RFQ-FRTIB1-25-Q-0003-Final.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

CODE 16. ADMINISTERED BYCODE

X

X

541519

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROCFO_ACQ_MGT_DIV ISS

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

12/02/2024 1200 ET

11/08/2024

Ronald Rheinhardt (No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

FRTIB1-25-Q-0003

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 5 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

15. DELIVER TO

Washington DC DC 20002 Suite 1000 77 K Street NE

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$34

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULE

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

FRTIB

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

FRTIB/TSP Brand Monitoring and Enforcement

Period of Performance: 01/01/2025 to 12/31/2029

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

Ronald Rheinhardt

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

5 2 of

B. CONTINUATION OF SF-1449 (per FAR 12.303 format).

B.1 This document consists of the following sections:

SECTION DESCRIPTION

A Standard Form 1449

B Continuation of the SF-1449

C Contract Clauses

D Solicitation Provisions

-Evaluation Factors for Award

-Instructions to Offeror(s)

E Attachment A-Statement of Work

Attachment B-Pricing Schedule

Attachment C- Software Attestation Form

[End of text]

SECTION B - CONTINUATION OF BLOCK 18a.

Award Type: As a result of this solicitation FRTIB1-25-Q-0003, a Firm-Fixed Price, Single Award Contract is being awarded.

B.1 Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (January

2019)

Payment request must be submitted electronically through the U.S. Department of Treasury’s Invoice

Processing Platform (IPP) system using the “Bill to Agency” of Interior Business Center – FMD.

“Payment request” means any request for contract financing payment or invoice payment by the Contractor.

Any changes to submitted invoice (short-pay or withhold) will require resubmission of invoice with revised amount. To constitute a proper invoice, the payment request must comply with the requirements identified in the applicable Prompt Payment clause included in the contract, or the clause 52.212-4 Contract Terms and

Conditions – Commercial Items include in commercial item contracts. The IPP website address is:

https://www.ipp.gov.

The Contractor must use the IPP website to register, access and use IPP for submitting requests for payment.

The Contractor must attach invoices in IPP. The Contractor Government Business Point of Contact (as listed in SAM) will receive enrollment instructions via email from the Federal Reserve prior to the contract award date, but no more than 3 – 5 business days of the contract award date.

Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email

IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973 – 3131.

If the Contractor is unable to comply with the requirements to use IPP for submitting invoices for payment, the Contractor must submit a waiver request in writing to the Contracting Officer with its proposal or quotation.

(End of Clause) https://www.ipp.gov/

SECTION C - CONTRACT CLAUSES

52.217-7 Option For Increased Quantity-Separately Priced Line Item (MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

(End of clause)

52.217-8 Option To Extend Services. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

52.217-9 Option To Extend the Term of the Contract. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years (5 years 6 months)

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—

Commercial Products and Commercial Services. (Feb 2024)

FAR 52.212-5 Clauses incorporated by reference:

52.203-6 Restrictions on Subcontractor Sales to the Government. (Jun 2020)

52.203-17 Contractor Employee Whistleblower Rights and Requirement To Inform Employees of Whistleblower Rights. (Nov 2023)

52.204-14 Service Contract Reporting Requirements. (Oct 2016)

52.204-7 System of Award Management (Oct 2018)

52.204-13 System of Award Management Maintenance (Oct 2018)

52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or

Provided by Kaspersky Lab and Other Covered Entities. (Nov 2021)

52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance

Services or Equipment. (Nov 2021)

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance

Services or Equipment. (Nov 2021)

52.204-26 Covered Telecommunications Equipment or Services-Representation. (Oct 2020)

52.204-27 Prohibition on a ByteDance Covered Application (Jun 2023)

52.209-6 Protecting the Government-Interest When Subcontracting with Contractors

Debarred, Suspended, or Proposed for Debarment. (Nov 2021)

52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters. (Oct

2018)

52.222-3 Convict Labor. (Jun 2003)

