RFQ 030ADV26Q0024.pdf

PAGE 1 OF1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

See SCHEDULE

030ADV26Q0024 11-26-2025

Blose, Todd 12-19-2025

18:00 EST

Contracts and Grants Directorate Library of Congress

101 Independence Ave. SE LA 325 Washington DC 20540-9411

X

N/A

X

DELIVERY

See Sections D&F for delivery instructions.

Library of Congress Contracts & Grants Directorate 101 Independence Ave SE

Washington DC 20540-9411

Submit Invoices via email to:

nlsadmin@loc.gov with a CC' to the COR

See CONTINUATION Page

See CONTINUATION Page

X X

Blose, Todd

030ADV26Q0024

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

B.2 LC52.212-2 SUPPLEMENTAL LICENSE AGREEMENTS (JUL 2017)

B.3 LC52.216-3 CONTRACT TYPE (JUN 2016)

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

SECTION D - PACKAGING AND MARKING

D.1 LC52.211-1 DELIVERIES (APR 2015)

D.2 LC52.231-1 PAYMENT OF POSTAGE FEES (MAY 2015)

SECTION E - INSPECTION AND ACCEPTANCE

E.1 Inspection and Acceptance

SECTION F - DELIVERIES OR PERFORMANCE

F.1 LC52.215-5 PLACE AND PERIOD OF PERFORMANCE (JAN 2019)

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 LC52.201-3 CONTRACT ADMINISTRATION (AUG 2015)

G.2 LC52.232-1A LIBRARY OF CONGRESS INVOICE INSTRUCTIONS (OCT 2016)

G.3 LC52.232-2 SCHEDULE OF PAYMENTS (JUN 2015)

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 LC52.201-1 CONTRACTING OFFICER'S REPRESENTATIVE (COR) APPOINTMENT AND AUTHORITY (JAN 2016)

H.2 LC52.203-1 CONTRACTOR PUBLICITY (OCT 2013)

H.3 LC52.204-3 INFORMATION SYSTEMS SECURITY (JUL 2024)

H.4 LC52.204-4 CONTRACTOR EMPLOYEE FITNESS (SEP 2024)

H.5 LC52.204-27 HANDLING OF FEDERAL RECORDS (JUL 2021)

H.6 LC52.237-1 KEY PERSONNEL (AUG 2014)

H.7 LC52.239-1 INFORMATION SECURITY (JUL 2025)

H.8 LC52.239-2 SYSTEMS DEVELOPMENT LIFE CYCLE (SEP 2018)

H.9 LC52.239-5 SYSTEMS HOSTED BY EXTERNAL HOSTING PROVIDERS (SEP 2018)

H.10 LC52.239-7 INFORMATION AND COMMUNICATION TECHNOLOGY ACCESSIBILITY (JAN 2025)

H.11 LC52.239-3A ASSESSMENT AND AUTHORIZATION (ALT I) (JAN 2016)

030ADV26Q0024

H.12 Use of Generative AI

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

I.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

I.2 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE

ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (JAN 2025)

I.3 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

I.4 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

I.5 LC52.212-4 CONTRACT TERMS AND CONDITIONS - COMMERCIAL ITEMS (DEV) (FEB 2016)

I.6 LC52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE

ORDERS - COMMERCIAL ITEMS (DEV) (MAY 2015)

I.7 LC52.232-25 PROMPT PAYMENT (DEV) (JUL 2013)

I.8 LC52.233-1 52.233-1 (DEV) DISPUTES (MAY 2014)

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

K.1 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (MAY 2024)

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.1 LC52.233-2 PROTESTS TO THE LIBRARY OF CONGRESS (DEC 2013)

SECTION M - EVALUATION FACTORS FOR AWARD

030ADV26Q0024 Section B

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1.00 LOT __________________ __________________

Currency Reader Information Management System (CRIMS) Enhancement, Development, and Support Services Contract Period: Base POP Begin: 02-18-2026 POP End: 02-17-2027

0002 12.00 MO __________________ __________________

#3rd party MS Azure Support Contract Period: Base POP Begin: 02-18-2026 POP End: 02-17-2027

0101 1.00 LOT __________________ __________________

Option CLIN – Phase In/Out Implementation of System Transition Contract Period: Option 1 POP Begin: 02-18-2027 POP End: 05-17-2027 See Section C.4.6 of the statement of work.

0102 3.00 MO __________________ __________________

Option CLIN - #3rd party MS Azure Support Contract Period: Option 1 POP Begin: 02-18-2027 POP End: 05-17-2027

GRAND TOTAL __________________

030ADV26Q0024 Section B

B.2 LC52.212-2 SUPPLEMENTAL LICENSE AGREEMENTS (JUL 2017)

The Library does not agree to licensing agreements or any other provisions that attempt to: (1) replace an order as the governing contract; (2) establish new or supplemental payment terms; or, (3) affect the legal relationships of the parties.

