Draft DAM PWS 3-24-2025.docx

Draft PWS 3.24.25

PERFORMANCE WORK STATEMENT (PWS)

FOR A

DIGITAL ASSET MANAGEMENT (DAM) SOLUTION

FOR

THE PEACE CORPS

OFFICE OF EXTERNAL AFFAIRS/COMMUNICATIONS

GENERAL

The Peace Corps is an international service network of volunteers, community members, host country partners, and staff who are driven by the federal agency’s mission of world peace and friendship. At the invitation of governments around the world, Peace Corps Volunteers work alongside community members on locally prioritized projects in the areas of education, health, environment, agriculture, community economic development, and youth development. Through service, members of the Peace Corps network develop transferable skills and hone intercultural competencies that position them to be the next generation of global leaders. Since President John F. Kennedy established the Peace Corps in 1961, more than 240,000 volunteers have served in 144 countries worldwide.

The Peace Corps is headquartered in Washington, DC, with recruiters nationwide and Volunteers serving in more than 60 countries (“posts”) worldwide.

The Peace Corp’s Office of External Affairs/Office of Communications oversees the agency’s external communications to the American public (including the oversight of brand and visual identities, tone and messaging, multimedia, etc.). Since each office throughout the agency also interacts with external stakeholders on a regular basis, the agency must be able to maintain brand continuity at the national, regional, and global levels, particularly for recruitment and outreach efforts.

BACKGROUND

The Peace Corps requires a centralized system for print, digital, and multi-media brand assets as it is essential to coordinate and oversee the materials. Our national and regional recruitment and outreach materials must be consistent, up-to-date and accessible to our multiple users throughout the Peace Corps. The system must also house a media library accessible to the public.

The Peace Corps currently uses a Digital Asset Management (DAM) platform that is cloud-hosted and accessible via Internet browsers for various capabilities, including, but not limited to, to manage a robust and growing content library of media assets, to host images that populate image galleries on the Peace Corps website as well as the Peace Corps’ media library, to organize and share brand-approved communications, marketing and other documents via “Brand Central portals” (curated mini-libraries for various internal and external users with different user permission levels), and more. Peace Corps’ preferred browsers are Edge and Chrome, however, some non-Peace Corps users may utilize other browsers. Or users may access via their personal devices (including mobile), which may use Firefox, or other browsers. Users can search, view, download, create, build, and customize a wide variety of static assets and templates in the Digital Asset Manager (DAM). The current system also allows for a comprehensive workflow for approving customized templates before final use and restricting what assets and templates can be seen by defined user roles.

1.2 SCOPE

The Contractor shall implement and support an online Software as a Service (SaaS) solution including the types of services and deliverables listed below in Section C.3. The exact sequence and scheduling of each type of service will be determined at the call order level with designated deliverables. The Contractor shall implement and support the online SaaS solution including the types of services and deliverables listed below in this Section CN.3. The Contractor shall provide an online solution to serve as the agency’s central location or content hub for brand assets with a management system and user-friendly interface with a minimum of 1 Terabyte (TB) of secure storage.

1.3 OBJECTIVE

The objectives are to:

A. Host the solution for sharing Peace Corps brand-approved advertising, collateral resources, and tools for Volunteer Recruitment and Selection (VRS), Peace Corps Response (PCR), University Partners, overseas posts, and other programmatic Peace Corps departments and stakeholders.

B. Successfully transfer all existing assets and customizable templates from the Peace Corps’ existing Brand Central [via the Digital Asset Manager platform] for immediate use by permission-based end-users.

C. Support the creation of new customizable templates (using Adobe software) and static assets created by the Peace Corps and Peace Corps’ advertising and marketing partners for use by permission- based end-users.

D. Host the solution for public-facing media (i.e., images) for Peace Corps’ Media Library and other website placements.

E. Successfully transfer all existing public-facing assets from the Peace Corps’ existing DAM platform for immediate access.

F. Streamline business processes and efficiencies for staff looking for branded materials, promoting Peace Corps brand cohesiveness and uniformity on all external facing materials.

G. Integrate with other key system for efficiencies and improved usability.

H. The platform shall meet federal IT security mandates (to include FISMA and FedRAMP controls).

PERFORMANCE REQUIREMENTS:

CONTENT HUB AND BRAND REPOSITORY /DIGITAL ASSET MANAGEMENT SOLUTION

The Contractor shall provide an online solution to serve as the agency’s central location or content hub for brand assets with a management system and user-friendly interface with a minimum of 1 Terabyte (TB) of secure storage.

