Request for Proposals (RFP) No. 693JJ322R000005.docx

Combined Synopsis/Solicitation for Credential Issuance and Management System (CIMS) for the Department of Transportation (DOT), Office of the Secretary of Transportation (OST), Office of the Chief Information Officer (OCIO) This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a SF 1449 will not be issued.

The solicitation number is 693JJ322R000005. The solicitation is issued as a Request for Proposals (RFP). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-07, effective August 11, 2021.

This procurement is a total set-aside for small businesses. The NAICS code for this procurement is 511210 – Software Publishers. The small business size standard for this NAICS code is $41.5M.

This combined synopsis solicitation contains six (6) firm-fixed price line items. The details of the items, including quantities and units of measure, and optional line items can be found in Attachment 3.1 – Statement of Work.

This procurement seeks to acquire and install a Credential Issuance and Management System (CIMS) to support smart card remote credential management, enterprise reporting and automated credential synchronization with internal directories.

A more detailed description of requirements, dates and place of performance, and FOB destination and acceptance point for deliverables are provided in the attached solicitation documents.

The provisions at 52.212-1 Instructions to Offerors–Commercial Items, applies to this acquisition. An addendum to 52.212-1 is provided in the attached solicitation document.

The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers: Technical Approach, Delivery, Past Performance, and Price.

Offerors shall include a completed copy of the provision at 52.212-3, Offeror Representations and Certifications–Commercial Items, with its offer. If the offeror’s annual representations and certifications are current in the U.S. Government beta.SAM.gov system, the offeror may merely state that the offeror’s representations and certifications are available through SAM in lieu of submitting the annual representations and certifications as part of the offeror’s proposal.

The clause 52.212-4 Contract Terms and Conditions–Commercial Items applies to this procurement. An addendum to 52.212-4 is provided in the attached solicitation document.

The clause 52.212-5, Contract Terms and Conditions Required To Implement Statutes Or Executive Orders–Commercial Items, applies to this acquisition; additional FAR and other clauses applicable to this acquisition are included in the attached solicitation document.

Defense Priorities and Allocation System (DPAS) does not apply to this acquisition.

Questions regarding this solicitation shall be submitted in electronic format to kyle.griggs@dot.gov no later than the times specified in Section 4.3.2 of the solicitation. Proposals shall be submitted in electronic format to the contract specialist at kyle.griggs@dot.gov no later than the times specified in Section 4.3.3 of the solicitation.

PART I – CONTINUATION OF BLOCK 20 OF THE SF 1449

1.1 SCHEDULE OF SUPPLIES/SERIVCES

The United States Department of Transportation (DOT), Office of the Secretary of Transportation (OST), Office of the Chief Information Officer (OCIO) requires the acquisition and installation of a Credential Issuance and Management System (CIMS) to support smart card remote credential management, enterprise reporting and automated credential synchronization with internal directories.

1.2 CONTRACT TYPE

The contractor shall perform the effort required by this contract on a Firm Fixed Price (FFP) basis.

1.3 SERVICES AND PRICES/COSTS

The following abbreviations are used in this price schedule:

1.3.1 PRICE SCHEDULE:

GRAND TOTAL

The offeror shall prepare its quote with Firm Fixed Prices listed for each CLIN, which will be used in the Government’s evaluation of the offeror’s price and will be used as the basis for the Continuation of Block 20 – Schedule of Supplies/Services in the awarded contract on the SF 1449. Further pricing instructions are found at Section 4.3 – Instruction to Offerors.

PART II – CONTRACT CLAUSES/ TERMS AND CONDITIONS

2.1 ADDENDUM TO FAR 52.212-4 -- CONTRACT TERMS AND CONDITIONS—COMMERCIAL ITEMS

The following clauses are incorporated into FAR 52.212-4 as an addendum to this contract.

2.1.1 FAR 52.252-2 -- CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR: https://www.acquisition.gov/browse/index/far

Date

2.1.2 FAR 52.203-14 -- DISPLAY OF HOTLINE POSTER(S) (JUN 2020)

(a) Definition. United States, as used in this clause, means the 50 States, the District of Columbia, and outlying areas.