Notwithstanding any clauses in this contract or order, or the contractual vehicles against which the order is placed, that establish order of precedence, the rights and obligations provided by this contract or order take precedence over the rights and obligations set forth in any licensing agreements provided to the Library.

The Library’s incorporation of a licensing agreement into this contract or order excludes all terms of the licensing agreement that contravene, modify or conflict with the terms of 36 C.F.R. 701.7 available at: https://www.ecfr.gov/cgi-bin/text-idx?SID=87a865ce2bd109313a951a3d477895d8&mc=true&node=se36.3.701_17&rgn=div8.

(End of Clause)

B.3 LC52.216-3 CONTRACT TYPE (JUN 2016)

This is a Firm-Fixed-Price contract.

(End of Clause)

030ADV26Q0024 Section C

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

C.1. BACKGROUND

The National Library Service for the Blind and Print Disabled (NLS) within the Library of Congress (LOC) provides nationwide support to visually impaired audiences seeking access to reading material in collaboration with state library systems. End-users for NLS programming are librarians and library patrons certified to receive specialized services.

Patron services are increasingly managed through information management systems (IMS) to connect patrons to resources.

NLS has provided various services under an inter-agency agreement between the Bureau of Engraving and Printing (BEP) since 2014, to include jointly operating the US Currency Reader Distribution Program (the Program). The Program's principal goal has been to distribute assistive technology free of charge to eligible members of the public requiring assistance with reading paper money. The Program has shipped thousands of currency reader devices to new and existing library patrons via USPS Free Matter. It is projected to continue until raised tactile currency features are successfully implemented nationwide on US banknotes.

The IMS behind the Program is known as the Currency Reader Information Management System (CRIMS). LOC operates and manages CRIMS as part of the inter-agency agreement with BEP. CRIMS maintains electronic records on physical packages shipped to individuals who apply for a free currency reader device to facilitate inventory tracking and customer service. CRIMS also exclusively supports the workflow of the Currency Reader Distribution Project (CRDP), from initial request to fulfillment and shipment. The current-state CRIMS is a cloud-based, database-driven system that is externally hosted and is currently managed by an outside commercial vendor.

A dedicated staff of NLS-based users have added thousands of patron records to generate CRDP shipping requests for a currency reader device since CRIMS was initially launched in 2016. The basis for these requests is a physical paper application form that is delivered bi-weekly to NLS for processing and data entry. Additionally, application forms are also received electronically through an Azure-based webform known as Currencyreader.gov. NLS staff create a patron record in CRIMS so that a device may be issued upon approval of either a paper or electronic application. Applicant supplied metadata is leveraged to facilitate throughput and tracking of a request to assist with customer service and inventory management.

C.2. Overview

The LOC seeks contractor (CTR) support to increase electronic patron engagement and patron record security by implementing a secure Azure web-based user interface, as well as associated tools and functionality, to enhance application throughput for the Program. The LOC envisions leveraging CTR support to –

1. Maintain CRIMS.

2. Support recent legacy upgrades that use COTS software.

3. Continue devolving paper-based workflows from the application process.

4. Continue migrating system user operations to a fully web-based electronic workflow to maximize efficiencies.

5. Improve system security using a more robust Microsoft (MS) Azure-based environment.

6. Comply with a government-wide initiative to reduce hard-copy paper in the workplace.

The intent of this requirement is to achieve several key objectives:

7. Supporting a new CRIMS user interface (UI) to reduce reliance on custom coded legacy operations modules in the CRIMS system.

8. Further reducing reliance on the current, paper-based workflow that involves patrons submitting their applications via US Mail.

9. Maintaining digital signature capability as a surrogate to the current wet signature model.

10. Enhancing the patron customer experience through faster and easier order processing using an end-to-end electronic workflow.

11. Reducing reliance on paper forms used to generate patron records in accordance with (IAW) government direction and policy to limit the use of paper forms wherever possible.

12. Reducing error rate/guesswork on the part of Library staff processing hand-written paper forms.

13. Adhering to all applicable LOC information security regulations, policies, and best practices.

C.3. SCOPE

The CTR shall support enhancing and upgrading CRIMS reporting features using MS Azure to maintain CRIMS operations for secure encrypted transmission of inbound patron metadata to improve external patron engagement, customer experience, request tracking, chain of custody, and workflows currently in use by the Program.

