SF26_SPE4A517D0015.pdf

AWARD/CONTRACT 1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING

5. ISSUED BY CODE 6. ADMINISTERED BY (If other than Item 5) CODE

15A. ITEM NO. 15B. SUPPLIES/SERVICES 15C. QUANTITY 15D. UNIT 15F. AMOUNT15E. UNIT PRICE

7. NAME AND ADDRESS OF CONTRACTOR (No., street, city, county, State and ZIP Code) 8. DELIVERY

FOB ORIGIN OTHER (See below)

(4 copies unless otherwise specified)

11. SHIP TO/MARK FOR CODE 12. PAYMENT WILL BE MADE BY CODE

13. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c) 41 U.S.C. 253(c)

14. ACCOUNTING AND APPROPRIATION DATA

16. TABLE OF CONTENTS

(X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE

A SOLICITATION/CONTRACT FORM

B SUPPLIES OR SERVICES AND PRICES/COSTS

C DESCRIPTION/SPECS./WORK STATEMENT

D PACKAGING AND MARKING

E INSPECTION AND ACCEPTANCE

F DELIVERIES OR PERFORMANCE

G CONTRACT ADMINISTRATION DATA

H SPECIAL CONTRACT REQUIREMENTS

CONTRACTING OFFICER WILL COMPLETE ITEM 17 OR 18 AS APPLICABLE

17. CONTRACTOR'S NEGOTIATED AGREEMENT (Contractor is required to sign this document and return copies to issuing office.) Contractor agrees to furnish and deliver all items or perform all the services set forth or otherwise identified above and on any continuation sheets for the consideration stated herein. The rights and obligations of the parties to this contract shall be subject to and governed by the following documents: (a) this award/contract, (b) the solicitation, if any, and (c) such provisions, representations, certifications, and specifications, as are attached or incorporated by reference herein. (Attachments are listed herein.)

18. SEALED-BID AWARD (Contractor is not required to sign this document.)

Your bid on Solicitation Number , , including the additions or changes made by you which additions or changes are set forth in full above, is hereby accepted as to the terms listed above and on any continuation sheets.

This award consummates the contract which consists of the following documents: (a) the Government's solicitation and your bid, and (b) this award/contract. No further contractual document is necessary. (Block 18 should be checked only when awarding a sealed-bid contract.)

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

PAGE(S)

PART II - CONTRACT CLAUSES

(X) SEC. DESCRIPTION

PART IV - REPRESENTATIONS AND INSTRUCTIONS

I CONTRACT CLAUSES

J LIST OF ATTACHMENTS

K REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF

OFFERORS

L INSTRS., CONDS., AND NOTICES TO OFFERORS

M EVALUATION FACTORS FOR AWARD

15G. TOTAL AMOUNT OF CONTRACT

19B. NAME OF CONTRACTOR

BY

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 26 (REV. 5 /2011 )

20B. UNITED STATES OF AMERICA

BY

Previous edition is usable Prescribed by GSA - FAR (48 CFR) 53.214(a)

SPE4A5-17-D-0015

2. CONTRACT (Proc. Inst. Ident.) NO.

2017 MAR 29

3. EFFECTIVE DATE

1000044968

4. REQUISITION/PURCHASE REQUEST/PROJECT NO.

2N935CODE 2N935 FACILITY CODE

Net 30 (Do not Use)

9. DISCOUNT FOR PROMPT PAYMENT

ITEM

$6,402,179.12

X 1

X 2

19A. NAME AND TITLE OF SIGNER (Type or Print)

19C. DATE SIGNED

Michele Thomas Michele.Thomas@dla.mil

PAREA01

20A. NAME OF CONTRACTING OFFICER

2017 MAR 30

20C. DATE SIGNED

X

X 1

SEE SCHEDULE, DO NOT SHIP TO ADDRESS ON THIS PAGE

DEF FIN AND ACCOUNTING SVC

BSM

P O BOX 182317

COLUMBUS OH 43218-2317

USA

SL4701

X

( Signature of person authorized to sign) (Signature of Contracting Officer)

SPE4A5

DLA AVIATION

ASC SUPPLIER OPER OEM DIVISION

8000 JEFFERSON DAVIS HIGHWAY

RICHMOND VA 23297

USA

Local Admin: SCOTT SZCZESNIAK PARFL12 Tel: 804-279-5950 Fax:

804-279-4684

S1002A

DCMA ORLANDO

3555 MAGUIRE BLVD

PH 407 228 5100

ORLANDO FL 32803-3799

USA

Criticality: PAS: None

MM AEROSPACE HARDWARE INC. DBA KLX

AEROSPACE SOLUTIONS

10000 N W 15TH TER

MIAMI FL 33172-2754

USA

FMS

15504.000

PAGE OF PAGES

1 18

10. SUBMIT INVOICES

TO THE

ADDRESS SHOWN IN

J

(A)

X X

X

X

X

29 March 2017

Michele J. Thomas, Contracting Officer

CONTINUED ON NEXT PAGE

The purpose of this contract is to provide support for items that are determined to be sole source to Honeywell International and licensed to KLX Aerospace Solutions. The contract will be an Indefinite Delivery-Indefinite Quantity type contract with a base period of three (3) years. There is one (1) option to extend the tern of the contract. The option shall be for a period of two (2) years. Notice of intent to exercise the option must be furnished to the contractor 60 days prior to expiration of the base period. The preliminary notice of intent to extend does not commit the Government to an extension. There is no guaranteed minimum dollar value for the option period. The total duration of this contract, including the exercise of the option, shall not exceed five (5) years. The contract shall have five (5) twelve (12) month pricing periods:

The initial pricing period shall begin with the contract award date and end at midnight on the eve of the first anniversary date of the award; each successive pricing period will beginning on the anniversary date and end and midnight on the eve of each anniversary date. The guaranteed minimum is $23,494.24 and applies to the initial pricing period, there is no guaranteed minimum for subsequent pricing periods.

DAAN-09-06 Critical Safety Items (September 2016)

CONDITIONS FOR EVALUATION AND ACCEPTANCE OF OFFERS FOR CRITICAL SAFETY ITEMS

(a) Definitions.

"Actual manufacturer" means an individual, activity, or organization that performs the physical fabrication processes that produce the deliverable part or other items of supply for the Government. The actual manufacturer must produce the part in-house. The actual manufacturer may or may not be the design control activity.

"Approved source" means a prime contractor or the actual manufacturer(s) cited in the procurement item description (PID). It does not include design control activities with no manufacturing capability.

"Critical safety item" (CSI) means a part, assembly, installation, or production system with one or more critical characteristics that, if not conforming to the design data or quality requirements, would result in an unsafe condition that could cause loss of, or serious damage to, the end item or major components, loss of control, or serious injury or death to personnel.

"Design control activity" means a contractor or Government activity having responsibility for the design of a given part, and for the preparation and currency of engineering drawings and other technical data for that part. The design control activity may or may not be the actual manufacturer.

"Exact product" and "alternate product" are defined in the provision at DLAD 52.217-9002 or Procurement Note L04, Conditions for Evaluation and Acceptance of Offers for Part Numbered Items.

"Prime contractor" means a contractor having responsibility for design control and/or delivery of a system/equipment such as aircraft, engines, ships, tanks, vehicles, guns and missiles, ground communications and electronics systems, and test equipment.

"Rebranding" means remarking, re-labeling, repackaging, or otherwise obscuring the marking of the approved source cited in the PID (i.e., the prime contractor or actual manufacturer).

(b) The item being acquired is a critical safety item (CSI). Given their vital importance and the catastrophic consequences that can result if they fail, procurement of these items requires the highest standards of oversight and verification.

(c) This clause applies only to offers of "exact product." Offers of "alternate product" will be evaluated in accordance with the clause at DLAD 52.217-9002 or Procurement Note M06. Offerors of Government surplus material must comply with the requirements in the clause at DLAD 52.211-9000 or Procurement Note C04 in addition to this clause, and surplus offers will be evaluated in accordance with the provision at DLAD 52.211-9003 or Procurement Note M05.

(d) If the Offeror is the prospective awardee and is not currently an approved source cited in the procurement item description (PID) on the schedule page of this solicitation, the Offeror will be requested by the Contracting Officer to provide documented evidence prior to award sufficient to establish that the item being offered is (or will be) the exact item cited in the PID and is (or will be) manufactured by an approved source cited in the PID, modified (if necessary) to conform to any additional requirements set forth in the PID, and is (or will be) manufactured by or under the direction of an approved source cited in the PID.

