RFQ CAFM_FINAL.pdf

RFQ# 9523ZY20-Q-0039

The U.S. Commodity Futures Trading Commission (CFTC) has a requirement for Computer Aided Facility Management (CAFM) system and related services.

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued.

The solicitation number is 9523ZY-20-Q-0039. This solicitation is issued a request for quotation

(RFQ).

The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-06 effective May 6, 2020.

The applicable NAICS code is 541512, and this is a full and open competition. Size standard:

$30 million.

See Section II for a list of contract line item numbers and items, quantities and units of measure, (including options).

See Section I for a description of requirements for the items to be acquired: Computer Aided Facility Management (CAFM) system and related services.

Dates and place of performance: The period of performance is a base period of 12 months and four (4) 12-month options, with the option to extend up to six months in accordance with the OPTION TO EXTEND SERVICES clause. The place of performance (i.e. hosting) shall be at the contractor’s data center facility.

See Section III for the provision 52.212-1, INSTRUCTIONS TO OFFERORS – COMMERCIAL ITEMS and the associated addenda.

See Section III for the description of the Evaluation in lieu of provision FAR 52.212-2, EVALUATION – COMMERCIAL ITEMS.

Quoters shall include a completed copy of the provision FAR 52.212-3, OFFEROR REPRESENTATIONS AND CERTIFICATIONS – COMMERCIAL ITEMS, with its quotation submission in accordance with Section III.

FAR 52.212-4, CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS, is applicable to this solicitation (See Section II).

FAR 52.212-5, CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS – COMMERCIAL ITEMS, is applicable to this solicitation (See Section II).

See Section II for all applicable additional terms and conditions and conditions for this solicitation.

http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/12.htm#P295_49304 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1511_210116 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1525_211968 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P1817_250859 http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/far/52_000.htm#P2017_291667

RFQ# 9523ZY20-Q-0039

Period for acceptance of quotations: The quoter agrees to hold the prices in its quotation firm for 120 calendar days from the date specified for receipt of quotations.

The date, time and place offers are due: Quotations shall be submitted electronically to the Contracting Officer, Christine Park at cpark@cftc.gov no later than July 16, 2020 at 10:00 AM ET (Eastern Time).

The name and telephone number of the individual to contact for information regarding the solicitation: Christine Park at 202-418-6046. Questions are due in writing to cpark@cftc.gov no later than July 2, 2020 at 10:00 AM ET (Eastern Time).

This request for quotation shall not be construed as a commitment of any kind.

Enclosures:

Part I – Statement of Work (SOW) Part II – Additional terms and conditions Part III – Quotation Preparation Instructions/Evaluation Criteria

Attachment A Mandatory Requirements Matrix Attachment B Past Performance Questionnaire Attachment C Non-disclosure of Confidential Information Agreement Attachment D Section 508 VPAT Template

(Rest of page left intentionally blank) mailto:cpark@cftc.gov

RFQ# 9523ZY-20-Q-0039

Part I Statement of Work

"Computer Aided Facility Management System and Services"

1. Background

The Commodity Futures Trading Commission (CFTC) implemented a web-based computer aided facility management (CAFM) system in 2009 to support a major space expansion project as well as ongoing space management activities via a third-party managed hosting provider.

The CFTC is headquartered in Washington, DC and has three regional offices located in Chicago, Kansas City, and New York. The CFTC is currently engaged in developing relocation plans for all four of its sites. This will result in a change in the amount of rentable square footage (RSF) in each location. The Contractor shall load the new space into the CAFM system two to three months prior to the physical relocation of each facility. The current space will then be deactivated one to two months after the physical move. Details of the current and new RSF for each location are as follows:

Location Current RSF and Floors

New RSF and Floors

Load Date of New Space

Washington, DC 288,395 sq. ft.

11 floors

150,000 sq. ft. (estimate) floors TBD January, 2024

Chicago, IL 60,412 sq. ft.

2 floors

35,277 sq. ft.

2 floors December, 2021

Kansas City, MO 16,473 sq. ft.

1 floor

12,451 sq. ft.

1 floor January, 2021

New York, NY 61,510 sq. ft.

3 floors

25,258 sq. ft.

1 floor September, 2021

TOTAL 426,790 sq. ft.

17 floors

222,986 sq. ft.

floors TBD

The CFTC acknowledges the right of both Contractor and Government to seek an equitable adjustment to the contract pricing (i.e., current period and future option periods) if the rentable square footage increases or decreases 10% from the square footage in the above table.

2. Scope

CFTC requires a web-based CAFM system that includes hosting, migration services, system support, data management, and system administration services. In addition, the Contractor shall work with the Contracting Officer's Representative (COR) to troubleshoot issues.

