RFQ 1605TA-24-Q-00018 - BLS VDE.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

ITAS

See Schedule

BLS DC NAT SHIP CODE 16. ADMINISTERED BYCODE

X

X

518210

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED ORITAS

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

04/16/2024 1700 ED

04/02/2024

202-693-3720Jeffrey Martin (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBERa. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

1605TA-24-Q-00018

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 97 1625-OCW-24-NAT-0003OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

WASHINGTON DC 20212

ROOM G225

2 MASSACHUSETTS AVENUE, NE

US DEPARTMENT OF LABOR

15. DELIVER TO

Washington DC 20210 S-4307 200 Constitution Ave, NW Information Technology Acq Services

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$40

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

US Department of Labor

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

ADMINISTERED BY:

US Department of Labor Information Technology Acq Services 200 Constitution Ave, NW S-4307 Washington DC 20210 USA This is a Request for Quotation (RFQ) prepared in accordance with Federal Acquisition Regulation (FAR) Part 13, Simplified Acquisition Procedures, in conjunction with FAR Part 12, Commercial Items.

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

Nicole D. Jacobs

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

x x

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

The Department of Labor (DOL) Office of the

Senior Procurement Executive (OSPE), on behalf of the Bureau of Labor Statistics (BLS) is issuing this Request for Quotation (RFQ) for Virtual Data

Enclave for restricted access microdata services.

The requested work is described in the attached

Performance Work Statement (PWS).

The Government contemplates awarding a single firm-fixed-price (FFP) contract.

The period of performance for this requirement is as follows:

Base Period - 12-months

Option Period 1 - 12-months

Option Period 2 - 12-months

Option Period 3 - 12-months

Option Period 4 - 12-months

Offerors are responsible for adhering to the terms and conditions found in this RFQ. Offerors shall complete "Attachment 6 - Additional

Information Sheet” and include it with their quotation response.

0001 Base Period - VDE One Time Set-up Costs

Continued ...

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

97 2 of

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

3 97

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1605TA-24-Q-00018

Product/Service Code: DH01

Delivery: 1 Days After Award

0002 Base Period - Per Project

Product/Service Code: DH01

Delivery: 1 Days After Award

0003 Base Period - Per User

Product/Service Code: DH01

Delivery: 1 Days After Award

1001 Option Period 1 - Per Project

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

1002 Option Period 1 - Per User

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

2001 Option Period 2 - Per Project

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

2002 Option Period 2 - Per User

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

3001 Option Period 3 - Per Project

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

Continued ...

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

NAME OF OFFEROR OR CONTRACTOR

4 97

CONTINUATION SHEET

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF

(A) (B) (C) (D) (E) (F)

1605TA-24-Q-00018

3002 Option Period 3 - Per User

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

4001 Option Period 4 - Per Project

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

4002 Option Period 4 - Per User

(Option Line Item)

(Anticipated Option Exercise Date) 0

Product/Service Code: DH01

NSN 7540-01-152-8067 OPTIONAL FORM 336 (4-86)

Sponsored by GSA

FAR (48 CFR) 53.110

RFQ - 1605TA-24-Q-00018

BLS VDE

Performance Work Statement (PWS)

For

Bureau of Labor Statistics Data

Enclave for Restricted Access

Microdata

PART 1 GENERAL INFORMATION

1.1. Description of Services/Introduction:

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and non-personal services necessary to perform all tasks as defined in this Performance Work Statement (PWS), except as Specified in section Part 3 as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.2. Background:

The Bureau of Labor Statistics (BLS) of the U.S. Department of Labor is the principal Federal statistical agency responsible for measuring labor market activity, working conditions, price changes, and productivity in the U.S. economy. Its mission is to collect, analyze, and disseminate essential economic information to support public and private decision-making that forms the basis of our democratic, free-enterprise system. Like all Federal statistical agencies, BLS executes its statistical mission with independence, serving its users by providing products and services that are accurate, objective, relevant, timely, and accessible.

The Bureau of Labor Statistics (BLS) currently makes available multiple files and data extracts from approximately twenty different surveys to eligible outside researchers working on approved projects through written agreements. This data currently is made available to eligible researchers through three types of environments with different types of physical and virtual access and security. The BLS is interested in consolidating access to a virtual data enclave (VDE) approach for providing outside researchers’ secure access to all restricted BLS confidential information research files that are protected from unauthorized disclosure under the CIPSEA.

