Statement of Work Maintenance Agreement for Autostainers.pdf

123A9423Q0017

US Department of Agriculture (USDA)

Statement of Work for

RFQ 123A9423Q0017

Contents Project General Information

1.0 Scope of Work

2.0 Background

Contractor Requirements

3.0 Technical Requirements / Tasks

4.0 Government Furnished

5.0 Deliverables / Schedule

6.0 Travel

7.0 Contractor’s Key Personnel

8.0 Security Requirements

9.0 Data Rights

10.0 Section 508 – Electronic and Information Technology Standards Attachment

Project Statement of Work for Maintenance Agreement for two Epredia autostainers

General Information

1.0 Scope of Work

This Statement of Work is for a maintenance agreement covering the two Epredia (formally known as Thermo Fisher Scientific) Autostainers used by the Pathology Branch of USDA, FSIS, OPHS, Eastern Lab located at Richard B. Russell Research Center (RRC), 950 College Station Road, Athens, GA 30605.

2.0 Background

Two Epredia autostainers were purchased by the Pathology Branch in 2020 for immunohistochemistry (in particular for the Advanced Meat Recovery (AMR) sampling project). A maintenance agreement for preventative maintenance (PM) and repairs is necessary to maintain this equipment for diagnostic purposes.

Equipment to be covered:

Epredia Autostainer 360 - Serial Number AS5924A2003

Epredia Autostainer 360 - Serial Number AS6036A2007

Contractor Requirements

3.0 Technical Requirements / Tasks

3.1 Preventative Maintenance:

3.1.1 The contractor shall provide one (1) PM annually for each of the two (2) autostainers.

Preventative maintenance (PM) and repairs shall be in accordance with Epredia/Richard-Allen Scientific, LLC recommendations for the equipment and software.

3.1.2 A written report will be issued by the contractor on the state of this equipment and on all preventive maintenance provided. Such reports will be provided as hard copies or via email within five

(5) calendar days of preventive maintenance.

3.1.3 The contracted work shall be done by a factory-trained representative with current/updated training.

3.2 Service:

3.2.1 The contractor shall provide service as needed annually for the two (2) autostainers.

3.2.2 The contract shall cover cost of repair, labor and travel expenses whenever repair services are needed.

3.2.3 Repairs shall be performed on-site or at the company’s location.

3.2.4 All shipping charges shall be covered for the instrument when applicable.

3.2.5 Parts and materials used for repairs/maintenance shall be new or refurbished by manufacturer’s specifications.

3.2.6 A written report will be issued by the contractor on the state of this equipment and on all service provided. Such reports will be provided as hard copies or via email within five (5) calendar days of service.

3.2.7 The contracted work shall be done by a factory-trained representative with current/updated training.

3.3 Communication:

3.3.1 The contractor shall provide the names of all employees or sub-contracted personnel who will require access to RRC to perform equipment PM or repair. Visits should be scheduled through the Pathology branch chief or technicians, including date and approximate time of arrival, at least 24 hours in advance of work being performed. Service personnel provided by the contractor must have valid picture identification to be allowed onto the premises.

3.3.2 On-site technical contacts shall be the Pathology Branch technicians (or staff Pathologist / Branch Chief). It should be known that laboratory personnel authority is limited to technical issues.

The authority to make contractual decisions, to resolve monetary issues or contractual interpretation is the responsibility of the Contracting Officer.

Service hours for maintenance or repair services shall be provided during normal working hours, 8:00am to 5:00pm EST, Monday through Friday, excluding Federal Holidays (see http://www.opm.gov/Fedhol/ for a listing of the Federal Holidays).

4.0 Government Furnished

The autostainers are housed at the Eastern Lab located at Richard B. Russell Research Center (RRC), 950 College Station Road, Athens, GA 30605. The contractor shall provide the names of all employees or sub-contracted personnel who will require access to RRC to perform equipment PM or repair. Visits should be scheduled through the Pathology technicians, including date and approximate time of arrival, at least 24 hours in advance of work being performed. Service personnel provided by the contractor must have valid picture identification to be allowed onto the premises.

