SOW.pdf

NATIONAL INSTITUTES OF HEALTH «System_Name» March 2025

STATEMENT OF WORK

(SOW)

For

NATIONAL INSTITUTES OF HEALTH (NIH)

Bethesda Main Campus (BMC) Visitor Badge System (VBS) Visitor Management Portal (VMP)

Phase 2

1. VERSION

REVISION DATE DESCRIPTION

1.1 3/13/2025 Release 2.0 – Release 2.1

2. PROJECT CONTACT PERSONS

2.1. Contracting Officer (CO):

Sharmaine Fagan 6701 Rockledge Dr Bethesda MD 20892-7786 sharmaine.fagan@nih.gov

2.2. Contracting Officer’s Representative (COR) | System Owner (SO)

Tae Chaney 9000 Rockville Pike Bethesda, MD Building 31 Bethesda, MD 20892 Tae.Chaney@nih.gov 301-496-1334

2.3. Project Officer (PO)

Tae Chaney 9000 Rockville Pike Bethesda, MD Building 31 Bethesda, MD 20892 Tae.Chaney@nih.gov 301-496-1334

2.4. Project Technical Representatives:

Sandra Scarborough 9000 Rockville Pike Bethesda, MD Building 31 mailto:Tae.Chaney@nih.gov

Bethesda, MD 20892 sandra.scarbrough@nih.gov 301-765-4577

Chad Cressley 9000 Rockville Pike Bethesda, MD Building 31 Bethesda, MD 20892 chad.cressley@nih.gov 301-496-1580

3. BACKGROUND

It is the mission of the National Institutes of Health (NIH) Division of Police (DP) to protect our country's national treasure: Scientific Research and the NIH research community, and further to ensure that the mission of NIH is not impeded by personal attacks, loss of assets, criminal activity or acts of terrorism. The Division of Police has responsibility for providing the efficient processing of visitors to NIH facilities. The DP is looking to upgrade the current Visitor Badging System (VBS) EntryPoint Application and Registration Modules with improved functionality that conforms to the security and regulatory requirements associated with the HHS Foreign National Access Management Policy (FNAMP).

The EntryPoint VBS is utilized at several NIH facilities including the Bethesda Main Campus (BMC), Biomedical Research Center (BRC), Maryland locations, Fort Detrick (IRF), and Rocky Mountain Labs (RML) original Visitor Badging System (VBS.

4. PURPOSE

The purpose of this Statement of Work (SOW) is to provide requirements to the Contractor as listed below for services to include but not limited to VBS engineering, VBS system planning, VBS system analysis, VBS systems integration and installation support, testing, implementation and deployment for Visitor Badging System (VBS) EntryPoint Application and Registration Modules Phase 2.

The software vendor will complete requirements and provide all resource estimates and obtain approval from the DP project lead prior to beginning commencement of work and continuing to subsequent completion. Additional SOWs shall include additional requirements for subsequent phases, if any.

5. OBJECTIVE

The objective of this Statement of Work (SOW) is to define the work required to meet the project requirements summarized within and to ensure that the VBS EntryPoint information system, system component, and information system services and system equipment-device configurations fully supports the HHS Foreign National Access Management Policy (FNAMP) Requirements as outlined in Visitor Badging System (VBS) EntryPoint Application and Registration Modules Phase 2 Appendix A – User Story Outlines and Appendix B – Timeline Schedule by Release.

The purpose of the SOW is to ensure that the work defined is accepted, integrated, and configured within NIH VBS EntryPoint system equipment-device, and adheres to all system security program and mailto:chad.cressley@nih.gov privacy requirements and in accordance with all applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs.

6. SCOPE

All requirements listed in this primary SOW will be applicable as listed Visitor Badging System (VBS) EntryPoint Application and Registration Modules Phase 2 Appendix A – User Story Outlines. Vendor will complete requirements and provide all resource estimates and obtain approval from Division of Police (DP) project lead prior to beginning commencement of work. The Visitor Badging System (VBS) EntryPoint Application and Registration Modules Phase 2 will be complete in two Releases 2.0 and 2.1.

• Task 1: Release 2.0: Software vendor shall deliver software that precisely aligns with the defined requirements by 4/3/25.

• Task 2: Release 2.1: Software vendor shall deliver software that precisely aligns with defined requirements and timeline by 6/7/25.

During design, contractor may request additional requirements needed to upgrade the Visitor Badging System (VBS) EntryPoint Application and Registration Modules Phase 2 information system, system component, and information system service and system equipment-devices. Anything not included in Appendix A, if required for proper installation must be coordinated, approved, and documented by project lead through change order request.

