RFP Attachment 1 - Provisions and Clauses.pdf

DOCUMENT NUMBER

FA805125R4001

CLAUSES INCORPORATED BY REFERENCE

CLAUSE

NO

ALT NO/

DEV NO

CLAUSE TITLE YEAR-

MO

SECTION

252.201-7000 Contracting Officer's Representative. 1991-12 SEC G

252.203-7000 Requirements Relating to Compensation of Former DoD Officials.

2011-09 SEC I

252.203-7002 Requirement to Inform Employees of Whistleblower Rights. 2022-12 SEC I

252.203-7005 Representation Relating to Compensation of Former DoD Officials.

2022-09 SEC K

252.204-7008 Compliance with Safeguarding Covered Defense Information Controls.

2016-10 SEC K

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services-Representation.

2021-05 SEC K

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services.

2023-01 SEC I

252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements. 2023-11 SEC L 252.204-7020 NIST SP 800-171 DoD Assessment Requirements. 2023-11 SEC I 252.204-7024 Notice on the Use of the Supplier Performance Risk System. 2023-03 SEC L 252.205-7000 Provision of Information to Cooperative Agreement Holders. 2024-10 SEC I 252.223-7008 Prohibition of Hexavalent Chromium. 2023-01 SEC I 252.225-7012 Preference for Certain Domestic Commodities. 2022-04 SEC I

252.225-7055 Representation Regarding Business Operations with the Maduro Regime.

2022-05 SEC K

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime.

2023-01 SEC I

252.226-7001 Utilization of Indian Organizations, Indian-Owned Economic Enterprises, and Native Hawaiian Small Business Concerns.

2023-01 SEC I

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports.

2018-12 SEC G

252.232-7010 Levies on Contract Payments. 2006-12 SEC I

252.237-7010 Prohibition on Interrogation of Detainees by Contractor Personnel.

2023-01 SEC I

252.243-7002 Requests for Equitable Adjustment. 2022-12 SEC I

252.244-7000 Subcontracts for Commercial Products or Commercial Services.

2023-11 SEC I

252.246-7004 Safety of Facilities, Infrastructure, and Equipment for Military Operations.

2010-10 SEC I

252.247-7023 Transportation of Supplies by Sea. 2024-10 SEC I 52.201-1 Acquisition 360: Voluntary Survey. 2023-09 SEC L 52.203-3 Gratuities. 1984-04 SEC I 52.204-13 System for Award Management Maintenance. 2018-10 SEC I 52.204-16 Commercial and Government Entity Code Reporting. 2020-08 SEC L 52.204-18 Commercial and Government Entity Code Maintenance. 2020-08 SEC I

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment.

2021-11 SEC K

52.204-7 System for Award Management. 2024-11 SEC L 52.209-7 Information Regarding Responsibility Matters. 2018-10 SEC K

52.212-4 Contract Terms and Conditions-Commercial Products and Commercial Services.

2023-11 SEC I

52.217-2 Cancellation Under Multi-year Contracts. 1997-10 SEC I 52.223-5 Pollution Prevention and Right-to-Know Information. 2024-05 SEC I 52.228-5 Insurance-Work on a Government Installation. 1997-01 SEC I

52.229-11 Tax on Certain Foreign Procurements-Notice and Representation.

2020-06 SEC K

52.240-1 Prohibition on Unmanned Aircraft Systems Manufactured or

Assembled by American Security Drone Act-Covered Foreign Entities.

2024-11 SEC I

52.204-29 Federal Acquisition Supply Chain Security Act Orders- Representation and Disclosures.

2023-12 SEC K

52.212-1 Instructions to Offerors-Commercial Products and Commercial Services.

2023-09 SEC L

52.204-26 Covered Telecommunications Equipment or Services- Representation.

2020-10 SEC K

52.203-18 Prohibition on Contracting with Entities that Require Certain

Internal Confidentiality Agreements or Statements- Representation.

2017-01 SEC L

52.204-19 Incorporation by Reference of Representations and Certifications.