The CAFM system must:

• Provide and maintain accurate and reliable space management information for all facilities, including reporting functionality;

• Provide information to enable the analysis of space and facilities cost effectiveness and efficiency; and

• Provide standardized information to support facilities budget and program requests.

3. CAFM System Requirements

The CAFM system shall provide real-time management and reporting of occupancy, square footage, and space type. The system shall provide secured web access to CFTC's facility information through an easy-to-use graphical interface. The system shall also allow for the import of computer aided design and drafting (CADD) floor plans. The CAFM system shall include any and all transition of the existing space management database to the new CAFM system. The CAFM system shall support at a minimum the list of data fields included in Attachment A, No.1.

The CAFM system shall support real-time processing of all CFTC space management transactions with integrated and robust functionality in each of the following areas:

a. Space Management

Space management is the functional ability of the system to store, organize, sort, retrieve, and report on the entire set of data related to the location, space type, measurements, use, seating capacity, occupants, and amenities associated within a given space in a building.

All information shall be graphically displayed on demand. The CAFM system shall support detailed Building Owners and Managers Association (BOMA) classification of space and organize all spaces in the inventory into an appropriate hierarchy. Space management also must track the organizational tenants of space and calculate space utilization/assignment by internal CFTC organization. The CAFM system shall provide the ability for the user to designate icons to be displayed for specially used space or personnel assignments (e.g., Safety Wardens, AED Responders, Shelter-in-Place locations, and emergency egress routes).

b. CADD Integration

The CADD drawings of CFTC's locations shall be imported into the CAFM system by the Contractor through a user-friendly interface. The CFTC reserves the right to import drawings into the system. Floor plans with or without furniture layouts will be furnished by the CFTC to the Contractor for processing as follows:

i. Layering

Drawings incorporated into the CAFM system shall conform to BOMA layering standards, e.g. electrical, data jacks, lighting, furniture, etc. The CFTC will provide up-to-date computer aided design (CAD) drawings to the Contractor.

ii. Poly-lining

Once appropriately layered, the drawings shall be poly-lined to reflect space that is to be tracked and monitored with the CAFM system. All poly-lining shall follow BOMA standards.

iii. Tagging

Location numbers shall be assigned to individual spaces.

The CAFM system shall also support ongoing modifications to the base drawings. On average, this would occur no more than two times per year.

c. Move Management

Move management is the functional ability to manage the space-related tasks for the move of a single employee or the reorganization of an entire floor. The CAFM system must provide the ability for the user of the system to prepare multiple "what-if” scenarios of potential personnel, office, and non-occupiable space (e.g., file rooms, waiting rooms, conference rooms, etc.) moves and then compare their feasibility and benefits. The CAFM system must be able to execute the selected configuration as well as update the system data. Move management functionality must be able to reserve one or more offices for specific organizations or new individual hires and prevent assigning the reserved space for another use, alerting the user when a requested space has already been reserved/allocated for future use. The CAFM system must provide the ability to create a queue of add/change/delete requests that can be executed at a later time determined by the user.

d. Reporting and Analysis

The CAFM system shall allow for ad-hoc queries as well as scheduled reports. At a minimum, the reporting capabilities of the CAFM system shall include space and occupancy analysis, monitoring, retrieval of historical data, pre-scheduled reporting, and graphical presentations of data and reports.

e. Audit Trail Capabilities

The CAFM system shall support the creation of audit trails to allow for investigation into the source of all data modifications, including additions, changes, and deletions. The logs must be retained for at least 90 days. The logs must be available for collection by CFTC’s log management system (i.e., Splunk via exposed Application Programming Interface (API) or alternate method).

f. Administrative Tools

The CAFM system shall include administrative tools to assign access levels, establish libraries and folders, and monitor system and resource utilization. The system shall permit system audits to determine who has recently used the system and what changes were made. In addition, the CAFM system shall keep a transaction log for recovery purposes. The system must provide full restart capabilities, database access activity logging, and transaction back out capabilities. The CAFM system must also provide adequate data backup to support these recovery activities.

g. Technical Requirements

i. Desktop requirements

The CAFM system shall comply with the following desktop requirements:

• Compatible with Microsoft Edge, Internet Explorer 11, and/or Google Chrome browsers.

• 508 Compliant - this must be demonstrated by supplying a completed Voluntary Product Accessibility Template (VPAT).

• Additional desktop components (e.g., ActiveX controls or Plugins) shall not be required to be installed on the user’s workstation in order for the system to function appropriately.

• Additional software specific configuration or changes to the United States Government Configuration Baseline (USGCB) settings shall not be required for the system to be fully operational.

