QMAE-EV-190002-D_2020_MHWC_Solicitation_FINAL_7_16_2019.pdf

PDF 513 KB Posted

Attached to
GSA's 2020 Medium & Heavy Duty Trucks and Wreckers & Carriers Program
Solicitation number
QMAE-EV-190002-D
Issued by

About this file

This solicitation seeks medium and heavy duty trucks, wreckers, and carriers through a multiple award indefinite delivery/indefinite quantity contract with the General Services Administration. Offerors must propose commercial pricing for vehicles that meet Federal Standard 794 and 807 requirements. The base period of performance is one year with two optional one-year extensions. Estimated quantities and sales figures are provided through January 2023. Delivery locations include the continental United States, Alaska, Hawaii, and U.S. territories. The minimum order amount is $10,000 and the maximum order amount per contract is $402 million inclusive of options. Delivery timeframes range from 180 to 300 days after order depending on the item. Status reporting and other deliverables are required.

View the file

Other files

File Type Posted
GSA_QMAE-EV-190002-D_Amendment_0002_8_14_2019.pdf PDF
QMAE-EV-190002-D_Attachment_6_-_Federal_Standards_REVISED.docx DOCX document
QMAE-EV-190002-D_Attachment_12_-_Small_Business_Subcontracting_Plan_Template_REVISED.docx DOCX document
GSA_QMAE-EV-190002-D_0001_SF30_Signed_7_29_2019.pdf PDF
QMAE-EV-190002-D_Attachment_15_-_AutoChoice_Online_Ordering_Instructions_REVISED.pdf PDF
QMAE-EV-190002-D_Attachment_16_-_GSA_Form_1611.xlsx XLSX spreadsheet
QMAE-EV-190002-D_Attachment_7_-_Schedule_of_Items.pdf PDF
QMAE-EV-190002-D_Attachment_2_-_Proposal_Checklist.pdf PDF
QMAE-EV-190002-D_Attachment_13_-_Inspection_Points_Template.xlsx XLSX spreadsheet
Summary_of_Changes_from_2017_to_2020_MHWC_Program.docx DOCX document
QMAE-EV-190002-D_Attachment_15_-_AutoChoice_Online_Ordering_Instructions.pdf PDF
QMAE-EV-190002-D_Attachment_14_-_AutoBid_Instructions.pdf PDF
QMAE-EV-190002-D_Attachment_6_-_Federal_Standards.pdf PDF
QMAE-EV-190002-D_Attachment_3_-_SF1449.pdf PDF
QMAE-EV-190002-D_Attachment_12_-_Small_Business_Subcontracting_Plan_Template.docx DOCX document
QMAE-EV-190002-D_Attachment_17_-_Option_Analysis.pdf PDF
QMAE-EV-190002-D_Attachment_11_-_Monthly_Status_Report_Template.xlsx XLSX spreadsheet
QMAE-EV-190002-D_Attachment_5_-_Technical_Exceptions_Spreadsheet.xlsx XLSX spreadsheet
QMAE-EV-190002-D_Attachment_10_-_Weekly_Status_Reports_EXAMPLE.xlsx XLSX spreadsheet
QMAE-EV-190002-D_Attachment_9_-_Weekly_Vendor_Status_Submission_Requirements_Report.pdf PDF
QMAE-EV-190002-D_Attachment_1_-_IBR.docx DOCX document
QMAE-EV-190002-D_Attachment_8_-_Estimated_Quantities.pdf PDF
QMAE-EV-190002-D_Attachment_4_-_Vendor_Response_Document.docx DOCX document
Show all 23

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

GSA Federal Acquisition Service

July 16, 2019

Dear Prospective Offeror:

The General Services Administration (GSA) appreciates your interest in Solicitation Number QMAE-EV-190002-D for Medium & Heavy Duty Trucks and Wreckers & Carriers for a base period of one (1) year, with two (2), one-year option periods.

This solicitation is targeted to OEM manufacturers, and their certified representatives, who meet all trade, regulatory and other conditions required to sell medium and heavy duty trucks to the United States Government in the United States. Please pay particular attention to Section A.1 as hard copy proposals are not required and will not be accepted. Section B.6 – Substantial Transformation also contains important information for offerors to consider prior to submitting a proposal.

This solicitation is being released via the Government-wide Point of Entry located via the FedBizOpps site at www.fbo.gov. In order to conduct this acquisition most effectively, all notices and postings will be made at this location. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-02 effective June 5, 2019. Please be aware that the solicitation, questions and answers, comments or any other information will not be disseminated in any other format. Be sure you check the web site regularly for any amendments. We suggest that you also bookmark GSA’s Automotive’s web site as it contains information of interest associated with automotive programs at www.gsa.gov/automotive.

Offerors are required to submit a complete offer. Offerors must propose their best price with their initial offer, as it is GSA’s goal to award without discussions. Note that substantially incomplete offers will be rejected.

NOTE: Pursuant to FAR 2.101, “day” means, unless otherwise specified, a calendar day in all references throughout this solicitation.

Should you have any questions, please contact me at 202-394-2799 or eric.vanderveen@gsa.gov.

I look forward to receiving your proposal!

Sincerely, Eric VanderVeen Contracting Officer/Branch Chief Medium and Heavy Duty Vehicles Branch (QMAAB)

SOLICITATION QMAE-EV-190002-D

TABLE OF CONTENTS

SECTION A – SOLICITATION/CONTRACT FORM

A.1 ADDITIONAL INFORMATION FOR STANDARD FORM 1449

A.2 NORTH AMERICAN INDUSTRY CLASSICIATION SYSTEM

(NAICS) AND PERIOD OF PERFORMANCE

A.3 NOTICE: REQUESTS FOR EXPLANATION OR INFORMATION

A.4 SOLICITATION COPIES (MAR 1996)

A.5 PERIOD FOR ACCEPTANCE OF OFFERS (MAR 1996)

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 FEDERAL STANDARDS AND SCHEDULE OF ITEMS