(b) Display of fraud hotline poster(s). Except as provided in paragraph (c)—

(1) During contract performance in the United States, the Contractor shall prominently display in common work areas within business segments performing work under this contract and at contract work sites-

(i) Any agency fraud hotline poster or Department of Homeland Security (DHS) fraud hotline poster identified in paragraph (b)(3) of this clause; and

(ii) Any DHS fraud hotline poster subsequently identified by the Contracting Officer.

(2) Additionally, if the Contractor maintains a company website as a method of providing information to employees, the Contractor shall display an electronic version of the poster(s) at the website

(3) Any required posters may be obtained as follows:

(c) If the Contractor has implemented a business ethics and conduct awareness program, including a reporting mechanism, such as a hotline poster, then the Contractor need not display any agency fraud hotline posters as required in paragraph (b) of this clause, other than any required DHS posters

(d) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in all subcontracts that exceed the threshold specified in Federal Acquisition Regulation 3.1004(b)(1) on the date of subcontract award, except when the subcontract—

(1) Is for the acquisition of a commercial item; or

(2) Is performed entirely outside the United States.

(End of clause)

2.1.3 FAR 52.217-6 OPTION FOR INCREASED QUANTITY (MAR 1989)

The Government may increase the quantity of supplies called for in the Schedule at the unit price specified. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days before the end of the current period of performance. Delivery of the added items shall continue at the same rate as the like items called for under the contract, unless the parties otherwise agree.

2.1.4 FAR 52.217-7 OPTION FOR INCREASED QUANTITY-SEPARATELY PRICED LINE ITEM (MAR 1989) The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the end of the period of performance. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of clause)

2.1.5 FAR 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed six months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the end of the period of performance.

(End of clause)

2.1.6 TAR CLAUSES INCORPORATED BY REFERNCE

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

TAR: https://www.acquisition.gov/tar

Date

2.1.7 FEDERAL INFORMATION TECHNOLOGY SYSTEMS SECURITY REQUIREMENT (FedRAMP) FOR UNCLASSIFIED CLOUD CONTRACT (SEP 2016)

1. The Contractor shall be responsible for the following privacy and security safeguards.

a) To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records and databases.

b) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

c) The contractor shall also comply with any additional FedRAMP privacy requirements.

d) The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor's IT environment being used to provide or facilitate services for the Government.

e) The Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of C&A verification.

f) To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include, but is not limited to:

· Authenticated and unauthenticated operating system/network vulnerability scans

· Authenticated and unauthenticated web application vulnerability scans

· Authenticated and unauthenticated database application vulnerability scans

· Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

g) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

If the contractor chooses to run its own automated scans or audits, results from these scans may, at the Government's discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of contractor conducted scans shall be provided, in full, to the Government.

2. Sensitive Information Storage

For Official Use Only (FOUO) information, data, and/or equipment will only be disclosed to authorized personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected. When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

The disposition of all data will be at the written direction of the COR, this may include documents returned to Government control; destroyed; or held as specified until otherwise directed.

3. Protection of Information

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor's infrastructure, as well as maintains the right to request full copies of these at any time.

Government data loaded into or processed by the cloud services shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure.

The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

4. Security Classification

The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

5. Confidentiality and Nondisclosure

The preliminary and final deliverables and all associated working papers and other material deemed relevant by the agency that have been generated by the contractor in the performance of this contract, are the property of the U.S. Government and must be submitted to the COR at the conclusion of the contract. The U.S. Government has unlimited data rights to all deliverables and associated working papers and materials in accordance with FAR 52.227-14.

All documents produced for this project are the property of the U.S. Government and cannot be reproduced, or retained by the contractor. All appropriate project documentation will be given to the agency during and at the end of this contract. The contractor shall not release any information without the written consent of the Contracting Officer.