• The system shall be accessible from CFTC’s facilities and while working remotely. A URL specific to the CFTC shall be provided. All CFTC data shall remain the property of CFTC.

ii. Information Security Requirements

• The Contractor shall have an effective or provisional FedRAMP authorization package OR a submitted provisional FedRAMP authorization request to GSA OR a full authorization package, conducted by a 3rd party, at a FIPS199 moderate impact level in accordance with NIST authorization guidelines. Note: Both the software and hosting environment shall be FedRAMP certified.

• The provided solution shall be Certificated and Accredited following NIST SP

800-37, 800-18, 800-30, 800-60, 800-53 R4, 800-53A, Federal Information Processing Standard (FIPS) 199 and 200 and shall have undergone a Privacy Impact Assessment.

• The Government reserves the right to conduct independent security testing and evaluation, using either Government personnel or an independent contractor.

• The contractor shall provide either the complete publications or a reference to public facilities, such as a website or office, where they may be accessed.

• All provided software products shall be certified by the Contractor to be free of malicious code.

The Contractor shall scan monthly with a vulnerability analysis tool. All

“safe” or “non-destructive” checks must be turned on during the monthly scan. An electronic copy of each report and session data shall be provided to the COR. The Government reserves the right to conduct unannounced and prearranged independent vulnerability scans using Government personnel or another Contractor.

Identified vulnerabilities shall be corrected or mitigated by the Contractor appropriately and in a timely manner as described in Attachment E, CFTC Vulnerability Management Policy.

• At least annually, the Contractor shall arrange for the provided solution to be independently penetration tested. The Contractor shall provide electronic reports of penetration test results to the COR.

• The Contractor shall conduct an annual self-assessment in accordance with NIST SP 800-26 and provide electronic reports of assessment to the COR.

• The Contractor shall store, transport or transmit CFTC sensitive information in an encrypted form, using a CFTC-approved encryption application that meets the requirements of NIST’s FIPS 140-2 standard and is FIPS 140-2 validated.

• A contingency plan compliant with NIST SP 800-34 shall be provided to the COR and tested at a minimum on an annual basis. Electronic reports of the test shall be provided to the COR.

• The CAFM system shall provide security controls to prevent unauthorized use of the database, maintain database process controls, and log all database transactions.

In addition, the CAFM system shall provide security and administrative rights to limit availability to system functionality, software screens, data records, data elements, and documents. The CAFM system shall have integrated security controls to separately assign create, read, update, and delete permissions for users or groups. The CAFM system shall also have the ability to hide certain restricted fields from view for some user groups.

• The Contractor shall perform all services under this task order within the continental United States. All services and CFTC data shall reside within the continental United States.

• The Contractor shall meet CFTC authentication requirements, including multifactor authentication and compliant with HSPD-12 mandate requirements and NIST SP 800-63 for remote access. The solution for multifactor authentication and HSPD-12 shall not be solely reliant on the CFTC having implemented Active Directory Federation Services (ADFS)/Security Assertion Markup Language (SAML).

• A CFTC-approved logon banner shall be displayed on the first page of any public access web page provided.

• The Contractor shall maintain backups for a minimum and maximum of 6 months.

• The Contractor shall maintain availability of the service during CFTC primary business hours of 6:00 a.m. and 8:00 p.m. Eastern Time Monday through Friday.

• The Contractor shall employ a continuous monitoring strategy to monitor the system.

h. System Privacy

i. Privacy Controls

• The CAFM system shall provide privacy controls to ensure compliance with applicable privacy requirements and to manage the risks to individuals associated with the system’s creation, collection, use, processing, dissemination, storage, maintenance, disclosure, or disposal (collectively referred to as “processing”) of personally identifiable information (PII). This includes providing adequate protection of user information, using a least privilege model for access to PII, completing a privacy impact assessment, and providing appropriate notice to users regarding the processing of PII.

• Contractors, including system development and support staff, will be required to ensure ongoing compliance with the privacy control requirements included in the current version of NIST SP 800-53.

ii. Breach Reporting

• Contractors shall report computer security incidents affecting CFTC data and systems or a breach of personally identifiable information, as defined in OMB Memorandum M-17-12, to CFTC staff in accordance with the National Cybersecurity and Communications Integration Center’s (NCCIC) / United States Computer Emergency Readiness Team (US-CERT) Federal Incident Response Guidelines and CFTC’s policy on “Responding to Incidents Involving CFTC Confidential Information.”

i. Data Import/Export

The CAFM system shall permit easy import and export of data and reports to and from desktop and server applications including, but not limited to, Microsoft Excel, Microsoft Access, query and reporting tools, Adobe PDF, etc. All access to the CAFM system shall be through an HTTP/SSL connection. In addition, the CAFM system shall provide edit controls and drop down menus to prevent incomplete or incorrect data from being processed. It must also have the ability to prevent users from overriding or bypassing data validation and editing routines.