C.4. REQUIREMENTS

The contractor shall provide the following support:

C.4.1. Kickoff Meeting and Initial Draft Documents

The contractor shall conduct a kickoff meeting with the COR within 10 business days of task order award and shall include/provide the following –

1. Kickoff meeting agenda with introductions.

2. Draft documentation covering the following elements that the contractor program manager (PM) and the Library’s designated Service Unit (SU) representative will socialize with the Library’s project stakeholders for their review, feedback, and approval:

a. A draft MS Project-formatted Boundary and Architecture proof-of-concept diagram(s) IAW C.4.5.2 that depict(s) the contractor’s process and methodology proposed to satisfy the requirements of the SOW. The final-approved diagrams(s) will be incorporated into the resultant task order as a Section J attachment via a subsequent contract modification post-task order award.

b. A draft Service Level Agreement (SLA) based on Section J Attachment J1.

3. Time for questions and discussion

The contractor shall deliver meeting minutes with discussion points, action items, and next steps within five business days following the kickoff meeting.

C.4.2. Program Management and Key Personnel

The contractor shall provide a Program Manager as Key Personnel, who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the program manager is absent shall be designated in writing to the Contracting Officer.

The program manager or alternate shall have full authority to act for the Contractor on all matters relating to this contract.

Minimum Qualifications for the Program Manager shall include:

U.S. Citizenship Ability to communicate both orally and in writing with senior level executives Ability to meet critical deadlines.

Expertise in execution and oversight of major federal IT programs

Additional Key Personnel may be identified on individual task orders. All key personnel must be approved by the

Contracting Officer prior to the start of any task.

Additionally, the contractor shall provide the below program management, at a minimum:

1. Contribute to organizational direction through regular involvement with client leadership and team members.

2. Maintain productive and effective client relationship with the most senior levels of the client organization.

3. Develop, maintain and update project management plan.

4. Develop, maintain and update SLA.

C.4.3. Agile Software Development

The contractor shall provide Agile Software Development support in accordance with attachment J7. This also includes:

1. Develop and maintain System User Interface for existing operational system to support Currency Reader Inventory and end user delivery, account management, granular reporting, record management, and website integration.

2. Support shall permit for identification and recommendation of additional deprecations of degraded legacy system modules that either pose a security risk or are recognized as obsolete functionalities. All other legacy functionalities are to be maintained.

3. Provide Azure Infrastructure support security and management, ADB2C Development and Integration, C# programming, Angular Development, and .Net Programming.

4. Maintain system website development, security, registration, and operations for existing supply chain integrations and interfaces.

5. Maintain ATO documentation as required by LOC

6. Provide system generated reports as required by the LOC.

7. Provide Helpdesk support, compliance management, security logging, and reporting utilizing tools to include but not limited to Azure Monitor and Qualys.

8. CTR shall implement security event management and automated response using basic application of MS

Sentinel. Security management using MS Azure portal. Upgrade security report delivery and sustain relevant aspects of existing CRIMS security reports and alerts. Upgrade report scheduling software.

9. The CTR shall support existing project staff and maintain operational support for the Currency Reader request supply chain in order to sustain application throughput, staff reporting capabilities (account management, log reports, other legacy reporting), tracking capability for the requestors using Currencyreader.gov, and record management capability for internal staff to verify, process, and facilitate individual application requests for a currency reader device against a legacy database.

10. Support system integration with LOC parent databases by API, Webhook, or other applicable technologies.

C.4.4. Provide Cloud Hosting Environments, Operations, and Cloud Support

The CTR shall provide Office of the Chief Information Officer (OCIO) -approved cloud hosting environments to support the system’s development, testing, and production environments. The CTR shall also provide production disaster recovery capabilities operational in a different availability zone. The CTR shall also provide business-hour help-desk support to authorized NLS project staff interfacing with individual applicants. It is expected that the vendor shall provide:

1. Project management for enhanced system approval, development, testing, operations, maintenance and reporting capabilities as acceptable to LOC/NLS Change Control and in conformity with CRIMS SLA and software tools defined by OCIO.

2. Daily harvesting of submitted applicant requests by staff for the purposes of verification and response to a valid request with a device shipment.

3. Implemented functionality and integrated enhancement with existing operations to meet the objectives of the CRIMS SLA and to continuous monitoring. The CTR shall produce documentation routinely and upon request.

4. Recommendations for COTS software or custom coding as needed to mitigate system vulnerabilities using recognized standards (e.g. NIST)

5. Reviewed implemented capabilities with ISSO and CRIMS stakeholders. Provide analysis on routine (weekly, 30 days, annual) basis.