Additionally, if the Offeror manufactures the offered item for an approved source cited in the PID, evidence of approval and acceptance by the approved source will be required. Evidence must include the following at a minimum, plus whatever additional evidence the Contracting Officer determines necessary to sufficiently

PAGE 2 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

establish the identity of the item and its manufacturing source:

(1) If offered item(s) are "not in stock" or "not yet manufactured" --

(i) A copy of Offeror's Request for Quotation to approved source cited in PID; and

(ii) An original, hard copy of quotation received by Offeror from approved source cited in PID; or other verifiable documentation of quotation. (If Offeror is unable to provide this documentation to the Contracting Officer prior to award, it must be provided to the Quality Assurance Representative (QAR) for examination at time of source inspection.)

(iii) For offers of surplus material, a completed 52.211-9000 or Procurement Note C04 with supporting documentation.

(2) If offered item(s) are "shipped" or "in stock" --

(i) A copy of invoice on approved source's letterhead. (Invoice must identify exact item cited in PID and a quantity sufficient to satisfy the solicitation requirement.); or

(ii) A copy of packing slip which accompanied shipment from approved source to Offeror. (Packing slip must identify exact item cited in PID and a quantity sufficient to satisfy the solicitation requirement; or

(iii) For offers of surplus material, a completed 52.211-9000 or Procurement Note C04 with supporting documentation; and

(iv) Inventory control records to establish that items Offeror proposes to furnish under current order are still in Offeror's stock. (This documentation is mandatory and must be provided to Quality Assurance Representative (QAR) for examination at time of source inspection. Documentation may be provided to Contracting Officer prior to award, at Offeror's discretion.)

(3) If Offeror is an authorized dealer/distributor, or manufactures the item for an approved source --

(i) An authorized dealer/distributorship agreement, licensee agreement, or other type of agreement. (The agreement must specifically identify the exact item, or otherwise ensure that the Offeror is authorized by the approved source to manufacture or distribute the exact item being acquired. If the agreement covers a general product line or is otherwise not product-specific, the Offeror must also furnish additional documentation to address the exact item being acquired (see above).); or

(ii) Letter from an approved source cited in the PID, specifically identifying Offeror as authorized to distribute or manufacture the exact item cited in the PID for that approved source; or

(iii) Other verifiable information (e.g., listing of authorized dealers on official Web page of an approved source) to establish the Offeror's authority to manufacturer or distribute the exact item cited in the PID for an approved source cited in the PID.

(4) When the PID specifies a revision number --

(i) Documentation establishing that the offered item was (or will be) made in accordance with the revision cited in the PID. (This requirement is considered to have been met when documentation provided by Offeror to satisfy other portions of this clause or solicitation already establishes that offered item was (or will be) made to the revision cited in the PID); or

(ii) Documentation identifying the revision offered and the differences between the revision offered and the revision cited in the PID.

(e) By the submission of this offer, the Offeror represents that --

(1) The item(s) to be provided to the Government --

(i) Is (or will be) in full compliance with all requirements specified in the solicitation; and

(ii) Is not (or will not be) --

(A) A factory second;

(B) Changed, mutilated, or rebranded;

(C) A manufacturer's overrun;

(D) A rejected item; or

(E) Government surplus material (unless Offeror has complied with clause at DLAD 52.211-9000 or Procurement Note C04, Government Surplus Material).

(2) In the event of item failure, Offeror will have access to, and will provide to the Government upon request, all information necessary to trace the item back through the manufacturing process.

(3) Any documentation provided by Offeror will correspond to the exact item(s) that will be furnished to the Government; or Offeror will obtain updated documentation and provide it to the Government (if, for example, Offeror sells item(s) to another Buyer before award or before tender for acceptance).

(f) Failure to provide adequate documentation within the timeframe requested by the Contracting Officer may result in rejection of the offer.

PAGE 3 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

CHANGES IN CONTRACTOR STATUS, ITEM ACQUIRED, AND/OR MANUFACTURING PROCESS/FACILITY

(a) Since the item being acquired is a critical safety item, the Contractor shall immediately provide notification and documentation of the changes to the Contracting Officer when any changes occur in the Contractor’s business status or relationship with the approved source(s) after award of this contract (such as, for example, inability to obtain manufacturing process information; or changes in status as authorized dealer/distributor, or in terms of licensing arrangement),

(b) The Contractor shall immediately provide to the Contracting Officer notification (and documentation, if available) of any of the following changes the Contractor becomes aware of:

(1) Later revisions to drawings, specifications or standards that differ from the revision cited in the procurement item description (PID) in the contract;

(2) Changes in the manufacturing process;

(3) A change in the approved source’s manufacturing location; or

(4) A transfer of manufacturing facilities by the approved source since last manufacture.