2014-12 SEC I

52.204-22 Alternative Line Item Proposal. 2017-01 SEC L 252.204-7000 Disclosure of Information. 2016-10 SEC I 252.204-7003 Control of Government Personnel Work Product. 1992-04 SEC I

252.215-7013 Supplies and Services Provided by Nontraditional Defense Contractors.

2023-01 SEC L

252.225-7001 Buy American and Balance of Payments Program. 2024-02 SEC I 252.225-7002 Qualifying Country Sources as Subcontractors. 2022-03 SEC I 252.225-7048 Export-Controlled Items. 2013-06 SEC I 252.243-7001 Pricing of Contract Modifications. 1991-12 SEC I 252.222-7002 Compliance with Local Labor Laws (Overseas). 1997-06 SEC I 252.233-7001 Choice of Law (Overseas). 1997-06 SEC I

52.225-25 Prohibition on Contracting With Entities Engaging in Certain Activities or Transactions Relating to Iran-Representation and

Certifications.

2020-06 SEC K

52.232-1 Payments. 1984-04 SEC I 52.232-11 Extras. 1984-04 SEC I

252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement.

2023-01 SEC I

CLAUSES IN FULL TEXT

CLAUSE

NO

CLAUSE TITLE ALT NO/

DEV NO

YEAR-

MO

CLAUSE TEXT

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident

Reporting. (DEVIATION 2024-O0013 REVISION 1) 2024-O0013 2024-05

SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT

REPORTING (MAY 2024) (DEVIATION 2024-O0013 REVISION 1)

(a) As used in this clause-Definitions.

means protective measures that are commensurate with the consequences and Adequate security probability of loss, misuse, or unauthorized access to, or modification of information.

means disclosure of information to unauthorized persons, or a violation of the security Compromise policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

means information that identifies the contractorContractor attributional/proprietary information (s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor

(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

means technical information with military or space application Controlled technical information that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

means an unclassified information system that is owned, or Covered contractor information system operated by or for, a contractor and that processes, stores, or transmits covered defense information.

means unclassified controlled technical information or other Covered defense information information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.

, that requires safeguarding or dissemination controls archives.gov/cui/registry/category-list.html pursuant to and consistent with law, regulations, and Governmentwide policies, and is-

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

means actions taken through the use of computer networks that result in a Cyber incident compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

means the practice of gathering, retaining, and analyzing computer-related data Forensic analysis for investigative purposes in a manner that maintains the integrity of the data.

means a discrete set of information resources organized for the collection, Information system processing, maintenance, use, sharing, dissemination, or disposition of information.

means computer software or firmware intended to perform an unauthorized Malicious software process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

means physical devices or writing surfaces including, but is not limited to, magnetic tapes, Media optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

means supplies or services designated by the Government as critical Operationally critical support for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

means within 72 hours of discovery of any cyber incident.Rapidly report means technical data or computer software, as those terms are defined in the Technical information clause at DFARS 252.227-7013, Rights in Technical Data-Other Than Commercial Products and Commercial Services, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) The Contractor shall provide adequate security on all covered contractorAdequate security.

information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of an Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the clause 252.239-7010, Cloud Computing Services, of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”, Revision 2 (available via the internet at

).https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf

(ii)(A) The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017. For all contracts awarded prior to October 1, 2017, the Contractor shall notify the DoD Chief Information Officer (CIO), via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer, for consideration by the DoD CIO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be nonapplicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

(C) If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline ( ) and that the cloud service provider complies https://www.fedramp.gov/documents-templates/ with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraphs (b)

(1) and (2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall-

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

(ii) Rapidly report cyber incidents to DoD at https://dibnet.dod.mil.

(2) The cyber incident report shall be treated as information created by orCyber incident report.

for DoD and shall include, at a minimum, the required elements at https://dibnet.dod.mil.

(3) In order to report cyber incidents in accordanceMedium assurance certificate requirement.

with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see .https://public.cyber.mil/eca/

(d) When the Contractor or subcontractors discover and isolate maliciousMalicious software.

software in connection with a reported cyber incident, submit the malicious software to DoD Cyber Crime Center (DC3) in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

(e) When a Contractor discovers a cyber incident has occurred,Media preservation and protection.

the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

(f) Upon request byAccess to additional information or equipment necessary for forensic analysis.

