information-officer/chief-information-security-officer-ciso/it-security-procedural-guides https://insite.gsa.gov/portal/getMediaData?mediaId=524325 https://insite.gsa.gov/portal/getMediaData?mediaId=524325 https://insite.gsa.gov/portal/getMediaData?mediaId=524325 https://insite.gsa.gov/portal/getMediaData?mediaId=524325 http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/03/Guide-to-Understanding-FedRAMP-v2.0-4.docx

SECTION 3 – CLAUSES/TERMS AND CONDITIONS

SAFEGUARDING SENSITIVE DATA AND INFORMATION TECHNOLOGY

RESOURCES

(a) In accordance with FAR 39.105, this section is included in the contract.

(b) This section applies to all who access or use GSA information technology (IT) resources or sensitive data, including awardees, contractors, subcontractors, lessors, suppliers and manufacturers.

(c) The GSA policies as identified in paragraphs (d), (e) and (f) of this section are applicable to the contract. These policies can be found at: http://www.gsa.gov/directives/

(d) All of the GSA policies listed in this paragraph must be followed.

1. CIO 1878.2A Conducting Privacy Assessments (PIAs) in GSA

2. CIO P 2180.1 GSA Rules of Behavior for Handling Personally Identifiable Information (PII)

3. CIO 9297.1 GSA Data Release Policy

4. CIO 9297.2B GSA Information Breach Notification Policy

(e) All of the GSA policies listed in this paragraph must be followed, when inside a GSA building or inside a GSA firewall.

1. CIO P 2100.2B GSA Wireless Local Area Network (LAN) Security

2. CIO 2100.3C Mandatory Information Technology (IT) Security Training Requirement for Agency and Contractor Employees with Significant Security Responsibilities

3. CIO 2104.1A CHGE 1 GSA Information Technology IT General Rules of Behavior

4. CIO 2182.2 Mandatory Use of Personal Identity Verification (PIV) Credentials

5. ADM P 9732.1 D Suitability and Personnel Security

(f) The GSA policies listed in this paragraph must be followed, if applicable.

[Contracting Office check all policies that apply.]

1.__√__CIO 2102.1 Information Technology (IT) Integration Policy 2.__√__CIO 2105.1C CHGE 1 GSA Section 508 Managing Electronic and

Information Technology for Individuals with Disabilities 3.__√__CIO 2106.1 GSA Social Media Policy 4._____CIO 2107.1 Implementation of the Online Resource Reservation Software 5.__√__CIO 2108.1 Software License Management 6.__√__CIO2160.2B GSA Electronic Messaging and Related Services 7.__√__CIO 2160.4A Provisioning of Information Technology (IT) Devices 8._____CIO 2162.1 Digital Signatures 9.__√__CIO P 2165.2 GSA Telecommunications Policy

(g) The contractor and subcontractors must insert the substance of this section in all subcontracts.

G-FSS-900-A CONTACT FOR CONTRACT ADMINISTRATION (JAN 1994)

http://www.gsa.gov/directives/

Offerors are required to designate a person to be contacted for prompt contract administration.

NAME ___________________________________________________

TITLE ___________________________________________________

ADDRESS _______________________________________________

_________________________________ ZIP CODE ______________

TELEPHONE NO. (_______) ________ FAX NO. _______________

EMAIL ADDRESS ___________________________________________

G-FSS-914-B CONTRACTOR'S REMITTANCE (PAYMENT) ADDRESS (SEP 1996)

(a) Payment by electronic funds transfer (EFT) is the Government’s preferred method of payment. However, under certain conditions, the Government may elect to make payment by check. The offeror shall indicate below the payment (remittance) address to which Government checks should be mailed for payment of proper invoices submitted under a resultant contract.

PAYMENT ADDRESS:

(b) All offerors are cautioned that if the payment address shown on an invoice differs from that shown above, the address above will govern. Payment to any other address, except as provided for through EFT payment methods, will require an administrative change to the contract.

INVOICE SUBMISSION

Invoices shall include the following information:

• Name of vendor;

• Invoice date;

• Government contract number, case number, or motor vehicle delivery order number, or other authorization for delivery of goods or services;

• Vendor invoice number, account number, and/or any other identifying number agreed to by contract;

• Description (including, for example, contract line/subline number), price, and quantity of goods and services rendered;

• Shipping and payment terms;

• Taxpayer Identifying Number (TIN);

• Banking information;

• Contact name (where practicable), title and telephone number.

Electronic invoices are encouraged and may be submitted to the following address:

http://fedpay.gsa.gov/

IF SUBMITTING AN ELECTRONIC INVOICE, FOLLOW THE INSTRUCTIONS

PROVIDED ON THE WEBSITE.

Invoices may also be submitted in lieu of electronic submission to:

Invoices WITHOUT Discounts: Invoices WITH Discounts:

General Services Administration OR General Services Administration Accounts Payable Branch Accounts Payable Branch P.O. Box 419018 P.O. Box 419897 Kansas City, MO 64141 Kansas City, MO 64141

Physical copies of invoices are NOT required to be submitted to the Contracting Officer.

552.216-73 ORDERING INFORMATION (AUG 2010) (ALTERNATE I—SEP 1999)

(a) In accordance with the Placement of Orders clause of this solicitation, the offeror elects to receive orders placed by GSA’s Federal Acquisition Service (FAS) by either facsimile transmission or computer-to-computer Electronic Data Interchange (EDI).

(b) An offeror electing to receive computer-to-computer EDI is requested to indicate below the name, address, and telephone number of the representative to be contacted regarding establishment of an EDI interface.

(c) An offeror electing to receive orders by facsimile transmission is requested to indicate below the telephone number(s) for facsimile transmission equipment where orders should be forwarded.

(e) Offerors marketing through dealers are requested to indicate below whether those dealers will be participating in the proposed contract.

YES NO

If “yes” is checked, ordering information to be inserted above shall reflect that in addition to offeror’s name, address, and facsimile transmission telephone number, orders can be addressed to the offeror’s name, c/o nearest local dealer. In this event, two copies of a list of http://fedpay.gsa.gov/ participating dealers shall accompany this offer, and shall also be included in Contractor’s Federal Supply Schedule pricelist.

52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS (JAN

2017)

(a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its post-acceptance rights—

(1) Within a reasonable time after the defect was discovered or should have been discovered; and

(2) Before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice.

http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/ https://www.acquisition.gov/far/html/52_233_240.html#wp1113304 https://www.acquisition.gov/far/html/52_200_206.html#wp1137572

(1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice must include—

(i) Name and address of the Contractor;

(ii) Invoice date and number;

(iii) Contract number, line item number and, if applicable, the order number;

(iv) Description, quantity, unit of measure, unit price and extended price of the items delivered;

(v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vi) Terms of any discount for prompt payment offered;

(vii) Name and address of official to whom payment is to be sent;

(viii) Name, title, and phone number of person to notify in event of defective invoice;

and

(ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g., 52.232-33, Payment by Electronic Funds Transfer—System for Award Management, or 52.232-34, Payment by Electronic Funds Transfer—Other Than System for Award Management), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR Part 1315.

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment.—

(1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract.

(2) Prompt payment. The Government will make payment in accordance with the

Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR Part 1315.

(3) Electronic Funds Transfer (EFT). If the Government makes payment by EFT, see 52.212-5(b) for the appropriate EFT clause.

(4) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, https://www.acquisition.gov/far/html/52_232.html#wp1153351 https://www.acquisition.gov/far/html/52_232.html#wp1153375 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/far/html/52_212_213.html#wp1203358 payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made.

(5) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall—

(i) Remit the overpayment amount to the payment office cited in the contract along with…