SAAS/DAM

The Contractor shall provide a DAM, and all the services associated with the system’s continual implementation, execution and maintenances. This centralized DAM shall serve as a brand repository for multiple stakeholders to access and use in different capacities. At a minimum, the Contractor shall provide digital asset management services that include templates design, cloud hosting, multi-platform integration, and technical account services required to continue services of a SaaS brand central management Web application.

Note: See Attachment A for a list of requirements to complete with your response (instructions are provided).

SOFTWARE INTEGRATION

The Peace Corps has the following standard services in place for hosted solutions and/or SaaS. The Contractor shall work with Peace Corps to:

A. Integrate the DAM with Peace Corps’ existing Azure Active Directory and/or Entra ID, multifactor authentication, single sign-on and identity management infrastructure for staff. RSA, ADFS and FIM are standard tools used by Peace Corps.

B. Integrates Agency hosted systems with the Contractor’s software. The Contractor shall host either a REST‐based or SOAP‐based web service and that data will be structured in either XML or JSON. The Peace Corps will develop any integration required to update the Contractor’s solution with data from Peace Corps’ systems. The Contractor may propose another method but for informational purposes, this is the technology the Peace Corps uses.

C. The Contractor shall provide the following:

1. The capability for Single Sign-on for Peace Corps staff. Peace Corps uses ADFS/SAML. For non-Peace Corps staff, the system shall provide forms sign-on and adhere to Peace Corps policy on passwords and protections.

a) Propose fields and information that would be useful for the system e.g.: Name, Office, Title, Email Address, and Phone Number.

2. The capability to print to the Government Printing Office’s FedEx site, in order for staff to send approved files directly from the system to FedEx and pick up the print assets locally.

3. *The ability to share assets with Peace Corps Microsoft Dynamics CRM on premise instance (may move to 365), to enable staff to seamlessly move an asset from the system to the CRM based marketing automation managed solution ClickDimensions.

* Contractor should be able to provide this, but it is not mandatory.

PERFORMANCE AND LEVEL OF SERVICE

The Peace Corps operates in countries where Internet infrastructure may be a challenge. Intermittent latency and poor performance may be expected at our remote locations. The average bandwidth (April 2018) at our overseas posts is approximately 11Mbps down / 10Mbps up, with some posts performing much lower. The contractor shall state in their quote submissions, features of their systems that may compensate for Peace Corps users in the field with latency and poor bandwidth conditions.

The contractor shall provide the following minimum level of service:

A. Expected 99% availability, outside of planned outages, upgrades, and patching.

B. Standard upgrades and patching to remain on current versions of the Contractor’s software.

C. Notification of patching, upgrades, and other planned outages at least one week in advance, with Peace Corps branded notification to all users.

D. Coordination with Contracting Officer Representative (COR) on planned outages, to ensure dates do not coincide with essential work activities.

E. Provide an account manager and respond to tickets/requests for assistance:

1. Within 24 hours for standard requests.

2. Within 1 hour for system outages.

F. System monitoring and real-time notification to users for unplanned outages.

SYSTEM SET-UP/MIGRATION AND IMPLEMENTATION (I-VI)

SET-UP

The Contactor shall provide a system built-in workflow that allows for asset creation, comments, revisions, and approvals, while also providing flexibility. The contractor shall make the workflow (normal users assigned to select document/regional approver users) and nomenclature available immediately upon system setup.

PLAN

The Contractor shall participate, which may be in-person, hybrid, or virtual, in a project kick-off meeting which will take place within two weeks of contract award. In this kick-off meeting the following non-exhaustive list of topics will be reviewed:

A. Solution components, features and key integrations.

B. Security requirements and required documentation.

C. Key milestones, implementation plans and training schedule shall be confirmed, along with key project staff roles and reporting.

MIGRATION

The Contractor shall receive the transfer of all assets (in use and defunct), —templates (active and inactive) and upload the files for use in the new system. The contractor shall make the migrated assets available for use immediately after the system setup and as needed.

A. Formats of assets may include assets whose rights may have expired and cannot be used by users and shared outside of the Peace Corps. These assets should still live on Brand Central for admin use or for future use by selects users. Current assets are assets without royalty or an expiration date. Examples of assets include approved images; static artwork; and collateral in PDF format, and videos (that are not posted on YouTube).