7. REQUIREMENTS

7.1. All workmanship shall meet the standards specified in the SOWs and shall be accomplished in conformance with approved and accepted standards of the industry; equipment manufacturers; applicable activity, local, state, and federal standards; and applicable building and safety codes.

7.2. All work must be accepted and approved by DP for purposes of inclusion of all equipment into the NIH security systems maintenance agreements and programs. Contractor shall be certified by the system application manufacturer to install and commission the work.

8. PROJECT MANAGEMENT

8.1. The Contractor shall provide the technical and functional activities necessary for the management of this SOW. The Contractor shall follow the written Project Plan outlining organizational resources to be employed, and deliverables and delivery dates. This written Project Management Plan will be provided and agreed upon by the COR before commencement.

8.2. Requirements Planning

The Contractor shall support the functional and non-functional requirements and provide requirements and configuration management support for the duration of the project.

The NIH organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.

The NIH organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes one or more of the following:

• Security-relevant external system interfaces;

• Source code or hardware schematics;

• Other NIH and/or IC design/implementation information at an NIH and/or IC level of detail

The NIH organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.

a. Security functional requirements;

b. Security strength requirements;

c. Security assurance requirements;

d. Security-related documentation requirements;

e. Requirements for protecting security-related documentation;

f. Description of the information system development environment and environment in which the system is intended to operate; and

g. Acceptance criteria as defined by NIH ORS IT Security Team and NIH InfoSec Policy

The NIH organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.

8.3. Design

Design Task Deliverables and Milestones. Review design meeting with deliverables at 65% completion and review of Final Design 100%. Design must be approved by project lead prior to any installation. Deliverables to be included in project schedule:

8.3.1. Survey Results

8.3.2. Draft Design Document

8.3.3. Preliminary Design Review

8.3.4. Design Review Comments/Responses Forms

8.3.5. Final Design Document

8.4. Work Planning

The Contractor shall provide all manufacturer data and specifications of the system application to be installed under this SOW for DP approval prior to purchase of equipment.

The Contractor shall provide printed deliverables that consist of two sets of drawings, specifications, and manufacturer documentation. Electronic versions of these deliverables shall be provided as well.

8.5. Implementation

The Contractor shall refer to the implementation plan for review and approval by the project lead. See Appendix B for Details.

The final design must be approved by DP prior to any installation activities. The Contractor shall verify the latest version offered by the manufacturer and all discrepancies discovered must be relayed to the project lead for direction prior to purchase.

The Contractor shall support user and operator training, determine readiness to implement, and execute the Implementation Plan, including any phased implementation. The outcome of the Implementation Phase is successful establishment of full production capability. The Contractor shall conduct systems implementation support services inclusive of all necessary user and operator trainings, technology integrations, technology deliveries, implementation plans, installation services, and other required services for the establishment of full production capability.

The Contractor shall provide and adhere to quality assurance services for all work performed under the awarded SOW. The services shall include a method for identifying deficiencies in the quality of services performed and taking corrective action before the level of performance become unsatisfactory. A file of all quality control inspection conducted and corresponding results, and any corrective action required, shall be maintained by the Contractor throughout the term of this SOW. This file shall be the property of DP and shall be made available to the PO upon request.

The Contractor shall provide an updated installation schedule with each submission. The baseline schedule shall include Work Breakdown Structure and milestones. This baseline construction schedule will be used as the Government baseline to be utilized to compare with the Contractor’s schedule at the time of award.

8.6. Implementation Task Deliverables and Milestones and deliverables supporting schedule:

8.6.1. Software Installation

8.6.2. Design & Configuration

8.6.3. Implementation Plan

8.6.4. Test Plan

8.6.5. Training Plan

8.6.6. User Trainings and Training Materials

8.7. Testing

All work performed under this SOW shall be tested to verify proper system operation. The Contractor shall provide written proof that the systems and equipment are performing as intended via a test report. The test report shall list each pertinent function of the system application or system. The individual performing the testing shall initial each function indicating satisfactory performance of the system application or system. The Contractor shall notify the PO at least one week in advance of testing so arrangements can be made to witness the testing if desired.

Thorough testing and audit of the design, documentation, programming, operation, coding, and regulatory compliance of the system. The outcome of the Test Phase is completed with user acceptance testing and readiness for sign off and commissioning.

8.8. Signoff/Commissioning

The Contractor shall conduct a thorough review of all Work Order contractual requirements with the COR or his/her designee. The outcome of the Sign-Off / Commissioning Phase is agreement between both the Contractor and the Government that all requirements have been met and the systems are operating as expected. Operations are turned over to the Government or the appropriate Operations and Maintenance Contractor at this time.

