RFQ-_Security_Awareness_Training.pdf

Section B

SUPPLIES OR SERVICES AND PRICES/COSTS

Line Item No.

Description of Supplies/Services Qty U/I Unit Price Total

0001-Base Security Awareness Training Enterprise Software License

POP: 07/01/2019-06/30/2020

Up to 130,000

Users $ $

Description of Supplies/Services Qty U/I Unit Price Total

1001-OY1 Security Awareness Training Enterprise Software License

POP: 07/01/2020-06/30/2021

Up to

Description of Supplies/Services Qty U/I Unit Price Total

2001-OY2 Security Awareness Training Enterprise Software License

POP: 07/01/2021-06/30/2022

Up to

Description of Supplies/Services Qty U/I Unit Price Total

3001-OY3 Security Awareness Training Enterprise Software License

POP: 07/01/2022-06/30/2023

Up to

Description of Supplies/Services Qty U/I Unit Price Total

4001-OY4 Security Awareness Training Enterprise Software License

POP: 07/01/2023-06/30/2024

Up to

U.S. Department of Treasury Associate Chief Information Officer for Cybersecurity (ACIO/CS)

Security Awareness Training Program Statement of Work (SOW)

February 8th, 2019

Contents

1 INTRODUCTION

2 BACKGROUND

3 CURRENT ENVIRONMENT

4 OBJECTIVES

5 SCOPE

6 REQUIREMENTS

6.1 Task Requirements

6.1.1 Security Awareness Training Enterprise License

6.1.2 Customizable Training Package

6.1.3 Security Awareness Training Materials

6.1.4 Customer Support Services

6.2 Key Deliverables, Milestones and Schedule

6.2.1 Deliverables Acceptance Criteria

7 SECURITY

8 CONTRACT TYPE

9 PERIOD OF PERFORMANCE

10 INSPECTION AND ACCEPTANCE

11 ACCEPTANCE CRITERIA

12 INVOICE REVIEW

13 DELIVERY ADDRESS

14 SHIPPING

15 OTHER SPECIAL CONSIDERATIONS

16 GOVERNMENT POINTS OF CONTACT

17 CONTRACT ADMINISTRATION………………………………………………………9

1 INTRODUCTION

The Office of the Chief Information Officer (OCIO) for the Treasury Departmental Offices (DO) and the Data Center Operations for Treasury maintains and controls all the hardware and software supporting the Department and its Bureaus in all areas of information and technology. Treasury OCIO Cybersecurity currently has a requirement to procure a software-as-a-service (Saas) enterprise license for providing module-based cybersecurity awareness training to all employees and collecting completion metrics.

2 BACKGROUND

The Associate Chief Information Officer (ACIO) for Cyber Security (ACIO/CS) offices resides within the U.S. Department of the Treasury’s Departmental Offices (DO), Office of the Chief Information Officer (OCIO). The OCIO provides leadership to the Department of Treasury and its Bureaus in all areas of information and technology management, and support Treasury’s Mission by implementing strategies that improve the efficiency and performance of Treasury information Technology (IT) systems and business processes. OCIO has Department-wide responsibility for the direction and development of Treasury’s IT strategy, management of IT investments, and leadership of key technology initiatives. As a pillar of Treasury OCIO, ACIO/CS is a service provider of cybersecurity solutions through shared and scalable products, platforms and services.

ACIO/CS offers all Treasury Bureaus, Offices and Leadership with a variety of cybersecurity policy, services and solutions for securing and protecting Treasury systems and associated sensitive business data.

3 CURRENT ENVIRONMENT

In accordance with OMB A-130, The Federal Information Security Management Act (FISMA), and The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-16 Treasury requires procurement of a SaaS enterprise license for providing module-based cybersecurity awareness training to all employees. The current Treasury Security Awareness Training Program utilizes SANS, Securing the Human software to fulfill security awareness training requirements. While this solution has been acceptable in the effort to comply with the mandates and to provide employees with valuable security and role-based training; the contract (TIRNO-16-E-00015) for this SANS is set to expire in June of 2019. With respect to the Government’s commitment to fair opportunity Treasury intends to fill this requirement via open competition.