Currently, BLS shares microdata from the Census of Fatal Occupational Injuries (CFOI) and the National Longitudinal Surveys (NLS) with eligible researchers working on approved projects through an agreement, which allows for off-site access. The current VDE approach will serve as the basis for expanding the VDE to all BLS-restricted research files.

1.3. Objective and Scope:

The primary objective of this effort is for the contractor to provide services to create a National Institute of Standards and Technology (NIST) 800-171 compliant virtual data enclave (VDE) through which confidential information can be stored and disseminated. If proposing a cloud-based solution, Contractors shall be a FedRAMP authorized Contractor at the moderate impact level. The Contractor shall ensure all employees of the prime and sub-Contractors (including third-party cloud service providers) that have access to the cloud data storage sign BLS agent agreements found in Attachment 1: BLS Confidentiality and Security Requirements and complete required training. See Attachment 3: Sub-Contractor Confidentiality and Security Commitment.

The Contractor shall ensure that BLS-approved researchers can access data from their own computer via a ‘virtual desktop’ but cannot download or remove confidential data from the remote server. The Contractor shall ensure the virtual desktop is isolated from the user's physical desktop computer, restricting the user from downloading files or parts of files to their physical computer. The Contractor shall ensure that external access is restricted, preventing users from emailing, copying, or otherwise moving files outside of the secure environment, either accidentally or intentionally. The Contractor shall provide a VDE that shall allow for virtual file sharing among research project team members and BLS disclosure review staff. The Contractor shall provide a VDE that includes technical support provided by the enclave staff and offers a variety of software packages for statistical analysis. The Contractor shall ensure the data enclave offers enhanced security while updating the method of data sharing to take advantage of advancements in IT security that have occurred since the off-site data sharing program at BLS originated.

1.4. Period of Performance:

The period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option periods. The Period of Performance reads as follows:

Base Period: 12-months Option Period I: 12-months Option Period II: 12-months Option Period III: 12-months Option Period IV: 12-months

1.5. General Information

1.5.1. Quality Control:

The contractor shall develop and maintain an effective quality control program (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. As a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. After acceptance of the quality control plan, the contractor shall receive the Contracting Officer’s (CO) acceptance in writing of any proposed change to his QC system. The QCP shall be delivered within 10 days after awarding the contract. The QC is to be submitted to the Contracting Officer Representative (COR) and/or CO within 30 calendar days of contract award.

1.5.2. Quality Assurance:

The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance requirements summary. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.3. Reserved

1.5.4. Recognized Holidays:

The Virtual Data Enclave shall be available to researchers to access on federal holidays.

Contractor helpdesk requests shall be addressed on the next business day after a federal holiday.

The Federal Government observes the following holidays and Federal buildings will be closed.

Federal contractors shall not perform services under this contract on the following holidays:

New Year’s Day Labor Day

Birthday of Martin Luther King, Jr. Columbus Day

Washington’s Birthday Veterans Day

Memorial Day Thanksgiving Day

Juneteenth National Independence Day Christmas Day

Independence Day Inauguration Day

1.5.5. Hours of Operation/Place of Performance:

The contractor is responsible for conducting performance to ensure adequate helpdesk coverage is provided so that requests are responded to within two business days, except when the government facility is closed due to local or national emergencies, administrative closings, or similar government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this performance work statement when the government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

Remote work is authorized under this contract and all work must be performed within the United States of America.

All work shall be performed at the Contractor’s worksite or remotely. Remote work performed by Contractor employees is permitted with COR approval subject to the requirements in the BLS Confidentiality and Security Requirements. Travel: No travel shall be authorized for this contract.

1.5.6. Type of Contract:

The government contemplates award of a firm-fixed-price contract with optional line items for increasing the quantity of projects and users.

1.5.7. Security Requirements:

The Contractor shall comply with all Confidentiality and Security Requirements as outlined in Technical Exhibit 3 of the contract through steps outlined in their quality control plan.

The Contractor’s employees, performing work in support of this contract will have had a background check prior to being assigned to the project.

1.5.7.1. Physical Security.

The contractor shall be responsible for safeguarding all government property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.5.7.2. Reserved

1.5.8. Special Qualifications:

Privacy Act If applicable, the Contractor shall be required to design, develop, or operate system(s) of records on individuals, to accomplish an Agency function subject to the Privacy Act of 1974, Public Law 93 579 (5 U.S.C., Section 552a) as amended (the Act), and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties (FAR 52.224 1). The title(s) of the system(s) of records will be listed on the respective call orders, as appropriate.