8.9. Operations and Maintenance

The outcome of the Operations and Maintenance Phase is successful operation of the asset against current cost, schedule, and performance benchmarks.

8.10. Operations and Maintenance Task Deliverables and Milestones and deliverables to be included in project schedule:

It is imperative that the Contractor and its consultants recognize that the DP reviews are general in nature; that the detailed checking for technical accuracy, sufficiency, and coordination is the sole responsibility of the Contractor and his consultants. Government approval of deliverables does not relieve the Contractor of any performance standards, delivery or quality requirements identified in the SOW. For all document deliverables required under SOWs, the COR may return to the Contractor written comments on the submitted work.

The Government may use a web-based or other electronic system to provide comments in which case the Contractor shall provide responses using the same system. All review comments shall be incorporated into the work prior to the next submittal unless the reviewer directs the Contractor to disregard the comment. In this event the Contractor shall send a memo reporting the directive to the COR and CO.

9. SOW STRUCTURE

Tasks within the scope of this SOW will be placed by a warranted CO as requirements are identified and shall be described in specific work statements.

• Type: Firmed Fixed Price

• Period of Performance (POP): 12 months from date of award with no option periods

• Place of Performance: Contractor facilities

10. DELIVERABLES/DELIVERY SCHEDULE

10.1. Schedules and Reviews

The work shall proceed only after the issuance of the Notice to Proceed (NTP) by the CO for the activities indicated. The Contractor shall schedule and staff the project as necessary to deliver the project substantially complete. The COR will coordinate all required Government reviews and reviews of other Government contracted services.

The Contractor shall conform to the submission schedules and requirements as defined herein for the work of this contract. The Contractor shall allocate technical manpower and other resources so as to steadily progress toward milestone dates and monitor the work of consultants to insure concurrent steady progress. The Contractor shall request information, determinations, and similar direction in sufficient time to permit the Government’s development and delivery of the required information without delay to the schedule.

The Contractor shall endeavor, in the planning of the work, to anticipate information requirements and request information as soon as the need for it becomes apparent. Insofar as possible, the Contractor shall work around areas requiring clarification so as to minimize any delay to the project as a whole. Should delay occur, the Contractor shall work closely and cooperatively with the PO to develop and implement methods to regain or minimize lost time.

It is imperative that the Contractor and its consultants recognize that the Government’s reviews are general in nature; that the detailed checking for technical accuracy, sufficiency, and coordination is the sole responsibility of the Contractor and its consultants. Notwithstanding Government approval, the Contractor shall remain liable for all damages resulting from design errors and negligent performance by the Contractor or its consultants.

Following each submittal, the COR will return to the Contractor written comments on the submitted work within 10 business days. The Government may use a web-based system to provide comments in which case the Contractor shall provide responses using the same system.

All review comments shall be incorporated into the work prior to the next submittal unless the reviewer directs the Contractor to disregard the comment. In this event, the Contractor shall send a memo reporting the directive to the PO, COR and CO.

The Contractor shall provide a written reply to all comments with the next submission on the Review Comment forms. If the Contractor intends to disregard a comment, the Contractor shall provide a written explanation of variance with the comment to the COR within seven (7) calendar days after receipt of the Government review comments.

11. FEDERAL REGULATIONS, CODES, STANDARDS, GUIDELINES

All work performed shall comply with applicable federal regulations, codes and industry standards and best practices to include but not limited to the following:

• DHS Interagency Security Committee (ISC) Standards

• Homeland Security Presidential Directives (HSPD)

• NIH Policy Manual Chapters, NIH Design Requirements Manual, NIH Facility Development Manual, DP Policies and Design Requirements

• Computer Fraud and Abuse Act (P.L. 99-474, 18 USC 1030), October 1986

• Federal Information Security Modernization Act (FISMA) (P.L. 113-283, 44 USC 35), December

• Privacy Act of 1974 as amended (P.L. 93-579, 5 USC 552a), December 1974

• Freedom of Information Act as Amended (15 CFR § 270.350), January 2018

• Records Management by Federal Agencies (44 USC 31), January 2012

• Office of Management and Budget (OMB) Circular A-108, Federal Agency Responsibilities for

Review, Reporting, and Publication under the Privacy Act, January 2017

• Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for

Enterprise Risk Management and Internal Control, July 2016

• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic

Resource, July 2016

• Office of Management and Budget (OMB) M-01-05, Guidance on Inter-Agency Sharing of Personal

Data - Protecting Personal Privacy, December 2000

• Office of Management and Budget (OMB) M-04-04, E-Authentication Guidance, December 2003