Personnel working on any of the described tasks may, at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

6. Disclosure of Information

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision ofthe Contractor or the Contractor's responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

7. Security Requirements Section

The minimum requirements for low, moderate and high impact level cloud systems are contained within the FedRAMP Cloud Computing Security Requirements Baseline. The contractor and Federal Government Agency share responsibility to ensure compliance with security requirements.

The implementation of a new Federal Government cloud system requires a formal process, known as Assessment and Authorization, which provides guidelines for performing the assessment.

FedRAMP requires cloud service providers to utilize a Third-Party Assessment Organization (3PAO) to perform an assessment of the cloud service provider's security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements.

The FedRAMP PMO security staff will be available for consultation during the process. Both the FedRAMP PMO staff and Joint Authorization Board (JAB) will review the results before issuing a Provisional Authorization decision. The Government reserves the right to verify the infrastructure and security test results before issuing an Authorization decision.

DOT will be able to leverage the provisional Authorization granted by FedRAMP, and agency issued FedRAMP authorizations, and any documentation prepared by the contractor to issue their own authority to operate in accordance with DOT Security Authorization & Continuous Monitoring Performance Guide.

The contractor is advised to review the FedRAMP guidance documents (see References below) to determine the level of effort that will be necessary to complete the requirements. All FedRAMP documents and templates are available at http://FedRAMP.gov.

8. FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low, moderate, and high impact level systems (as defined in FIPS 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision No. 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance. In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

9. Required FedRAMP Policies and Regulations:

OMB Memo Security Authorization of Information Systems in Cloud Computing Environments

10. Assessment and Authorization:

The Agency may choose to cancel the (Contract/award) and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

11. Assessment of the System:

1. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System's NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the documentation using FedRAMP requirements and templates, which are available at http://FedRAMP.gov.

2. Information systems must be assessed by an accredited 3PAO whenever there is a significant change to the system's security posture in accordance with the FedRAMP Continuous Monitoring Plan.

3. The Government reserves the right to perform Penetration Testing. If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities include but are not limited to scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

4. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor's implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require POA&Ms to be remediated before a provisional or agency authorization is issued.

The contractor is responsible for mitigating all security risks found during Authorization & Assessment and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the https://www.fedramp.gov/

5. date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

12. Authorization of System:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct onsite inspections. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

13. Reporting and Continuous Monitoring:

Maintenance of the FedRAMP Provisional or DOT-issued Authorizations will be through continuous monitoring and periodic audit of the operational controls within a contractor's system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the FedRAMP PMO as required by FedRAMP Requirements. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. The deliverables allow the FedRAMP JAB and/or DOT to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan.

14. Audit, Inspection, and Access

The contractor shall respond to government requests for documentation and/or access to the contractor’s facilities for any lawful government purpose to include oversight, audit, and inspection within a reasonable period of notification from the government not less than two (2) business days unless otherwise negotiated as specific terms within the governing contract. The contractor shall provide access and documentation without requirement for separate or additional non-disclosure. The government commits to the contractor that information provided by the contractor shall be retained no longer than required by law or applicable Department/Agency policy, shall be appropriately protected while within the government's possession, and shall be destroyed in accordance with Federal requirements for the destruction of sensitive information and media when no longer required.

Additional Stipulations:

1. The FedRAMP deliverables shall be labeled "FOR OFFICIAL USE ONLY" (FOUO) or other label as determined by the Government per document sensitivity. External transmission/dissemination of deliverables labeled FOUO or similar marking or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, "Security requirements for Cryptographic Modules."

2. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, "Privacy Act Notification" and FAR clause 52.224-2, "Privacy Act."

3. The contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government's agent.

2.1.8 INFORMATION ASSURANCE

The Contractor may have access to sensitive (to include privileged and confidential) data, information, and materials of the U.S. Government. These printed and electronic documents are for internal use only and remain the sole property of the U.S. Government. Some of these materials are protected by the Privacy Act of 1974 (AMENDED) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2.1.9 CONTRACT ADMINISTRATION POINTS OF CONTACT

(a) Technical Point of Contact (TPOC):

Provided after award.