1.5.9. Post Award Conference/Periodic Progress Meetings:

The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the CO will apprise the contractor of how the government views the contractor's performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.5.10. Contracting Officer Representative (COR):

A COR for this order shall be appointed under separate cover.

1.5.11. Key Personnel:

Key personnel designated are those personnel assigned to Key positions or labor categories and are essential to the work performed herein. The CO will designate or replace Key Personnel, as appropriate.

DOL has determined that continuity through the retention of highly qualified contractor personnel is a major factor for success in achieving high quality products and efficient performance. If it becomes necessary for the vendor to replace Key Personnel after designation, the vendor shall provide to the CO and the COR a written evaluation of the impact on the progress and continuity of the relevant work that might result by replacing these personnel. The vendor shall submit the names and resumes of replacement personnel to the CO and the COR for review not later than two calendar weeks prior to their replacement, or as soon as known. All replacement personnel must possess qualifications equal to or higher than the qualifications of the person replaced. The CO and COR will evaluate the requests and the CO will promptly notify the contractor of approval or disapproval of the replacement key personnel. Once the key personnel is approved the vendor must have said personnel on board within 14 days.

The follow personnel are considered key personnel by the government: Project Manager and Information Security Officer. The Contractor shall provide the Contracting Officer with the name of the key personnel and alternate(s) who shall act for the Contractor when the key personnel are absent.

No substitution of key personnel is to be made without the prior written approval of the Contracting Officer.

Project Manager (PM) The PM shall be responsible for the performance of all work conducted under the contract. The Project Manager shall organize and direct a project team who shall carry out the tasks listed in Part 5

- Tasks. The Project Manager shall serve as the liaison between Contractor personnel, the Contracting Officer's Representative (COR) and Task Monitors and shall have overall responsibility for all administrative matters. The PM shall be available to communicate with the Government by telephone or email between 8:00 am and 4:30 pm, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

Information Security Officer (ISO) The ISO is responsible for ensuring the data security of the data enclave. They will be in charge of implementing effective technology solutions to prevent internal and external malicious users from compromising BLS data integrity. Implement and monitor information security requirements, policies, and compliance. Assist with regulatory and data transfer procedures and document the current state of the VDE system.

1.5.11.1 Key Personnel Qualifications

Project Manager The Project Manager shall be a member of the Contractor's organization with training and/or experience in managing and administering a virtual data enclave as described in Part 5 - Tasks. The Project Manager shall have a minimum of three years of experience working with and maintaining a virtual data enclave.

Information Security Officer The Information Security Officer shall have a bachelor’s degree in cyber security or a related degree and a minimum of four years of experience ensuring federal information security compliance standards are met and enforced. Standards shall include some or all of the following: OMB, FISMA, and/or NIST, Federal Policies, Directives and Standards.

1.5.12. Identification of Contractor Employees:

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

PART 2 DEFINITIONS & ACRONYMS

2.1 Definitions:

2.1.1 AGENT: An individual who meets the definition of agent as set forth by CIPSEA and who has been designated by the BLS to perform exclusively statistical activities under an agent agreement.

2.1.2 BLS AGENT AGREEMENT: A formal legal agreement used to designate non BLS employees as BLS agents under the authority of CIPSEA. Agent status authorizes non-BLS employees to access CIPSEA-protected data for exclusively statistical purposes. There are different versions of agent agreements depending on the organizational affiliation of the individual and the circumstances involved.

2.1.3 CONTRACTOR. A supplier or Contractor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.4 CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.5 CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the Contracting Officer to administer the contract.

Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.6 DATA ACCESS AGREEMENT (DAA): Authorizes the provision of sensitive information and the requirements for protecting that information with a university or non-profit institution.

2.1.7 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.8 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.9 KEY PERSONNEL. Contractor personnel that are evaluated in the evaluation process and that may be required to be used in the performance of the contract.

When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.10 MEMORANDUM OF UNDERSTANDING: Authorizes the provision of sensitive information and the requirements for protecting that information with a

Federal or State agency.

2.1.11 PROJECT: A research proposal submitted and accepted by the BLS. Each project may have multiple researchers/users who will be required to complete a BLS agent agreement prior to gaining access to the VDE.