Service hours for maintenance or repair services shall be provided during normal working hours, 8:00am to 5:00pm EST, Monday through Friday, excluding Federal Holidays (see http://www.opm.gov/Fedhol/ for a listing of the Federal Holidays).

LEGAL HOLIDAYS (DEC 2008)

(a)The Federal Government observes the following days as holidays.

New Year’s Day January 1st*

Martin Luther King’s Birthday Third Monday in January

Presidents’ Day Third Monday in February

Memorial Day Last Monday in May

Juneteenth Third Monday in June

Independence Day July 4th*

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans’ Day November 11th

Thanksgiving Day Fourth Thursday in November

Christmas Day December 25th* http://www.opm.gov/Fedhol/ http://www.opm.gov/Fedhol/

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

(b) In addition to the days designated above as holidays, the Government may observe additional days in accordance with 5 USC 6103.

On-site technical contacts shall be the Pathology Section technicians (or a pathologist or pathology Branch Chief). It should be known that laboratory personnel authority is limited to technical issues. The authority to make contractual decisions, to resolve monetary issues or contractual interpretation is the responsibility of the Contracting Officer.

5.0 Deliverables / Schedule

• Timely scheduled technical support such as annual preventative maintenance or repairs when requested is essential to successful completing this requirement. Schedules for deliverables are specified in Exhibit A. Once completed, a service report should be completed and sent within 5 calendar days from date of service.

Exhibit A

Key Deliverables Item No. Deliverable Objective Due 1 Preventative

Maintenance To minimize down time, unexpected repairs and optimize equipment function

Annually during service maintenance agreement

2 Service Repairs To repair equipment that is no longer functioning appropriately

Within 48hrs of service request

3 Service Reports To provide written communication pertaining to the service

Within 5 calendar days from date of service

6.0 Travel

All travel and shipping charges associated with preventative maintenance and service should be included in the contract and should be covered by the contractor.

7.0 Contractor’s Key Personnel

The contracted work shall be done by a factory-trained representative with current/updated training. Services shall be performed by fully trained and competent personnel in accordance with industry standards.

8.0 Security Requirements

For onsite support, the contractor shall provide the names of all employees or sub-contracted personnel who will require access to RRC to perform equipment PM or repairs. Visits should be scheduled through the Pathology technicians or pathology branch chief, including date and approximate time of arrival, at least 24 hours in advance of work being performed. Service personnel provided by the contractor must have valid picture identification to be allowed onto the premises.

Prior to performing services under this contract, all contractor employees requiring routine physical access to Federally-controlled facilities or routine access to Federally-controlled information systems must go through an FSIS identity proofing and registration process, and must have been successfully identity proofed, and have a successfully adjudicated National Agency Check with (Written) Inquiries (NACI) or Office of Personnel Management (OPM)/National Security (NS) Background Investigation (BI) to serve on this contract. Further, any Contractor employee having access to Departmental investigation information will need at least a level of trust background investigation.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in the Computer Security Act of 1987; Office of Management and Budget (OMB) Circular A-130; and the Federal Information Security Management Act of 2002 (FISMA).

Pursuant to FSIS policy, the Contractor shall be responsible for assuring that each Contractor employee has completed training in Computer Security Awareness prior to performing any task order work. The Contractor shall be required to maintain a listing of all individuals who have completed this training and submit this listing to the COR with a copy to the Contracting Officer.

The Contractor shall be responsible for properly protecting any Government property provided for use in this effort and all Government data and information used, gathered or developed as a result of this SOW and will treat this information as sensitive. The Contractor shall establish and implement appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment. The Contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect government information. The Contractor shall forward any requests for such information to the COR.

Contractor personnel shall not associate (wireless) or otherwise connect any non-Government approved devices to a Government network.