4 OBJECTIVES

The objective of this proposed contact is to procure an enterprise license for a SaaS security awareness training solution. Treasury intends to utilize the capabilities of this license Department-wide to meet Federally mandated cybersecurity training requirements.

5 SCOPE

All tasks and deliverables completed under this SOW shall pertain to the successful configuration of, deployment of, and on-going support of a Treasury Department-wide security awareness training solution. The solution shall include an enterprise license, security awareness training materials, support services and the ability to create and distribute custom training packages.

Section 6, “Requirements” (below) further details the activities and deliverables required in order to satisfy the objectives of this task order.

6 REQUIREMENTS

The contractor(s) shall complete all activities and related deliverables listed in the sub-sections below.

6.1 Task Requirements

6.1.1 Security Awareness Training Enterprise License

Treasury hosted, enterprise-wide security training SaaS. Training shall include a wide variety of security awareness and compliance topics and videos (modules). At a minimum, available topics shall include the following:

• Social engineering

• Email Security

• Browsing Safely

• Mobile Devices

• Passwords

• Data Security

• Working Remotely

• Insider Threats

• Human Protection Measures

• Cloud Security

• Encryption

• Human Resources (HR) Compliance

• Phishing

• Protecting Sensitive Information

• Preventing Security Breaches

• Social networks

• C-level Email Impersonation

• Appropriate Use

• Cyber Attack Detection

• Data Privacy

• Travel Security

• Physical Security

Training shall be updated annually (at a minimum), include the option for quizzes, be easily distributable, support up to 130,000 users and provide the ability to track user compliance on macro and micro user levels. The proposed contract shall provide Treasury with the Security Awareness Training Enterprise License for a twelve (12) month base period and four (4) additional option periods to be exercised at the discretion of the government.

6.1.2 Customizable Training Package

As a subcomponent of the Security Awareness Training Enterprise License, the solution shall include the functionality to build customizable training courses. Specifically, these customizable training courses shall provide the ability to choose topics and videos, ends pages, and logos. The proposed contract shall provide Treasury with a Customizable Training Package for a twelve (12) month base period and four (4) additional option periods to be exercised at the discretion of the government.

6.1.3 Security Awareness Training Materials

Security Awareness Training materials shall be provided in the form of topical monthly newsletters, posters, and screen savers. These support materials shall be easily distributable amongst all of the Treasury Bureaus. The proposed contract shall provide Treasury with the Security Awareness Training materials for a twelve (12) month base period and four (4) additional option periods to be exercised at the discretion of the government.

6.1.4 Customer Support Services

A direct line to a customer support manager to assist with successful configuration, deployment, usage and miscellaneous issues shall be provided. The proposed contract shall provide Treasury with the Customer Support Services for a twelve (12) month base period and (4) additional option periods to be exercised at the discretion of the government.

6.2 Key Deliverables, Milestones and Schedule

All deliverables, work products, software, hard-copy and electronic documents, including everything and anything developed by the contractor(s) while working on this contract, are the sole property of the United States Government. The contractor(s) shall have no rights of ownership.

The contractor(s) shall be responsible for the completion of the following deliverables in accordance with the delivery schedule and completion criteria. If an extension is needed, the contractor(s) must submit a written request to the COR and Technical Manager at least three (3) business days prior to the due date. A justification for an extension must be provided.

All days are calendar days unless otherwise specified. “Start date” refers to the day that the contractor(s) are deemed suitable (i.e. able to start work) by the Treasury’s Security Office and the on-boarding process has been completed.

# Deliverable Description Section Reference

Due By Submitted To

001 Security Awareness Training Enterprise License

6.1.1 Due within thirty

(30) days of award.

COR/Government Technical Manager

002 Customizable Training Package

6.1.2 Due within thirty

(30) days of award.

COR/Government Technical Manager

003 Security Awareness Training Materials

6.1.3 Due within thirty

(30) days of award.

COR/Government Technical Manager

004 Customer Support Services 6.1.4 Due within thirty

(30) days of award.

COR/Government Technical Manager

6.2.1 Deliverables Acceptance Criteria

Final inspection and acceptance of all work performed, reports and other deliverables will be performed at the Government site (1750 Pennsylvania Avenue, Washington, D.C.). Deliverables are not final until reviewed and approved by the Government Technical Lead and the COR. All deliverables, including anything and everything developed while working under this contract, are the sole property of the United States Government.