DoD, the Contractor shall provide DoD with access to additional information equipment that is necessary to conduct a forensic analysis.

(g) If DoD elects to conduct a damage assessment,Cyber incident damage assessment activities.

the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(h) TheDoD safeguarding and use of contractor attributional/proprietary information.

Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(i) Use and release of contractor attributional/proprietary information not created by or for DoD.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for DoD is authorized to be released outside of DoD-

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes (including with Defense Industrial Base (DIB) participants in the program at 32 CFR part 236); or

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract that includes the clause at 252.204-7009, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

(j) Use and release of contractor attributional/proprietary information created by or for DoD.

Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(l) The safeguarding and cyber incident reportingOther safeguarding or reporting requirements.

required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(m) The Contractor shall-Subcontracts.

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as covered defense information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to-

(i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause; and

(ii) Provide the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DoD as required in paragraph (c) of this clause.

(End of clause)

252.232-7006 Wide Area WorkFlow Payment Instructions. 2023-01

WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) As used in this clause-Definitions.

"Department of Defense Activity Address Code (DoDAAC)" is a six position code that uniquely identifies a unit, activity, or organization.

"Document type" means the type of payment request or receiving report available for creation in Wide Area WorkFlow (WAWF).

"Local processing office (LPO)" is the office responsible for payment certification when payment certification is done external to the entitlement system.

"Payment request" and "receiving report" are defined in the clause at 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(b) The WAWF system provides the method to electronically processElectronic invoicing.

vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving Reports.

(c) To access WAWF, the Contractor shall-WAWF access.

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) The Contractor should follow the training instructions of the WAWF Web-WAWF training.

Based Training Course and use the Practice Training Site before submitting payment requests through WAWF. Both can be accessed by selecting the "Web Based Training" link on the WAWF home page at https://wawf.eb.mil/

(e) Document submissions may be via web entry,WAWF methods of document submission.

Electronic Data Interchange, or File Transfer Protocol.

(f) The Contractor shall use the following information whenWAWF payment instructions.

submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) The Contractor shall submit payment requests using the followingDocument type.

document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items-

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the Contracting Officer.

Not Applicable

(Contracting Officer: Insert applicable invoice and receiving report document type(s) for fixed price line items that require shipment of a deliverable.)

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

Invoice 2 in 1

(Contracting Officer: Insert either "Invoice 2in1" or the applicable invoice and receiving report document type(s) for fixed price line items for services.)

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) ) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF "combo" document type to create some combinations of invoice and receiving report in one step.]

(3) The Contractor shall use the information in the Routing Data TableDocument routing.

below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table*

Field Name in WAWF Data to be entered in WAWF

Pay Official DoDAAC F87700

Issue By DoDAAC FA8051

Admin DoDAAC FA8051

Inspect By DoDAAC FA8051

Ship To Code ____

Ship From Code ____

Mark For Code ____

Service Approver (DoDAAC) ____

Service Acceptor (DoDAAC) FA8051

Accept at Other DoDAAC ____

LPO DoDAAC ____

DCAA Auditor DoDAAC ____

Other DoDAAC(s) ____

(*Contracting Officer: Insert applicable DoDAAC information. If multiple ship to/acceptance locations apply, insert "See Schedule" or "Not applicable.")

(**Contracting Officer: If the contract provides for progress payments or performance-based payments, insert the DoDAAC for the contract administration office assigned the functions under FAR 42.302(a)(13).)

(4) The Contractor shall ensure a payment request includes documentationPayment request.

appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) The Contractor shall ensure a receiving report meets the requirementsReceiving report.

of DFARS Appendix F.

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity's WAWF point of contact.

(Contracting Officer: Insert applicable information or "Not applicable.")

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

(End of clause)

52.216-18 Ordering. 2020-08

Ordering (Aug 2020)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the Schedule. Such orders may be issued from 31 March 2026 through 30 March 2031[insert dates].

