Request for Quotation 693JJ320Q000049.pdf

Request for Quotation 693JJ320Q000049 Page 1

REQUEST FOR QUOTATION (RFQ)

Issuing Office: Federal Highway Administration (FHWA)

Office of Acquisitions and Grants Management Office of Assistance Agreement & Acquisition Services

HFCA-31

1200 New Jersey Avenue, S.E.

Mail Stop: E65-101 Washington, DC 20590-0001

Agency Contact: Gunnar Prutz, Contracting Officer Telephone: (360) 619-7685 Gunnar.Prutz@dot.gov

Title: 693JJ320Q000049 - FHWA Library Integrated Library System

(ILS) Service

RFQ Release Date: April 6, 2020

Questions Due Date: April 14, 2020 12:00 PM Eastern Time

Quotations Due Date: April 21, 2020 12:00 PM Eastern Time

Submit Quotations and Questions to: Gunnar.Prutz@dot.gov

Request for Quotation 693JJ320Q000049 Page 2

PART I

This is a Firm Fixed Price Request for Quotation (RFQ), No. 693JJ320Q000049, being issued by the Federal Highway Administration (FHWA) Office of Acquisitions and Grants Management for the FHWA Library Integrated Library System (ILS) Service.

This OPEN-MARKET solicitation is prepared in accordance with FAR Part 12, the acquisition of commercial items in conjunction with the policies and procedures for solicitation, evaluation, and award as prescribed in FAR 13, Simplified Acquisition Procedures. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular

(FAC) 2020-05.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued.

This solicitation is UNRESTRICTED and the North American Industry Classification System (NAICS) code is 519120 with an industry size standard of $16.5 million. A responsible quoter is one whose quote conforms to the solicitation and will be most advantageous to the Government.

It is the contractor’s responsibility to be familiar with applicable clauses and provisions. FAR Provisions and Clauses may be viewed and/or downloaded from https://www.acquisition.gov/?q=browsefar.

To be eligible to receive a Government Contract a contractor must be registered and active in www.SAM.gov prior to award.

Instructions for Preparation of Quotations:

In responding to this RFQ, the quotation MUST include the following:

1. Technical Quote: Narrative discussion addressing the quoter’s technical approach, this is to include a description of how the Statement of Work requirements will be completed. A contractor’s quote is technically acceptable when it addresses the Statement of Work requirements. Addressing FEDRAMP and Section 508 of the Rehabilitation Act in addition to the modules needed to fulfil this SOW is required. Screenshots of the library system to demonstrate capabilities are required to be included in quotation.

2. Price Quote: Submitted pricing in the format of the Contract Line Item Number (CLIN)

Structure table shown in Part II.

Include the names and pricing of the modules needed to fulfil this SOW, including integrated customizable reference tracker and customizable report writing.

3. Organizational Information: The quotation shall include the following mandatory business information regarding your company in the body of the cover email message:

Request for Quotation 693JJ320Q000049 Page 3

a. Does your company accept government purchase orders?

b. Business Size (Small, Woman-Owned, Disadvantaged, Hub-Zone, Large, Non- Profit, etc)

c. Payment Terms (Government Standard is NET 30)

d. Dunn & Bradstreet Number

e. Federal Tax Identification Number (9-Digits)

f. Correct Mailing Address for the order (include name, telephone, email address)

g. Is the company information listed in the System for Award Management

(SAM) current and accurate? https://www.sam.gov/portal/public/SAM/

4. Instructions for Preparation of the Quotation: The quotation shall be submitted electronically as Adobe (.pdf) files with the pricing and organizational information sections submitted in a SINGLE email whose size shall not exceed 10 Megabytes.

A maximum of 15 pages is allowed for the quotation, inclusive of resumes. Pages beyond the limit will not be evaluated.

Cover page, price quotation, and table of contents do not apply to the page limit.

5. Past Performance information: Contractor shall submit 3 previous projects performed that are similar in size and scope, completed within the previous 5 years. Provide contact information for past performance check, including name, phone number and email address.