2.1.12 QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.13 QUALITY CONTROL PLAN (QCP). A written document specifying how the Contractor shall monitor and control quality of all services to be provided.

2.1.14 QUALITY ASSURANCE SURVELLIENCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.15 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.16 SUBCONTRACTOR. One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.17 TASK MONITOR. BLS subject matter experts who shall support the COR in contract management and deliverable review.

2.1.18 User: A user is an account for a researcher assigned to a project accessing the

Virtual Data Enclave (VDE). A researcher will be given an additional account for each project they are assigned to. Each individual account will be considered a user and count towards the total users in the VDE. Accounts for BLS staff shall not count towards the user total.

2.2 Acronyms:

2.2.1 BLS Bureau of Labor and Statistics

2.2.2 CO Contracting Officer

2.2.3 COR Contracting Officer Representative

2.2.4 DAA Data Access Agreement

2.2.5 FAR Federal Acquisition Regulation

2.2.6 MOU Memorandum of Understanding

2.2.7 OCI Organizational Conflict of Interest

2.2.8 PWS Performance Work Statement

2.2.9 QA Quality Assurance

2.2.10 QASP Quality Assurance Surveillance Plan

2.2.11 QCP Quality Control Plan

2.2.12 TMP Task Management Plan

2.2.13 VDE Virtual Data Enclave

PART 3 GOVERNMENT FURNISHED

PROPERTY, EQUIPMENT, AND SERVICES

3.1 Equipment:

No facilities or equipment shall be provided under this contract.

3.2 Services:

The Government will answer questions about BLS data or procedures, review and provide feedback on deliverables.

3.2.1 Reserved.

3.3 Facilities:

Remote. The contractor shall furnish necessary equipment to perform the effort(s) outlined in this PWS remotely, at a location other than a government-owned or contractor-owned facility. If deemed necessary, the government may issue, at its discretion, supplemental equipment (e.g., computing equipment).

3.4 Materials:

The Government will provide all BLS restricted data sets to be accessed within the VDE. These data sets will be provided as flat files. The government will also provide a list of approved research agreements, including researcher contact information, approved data sets, and confirmation that the researchers have an approved MOU/DAA and have completed required BLS training. Datasets may be updated yearly with new information. Researchers will be provisioned the either the entire dataset for their project or a dataset extract will be provided on a project-by-project basis for storage and access within each project space.

PART 4 CONTRACTOR FURNISHED

ITEMS AND SERVICES

4.1 General:

The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed as Government furnished items and services.

4.2 Materials:

The Contractor shall furnish all materials required to perform work under this contract including office supplies.

4.3 Equipment:

The Contractor shall furnish and maintain all necessary equipment required to perform work under this contract including but not limited to computers, hardware and software required to conduct analysis.

PART 5 SPECIFIC TASKS

5.1 Base Period Tasks

A. Administrative Tasks (CLIN 0002 and CLIN 0003)

1. The Contractor shall participate in a kick-off meeting.

2. The Contractor shall submit a written Task Management Plan detailing the activity schedule, including the tasks and duration for each activity included in the project.

3. The Contractor shall participate in weekly meetings during the development of the VDE, and then monthly conference call meetings throughout the duration of the contract. The Contractor shall take meeting notes during these meetings and provide them to BLS. Notes shall include the meeting agenda, a summary of the discussion topics, any decisions made during the call, and action items.

4. The Contractor shall submit via email brief weekly progress reports during the construction of the VDE, and then monthly status reports throughout the duration of the base period. During the VDE construction, the reports shall include the work completed in the previous week, goals for the current week, identification of any risk factors that could affect the timely completion of the VDE, and contingency plans for those risks.

After the implementation of the VDE, monthly reports shall include at a minimum: a daily log of VDE usage, total number of projects supported, total number of users, IP addresses, any security risk factors, and identification of how the risk will be mitigated, and any other issues that occurred with the VDE. On a quarterly basis, the Contractor shall include a “Last Login Report” which shall include an up-to-date listing of all active projects to date, their DAA numbers, the names and affiliations of the users, the associated BLS programs, the beginning and expiration dates, and the first and most recent login data.

5. The Contractor shall create a VDE manual that outlines standard operating procedures that will occur between BLS and the Contractor. Topics shall include but are not limited to:

account creation, required training, data import review and approval, export review, and account closeouts. This product will belong to BLS, who will hold editorial control of its contents, and shall be maintained by the Contractor who shall make changes to it pursuant to BLS review and recommendations for the duration of the contract.