Contractor personnel shall not disconnect a network-connected Government IT device or connect a Government IT device to a Government network, if not already connected, without explicit approval from laboratory IT support staff.

Before connecting any external storage devices or media (e.g., DVD, CD, flash drives, external USB drives, etc.) to a Government computing device (e.g., laboratory instrument controller PC or instrument with embedded computer), whether Government owned or leased, contractor personnel shall present the storage device or media to local IT support staff for malware scanning. Only devices/media determined by the Government to be malware free may be connected to Government computing devices.

Contractor personnel, as applicable and as determined by the COR, shall sign a non-disclosure agreement.

NON-DISCLOSURE REQUIREMENTS

If the contractor acts on behalf of, or provides advice with respect to any phase of an agency procurement, as defined in FAR 3.104-4, then the contractor shall ensure that all its personnel (to include subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the TO:

a. Execute and submit a Corporate Non-Disclosure Agreement (NDA) Form (Attachment A) and submit to the CO, prior to the commencement of any work on the TO, and

b. Are instructed in the FAR 3.104 requirements for disclosure, protection, and marking of contractor bid or proposal information, or source selection information.

All proposed replacement contractor personnel also must submit an NDA and be instructed in the requirements of FAR 3.104. Any information provided by contractors in the performance of this TO or obtained by the Government is only to be used in the performance of the TO. The contractor shall put in place appropriate procedures for the protection of such information and shall be liable to the Government for any misuse or unauthorized disclosure of such information by its personnel, as defined above.

9.0 Data Rights

ACCESS TO SENSITIVE INFORMATION (FEB 2007)

(a) As used in this clause, “sensitive information” refers to information that a contractor has developed at private expense, or that the Government has generated that qualifies for an exception to the Freedom of Information Act, which is not currently in the public domain, and which may embody trade secrets or commercial or financial information, and which may be sensitive or privileged.

(b) To assist the U. S. Department of Agriculture (USDA), Food Safety and Inspection Service (FSIS) in accomplishing management activities and administrative functions, the Contractor shall provide the services specified elsewhere in this contract.

(c) If performing this contract entails access to sensitive information, as defined above, the Contractor agrees to -

(1) Utilize any sensitive information coming into its possession only for the purposes of performing the services specified in this contract, and not to improve its own competitive position in another procurement action.

(2) Safeguard sensitive information coming into its possession from unauthorized use and disclosure.

(3) Allow access to sensitive information only to those employees that need it to perform services under this contract.

(4) Preclude access and disclosure of sensitive information to persons and entities outside of the Contractor’s organization.

(5) Train employees who may require access to sensitive information about their obligations to utilize it only to perform the services specified in this contract and to safeguard it from unauthorized use and disclosure.

(6) Obtain a written affirmation from each employee that he/she has received and will comply with training on the authorized uses and mandatory protections of sensitive information needed in performing this contract.

(7) Administer a monitoring process to ensure that employees comply with all reasonable security procedures, report any breaches to the Contracting Officer, and implement any necessary corrective actions.

(d) The nature of the work on this contract may subject the Contractor and its employees to a variety of laws and regulations relating to ethics, conflicts of interest, corruption, and other criminal or civil matters relating to the award and administration of government contracts. Recognizing that this contract establishes a high standard of accountability and trust, the Government will carefully review the Contractor’s performance in relation to the mandates and restrictions found in these laws and regulations. Unauthorized uses or disclosures of sensitive information may result in termination of this contract for default, or in debarment of the Contractor for serious misconduct affecting present responsibility as a government contractor.

(e) The Contractor shall include the substance of this clause, including this paragraph (e); suitably modified to reflect the relationship of the parties, in all subcontracts that may involve access to sensitive information.