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

A delivery order or task order is considered "issued" when-(c)

If sent by mail (includes transmittal by U.S. mail or private delivery service), the Government(1) deposits the order in the mail;

If sent by fax, the Government transmits the order to the Contractor's fax number; or(2)

If sent electronically, the Government either-(3)

Posts a copy of the delivery order or task order to a Government document access system, and(i) notice is sent to the Contractor; or

Distributes the delivery order or task order via email to the Contractor's email address.(ii)

Orders may be issued by methods other than those enumerated in this clause only if authorized in(d) the contract.

(End of clause)

52.216-19 Order Limitations. 1995-10

Order Limitations (OCT 1995)

. When the Government requires supplies or services covered by this contract in an(a) Minimum order amount of less than [insert dollar figure or quantity], the Government is not obligated to 50,000.00 purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

. The Contractor is not obligated to honor-(b) Maximum order

Any order for a single item in excess of [insert dollar figure or quantity];(1) 1,000,000.00

Any order for a combination of items in excess of [insert dollar figure or quantity]; or(2) 1,000,000.00

A series of orders from the same ordering office within days that together call(3) ten (10) calendar for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section.

If this is a requirements contract ( includes the Requirements clause at subsection 52.216-21 of(c) i.e., the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph

(b) of this section.

Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order(d) exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within days after issuance, with written notice stating the Contractor's five (5) calendar intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

52.216-22 Indefinite Quantity. 1995-10

Indefinite Quantity (OCT 1995)

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the "maximum." The Government shall order at least the quantity of supplies or services designated in the Schedule as the "minimum."

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order. The contract shall govern the Contractor's and Government's rights and obligations with respect to that order to the same extent as if the order were completed during the contract's effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after 30 Sep 2031[insert date].

(End of clause)

52.252-1 Solicitation Provisions Incorporated by Reference. 1998-02

Solicitation Provisions Incorporated by Reference (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

FAR Website http://acquisition.gov/____[Insert one or more Internet addresses]

(End of provision)

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law.

2016-02

Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law (FEB 2016)

As required by sections 744 and 745 of Division E of the Consolidated and Further Continuing(a) Appropriations Act, 2015 (Pub. L. 113-235), and similar provisions, if contained in subsequent appropriations acts, the Government will not enter into a contract with any corporation that-

Has any unpaid Federal tax liability that has been assessed, for which all judicial and(1) administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or

Was convicted of a felony criminal violation under any Federal law within the preceding 24(2) months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.

The Offeror represents that-(b)

It is(1) is not a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and

It is(2) is not a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.

(End of provision)

52.252-2 Clauses Incorporated by Reference. 1998-02

Clauses Incorporated By Reference (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Website [Insert one or more Internet addresses]http://acquisition.gov/ ____

(End of clause)

52.212-2 Evaluation-Commercial Products and Commercial Services. 2021-11

Evaluation-Commercial Products and Commercial Services (Nov 2021)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

See Combined Synopsis for details.________[Contracting Officer shall insert the significant evaluation factors, such as (i) technical capability of the item offered to meet the Government requirement; (ii) price; (iii) past performance (see FAR 15.304); and include them in the relative order of importance of the evaluation factors, such as in descending order of importance.]

Technical and past performance, when combined, are [Contracting Officer state, in accordance ____ with FAR 15.304, the relative importance of all other evaluation factors, when combined, when compared to price.]

(b) . The Government will evaluate offers for award purposes by adding the total price for allOptions options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

(End of provision)

252.204-7025 Notice of Cybersecurity Maturity Model Certification Level

Requirements.

2025-11

NOTICE OF CYBERSECURITY MATURITY MODEL CERTIFICATION LEVEL

REQUIREMENTS (NOV 2025)

(a) Definitions. As used in this provision, "controlled unclassified information (CUI)," "current," "Cybersecurity Maturity Model Certification (CMMC) status," "Cybersecurity Maturity Model Certification unique identifier (CMMC UID)," "Federal contract information (FCI)", and "plan of action and milestones" have the meaning given in the Defense Federal Acquisition Regulation Supplement 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, clause of this solicitation.