B. Formats of templates may include templates that are inactive or dormant and cannot be accessed by users, but can be accessed by administrators and the vendor. These templates should still live on Brand Central for future use by select users. Current templates are templates available for use by select users – some of which require an approval, and others that do not require an approval from the document/regional approver.

IMPLEMENTATION (PHASES I-VI)

A. Phase I -- Users and Permissions

1. The system should support up to 2000 users with a minimum of 15 admin seats. The Contractor shall provide pricing levels for different amounts of permission-based end-users. If the price varies depending on how much access each user is provided, please explain and detail the pricing differences.

2. The Contractor shall provide direction on user groups/roles and their associated permissions.

3. The system shall provide users with the ability to easily post assets to social media platforms.

4. The system shall allow the agency to provide rights and responsibilities, terms and conditions to all users based on user type.

B. Phase II -- Asset Storage

1. The system shall provide a minimum of 1TB of secure storage.

2. The Contractor shall provide the ability for incremental storage when needed. The Contractor should propose the method of adding storage should Peace Corps exceed any initial storage limitations.

3. The system shall allow for large batch importing of assets by admins with an unlimited amount of uploads within the allowable storage.

4. The system shall allow end-users to upload images with limitations on viewership by other users.

5. The Contractor shall back up the content and shall propose a frequency of back-ups, no less than weekly.

C. Phase III -- Digital Asset Management (DAM)

1. At a minimum, this system shall:

a. Enable content created by the Contractor, advertising agencies, and Peace Corps Communications staff to be shared.

b. Support the Peace Corps’ metadata and tags for assets and templates.

c. Provide a front-end web portals with the option for branding and customization.

d. Optionally accept auto-generated tags and add metadata automatically on import (such as timestamps, geotagging, and similar tags related to the photos or other multimedia).

e. Optionally auto-detect foreign languages for tagging and translations.

f. Optionally support multiple languages and/or the ability to translate assets and customizable templates.

g. Have the ability to automatically update a primary file (for example a photo) that is linked to other galleries or templates.

2. At a minimum, the Contractor shall:

a. Provide digital asset management services that include template composition.

b. Review metadata and tagging structure and make recommendations or share best practices.

D. Phase IV -- End-User Experience

1. The system shall:

a. Allow users to convert asset file types and customizable templates (such as converting a .jpg to a web-ready file or converting a full-color file to a grey-scale file).

b. Allow users to compress large files for sharing outside of the system.

c. Allow users to crop assets.

d. Support Peace Corps brand-approved font template customization (e.g. color, size, bold/italicize, etc.) See the Peace Corps’ brand guidelines [Attachment B].

e. Allow users to use a lightbox function (or similar functionality) for the ability to share assets and completed template files with stakeholders that do not have access to the system.

f. Allow end users to upload via mobile and browser assets (e.g., photo) —versus downloading an additional software package.

g. Allow the ability to submit content via a branded web portal—accessible via browser or private link.

h. Optionally allow users to save and share documents (drafts and final) with other system users.

E. Phase V -- Analytics

F. Phase VI -- Project Management of Brand Assets

1. The system shall:

a. Permit routing and workflow of working/in-progress design projects, templates, and assets.

b. Permit collaboration and commenting for project management of templates on the platform between users and admins.

c. Permit collaboration and commenting for project management of templates on the platform between users.

d. Support file management of final design projects, templates, and assets.

e. Provide a customizable and automated workflow.

f. Provide a digital project request and/or creative brief component, along with a related calendar and checklist from beginning to end.

TRAINING AND SUPPORT SERVICES:

The Contractor shall provide training to support the roll-out of the new system for all users based on their role. This includes technical/troubleshooting during on-going use of the system as well as more function/role specific training to acclimate with the system and for on-boarding new staff. The Contractor shall also help facilitate the Peace Corps with training future end-users and administrators of the system. Timing of these trainings shall be detailed at the call order level. These Trainings shall include:

A. Training for admins, graphic-design teams, and end-users in-person or virtually, along with customized and proprietary training materials for the system.

B. Training materials in a format acceptable to the Peace Corps that can be referred to after implementation (e.g., PDF manuals, video recordings, online reference materials, etc.) for training new users.