6. Evaluation of the Quotation: The Government intends to evaluate quotes and make a lowest price technically acceptable award.

NOTE: Failure to furnish all information required above may result in your quotation being considered non-responsive and eliminated from further consideration.

Request for Quotation 693JJ320Q000049 Page 4

PART II

FHWA Library Integrated Library System (ILS) Service

The Contractor shall furnish all products and non-personal technical, administrative, and other support services to perform the tasks described under this Statement of Work. The Contractor shall furnish all products and non-personal services in support of the mission of the Federal Highway Administration’s (FHWA’s) Office of Research, Development, and Technology.

This is a Firm Fixed Price (FFP) Purchase Order.

CONTRACT LINE ITEM

NUMBER (CLIN)

DESCRIPTION FIRM FIXED

PRICE

0001- Base Year Integrated Library System including:

Delivery and Installation Training of the Integrated

Library System Service, support and maintenance service agreement 06/01/2020 – 05/31/2021

0002 - Option Year 1 Service, support and maintenance service

06/01/2021 – 05/31/2022

0003 - Option Year 2 Service, support and maintenance service

06/01/2022 – 05/31/2023

0004 - Option Year 3 Service, support and maintenance service

06/01/2023 – 05/31/2024

0005 - Option Year 4 Service, support and maintenance service

06/01/2024 – 05/31/2025

The Total Maximum Potential Price for all work under this Purchase Order:

Request for Quotation 693JJ320Q000049 Page 5

Part III

Office of Research, Development, and Technology

Statement of Work

For

FHWA Library Integrated Library System (ILS) Service

Request for Quotation 693JJ320Q000049 Page 6

1.0 Overview

This is a non-personal services contract to provide Integrated Library Services1 (ILS). The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government as defined in this Statement of Work (SOW). The Contractor shall perform to the standards herein.

1.1 Background

Over the past 10 years, the FHWA Research Library has used specialized library cataloging software to catalog library holdings, including videos, graphics, periodicals, databases, and other publications—both online and in printed copy. The agency started with software that was housed on FHWA servers, but 10 years ago, switched to an online, commercial-off-the-shelf, Web-based service hosted by the ILS service provider. The FHWA Research Library has approximately 28,000 records in MARC 21, machine-readable, barcode compatible format.

The ILS serves as a dynamic central repository of data describing and providing access to a broad variety of library resources and holdings that facilitate the maintenance and expansion of library service and research. Those resources might include publications, videos, graphics, or articles. In addition, the system enables cataloging of unpublished material and e-books.

Librarians use the system to catalog and upload/download information about library holdings, share records with other libraries, generate queries and reports, communicate notifications to library users, and to track borrowing/circulation. Library users (OPAC users) perform searches in the system for holdings and borrowing status, save searches, and export search results.

1.2 Objective

The Federal Highway Administration (FHWA) Research Library is seeking a powerful and flexible commercial-off-the-shelf integrated library system (ILS) service to enable cataloging of electronic and hard copy documents in a database system. The system is web-based and shall include cataloging/bibliographic control, public access, circulation, serials control, knowledge management, reference/request tracking, robust and user-friendly search engine, and report generation.

1.3 Detailed Requirement

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the services listed in this section.

1.3.1 General Description and Technical Functions of Service

1. The ILS system must be FedRAMP compliant. See Section H. for information about this security requirement.

2. The ILS system must be MARC 21 compatible. Upon industry acceptance of the new standard, the ILS shall have the capability to change to the new frame format currently called BIBFRAME, for the bibliographic frame initiative. The system shall fully integrate

1 A group of automated library subsystems working together and communicating within the same set or system of software to control such activities as circulation, cataloging, acquisitions, and serial control.

Request for Quotation 693JJ320Q000049 Page 7 cataloging, circulation, serials, and public access catalog (OPAC), with a full MARC database. A sample FHWA Research Library record is included in appendix 3.

3. After notification by TPOC of industry standard change to BIBFRAME contractor shall convert FHWA records to the new format within 6 months.