(b)(1) Cybersecurity Maturity Model Certification (CMMC) level. The CMMC level required by this solicitation is: CMMC Level 2 (Self) [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)]. This CMMC level, or higher (see 32 CFR part 170), is required prior to award for each contractor information system that will process, store, or transmit Federal contract information (FCI) or controlled unclassified information (CUI) during performance of the contract.

(2) The Offeror will not be eligible for award of a contract, task order, or delivery order resulting from this solicitation if the Offeror does not have, for each of the contractor information systems that will process, store, or transmit FCI or CUI and that will be used in performance of a contract resulting from this solicitation-

(i) The current CMMC status entered in the Supplier Performance Risk System (SPRS) ( https://piee.eb.mil) at the CMMC level required by paragraph (b)(1) of this provision; and

(ii) A current affirmation of continuous compliance with the security requirements identified at 32 CFR part 170 in SPRS.

(c) . If the Offeror has a CMMC Status of Conditional, the Offeror Plan of action and milestones shall successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.

(d) . The Offeror shall provide, in the proposal, the CMMC unique CMMC unique identifiers identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI during performance of a contract, task order, or delivery order resulting from this solicitation. The Offeror also shall update the list when new CMMC UIDs are generated in SPRS. The CMMC UIDs are provided in SPRS after the Offeror enters the results of self-assessment(s) for each such information system.

(End of provision)

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders - Commercial Products and Commercial Services. (DEVIATION 2025-O0003 and 2025-O0004)

2025-O0004 2025-03

Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Services (MAR 2025) (DEVIATION 2025-O0003 and 2025-O0004)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (section 743 of Division E, Title VII, of the Consolidated and Further Continuing (JAN 2017)

Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (Section 1634 of Pub. L. 115-91).(DEC 2023)

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (Section 889(a)(1)(A) of Pub. L. 115-232).(NOV 2021)

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations .(NOV 2015)

(5) 52.232-40, Providing Accelerated Payments to Small Business Subcontractors (31 U.(MAR 2023) S.C. 3903 and 10 U.S.C. 3801).

(6) 52.233-3, Protest After Award (31 U.S.C. 3553).(AUG 1996)

(7) 52.233-4, Applicable Law for Breach of Contract Claim (Public Laws 108-77 and (OCT 2004) 108-78 ( 19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[ .]Contracting Officer check as appropriate

52.203-6, Restrictions on Subcontractor Sales to the Government with (1) (JUN 2020), Alternate I (41 U.S.C. 4704 and 10 U.S.C. 4655). (NOV 2021)

52.203-13, Contractor Code of Business Ethics and Conduct (41 U.S.C. 3509)).(2) (NOV 2021)

52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009(3) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery(JUN 2010) and Reinvestment Act of 2009.)

52.203-17, Contractor Employee Whistleblower Rights (41 U.S.C. 4712); this clause(4) (NOV 2023) does not apply to contracts of DoD, NASA, the Coast Guard, or applicable elements of the intelligence community-see FAR 3.900(a).

52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Pub.(5) (JUN 2020) L. 109-282) ( 31 U.S.C. 6101 note).

[Reserved].(6)

52.204-14, Service Contract Reporting Requirements (Pub. L. 111-117, section 743 of(7) (OCT 2016) Div. C).

52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (8) (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

52.204-27, Prohibition on a ByteDance Covered Application (Section 102 of Division R(9) (JUN 2023) of Pub. L. 117-328).

52.204-28, Federal Acquisition Supply Chain Security Act Orders-Federal Supply Schedules,(10) Governmentwide Acquisition Contracts, and Multi-Agency Contracts. (Pub. L. 115-390,(DEC 2023) title II).

(11)

(i) 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition. (Pub.(DEC 2023) L. 115-390, title II).

Alternate I of 52.204-30.(ii) (DEC 2023)

(12) 52.209-6, Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, Proposed for Debarment, or Voluntarily Excluded. ( 2025) (31 U.S.C. 6101 note).JAN

52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (13) (OCT 2018) (41 U.S.C. 2313).