B. Technical Tasks (CLIN 0001)

1. The Contractor shall build a virtual data enclave that conforms to the requirements listed.

a. The VDE shall ensure secure access to restricted BLS confidential information files provided by the BLS programs listed in the below table, which shall be considered controlled unclassified information (CUI).

BLS Program/Survey Datasets

Consumer Expenditure Survey (CE)

Current Employment Statistics (CES): National and State and Area

Census of Fatal Occupational Injuries (CFOI)

Consumer Price Indexes (CPI)

International Price Program (IPP)

Job Openings and Labor Turnovers Survey (JOLTS)

National Compensation Survey (NCS)

National Longitudinal Surveys of Youth (NLSY)

Occupational Employment Statistics (OEWS)

Occupational Requirements Survey (ORS)

Producer Price Indexes (PPI)

Quarterly Census of Employment and Wages

(QCEW)

Survey of Occupational Injuries and Illnesses (SOII)

These data sets will be provided as flat files. The government will also provide a list of approved research agreements, including researcher contact information, approved data sets, and confirmation that the researchers have an approved MOU/DAA and have completed required BLS training. Datasets may be updated yearly with new information. Researchers will be provisioned either the entire dataset for their project or a dataset extract will be provided on a project-by-project basis for storage and access within each project space.

b. The Contractor shall ensure the virtual data enclave is built to adhere to CIPSEA and

NIST 800-171 based confidentiality and security requirements for CUI in a Non- Federal System.

c. The VDE shall be a secure solution with controls that prevent all users from emailing, copying, printing, capturing screenshots, sharing, or moving files and confidential data outside the VDE environment.

d. The VDE shall provide technical controls to only provide access to agency approved researchers at specified locations. These controls must include the following:

i. Verifying the researcher’s identity

1. Validating user’s identity to include adequate proof of affiliation with the approved University or Government organization (University or Government ID)

2. Requiring a login ID and password to login

3. Requiring a two-factor authentication process upon each login

ii. Collecting and verifying IP addresses

1. Collecting IP address from the researchers during the application process

2. Verifying that the IP address is affiliated with the recipient organization, after a project is approved but before work begins.

iii. Ensuring access only from approved locations from approved equipment

1. Continuously monitoring IP addresses and blocking IP addresses that have not been approved/authorized access from unapproved locations.

2. Limiting access to only static IP addresses

3. Prohibiting the use of a VPN to access the VDE.

4. BLS must comply with the control and supervision under CIPSEA. The vendor must ensure the VDE is compliant, some available options are:

• Require that laptop/desktop cameras will turn on automatically once a researcher has logged into the VDE and provide BLS security personnel access to video feeds to randomly monitor researchers in compliance with the control and supervision requirement under CIPSEA. The feed will not be recorded or stored for later use.

• An artificial intelligence solution that will monitor the room like an AI proctoring system; or

• A mutually agreed upon alternative solution.

e. The VDE shall minimally support 50 projects and 100 users; this minimum represents a firm-fixed-price. The VDE shall be scalable up to 600 projects and 1,500 users.

Researchers shall have unlimited use of to the VDE with no additional charges for cloud compute, resources, etc. The number of projects and/or users is anticipated to vary throughout the contract’s period of performance. Quantity adjustments may occur at anytime, but the government will not increase the total funded amount by contract modification more than four times per year. Once a modification is awarded, the vendor shall have 10 days to meet the additional capacity for projects and/or users.

Although the total number of funded projects and users will only fluctuate by modification(s), the Contractor, at the direction of the government, shall add/remove projects and users in accordance with B.2 of the PWS. The Contractor shall only invoice monthly for the number of projects and users that have been added and maintained each month, not the funded amount (example: The BLS funds 250 projects and 400 users through a contract modification. In March, there are 200 projects and 350 users in the VDE. In this instance, the vendor’s March invoice would be for 200 projects and 350 users, not 250 projects and 400 users). Any unbillable amounts may be applied to future month’s costs. BLS will ensure the contract has sufficient funding to support existing projects and users in the VDE. The government may also utilize the “True Up” clause if an immediate adjustment is needed beyond the project and/or user funded amount. Reconciliation of these additions will be completed in accordance with the clause.

f. The VDE shall have a secure workspace for each approved project. The workspace shall be accessible by all researchers approved for the same project. The estimated workspace needed for most VDE projects is between 200GB and 500GB.