4. Implementation

Implementation of the CAFM system, including verification of all security and technical requirements, the upload of CADD drawings, and all data migration must be completed within 45 days of award. The Contractor shall meet with the COR, representatives from CFTC's Facilities and Operational Services Section (FOS), and representatives from CFTC's Office of Data & Technology (ODT) within five (5) business days after the contract is awarded. The purpose of this meeting will be to obtain an understanding of CFTC-specific space standards. The Contractor shall work with the COR throughout the implementation process to allow for the identification of any issues prior to the completion of implementation.

Within 15 days of award, the Contractor shall provide an implementation plan that includes details of the components to be installed/configured and their technical approach to the implementation. In addition, the implementation plan shall identify any technical requirements and/or support required from the CFTC to complete the implementation.

The Contractor shall develop training material simultaneously with implementation activities so that the CFTC can use the material in its user acceptance testing.

The Contractor shall implement a CAFM website and database configured to correspond to the CFTC's requirements. The website shall reside at a specific URL to be approved by the CFTC. The Contractor shall configure the underlying database to make available all appropriate functionality for the CFTC.

CADD drawings of CFTC's locations shall be imported into the CAFM system by the Contractor. Floor plans with furniture layouts will be furnished by the CFTC for processing as described in Section 3.b, CADD Integration.

The existing system will be used to provide a spreadsheet/database containing all space and employee information with appropriate designations and attributes. The exact format of the export file will be jointly determined by the CFTC and the Contractor. The data shall be provided via a spreadsheet/database through a secure and encrypted manner. During the data migration, the final data fields will be determined, however, current CFTC data fields include buildings, floors, rooms, and user information. This contract does not require the development of custom software code.

Deliverables:

a. Implementation documentation

Within 30 business days of the implementation, the Contractor shall provide a document that details the implementation. At a minimum, the document must include the following:

i. Functional/reporting methods

ii. Existing CFTC standards/procedures

iii. System usage procedures

iv. Information technology/system integration

v. Change management procedures

b. Training

Within 5 business days after implementation, the Contractor shall provide eight 1-hour training sessions (over the course of two days in 4-hour blocks). This training shall be conducted virtually via Webex. Users of CAFM will sign up for a 1-hour block of time in order to get familiarized with the new system. The Contractor shall provide the CFTC with an electronic version of a user manual no later than one week before training begins.

5. Maintenance and System Support

a. User Permissions/Security Configuration

The CAFM system shall support 25 users, with twelve (12) being concurrent users* and shall also support varying degrees of permissions associated with categories of users. The permissions shall range from limiting access to various functions and data to assigning the level of interactivity by the user, i.e. from read-only to full read-write-add-modify-delete access. The permission levels required are (1) read-only access, (2) read-write access, and (3) read-write access with administrative rights. Special permissions are required to maintain the confidentiality of move scenarios, i.e. not all users with access to Move Management functionality shall have read or write access to the move scenarios.

*The term "concurrent users" is defined as the number of simultaneous connections to the CAFM System for all permission levels.

b. System Performance

Most users of the system will require access during the hours of 6:00 a.m. and 8:00 p.m.

(Eastern Time) Monday through Friday. Occasional weekend and evening access may also be required. The Contractor must notify the COR when the system will be unavailable and/or system performance/response time will be severely degraded due to other concurrent processes, such as scheduled processes or system backups.

In addition, technical support shall be provided from 7:00 a.m. to 6:00 p.m. Eastern Time Monday through Friday, except days the CFTC is closed (e.g., Federal holidays and weekends). The Contractor shall resolve reported problems within two (2) work days.

The CFTC requires service availability of 99.86%.

c. Software and Hardware Support

The Contractor shall:

• Ensure new software releases are deployed within 45 days after the official release of the software. This includes major and minor software releases, service packs, upgrades, patches, and fixes.

• Monitor the physical server(s) within which the CAFM system instance resides, as well as the CAFM system. This includes checking the system and server availability at regular intervals.

• Deploy, upgrade, and maintain the system and database servers. Deployments, server maintenance, and upgrades shall be scheduled during off hours. Major version upgrades shall be scheduled during non-business hours with a minimum of one week's advance notice to the CFTC.

d. Backup and Restoration

The Contractor shall schedule, perform, monitor, and maintain CAFM data for backup.

The Contractor shall backup all files and database content on each server in the hosting configuration. Backups shall be scheduled at non-peak hours each day of a predetermined window acceptable to the Contractor and the COR.

The Contractor shall support data recovery due to physical damage to the storage device or logical damage to the file system that prevents it from being accessed by the host operating system. The Contractor shall support the data recovery process to salvage data from damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. The Contractor shall restore data from the most recently archived copies or such earlier copies as requested by the COR through a written request with all information necessary to perform such restoration.

e. Monitoring and Response

The Contractor shall monitor the performance and availability of the hosted CAFM system. Monitoring shall include all applicable ports (HTTP, HTTPS, SMTP, etc.) for service availability. The Contractor shall also monitor the network to determine network availability and backup success/failure.