B.2 ESTIMATED QUANTITIES

B.3 PRICING

B.4 GSA AUTOMOTIVE PROGRAM

B.5 DEFINITIONS

B.6 SUBSTANTIAL TRANSFORMATION DETERMINATION

SECTION C – DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 DELIVERABLES

C.2 POINTS OF CONTACTS AND RESPONSIBILITIES

C.3 WEEKLY STATUS REPORTS

C.4 IDENTIFICATION OF VEHICLES

C.5 FIRST PRODUCTION VEHICLE

C.6 DEALER DELIVERY REQUIREMENT

C.7 SHIPMENT DELAYS AND APPLICATION OF CONCESSIONS

C.8 ORDER ACCEPTANCE

C.9 NOTIFICATION OF VEHICLE DEFECTS/RECALLS

C.10 AVAILABILITY OF FUNDS

C.11 GUARANTEED MINIMUM QUANTITY

C.12 MAXIMUM QUANTITY OF SUPPLIES

C.13 GSA FORM 1611

C.14 CONTRACT ADMINISTRATION INFORMATION

C.15 CYBERSECURITY LANGUAGE FOR OBD DONGLE AND

TELEMATICS PROTECTION FOR FACTORY AND AFTER-

MARKET INSTALLED HARDWARE

C.16 NEW OPTIONAL EQUIPMENT CODES

C.17 NEXT MODEL YEAR

C.18 DEALERS AND SUPPLIERS

C.19 INTERPRETATION OF CONTRACT REQUIREMENTS

C.20 SCOPE OF CONTRACT

SECTION D – PACKAGING AND MARKING

D.1 GSAM 552.211-91 VEHICLE DECALS, STICKERS, AND DATA

PLATES (JAN 2010)

D.2 GSA FORM 1398

SECTION E – INSPECTION AND ACCEPTANCE

E.1 PRODUCTION AND INSPECTION POINT(S)

E.2 552.246-71 SOURCE INSPECTION BY GOVERNMENT (JUNE 2009)

SECTION F – DELIVERIES OR PERFORMANCE

F.1 DELIVERY--F.O.B. DESTINATION

F.2 WAIVER OF DELIVERY SCHEDULE

F.3 DELIVERY HOURS

F.4 EXPORT TRAFFIC RELEASE

F.5 552.211-81 TIME OF SHIPMENT (FEB 1996) (ALTERNATE I—FEB

1996)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 CONTACT FOR CONTRACT ADMINISTRATION

G.2 CONTRACTOR'S REMITTANCE (PAYMENT) ADDRESS

G.3 INVOICE SUBMISSION

G.4 552.216-72 PLACEMENT OF ORDERS, ALTERNATE I (AUG 2010)

G.5 552.216-73 ORDERING INFORMATION (AUG 2010) (ALTERNATE

I—SEP 1999)

G.6 552.216-74 TASK-ORDER AND DELIVERY-ORDER OMBUDSMAN

(JAN 2016)

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 EVIDENCE OF SHIPMENT OF MANUALS

H.2 NOTIFICATION OF VEHICLE DEFECTS

SECTION I – CONTRACT CLAUSES

I.1 552.217-71 NOTICE REGARDING OPTION(S) (NOV 1992)

I.2 52.216-18 ORDERING (OCT 1995)

I.3 52.216-19 ORDER LIMITATIONS (OCT 1995)

I.4 52.216-22 INDEFINITE QUANTITY (OCT 1995)

I.5 52.223-11 OZONE-DEPLETING SUBSTANCES AND HIGH GLOBAL

WARMING POTENTIAL HYDROFLUOROCARBON (JUN 2016)

I.6 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

I.7 252.227-7015 TECHNICAL DATA – COMMERCIAL ITEMS (FEB

2014)

I.8 52.209-7 INFORMATION REGARDING RESPONSIBILITY

MATTERS (OCT 2018)

I.9 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT

(MAR 2000)

I.10 52.215-20 REQUIREMENTS FOR CERTIFIED COST OR PRICING

DATA AND DATA OTHER THAN CERTIFIED COST OR PRICING

DATA (ALTERNATE IV) (OCT 2010)

I.11 52.216-1 TYPE OF CONTRACT (APR 1984)

I.12 52.225-18 PLACE OF MANUFACTURE (AUG 2018)

I.13 52.225-25 PROHIBITION ON CONTRACTING WITH ENTITIES

ENGAGING IN CERTAIN ACTIVITIES OR TRANSACTIONS

RELATING TO IRAN—REPRESENTATION AND CERTIFICATION

(AUG 2018)

I.14 52.233-2 SERVICE OF PROTEST (SEP 2006)

I.15 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY

REFERENCE (FEB 1998)

I.16 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS –

COMMERCIAL ITEMS (MAY 2019)

I.17 552.212-71 CONTRACT TERMS AND CONDITIONS APPLICABLE

TO GSA ACQUISITION OF COMMERCIAL ITEMS (May 2019)

SECTION J – LIST OF ATTACHMENTS

SECTION K - REPRESENTATIONS, CERTIFICATIONS, AND OTHER

STATEMENTS OF OFFERORS OR RESPONDENTS

K.1 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS –

COMMERCIAL ITEMS (OCT 2018)

K.2 AUTHORIZED NEGOTIATORS

SECTION L – INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

OR RESPONDENTS

L.1 ADDENDUM TO 52.212-1 INSTRUCTIONS TO OFFERORS –

COMMERCIAL ITEMS

L.2 UNSOLICITED SAMPLES, DESCRIPTIVE LITERATURE, OR

BRAND NAME REFERENCES

L.3 SUBMISSION OF OFFERS—ADDITIONAL INSTRUCTIONS

L.4 AWARD

L.5 PRE-PROPOSAL CONFERENCE

SECTION M – EVALUATION FACTORS FOR AWARD

M.1 EVALUATION – TECHNICAL

M.2 ADJECTIVAL RATINGS

M.3 METHOD OF AWARD FOR THE MASTER CONTRACT

M.4 METHOD OF AWARD FOR DELIVERY ORDERS PLACED

AGAINST THE MASTER CONTRACT

M.5 CHANGES TO ORDERS

M.6 552.217-70 EVALUATION OF OPTIONS (JUL 2016)

SECTION A – SOLICITATION/CONTRACT FORM

A.1 ADDITIONAL INFORMATION FOR STANDARD FORM 1449

Hard copy proposals will not be accepted. Offerors must submit electronic versions of proposals to the following address:

George.Anderson@gsa.gov with carbon copies to Amanda.Vance@gsa.gov and Eric.Vanderveen@gsa.gov

Electronic copies of proposals are due Friday, August 30, 2019 at 2:00 PM Eastern. AutoBid will close Friday, August 30, 2019 at 2:00 PM Eastern.