Approximately 2-5% of projects utilize larger workspaces up to 2TB. Researchers shall have unlimited access to work in the VDE, including the capability to run complicated multi-day statistical programs.

g. The VDE shall restrict researcher access to only the BLS data set(s) approved for use by BLS. The VDE shall contain a shared workspace for researchers working on the same approved project.

h. The VDE shall offer the following statistical software to all researchers.: SAS, Stata, StatTransfer, R and R Studio, SPSS, Python, and a text editor. The software shall be maintained so the most recent version is available in the VDE for use. The BLS may request to modify the contract to add additional software for researcher use in the future.

i. The Contractor shall allocate virtual space to have publicly available datasets uploaded to the enclave to allow researchers to combine them with the restricted BLS data. For researchers interested in adding licensed datasets, the Contractor shall obtain BLS approval prior to uploading any licensed data into the VDE. The system shall ensure all uploaded information is scanned to prevent viruses from entering the virtual data enclave. The minimum space for this is 100 GB.

j. The VDE shall include a space for researchers to save outputs that they wish to have approved for public dissemination. This space shall allow BLS staff to review and approve those outputs for disclosure concerns. The contractor shall make sure export requests for each dataset have a unique space in the output system, so it is easy for BLS reviewers to identify the requests associated with their datasets. Additionally, each output request shall have a space that is divided into two subfolders – one for items to be exported and one for supporting documentation that the reviewer may use to check the request but that will not be exported due to its sensitive nature". Upon approval, a partition must exist where the researchers can download BLS-approved outputs. The minimum size for this space is 100GB.

2. Access and Removal: Access for new BLS agents shall be completed within three business days of receipt of BLS DAA. User accounts shall be disabled immediately on the DAA expiration date. All dates will be provided by BLS. In addition to disabling access based on expiration date, the Contractor shall disable any agent’s access within 24 hours of being requested by BLS. A disabled account shall remain available to be reactivated for a minimum of 60 days, unless a shorter or longer time period is requested by the BLS.

Disabled accounts will still count toward the total number of projects and users maintained in each month. Accounts will be deleted once the disabled period has lapsed. Once deleted, they will no longer count toward the total number of projects and users maintained in each month.

3. The Contractor shall create a database that shall track all current Data Access Agreements (DAAs) and agents that have been issued to researchers accessing the VDE. The database shall include the BLS assigned project number, BLS agent’s name and user credentials (including phone number, IP address, and location of access), the date access was given, and the date the DAA expires. This database should also be readily transferrable to an Excel or Access file.

4. The Contractor shall provide a report to demonstrate the VDE complies with all applicable security requirements including NIST 800-171. If using a cloud-based solution, the Contractor shall also include their FedRAMP package ID and confirmation of a subscription of a government tenant.

5. The Contractor shall provide a virtual demonstration of the VDE and BLS agreement and agent database within 5 days of their completion. The Contractor shall demonstrate the VDE and database have all the required capabilities listed in task 5 and 6.

6. BLS will provide feedback within 10 days of the presentation, and the Contractor shall make any updates needed to the VDE or database within 10 days of receiving feedback.

C. Maintenance Tasks (CLIN 0002 and CLIN 0003)

1. The Contractor shall maintain the VDE in order to support the current level of projects and users that are specified in the base period. This includes providing access to BLS approved projects, ensuring adequate space is available to support all active projects and users, and disabling and deleting access from BLS agents whose projects have been completed. Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends and shall be communicated to VDE users and the BLS COR and Task Monitors at least 5 calendar days in advance and occur no more than 24 hours per quarter.

2. The Contractor shall provide technical support to BLS staff and BLS agents using the VDE by an email helpdesk. Supported topics shall be related to accessing and using the VDE. The support will not include questions about the BLS microdata. A plan outlining how technical support will be provided to BLS shall be due at the conclusion of VDE development. Email requests shall be responded to within two business days.

5.2 Option Year Tasks

The Contractor shall perform the 4 tasks listed below for each Option Year:

A. Administrative Tasks (CLINS 1001, 1002, 2001, 2002, 3001, 3002, 4001, 4002):

1. The Contractor shall participate in monthly conference call meetings throughout the duration of each Option Year. The Contractor shall take meeting notes during these meetings and provide them to BLS. Notes shall include the meeting agenda, summary of the discussion topics, any decisions made during the call, and action items.