10.0 Section 508 – Electronic and Information Technology Standards

(1) Section 508 – Accessibility of Information and Communications Technology

This contract vehicle is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 749d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). The Revised Section 508 Standards, which consist of 508 Chapters 1 and 2 (Appendix A), along with Chapters 3 through 7 (Appendix C), contain scoping and technical requirements for information and communication technology (ICT) to ensure accessibility and usability by individuals with disabilities. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

Each ICT product or service furnished under this contract shall comply with the Revised Section 508 ICT Accessibility Standards at a minimum, as specified in the contract. If any furnished product or service is determined to be noncompliant, the Contracting Officer will notify the Contractor in writing. The Contractor shall, without charge to the Government, remediate or replace the noncompliant products or services within a specified timeframe as determined by the Government in writing. If such remediation or replacement is not completed within the time specified, the Government shall have the following recourses:

1) Cancellation of the contract, delivery, task order, purchase, or line item without termination liabilities; or

2) In the case of custom ICT being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

The contractor must ensure all noncompliant ICT products and services are provided pursuant to extensive market research and exhibit the highest level of compliance while satisfying the contract requirements.

For every ICT product or service accepted under this contract by the Government that does not comply with the Revised Section 508 Accessibility Standards, the contractor shall, at the discretion of the Government, remediate or upgrade the item with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

(2) Section 508 Compliance Vendors, contractors, and their respective ICT products and services shall comply with the following standards, policies, and procedures. In the event of conflicts between the referenced documents and this contract vehicle, the contract vehicle shall take precedence.

1) Revised Section 508 ICT Accessibility Standards

2) Section 508 of the Rehabilitation Act as amended (29 U.S.C. 794d)

3) Federal Acquisition Regulation (FAR) Subpart 39.2

4) USDA Section 508 Departmental Regulation

Additionally, all contract deliverables are subject to these standards.

All ICT products and services, regardless of format, must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities equivalent access to and use of information and data provided to those without disabilities.

All contractors, sub-contractors, and consultants are responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced https://www.access-board.gov/ict/#about-the-ict-accessibility-standards https://www.access-board.gov/law/ra.html#text-of-section-508-of-the-rehabilitation-act-of-1973-as-amended-29-usc-794d https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_2.html http://www.ocio.usda.gov/document/departmental-regulation-4030-001 policy or standards document. Remediation of any noncompliant ICT or materials as set forth in this contract vehicle shall be the responsibility of the contractor, sub-contractor, or consultant.

According to the Access Board’s Section 508 Scoping Requirements The following Section 508 provisions apply to the products and/or services identified in this contract vehicle:

• C202 Functional Performance Criteria: Where the requirements in Chapters 4 and 5 do not address one or more functions of telecommunications or customer premises equipment, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.

• C203 Electronic Content: Electronic content that is integral to the use of telecommunications or customer premises equipment shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.

• C204 Hardware: Where components of telecommunications equipment and customer premises equipment are hardware, and transmit information or have a user interface, those components shall conform to applicable requirements in Chapter 4.

• C205 Software: Where software is integral to the use of telecommunications functions of telecommunications equipment or customer premises equipment and has a user interface, such software shall conform to C205 and the applicable requirements in Chapter 5.

WCAG Conformance: User interface components, as well as the content of platforms and applications shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.

• C206 Support Documentation and Services: Where support documentation and services and provided for telecommunications equipment and customer premises equipment, manufacturers shall ensure that such documentation and services conform to Chapter 6 and are made available upon request at no additional charge.

In addition, vendors and contractors shall comply with the standards, policies, and procedures below for all ICT pursuant to this contract:

• For Custom ICT Development Services, the vendor or contractor shall ensure the ICT fully conforms to the applicable Revised Section 508 standards prior to delivery and before final acceptance.

• For Installation, Configuration, and Integration Services, the vendor or contractor shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised Section 508 standards.

• For Maintenance, Upgrades, and Replacements, the vendor or contractor shall ensure maintenance upgrades, substitutions, and replacements do not reduce the original level of conformance with the applicable Revised Section 508 standards at the time of the contract award.