4. The system shall be machine readable and capable of interfacing with other institutional data through different systems.

5. The system shall be able to import and export data at any time in a variety of formats, at a minimum including MARC, XML, and Dublin Core (or have a mechanism for mapping to Dublin Core).

6. The system shall enable the library to upload records from the ILS to other catalog databases easily.

7. The system shall be Z39.50 compliant.

8. The system shall support standard barcode readers (scanners). The system shall utilize industry standard barcode labels, specifically Code 39. The system shall include barcode numbers on items and user IDs shall be able to be scanned or manually entered into the system.

9. The ILS shall reduce the likelihood of incorrect or conflicting information (such as duplicate record check, missing data, URL checker, etc.) being entered into the database, and speed users through any operations.

10. The system shall be designed for ease of use by nontechnical personnel and library patrons.

11. The system shall provide sophisticated searching capabilities in all modules.

12. The system shall include the ability to customize fields and metadata and manage nontraditional data sources.

13. The system shall allow for 5 library staff accounts (record data entry, and record management) to have concurrent access to administrative functions and enter/manage information in modules. The system must accommodate additional users without noticeable performance issues such as slower rate of record upload or long waits between screens.

14. The system shall support unlimited web Online Public Access Catalog (OPAC) users.

15. The system shall have a mechanism for receiving and addressing feedback and problems with the system from the library staff, such as enhancement requests, problems, and feedback. A mechanism to log and track support requests is required.

16. The ILS service shall initially be able to limit access to internal USDOT employees (by IP address recognition or some other means other than sign in), and shall be capable of being made available to the public if needed. If the system is made public2 (as requested under this SOW by TPOC), then the ILS public view must follow W3C Web standards at www.W3C.org and “Minimum Requirements for FHWA Web Pages” (in appendix 1). The standard “header” and “footer” listed in the “Minimum Requirements for FHWA Web Pages” means the capability to mimic the “look and feel” of the FHWA Web site headers and footers at https://highways.dot.gov. See appendix 2.

17. The Contractor shall provide data conversion (record migration of bibliographic and

2 Should the FHWA decide to make the system available to the public, the Contractor could be asked to designate an IP address to the FHWA public view so that the agency could assign a domain name to that IP address such as http://library.fhwa.dot.gov.

Request for Quotation 693JJ320Q000049 Page 8 patron records), loading, and minor customization support, as well as database testing and confirmation.

18. In addition, the Contractor shall provide training to library staff. Training shall include education about all modules of the software including, administrative functions, and OPAC. The Contractor will provide the training to 5 people and will supply all online conferencing equipment, instructors, training documentation, and any other training materials needed to educate the FHWA library personnel.

1.3.2 Cataloging

1. The system shall encode all bibliographic records in .MARC 21 Format for Bibliographic Data with the ability to transition to the BIBFRAME format without limitation on record length.

2. The system shall support Anglo-American Cataloguing Rules, 2nd edition (AACR2), and Resource Description and Access (RDA) cataloging standards.

3. The system shall be capable of importing and exporting bibliographic records in MARC 21 Format for Bibliographic Data, XML, and Dublin Core (or a method to map to/from Dublin Core) from utilities like OCLC Connexion browser and client, without vendor intervention and with full preservation of all content designators.

4. The system shall provide for display of all MARC content designators (field tags, subfield codes, indicators) in the cataloging module and suppress display of codes in the online public access catalog display.

5. The system shall be flexible, i.e., enabling librarians to develop cataloging templates for multiple workflows to create data entry shortcuts and save work on repetitive tasks, especially with regards to original cataloging.

6. The system shall be able to allow customizable fields that are outside of the MARC fields so that the library can filter items using additional fields.

7. The system shall have the ability to assign security levels to patron groups (e.g., on group can access subscription information and another cannot access that subscription record).

8. The system shall allow users to get needed information without moving hierarchically between ILS functional subsystems.