[Reserved].(14)

52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award ( ) (15 U.S.C. 657a).(15) OCT 2022

52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns ((16) OCT ) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).2022

[Reserved](17)

(18)

(i) 52.219-6, Notice of Total Small Business Set-Aside (15 U.S.C. 644).(NOV 2020)

Alternate I of 52.219-6.(ii) (MAR 2020)

(19)

(i) 52.219-7, Notice of Partial Small Business Set-Aside (15 U.S.C. 644).(NOV 2020)

Alternate I of 52.219-7.(ii) (MAR 2020)

52.219-8, Utilization of Small Business Concerns (15 U.S.C. 637(d)(2) and (3)).(20) ( )JAN 2025

(21)

(i) 52.219-9, Small Business Subcontracting Plan (15 U.S.C. 637(d)(4)).( )JAN 2025

Alternate I of 52.219-9.(ii) (NOV 2016)

Alternate II of 52.219-9.(iii) (NOV 2016)

Alternate III of 52.219-9.(iv) (JUN 2020)

Alternate IV of 52.219-9.(v) ( )JAN 2025

(22)

(i) 52.219-13, Notice of Set-Aside of Orders (15 U.S.C. 644(r)).(MAR 2020)

Alternate I of 52.219-13.(ii) (MAR 2020)

52.219-14, Limitations on Subcontracting ( ) (15 U.S.C. 657s).(23) OCT 2022

52.219-16, Liquidated Damages-Subcontracting Plan (15 U.S.C. 637(d)(4)(F)(i)).(24) (SEP 2021)

52.219-27, Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned(25) Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program ( ) (15 U.S.FEB 2024 C. 657f).

(26)

(i) 52.219-28, Small Business Program Rerepresentation (15 U.S.C. 632(a)(2)).Postaward ( )JAN 2025

Alternate I of 52.219-28.(ii) (MAR 2020)

52.219-29, Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged(27) Women-Owned Small Business Concerns ( ) (15 U.S.C. 637(m)).OCT 2022

52.219-30, Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business(28) Concerns Eligible Under the Women-Owned Small Business Program ( ) (15 U.S.C. 637(m)).OCT 2022

52.219-32, Orders Issued Directly Under Small Business Reserves (15 U.S.C. 644(r)).(29) (MAR 2020)

52.219-33, Nonmanufacturer Rule (15 U.S.C. 637(a)(17)).(30) (SEP 2021)

52.222-3, Convict Labor (E.O.11755).(31) (JUN 2003)

(32) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (E.O. 13126).(JAN 2025)

[Reserved](33)

[Reserved](34)

(35)

(i) 52.222-35, Equal Opportunity for Veterans (38 U.S.C. 4212).(JUN 2020)

Alternate I of 52.222-35.(ii) (JUL 2014)

(36)

(i) 52.222-36, Equal Opportunity for Workers with Disabilities (29 U.S.C. 793).(JUN 2020)

Alternate I of 52.222-36.(ii) (JUL 2014)

52.222-37, Employment Reports on Veterans ( ) (38 U.S.C. 4212).(37) JUN 2020

52.222-40, Notification of Employee Rights Under the National Labor Relations Act (38) (DEC 2010) (E.O. 13496).

(39)

(i) 52.222-50, Combating Trafficking in Persons (22 U.S.C. chapter 78 and E.O. 13627).(NOV 2021)

Alternate I of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).(ii) (MAR 2015)

(40) 52.222-54, Employment Eligibility Verification (Executive Order 12989). (Not (JAN 2025) applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

(41)

(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (May 2008) ( 42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

Alternate I of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of (ii) (MAY 2008) commercially available off-the-shelf items.)

52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (42) (42 U.S.C. 7671, ).(MAY 2024) et seq.

52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air (43) Conditioners (42 U.S.C. 7671, ).(MAY 2024) et seq.

52.223-20, Aerosols (42 U.S.C. 7671, ).(44) (MAY 2024) et seq.

52.223-21, Foams (42 U.S.C. 7671, ).(45) (MAY 2024) et seq.