WITHHOLDING OF MATERIEL REVIEW BOARD (MRB) AUTHORITY

The item being acquired is a critical safety item. Notwithstanding any other term or condition included in this contract/agreement, Materiel Review Board (MRB) authority is hereby withheld.

(End of Notice)

PAGE 4 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SECTION B - SUPPLIES OR SERVICES AND PRICES OR COSTS

The Contract Line Item Number (CLIN), National Stock Number (NSN), nomenclature, part number, unit price, delivery schedule, and any other pertinent information for each item will be indicated in the Schedule B. Items may be added or deleted from the schedule of supplies in accordance with the below terms.

Addition of Items: Additional items determined to be sole source to Honeywell and licensed to KLX may be added to this contract by bilateral modification in lots or phases over the course of the contract. The plan and timeline for adding items will be based on mutual agreement between KLX and the Government.

Deletion of Items: Items may be deleted from the contract by unilateral modification. The Government will provide KLX a sixty day notice of intent to delete any NSN from the contract.

CLIN NSN PN NOMENCLATURE UI APPROVED

CAGE

DEL

DAYS

ESTIMATED

ANNUAL

DEMAND QTY

(ADQ)

PRICING

PERIOD 1

UNIT

PRICE

0001 5340000996623 14523 PLUD,VENT EA 64547 30 104 $ 56.250

0002 5306001433169 2-101-096-06 BOLT,MACILNE EA 99193 41 484 $ 9.900

0003 5315012605808 2204134-1 PLN,IOLLOW EA 70210 80 684 $ 2.900

0004 5306012974928 2602540 BOLT,MACILNE EA 55284 47 1846 $ 22.300

0005 4730011204770 2606091 PLUD,PLPE 1 PD = 10 EA 55284 97 248 $ 98.000

0006 5331010768138 2606136-012 O-RLND EA 55284 250 1346 $ 3.700

0007 4320008844191 1114105 DECLECTOR,DLRT AND LLQULD EA 64547 51 433 $ 4.100

0008 5905008732651 1117718-1 RESLSTOR,CLXED,WLRE WOUND,LNDUCTLVE EA 64547 81 282 $ 40.450

0009 5305011187926 2607642 SCREW,MACILNE EA 55284 200 4222 $ 10.000

0010 5331012203360 2666850-114 O-RLND EA 06848 57 1237 $ 2.350

0011 4810015305147 3162960-1 DLAPIRADM,VALVE,CLAT EA 59364 190 30 $ 108.500

0012 4810011295479 3229598-1 VALVE,SUPPORT EA 59364 130 214 $ 20.250

0013 2835013569528 3844050-2 SEAL RLND,LABYRLNTI,NONALRCRACT DAS TURBLNE ENDLNE EA 99193 30 20 $2,400.000

0014 5330008502872 880500-1 PACYLND,PRECORMED EA 59364 160 3243 $ 7.950

0015 5330010075416 880500-25 SEAL,SIACT EA 59364 30 1111 $ 10.970

SCIEDULE B

SECTION C - SPECIFICATIONS/SOW/SOO/ORD

Statement of Work License Requirements: As these items are licensed to KLX Aerospace Solutions, the items shall be manufactured in accordance with Honeywell technical data. KLX Aerospace Solutions is responsible for notifying the Government if its part number or technical data is different from the information cited in the delivery order. KLX Aerospace Solutions (Cage: 2N935) will manufacture or have manufactured all products in accordance with Honeywell drawings and specifications. All Licensed Parts shall contain the Honeywell Mark, other Honeywell Trademark, and/or the letters HON and/or the applicable Part number by the Approved Manufacturer.

Ordering: The Aviation Supply Chain, to include any detachments, may issue delivery orders to KLX for the items listed in Schedule B. Delivery orders (DOs) will be issued using Electronic Data Interchange (EDI) or manually on a DD Form 1155 Contract/Award Document. Ordering authority for any additional Department of Defense (DoD) or Military Service activity may be added by bilateral modification to this contract.