9. The system shall have the ability to display/include holdings, notes, and other access information for e-resources.

10. The system shall allow a seamless flow between modules, i.e., multiple views of the different modules simultaneously without having to sign-in and sign-out. For example, working in the cataloging module, jumping to the authority module to fix a heading and then going back to work in the cataloging module.

1.3.3 Authority Control

1. The system shall support .MARC 21 Format for Authority Data and allow all relevant bibliographic fields to be authority controlled.

2. The preference is that the system shall generate SEE and SEE ALSO references from authority records and display them in the OPAC.

3. The system shall be capable of importing and exporting authority records in .MARC 21

Request for Quotation 693JJ320Q000049 Page 9

Format for Authority Data from bibliographic utilities like, OCLC Connexion browser and client, without vendor intervention and with full preservation of all content designators.

4. The system shall be capable of editing bibliographic and authority records individually and globally and allow easy access to authority records editing from within the cataloging module.

1.3.4 Serials

1. The system shall provide publication patterns for regular and irregular titles a n d must be easy to set up and maintain.

2. The system shall support check-in of serial issues, including serials received out of sequence or combined issues, irregular titles, indexes, supplements, and other variations.

3. The system shall be able to search by ISSN.

4. The system shall have the ability to generate claims and other memos on demand.

5. The system shall have the ability for the serials check-in system to automatically update the MARC 21 holdings record

6. The system shall adhere to MARC 21 Format for Holdings Data, and ANSI/NISO

Z39.71 Holdings Statements for Bibliographic Items standards, and retain this format when exporting holdings data. In addition, the system shall include the following:

a. the ability to automatically generate summary holdings

b. the ability to export holdings data to allow participation in union lists or library data exchanges

1.3.5 Circulation

1. The system shall allow for customizable check-out, check-in, renewals, holds, and interlibrary loans.

2. The system shall support staff configuration of loan periods, patron types, and other circulation parameters.

3. The system shall support the delivery of pre-due-date and overdue notices by email.

4. The system displays circulation status information in the public access catalog without revealing the identity of patrons.

5. The system shall allow a material lookup by partial or complete title, author, call number, or item barcode.

6. The system allows the librarian to perform a patron lookup by partial or complete patron name.

7. The system allows for the creation of a temporary item record to facilitate circulation of materials that have not been cataloged.

8. The system shall have the ability to create messages that show up in circulation module and the OPAC.

1.3.6 Online Public Access Catalog (OPAC)

1. The full range of information in the ILS must be available from a variety of physical

Request for Quotation 693JJ320Q000049 Page 10 locations to the research community, to library staff, and to remote users.

2. The system shall allow users to search the collection by using both keyword and key phrase elements.

3. The system shall allow full Boolean searching capability across or within all fields of the full bibliographic record.

4. Search Function shall have a simple and advanced search. The simple search, shall enable web OPAC users to search records and then narrow searches by filtering and sorting the results. The ILS also shall enable librarians to add additional fields such as one or more dropdown tables of terms that would enable topic-based or other means of providing users with filtering mechanisms. It is preferred that OPAC users are able to export search results to useable formats such as ENL (Endnote), RIS (citation manager language), and XLS/CSV (Microsoft® Excel®).

5. The system shall allow the user to browse and filter searches by specific categories, such as title, author, subject, series, etc., with system displaying closest match if exact match not found.

6. The system shall provide the user the ability to place a hold on any circulating title desired.

7. The system shall provide the user the ability to view their current records, items checked-out, and holds placed and ability to renew online.

8. The system shall provide the user the ability to print whatever is displayed on the screen, and if possible, to export research results to a useable format such as Excel if so desired.

9. The system shall provide the user the complete description of item status, including due dates, location within the collection, holdings, etc.

10. The system shall provide the user the ability to view the bibliographic record in multiple record displays: Brief, Full, MARC.

11. The system shall provide the user the capability of displaying hyperlinks with the bibliographic record.

12. The system shall provide the user easy access to the location and status of holdings after a search.

1.3.7 Reference/Request Tracking

1. The system shall provide a dedicated module/tool that can be integrated with the system to track material, reference, and information requests from patrons.