6. Compliance with all Library of Congress IT security policies and directives.

7. Deploy and monitor added system enhancement(s)/features to the Prod/Test/DR environment(s).

8. Support for NLS during user acceptance testing of UI and fillable form enhancement(s) and related system reporting functions.

9. Management for system recovery to the production and disaster recovery environments to ensure successful system operation in both environments.

10. Communication/correspondence with service desk(s) for parent database(s), system back-up and other

3rd party stakeholders to manage system interconnectedness.

11. Proposed System Architecture Enhancements

12. IT security “lessons learned” to minimize administrative burden of managing enhancements to system configuration to pre-screen for future state enhancements to CRIMS system and its web-based user interface. Proposed enhancements shall include diagrams ensuring IP level specificity actionable by change request.

13. An implementation-ready timetable for associated security enhancements to CRIMS inclusive of cloud based virtual machines

14. Upon request, tests for 508 Compliance and provide feedback with respect to any proposed updates, solutions or system modifications during the performance period.

C.4.5. Additional Documentation

The following documentation shall be provided by the CTR in response to OCIO and ISSO inquiries for documentation:

C.4.5.1. Concept of Operations for Change Control Board

The CTR shall maintain performance reporting and documentation to include proposed enhancement architecture solution(s) (Concept of Operations) to LOC Change Control Board, CRIMS Information System Security Officer, and authorized users prior to development.

C.4.5.2. Boundary and Architecture Diagrams

The CTR shall submit boundary and architecture diagrams annually to OCIO for system Authorization to Operate (ATO) accreditation renewal. The diagrams and associated deliverables (e.g., security artifacts submitted for the annual ATO reaccreditation process), shall conform to current LOC system security requirements applicable to CRIMS, and be compliant with annual ATO security obligations. This diagram shall include Prod, Test, DR and Dev environments for CRIMS to effect implementation of a web-based fillable form solution to upgrade the patron applicant experience, inclusive of application submission and tracking of new requests for a currency reader device.

C.4.5.3. IT Security Documentation

1. Provide all IT Security documentation for the system as required by the Library OCIO.

2. Maintain system FEDRAMP compliancy.

C.4.5.4. Continuous SLA Updates

The CTR shall utilize attachment J1 and provide continuous updates to the SLA as they occurring.

C.4.6. Optional CLIN – Phase In/Out Implementation of System Transition

When and if this CLIN is exercised, the CTR shall provide support for the following –

1. Phase-In/Out implementation in compliance with LOC OCIO Change Advisory Board (CAB) requirements to transition legacy CRIMS system lifecycle over to a fully integrated Azure cloud and front-end operations model that can be supported entirely by MS Azure Helpdesk without reliance on custom coding.

2. Continued SLA Updates.

C.5. SCHEDULE OF DELIVERABLES

SOW Ref. Description of Event Due Date

C.4.1 Kickoff Meeting Within 10 Days of POP Start

C.4.1 Kickoff Meeting Minutes (to include discussion points, action items, and next steps).

5 Bus. Days Post Kickoff Meeting

C.4.1, C.4.5.2 Final Boundary and Architecture proof-of-concept diagram(s).

10 Days Post

Kickoff Meeting

C.4.3-

C.4.4

Account User Report

Qualys Compliance Report

System Sync/Backup Report

Weekly +

Continuous/

Upon Request

C.4.3-

C.4.4 System Status Report

Weekly/Monthly

+ Continuous/

Upon Request

C.4.3-

C.4.4

Maintain all aspects of CRIMS cloud environment in MS Azure to ensure secure encrypted transmission of currency reader requests between stakeholders.

Maintain Currency Reader.gov fillable form in conformance with CRIMS system support

Maintain CRIMS operations and system security IAW SLA.

Maintain data connection with PIMMS.

Continuous

C.4.3-

C.4.4

Help-Desk and System Security to include project support of ongoing version control of CRIMS documentation and Concept of Operations (including diagrams, documented Use Cases, and Stories for LOC

OCIO/CAB

Support web-based workflows for authorized staff to ensure repeated access to customer data.

Provide routine customer service liaison

Continuous

C.4.4 Initial provision of cloud hosting, operations and cloud support for testing of PROD, TEST, DR environments. Dev if needed.

Within 60 Days of POP Start

C.4.6 Complete phase-in/out implementation of system transition Within 90 Days of POP Start

SOW Ref. Description of Event Due Date

C.4.5.4.