52.223-23, Sustainable Products and Services (MAR 2025) (DEVIATION 2025-O0004)) (7 U.S.C. (46) 8102, 42 U.S.C. 6962, 42 U.S.C. 8259b, and 42 U.S.C. 7671l).

(47)

(i) 52.224-3 Privacy Training (5 U.S.C. 552 a).(JAN 2017)

Alternate I of 52.224-3.(ii) (JAN 2017)

(48)

(i) 52.225-1, Buy American-Supplies (41 U.S.C. chapter 83).(OCT 2022)

Alternate I of 52.225-1.(ii) (OCT 2022)

(49)

(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (19 U.S.C. 3301 (NOV 2023) note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, 19 U.S.C. chapter 29 (sections 4501-4732), Public Law 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110- 138, 112-41, 112-42, and 112-43.

Alternate I [Reserved].(ii)

Alternate II of 52.225-3.(iii) (JAN 2025)

Alternate III of 52.225-3.(iv) (FEB 2024)

Alternate IV (Oct 2022) of 52.225-3.(v)

52.225-5, Trade Agreements (19 U.S.C. 2501, ., 19 U.S.C. 3301 note).(50) (NOV 2023) et seq

52.225-13, Restrictions on Certain Foreign Purchases (E.O.'s, proclamations, and (51) (FEB 2021) statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016)(52) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C.

Subtitle A, Part V, Subpart G Note).

52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C. 5150).(53)

52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (42 U.(54) (NOV 2007) S.C. 5150).

52.226-8, Encouraging Contractor Policies to Ban Text Messaging While Driving (E.(55) (MAY 2024) O. 13513).

52.229-12, Tax on Certain Foreign Procurements .(56) (FEB 2021)

52.232-29, Terms for Financing of Purchases of Commercial Products and Commercial Services(57)

(41 U.S.C. 4505, 10 U.S.C. 3805).(NOV 2021)

52.232-30, Installment Payments for Commercial Products and Commercial Services (58) (NOV 2021) (41 U.S.C. 4505, 10 U.S.C. 3805).

52.232-33, Payment by Electronic Funds Transfer-System for Award Management (59) (OCT2018) (31 U.S.C. 3332).

52.232-34, Payment by Electronic Funds Transfer-Other than System for Award Management (Jul(60) 2013) (31 U.S.C. 3332).

52.232-36, Payment by Third Party (31 U.S.C. 3332).(61) (MAY 2014)

52.239-1, Privacy or Security Safeguards (5 U.S.C. 552a).(62) (AUG 1996)

52.240-1, Prohibition on Unmanned Aircraft Systems Manufactured or Assembled by American(63) Security Drone Act-Covered Foreign Entities (Sections 1821-1826, Pub. L. 118-31, 41 U.S.(NOV 2024) C. 3901 note prec.).

52.242-5, Payments to Small Business Subcontractors (15 U.S.C. 637(d)(13)).(64) (JAN 2017)

(65)

(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (46 U.S.(NOV 2021) C. 55305 and 10 U.S.C. 2631).

Alternate I of 52.247-64.(ii) (APR 2003)

Alternate II of 52.247-64.(iii) (NOV 2021)

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[ ]Contracting Officer check as appropriate.

52.222-41, Service Contract Labor Standards (41 U.S.C. chapter67).(1) (AUG 2018)

52.222-42, Statement of Equivalent Rates for Federal Hires (29 U.S.C. 206 and 41 U.S.(2) (MAY 2014) C. chapter 67).

52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (3) (Multiple Year and Option Contracts) (29 U.S.C. 206 and 41 U.S.C. chapter 67).(AUG 2018)

52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (May (4) 2014) ( 29U.S.C.206 and 41 U.S.C. chapter 67).

52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for (5) Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.

C. chapter 67).

52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for (6) Certain Services-Requirements (41 U.S.C. chapter 67).(MAY 2014)

52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 .(7) (JAN 2022)

52.222-62, Paid Sick Leave Under Executive Order 13706 (E.O. 13706).(8) (JAN 2022)

52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (Jun 2020) (42 U.S.C. 1792).