2. The system shall provide integration of requests with patron records.

3. The system shall have the ability of tracking and finding status, staff assigned to fulfill requests, and other related fields.

4. The system shall have the ability to create custom categories and filters that can help categorize requests, assign the cost or number of items associated with a request, and indicate the amount of time spent on a request by each staff member.

5. The system shall have the ability to submit requests via a Web form and track requests.

1.3.8 Report Writing

1. The system shall include a report generator allowing staff to create custom reports, run, Request for Quotation 693JJ320Q000049 Page 11 schedule automated report generation and distribution, and email and publish reports in various outputs including Excel.

2. The system shall be able to generate reports with statistics such as number of requests by department, origin of request, category, and other information.

3. The system shall allow new relationships, new/customized queries, and new reports to be added or modified without changing the program source code.

4. The system shall be able to generate reports and alerts for subscription dates or other criteria set by the library for e-resources.

1.3.9 Support and Maintenance Service

The contractor shall have a dedicated maintenance service for the ILS System.

The contractor shall provide service maintenance for the duration of the period of performance that will begin on the contract award date. The service maintenance agreement will provide for the following:

1. Customer support via electronic means including telephone, chat, or email during normal business hours. 8:00AM to 5:00PM, Eastern Time, Monday through Friday

2. System installation and implementation including software components, data import, cleanup, and any needed other installation and implementation required to stand up the system at FHWA, including review by the FHWA IT and IT Security teams. Any adjustments needed upon review of the FHWA IT and IT Security teams shall be the responsibility of the contractor to implement

3. Contractor IT consultation and troubleshooting

4. Data conversion support

5. Web-based, telephone, and conference-centered user training and consultation. The contractor shall be responsible for coordinating and training five library staff on all components of the system and shall host consultation sessions when needed, and online training modules and webinars which the contractor shall host

Upon notification of the event of failure of any unit of the ILS system by the FHWA Research Library, the contractor shall provide maintenance service in accordance with its normal operation procedures.

Repair and maintenance work will be performed at the location of the equipment during normal working hours as appropriate. Normal working hours for the purpose of this contract are 8:00AM to 5:00PM Eastern Time Monday through Friday, excluding Federal Holidays.

2.0 Period of Performance

The period of performance shall be for one Base period of one year and four one year option periods. The Period of Performance reads as follows:

Base Period 06/01/2020 – 05/31/2021 Option Period I 06/01/2021 – 05/31/2022 Option Period II 06/01/2022 – 05/31/2023 Option Period III 06/01/2023 – 05/31/2024 Option Period IV 06/01/2024 – 05/31/2025

Request for Quotation 693JJ320Q000049 Page 12

The contractor shall deliver all related supplies to the following address:

Federal Highway Administration Turner-Fairbank Highway Research Center FHWA Research Library c/o Dawn Vanlandingham Corporate Research, Technology, and Innovation Management 6300 Georgetown Pike McLean, VA 22101

3.1 Place of Performance

The primary place of performance shall be at Contractor's facility and if uploaded to a DOT data center or DOT cloud service, the contractor will be responsible for providing bug fixes and updates to the software so that DOT can install them to the server. Cataloging access and training (via Webinar or other electronic means) shall take place at Turner-Fairbank Highway Research Center, 6300 Georgetown Pike, McLean, VA. Cataloging access may also take place at telework locations.

3.2 Physical Security

The Contractor shall be responsible for safeguarding all government equipment, information, and property provided for Contractor use.

3.3 Special Qualifications

FEDRAMP Certified as indicated by https://www.fedramp.gov/. See Section 5.2 for more information.