2. The Contractor shall submit via email brief monthly reports throughout the duration of each Option Year. Monthly reports shall include a snapshot of the VDE database, a list of removed agents from the previous month, a daily log of VDE usage, total number of projects supported, total number of users, any security risks and identification of how the risk will be mitigated, and any other issues that occurred with the VDE.

B. Maintenance Tasks (CLINS 1001, 1002, 2001, 2002, 3001, 3002, 4001, 4002):

1. Confidentiality and Security Requirements. The Contractor shall comply with all Confidentiality and Security Requirements as outlined in Technical Exhibit 3 of the contract through steps outlined in their quality control plan and systems security plan.

The BLS maintains the right to conduct site inspections to ensure compliance with CIPSEA, FedRAMP (if cloud based) and NIST requirements.

2. The Contractor shall maintain the VDE in order to support the current level of projects and users that is specified in each Option Year. This includes providing access to BLS agents attached to approved projects, ensuring adequate space is available to support all active projects and users, and removing access from users whose projects have been completed. Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends, be communicated to VDE users and the BLS COR and Task Monitors at least 5 calendar days in advance and occur no more than 24 hours per quarter.

3. The Contractor shall provide technical support to BLS agents using the VDE by email.

Supported topics shall be procedures for accessing the data and any access issues to the VDE. Email requests shall be responded to within two business days.

5.3 Start Up and Phase Out Tasks

The Contractor shall perform the following tasks during Start Up and Phase Out:

1. To ensure a smooth transition from the previous VDE platform to the new VDE platform and to prevent possible negative service impacts, the incumbent contractor shall make all necessary personnel available during the thirty (30) day Start Up and Phase Out periods. During the Start Up and Phase Out periods, the incoming contractor will become familiar with performance requirements and the incumbent will share lessons learned, address knowledge or documentation gaps, and be available for questions.

2. 30 days prior to contract expiration or termination, the Contractor shall provide a closeout plan on how they will preserve, transfer, or destroy the Agency data stored in the VDE based on the Agency’s direction. BLS will provide approval of the plan prior to execution.

3. Upon expiration or termination of this Contract, the Contractor shall ensure that no Data

Breach occurs and shall follow the approved plan to preserve, transfer, or destroy the agency data stored in the VDE. The Contractor shall preserve and deliver to BLS any project data that has been created by researchers in the VDE. For all other data, the Contractor shall destroy it by “purging” or “physical destruction”, in accordance with NIST Special Publication 800-171 section 3.8.3 media protection. The Contractor shall certify in writing that the destruction of data has been completed.

PART 6 APPLICABLE PUBLICATIONS

6.1 Publications Applicable to This PWS:

There are no publications applicable to this PWS.

Part 7 Technical Exhibit Index

1. Technical Exhibit 1 – Performance Requirements Summary

2. Technical Exhibit 2 – Deliverables Schedule

3. Technical Exhibit 3 – BLS Confidentiality and Security Requirements

4. Technical Exhibit 4 – Historical Workload

TECHNICAL EXHIBIT 1

Performance Requirements Summary Below is a set of performance objectives and standards. The Contractor shall adhere to all performance objectives and standards.

Performance

Objective Performance Standard Maximum

Allowable Deviation from the

Requirement

(AQL)

Method of Surveillance

Consequences of

Noncompliance

Staffing

The Contractor shall provide key personnel with the qualifications required in the PWS.

Key Personnel proposed shall have the experience and skills required by the qualifications in the

PWS.

No Deviation allowed.

100% Inspection of

Resumes

Impact on CPARS review.

Quality Control develop and adhere to quality requirements

The Contractor has a quality control plan which specifies procedures to identify, prevent, and ensure non-recurrence of defective or subpar deliverables and adherence to all security requirements.

No allowable deviation.

100% inspection Impact on CPARS

Timelines meet established deadlines for deliverables.

Deliverables are completed by the deadline established in the task management plan.

Deliverables may be provided up to 2 days past the deadline, if the delay is communicated to the agency at least a week in advance.

100% inspection

Impact on CPARS

Communication maintain communication with the agency about delays and unexpected issues that may impact the project schedule, or quality of deliverables.

Contractor informs BLS of any delays at least a week in advance of deadline.

Any issues that could impact performance at any point during performance are communicated to BLS within 3 business days of being identified.

Communication shall be provided within the standard time 95% of the time.

Customer feedback from Task Monitors.

Impact on CPARS

Technical Support provide technical support to BLS agents via email.