(b) Contract Specialist (CS):

Provided after award.

(c) Contracting Officer (CO):

Provided after award.

2.1.10 TECHNICAL POINT OF CONTACT (TPOC)

(a) The Contracting Officer is the only individual authorized to enter into or terminate this contract, modify any term or condition of this contract, waive any requirement of this contract, or accept nonconforming work delivered under this contract.

(b) The Contracting Officer has designated ______________ as the Technical Point of Contact (TPOC) for this award. The TPOC’s responsibilities shall include technical monitoring of the contractor’s performance on the overall contract award and inspecting and accepting deliveries under the contract. The COR shall be appointed in writing, at which time ALL of the responsibilities of the COR shall be detailed, and a copy of the appointment memorandum shall be furnished to the contractor. Any changes to the COR delegation shall be made in writing through modification to this contract and changes to the existing memorandum or by issuance of a new appointment memorandum. Copies of any changes shall be provided to the contractor.

(c) The TPOC is not authorized to perform, formally or informally, any of the following actions:

(1) Promise, award, agree to award, or execute any contract, contract modification, or notice of intent that changes or may change this contract;

(2) Waive or agree to any modification of the delivery schedule;

(3) Make any final decision on any contract matter subject to the Disputes Clause;

(4) Terminate, for any reason, the contractor’s right to proceed, or issue any order causing the contractor to stop work; or

(5) Obligate in any way, the payment of money by the Government.

(d) The contractor shall comply with the written or oral direction of the Contracting Officer or authorized representative(s) acting within the scope and authority of the appointment memorandum. The contractor need not proceed with direction that it considers to have been issued without proper authority. The contractor shall notify the Contracting Officer in writing, with as much detail as possible, when the TPOC, if applicable, has taken an action or has issued direction (written or oral) that the contractor considers to exceed the TPOC appointment, within 3 days of the occurrence. Unless otherwise provided in this contract, the contractor assumes all costs, risks, liabilities, and consequences of performing any work it is directed to perform that falls within any of the categories defined in paragraph (c) prior to receipt of the Contracting Officer’s response issued under paragraph (e) of this clause.

(e) The Contracting Officer shall respond in writing within 30 days to any notice made under paragraph (d) of this clause. A failure of the parties to agree upon the nature of a direction, or upon the contract action to be taken with respect thereto, shall be subject to the provisions of the Disputes clause of this contract.

(f) The contractor shall provide copies of all correspondence to the Contracting Officer and the TPOC, if applicable.

(g) Any action(s) taken by the contractor, in response to any direction given by any person acting on behalf of the Government or any Government official other than the Contracting Officer or the TPOC acting within his or her appointment, shall be at the contractor’s risk.

2.1.11 TECHNICAL DIRECTION

Performance of the work under this task order is subject to the Technical Direction of the TPOC. The term “Technical Direction” is defined to include, without limitation, the following:

(a) Direction to the Contractor which redirects the efforts, shifts work emphasis between work areas, requires pursuit of certain lines of inquiry, fills in details, provides project based estimates, or otherwise serves to accomplish the task order requirements;

(b) Provision of information to the Contractor that assists in the interpretation of drawings, specifications or technical portions of the work description; and,

(c) Review and approval/rejection of technical reports, drawings, specifications and technical information to be delivered by the Contractor.

All Technical Direction must be within the general scope of work stated in the contract. The TPOC does not have the authority to and may not issue any Technical Direction that:

(a) Constitutes an assignment of additional work outside the general scope of the base contract;

(b) Constitutes a change as defines in the base contract clause entitled “Changes”;

(c) In any manner causes an increase or decrease in prices set forth in Section B; or

(d) Changes any of the expressed terms, conditions or specifications of the contract.