• Service Personnel are ensured by the vendor or contractor to possess the knowledge, skills, and ability necessary to address the applicable Revised Section 508 standards and shall provide supporting documentation upon request.

• When providing Hosting Services, the vendor or contractor shall not reduce the existing level of conformance of the electronic content with the applicable Revised Section 508 standards.

• When purchasing ICT where 1) Section 508 validation is not possible prior to award, 2) the ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the vendor or contractor shall test and validate the ICT solution for conformance to the Revised Section 508 standards, in accordance with the required testing methods as defined by the agency.

• The vendor or contractor shall document and maintain information regarding the measures taken to ensure compliance with the applicable requirements. This documentation includes but is not limited to testing records, product demonstrations, and reported defects by end users and testers.

• Prior to acceptance, the vendor or contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, and/or configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary https://www.access-board.gov/ict/#508-chapter-2-scoping-requirements https://www.access-board.gov/ict/#C202-functional-performance-criteria https://www.access-board.gov/ict/#C203-electronic-content https://www.access-board.gov/ict/#C204-hardware https://www.access-board.gov/ict/#C205-software https://www.access-board.gov/ict/#C206-documentation-services https://www.section508.gov/sell/vpat

Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by the ITI.

Note: A supplemental ACR may be required if the agency has additional or stricter accessibility requirements than what is outlined in the VPAT.

• Prior to acceptance, the agency reserves the right to require a full working demonstration of the completed ICT item to demonstrate conformance to the agency’s accessibility requirements in addition to independent testing to validate.

• In the case of non-compliance where the vendor or contractor claims its products and/or services satisfy the applicable Revised Section 508 standards specified in the contract vehicle, the contracting officer will promptly inform the vendor or contractor in writing of the non-compliance. The vendor or contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

All Information and Communications Technology (ICT) subject to the Revised Section 508 standards will be evaluated for Section 508 conformance and usability. The test must be administered by a Federal Section 508 Testing Center. All maintenance for ICT that requires upgrades, modifications, installations, repairs, and purchases shall adhere to the Revised Section 508 standards.

COMPLIANCE WITH INTERNET PROTOCOL VERSION 6 (IPv6) (FEB 2007)

This contract involves the acquisition of Information Technology (IT) that used Internet Protocol (IP) technology. In order to comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (lPv6) issued on August 2, 2005, the following condition is included in this solicitation. The contractor agrees that: (1) all deliverables that involve IT that uses IP (products, services, software, etc.) will comply with IPv6 standards and interoperate with both IPv6 and IPv4 systems and products; and (2) it has IPv6 technical support for development and implementation and product management available. If the contractor plans to offer a deliverable that involves IT that is not initially compliant, the contractor agrees to:

(1) obtain the Contracting Officer's approval before starting work on the deliverable; (2) provide a commitment to upgrade to IPv6 for all applications and product features by June 2008; and (3) have IPv6:

technical support available.

BIO PREFERRED PRODUCTS

The Contractor must comply with the Farm Security and Rural Investment Act of 2002 (FSRIA), 7 U.S.C.

8102; the Food, Conservation and Energy Act of 2008 (FCEA), 7 U.S.C. 8102; the Federal Acquisition Regulation; Executive Order (EO) 13514, “Federal Leadership in Environmental, Energy and Economic Performance,” dated October 5, 2009; EO 13423, “Strengthening Federal Environmental, Energy, and Transportation Management,” dated January 24, 2007; and Presidential Memorandum, “Driving Innovation and Creating Jobs in Rural America through Bio based and Sustainable Product Procurement,” dated February, 2012 to provide bio based products.