52.222-19 Child Labor-Cooperation with Authorities and Remedies. (Feb 2024)

52.222-21 Prohibition of Segregated Facilities. (April 2015)

52.222-26 Equal Opportunity. (Sept 2016)

52.222-36 Equal Opportunity for Workers with Disabilities (JUN 2020)

52.222-40 Notification of Employee Rights Under the National Labor Relations

Act (DEC 2010)

52.222-50 Combating Trafficking in Persons (NOV 2021)

52.224-3 Privacy Training (Jan 2017)

52.225-13 Restrictions on Certain Foreign Purchases

52.223-18 Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020)

52.222-35 Equal Opportunity for Veterans (JUN 2020)

52.222-37 Employment Reports on Veterans (JUN 2020)

52.222-54 Employment Eligibility Verification (MAY 2022)

52.232-39 Unenforceability of Unauthorized Obligations (June 2013)

Software Attestation

In accordance with 44 U.S.C. § 3554, Executive Order (E.O) 14028, “Improving the Nation’s Cybersecurity,” and OMB Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain through Secure

Software Development Practices,” as amended by OMB Memorandum M-23-16 “Update to Memorandum

M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development

Practices”, Federal Agencies are required to collect secure software development attestations from software producers affirming their software follows the NIST Secure Software Development Framework (SSDF), SP

800-218.

All vendors submitting proposals, or the software producers (where applicable) shall comply with M-22-18 and M-23-16. Software producers shall submit the attestation and necessary artifacts on https://softwaresecurity.cisa.gov and notify the Contractor Officer after doing so. Alternatively, software producers may also complete and submit the attached attestation form titled “Self-Attestation-Common-https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title44-chapter35-subchapter2&edition=prelim https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2022%2F09%2FM-22-18.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM5nHLZIK%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484388988040%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KwXSxqH63KJXceatanm4LWnPD%2B%2BlxEhf3%2Bb7KYfR8eA%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2022%2F09%2FM-22-18.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM5nHLZIK%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484388988040%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KwXSxqH63KJXceatanm4LWnPD%2B%2BlxEhf3%2Bb7KYfR8eA%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.whitehouse.gov%2Fwp-content%2Fuploads%2F2023%2F06%2FM-23-16-Update-to-M-22-18-Enhancing-Software-Security.pdf__%3B!!FJ-Y8qCqXTj2!c83bpUFOXwP-wfOdo5pTlbfIduu4WoUElyDmJ_VSGdqOekEKx1BZF1OEs7JqFCqrJxor0JvOBgSlcgJXCqtMM9mAzxGZ%24&data=05%7C02%7CSheri.Brooks%40frtib.gov%7Ca84b41230e2744af0cb408dcac1c3696%7C3f6323b7e3fd4f35b43d1a7afae5910d%7C0%7C0%7C638574484389006444%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=xGRm0vR8RVyVmjOxyWQaJ6p%2FWbnExPGNce4mgdmBRkk%3D&reserved=0 https://softwaresecurity.cisa.gov/

Form-03082024-FINAL-FRTIB-Fillable” along with a valid 3PAO assessment report (if applicable) to the

Contracting Officer.

Any software vendor found not compliant with the above requirement may be determined not eligible for award.

FRTIB Contract Provisions and Clauses

H.1 Safeguarding Controlled Unclassified Information (CUI) (JULY 2020)

(a) Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Covered contractor information system” means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits Controlled Unclassified Information.

“Controlled Unclassified Information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of FRTIB in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Technical information” means technical data or computer software, as those terms are defined in this clause--Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

“Technical data” means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information.

(b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections:

(1) For covered contractor information systems that are part of, and Information Technology (IT) service or system operated on behalf of the Government, the following security requirements apply:

(i) Cloud computing services shall be subject to the security requirements specified in the Cloud

Computing Services clause of this contract.

(ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract.