3.4 Periodic Progress Meetings

The contractor agrees to attend progress meetings. The Contracting Officer or Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance via phone conference or other electronic means hosted by the Government. At these meetings, the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

3.5 Organizational Conflict of Interest

Contractor and subcontract personnel performing work under this award may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.), or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever he/she becomes aware that such access or participation may result in any actual or potential OCI, and may merit the submittal of a plan to the CO to avoid or mitigate any such OCI. This mitigation plan would be determined to be acceptable solely at the discretion of the CO, and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may effect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

Request for Quotation 693JJ320Q000049 Page 13

4.0 Government Furnished Equipment and Services

4.1 Services

The Government will provide library staff to work with contractor for data transfer and installation/implementation of the system.

5.0 Applicable Regulations

The Contractor must abide by the following regulations, publications, manuals, and local policies and procedures.

5.1 Requirements for Implementing Section 508 Standards

In addition to the work requirements specified in this Statement of Work, the contractor must ensure that its service product complies with Section 508 of the Rehabilitation Act. The act requires that all electronic products prepared for the Federal Government be accessible to persons with disabilities, including those with vision, hearing, cognitive, and mobility impairments. The contractor can view Section 508 of the Rehabilitation Act (http://www.access-board.gov/) and the Federal IT Accessibility Initiative (Home Page) (http://www.section508.gov/) for detailed information.

The FHWA has determined that the accessibility requirements contained in the Section 508 Standards and Section 255 Guidelines for information and communication technology (ICT) apply to this work. https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh.

5.2 Federal Information Technology Systems Security Requirement (FedRAMP) For

Unclassified Cloud In OMB memorandum, dated December 9, 2011, titled "Security Authorization of Information Systems in Cloud Computing Environments," the Federal Chief Information Officer established policy for the protection of Federal information in cloud services under the Federal Risk and Authorization Management Program (FedRAMP). Under the FedRAMP policy, agencies leveraging existing cloud-based services or acquiring new cloud based services must initiate an authorization and use the FedRAMP information security and privacy requirements for cloud services to support authorization decisions.

This DASH and its attachment will be available online at the following website:

http://one10.dot.gov/office/ost/ospe/TAMwiki/Home.aspx.

DOT will determine the security category for the cloud services in accordance with the DOT Security Authorization and Continuous Monitoring Performance Guide; the contractor shall apply the appropriate set of impact baseline controls as required in the FedRAMP cloud computing security requirements baseline document to ensure compliance to security standards.

The Contractor shall be responsible for the following privacy and security safeguards and the clause set forth below:

Request for Quotation 693JJ320Q000049 Page 14

1. The Contractor shall be responsible for the following privacy and security safeguards:

1. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records and databases.

2. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

3. The contractor shall also comply with any additional FedRAMP privacy requirements.

4. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor's IT environment being used to provide or facilitate services for the Government.

5. The Contractor shall not publish or disclose in any manner, without the Contracting Officer's written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure Contractor under this contract or otherwise provided by the Government.

Exception - Disclosure to a Consumer Agency for purposes of C&A verification.

6. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours. The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Authenticated and unauthenticated database application vulnerability scans

• Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools.

7. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. If the contractor chooses to run its own automated scans or audits, results from these scans may, at the Government's discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of contractor conducted scans shall be provided, in full, to the Government.

2. Sensitive Information Storage:

For Official Use Only (FOUO) information, data, and/or equipment will only be disclosed to authorize personnel on a Need-To-Know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

Request for Quotation 693JJ320Q000049 Page 15

The disposition of all data will be at the written direction of the COR; this may include documents returned to Government control; destroyed; or held as specified until otherwise directed.

3. Protection of Information:

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor's infrastructure, as well as maintains the right to request full copies of these at any time.

Government data loaded into or processed by the cloud services shall be protected against unauthorized access, disclosure or modification, theft, or destruction. The contractor shall ensure that the facilities that house the network infrastructure are physically secure. The data must be available to the Government upon request within one business day or within the timeframe specified otherwise, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government. No data shall be released by the Contractor without the consent of the Government in writing. All requests for release must be submitted in writing to the COR/CO.

4. Security Classification:

The preparation of the deliverables in this contract will be completed at a Sensitive but Unclassified level.