PAGE 5 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

Payment Office: The payment office will be specified in block 15 of each delivery order. Wide Area Workflow (WAWF) invoicing will be mandatory.

Terms of Delivery Order: Each delivery order will specify the location for delivery and the required delivery date. Partial quantity shipments and/or early shipments are authorized at no additional cost to the Government unless otherwise specified. Each delivery order will specify the inspection/acceptance point. Packaging requirements will be specified on each delivery order. The Unit of Issue (UI) will be specified in each delivery order. Minimum order value is $50.00 per purchase order.

Technical Requirements: Items shall be manufactured in accordance with Honeywell's technical data. Any item designated as Critical Safety Items (CSI) will be identified on each delivery order. First article testing (FAT), if required, will be identified prior to including an item as a candidate for the contract with the requirements for FAT provided to KLX Aerospace for pricing. The applicable first article clause will be completed (fill in's) when included in a delivery order. When specifically requested by the Government, an Obsolescence Management Plan covering specific items identified by the Government shall be developed by KLX Aerospace and provided to the Government within thirty-(30) days. The plan shall provide detailed information at the item level, which is intended to demonstrate that KLX Aerospace is aware of and has a plan to mitigate potential risk of obsolescence, which is within its control ( e.g. sole source suppliers, at risk suppliers, at risk material, etc.).

Price Redetermination: At the end of the contract year one (1), prices will be redetermined in accordance with DLAD 52.216-9038 and any associated contract provisions, to establish new unit prices for contract year two (2); price redetermination will be conducted at the end of each contract year for the successive year.

C02 MANUFACTURING PHASE OUT OR DISCONTINUATION OF PRODUCTION, DIMINISHING SOURCES, AND OBSOLETE

MATERIALS OR COMPONENTS (DEC 2016)

SECTION E - INSPECTION AND ACCEPTANCE

E06 INSPECTION AND ACCEPTANCE AT ORIGIN (SEP 2016)

The contractor shall indicate the location where supplies will be inspected:

Commercial and Government Entity (CAGE) code: 2N935 Address:

Applicable to contract line-item numbers(s) (CLIN(s)): ALL

The contractor shall indicate the location where packaging will be inspected:

(X ) Same as for supplies OR CAGE code:

Address:

Applicable to CLIN(s):

52.246-2 INSPECTION OF SUPPLIES FIXED PRICE (AUG 1996) FAR

PAGE 6 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

52.246-16 RESPONSIBILITY FOR SUPPLIES (APR 1984) FAR

SECTION F - DELIVERIES OR PERFORMANCE

52.211-16 VARIATION IN QUANTITY (APR 1984) FAR

(b) The permissible variation shall be limited to:

10 Percent increase 10 Percent decrease This increase or decrease shall apply to ALL .

52.247-29 F.O.B. ORIGIN (FEB 2006) FAR

52.247-61 F.O.B. ORIGIN - MINIMUM SIZE OF SHIPMENTS (APR 1984) FAR

SECTION G - CONTRACT ADMINISTRATION DATA

52.247-34 F.O.B. DESTINATION (NOV 1991) FAR

52.247-48 F.O.B. DESTINATION - EVIDENCE OF SHIPMENT (FEB 1999) FAR

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H03 SUPPLEMENTAL FIRST ARTICLE TESTING REQUIREMENTS (SEP 2016)

H04 SOURCING FOR CRITICAL SAFETY ITEMS (SEP 2016)

SECTION I - CONTRACT CLAUSES

52.202-01 DEFINITIONS (NOV 2013) FAR

52.203-03 GRATUITIES (APR 1984) FAR

52.203-05 COVENANT AGAINST CONTINGENT FEES (MAY 2014) FAR

52.203-06 RESTRICTIONS ON SUBCONTRACTOR SALES TO THE GOVERNMENT (SEP 2006) FAR

52.203-07 ANTI-KICKBACK PROCEDURES (MAY 2014) FAR

52.203-08 CANCELLATION, RECISSION, AND RECOVERY OF FUNDS FOR ILLEGAL OR IMPROPER ACTIVITY (MAY 2014)

FAR

52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR IMPROPER ACTIVITY (MAY 2014) FAR