Please review 52.212-1 – Instructions to Offerors – Commercial Items (Oct 2018) as referenced in Attachment 1 – Clauses Incorporated by Reference (IBR), for information regarding timely electronic proposal submission information:

(f)Late submissions, modifications, revisions, and withdrawals of offers.

(1) Offerors are responsible for submitting offers, and any modifications, revisions, or withdrawals, so as to reach the Government office designated in the solicitation by the time specified in the solicitation. If no time is specified in the solicitation, the time for receipt is 4:30 p.m., local time, for the designated Government office on the date that offers or revisions are due.

(2)(i) Any offer, modification, revision, or withdrawal of an offer received at the Government office designated in the solicitation after the exact time specified for receipt of offers is “late” and will not be considered unless it is received before award is made, the Contracting Officer determines that accepting the late offer would not unduly delay the acquisition; and-

(A) If it was transmitted through an electronic commerce method authorized by the solicitation, it was received at the initial point of entry to the Government infrastructure not later than 5:00 p.m. one working day prior to the date specified for receipt of offers; or

(B) There is acceptable evidence to establish that it was received at the Government installation designated for receipt of offers and was under the Government’s control prior to the time set for receipt of offers; or

(C) If this solicitation is a request for proposals, it was the only proposal received.

(ii) However, a late modification of an otherwise successful offer, that makes its terms more favorable to the Government, will be considered at any time it is received and may be accepted.

(3) Acceptable evidence to establish the time of receipt at the Government installation includes the time/date stamp of that installation on the offer wrapper, other documentary evidence of receipt maintained by the installation, or oral testimony or statements of Government personnel.

(4) If an emergency or unanticipated event interrupts normal Government processes so that offers cannot be received at the Government office designated for receipt of offers by the exact time specified in the solicitation, and urgent Government requirements preclude amendment of the solicitation or other notice of an extension of the closing date, the time specified for receipt of offers will be deemed to be extended to the same time of day specified in the solicitation on the first work day on which normal Government processes resume.

(5) Offers may be withdrawn by written notice received at any time before the exact time set for receipt of offers. Oral offers in response to oral solicitations may be withdrawn orally. If the solicitation authorizes facsimile offers, offers may be withdrawn via facsimile received at any time before the exact time set for receipt of offers, subject to the conditions specified in the solicitation concerning facsimile offers. An offer may be withdrawn in person by an offeror or its authorized representative if, before the exact time set for receipt of offers, the identity of the person requesting withdrawal is established and the person signs a receipt for the offer.

Complete electronic file formatting instructions are located in Section L.

A.2 NORTH AMERICAN INDUSTRY CLASSICIATION SYSTEM (NAICS) AND

PERIOD OF PERFORMANCE

FSC GROUP: 2320

PRODUCT: TRUCKS & TRUCK TRACTORS, WHEELED

NAICS: 336120 and 336211

PERIOD: Estimated Base Period of Performance: January 9, 2020 – January 8, 2021 Estimated Option Period I, if exercised: January 9, 2021 – January 8, 2022 Estimated Option Period II, if exercised: January 9, 2022 – January 8, 2023

A.3 NOTICE: REQUESTS FOR EXPLANATION OR INFORMATION

Oral or written requests for explanation or information regarding this solicitation should be directed to:

U.S. GENERAL SERVICES ADMINISTRATION

Medium and Heavy Vehicles Branch (QMAAB) George.Anderson@gsa.gov Amanda.Vance@gsa.gov eric.vanderveen@gsa.gov

A.4 SOLICITATION COPIES (MAR 1996)

In order to conduct this procurement most effectively and at the lowest costs, all information – including the solicitation, solicitation amendments, and any comments – will be posted only via the Internet at: http://www.fbo.gov.

A.5 PERIOD FOR ACCEPTANCE OF OFFERS (MAR 1996)

Paragraph (c) of the provision 52.212-1, Instructions to Offerors—Commercial Items, is revised to read as follows: The offeror agrees to hold the prices in its offer firm for 120 days from the date specified for receipt of offers within which offer may be accepted.

SECTION B – SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 FEDERAL STANDARDS AND SCHEDULE OF ITEMS

The Federal Standards can be found in Attachment 6 and Schedule of Items can be found in Attachment 7. Vehicles to be provided under this acquisition must adhere to the Federal Standards 794 and 807 and be current model year production.

If an Offeror offers a comparable model that differs from the Government’s minimum requirements, the Offeror must identify those differences for each respective make and model on Attachment 5 – Technical Exceptions Spreadsheet – as part of its electronic proposal submission.

Please note that submission of representative makes and models does not ensure that they will be accepted.

Instructions to Offerors relating to AutoBid are included in Section L.

B.2 ESTIMATED QUANTITIES

The estimated quantities and estimated sales figures in Attachment 8 show projected sales amounts for the first full year of contract award.

B.3 PRICING

Commercial pricing structures are desired to the maximum extent practicable. Offerors may propose on one or more item numbers solicited herein. Offerors must meet the standards specified for each item number offered and follow the proposal submission instructions noted in Section L.

B.4 GSA AUTOMOTIVE PROGRAM

GSA awards and administers the GSA Automotive Program. The program in its entirety purchases over $1.5 billion annually in high-quality vehicles and automotive services at significant savings for customer agencies. Under this program, GSA enters into Government-wide contracts with commercial firms to provide commercial products at stated prices for given periods of time. GSA Automotive offers a large selection of vehicles and related products and services. GSA is also the mandatory source for all new, non-tactical light vehicles for Executive branch agencies and the Department of Defense. As a procurement agent of the United States Government, GSA has the responsibility of issuing solicitations and awarding contracts to meet this obligation. GSA accepts orders from eligible parties in accordance with GSA Order ADM 4800.2E.

Medium and Heavy Duty Trucks are not eligible for the 1122 Program of the National Defense Authorization Act (www.gsa.gov/1122program).

GSA Automotive simplifies the procurement process for Federal agencies and industry partners.