C.4.56

Continuous SLA Updates

Continued SLA Updates

Ongoing, But Within 180 Days of POP Start

NLT the end of the optional CLIN’s POP

C.4.5.2-

C.4.5.3

ATO Documentation Deliverables IAW with LOC ISCM policy and requirements including documentation

Within 180 Days of POP Start

C.6. GOVERNMENT FURNISHED PROPERTY (GFP):

The Government will provide the contractor with the following:

1. Network accounts

2. Access to appropriate development, testing, and production environments in accordance with IT Security and

OCIO directives and procedures.

3. Access to Library intranet and Network Systems as deemed necessary to fulfill the requirements.

4. Access to existing system documentation and subject matter experts, as needed.

The contractor shall be responsible for providing –

5. Library-compatible workstations, IAW LC52.239-1, “Information Security”, for remote work.

6. All reference tools, training tools, and additional supplies to its personnel, as required.

(End of Statement of Work)

030ADV26Q0024 Section D

SECTION D - PACKAGING AND MARKING

D.1 LC52.211-1 DELIVERIES (APR 2015)

All deliveries submitted to the CO or the COR or other Library personnel designated to receive deliverables shall clearly indicate the following information:

a. Agency/Requiring Library Service Unit and MAIL STOP/Room Number

b. Description of information/data being submitted

c. Contract Number

d. Contractor Name and Address

(End of Clause)

D.2 LC52.231-1 PAYMENT OF POSTAGE FEES (MAY 2015)

All postage and fees related to submission of information, including forms, and reports, etc., to the Contracting Officer or Contracting Officer’s Representative (COR) or other persons designated to receive, shall be paid by the Contractor.

030ADV26Q0024 Section E

SECTION E - INSPECTION AND ACCEPTANCE

E.1 Inspection and Acceptance

Inspection and acceptance shall be in accordance with paragraph (a) of FAR 52.212-4.

030ADV26Q0024 Section F

SECTION F - DELIVERIES OR PERFORMANCE

F.1 LC52.215-5 PLACE AND PERIOD OF PERFORMANCE (JAN 2019)

Place of Performance: Work to be performed shall take place remotely at the contractor's facilities or approved telework site.

The overall period of performance shall be as stated in section B.

The contractor is responsible for determining its hours of operation in fulfilling the requirements of this contract. The Library’s standard operating hours are from 8:30 AM through 5:30 PM, Monday through Friday, excluding Federal holidays. The contractor shall coordinate with the COR for any work to be conducted at Library facilities.

030ADV26Q0024 Section G

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 LC52.201-3 CONTRACT ADMINISTRATION (AUG 2015)

This contract will be administered by:

Library Contracting Officer: Blose, Todd

Address: Library of Congress

Contracts & Grants Directorate

101 Independence Ave SE

Washington DC 20540-9411

Phone:

Email: tblose@loc.gov

Library Contract Specialist: Cartheuser, Quinn

Address: Library of Congress

Contracts & Grants Directorate

101 Independence Ave SE

Washington DC 20540-9411

Phone: (202) 707-2339

Email: qcart@loc.gov

Library Contracting Officer Representative:

Address: Provided at Time of Award

Phone:

Email:

030ADV26Q0024 Section G

Contractor Contract Administrator: Provided at time of award

Address: Provided at time of award

Provided at time of award

Provided at time of award

Provided at time of award

Phone:

Email:

G.2 LC52.232-1A LIBRARY OF CONGRESS INVOICE INSTRUCTIONS (OCT 2016)

The Contractor must prepare and submit invoices electronically to: nlsadmin@loc.gov with a CC' to the COR. The Contractor may submit payment requests using other than electronic means only when alternate procedures are authorized by the contracting officer in writing.

(End of Clause)

G.3 LC52.232-2 SCHEDULE OF PAYMENTS (JUN 2015)

The contractor must submit invoices for payment upon delivery of the items or successful performance of the events identified below pursuant to the standards and acceptance criteria defined in this contract.

The contractor shall submit its invoices in the quantities and amounts stated in Section B, upon delivery and Government Acceptance.

For CLINs 0001 and 0101 (if exercised), the contractor shall submit invoices upon delivery and Government acceptance of each sprint.

For CLINs 0002 and 0102 (if exercised), the contractor shall submit monthly invoices for support services delivered and accepted by the Government.

030ADV26Q0024 Section H

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 LC52.201-1 CONTRACTING OFFICER'S REPRESENTATIVE (COR) APPOINTMENT AND

AUTHORITY (JAN 2016)

(a) Performance of work under this contract is subject to the technical direction of the COR. The term “technical direction” includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, and/or fills in details and otherwise serves to ensure that tasks outlined in the contract are accomplished satisfactorily.