C. Support services on technical/troubleshooting issues for all users during normal business hours, 9am – 5pm ET/EST, Monday through Friday. (Please note: for international users, the Contractor shall have a system for capturing problems and trouble-shooting.)

D. Customer success support to the COR and TPOCs on a scheduled basis.

E. Reports and status updates on system upgrades, usage, and system interruptions on a scheduled basis.

F. A system that hosts customizable FAQs and/or a help guide based on permissions and/or user types.

G. Periodic updates to the COR. Periodic progress updates should be supplemented by meetings, telephone calls, and other notices so that any problems that will impede timely performance may be immediately brought to the attention of the COR.

H. Regular updates of the software.

CONTRACT CLOSEOUT PLAN/COORDINATION

The Contractor shall work with Peace Corps to provide a contract closeout plan and coordinate services as needed to migrate assets to a new system at the end of the BPA. The Contractor shall:

A. Provide an exit plan that outlines the steps and timing to end system use.

B. Provide instruction and assistance with the exporting of assets to the Peace Corps that maintains the integrity of the system and asset usage (e.g., tagging, formatting).

SCALABILITY /OPTIONS

The Contractor shall allow for scalability of the system to adjust to the dynamic needs of the Peace Corps and wider acceptance of the system. The Contractor shall price and provide the following optional services, particularly if not part of the SaaS solution as described above:

A. Additional administrators and/or users including in international locations.

B. Increase storage as needed beyond the initial level.

C. Optional languages translations incorporated into the system.

D. Additional training sessions.

E. Ability to host and/or expand the Peace Corps photo and video libraries currently housed on platforms such as Zenfolio and YouTube.

F. Ability to add modules that may make the system solution more robust related to task manager functions, workflow and/or permission solution integrations/enhancements.

G. Integrate other modules that work in tandem with the system to make it more robust. For instance, a module for an orderable merchandise hub for all Peace Corps brand-approved promotional/swag/premium items. The Peace Corps envisions a system for permission-based users to search and view available merchandise with actual inventory levels (real-time or manually updated) from our leased warehouse. The transaction would be completed on the system (quantity, color, shipping address, account number, etc.) and the receipt would be sent electronically to the warehouse for fulfillment. System notifications would be sent to the requester as well once the transaction is complete; along with a follow-up notification was the order has been fulfilled and/or shipped. The master admin would manage the inventory/inventory levels, workflow, and any invoicing, if needed.

COMPLIANCE WITH FEDERAL INFORMATION SECURITY REQUIREMENTS

Required Policies and Regulations for Peace Corps Contracts Federal Laws, Regulations, and Guidance The contractor shall comply with all applicable Federal Laws and Regulations.

· 40 U.S.C. 11331, “Responsibilities for Federal Information Systems Standards”

· FISMA of 2014, “The Federal Information Security Modernization Act of 2014”

· HSPD 12, “Homeland Security Presidential Directive 12 – Policy for a Common Identification Standard for Federal Employees and Contractors”

· OMB Circular A-130, “Managing Information as a Strategic Resource”

· OMB M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure (Submission of Draft Agency Plans Due by September 5, 2008)”

· OMB M 14-03, “Enhancing the Security of Federal Information and Information Systems”

· OMB M-10-23, “Guidance for Agency Use of Third-Party Websites and Applications”

· OMB M-15-13, “Policy to Require Secure Connections across Federal Websites and Web Services” OMB M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”

· Privacy Act of 1974, “5 USC, § 552a”

· OMB Memoranda, location of current fiscal year guidance on Federal Information Security and Privacy Management Requirements, including FISMA reporting Federal Standards and Guidance The contractor shall comply with all applicable Federal Information Processing Standards (FIPS). NIST Special Publications (800 Series) are guidance, unless required by a FIPS publication, in which case usage is mandatory.

· FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems”

· FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems”

· FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”

· NIST SP 800-18, Revision 1, “Guide for Developing Security Plans for Federal Information Systems”

· NIST SP 800-30, Revision 1, “Guide for Conducting Risk Assessments”

· NIST SP 800-34, Revision 1, “Contingency Planning Guide for Federal Information Systems”

· NIST SP 800-37, Revision 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”

· NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems”

· NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations”

· NIST SP 800-53A, Revision 4, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans”

· NIST SP 800-63-3, “Digital Identity Guidelines”

· NIST SP 800-122, “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)”

· NIST SP 800-137, “Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations” Peace Corps Policies The contractor shall comply with the following Peace Corps Directives/Policies.