GSA ensures that potential vendors meet the responsibility determinations required by Federal

Acquisition Regulation (FAR) Part 9 and offers products that meet the Federal Standards 794 and 807. GSA also examines the base vehicle and optional equipment prices received as a result of this competitive procurement to determine price reasonableness, as it leverages the Government’s purchasing power. Following the GSA Automotive program ordering procedures, agencies will make a best value determination and place their order directly through AutoChoice.

AutoChoice is GSA’s secure on-line ordering application for light vehicles, ambulances, medium/heavy vehicles, buses, wreckers and car carriers. With AutoChoice, agencies can:

Configure vehicles and choose vehicle equipment options Utilize side-by-side comparisons of each competitor’s vehicle model Calculate actual vehicle prices for the configured vehicle View the discounts from the manufacturers’ suggested retail price (MSRP) and dealers’ invoice View miles per gallon (MPG) fuel ratings, where applicable View Carbon Dioxide Grams per Mile (GPM) data, where applicable View Federal Standards View vendor’s past performance Select the vehicle that provides the best value considering price, GPM, delivery availability, mission requirements, and time of shipment Submit vehicle orders to GSA online Check vehicle order status Link to the NHTSA’s website to view crash test ratings and recall information

Further information about the GSA Automotive program can be found at www.gsa.gov/vehiclebuying.

B.5 DEFINITIONS

The following terms are defined:

Dealer Net Invoice Price: The initial charge to the dealer from the manufacturer which reflects the base vehicle invoice price and the invoice price for options, including freight and delivery charges.

Dealer Invoice Price: The amount the dealer pays for a car or truck. Included in this price may be a dealer holdback, which is a percentage of the vehicle's wholesale price and local charges assessed for brand advertising.

Net MSRP: Manufacturer’s Suggested Retail Price is the recommended selling price for a vehicle as set by the manufacturers.

NHTSA: National Highway Traffic Safety Administration

B.6 SUBSTANTIAL TRANSFORMATION DETERMINATION

Offerors certify, by submission of a proposal, that all products are compliant with the Trade Agreements Act (TAA) as specified in FAR 52.225-5 and FAR 52.225-6. If significant proposed vehicle(s) component(s) are from a non-TAA compliant country, the offeror is required to supply a binding ruling of Substantial Transformation from the Office of Regulation and Rulings, Office of International Trade, Customs and Border Protection with proposal submission. Offerors are advised the process for obtaining a binding ruling can take up to 120 days. Failure to provide a binding ruling for these products with proposal submission will result in any applicable awarded items remaining closed for order placement in AutoChoice until such time the determination has been provided. These components include, but are not limited to, vehicle gliders/chassis, engines, and powertrains. It is the offeror’s responsibility to request a determination, and such requests should be made in writing to the following:

Customs and Border Protection Office of International Trade Office of Regulation and Rulings 799 9th Street NW; 7th Floor Washington, D.C. 20229-1177 202-325-0040

Any questions related to this requirement should be directed to the Contracting Officer, Eric VanderVeen at eric.vanderveen@gsa.gov, prior to proposal submission.

SECTION C – DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1 DELIVERABLES

In addition to the vehicles purchased, the following deliverables are required:

Description Due NLT To Weekly Status Report

(see Attachment 9 for requirements;

Attachment 10 for example)

Each Friday After Contract Award automotiveedi.partnerships@gsa.gov

Monthly Status Report (see Attachment 11 for requirements)

10 Days After the First of the Month

Administrative Contracting Officer and Contracting Officer

Shipment Delays 30 Days Prior to Shipping

(preferably as soon as known)

Contracting Officer

Notification of Vehicle Defects / Recalls

Within 1 week of public announcement

Consignee, with a copy to the Contracting Officer, in accordance with Section C.9

1611 for Each Export Destination

30 Days in Advance of Anticipated Date of

Availability for Shipment

GSA Office of Fleet Management Program Management Branch

GSA.Export@gsa.gov

Vehicle Availability Listing

As required

Contracting Officer

The Contractor must deliver via email one (1) electronic copy of each deliverable to the designated persons listed on the date it is due in Microsoft Office, Word 2010, PowerPoint 2010, or Project 2010 format (or compatible version), as appropriate, for the deliverables specified herein, whether verbally requested or not. Changes to delivery points of contact must be issued to the Contractor by email notification. All deliverables must be delivered no later than the date specified herein.

Offerors may download the solicitation and make electronic copies of necessary items for submission. For their own records, offerors are responsible for downloading and making complete copies of the solicitation, the terms of which are incorporated in the contracts.

C.2 POINTS OF CONTACTS AND RESPONSIBILITIES

Contracting Officer’s Representative (COR): The COR will oversee the Contractor’s technical efforts to assure that its performance is in accordance with the terms and conditions of the contract. The COR will be designated after award.

Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The CO is the only individual authorized to make changes to the terms and conditions of the contract. The CO for this contract is as follows:

Contracting Officer: Eric VanderVeen

GSA/FAS/QMAAB

1800 F St NW Washington, DC 20405

(202) 394-2799 or eric.vanderveen@gsa.gov

Contracting Specialist(s): Amanda Vance

GSA/FAS/QMAAB

1800 F St, NW

(202) 372-5910 or amanda.vance@gsa.gov

George Anderson

1800 F St, NW

(703) 605-9026 or george.anderson@gsa.gov

Administrative Contracting Officer (ACO): TBD at award

Exports (GSA Form 1611): GSA, Office of Fleet Management

Program Management Branch (QMDAB) 1800 F St, NW

(703) 605-2277 or gsa.export@gsa.gov

C.3 WEEKLY STATUS REPORTS

**For purposes of this deliverable, for North American production the ship date is defined as the moment a vehicle leaves the manufacturer’s production facility. For vehicles which require oceanic transport, the ship date is defined as the moment a vehicle leaves the port of debarkation.

WEEKLY VENDOR STATUS SUBMISSION REQUIREMENTS

ATTACHMENT 9

GSA Office of Motor Vehicle Management’s contracts requires vendors to submit electronic status reports on a weekly cycle which indicate the production status of all vehicles ordered.

Status information sent electronically to GSA by your firm is displayed in our on-line ordering program, AutoChoice. Customers can view the production, shipment and actual delivery status of orders placed against your contract.