Email questions are responded to within two business days.

Responses shall be provided within the standard time 95% of the time.

BLS Agent feedback

Impact on CPARS review.

BLS Agent Access Management

The Contractor shall ensure access and removal of access comply with section

B.6.

Access for new BLS agents shall be completed within three business days after receipt of BLS DAA.

Access shall be removed immediately on the DAA expiration date. All dates will be provided by BLS. In addition to removing access based on expiration date, the Contractor shall remove any agent’s access within 24 hours of being requested by

BLS.

Additions shall meet the standard 95% of the time each quarter and removals shall meet the standard 100% of the time each quarter

Periodic Surveillance

Impact on CPARS review.

Schedule downtime of the

VDE

The Contractor shall ensure scheduled VDE downtime occurs in accordance with sections 1.4 C 11 and 1.4.1

B4.

Any scheduled downtime for maintenance shall occur after 5 pm on weekdays or anytime on weekends, be communicated to VDE users and the BLS

COR and Task Monitors at least 5 calendar days in advance, and occur no more than 24 hours per quarter.

Duration of scheduled downtime shall meet the standard 95% of the time each quarter

Periodic Surveillance

Impact on CPARS

Availability of the VDE

The Contractor shall ensure the VDE is available to all covered projects and users.

The VDE shall be available to users at all times.

VDE users and BLS staff shall be notified within 5 calendar days in advance of any planned downtimes.

No more than 5% of unscheduled downtime occurs during each quarter.

No deviation from the standard unless a security breach is identified.

BLS Agent feedback and Periodic Surveillance

Impact on CPARS review, possible termination for cause.

Security conform to security requirements listed in Section J.H.1 to J.H.3.

All software, hardware, systems and

Contractor staff handling confidential data function properly and are compliant with the requirements of section J.H.1 to J.H.3.

No deviation from the standard is allowed.

Periodic Surveillance

Impact on CPARS review, possible termination for cause.

TECHNICAL EXHIBIT 2

Deliverables Schedule

The following is a list of deliverables and delivery dates. The final delivery dates shall be mutually agreed upon between BLS and the Contractor during the kick-off meeting and shall be included in the Task Management Plan (TMP). Each written deliverable shall first be submitted as a draft and then revised based on BLS feedback. An estimation of 10 business days should be allowed for BLS review and feedback.

CLIN 0001 and Base Period Tasks

Deliverable Frequency # of Copies Medium/Format Submit To

1. Kick off and clarification meeting

Within 10 business days of award.

N/A Teleconference COR and Task

Monitor

2. Task Management Plan and Quality Control Plan

2 weeks after kick-off meeting

1 MSWord COR and Task Monitor via email

3. Meeting notes

Within 2 business days after meeting

1 MSWord COR and Task Monitor via email

4. Monthly Progress Reports

Every Friday during VDE constructions, and by the 5th day of the month for the duration of the base period.

1 MSWord COR and Task Monitor via email

5. VDE

Development and Technical Support Plan Complete

90 days after kick-

N/A N/A COR and Task Monitor

6. Database of BLS agreements and agents

90 days after kick-

N/A N/A COR and Task Monitor

7. Documentation that VDE complies to all applicable security requirements

Proof of compliance due 90 days after kick-off meeting.

Confirmation of continued compliance shall be

1 MSWord COR and Task Monitor

CLIN 0001 and Base Period Tasks including NIST 800-171 included in monthly reports.

8. Presentation of the VDE and BLS agreements and agent’s database

Within 5 days of VDE and Database Completion

N/A N/A COR and Task Monitor

9. Complete updates to the VDE and BL S agreements and agents database

Within 10 days of receiving BLS feedback

N/A N/A COR and Task Monitor

10. VDE Manual Within 5 days of VDE and Database Completion

N/A MS Word COR and Task Monitor

Option Year Tasks

1. Meeting notes

Within 2 business days after meeting

1 MSWord COR and Task Monitor via email

2. Monthly Progress Reports

By 5th day of the month for the duration of each option year.

1 MSWord COR and Task Monitor via email

3. VDE Manual Within one week of updating an internal VDE policy.

1 MS Word COR and Task

Closeout Tasks

1. Submit closeout plan

30 days prior to contract expiration or termination

1 MS Word CO, COR and Task Monitor via email

2. Certify in writing that the return or destruction of data has been completed.

1 week prior to contract completion

1…