· MS 542, “Peace Corps Information Security Program”

· MS 892, “Records Management”

· MS 897, “Privacy Act Administration”

· MS 899, “Breach Notification Response Plan” The Peace Corps policies listed in this paragraph must be followed, if applicable.

· MS 542, “General Rules of Behavior” Peace Corps Procedural Guides:

Peace Corps IT Procedural Guides are guidance, unless required by a Peace Corps Policy, in which case usage is mandatory.

Note: Peace Corps’ Procedural Guides are updated frequently; to make sure you have the most recent version of publicly available procedural guides, visit IT Policies and Procedures. If a non-publicly available guide is needed, contact the contracting officer who will coordinate with the Peace Corps Office of the Chief Information Security Officer to determine if it can be made available.

Peace Corps Security Compliance Requirements FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” is a mandatory federal standard that defines the minimum-security requirements for federal information and information systems in seventeen security-related areas. Information systems supporting Peace Corps must meet the minimum security and privacy requirements using security controls in accordance with NIST Special Publication 800-53, Revision 4 (hereafter described as NIST 800-53), “Security and Privacy Controls for Federal Information Systems and Organizations.”

To comply with the Federal standard, Peace Corps must determine the security category of the information and information system in accordance with FIPS PUB 199, “Standards for Security Categorization of Federal Information and Information Systems,” and then the contractor shall apply the appropriately tailored set of Low, Moderate, or High impact baseline security controls in NIST 800-53, as determined by Peace Corps. NIST 800-53 controls requiring organization-defined parameters (i.e., password change frequency) shall be consistent with Peace Corps specifications.

Peace Corps has determined the security category of this information system to be Low>.

The Contractor shall use Peace Corps technical guidelines, NIST guidelines, Center for Internet Security (CIS) guidelines (Level 1), US Government Configuration Baseline (USGCB), or industry best practice guidelines in hardening their systems.

Essential Security Controls All NIST 800-53 controls must be implemented as per the applicable FIPS PUB 199 Low, Moderate, or High baseline. The following table identifies essential security controls from the respective baselines to highlight their importance and ensure they are implemented. The Contractor shall make the proposed system and security architecture of the information system available to the Chief Information Security Officer for review and approval before commencement of system build (architecture, infrastructure, and code).

Cryptographic Module Validation Program Validated Modules

· Weekly authenticated scans of operating systems (OS) including databases

· Monthly unauthenticated scans of web applications

· Annual authenticated scans of web applications The most recent vulnerability scanning results shall be provided to PC together with the quarterly POA&M submission.

· Digital signature encryption algorithms

· Block cypher encryption algorithms

· Secure hashing algorithms For web services connections, implement end to end encryption terminating the connection at the web server; connections terminated at a load balancer shall employ re- encryption techniques to ensure end to end encryption.

Internet accessible Websites shall implement HTTPS Only with HTTP Strict Transport Security (HSTS), have no weak ciphers, have no weak protocols, and preload .gov domains. (see Binding Operational Directive (BOD) 18-01, Enhance Email and Web Security).

· Digital signature encryption algorithms

· Block cypher encryption algorithms

· Secure hashing algorithms

For web services connections, implement end to end encryption terminating the connection at the web server; connections terminated at a load balancer shall employ re- encryption techniques to ensure end to end encryption.

Encryption algorithms shall be FIPS-approved with FIPS validated encryption modules.

Note: Privacy controls are not associated with a baseline. Controls are applicable/not applicable based on PII data being collected, stored, or transmitted.

Peace Corps Privacy Requirements MS-897-Policy.docx (peacecorps.gov) <SELECT: is or is not> in the scope of the acquisition and PII <SELECT: is or is not> expected to be stored, processed, or transmitted in the vendor's information system. The collection, maintenance or dissemination of any PII that is subject to the Privacy Act and/or the E-Government Act will be handled in full accordance with all Peace Corps rules of conduct and in accordance with Peace Corps Privacy Program requirements.

The contractor shall work with Peace Corps to prepare a Privacy Threshold Assessment (PTA) to confirm and document PII is not in scope, or to determine which categories of information will be stored, processed, or transmitted by the system. The PTA must be completed before development begins and whenever a change with a privacy impact (e.g., a new category of information is collected) is made to an existing system. PTAs are required as part of Peace Corps’ process to determine whether a Privacy Impact Assessment (PIA) and/or a System of Records Notice is required, and if any other privacy requirements apply to the information system PII (should it come into scope) will require the following guidelines be adhered to.