• Office of Management and Budget (OMB) M-05-24, Implementation of HSPD-12 - Policy for a

Common Identification Standard for Federal Employees and Contractors, May 2005

• Office of Management and Budget (OMB) M-06-16, Protection of Sensitive Agency Information, June 2006

• Office of Management and Budget (OMB) M-17-12, Preparing for and Responding to a Breach of

Personally Identifiable Information, January 2017

• Homeland Security Presidential Directive (HSPD) 7, Critical Infrastructure Identification, Prioritization, and Protection, December 2003

• Homeland Security Presidential Directive (HSPD) 12, Policy for a Common Identification Standard for Federal Employees and Contractors, August 2005

• American National Standards Institute (ANSI), Institute of Electrical and Electronics Engineers

(IEEE), National Electrical Manufacturers Association (NEMA), Underwriters Laboratories (UL), International Organization for Standardization (ISO), American Society for Industrial Security (ASIS)

All information system, system component, or information system service shall comply the following standards, guidance, and policy:

• Health and Human Services (HHS) Information Systems Security and Privacy Policy (IS2P), July

• National Institutes of Health (NIH) Information Security Policy Handbook 4.0, May 2018

• National Institute of Standards and Technology (NIST) Federal Information Processing Standard

(FIPS) 140-2, Security Requirements for Cryptographic Modules, December 2002

• National Institute of Standards and Technology (NIST) Federal Information Processing Standard

(FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

• National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

• National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, September

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18 Rev 1 Guide for Developing Security Plans for Federal Information Systems, February 2006

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-30 Rev 1 Guide for Conducting Risk Assessments, September 2012

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34 Rev 1 Contingency Planning Guide for Federal Information Systems, November 2010

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Rev 1 Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 2014

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39 Managing Information Security Risk: Organization, Mission, and Information System View, March 2011

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-47 Security Guide for Interconnecting Information Technology Systems, September 2002

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53A Rev 5 Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans, September 2020

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 5 Security and Privacy Controls for Federal Information Systems and Organizations, September 2020

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-59 Guideline for Identifying an Information System as a National Security System, August 2003

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-82 Rev 3 Guide to Operational Technology (OT) Security, April 26, 2022

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60 Volume 1 Rev 1 Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60 Volume 2 Rev 1 Guide for Mapping Types of Information and Information Systems to Security Categories:

Appendices, August 2008

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Rev 2 Computer Security Incident Handling Guide, August 2012

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-64 Rev 2 Security Considerations in the System Development Life Cycle, October 2008

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-115 Technical Guide to Information Security Testing and Assessment, September 2008

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-128 Guide for Security-Focused Configuration Management of Information Systems, August 2011

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-137 Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-145 The NIST Definition of Cloud Computing, September 2011

12. TECHNICAL EVALUATION CRITERIA

12.1. The software vendor’s submission in response to this solicitation will be evaluated using the criteria outlined in the section. The vendor’s response should address each of the following elements:

12.1.1. Cost Reasonableness: The price quoted by the vendor should be consistent with the government’s IGCE and not contain unnecessary items or services.

12.1.2. Technical Accuracy of Requested Enhancements: The new software functionality should be consistent and complete all the requirements outlined in the User Story Outlines and requirements identified n Appendix A. The vendor will create and deploy the new functionality to the test version of the system. Once deployed to the testing environment, NIH will identify individuals to verify the new functionality is in line with the User Story Outlines and requirements identified in Appendix A. Any deviations from the outlined User Story Outlines and requirements must be remedied by the vendor at no additional cost.

Once the NIH confirms that the new functionality meets all requirements, it will then be deployed to the production environment for use in supporting daily operations.

12.1.3. Timeliness of Software Deployment: The vendor and NIH will agree to an established schedule and timeline for software deployments. Appendix B of this document has the current schedule previously identified. Any deviations from this schedule must be agreed to in writing by both the vendor and NIH.

13. SECURITY MATTERS

13.1. Confidentiality and Rights of Data

Duplication or disclosure of the data and other information to which the Contractor will have access as a result of this SOW is prohibited. It is understood that throughout performance of this SOW, the Contractor may have access to confidential data that either is the sole property of the Department of Health and Human Services (DHHS) /National Institutes of Health or is the sole property of other than the contracting participant.

The Contractor and its subcontractor(s) (if any) agree to maintain the confidentiality of all data to which access may be gained throughout performance, whether title thereto vests in the DHHS or otherwise. The Contractor and its subcontractor(s) (if any) agree to not disclose said data, any interpretations and/or translation; there of or data derivative there from, to unauthorized parties in contravention of these provisions, without the prior written approval of the CO or the party in which title thereto is wholly vested. Subcontractors are subject to the same stipulations and may be held responsible for any violations of confidentiality.