(b) Technical direction must be within the scope of the contract specification(s)/work statement. The COR does not have authority to issue technical direction that:

(1) Constitutes additional work outside the contract specification(s)/work statement;

(2) Constitutes a change as defined in the “Changes” clause of this contract;

(3) Causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract; or

(6) Directs, supervises or otherwise controls the actions of the contractor's employees.

(c) Technical direction may be oral or in writing. The COR must confirm oral direction in writing within five workdays, with a copy to the Contracting Officer.

(d) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR.

If, in the opinion of the contractor, any direction of the COR or the designated representative falls within the limitations of (b) above, the contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(e) Failure of the Contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the “Disputes” clause of this contract.

(End of Clause)

H.2 LC52.203-1 CONTRACTOR PUBLICITY (OCT 2013)

The Contractor, or any entity or representative acting on behalf of the Contractor, may not refer to the equipment or services furnished pursuant to the provisions of this contract in any news release or commercial advertising, or in connection with any news release or commercial advertising, without first obtaining explicit written consent to do so from the Contracting Officer. Should any reference to such equipment or services appear in any news release or commercial advertising issued by or on behalf of the Contractor without the required consent, the Government will consider institution of all remedies available under applicable law.

H.3 LC52.204-3 INFORMATION SYSTEMS SECURITY (JUL 2024)

(1) Computer Security Policy. The Library requires anyone using or accessing its digital assets (including networks, servers, workstations, systems, data, web pages, and email) to protect them and use them only for official business, and only in accordance with Library regulations and applicable Library bargaining agreements. Unauthorized or inappropriate use may be grounds for termination or other contractual remedy.

(2) Privacy Policy. No one has the right to privacy while using any Library computer system, including internet or email services. Usage may be monitored.

(3) Level of Access. The Library’s Host Office will determine the level of access to the Library’s IT equipment, staff and software needed to successfully perform under this contract. Access may include, for example, email, word processing, internet, and intranet.

(4) Mandatory IT Security Training. Contractor staff must successfully complete mandatory information systems security training and access forms prior to use of or access to any of the Library’s digital assets.

(a) The required training is available on the Library’s learning management system, LOC Learn, at https://www.loc.gov/extranet/cld/. Library staff will provide further instructions upon onboarding.

(b) Contractor staff with access to Library digital assets shall complete the information systems security training annually. The training is available on the Library intranet at https://www.loc.gov/staff/cld/.

(End of Clause)

H.4 LC52.204-4 CONTRACTOR EMPLOYEE FITNESS (SEP 2024)

“Contractor employee fitness” means fitness based on character and conduct for work for or on behalf of the Government as a contractor employee.

Work under this contract is unclassified. However, the Library of Congress shall conduct background investigations of contractor personnel who will have 1) regular, ongoing, unescorted access to the Library’s buildings, grounds, or collections, 2) access to Library information technology systems, and/or 3) access to Library information not available to the public, including information determined to be Controlled Unclassified Information (CUI), to ensure they meet basic standards of honesty and trustworthiness pursuant to Library regulations. The Library does not determine the fitness of employees to work for the contractor firm that hires them. The Library’s interest is in determining whether contractor personnel should be granted greater access than the general public to Library facilities, Library information technology systems, and/or non-public Library information.

(1) Any access to non-public Library facilities, Library information technology systems, and/or non-public Library information will require a contractor employee fitness determination. All initial, existing, and reciprocal contractor employee fitness determinations will be subject to continuous vetting. Continuous vetting will vary based on position risk level. An example of continuous vetting is outlined in Trusted Workforce 2.0 (https://www.performance.gov/trusted-workforce/ and https://www.dcsa.mil/Personnel-Security/Continuous- Vetting/).

(2) A favorable contractor employee fitness determination requires completion and successful adjudication of a security application request (release forms, fingerprints, and a full background investigation). To facilitate the fitness determination, the prospective contractor employee shall submit to the Library complete and accurate information as identified on the National Background Investigation Services (NBIS)’s eAPP (https://eapp.nbis.mil) or other system as provided by the Personnel Security Division (PSD). Contractors should anticipate a minimum of two weeks for the process, provided all requested information is timely, accurate and complete and that no adverse information is received. A background investigation generally will require that the candidate has cumulatively resided in the United States for at least three of the past five years. This requirement is subject to certain exceptions assessed on a case-by-case basis by PSD in accordance with established federal personnel vetting standards.

(3) After the contractor employee fitness determination, each contractor employee with a favorably adjudicated background investigation shall be enrolled in and subject to the Library’s continuous vetting process. Enrollment in the Library’s continuous vetting process also requires enrollment in the Federal Bureau of Investigation (FBI) Record of Arrest and Prosecution Background (“Rap Back”) program, which provides the Library with notification of any criminal activity by the enrollee. Upon enrollment in Rap Back, the Library shall provide each enrollee with a notification of their rights with respect to the collection and use of their fingerprints and to the accuracy of the information obtained from Rap Back, as well as a copy of the FBI Privacy Act Statement that describes how FBI may use their fingerprint images.