Additionally, the status report will also be used to calculate your on-time shipment performance against the contract time of shipment. The customer will be able to view the percentage of vehicles shipped on time by each vendor in AutoChoice. It is an avenue for customer agencies to evaluate the vendor’s performance when making a best value decision when selecting a vehicle.

Your file can be sent in either of the following two formats which are attached:

1. XLS: Send data as an EXCEL file via an email attachment to AutomotiveEDI.Partnerships@gsa.gov

2. EDI: Data collection is in X12 format (870 transactions set version 3010). Please contact Terry Koniarski at 703-605-9505 for further information on this electronic data interchange.

AUTOCHOICE STATUS Record Layout (870)

Name of Field EXCEL

File Col Text File Position

Field Length

Alpha/ Numeric

Option

*Reference

Description A 1-38 38 AN O N1

Vehicle Order Number (VON ) B 39-46 8 N M N2

Vehicle Identification Number

(VIN)

C 47-63 17

AN O N2

Filler D 64-68 5

Do NOT fill!

Contract E 69-73 5 AN M

Filler F 74-84 11

Do NOT fill!

Case Number G 85-89 5 AN M

Filler H 90-115 26

Do NOT fill!

Name I 116-150 35 AN O N3

Address J 151-185 35 AN O N3

City K 186-215 30 AN O N3

State L 216-217 2 A O N3, N4

Zip M 218-227 10 AN O N3, N5

Status N 228-229 2 AN M N6

Status Date O 230-239 10 AN O N7

Filler P 240-241 2

Do NOT fill!

Contact Person Q 242-276 35 AN O N8

Filler R 277-278 2

Do NOT fill!

Contact Telephone Number S 279-299 21 AN O N9

Filler T 300-303 4

Do NOT fill!

Gross Vehicle Weight Rating

(GVWR)

U 304-309 6

AN O N10

Fuel Type V 310-315 6 AN O N11

Gram Per Mile (GPM) W 316-319 4 AN O N12

Miles Per Gallon (MPG) City X 320-322 3 AN O N13

MPG Highway Y 323-325 3 AN O N14

MPG Combined Z 326-328 3 AN O N15

Flex Gram Per Mile (GPM) AA 329-332 4 AN O N16

Flex Fuel MPG City AB 333-335 3 AN O N17

Flex Fuel MPG Highway AC 336-338 3 AN O N18

Flex Fuel MPG Combined AD 339-341 3 AN O N19

Color AE 342-391 50 AN O N20

Trim AF 392-441 50 AN O N21

Requisition Interface Record Layout Relationship Edits (Legend)

N1: Vehicle Description

N2: Vehicle Order Number is the internal number assigned by the vendor. If no number is entered, an integer representing each vehicle will be automatically assigned. Vehicle Identification Number is mandatory when the vehicle has been shipped.

N3: For Dealer Delivery, enter Dealership name, location, and point-of-contact.

For CNS Delivery, put Customer delivery location and point-of-contact.

N4: Must be a valid US State, Territory, Armed Forces abbreviation, or “XX” for Foreign Countries.

See the USPS official list of State Abbreviations (including territories and Armed Forces addresses) at http://www.usps.com/ncsc/lookups/abbreviations.html#states N5: Zip Codes are validated against the state field. Required unless “XX” is in the state field (foreign country).

N6: Valid status codes:

SP – Scheduled for Production IN – In Process AN – Available Now, No Shipping Schedule CC – Shipped DD – Actual Delivery Date DE – Order Cancelled

N7: Date format is DD/MM/YYYY. This is the date of the vehicle status. For example, if the status of the vehicle is “CC,” enter the shipment date. Do not use dashes.

N8: Contact Person is the person to call who is receiving the vehicle. If it is a dealership, enter the POC for the dealership.

N9: Contact Telephone Number is phone number of the contact person.

N10: Gross Vehicle Weight Rating (GVWR) is the maximum weight value of a vehicle as specified by the manufacturer.

N11: Valid fuel types are:

CNG BI CNG Bi-Fuel GAS HY Gasoline Hybrid

CNG

DE

CNG Dedicated GAS PH Gasoline PHEV

DSL AF Diesel Dedicated AFV LNG BI LNG Bi-Fuel

DSL DE Diesel Dedicated LNG DE LNG Dedicated

DSL

HY

Diesel Hybrid LPG BI LPG Bi-Fuel

E85 FF E85 Flex-Fuel LPG DE LPG Dedicated

ELE DE Electric Dedicated NON FL Non Fueled

GAS AF Gasoline Dedicated AFV OTHER Other

GAS

DE

Gasoline Dedicated

N12: Gram Per Mile (GPM) is 3 characters in length and has replaced Green House Gas (GHG).

N13 through N15: MPG date for city, highway and combined.

N16: If the vehicle is offered as flex fuel, GSA requires Flex Gram Per Mile (GPM). It is 3 characters in length and has replaced Green House Gas (GHG).

N17 through N19: If the vehicle is offered as a flex fuel, GSA requires the MPG associated for all types of fuel. For ex, if the vehicle has gas and E85: gas data is entered in N13-N15; E85 data is entered in N16- N18.

N20: Color can be up to 50 characters in length.

N21: Trim can be up to 50 characters in length.

General Comments:

1. The ROADS Status Batch File transmitted to the Automotive Center will be an ASCII file (flat file) with a fixed Length of 303 bytes (records).

2. Column Option: O = Optional Field (Required as applicable) and M = Mandatory Field.

3. Initialize all Bytes in Filler Field with “blank spaces”.

Please note that in the sample Weekly Status Layout provided (Attachment 9), the VIN is provided in Column A - Description. This field is clarified as a free-form field and vendors can insert whatever description they desire, provided it is within the character allowance provided.

C.4 IDENTIFICATION OF VEHICLES

The contractor must show the applicable GSA Purchase Order number on the carrier’s freight bill or other document used in the delivery of vehicles awarded F.O.B. Destination under this solicitation. This information is essential to the consignee for identification purposes. Vehicles will not be accepted by the Government without this identifying number.

Contractor’s Monroney label, if available, is also acceptable, if it provides all of the required data.