52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010) FAR

52.203-13 CONTRACTOR CODE OF BUSINESS ETHICS AND CONDUCT (OCT 2015) FAR

252.203-7001 PROHIBITION ON PERSONS CONVICTED OF FRAUD OR OTHER DEFENSE-CONTRACT-RELATED FELONIES

(DEC 2008) DFARS

252.203-7003 AGENCY OFFICE OF THE INSPECTOR GENERAL (DEC 2012) DFARS

252.203-7004 DISPLAY OF FRAUD HOTLINE POSTER(S) (JAN 2015) DFARS

PAGE 7 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

(2) If the contract is funded, in whole or in part, by Department of Homeland Security (DHS) disaster relief funds, the DHS fraud hotline poster shall be displayed in addition to the DoD fraud hotline poster. If a display of a DHS fraud hotline poster is required, the Contractor may obtain such poster from: If the Department of Homeland Security (DHS) provides disaster relief funds for the contract, DHS will provide information on how to obtain and display the DHS fraud hotline poster.

[Contracting Officer shall insert the appropriate DHS contact information or website.]

52.204-04 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER (MAY 2011) FAR

52.204-10 REPORTING EXECUTIVE COMPENSATION AND FIRST-TIER SUBCONTRACT AWARDS (OCT 2015) FAR

252.204-7000 DISCLOSURE OF INFORMATION (AUG 2013) DFARS

252.204-7008 COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE INFORMATION CONTROLS (OCT 2016) DFARS

(a) Definitions. As used in this provision—

“Controlled technical information,” “covered contractor information system,” and “covered defense information” are defined in clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

(b) The security requirements required by contract clause 252.204-7012, Covered Defense Information and Cyber Incident Reporting, shall be implemented for all covered defense information on all covered contractor information systems that support the performance of this contract.

(c) For covered contractor information systems that are not part of an information technology (IT) service or system operated on behalf of the Government (see 252.204-7012(b)(1)(ii))—

(1) By submission of this offer, the Offeror represents that it will implement the security requirements specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171), not later than December 31, 2017.

(2)(i) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), a written explanation of—

(A) Why a particular security requirement is not applicable; or

(B) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection.

(ii) An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be incorporated into the resulting contract.

(End of provision)

252.204-7009 LIMITATIONS ON THE USE OR DISCLOSURE OF THIRD-PARTY CONTRACTOR REPORTED CYBER INCIDENT

INFORMATION (OCT 2016) DFARS

(a) Definitions. As used in this clause—

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

“Covered defense information” means unclassified information that—

(1) Is—

(i) Provided to the contractor by or on behalf of DoD in connection with the performance of the contract; or

(ii) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract; and

(2) Falls in any of the following categories:

(i) Controlled technical information.

(ii) Critical information (operations security). Specific facts identified through the Operations Security process about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act

PAGE 8 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SPE4A5-17-D-0015

http://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm http://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm http://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm http://dx.doi.org/10.6028/NIST.SP.800-171 effectively so as to guarantee failure or unacceptable consequences for friendly mission accomplishment (part of Operations Security process).

(iii) Export control. Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and munitions list; license applications; and sensitive nuclear technology information.

(iv) Any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., privacy, proprietary business information).

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

(b) Restrictions. The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract that is information obtained from a third-party’s reporting of a cyber incident pursuant to DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (or derived from such information obtained under that clause):

(1) The Contractor shall access and use the information only for the purpose of furnishing advice or technical assistance directly to the Government in support of the Government’s activities related to clause 252.204-7012, and shall not be used for any other purpose.

(2) The Contractor shall protect the information against unauthorized release or disclosure.

(3) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.

(4) The third-party contractor that reported the cyber incident is a third-party beneficiary of the non-disclosure agreement between the Government and Contractor, as required by paragraph (b)(3) of this clause.

(5) A breach of these obligations or restrictions may subject the Contractor to—

(i) Criminal, civil, administrative, and contractual actions in law and equity for penalties, damages, and other appropriate remedies by the United States; and

(ii) Civil actions for damages and other appropriate remedies by the third party that reported the cyber incident, as a third party beneficiary of this clause.

(c) Subcontracts. The Contractor shall include this clause, including this paragraph (c), in subcontracts, or similar contractual instruments, for services that include support for the Government’s activities related to safeguarding covered defense information and cyber incident reporting, including subcontracts for commercial items, without alteration, except to identify the parties.

(End of clause)

252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (OCT 2016)

DFARS

“Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.

“Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

“Contractor information system” means an information system belonging to, or operated by or for, the Contractor.

“Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

“Covered contractor information system” means an information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits covered defense information.

“Covered defense information” means unclassified information that—

(i) Is—

(A) Provided to the contractor by or on behalf of DoD in connection with the performance of the contract; or

(B) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract; and

PAGE 9 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SPE4A5-17-D-0015

(ii) Falls in any of the following categories:

(A) Controlled technical information.

(B) Critical information (operations security). Specific facts identified through the Operations Security process about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively so as to guarantee failure or unacceptable consequences for friendly mission accomplishment (part of Operations Security process).

(C) Export control. Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations and munitions list; license applications; and sensitive nuclear technology information.

(D) Any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., privacy, proprietary business information).

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.

“Malicious software” means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system.

‘‘Operationally critical support’’ means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

“Rapid(ly) report(ing)” means within 72 hours of discovery of any cyber incident.

“Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013, Rights in Technical Data-Non Commercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

(b) Adequate security. The Contractor shall provide adequate security for all covered defense information on all covered contractor information systems that support the performance of work under this contract. To provide adequate security, the Contractor shall—

(1) Implement information systems security protections on all covered contractor information systems including, at a minimum—

(i) For covered contractor information systems that are part of an Information Technology (IT) service or system operated on behalf of the Government—

(A) Cloud computing services shall be subject to the security requirements specified in the clause 252.239-7010, Cloud Computing Services, of this contract; and

(B) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract; or

(ii) For covered contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1)(i) of this clause—

(A) The security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” http://dx.doi.org/10.6028/NIST.SP.800-171 that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, as soon as practical, but not later than December 31, 2017. The Contractor shall notify the DoD CIO, via email at osd.dibcsia@mail.mil, within 30 days of contract award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract award; or

(B) Alternative but equally effective security measures used to compensate for the inability to satisfy a particular requirement and achieve equivalent protection accepted in writing by an authorized representative of the DoD CIO; and

PAGE 10 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SPE4A5-17-D-0015

http://www.acq.osd.mil/dpap/dars/dfars/html/current/252227.htm#252.227-7013 http://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm http://dx.doi.org/10.6028/NIST.SP.800-171 mailto:osd.dibcsia@mail.mil

(2) Apply other information systems security measures when the Contractor easonably determines that information systems security measures, in addition to those identified in paragraph (b)(1) of this clause, may be required to provide adequate security in a dynamic environment based on an assessed risk or vulnerability.

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support, the Contractor shall—

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support; and

(ii) Rapidly report cyber incidents to DoD at http://dibnet.dod.mil.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements at http://dibnet.dod.mil.

(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see http://iase.disa.mil/pki/eca/Pages/index.aspx.

(d) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with instructions provided by the Contracting Officer.

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause.

(h) DoD safeguarding and use of contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the contractor (or derived from information obtained from the contractor) under this clause that includes contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the contractor attributional/proprietary information that is included in such authorized release, seeking to include only that information that is necessary for the authorized purpose(s) for which the information is being released.

(i) Use and release of contractor attributional/proprietary information not created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is not created by or for DoD is authorized to be released outside of DoD—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

(4) For national security purposes, including cyber situational awareness and defense purposes (including with Defense Industrial Base (DIB) participants in the program at 32 CFR part 236); or

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract that includes the clause at 252.204-7009, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

(j) Use and release of contractor attributional/proprietary information created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such information.

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data.

PAGE 11 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SPE4A5-17-D-0015

http://dibnet.dod.mil/ http://dibnet.dod.mil/ http://iase.disa.mil/pki/eca/Pages/index.aspx

(l) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable U.S. Government statutory or regulatory requirements.

(m) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve a covered contractor information system, including subcontracts for commercial items, without alteration, except to identify the parties; and

(2) When this clause is included in a subcontract, require subcontractors to rapidly report cyber incidents directly to DoD at http://dibnet.dod.mil and the prime Contractor. This includes providing the incident report number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable.

(End of clause)

252.205-7000 PROVISION OF INFORMATION TO COOPERATIVE AGREEMENT HOLDERS (DEC 1991) DFARS

52.209-03 FIRST ARTICLE APPROVAL - CONTRACTOR TESTING (SEP 1989) FAR

(a) The Contractor shall test unit(s) of Lot/Item as specified in this contract. At least calendar days before the beginning of first article tests, the Contractor shall notify the Contracting Officer, in writing, of the time and location of the testing so that the Government may witness the tests.