(4) The fact that the Library may conduct background investigations and continuous vetting on assigned contractor personnel does not relieve the contractor of the responsibility to provide qualified, reliable personnel of sound character and conduct. This includes providing contractor personnel who can maintain compliance with the Library’s requirement of a drug-free workplace and federal laws regarding controlled substances (see the Controlled Substances Act, 21 U.S.C.

§ 801 et seq. for the definition of controlled substances). In the event that drug testing is required for a contractor employee to obtain a favorable fitness determination, the contractor will be responsible for bearing the costs of such testing, conducting the testing in a manner consistent with federal vetting standards, which are based on the testing protocols published by the Substance Abuse and Mental Health Services Administration (SAMHSA), and providing the results to the Library.

(5) The Library may require removal of contractor staff from Library facilities and revocation of access to Library information technology systems and non-public Library information if investigative results raise concerns regarding a contractor employee’s fitness or the contractor employee is non-compliant with the Library’s instructions or requests for information during the vetting process. In such cases, the Contracting Officer (CO) or Contracting Officer Representative (COR) will notify the contractor of the unfit determination and need for the contractor employee to return all government equipment such as badges, keys and network tokens if issued. Contractor management staff may be required to escort the contractor employee from Library premises.

(6) The contractor will ensure the COR and CO are notified of all changes to those contractor personnel performing work on this contract that require non-public access.

(End of Clause)

H.5 LC52.204-27 HANDLING OF FEDERAL RECORDS (JUL 2021)

(a) Definitions “Records,” as defined in 36 C.F.R. § 703.4(a), includes all books, papers, maps, photographs, reports, and other documentary materials, exclusive of materials in the Library’s collections, regardless of physical form or characteristics, made or received and under the control of the Library in pursuance of law or in connection with the transaction of public business, and retained, or appropriate for retention, by the Library as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the government or because of the informational value of data contained therein. The term refers only to such items in being and under the control of the Library. It does not include the compiling or procuring of a record, nor does the term include objects or articles, such as furniture, paintings, sculpture, three-dimensional models, structures, vehicles, and equipment. All data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Privacy Act of 1974 (5 U.S.C. 552a), as amended, and Library of Congress regulations at 36 CFR Part 703.

(b) Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs.

21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, Library of Congress regulations at 36 CFR Part 703 and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, Contractor shall manage and schedule records for disposition only as permitted by statute or regulation.

3. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or which is exempted from public disclosure by 36 C.F.R. 703.5.

4. The Library of Congress shall own the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which the Library of Congress shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227- 20.

5. In accordance with 36 CFR 1222.32, Contractor shall maintain and manage all records in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

6. The Contractor shall only remove records from the legal custody of the Library of Congress or destroy them in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report the event to the Contracting Officer.

7. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to Library of Congress control unless otherwise directed by the Contracting Officer.

8. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract vehicle in accordance with instructions provided by the Contracting Officer. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

9. The Contractor shall not create or maintain any records containing any non-public Library of Congress information that are not specifically authorized by the contract.

10. All Contractor employees assigned to this contract who create, work with, receive, store, or otherwise handle records shall take Library of Congress-provided records management training. The Contractor shall be responsible for confirming training has been completed.

11. The Contractor shall obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts.

12. The Contractor (and any sub-contractor) shall abide by Government and Library of Congress guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information. The Contractor shall immediately notify the Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment.

(c) Flowdown of requirements to subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this contract vehicle, and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

(End of Clause)

H.6 LC52.237-1 KEY PERSONNEL (AUG 2014)

The personnel designated as key personnel in this contract are considered to be essential to the work being performed hereunder. At least 30 days prior to diverting any of the specified individuals to other programs or contracts or as soon as possible if an individual must be replaced, for example, as a result of leaving the employ of the contractor, the contractor shall notify the contracting officer and identify proposed substitutions. No diversion or substitution shall be made by the contractor without written consent of the contracting officer.

The following personnel have been identified as Key Personnel in the performance of this contract:

Position/Labor Category Name

Program Manager / Appl. Prgrmr. III

(End of Clause)

H.7 LC52.239-1 INFORMATION SECURITY (JUL 2025)

The work to be conducted is considered Controlled Unclassified Information (CUI) pursuant to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 (rev 4) or current version. The Contractor shall ensure that all non-public Library information processed under this contract shall be protected from unauthorized use and mishandling by the Contractor. Information includes both hard copy (paper) formats and soft copy (stored in electronic form, e.g., hard disks, tapes, flash drives, CD-ROM/CD-R, etc.).