All contractor-produced deliverables shall be reviewed using the following criteria:

• Accuracy - Work products shall be accurate in presentation, technical content, and adherence to accepted elements of style.

• Clarity - Work products shall be clear and concise. All diagrams shall be easy to understand and relevant to the supporting narrative.

• Specifications Validity - All work products must satisfy the requirements of the Government as specified herein.

• File Editing - All text and diagrammatic files shall be editable by the Government.

• Format - Work products shall be submitted in hard copy (where applicable) and in media as required by the project per the COR’s direction.

• Timeliness – Work products shall be submitted on or before the due date as mutually agreed upon by the COR and the Contractor On-Site Manager. If an extension is required, written request for an extension with justification must be received at least three (3) business days prior to the due date.

7 SECURITY

General Security:

Department of Treasury, otherwise known as the Department, retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. Lack of the ability to obtain or maintain the required investigation level is included in the reasons the Department may remove a contractor employee. The reason for removal shall be documented in writing by the Contracting Officer. Additionally, the Contractor must notify the OSP of all terminations/resignations within 24 hours of occurrence. When and if such removal occurs, the Contractor is responsible for assigning qualified replacement personnel in a timely manner or ensuring that performance of the contract is not adversely affected. The Contractor shall return all departmentally issued identification cards, building passes, keys, and any other government issued material of those terminated employees to the COR. If government issued material is not available to be returned, a report must be submitted to the COR referencing the number, name of individual to whom it was issued, the last known location, and disposition of the items. Failure to return government materials may result in remedial actions against the contractor. Contractor personnel shall visibly wear departmentally issued identification badges when working in Government facilities. If any current or prospective employee is found to be ineligible for access to Government facilities or information by the Department, the COR will notify the contractor that the employee shall not continue to work or to be assigned to work under the contract. The Department may require drug screening for probable cause at any time. The contractor must also ensure that, prior to the end of the contract, all Departmental information, systems and equipment is returned to the appropriate Department personnel.

The contractor must limit the number of individuals requested to undergo any level of investigation/adjudication to those required to ensure performance of the scope for this contract (“pools” of investigated employees are not permitted).

Any employee assigned to support the Department shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal Identity Verification Standards for Federal Employees and Contractors,” dated August 2013. For T4/High Risk contracts, the contract employee must be a U.S. Citizen; for T2/Moderate Risk contracts, the contract employee must be a U.S. Citizen or Lawful Permanent Resident Alien with at least three or more years of U.S. residency from the legal entry date in the U.S.. Contractor personnel will have access to Department facilities, information and equipment limited to that which is needed to perform contract scope.

The Contractor shall provide the CO the name of all entities to be used as subcontractors for each type of work to be performed prior to performing any work under this contract in accordance with the FAR. The Government reserves the right to accept or reject any subcontractors proposed.

Contractors should not serve as the escort for their subcontractors or for any other contractor;

escorts used should be Departmental Federal employees.

The contractor is responsible for obtaining the approval of the Contracting Officer (CO) prior to release of any information received or generated under the contract. The CO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should serve as focal point for their subcontractors’ public release requests and refer them to the CO. SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71). For Official Use Only must be protected in accordance with the providing Agency’s directives. Data contained within all Treasury computer systems are governed by Agency Security Regulations as well as the Federal Privacy Act of 1974. Contractor personnel assigned to this project will be held accountable for adherence to these regulations.

Contractors and their subcontractors must perform all initial, annual, contemporaneous, specialized and termination training required per 32 CFR 2004 and Department guidance as appropriate for their position.

The Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this contract, to include loss or suspension of clearance, or security issues involving the scope being completed for the contract. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information.

Work on this contract may require personnel to have access to private information covered by the Privacy Act, Title 5 of the U.S. Code, Section 552a (in addition to other types of non-public information). All Contractor personnel shall adhere to the requirements of the Privacy Act as well as any applicable Department or Federal rule/regulation regarding private information or other types of non-public information.

As a condition for access for Government‐Owned Systems and data, all Contractor personnel must pass background investigations in accordance with OMB Circular A‐130 which requires screening of all individuals involved with sensitive applications or data in Federal automated information systems.