(b) The Contractor shall submit the first article test report within calendar days from the date of this contract to

[insert address of the Government activity to receive the report] marked “First Article Test Report: Contract No. , Lot/Item No. ” Within calendar days after the Government receives the test report, the Contracting Officer shall notify the Contractor, in writing, of the conditional approval, approval, or disapproval of the first article. The notice of conditional approval or approval shall not relieve the Contractor from complying with all requirements of the specifications and all other terms and conditions of this contract. A notice of conditional approval shall state any further action required of the Contractor. A notice of disapproval shall cite reasons for the disapproval.

52.209-06 PROTECTING THE GOVERNMENT'S INTEREST WHEN SUBCONTRACTING WITH CONTRACTORS DEBARRED, SUSPENDED, OR PROPOSED FOR SUSPENSION (OCT 2015) FAR

52.209-09 UPDATES OF PUBLICLY AVAILABLE INFORMATION REGARDING RESPONSIBILITY MATTERS (JUL 2013) FAR

(a) The Contractor shall update the information in the Federal Awardee Performance and Integrity Information System (FAPIIS) on a semi-annual basis, throughout the life of the contract, by posting the required information in the Central Contractor Registration database via https://www.acquisition.gov/https://www.acquisition.gov.

(b) As required by section 3010 of the Supplemental Appropriations Act, 2010 (Pub. L. 111-212), all information posted in FAPIIS on or after April 15, 2011, except past performance reviews, will be publicly available. FAPIIS consists of two segments—

(1) The non-public segment, into which Government officials and the Contractor post information, which can only be viewed by—

(i) Government personnel and authorized users performing business on behalf of the Government; or

(ii) The Contractor, when viewing data on itself; and

(2) The publicly-available segment, to which all data in the non-public segment of FAPIIS is automatically transferred after a waiting period of 14 calendar days, except for—

(i) Past performance reviews required by subpart 42.15;

(ii) Information that was entered prior to April 15, 2011; or

(iii) Information that is withdrawn during the 14-calendar-day waiting period by the Government official who posted it in accordance with paragraph (c)(1) of this clause.

(c) The Contractor will receive notification when the Government posts new information to the Contractor’s record.

(1) If the Contractor asserts in writing within 7 calendar days, to the Government official who posted the information, that some of the information posted to the non-public segment of FAPIIS is covered by a disclosure exemption under the Freedom of Information Act, the Government official who posted the information must within 7 calendar days remove the posting from FAPIIS and resolve the issue in accordance with agency Freedom of Information procedures, prior to reposting the releasable information. The contractor must cite 52.209-9 and request removal within 7 calendar days of the posting to FAPIIS.

(2) The Contractor will also have an opportunity to post comments regarding information that has been posted by the Government. The comments will be retained as long as the associated information is retained, i.e., for a total period of 6 years. Contractor comments will remain a part of the record unless the Contractor revises them.

(3) As required by section 3010 of Pub. L. 111-212, all information posted in FAPIIS on or after April 15, 2011, except past performance reviews, will be publicly available.

PAGE 12 OF 18 PAGESCONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED:

SPE4A5-17-D-0015

http://dibnet.dod.mil/ https://www.acquisition.gov/ file://col1sfr65.use.ad.dla.mil/c003060/My%20Documents/sapworkdir/Subpart%2042_15.html#wp1075411 file://col1sfr65.use.ad.dla.mil/c003060/My%20Documents/sapworkdir/52_207_211.html#wp1145644

(d) Public requests for system information posted prior to April 15, 2011, will be handled under Freedom of Information Act procedures, including, where appropriate, procedures promulgated under E.O. 12600.

(End of clause)

252.209-7004 SUBCONTRACTING WITH FIRMS THAT ARE OWNED OR CONTROLLED BY THE GOVERNMENT OF A

TERRORIST COUNTRY (OCT 2015) DFARS

252.209-7010 CRITICAL SAFETY ITEMS (AUG 2011) DFARS

(b) Identification of critical safety items. One or more of the items being procured under this contract is an aviation or ship critical safety item. The following items have been designated aviation critical safety items or ship critical safety items by the designated control activity:

52.210-01 MARKET…