The Contractor shall monitor network alerts and COR-initiated trouble tickets. When alerted of a potentially critical problem by any of the monitoring systems, the Contractor shall begin troubleshooting the problem and shall initiate contact with the COR via support ticket, telephone call, or both depending upon the severity of the situation.

f. Contractor Support

The CFTC requires up to twenty hours of Contractor support each contract year. This support will be used for consultation on system operations such as report design, data management, loading new buildings/floors, deactivating inactive floors, etc.

(Rest of page intentionally left blank)

(End of Part I)

Part II

ADDITIONAL TERMS AND CONDITIONS

1. CONTRACT PRICING – FIRM FIXED PRICE CONTRACT

This is a firm-fixed price contract. The total firm-fixed-price is $____________.

2. DESCRIPTION OF SUPPLIES/SERVICES

CLIN/Description QTY UNIT UNIT

PRICE

TOTAL FUNDED

AMOUNT

0001: Implementation 1 EA $ $ 0002: Training (8 one hr sessions)

1 EA $ $

0003: Maintenance (includes up to 20 hours of support)

11 MO $ $

Total – Base year $ $ 1001: Maintenance (includes up to 20 hours of support)

12 MO $ $

Total – Option 1 $ $ 2001: Maintenance (includes up to 20 hours of support)

12 MO $ $

Total – Option 2 $ $ 3001: Maintenance (includes up to 20 hours of support)

12 MO $ $

Total – Option3 $ $ 4001: Maintenance (includes up to 20 hours of support)

12 MO $ $

Total – Option 4 $ $ Total Contract Value $ $

3. PERIOD OF PERFORMANCE

The base period of performance for CLINs 0001 thru 0003 of this contract is 09/28/2020 through 09/27/2021, with four 12 month option periods, and an option to extend up to six months in accordance with the OPTION TO EXTEND SERVICES clause below. The period of performance of the Options, if exercised, are as follows:

CLIN 1001 of this contract is 09/28/2021 through 09/27/2022.

CLIN 2001 of this contract is 09/28/2022 through 09/27/2023.

CLIN 3001 of this contract is 09/28/2023 through 09/27/2024.

CLIN 4001 of this contract is 09/28/2024 through 09/27/2025.

4. 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days prior to contract expiration; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five (5) years.

5. OPTION TO EXTEND SERVICES (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days of the end of the period of performance.

6. CONTRACTING OFFICER

Christine Park Commodity Futures Trading Commission 1155 21st Street, NW Washington, DC 20581 Phone: (202) 418-6046 E-Mail: cpark@cftc.gov

7. CONTRACTING OFFICER’S REPRESENTATIVE

The Government’s Contracting Officer’s Representative (COR) is:

To be identified at the time of contract award.

The Contracting Officer may also designate an Alternate COR contract. The Alternate COR, if designated, will be authorized to perform the COR responsibilities described in this contract in instances where the COR is not available.

8. TECHNICAL DIRECTION AND SURVEILLANCE

(a) Performance of work under this contract shall be subject to the surveillance and written technical direction of the COR. The term “technical direction” is defined to include:

(1) Directions to the contractor that provide clarification of the requirements described in the Statement of Work.

(2) Inspection and acceptance of deliverables completed by the contractor under this contract.

(b) The COR does not have authority to, and may not, issue any technical direction which:

(1) Assigns additional work outside the scope of work for the contract;

(2) Constitutes a change as defined in the contract clause(s) that address “changes”;

(3) In any manner causes an increase or decrease in the contract price or the time required for performance;

(4) Changes any of the expressed terms, conditions or specifications of the contract; or

(5) Interferes with the contractor’s right to perform the terms and conditions of the contract.

(c) All technical direction shall be issued in writing by the COR. The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed in this clause and within his/her authority under the provisions of this clause. If, in the opinion of the contractor, any instruction or direction by the COR would increase or decrease the cost of the contract or result in work outside the scope of this contract, the contractor shall not proceed but shall immediately notify the Contracting Officer in writing. It is anticipated that within 30 days of receiving the notification from the contractor, the Contracting Officer will either issue an appropriate contract modification or advise the contractor in writing that:

(1) The technical direction is rescinded in its entirety;

(2) The technical direction is within the scope of the contract, does not constitute a change as defined in the contract clause(s) that address “changes” and that the contractor should continue with the performance of the technical direction.

(d) A failure of the contractor and Contracting Officer to agree that the technical direction is within scope of the contract, or a failure to agree upon the contract action to be taken with respect thereto, shall be subject to the provisions of the “Disputes” clause of the contract.