· The vendor’s information system must be authorized at least at the FIPS PUB 199 Moderate level.

· For any system that collects, maintains or disseminates PII, a PIA must be completed by the contractor and provided to the Peace Corps Privacy Office for review along with the other authorization to operate (ATO) documents.

· If the system retrieves information using PII, the Privacy Act applies and it must have a system of records notice (SORN) published in the Federal Register.

· If PII is collected from individuals by the system, a Privacy Act Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

Per OMB A-130, Privacy Act Statements must include:

(1) the authority (whether granted by statute or executive order) that authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(2) the principal purpose(s) for which the information is intended to be used;

(3) the published routine uses to which the information is subject;

(4) the effects on the individual, if any, of not providing all or any part of the requested information; and

(5) an appropriate citation (and, if practicable, a link) to the relevant SORN(s).

Note: Systems that access data a user creates must assume a user may include privacy data/PII in the system unless the data creation is restricted to data controlled by the system.

All contractor staff who have significant privacy information responsibilities must complete Peace Corps’ mandatory privacy awareness and role-based training courses. This includes contractors who work with PII as part of their work duties (e.g., Human Resource staff, Finance staff, and managers/supervisors).

Additional Stipulations A. Deliverables shall be labeled Sensitive But Unclassified (SBU) or contractor selected designation per document sensitivity. External transmission/dissemination of SBU to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security Requirements for Cryptographic Modules.”

B. The Contractor shall certify applications are fully functional and operate correctly as intended on systems using benchmarks from Peace Corps technical guidelines, NIST guidelines, Center for Internet Security guidelines, or industry best practice guidelines, as reviewed and accepted by the Peace Corps AO. The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved benchmark configuration. Information technology for Windows systems should use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall use tools to verify their products operate correctly with the approved benchmark configurations and do not alter the benchmark settings.

C. The Contractor shall cooperate in good faith in defining non-disclosure agreements (NDAs) that other third parties must sign when acting as the Federal government’s agent.

Note: Peace Corps’ Office of the General Counsel (OGC) is available to coordinate on defining NDA requirements. Upon request, Peace Corps OGC can advise on NDA development.

D. The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. The Contractor shall be responsible for the following privacy and security safeguards:

1. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification or to the MAX.Gov portal. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. Access to support incident investigations, shall be provided as soon as possible but not longer than 72 hours after request.

a. The program of inspection shall include, but is not limited to:

b. Authenticated and unauthenticated operating system/network vulnerability scans

c. Authenticated and unauthenticated web application vulnerability scans

d. Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. If the vendor chooses to run its own automated scans or audits, results from these scans may at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor conducted scans shall be provided in full to the Government.

E. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

F. The Contractor shall comply with Section 1634 of Public Law 115-91 that prohibits use of any hardware, software, or services developed or provided, in whole or in part, by— (1) Kaspersky Lab (or any successor entity); (2) any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (3) any entity of which Kaspersky Lab has majority ownership.

G. The Contractor shall comply with 52.204-25 of the Federal Acquisition Regulation (FAR). It prohibits, under Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232), contractors from providing to the Government any equipment, system, or service that uses telecommunications equipment or video surveillance services from certain named companies as a substantial or essential component of any system, or as critical technology as part of any system , unless an exception or waiver is granted per the FAR. It also prohibits, under Section 889(a)(1)(B), contractors from using any equipment, system, or service that uses telecommunications or video surveillance equipment or services from certain named companies as a substantial or essential component of any system or as critical technology as part of any system, unless an exception or waiver is granted per the FAR. The proscribed companies are Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company and their subsidiaries and affiliates.

System Accessibility and Ease of Use Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall comply with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

The Contractor shall comply with the following technical standards as applicable:

· 1194.21 Software applications and operating systems

· 1194.22 Web-based intranet and internet information and applications

· 1194.23 Telecommunications products

· 1194.24 Video and multimedia products

· 1194.25 Self-contained, closed products

· 1194.26 Desktop and portable computers

· 1194.31 Functional Performance Criteria

· 1194.41 Information, Documentation, and Support The competitor’s response must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location).

DELIVERABLES:

see Attachment A_Requirements List