8 CONTRACT TYPE

The Government anticipates that this task will result in a “Firm Fixed Price” (FFP) award.

9 PERIOD OF PERFORMANCE

The period of performance is:

Base Year: 07/01/2019-06/30/2020 Option Year 1: 07/01/2020-06/30/2021 Option Year2: 07/01/2021-06/30/2022 Option Year 3: 07/01/2022-06/30/2023 Option Year 4: 07/01/2023-06/30/2024

10 INSPECTION AND ACCEPTANCE

The Delivery POC is responsible for inspection and acceptance of all items, incoming shipments, documents, and services.

11 ACCEPTANCE CRITERIA

Certification by the Government of satisfactory goods or services provided is contingent upon the vendor performing in accordance with the terms and conditions of the referenced agreement, this order, and all amendments.

12 INVOICE REVIEW

The Delivery POC may reject or require correction of any deficiencies found in the invoice.

13 DELIVERY ADDRESS

Electronic Delivery, if physical delivery of the license is required by the vendor, use the Treasury address below:

Delivery shall be to the following address, a minimum of 24hrs notice is required prior to delivery:

POC: Will be responsible for receipt of product and invoice approval.

The items are to be delivered to the following address below:

US Department of the Treasury Attn: Bryant, Julie 1750 Pennsylvania Ave NW, Floor 11 Washington, D.C. 20006

Additional information:

Bryant, Julie Julie.Byrant@treasury.gov

(202) 622-0014

14 SHIPPING

The vendor shall make use of commercial best practices in the packing and shipment of packages, unless otherwise stated in this order.

15 OTHER SPECIAL CONSIDERATIONS

This procurement is required to have an item column placed into the (IGCE); this will match the same item # as the Purchase Request (PR) # on the Purchase Order (PO). This action is critical in controlling the status and simplifying the effort to account for our items, for various reasons.

This effort has proven to be a great asset to all stakeholders.

16 GOVERNMENT POINTS OF CONTACT

Contracting Officer (CO) Name: Michael A. Burke Email:Michael.A.Burke@irs.gov Phone:240-613-5827 mailto:Julie.Byrant@treasury.gov

Contracting Officer’s Representative (COR) Name: Julie Bryant Address: 1750 Pennsylvania Ave NW Washington, DC 20006 Email: Julie.Bryant@treasury.gov Phone: (202) 622-0014

Technical Point of Contact Name: Steve Arauz Address: 1750 Pennsylvania Ave NW Washington, DC 20006 Email: Steve.Arauz@treasury.gov Phone: (202) 622-9109

17 CONTRACT ADMINISTRATION

The Contracting Officer responsible for administration of this contract is Michael A. Burke.

The Contracting Officer, in accordance with FAR Subpart 1.6, is the only individual authorized to enter into, administer, and terminate work under this contract. Notwithstanding any clauses contained elsewhere in this contract, this said authority remains solely with the Contracting Officer. In the event the Contractor makes any changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in cost incurred as a result thereof.

All correspondence related to this contract shall be directed as follows:

Michael A. Burke Email: Michael.A.Burke@irs.gov Telephone: 240-613-5827

The Contracting Officer for individual orders placed under this contract will be noted on the order.

All orders placed under this contract shall contain the following information:

(a) Date of order

(b) Contract Number, Order Number, Item number, Description, Quantity, and Unit Price

(c) Delivery or Performance Date

(d) Place of Delivery

(e) Packing, unpacking, and shipping instructions, if any

(f) Accounting and Appropriation Data

(g) Any other pertinent information

1052.201-70 Contracting Officer’s Representative (COR) Appointment and Authority

(APR 2015)

(a) The COR is Julie Bryant

Email: Julie.Bryant@treasury.gov Phone: (202) 622-0014

(b) Performance of work under this contract is subject to the technical direction of the COR identified above, or a representative designated in writing. The term “technical direction” includes, without limitation, direction to the contractor that directs or redirects the labor effort, shifts the work between work areas or locations, and/or fills in details and otherwise serves to ensure that tasks outlined in the work statement are accomplished satisfactorily.

(c) Technical direction must be within the scope of the contract specification(s)/work statement.