INFORMATION TECHNOLOGY SYSTEMS SECURITY (SEPT 2013)

The activities covered under by this contract shall require the Contractor’s access to Federal Automated Information System or systems, as well as the implementation of new systems. The Offeror’s proposal must include:

(3) A detailed outline (commensurate with the size and complexity of the Performance Work Statement) of its present and proposed information technology systems security program. The https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility http://www.itic.org/policy/accessibility response must demonstrate that it complies with the security requirements of the PW,S the Federal Information Security Management Act of 2002 (FISMA, Public Law 107-347, 44 U.S.C.

3531-3536); Office of Management and Budget (OMB) Circular A-130, Appendix III “Security of Federal Automated Information Systems” (http://www.whitehouse.gov/omb/circulars_a130_a130appendix_iii) and an acknowledgement of its understanding of the security requirements of the SOW.

(4) A signed copy of the USDA FSIS IT Rules of Behavior (Attachment B) shall be included with the Offeror’s proposal.

INFORMATION TECHNOLOGY SYSTEMS SECURITY CONTRACT REQUIREMENTS (JAN 2012)

The contractor shall establish and implement appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The contractor shall comply with IT systems security and/or privacy specifications set forth in FSIS and USDA directives, policy, and procedures; the Computer Security Act of 1987; Office of Management and Budget (OMB) Circular A-130; and the Federal Information Security Management Act of 2002 (FISMA).

Pursuant to FSIS policy, the contractor shall be responsible for assuring that each contractor employee who requires routine unaccompanied physical access to a Federally-controlled facility and/or unaccompanied access to a Federally-controlled information system, including an FSIS-issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten (10) calendar days of an individual starting work on this contract.

Attachment

ATTACHMENT A

CONFIDENTIALITY AND NON-DISCLOSURE STATEMENT

(Name: _)

I understand that in connection with my performance on this contract/purchase/task order No.

. I may acquire or have access to information relating to any and all aspects of the acquisition.

I, , hereby certify that I will not knowingly disclose or reveal to any representative of any governmental entity, business organization, other entity, or any individual person [except persons specifically authorized by the Contracting Officer (CO)], either within or outside the United States Department of Agriculture, Food Safety and Inspection Service, any aspect of the acquisition. I may have access to:

a. Extremely sensitive business or acquisition-related information, strategic planning documents, and other information relating to the United States Department of Agriculture (USDA), Food Safety and Inspection Service (FSIS) program and initiatives;

b. Data and information in the possession of the Government for which the Government’s right to use and disclose any of the data and/or information is restricted, of which may be of a nature that its dissemination or is other than in the performance of this contract/purchase order, would be adverse to the interest of the United States Government, the privacy of the United States citizens or other parties;

c. Information labeled as “Limited Official Use Only,” “Official Use Only,” or “Sensitive Security Information,” which is disclosed only for the purpose of carrying out one or more provision of this contract/purchase order; and,

d. Information covered by the Privacy Act of 1974.

Except as specifically authorized by the CO, release of such information is not authorized. I agree that this obligation shall continue both during the period of my current participation and thereafter. In the event that I release any information described above or become aware that such information has been released by someone else, I agree to promptly notify the CO. Having knowledge of information that has been released to someone else (and not reporting the incident) may also result in the termination of my participation in the acquisition. When advising the CO, I will provide the CO with the following information: (1) the business organization or other entity, or individual person, to whom the information in question was divulged, (2) the identity of the person that disclosed the information, and (3) the content of the information.

These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information,

(2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.

These restrictions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights or liabilities created by Executive Order No. 12958; section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military): Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act of 1989 (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 U.S.C. 421 et seq.) (governing disclosures that could expose confidential Government agents), and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 U.S.C. Section 783(b)). The Definitions, requirements, obligations, rights, sanctions and liabilities created by said Executive Order and listed statutes are incorporated into this Agreement and are controlling.

I acknowledge that the unauthorized release of information may result in the termination of my participation in this acquisition. I am aware that conduct constituting a violation of such information may subject me to criminal penalties, civil penalties, and/or administrative actions with the same enforceability set forth in 41USC423(e) and as prescribed at FAR 3.104 – Procurement Integrity.