(e) Any action(s) taken by the contractor in response to any direction given by any person other than the Contracting Officer or the COR whom the Contracting Officer shall appoint shall be at the contractor’s risk.

9. ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS – iSupplier

The requirements of the Prompt Payment Act, P.L. 97-177, as reflected in the clauses incorporated into the contract (e.g., FAR clauses 52.232-25, Prompt Payment, and 52.212-4, Contract Terms and Conditions--Commercial Items) apply to this contract.

Payment requests (i.e., invoices) shall be submitted electronically through the Delphi eInvoicing system via Login.gov on a monthly basis for processing and payment. The CFTC’s Delphi eInvoicing system is managed by the Department of Transportation’s Enterprise Services Center

(ESC).

Invoices shall include sufficient detail to identify the contract CLIN(s) for which the request for payment is being made. The contractor shall also complete the “Period of Performance Begin” and “Period of Performance End” fields when submitting an invoice through the eInvoicing system, corresponding to the period of performance of the submitted invoice.

Upon contract award, the contractor shall provide an invoicing point of contact to the Contracting Officer as follows:

• First and Last Name

• Email Address (not a centralized email address)

• Phone Number

The contractor shall notify the Contracting Officer of changes to the above information within ten (10) days after the change.

The contractor shall access the eInvoicing System using the following link:

http://einvoice.esc.gov/

If the contractor requires assistance with the eInvoicing system, they may contact the ESC help desk:

ESC Help Desk for the Delphi eInvoicing System

• Business Hours: 8:00am to 7:00pm

• 1-866-641-3500

10. PLACE OF PERFORMANCE

Hosting shall be at the contractor’s data center facility.

11. LIABILITY

The Contractor shall be responsible for all liabilities which result from willful misconduct, gross negligence, or lack of good faith on the part of any of its officers and employees. Such liability is not restricted by any dollar limitations.

https://login.gov/ http://einvoice.esc.gov/

12. GOVERNMENT RIGHTS IN SOFTWARE AND DATA

The Government shall have unrestricted rights in all computer software, documentation, and other data developed and created by the Contractor under this contract specifically for CFTC, as described in FAR Clause 52.227-17, Rights in Data – Special Works (Dec 2007), which is incorporated herein by reference.

13. GOVERNMENT FURNISHED INFORMATION

CFTC will provide all data necessary to populate and configure the CAFM system at the contractor’s site. Government furnished data shall be returned to the Government upon conclusion of the contract or as otherwise specified by the CFTC. Government-furnished data shall only be used in connection with this contract.

14. PRIVACY ACT COMPLIANCE

The contractor and contractor personnel shall store, use, maintain, share and dispose of personally identifying information it receives under this contract in accordance with the Privacy Act of 1974 (5 USC §552a) and its implementing Federal regulations.

15. COMPLIANCE WITH THE REHABILITATION ACT OF 1973

All electronic and information technology (“EIT”) (i.e., services) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194, unless an agency exception to this requirement exists. 36 CFR 1194 implements Section 508 of The Rehabilitation Act of 1973, as amended (29 U.S.C. 794d). In the event that the contractor’s work does not meet such standards, and the defect is brought to the contractor’s attention no later than one year after the date of final payment under this contract, the contractor will be responsible for correcting the work at no cost to the Government.

16. COMMERCIAL SUPPLIER AGREEMENTS – UNENFORCEABLE CLAUSES

(a) “Commercial supplier agreements” means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of “commercial item” set forth in FAR 2.101 and intended to create a binding legal obligation on the end user.

Commercial supplier agreements are particularly common in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data, but they may apply to any supply or service. The following terms apply–

(1) Regardless of the format or style of the document. For example, a commercial supplier agreement may be styled as standard terms of sale or lease, Terms of Service (TOS), End User License Agreement (EULA), Subscription Agreement, governing terms or another similar legal instrument or agreement, and may be presented as part of a proposal or quotation responding to a solicitation for a contract or order;

(2) Regardless of the media or delivery mechanism used. For example, a commercial supplier agreement may be presented as one or more paper documents or may appear on a computer or other electronic device screen during a purchase, software installation, other product delivery, registration for a service, or another transaction.

(b) When any supply or service acquired under this contract is subject to a commercial supplier agreement, the following language shall be deemed incorporated into the commercial supplier agreement. As used herein, “this agreement” means the commercial supplier agreement:

(1) Notwithstanding any other provision of this agreement, the following shall apply:

(i) Applicability. This agreement is a part of a contract between the commercial supplier and the CFTC for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including, but not limited to, all contracts, task orders, and delivery orders under FAR Part 12).

(ii) End user. This agreement shall bind the CFTC as end user but shall not operate to bind a CFTC employee or person acting on behalf of the CFTC in his or her personal capacity.

(iii) Law and disputes. This agreement is governed by Federal law.