5. Confidentiality and Nondisclosure:

The preliminary and final deliverables and all associated working papers and other material deemed relevant by the agency that have been generated by the contractor in the performance of this contract, are the property of the U.S. Government and must be submitted to the COR at the conclusion of the contract. The U.S. Government has unlimited data rights to all deliverables and associated working papers and materials in accordance with FAR 52.227-14. All documents produced for this project are the property of the U.S.

Government and cannot be reproduced, or retained by the contractor. All appropriate project documentation will be given to the agency during and at the end of this contract. The contractor shall not release any information without the written consent of the Contracting Officer. Personnel working on any of the described tasks may, at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

6. Disclosure of Information:

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of-the Contractor or the Contractor's responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

Request for Quotation 693JJ320Q000049 Page 16

7. Security Requirements Section:

The minimum requirements for low, moderate and high impact level cloud systems are contained within the FedRAMP Cloud Computing Security Requirements Baseline. The contractor and Federal Government Agency share responsibility to ensure compliance with security requirements. The implementation of a new Federal Government cloud system requires a formal process, known as Assessment and Authorization, which provides guidelines for performing the assessment.

FedRAMP requires cloud service providers to utilize a Third-Party Assessment Organization (3PAO) to perform an assessment of the cloud service provider's security controls to determine the extent to which security controls are implemented correctly, operate as intended, and produce the desired outcome with respect to meeting security requirements.

The FedRAMP PMO security staff will be available for consultation during the process. Both the FedRAMP PMO staff and Joint Authorization Board (JAB) will review the results before issuing a Provisional Authorization decision. The Government reserves the right to verify the infrastructure and security test results before issuing an Authorization decision.

DOT will be able to leverage the provisional Authorization granted by FedRAMP, and agency issued FedRAMP authorizations, and any documentation prepared by the contractor to issue their own authority to operate in accordance with DOT Security Authorization & Continuous Monitoring Performance Guide. The contractor is advised to review the FedRAMP guidance documents (see References below) to determine the level of effort that will be necessary to complete the requirements.

All FedRAMP documents and templates are available at http://FedRAMP.gov.

8. FedRAMP Security Compliance Requirements:

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for low, moderate, and high impact level systems (as defined in FIPS 199).

These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for both low and moderate impact systems.

The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 4.

The contractor shall generally, substantially, and in good faith follow FedRAMP guidelines and Security guidance.

In situations where there are no procedural guides, the contractor shall use generally accepted industry best practices for IT security.

9. Required FedRAMP Policies and Regulations:

OMB Memo Security Authorization of Information Systems in Cloud Computing Environments.

10. Assessment and Authorization:

The Agency may choose to cancel the (Contract/award) and terminate any outstanding orders if the contractor has its provisional authorization revoked and the deficiencies are greater than agency risk tolerance thresholds.

Request for Quotation 693JJ320Q000049 Page 17

11. Assessment of the System:

1. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the A&A is based on the System's NIST Federal Information Processing Standard (FIPS) Publication 199 categorization. The contractor shall create, maintain and update the documentation using FedRAMP requirements and templates, which are available at http://FedRAMP.gov.

2. Information systems must be assessed by an accredited 3PAO whenever there is a significant change to the system's security posture in accordance with the FedRAMP Continuous Monitoring Plan.

3. The Government reserves the right to perform Penetration Testing. If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment activities to include control reviews in accordance with FedRAMP requirements. Review activities include but are not limited to scanning operating systems, web applications, wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

4. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor's implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require POA&Ms to be remediated before a provisional or agency authorization is issued.

5. The contractor is responsible for mitigating all security risks found during Authorization &Assessment and continuous monitoring activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are formally identified. The Government will determine the risk rating of vulnerabilities.

12. Authorization of System:

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The Government reserves the right to conduct onsite inspections.

The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

13. Reporting and Continuous Monitoring:

Maintenance of the FedRAMP Provisional or DOT-issued Authorizations will be through continuous monitoring and periodic audit of the operational controls within a contractor's system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment.