C.5 FIRST PRODUCTION VEHICLE

** It is the Contracting Officer’s discretion to waive this requirement. **

As directed by the Contracting Officer and/or Contracting Officer Representative (COR), Government representatives must inspect the first production vehicle of each item offered at the inspection point designated in the contract. The inspection must be performed to determine vehicle conformity with the contract specifications. If multiple production facilities are used to produce each item a first article must be performed at all locations.

The First Production Vehicle Inspection (FPVI) requires a line by line review of the Federal Standard specifications applicable to the Standard Item Number of the vehicle being examined.

A comparison to the end product shall be performed and notes shall be taken to detail any discrepancies found during the inspection. Instructions will be given to the vendor after the inspection detailing what is expected by the Government as corrective action to resolve each discrepancy found.

Upon acceptance, the vehicle must be shipped in accordance with shipment terms of the contract. If the first production vehicle fails to meet the specification requirements, the Government may refuse acceptance of all vehicles until corrective action has been taken. This acceptance failure must not relieve the Contractor from complying with the contract delivery terms or any other provisions of the contract.

C.6 DEALER DELIVERY REQUIREMENT

*Consignee delivery is designated as the standard delivery process for items awarded under this solicitation per the Federal Standards 794 and 807.

**For the purpose of complying with dealer delivery mileage restrictions in this solicitation where so specified under the item, the road mileage between geographical points must be as stated in “Household Goods Carriers’ Bureau Mileage Guide”, or “Rand McNally Road Atlas”, latest issue in effect.**

A. DEALER DELIVERY

Dealer Delivery is listed under Optional Equipment for the items included in this solicitation.

Should dealer delivery (Indicated by Option Code “DDR”) be noted on a motor vehicle delivery order, delivery must be made to an available product dealer within the geographical radius (specified below) to the destination for the item specified in the schedule of items or as designated on the delivery order.

(1) For populated areas of 100,000 or more, the product dealer must be no farther than 25 miles from the destination specified. In the event more than one product dealer is indicated to serve one destination, the additional dealer(s) utilized by the Contractor must not be in excess of 25 miles from the specified location.

(2) For populated areas of fewer than 100,000, the product dealer must be no farther than 150 miles from the specified location.

(3) If a destination is found to be in excess of 100 miles from a product dealer the

Contractor must notify the Government within 30 days after receipt of delivery order so that the Government, at its option, may amend the delivery order to require consignee delivery.

(4) At the Government’s option, vehicles may be delivered directly to a Government-specified location which is certified by the contractor as a warranty repair location. The Government will receive and prep the vehicles in the same manner as a dealership.

(Example – Kennedy Space Flight Center FMC)

NOTE: ALL ORDERS PLACED PURSUANT TO THE ABOVE WILL BE RESTRICTED TO

DESTINATIONS WITHIN THE CONTINENTAL UNITED STATES (CONUS); DELIVERY

TO ALASKA, HAWAII, GUAM, AND PUERTO RICO MAY BE FURTHER RESTRICTED

TO CERTAIN CITIES WITHIN THESE LOCATIONS.

B. THE FOLLOWING SERVICES MUST BE REQUIRED FROM THE PRODUCT

DEALER:

(1) RECEIPT AND INSPECTION OF NEW VEHICLE. Product dealer must receive new vehicle from carrier and inspect the vehicle for carrier damage.

(2) CARRIER CLAIMS. When necessary, product dealer must prepare and process claims against the carrier.

(3) REPAIR/REPLACEMENT. Product dealer must make any repairs necessitated by carrier damage and must replace any equipment lost in transit.

(4) PREDELIVERY SERVICING. Product dealer must perform pre-delivery servicing in accordance with the manufacturer’s recommended pre-delivery service procedures.

(5) NOTIFICATION TO GOVERNMENT. Product dealer must notify the designated Government official upon receipt of new vehicle(s).

(6) TRANSFER TO GOVERNMENT. All new motor vehicles received must be picked up at the Product Dealer’s location by Government personnel within five (5) days after notification.

All vehicles must remain the responsibility of the Contractor until inspected, accepted, and transferred to the Government.

C. None of the above must be construed as creating contractual privity between the General Services Administration and the Product Dealer.

C.7 SHIPMENT DELAYS AND APPLICATION OF CONCESSIONS

If vehicles are not produced, inspected and shipped in accordance with the contract time of shipment, they are deemed late. The contractor is required to advise the Government of the delay a minimum of 30 days prior the shipment date and establish a new shipment date and offer concession to the Government to remove the vehicle(s) from default status. The concession is one (1) % of the awarded line item price per 30 day interval, prorated for the number of days late. In accordance with FAR 52.212-4(f), concessions will not be required for delays that are beyond the reasonable control and without the fault or negligence of the contractor or subcontractor. Examples of this include “acts of God or the public enemy, acts of the Government in either sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers.” None of the aforementioned must be regarded as an extension, waiver, or abandonment of the delivery schedule or a waiver of the Government's right to terminate for cause.

This concession mechanism must also apply in instances where vehicles purchased under contracts resulting from this solicitation suffer extended downtime awaiting repairs covered by warranty. Concessions in accordance with the terms listed above may be assessed at the discretion of the Contracting Officer in instances of extended vehicle downtime.

C.8 ORDER ACCEPTANCE

Once an order is received by the contractor, the contractor is required to review each order and notify the Government within 10 business days of receipt if there are ANY collisions or variations within the required specifications that will interfere with the contractor’s ability to complete the vehicle in any way. If such circumstance arises, the contractor must not begin building the vehicle until the situation is resolved. If the vehicle is not able to be completed in accordance with the required specifications, the Government may terminate the order at no cost to the Government in accordance with FAR 52.212-4(L) Termination for the Government’s Convenience.

C.9 NOTIFICATION OF VEHICLE DEFECTS/RECALLS

For vehicles delivered under this contract, any notification of defects in accordance with 49 CFR

577.7 must be addressed to the consignee mailing address unless otherwise instructed by the Government.

In addition, in order to increase recall closure rates and provide enhanced oversight, GSA is capable of receiving electronic notifications of announced recalls, field service actions / customer service bulletins, technical service bulletins (TSB), and/or warranty extensions.

Vendors must inform GSA as to their ability to transmit this data electronically.