(A) Any language purporting to subject the CFTC to the laws of a U.S. state, U.S. territory, district, or municipality, or a foreign nation, except where Federal law expressly provides for the application of such laws, is hereby deleted.

(B) Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted.

(C) Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

(iv) Continued performance. The supplier or licensor shall not unilaterally revoke, terminate or suspend any rights granted to the CFTC except as allowed by this contract. If the supplier or licensor believes the CFTC to be in breach of the agreement, it shall pursue its rights under the Contract Disputes Act or other applicable Federal statute while continuing performance.

(v) Disputes. This contract is subject 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(vi) Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, a binding arbitration shall not be used, and equitable or injunctive relief, including the award of attorney fees, costs or interest, may be awarded against the CFTC only when explicitly provided by statute (e.g., Prompt Payment Act or Equal Access to Justice Act).

(vii) Updating terms.

(A) After award, the contractor may unilaterally revise commercial supplier agreement terms if they are not material. A material change is defined as:

(I) Terms that change CFTC rights or obligations;

(II) Terms that increase CFTC prices;

(III) Terms that decrease overall level of service; or

(IV) Terms that limit any other CFTC right addressed elsewhere in this contract.

(B) For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be incorporated into the contract using a bilateral modification.

(C) Any agreement terms or conditions unilaterally revised subsequent to award that are inconsistent with any material term or provision of this contract shall not be enforceable against the CFTC, and the CFTC shall not be deemed to have consented to them.

(viii) No automatic renewals. If any license or service tied to periodic payment is provided under this agreement (e.g., annual software maintenance or annual lease term), such license or service shall not renew automatically upon expiration of its current term without prior express consent by an authorized CFTC representative.

(ix) Indemnification and Unauthorized Obligations.

(A) When any supply or service acquired under this contract is subject to any commercial supplier agreement that includes any language, provision, or clause requiring the Government to directly or indirectly indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability or similar that would or reasonably could create an Anti- Deficiency Act violation (31 U.S.C. 1341), any such language, provision, or clause is unenforceable against the Government, and will be treated as if those terms were deleted and do not otherwise exist.

(B) Any clause of this agreement requiring the commercial supplier or licensor to defend or indemnify the end user is hereby amended to provide that the CFTC and/or the U.S. Department of Justice has the sole right to represent the United States in any such action, in accordance with 28 U.S.C. 516.

(x) Audits. Any clause of this agreement permitting the commercial supplier or licensor to audit the end user’s compliance with this agreement is hereby amended as follows:

(A) Discrepancies found in an audit may result in a charge by the commercial supplier or licensor to the CFTC. Any resulting invoice must comply with the proper invoicing requirements specified in the underlying CFTC contract or order.

(B) This charge, if disputed by the CFTC, will be resolved in accordance with subparagraph (v) (Disputes); no payment obligation shall arise on the part of the CFTC until the conclusion of the dispute process.

(C) Any audit requested by the contractor will be performed at the contractor's expense, without reimbursement by the CFTC.

(D) Any contractor requesting a right to audit CFTC’s end user compliance must provide CFTC 30 days prior written notice before being permitted to conduct any on-site audit.

(xi) Taxes or surcharges. Any taxes or surcharges which the commercial supplier or licensor seeks to pass along to the CFTC as end user will be governed by the terms of the underlying CFTC contract or order and, in any event, must be submitted to the Contracting Officer for a determination of applicability prior to invoicing unless specifically agreed to otherwise in the CFTC contract.

(xii) Non-assignment. This agreement may not be assigned, nor may any rights or obligations thereunder be delegated, without the CFTC’s prior approval, except as expressly permitted under the clause at FAR 52.212-4, Contract Terms and Conditions-Commercial Items, which is incorporated herein by reference.

Confidential information. If this agreement includes a confidentiality clause, such clause is hereby removed. Issues regarding release of “unit pricing” will be resolved consistent with the Freedom of Information Act.

17. INSPECTION AND ACCEPTANCE

Inspection and acceptance of items delivered under this contract shall be performed by the COR.

Delivery of any and all items under this contract shall be shipped F.O.B. destination to the Contracting Officer’s Representative identified under Part II, Additional Terms and Conditions, number 7 of this solicitation.

18. ORGANIZATIONAL CONFLICTS OF INTEREST (OCI)

(a) The contractor warrants that to the best of its knowledge and belief, and except as otherwise disclosed, it does not have any organizational conflict of interest, which is defined in FAR Subpart 9.5 as a situation in which the nature of work under a Government contract and a contractor’s organizational, financial, contractual or other interests are such that:

1. Award of the contract may result in an unfair competitive advantage; or

2. The contractor’s objectivity in performing the contract work is or might be otherwise may be impaired.

(b) The contractor agrees that if after award it discovers an organizational conflict of interest with respect to this contract, it shall make an immediate and full disclosure in writing to the Contracting Officer, which shall include a description of the action(s) that the contractor has taken or intends to take to mitigate, eliminate, or neutralize the conflict.