The COR does not have authority to issue technical direction that:

(1) Constitutes a change of assignment or additional work outside the contract specification(s)/work statement;

(2) Constitutes a change as defined in the clause entitled “Changes”;

(3) In any manner causes an increase or decrease in the contract price, or the time required for contract performance;

(4) Changes any of the terms, conditions, or specification(s)/work statement of the contract;

(5) Interferes with the contractor's right to perform under the terms and conditions of the contract;

or

(6) Directs, supervises or otherwise controls the actions of the Contractor's employees.

(d) Technical direction may be oral or in writing. The COR must confirm oral direction in writing within five workdays, with a copy to the Contracting Officer.

(e) The Contractor shall proceed promptly with performance resulting from the technical direction issued by the COR. If, in the opinion of the Contractor, any direction of the COR or the designated representative falls within the limitations of (c) above, the Contractor shall immediately notify the Contracting Officer no later than the beginning of the next Government work day.

(f) Failure of the Contractor and the Contracting Officer to agree that technical direction is within the scope of the contract shall be subject to the terms of the clause entitled “Disputes.” (End of clause.

FAR CLAUSES

1) 52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements-Representation (Jan 2017)

(a) Definition.

“Internal confidentiality agreement or statement,” “subcontract”, and “subcontractor”, as used in this provision, are defined in the clause at 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements.

(b) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions), Government agencies are not permitted to use funds appropriated (or otherwise made available) for contracts with an entity that requires employees or subcontractors of such entity seeking to report waste, fraud, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(c) The prohibition in paragraph (b) of this provision does not contravene requirements applicable to Standard Form 312, (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(d) Representation. By submission of its offer, the Offeror represents that it will not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

2) 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018)

Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

As prescribed in 4.2004, insert the following clause:

Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018)

(a) Definitions. As used in this clause--

Covered article means any hardware, software, or service that--

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity.

Covered entity means--

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any covered article. The Contractor is prohibited from--

(1) Providing any covered article that the Government will use on or after October 1, 2018; and

(2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement. (1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil/. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil/.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number);

item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause:

Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

(End of clause)

3) 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015)

(a) Definitions. As used in this clause—

“Inverted domestic corporation” means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

“Subsidiary” means an entity in which more than 50 percent of the entity is owned—

(1) Directly by a parent corporation; or

(2) Through another subsidiary of a parent corporation.

(b) If the contractor reorganizes as an inverted domestic corporation or becomes a subsidiary of an inverted domestic corporation at any time during the period of performance of this contract, the Government may be prohibited from paying for Contractor activities performed after the date when it becomes an inverted domestic corporation or subsidiary. The Government may seek any available remedies in the event the Contractor fails to perform in accordance with the terms and conditions of the contract as a result of Government action under this clause.

(c) Exceptions to this prohibition are located at 9.108-2.

(d) In the event the Contractor becomes either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation during contract performance, the Contractor shall give written notice to the Contracting Officer within five business days from the date of the inversion event.

04) 52.212-5 Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Items (Jul 2018)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115- 91).

(3) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(4) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(5) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004)(Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Jul 2013) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011) (15 U.S.C. 657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (Oct 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (Jan 2011) of 52.219-4.

__ (13) [Reserved]

__ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644).

__ (ii) Alternate I (Nov 2011).

__ (iii) Alternate II (Nov 2011).

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

__ (ii) Alternate I (Oct 1995) of 52.219-7.

__ (iii) Alternate II (Mar 2004) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)).

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Jan 2017) (15 U.S.C. 637(d)(4)).

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Nov 2016) of 52.219-9.

__ (v) Alternate IV (Nov 2016) of 52.219-9.

__ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

__ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages—Subcon-tracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (Nov 2011) (15 U.S.C. 657 f).

__ (22) 52.219-28, Post Award Small Business Program Rerepresentation (Jul 2013) (15 U.S.C.

632(a)(2)).

__ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

__ (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

__ (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

__ (26) 52.222-19, Child Labor—Cooperation with Authorities and Remedies (Jan 2018) (E.O.

13126).