All Technical Direction must be issued in writing, or shall be confirmed in writing by the TPOC within 3 working days after issuance. The Contractor shall proceed promptly with the performance of duly issued Technical Directions. However, if in the opinion of the Contractor, the direction issued but the TPOC is within one of the prescribed categories in (a) through (d) above, the Contractor shall not proceed, but shall notify the Contracting Officer in writing, within 3 working days after receipt of any such direction. The Contracting Officer will determine if the Technical Direction is proper, or if a contract modification would be required to properly implement the direction. Failure of the parties to agree upon the nature of the direction or upon the contract action to be taken with respect thereto shall be subject to the clause included in paragraph (d) of FAR 52.212-4.

2.1.12 INVOICING INSTRUCTIONS - iSUPPLIER CLAUSE

Invoices shall be submitted for each CLIN only after the fulfillment of all requirements on that CLIN.

ELECTRONIC SUBMISSION OF PAYMENT REQUESTS

1. Definitions. As used in this clause—

0. Contract financing payment has the meaning given in FAR 32.001.

0. Payment request means a bill, voucher, invoice, or request for contract financing payment or invoice payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices,” this clause, and the applicable Payment clause included in this contract.

0. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods and formats identified in paragraph (c) of this clause. Facsimile, email, and scanned documents are not acceptable electronic forms for submission of payment requests.

0. Invoice payment has the meaning given in FAR 32.001.

1. Electronic payment requests. Except as provided in paragraph (e) of this clause, the Contractor shall submit payment requests in electronic form. Purchases paid with a Governmentwide commercial purchase card are considered to be an electronic transaction for purposes of this rule, and therefore no additional electronic invoice submission is required.

1. The Department of Transportation utilizes the Delphi eInvoicing web-portal for processing invoices. For vendors submitting invoices, and certain grantees submitting payment requests, they will be required to submit invoices via Delphi eInvoicing which is accessed and authenticated via www.login.gov

1. In order to receive payment and in accordance with the Prompt Payment Act, all invoices submitted as attachments in the Delphi eInvoicing web-portal shall contain the following:

3. Invoice number and invoice date.

3. Period of performance covered by invoice.

3. Contract number and title.

3. Task/Delivery Order number and title (if applicable).

3. Amount billed (by CLIN), current and cumulative.

3. Total ($) of billing.

3. Cumulative total billed for all contract work to date.

3. Name, title, phone number, and mailing address of person to be contacted in the event of a defective invoice.

If the contract includes allowances for travel, all invoices which include charges pertaining to travel expenses will catalog a breakdown of reimbursable expenses with the appropriate receipts to substantiate the travel expenses.

1. Payment system registration. All persons accessing the Delphi eInvoicing web-portal will be required to have their own unique user Delphi eInvoicing ID and password and be credentialed through login.gov.

4. Electronic authentication. See www.login.gov for instructions. Click on the following link for instructions on establishing a login.gov account: https://login.gov/help/creating-an-account/how- to-create-an-account/

4. To create a login.gov account, the user will need a valid email address and a working phone number. The user will create a password and then login.gov will reply with an email confirming the email address.

4. Agency POC’s will be responsible for communicating with vendor POC’s to initiate the Delphi eInvoicing account creation process. Vendor POC’s who require access to the eInvoicing web-portal for invoice submission and payment tracking purposes will be required to provide their full name, email address, and current phone number to the agency POC to initiate the Delphi eInvoicing web-portal account. Vendor users and the agency POC will be notified via e- mail when the account is created. The vendor user will be provided detailed instructions for logging into their Delphi eInvoicing account.

If the Vendor has any general questions or issues accessing the iSupplier web-portal, please have them contact the ESC iSupplier helpdesk either at:

2. https://einvoice.esc.gov/

2. Call Delphi Help Desk at 1-866-641-3500, option #4, then option #3

4. Training on Delphi. To facilitate use of DELPHI, comprehensive user information is available at http://einvoice.esc.gov.

4. Account Management. Vendors are responsible for contacting the Delphi Help Desk when their firm’s points of contacts will no longer be submitting invoices so they can be removed from the system. Instructions for contacting the Delphi Help Desk can be found at http://einvoice.esc.gov.