Through continuous monitoring, security controls and supporting deliverables are updated and submitted to the FedRAMP PMO as required by FedRAMP Requirements. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information systems. The deliverables allow the FedRAMP JAB and/or DOT to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be

Request for Quotation 693JJ320Q000049 Page 18 required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan.

14. Audit, Inspection, and Access The contractor shall respond to government requests for documentation and/or access to the contractor’s facilities for any lawful government purpose to include oversight, audit, and inspection within a reasonable period of notification from the government not less than two (2) business days unless otherwise negotiated as specific terms within the governing contract. The contractor shall provide access and documentation without requirement for separate or additional non-disclosure.

The government commits to the contractor that information provided by the contractor shall be retained no longer than required by law or applicable Department/ Agency policy, shall be appropriately protected while within the government's possession, and shall be destroyed in accordance with Federal requirements for the destruction of sensitive information and media when no longer required.

Additional Stipulations:

1. The FedRAMP deliverables shall be labeled "FOR OFFICIAL USE ONLY" (FOUO) or other label as determined by the Government per document sensitivity. External transmission/dissemination of deliverables labeled FOUO or similar marking or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, "Security requirements for Cryptographic Modules."

2. As prescribed in the Federal Acquisition Regulation (FAR) Part 24.104, if the system involves the design, development, or operation of a system of records on individuals, the contractor shall implement requirements in FAR clause 52.224-1, "Privacy Act Notification" and FAR clause 52.224-2, "Privacy Act."

3. The contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government's agent.

6.0 Attachment/Exhibit List

6.1 Exhibit 1

Deliverables Schedule

6.2 Appendix 1 - Minimum Requirements for FHWA Web Pages

6.2 Appendix 2 - Example of Standard FHWA Header and Footer

6.2 Appendix 3 - FHWA Library Integrated Library System Sample Record

Request for Quotation 693JJ320Q000049 Page 19

TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

This technical exhibit lists any reports or documentation that is required as a deliverable to include the frequency, # of copies, medium/format and who/where it is to be submitted. A deliverable is anything that can be physically delivered but may include non-physical things such as meeting minutes.

Deliverable Compliant Frequency Medium/Format Submit To

Integrated Library System (including full accessibility by FHWA as required by

SOW)

Yes Within 30 days after the award date

Online access

System will be online and delivered to FHWA at Turner-Fairbank Highway Research Center, 6300 Georgetown Pike, McLean, VA. The system will be accessible by FHWA at the facility and during telework offsite.

Access to the ILS System at Turner- Fairbank Highway Research Center and conversion of data

Yes Provide access and data conversion within 30 days after the award date

Online access to the librarians and OPAC users

[Same as above]

Online Webinar and video conference training

Yes Arrange Training within 30 days after the award date

Training for designated library staff and TPOC

Service, support and maintenance service agreement as designated in the contract

Yes Per the length of the contract

Support to designated library staff and TPOC

Request for Quotation 693JJ320Q000049 Page 20

PART IV

CONTRACT PROVISIONS AND CLAUSES

PROVISIONS

52.252-1 -- Solicitation Provisions Incorporated by Reference (Feb 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at https://www.acquisitions.gov/far

52.204-7 -- System for Award Management (Oct 2018) 52.204-16 -- Commercial and Government Entity Code Reporting (Jul 2016) 52.212-1 -- Instructions to Offerors—Commercial Items (Mar 2020) 52.212-3 -- Offeror Representations and Certifications -- Commercial Items (Mar 2020)

CONTRACT CLAUSES

52.252-2 -- Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at https://www.acquisitions.gov/far

(End of Clause)

52.204-18 -- Commercial and Government Entity Code Maintenance (Jul 2016) 52.212-4 -- Contract Terms and Conditions -- Commercial Items (Oct 2018) 52.232-40 -- Providing Accelerated Payments to Small Business Subcontractors (Dec 2013)

FULL TEXT CLAUSES

52.212-5 -- Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items (Mar 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

Request for Quotation 693JJ320Q000049 Page 21

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Aug 2019) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108- 77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business…