(2) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply:

(i) Except as provided in paragraph (b)(2)(ii) of this clause, the covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal

Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

(ii)(A) The Contractor shall notify the FRTIB Chief Information Security Officer (CISO), via email, within

30 days of contract award of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award.

(B) The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting

Officer, for consideration by the FRTIB Chief Technology Officer (CTO) or CISO. The Contractor need not implement any security requirement adjudicated by an authorized representative of the FRTIB CTO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place. FRTIB acknowledges its understanding and acceptance of the variance that at the time of the execution of this contract the Contractor does not provide insider threat training but will use good faith efforts to put such training in place.

(C) If the FRTIB CTO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when requesting its recognition under this contract.

(D) If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the

Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline

(https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in the clause for Cyber Incident Reporting, including malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

(3) Apply other information systems security measures when the Contractor reasonably determines that information systems security measures. These measures may be addressed in a system security plan.

(c) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place.

(d) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(e) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(f) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified

Information, including subcontracts for commercial items, without alteration, except to identify the parties.

The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(ii)(B) of this clause. (End of Clause)

H.2 Compliance with Controls for Safeguarding Controlled Unclassified Information (CUI) (JULY

2020)

(a) Definitions. As used in this provision—

“Controlled Unclassified Information (CUI),” “covered contractor information system,” “cyber incident,”

“information system,” and “technical information” are defined in clause H.1, Safeguarding Controlled

Unclassified Information (CUI) and H.6, Cyber Incident Reporting.

(b) The security requirements required by contract clause H.2, Safeguarding Controlled Unclassified

Information (CUI) and Cyber Incident Reporting, shall be implemented for all Controlled Unclassified

Information (CUI) on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology service or system operated on behalf of the Government (see (b)(2) of clause H.1, Safeguarding Controlled

Unclassified Information (CUI) and H.6 - Cyber Incident Reporting.

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171

“Protecting Controlled Unclassified Information (CUI) in Nonfederal Information Systems and

Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) that are in effect at the time the solicitation is issued or as authorized by the contracting officer.

(2) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that are in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the CISO, a written explanation of —

(i) Why a particular security requirement is not applicable; or

(ii) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(3) An authorized representative of the FRTIB CISO or Security Division will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract. (End of Clause)

H.3 Representation of Use of Cloud Computing

(a) Definition. “Cloud computing,” as used in this provision, means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

(c) The Offeror shall indicate by checking the appropriate blank in paragraph (c) of this provision whether the use of cloud computing is anticipated under the resultant contract.

(d) Representation. The Offeror represents that it—

_____ Does anticipate that cloud computing services will be used in the performance of any contract or subcontract resulting from this solicitation.

_____ Does not anticipate that cloud computing services will be used in the performance of any contract or subcontract resulting from this solicitation.

(End Clause)

H.3 Federal Information Security Modernization Act (FISMA) Compliance (JULY 2020)

(a) Contractor shall implement security requirements specified by the Federal Information Security

Modernization Act (FISMA) for the relevant covered contractor information systems. Contractor shall implement controls from NIST Special Publication 800-53 Rev. 4 and any subsequent updates as recommended for the [select: low, medium, high] security categorization and in accordance with all FRTIB

FISMA Baseline Policies, and the agency’s implementation of the NIST Risk Management Framework.

Deviations from the agency’s FISMA policies must be approved by the CISO and an Authority to Operate must be maintained on an ongoing basis.

(b) The contractor shall provide access to the Contractor’s facilities, personnel and information system documentation for the purposes of audit or inspection by an authorized regulator or designated security certification activity to ensure appropriate information security practices are in place. (End of Clause)

H.4 Cloud Computing Services (JULY 2020)

(a) Definitions. As used in this clause—

“Authorizing official,” means the senior Federal official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations

(including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

“Cloud computing” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Government data” means any information, document, media, or machine-readable material regardless of physical form or characteristics, which is created or obtained by the Government in the course of official

Government business.