4. To add new points of contacts, Vendors are to submit the name(s), email address(es) and phone number(s) to Wasilla Jordon (OST) (Wasilla.jordon.ctr@dot.gov)

Account Management

If a user ID becomes inactive/times out due no activity by the POC, the Vendor shall contact Wasilla Jordon (OST) (wasilla.jordon.ctr@dot.gov) with the full name, title, phone number, e-mail address, and user ID of the POC to be reactivated. To prevent being timed out due to no-activity, users should login once within 45 days of their last login.

Waivers

The Department of Transportation Financial Management officials may, on a case by case basis, waive the requirement to register and use the DELPHI eInvoicing System. Waiver request forms can be obtained on the DELPHI eInvoicing website (http://www.dot.gov/cfo/delphi-einvoicing- system.html) or by contacting the COR. All Vendors must explain why they are unable to use or access the Internet to register and enter payment requests.

All waiver requests shall be sent via mail to:

Director of the Office of Financial Management US Department of Transportation, B-30 Office of Financial Management, Room W93-431 1200 New Jersey Avenue SE Washington DC 20590-0001 or electronically to: DOTeInvoicing@dot.gov

The Director of the DOT Office of Financial Management will confirm or deny the request within approximately 30 days.

If a Vendor is granted a Waiver, Requests for Advance or Reimbursement and required supporting documents, shall be sent via regular U.S. Postal Service to the following address:

Federal Highway Administration Invoice Processing P.O. Box 268865 Oklahoma City, OK 73126-8865 Attention: (Fill-in Name of Contract Specialist) Invoices submitted via an overnight service must use one of the following physical addresses: MMAC

OST/AMZ-150

6500 MacArthur Blvd. Oklahoma City, OK 73169 Attention: (Accounting Technician)

MMAC

OST-WCF/AMZ-150

6500 MacArthur Blvd. Oklahoma City, OK 73169 Attention: (Accounting Technician)

Express Delivery Point of Contact: Lead Account Technician, 405-954-8252

All invoices, regardless of submission method, must identify the Contract Specialist as the invoicing point of contact.

Final Invoices

For firm-fixed-price (FFP) contracts where supplies are delivered or services are performed, the final invoice is not subject to further contract settlement actions between the Government and the Contractor.

For non-FFP contracts, further contract settlement actions may exist where final invoices are not to be submitted yet until these contract settlement actions are resolved. For these contracts, the Contracting Officer will process final invoices as a routine part of the closeout process. When requested, the Contractor shall submit the final invoice directly to the Contracting Officer/ Contract Specialist along with the final closeout documents. When the final invoice is ready for payment, the Contracting Officer will inform the Contractor that the final invoice can be submitted through the iSupplier system.

2.2 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS-COMMERCIAL ITEMS (JAN 2021)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AUG 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: [Contracting Officer check as appropriate.] _X_ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUNE 2020), with Alternate I (OCT 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

_ X _ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (JUN 2020) (41 U.S.C. 3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

_ X _ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) ( 31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

_ X _ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (JUN 2020) (31 U.S.C. 6101 note).

_ X _ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11) (i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (MAR 2020) (15 U.S.C. 657a).

__ (ii) Alternate I (MAR 2020) of 52.219-3.

__ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (MAR 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (MAR 2020) of 52.219-4.

__ (13) [Reserved] _ X _ (14) (i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-6.

__ (15) (i) 52.219-7, Notice of Partial Small Business Set-Aside (NOV 2020) (15 U.S.C. 644).

__ (ii) Alternate I (MAR 2020) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C. 637(d)(2) and (3)).

__ (17) (i) 52.219-9, Small Business Subcontracting Plan (JUN 2020) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (NOV 2016) of 52.219-9.

__ (iii) Alternate II (NOV 2016) of 52.219-9.

__ (iv) Alternate III (JUN 2020) of 52.219-9.

__ (v) Alternate IV (JUN 2020) of 52.219-9 __ (18) (i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) (15 U.S.C. 644(r)).