I have read and understand the above requirements.

Company:

Print Name/Signature:

Title:

Date:

ATTACHMENT B

RULES OF BEHAVIOR

Food Safety and Inspection Service (FSIS) Information Technology (IT) Security Rules of Behavior for Privileged Users Version 2.0

INTRODUCTION PURPOSE

The intent of the FSIS Rules of Behavior (ROB) for Privileged Users is to recognize the additional responsibilities associated with special access to, and/or privileges associated with, computer resources within the Department or its offices/bureaus/components. The ROB for Privileged Users are in addition to the Computer System User IT Security General ROB to which all DOJ users are subject. The identification of these responsibilities originates in OMB A-130 and is included in the FSIS IT Security Standards.

“Privileged User” defined:

A privileged user is someone authorized access to departmental/office/bureau/component computer resources when that access provides the capability to alter the properties, behavior or control of the information system/network. It includes, but is not limited to, any of the following types of access:

a. “Super user,” “root,” or equivalent access, such as access to the control functions of the information system/network, administration of user accounts, etc.

b. Access to change control parameters (e.g., routing tables, path priorities, addresses) of routers, multiplexers, and other key information system/network equipment or software.

c. Ability and authority to control and change program files, and other users’ access to data.

d. Direct access to operating system level functions (also called unmediated access) that would permit system controls to be bypassed or changed.

e. Access and authority for installing, configuring, monitoring or troubleshooting the security monitoring functions of information systems/networks (e.g., network/system analyzers; intrusion detection software; firewalls) or in performance of cyber/network operations.

Who is covered by these rules?

These rules extend to all privileged users (FSIS employees and contractors) who use any computing resources that support the mission and functions of the Food Safety and Inspection Service. All privileged users will review and provide signature or electronic verification to these rules annually, or upon change of assigned responsibilities, whichever occurs first.

What are the penalties for Noncompliance?

Compliance with these rules will be enforced through sanctions commensurate with the level of infraction.

Actions may include a verbal or written warning, removal of system access for a specific period of time, reassignment to other duties, or termination, depending on the severity of the violation. In addition, activities that lead to or cause the disclosure of classified information may Result in criminal prosecution under the U.S. Code, Title 18, Section 798, and other applicable statutes.

Complying Privileged Users will:

RESPONSIBILITIES

1. Understand that it is their responsibility to comply with all security measures necessary to prevent the unauthorized disclosure, modification, or destruction of information; follow appropriate system security policies, guidelines and procedures

2. Agree to the FSIS General Rules of Behavior.

3. Minimize exposure and risk by utilizing a separate account to perform privileged functions from general user functions.

4. Not establish or reset any account utilizing the same password for more than one account, and will not provide the user name and password at the same time through the same medium.

5. Grant read or write authority no higher than is granted to him/her (e.g., a component level user administrator shall not assign department level access to another user administrator).

6. Access application programs only for the purpose of creating or maintaining files.

7. Not make modifications to system configurations that could impact availability or security of the system without the approval of the Change Control Board and/or change management process.

8. Not perform general user activities under the same account (user name and password) due to the security requirement for separation of duties.

9. Protect all passwords from unauthorized disclosure.

10. Not share accounts with another privileged user.

11. Make the system available at any time to the SAISO for inspection and review of audit logs.

12. Grant only read-only access to audit files to the Security Auditor; grant access to general system information only if a need-to-know is established and authorization is received from the ISSO.

13. Make the computer(s) available for periodic reviews of the security configuration by independent testers

14. Make changes to system configuration as directed to meet Vulnerability and Patch Management requirements.

15. Immediately record and report any security incidents to the ISSPM.

I acknowledge and understand the responsibilities associated with my role as a Privileged User, and I will comply with the February 10, 2006, Privileged User Rules of Behavior. The Statement of acknowledgement can be provided via email.

Typed Name

Signature Date