“Government-related data” means any information, document, media, or machine-readable material regardless of physical form or characteristics that is created or obtained by a contractor through the storage, processing, or communication of Government data. This does not include contractor’s business records e.g., financial records, legal records etc. or data such as operating procedures, software coding or algorithms that are not uniquely applied to the Government data.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

“Spillage” security incident that results in the transfer of classified or controlled unclassified information onto an information system not accredited (i.e., authorized) for the appropriate security level.

(b) Cloud computing security requirements. The requirements of this clause are applicable when using cloud computing to provide information technology services in the performance of the contract.

(1) If the Contractor indicated in its offer that it “does not anticipate the use of cloud computing services in the performance of a resultant contract,” in response to provision H No. H.3__, Representation of Use of

Cloud Computing, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract.

(2) The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security

Requirements Guide (SRG) (version in effect at the time the solicitation is issued or as authorized by the

Contracting Officer) found at http://iase.disa.mil/cloud_security/Pages/index.aspx, unless notified by the

Contracting Officer that this requirement has been waived by the FRTIB Chief Information Officer.

(3) The Contractor shall maintain within the United States or outlying areas all Government data that is not physically located on FRTIB premises, unless the Contractor receives written notification from the

Contracting Officer to use another location.

(4) All cloud computing service must meet security requirements equivalent to those established by the

Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline

(https://www.fedramp.gov/resources/documents/).

(c) Limitations on access to, and use and disclosure of Government data and Government-related data.

(1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder.

(i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order.

(ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibitions and obligations.

(iii) These access, use, and disclosure prohibitions and obligations shall survive the expiration or termination of this contract.

(2) The Contractor shall use Government-related data only to manage the operational environment that supports the Government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer.

(d) Cloud computing services cyber incident reporting. The Contractor shall immediately report all actual or potential cyber incidents that are related to the cloud computing service provided under this contract. Reports shall be submitted to IncidentResponse@tsp.gov.

(e) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with instructions provided by the Contracting Officer.

(f) Media preservation and protection. When a Contractor discovers a cyber-incident has occurred, the

Contractor shall preserve and protect images of all known affected information systems identified in the cyber incident report (see section (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days unless directed otherwise by FRTIB CISO or CTO from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(g) Access to additional information or equipment necessary for forensic analysis. Upon request by

FRTIB, the Contractor shall provide FRTIB with access to additional information or equipment that is necessary to conduct a forensic analysis.

(h) Cyber incident damage assessment activities. If FRTIB elects to conduct a damage assessment, the

Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (f) of this clause.

(i) Records management and facility access.

(1) The Contractor shall provide the Contracting Officer all Government data and Government-related data in the format specified in the contract.

(2) The Contractor shall dispose of Government data and Government-related data in accordance with the terms of the contract and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures.

(3) The Contractor shall provide the Government, or its authorized representatives, access to all

Government data and Government-related data, access to contractor personnel involved in performance of the contract, and physical access to any Contractor facility with Government data, for the purpose of audits, investigations, inspections, or other similar activities, as authorized by law or regulation.

(j) Notification of third-party access requests. The Contractor shall notify the Contracting Officer promptly of any requests from a third party for access to Government data or Government-related data, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contracting Officer to take all measures to protect

Government data and Government-related data from any unauthorized disclosure.

(k) Spillage. Upon notification by the Government of a spillage, or upon the Contractor’s discovery of a spillage, the Contractor shall promptly notify the Contracting Officer and cooperate with the Contracting

Officer to address the spillage in compliance with agency procedures.

(l) Subcontracts. The Contractor shall include this clause, including this paragraph (l), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial items. (End of Clause)

H.5 System Development/Engineering Lifecycle (JULY 2020)

(a) Contractor shall implement a System Development Life Cycle (SDLC) or System Engineering Life

Cycle (SELC) to manage systems, applying cyber resiliency design principles, constructs, and concepts from

NIST Special Publication 800-160 and its associated volumes. Contractor shall attest that all systems have a documented SDLC and provide FRTIB with documentation on an annual basis.