(a) The Contractor shall store hard copies and soft copies contained on removable media (e.g., tapes, floppy disks, flash drives, CD-ROM/CD-R, etc.) in a government-approved storage container per the direction of the Contracting Officer Representative (COR) or the Library of Congress Project Manager when not under the direct control of Contractor Key Personnel.

(b) The Contractor shall treat any information developed on security vulnerabilities and any Government provided non-public information as “CUI.”

(c) The Contractor personnel shall label and protect this information as “Security Category: Moderate,” placing this designation in the footer.

(d) The Contractor shall ensure that all documents designated “Security Category: Moderate,” “Security Category:

High” and “Limited Official Use Only” are not emailed to or from an external email system. These documents may only be emailed between Library of Congress email accounts, or within a secured corporate email network.

(e) The Contractor shall ensure that all documents designated “Security Category: Moderate,” “Security Category:

High” and “Limited Official Use Only” are shredded, burned, or otherwise destroyed before being disposed of in accordance with applicable corporate and federal records management policies.

(f) The Contractor shall dispose of all documents designated “Security Category: Moderate,” “Security Category: High” and “Limited Official Use Only” remaining in the Contractor’s possession at the end of the contract term.

(g) The Contractor shall ensure that all Contractor workstations used to process Library information utilizes anti-virus and anti-spyware utilities that are configured to continuously monitor and to automatically update as well as having automatic operating system patching in place.

(h) The Contractor shall ensure that all Contractor workstations used to process Library information employ a firewall that can either be software running on the workstation or a stand-alone firewall that protects the workstation from unauthorized access from any other devices, including devices on the Contractor’s corporate network.

(i) The Contractor shall ensure that all Library information that is labeled “Security Category: Moderate,” “Security Category: High” and “Limited Official Use Only” is encrypted using a Federal Information Processing Standards Publication (FIPS) 140-3 validated application configured in FIPS mode. This includes information stored on internal hard drives and removable devices (e.g., CD-Rs, flash drives, etc.).

(j) The Contractor must provide a written list of anti-virus, anti-spyware, firewall, encryption products, versions and proof of licenses, along with the automatic operating system patching status, MAC address (if applicable) and user name for each system being used to process Library information. Patching shall include Operating System packages and third party software installed on any systems accessing the Library Networks.

(k) In accordance with NIST SP 800-61 (rev 3) or current version, the Contractor shall report to infosec@loc.gov, the Contracting Officer, and the COR any adverse events that are computer security related or computer security incidents (adverse events and computer security incidents as defined in NIST SP 800-61 (rev 3) or current version) concerning Library CUI within 24-hours of its discovery. The contractor shall coordinate its response to such an event or incident with the Library.

(l) The Contractor shall not provide any government-furnished non-public documents, information, or licensed material in any form to anyone other than the Contracting Officer, the COR, or the Library of Congress Project Manager without the written approval of the Contracting Officer, the COR, or the Library of Congress Project Manager during the period of this contract or at any time afterwards.

(m) The Contractor shall not release any government documents or information related to IT Security in any form without the written approval of the Library’s IT Security Group.

(n) The Contractor shall ensure that all Contractor personnel sign nondisclosure agreements (NDAs).

(o) The Contractor shall ensure that all Contractor personnel complete the Library of Congress IT Security Awareness Training on an annual basis.

(End of Clause)

H.8 LC52.239-2 SYSTEMS DEVELOPMENT LIFE CYCLE (SEP 2018)

The Information Technology to be provided under this contract is subject to the procedures established in the Library’s Systems Development Life Cycle (SDLC) as follows:

(a) Requirements: The Contractor shall gather and analyze requirements and produce a system requirements document (SRD) accordingly.

(b) Design: The Contractor shall perform design analysis and complete a Systems Design Document which satisfies the requirements in the aforementioned SRD.

(c) Development: The Contractor shall develop, customize and/or configure the system according to system requirements and design specifications.

(d) Testing: The Contractor shall test the solution to ensure it satisfies all requirements, including security requirements documented in Library of Congress Directive (LCD) 5-410.1, Information Technology Security Policy. The Contractor shall remediate any identified vulnerabilities and weaknesses in accordance with LCD 5-410.1.

(e) Implementation: The Contractor shall support implementation and deployment of the tested solution into the Library’s production environment.

(f) Documentation: The Contractor must either use the Library’s SDLC templates, which will be provided by the COR upon request, or use an…