__ (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

__ (28) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

__ (29) 52.222-35, Equal Opportunity for Veterans (Oct 2015)(38 U.S.C. 4212).

__ (30) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

__ (31) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212).

__ (32) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496).

__ (33)(i) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O. 13627).

__ (ii) Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

__ (34) 52.222-54, Employment Eligibility Verification (Oct 2015). (Executive Order 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

__ (35)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA–Designated Items (May 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (ii) Alternate I (May 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

__ (36) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (Jun 2016) (E.O. 13693).

__ (37) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (Jun 2016) (E.O. 13693).

__ (38)(i) 52.223-13, Acquisition of EPEAT®-Registered Imaging Equipment (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Oct 2015) of 52.223-13.

__ (39)(i) 52.223-14, Acquisition of EPEAT®-Registered Televisions (Jun 2014) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-14.

__ (40) 52.223-15, Energy Efficiency in Energy-Consuming Products (Dec 2007) (42 U.S.C.

8259b).

__ (41)(i) 52.223-16, Acquisition of EPEAT®-Registered Personal Computer Products (Oct 2015) (E.O.s 13423 and 13514).

__ (ii) Alternate I (Jun 2014) of 52.223-16.

__ (42) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (Aug 2011) (E.O. 13513).

__ (43) 52.223-20, Aerosols (Jun 2016) (E.O. 13693).

__ (44) 52.223-21, Foams (Jun 2016) (E.O. 13693).

__ (45)(i) 52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a).

__ (ii) Alternate I (JAN 2017) of 52.224-3.

__ (46) 52.225-1, Buy American—Supplies (May 2014) (41 U.S.C. chapter 83).

__ (47)(i) 52.225-3, Buy American—Free Trade Agreements—Israeli Trade Act (May 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C.

4001 note, Pub. L. 103-182, 108-77, 108-78, 108-286, 108-302, 109-53, 109-169, 109-283, 110- 138, 112-41, 112-42, and 112-43.

__ (ii) Alternate I (May 2014) of 52.225-3.

__ (iii) Alternate II (May 2014) of 52.225-3.

__ (iv) Alternate III (May 2014) of 52.225-3.

__ (48) 52.225-5, Trade Agreements (Oct 2016) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

__ (49) 52.225-13, Restrictions on Certain Foreign Purchases (June 2008) (E.O.’s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

__ (50) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

__ (51) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (Nov 2007) (42 U.S.C.

5150).

__ (52) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (Nov 2007) (42 U.S.C. 5150).

__ (53) 52.232-29, Terms for Financing of Purchases of Commercial Items (Feb 2002) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (54) 52.232-30, Installment Payments for Commercial Items (Jan 2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

__ (55) 52.232-33, Payment by Electronic Funds Transfer—System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (56) 52.232-34, Payment by Electronic Funds Transfer—Other than System for Award Management (Jul 2013) (31 U.S.C. 3332).

__ (57) 52.232-36, Payment by Third Party (May 2014) (31 U.S.C. 3332).

__ (58) 52.239-1, Privacy or Security Safeguards (Aug 1996) (5 U.S.C. 552a).

__ (59) 52.242-5, Payments to Small Business Subcontractors (Jan 2017)(15 U.S.C. 637(d)(12)).

__ (60)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631).

__ (ii) Alternate I (Apr 2003) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

[Contracting Officer check as appropriate.]

__ (1) 52.222-17, Nondisplacement of Qualified Workers (May 2014)(E.O. 13495).

__ (2) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67).

__ (3) 52.222-42, Statement of Equivalent Rates for Federal Hires (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (4) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (May 2014) (29 U.S.C. 206 and 41 U.S.C.

chapter 67).

__ (5) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards—Price Adjustment (May 2014) (29 U.S.C. 206 and 41 U.S.C. chapter 67).

__ (6) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment—Requirements (May 2014) (41 U.S.C. chapter 67).

__ (7) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services—Requirements (May 2014) (41 U.S.C. chapter 67).

__ (8) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015).

__ (9) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

__ (10) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (May 2014) (42 U.S.C. 1792).

__ (11) 52.237-11, Accepting and Dispensing of $1 Coin (Sept 2008) (31 U.S.C. 5112(p)(1)).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, and does not contain the clause at 52.215-2, Audit and Records—Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor’s directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial items. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115- 91).

(iv) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds $700,000 ($1.5 million for construction of any public facility), the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(v) 52.222-17, Nondisplacement of Qualified Workers (May 2014) (E.O. 13495). Flow down required in accordance with paragraph (l) of FAR clause 52.222-17.

(vi) 52.222-21, Prohibition of Segregated Facilities (Apr 2015)

(vii) 52.222-26, Equal Opportunity (Sept 2016) (E.O. 11246).

(viii) 52.222-35, Equal Opportunity for Veterans (Oct 2015) (38 U.S.C. 4212).

(ix) 52.222-36, Equal Opportunity for Workers with Disabilities (Jul 2014) (29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (Feb 2016) (38 U.S.C. 4212)

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (Dec 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (May 2014) (41 U.S.C. chapter 67).

(xiii) 52.222-50, Combating Trafficking in Persons (Mar 2015) (22 U.S.C. chapter 78 and E.O 13627). Alternate I (Mar 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (May 2014) (41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (May 2014) (41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (Oct 2015) (E.O. 12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (Dec 2015).

(xviii) 52.222-62, Paid Sick Leave Under Executive Order 13706 (Jan 2017) (E.O. 13706).

(xix)(A) 52.224-3, Privacy Training (Jan 2017) (5 U.S.C. 552a).

(B) Alternate I (Jan 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (Oct 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (May 2014) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (Feb 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow down required in accordance with paragraph

(d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations. (End of Clause)

5) FAR 52.217-6 Option for Increased Quantity (MAR 1989)

The Government may increase the quantity of supplies called for in the Schedule at the unit price specified. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days. Delivery of the added items shall continue at the same rate as the like items called for under the contract, unless the parties otherwise agree. (End of Clause)

6) FAR 52.217-9 Option to Extend the Term of the Contract. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 07 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 10 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months. (End of clause)

7) 52.232-40 Providing Accelerated Payments to Small Business Subcontractors (Dec 2013)

(a) Upon receipt of accelerated payments from the Government, the Contractor shall make accelerated payments to its small business subcontractors under this contract, to the maximum extent practicable and prior to when such payment is otherwise required under the applicable contract or subcontract, after receipt of a proper invoice and all other required documentation from the small business subcontractor.

(b) The acceleration of payments under this clause does not provide any new rights under the Prompt Payment Act.

(c) Include the substance of this clause, including this paragraph (c), in all subcontracts with small business concerns, including subcontracts with small business concerns for the acquisition of commercial items.

8)FAR 52.252-2 -- Clauses Incorporated by Reference. (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.arnet.gov/far/ (End of Clause) http://www.arnet.gov/far/

NUMBER TITLE

52.203-3 Gratuities (APR 1984) 52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights (Apr 2014) 52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper. (May 2011) 52.204-13 System for Award Management Maintenance (Oct 2016) 52.212-4 Contract Terms and Conditions-Commercial Items (Jan 2017) 52.223-10 Waste Reduction Program (May 2011) 52.227-19 Commercial Computer Software License (Dec 2007) 52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013)

FAR DEVIATIONS

1) 1052.212-4 Contract Terms and Conditions-Commercial Items. (ALTERNATE II) (DEVIATION 2016-00001) (April 2018)

As prescribed in 1012.301-70, substitute, paragraphs, (s), and (u) of FAR clause 52.212-4; and additionally, add subparagraph (e)(2) and paragraph (w) to FAR clause 52.212-4.

(e) Definitions.

(2) As used in this clause, "Commercial supplier agreements" means terms and conditions customarily offered to the public by vendors of supplies or services that meet the definition of commercial item set forth in FAR 2.101and intended to create a binding legal obligation on the end user. Commercial supplier agreements (CSA) are particularly common in information technology acquisitions, including acquisitions of commercial computer software and commercial technical data, but they may apply to any supply or service. The term applies-

(i) Regardless of the format or style of the document. For example, a CSA may be styled as standard terms of sale or lease, Terms of Service (TOS), End User License Agreement (EULA), or another similar legal instrument or agreement, and may be presented as part of an offer or quotation responding to a solicitation;

(ii) Regardless of the media or delivery mechanism used. For example, a CSA may be presented as one or more paper documents or may appear on a computer or other electronic device screen during a purchase, software installation, other…