(b) The SDLC/SELC must be designed to receive and incorporate from FRTIB the necessary security requirements, including those outlined in NIST Special Publication 800-53a Rev. 4, control SA-4. (End of

Clause)

H.6 Cyber Incident Reporting (JULY 2020)

(a) Definitions. As used in this clause—

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose. A Breach is also considered an incident.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Computer software” means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae and related material that would enable the software to be reproduced, recreated, or recompiled. Computer software does not include computer data bases or computer software documentation.

“Cyber incident” means an incident occurring through the use of computer networks that result in an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Incident” means an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of FRTIB’s information or an FRTIB information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies with respect to FRTIB’s information or an FRTIB information system. “Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which controlled unclassified

Information is recorded, stored, or printed within a covered contractor information system.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

“Rapidly report” means within one (1) hour of first becoming aware of an incident or a Breach or within one

(1) hour of determining with reasonable certainty that there has been an incident or a Breach involving

FRTIB data."

(b) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident or breach that affects a covered contractor information system or the controlled unclassified information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the

Contractor shall—

(i) Rapidly report cyber incidents to FRTIB at IncidentResponse@tsp.gov; and

(ii) Require training for contractors and subcontractors on how to identify and report an incident or breach.

(iii) Conduct a review for evidence of compromise of Controlled Unclassified Information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts, in identifying what information was or may have been accessed and by whom, creating timelines of user activity, determining methods and techniques used to access federal information, and identifying the attack vector.

This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident or breach, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised Controlled Unclassified Information, or that affect the Contractor’s ability to provide operationally critical support.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for FRTIB and shall include, at a minimum, the required elements in accordance with FRTIB Cyber Incident Response

Policy and Procedures.

(c) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to FRTIB CIO in accordance with instructions provided by the Contracting Officer. Do not send the malicious software to the Contracting

Officer.

(d) Media preservation and protection. When a Contractor discovers a cyber incident or breach has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (b)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow FRTIB to request the media or decline interest.

(e) Cyber incident damage assessment activities. The Contracting Officer will request that the

Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(f) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

(g) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(h) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph, in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve Controlled Unclassified

Information, including subcontracts for commercial items, without alteration, except to identify the parties.

The Contractor shall determine if the information required for subcontractor performance retains its identity as Controlled Unclassified Information and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and

(2) Require subcontractors to provide the incident report number assigned by the Security Operations

Center or Computer Security Incident Response Team (CSIRT), to the prime Contractor (or next higher tier subcontractor) as soon as practicable, when reporting a cyber-incident to FRTIB as required in paragraph (b) of this clause. (End of Clause)

H.7 Records Management Obligations (JULY 2020)

(a) “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

(b) The term Federal record:

(1) Includes Agency records.

(2) Does not include personal materials.

(3) Applies to records created, received, or maintained by Contractors pursuant to their Agency contract.

(4) May include deliverables and documentation associated with deliverables.

(c) Requirements

(1) Contractor shall comply with all applicable records management laws and regulations, as well as

National Archives and Records Administration (NARA) records policies, including but not limited to the

Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter

B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5

U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. Contractor employees may be required to take role based privacy training as provided by FRTIB.

(2) In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters

21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

(3) In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the

Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

(4) FRTIB and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FRTIB or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the

FRTIB Contracting Officer and COR. The agency must report promptly to NARA in accordance with 36

CFR 1230.

(5) The Contractor shall immediately notify the appropriate Contracting Officer and COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract vehicle. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the

Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FRTIB control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer and COR or address prescribed in the contract vehicle. Destruction of records is

EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

(6) The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FRTIB guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

(7) The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FRTIB policy.

(8) The Contractor shall not create or maintain any records containing any non-public Agency information that are not specifically tied to or authorized by the contract.

(9) The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

(10) The FRTIB owns unrestricted and unlimited rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FRTIB shall have unrestricted and unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

(11) Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records…