During the performance of this SOW, the Contractor (and its subcontractors) may gain access to information protected by the Privacy Act of 1974. The Contractor (and its subcontractors) shall comply with Privacy Act of 1974, in addition to the duplication and disclosure requirements noted above, for all information protected by the Privacy Act of 1974. All Contractor personnel and subcontractors are required to complete a Confidentiality Certificate and a Non-Disclosure Certificate upon execution of this SOW.

The Contractor agrees that upon completion (or termination with or without cause) of this SOW issued hereunder, it shall have no property or possessor rights to any of the correspondence, files, or materials of whatever kind or description, or any copies or duplicates of such, whether developed or prepared by it or furnished to it by the Government in connection with the performance of the SOW; and that upon demand it shall surrender immediately to the CO such items, matters, materials, and copies.

The Contractor shall not provide any Government documents, information or licensed material in any form to sources not authorized by the Government, during or after performance of this SOW without the written approval of the COR.

All data/information first produced as a result of performing under this SOW shall become the Federal Government’s property and the Contractor shall surrender any and all rights to its ownership. To this end, the Contractor hereby agrees to accept the terms and conditions of Federal Acquisition Regulation (FAR) clause 52.227-17, Rights in Data -Special Works (June 1987) which is incorporated into this SOW by reference. For purposes of this SOW, the FAR 52.227-17, Rights in Data -Special Works (June 1987) clause supersedes the FAR 52.227- 14, Rights in Data- General (June 1987) clause.

The Contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information:

• 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

• 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

• Public Law 96-511 (Paperwork Reduction Act)

• Contractor-Employee Non-Disclosure Agreements: Each Contractor employee who may have access to sensitive information under this contract shall complete the attachment entitled, "Commitment to Protect Non-Public Information -Contractor Agreement," which is available at: http://irrn.cit.nih.gov/security/Nonndisclosure.pdf

A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the COR prior to performing any work under SOW.

13.2. Information Technology Systems

The Contractor agrees to comply with the NIH Information Technology systems security and/or privacy specifications set forth herein; the Computer Security Act of 1987; Office of Management and Budget (OMB) Circular A-130, Appendix III, "Security of Federal Automated Information Systems," and the DHHS Automated Information Systems Security Program (AISSP) Handbook. The Contractor further agrees to include this provision in any subcontract awarded pursuant to this SOW. Failure to comply with these requirements shall constitute cause for termination.

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of the SOW. The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment. In addition, during all activities and operations on Government premises, the Contractor shall comply with DHHS, including NIH rules of conduct.

The Contractor shall assure that each employee has completed the NIH Computer Security Awareness Training (http://irtsectraining.nih.gov) prior to performing any work under this contract. The Contractor shall maintain a listing by name and title of each individual working under this SOW that has completed the NIH required training. Any additional security training completed by Contractor staff shall be included on this listing.

14. OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS

Final approval and acceptance of products required herein shall be by letter of approval and acceptance by the COR. The Contractor shall not construe any letter of acknowledgment of receipt of products as a waiver of review, or as an acknowledgment that a product is in conformance with this work statement. Any approval given during preparation of a product, or approval for shipment shall not guarantee the final acceptance of the completed product.

The Federal Acquisition Regulations (FAR) Section 508 requires that Federal agencies' electronic and information technology be accessible to people with disabilities. The Federal Acquisition Regulations (FAR) Final Rule for Section 508 (Accessibility) can be found at: http://www.section508.gov. All systems and services developed under this SOW will be Section 508 compliant. If any Other Direct Costs for compliance are anticipated, the Contractor shall identify them in a report to the COR. For existing systems, the Contractor may not be able to identify all Other Direct Costs for compliance if the Contractor did not develop that system but should state that any development performed during this SOW will be compliant.

14.1. Clauses Incorporated by Reference, FAR 52.252-2 (February 1998)

This SOW incorporates the following clause(s) by reference, with the same force and effect as if it were given in full text. Upon request, the CO will make their full text available. Also, the full text of the clauses may be accessed electronically at this address: http://www.acquisition.gov/far/index.html.

• 52.246-1 Contractor Inspection Requirements APR 1984

• 52.246-2 Inspection of Supplies - Fixed Price AUG 1996

• 52.246-4 Inspection of Services - Fixed Price AUG 1996

• 52.246-16 Responsibility for Supplies - Fixed Price APR 1984 http://www.section508.gov/

APPENDIX A – User Story Outline

VMP User Story with Acceptance Crit

APPENDIX B – Timeline Schedule by Release

End of Document