(c) The provisions of this clause shall be included in all subcontracts and consulting agreements wherein the work to be performed is similar to the service provided by the prime contractor under this contract. The contractor shall include in such subcontracts and consulting agreements any necessary provisions to mitigate, eliminate, or neutralize organizational conflicts of interest.

(d) The Contracting Officer has determined, however, that the nature of the work to be performed under this contract may give rise to potential perceived or actual organizational conflicts of interest in future CFTC contracts. Accordingly, the contractor and CFTC have agreed to the following conditions:

1. The contractor shall not be required to develop specifications or statements of work that are to be incorporated into any CFTC solicitation; and

2. The contractor shall not be provided any Government cost estimates, source-selection information, or third-party proprietary technical or cost data.

(e) Additionally, the contractor understands that for any related follow-on contract, it may be required to provide a statement which describes concisely all relevant facts concerning any past, present or planned interest (financial, contractual, organizational, or otherwise) relating to the work to be performed under the proposed contract and bearing on whether the quoter has a possible organizational conflict of interest with respect to:

1. Being able to render impartial and objective assistance or advice; or

2. Being given an unfair competitive advantage. The quoter may also provide relevant facts that show how its organizational structure and/or management systems limit its knowledge of possible organizational conflicts of interest relating to other divisions or sections of the organization and how that structure or system would avoid or mitigate such actual or perceived organizational conflict.

The contractor understands that no award shall be made until any potential conflict of interest has been neutralized or mitigated to the satisfaction of the Contracting Officer, or unless a waiver has been granted.

19. COMMON SECURITY CONFIGURATIONS

(a) The data access system must fully comply with CFTC’s existing Windows based Directory Services (Lightweight Directory Access Protocol, Active Directory) to support user access. Other government standards that apply include OMB Circular A-130, Federal Information Security Management Act (FISMA), NIST Special Publication 800 Series, including NIST SP 800-53 rev. 4, the Privacy Act of 1974 as amended, and the Freedom of Information Act as amended. The software must contain security controls based on industry best practices.

(b) The contractor will certify that the system is fully functional and operates correctly as intended on systems using the United States Government Configuration Baseline (USGCB) for Windows 7. For the Windows 7 settings see:

http://www.microsoft.com/industry/government/solutions/usgcb/default.aspx

(c) The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology should also use the Windows Installer Service for installation to the default “program files” directory and should be able to install and uninstall.

(d) The Commodity Futures Trading Commission reserves the right to test all delivered information technology to verify the contractor’s certification required in paragraph (a) above.

In the event the information technology does not meet the requirements of this clause, and the defect is brought to the Contractor’s attention no later than one year after the date of final payment under this contract, the Contractor shall correct the defect at no cost to the Government.

20. NON-DISCLOSURE OF CONFIDENTIAL INFORMATION

(a) As used in this clause, “confidential information” means information obtained during performance of the contract that is private or confidential in nature, and which is not meant for public disclosure. Examples of “confidential information” include, but are not limited to, investigatory materials, sensitive or proprietary procurement, business, technical, financial or personally identifiable information (PII) belonging to the Government, other companies or individuals in paper or electronic form, including but not limited to home addresses or personal contact information, full or partial social security numbers, credit card numbers, date of birth, passport numbers, employee performance or evaluation information, or any information related to a security adjudication of any CFTC employee or contractor.

(b) Procurement confidential information may be disclosed only to CFTC and contractor personnel directly concerned with the performance of the contract and who have a need to know such information to perform their assigned duties. It may be disclosed to no other parties, including CFTC and contractor personnel that do not have a need to know, and any and all other http://www.microsoft.com/industry/government/solutions/usgcb/default.aspx non-CFTC parties. Procurement confidential information includes but is not limited to information contained on CFTC requisitions and the documents attached thereto; Independent Government Cost Estimates and budgets pertaining to acquisitions and existing CFTC contracts;

the content of existing CFTC contracts, whether derived directly from the contract itself or from other sources; contractor bid and quotation information, including technical and cost/price information; the number of bids or quotations received in response to solicitations; the content of CFTC Technical Evaluation Plans and Source Selection Plans; technical and cost or price evaluations of quotations; competitive range and phase 2 determinations; ranking of bids, quotations or competitors; reports and evaluations of source selection panels, boards, and advisory councils; and other information marked “Source Selection Information.”

(c) Pursuant to the Commodity Exchange Act, as amended (7 U.S.C. § 1, et. seq.), other laws and the terms and conditions of this contract, the contractor agrees to use confidential information only for the purposes of performing work under this contract, and to otherwise hold such information confidential.