__ (ii) Alternate I (MAR 2020) of 52.219-13.

_ X _ (19) 52.219-14, Limitations on Subcontracting (MAR 2020) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages-Subcontracting Plan (JAN 1999) (15 U.S.C. 637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (MAR 2020) (15 U.S.C. 657f).

_ X _ (22) (i) 52.219-28, Post Award Small Business Program Representation (NOV 2020) (15 U.S.C. 632(a)(2)).

__ (ii) Alternate I (MAR 2020) of 52.219-28.

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (MAR 2020) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Mar2020) (15 U.S.C. 637(m)).

__ (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR 2020) (15 U.S.C. 644(r)).

__ (26) 52.219-33, Nonmanufacturer Rule (MAR 2020) (15U.S.C. 637(a)(17)).

_ X _ (27) 52.222-3, Convict Labor (JUN 2003) (E.O.11755).

_ X _ (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (JAN2020) (E.O.13126).

_ X _ (29) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

_ X _ (30) (i) 52.222-26, Equal Opportunity (SEP 2016) (E.O.11246).

_ X _ (ii) Alternate I (FEB 1999) of 52.222-26.

_ X _ (31) (i) 52.222-35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C. 4212).

__ (ii) Alternate I (JUL 2014) of 52.222-35.

_ X _ (32) (i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

__ (ii) Alternate I (JUL 2014) of 52.222-36.

__ (33) 52.222-37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212).

_ X _ (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

_ X _ (35) (i) 52.222-50, Combating Trafficking in Persons (OCT 2020) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (36) 52.222-54, Employment Eligibility Verification (OCT 2015). (Executive Order 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (37) (i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (MAY 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (JUN 2016) (E.O. 13693).

__ (40) (i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (JUN 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (OCT 2015) of 52.223-13.

__ (41) (i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (JUN 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun2014) of 52.223-14.

__ (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (MAY 2020) (42 U.S.C. 8259b).

__ (43) (i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (OCT 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (JUN 2014) of 52.223-16.

_ X _ (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020) (E.O. 13513).

__ (45) 52.223-20, Aerosols (JUN 2016) (E.O. 13693).

__ (46) 52.223-21, Foams (Jun2016) (E.O. 13693).

_ X _ (47) (i) 52.224-3 Privacy Training (JAN 2017) (5 U.S.C. 552 a).

__ (ii) Alternate I (JAN 2017) of 52.224-3.

__ (48) 52.225-1, Buy American-Supplies (JAN2021) (41 U.S.C. chapter 83).

__ (49) (i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (JAN 2021)(41 U.S.C.chapter83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (JAN 2021) of 52.225-3.

__ (iii) Alternate II (JAN 2021) of 52.225-3.

__ (iv) Alternate III (JAN 2021) of 52.225-3.

__ (50) 52.225-5, Trade Agreements (OCT 2019) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (51) 52.225-13, Restrictions on Certain Foreign Purchases (JUN 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302Note).

__ (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov2007) (42 U.S.C. 5150).

__ (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov2007) (42 U.S.C. 5150).

__ (55) 52.229-12, Tax on Certain Foreign Procurements (JUN 2020).

__ (56) 52.232-29, Terms for Financing of Purchases of Commercial Items (FEB 2002) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (57) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

_ X _ (58) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT2018) (31 U.S.C. 3332).

__ (59) 52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (60) 52.232-36, Payment by Third Party (MAY 2014) (31 U.S.C. 3332).

_ X _ (61) 52.239-1, Privacy or Security Safeguards (AUG 1996) (5 U.S.C. 552a).

__ (62) 52.242-5, Payments to Small Business Subcontractors (JAN 2017) (15 U.S.C. 637(d)(13)).

__ (63) (i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631).

__ (ii) Alternate I (APR 2003) of 52.247-64.

__ (iii) Alternate II (FEB 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: [Contracting Officer check as appropriate.] __ (1) 52.222-41, Service Contract Labor…