If available, indicate preferred options for data transmittal (e.g. Secure file transfer protocol (SFTP), file type (e.g. .XLSX, .CSV, >TXT), and available data fields, e.g.

VIN

Recall Code Recall Type (e.g. Safety, Not Safety, Warranty) NHTSA ID, if applicable Description Remedy Status (e.g. Actionable, Not Actionable, Parts Not Available) Repair Status (e.g. Open, Closed) Date Announced Date Actionable URL for Customer Notification Letter

C.10 AVAILABILITY OF FUNDS

The Government anticipates making an award on all items specified in the Schedule of Items.

Quantities provided are an estimate only and are not a guarantee of orders to be placed under any resultant contract. Customer agencies verify availability of funds at order placement.

C.11 GUARANTEED MINIMUM QUANTITY

In accordance with FAR 16.504(a), the quantity limits may be expressed as number of units or as dollar values. The minimum quantity of supplies that the Government guarantees to order during the period of this contract is $10,000. If at the end of the contract period (base period and any options exercised by the Government) the vendor has not received an order, upon request the Government will pay the contractor the guaranteed minimum dollar value. The minimum quantity dollar value is for the entire contract inclusive of options, and not for each line item awarded. No minimum quantity of units is guaranteed.

(a) Request for payment of any amount due under this clause must be submitted, in writing, to the Contracting Officer within 30 days after the end of the contract period.

(b) The guaranteed minimum does not apply if the contract is terminated for cause or if the Contractor has not performed in accordance with the terms and conditions of the contract.

C.12 MAXIMUM QUANTITY OF SUPPLIES

The Government anticipates making multiple awards under this acquisition. In accordance with FAR 16.504(a) (4) (ii), the maximum quantity of supplies the Government will acquire under this contract will be established for each resultant contract based on the items awarded. Each resultant contract will have its own contract ceiling established, and the ceiling price for each awarded contract may differ. For each successful offeror, the estimated dollar value of all awarded line items specific to that contract will be added together to determine the maximum quantity of supplies in dollars for the base period and all option periods. The maximum dollar amount for any one contract will not exceed $402,000,000.00.

C.13 GSA FORM 1611

GSA Form 1611 is required to be completed for any orders destined outside of the United States for which an established delivery code is not available. Instructions for form completion and delivery instructions are contained on the form.

Thirty (30) days in advance of the anticipated date of availability for shipment, the Contractor is to submit a completed GSA Form 1611, including vehicle identification (VIN) number(s) for each pertinent destination, to the GSA Office of Fleet Management, Program Management Branch, at GSA.Export@gsa.gov. Shipment is not to be made until instructions are received from the Program Management Branch. Failure to adhere to this requirement must result in refusal of shipment until proper release is obtained. The form can be found attached to this solicitation, as Attachment 16.

C.14 CONTRACT ADMINISTRATION INFORMATION

A. POINTS OF CONTACT:

Contracting Officer: Eric VanderVeen

GSA/FAS/QMAAB

1800 F St NW

(202) 394-2799 or eric.vanderveen@gsa.gov

Contracting Specialist(s): Amanda Vance

1800 F St, NW

(202) 372-5910 or amanda.vance@gsa.gov

George Anderson

1800 F St, NW

(703) 605-9026 or george.anderson@gsa.gov

Administrative Contracting Officer: TBD at contract award

Contracting Officer's Representative (COR): TBD at contract award

C.15 CYBERSECURITY LANGUAGE FOR OBD DONGLE AND TELEMATICS

PROTECTION FOR FACTORY AND AFTER-MARKET INSTALLED HARDWARE

A. BACKGROUND

Vehicle telematics and fleet management devices have the potential to introduce serious safety and security risks to an automobile. For devices using the OBD port, the design means that any such device has unlimited access to some or all of a car’s internal networks. These OBD devices also have external interface that is accessible from outside of the car—typically Wi-Fi, Bluetooth, or cellular. For built-in telematics devices, there are also serious concerns about the level of connectivity the telematics system provides to the internals of the vehicle.

Although there are no federal standards and/or directives that address the protection or Information Assurance (IA) of vehicle telematics systems, there is increasing white-hat and adversarial interest in exploiting vehicles. Information assurance (IA) is the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes. Information Assurance includes protection of the integrity, availability, authenticity, non-repudiation and confidentiality of user data. IA uses physical, technical and administrative controls to accomplish these tasks and the source for the IA controls is NIST 800-53: Security and Privacy Controls for Federal Information Systems and Organizations, April 2013, http://csrc.nist.gov/publications/drafts/800-53-rev4/sp800-53-rev4-ipd.pdf. To help mitigate this risk, GSA believes that the OEMs and vendors of automotive products/services alike should be diligent in ensuring the IA posture of all systems inherent in or incorporated into vehicles and products/services.

B. CYBERSECURITY GUIDANCE

GSA’s Office of Fleet Management recognizes that many vehicle manufacturers and Tier 1 suppliers of vehicle components are currently involved and/or participating in groups and initiatives to address and resolve vulnerabilities in the security posture of vehicle systems. GSA recommends vendors familiarize themselves with the following resources to increase the awareness of activities being undertaken:

Society of Automotive Engineers (SAE) J3061, “Cybersecurity Guidebook for Cyber- Physical Vehicle Systems”, https://global.ihs.com/doc_detail.cfm?document_name=SAE%20J3061&item_s_key=00 668496

SAE J2945, “Dedicated Short Range Communication (DSRC) Minimum Performance Requirements”

Car Hacker’s Handbook, http://opengarages.org/handbook/ Five Star Automotive Cyber Safety Program, https://www.iamthecavalry.org/domains/automotive/ Volvo’s HEAVENS (HEAling Vulnerabilities to ENhance Software Security and Safety

(HEAVENS) Security Model, http://www.sp.se/en/index/research/dependable_systems/heavens/Sidor/default.aspx

On Board Diagnostics: Risks and Vulnerabilities of the Connected Vehicle, CERT Coordination Center (CERT/CC) Whitepaper, http://resources.sei.cmu.edu/library/

(TBD)

GSA believes it to be in the best interest of OEMs, Tier 1 suppliers, and vendors of automotive products/services to familiarize themselves with the policies and directives required for IS/IT components within the federal government as the probability is very high that these or very similar policies and guidelines will be leveraged for vehicle systems in the very near future:

Cybersecurity Technical Implementation Standards/Guidelines:

NIST SP 800-52 Rev1, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations”

FIPS 140-2, “Security Requirements for Cryptographic Modules” NIST SP 800-121 Revision 1, “Guide to Bluetooth Security”

Cybersecurity Process Guidelines

Federal Information Security Management Act of 2002 (FISMA), 44 U.S.C. § 3541, https://www.law.cornell.edu/uscode/text/44/3541

Federal Information Processing Standards (FIPS) 199, “Standards for Security Categorization of Federal Information and Information Systems”

FIPS 200, “Minimum Security Requirements for Federal Information and Information Systems”

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Rev1, “Guide for Applying the Risk Management Framework to Federal Information Systems”

NIST SP 800-53 Rev4, “Security and Privacy Controls for Federal Information Systems and Organizations”

NIST SP 800-137, “Information Security Continuous Monitoring for Federal Information Systems and Organizations”

NIST SP 800-82 Rev2, “Guide to Industrial Control System (ICS) Security” The Committee on National Security Systems (CNSS) Instruction No. 1253, “Security.

Categorization and Control Selection for National Security Systems”

C. SECURITY CONTROLS GUIDANCE

As implementation of Executive Order 13693, “Planning for Federal Sustainability in the Next Decade” dated June 10, 2015 begins to be implemented1, government fleet managers will be acquiring vehicle OEM and third-party vendor telematics solutions. For vendors offering these solutions GSA recommends that at a minimum the following security measures are configured within their devices/service offerings:

Encrypt all external communications by following NIST 800-52 rev. 1 guidelines for communicating with backend services external to the telematics device.

o Reference: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 52r1.pdf

Sign and encrypt firmware updates through the use of cryptographically signing and encrypting to prevent firmware modification by an attacker. Specifically OBD and telematics device vendors should consider using The Update Framework (TUF) or another open, well-supported standard for doing software updates, https://theupdateframework.github.io/.

o Follow NIST SP800-53 rev. 4 Control “System Integrity (SI-7 )” and enhancements 1, 2, 6, 9, 10, 15 NIST SP 800-53r4 Control SI-7 — SOFTWARE, FIRMWARE, AND

INFORMATION INTEGRITY

Control: The organization employs integrity verification tools to detect unauthorized changes.

Supplemental Guidance: Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity (e.g., tampering).

Software includes, for example, operating systems (with key internal components such as kernels, drivers), middleware, and applications. Firmware includes, for example, the Basic Input Output System (BIOS). Information includes metadata such as security attributes associated with information. State-of-the-practice integrity-checking mechanisms (e.g., parity checks, cyclical redundancy checks, cryptographic hashes) and associated tools can automatically monitor the integrity of information systems and hosted applications. Related controls: SA-12, SC-8, SC-13, SI-3.

Control Enhancements:

(1) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY |

INTEGRITY CHECKS

Supplemental Guidance: Security-relevant events include, for example, the identification of a new threat to which organizational information systems are susceptible, and the installation of new hardware, software, or firmware.

Transitional states include, for example, system startup, restart, shutdown, and

1 E.O. 13693 section 3(g)(iii): collecting and utilizing as a fleet efficiency management tool, as soon as practicable but not later than two years after the date of this order, agency fleet operational data through deployment of vehicle telematics at a vehicle asset level for all new passenger and light duty vehicle acquisitions and for medium duty vehicles where appropriate;

abort.

(2) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY |

AUTOMATED NOTIFICATIONS OF INTEGRITY VIOLATIONS

The organization employs automated tools that provide notification upon discovering discrepancies during integrity verification.

Supplemental Guidance: The use of automated tools to report integrity violations and to notify organizational personnel in a timely matter is an essential precursor to effective risk response. Personnel having an interest in integrity violations include, for example, mission/business owners, information system owners, systems administrators, software developers, systems integrators, and information security officers.

(6) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY |

CRYPTOGRAPHIC PROTECTION

The information system implements cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.

Supplemental Guidance: Cryptographic mechanisms used for the protection of integrity include, for example, digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Related control: SC-13.

(9) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY |

VERIFY BOOT PROCESS

The information system verifies the integrity of the boot process.

Supplemental Guidance: Ensuring the integrity of boot processes is critical to starting devices in known/trustworthy states. Integrity verification mechanisms provide organizational personnel with assurance that only trusted code is executed during boot processes.

(10) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY |

PROTECTION OF BOOT FIRMWARE

The information system implements to protect the integrity of boot firmware.

Supplemental Guidance: Unauthorized modifications to boot firmware may be indicative of a sophisticated, targeted cyber-attack. These types of cyber-attacks can result in a permanent denial of service (e.g., if the firmware is corrupted) or a persistent malicious code presence (e.g., if code is embedded within the firmware). Devices can protect the integrity of the boot firmware in organizational information systems by: (i) verifying the integrity and authenticity of all updates to the boot firmware prior to applying changes to the boot devices;

and (ii) preventing unauthorized processes from modifying the boot firmware.

(15) SOFTWARE, FIRMWARE, AND INFORMATION INTEGRITY | CODE

AUTHENTICATION

The information system implements cryptographic mechanisms to authenticate prior to installation.

Supplemental Guidance: Cryptographic authentication includes, for example, verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code.

o Reference: https://theupdateframework.github.io/ ;

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

Obey the principle of least privilege by ensuring devices should provide only enough connectivity to enable it to operate for its desired function. For example, if the device does not need access to manufacturer networks (i.e., General Motors LAN), then the physical connector itself should be removed. Additional features introduce additional risk.

o Follow NIST SP800-53 rev. 4 Control “Configuration Management (CM-7)” and enhancements 1 NIST 800-53 r4 Control CM-7: LEAST FUNCTIONALITY Control: The organization:

a. Configures the information system to provide only essential capabilities.

Supplemental Guidance: Information systems can provide a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). Additionally, it is sometimes convenient to provide multiple services from single information system components, but doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit component functionality to a single function per device (e.g., email servers or web servers, but not both). Organizations review functions and services provided by information systems or individual components of information systems, to determine which functions and services are candidates for elimination (e.g., Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing).

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .