T17SOL10016_Smithsonian_Audio_Tours_RFP.pdf

T17SOL10016

REQUEST FOR PROPOSAL:

AUDIO TOUR PRODUCT FOR SELECT

SMITHSONIAN MUSEUMS

January 24, 2017

Smithsonian Institution

ABOUT SMITHSONIAN

The Smithsonian Institution is a non-profit trust instrumentality of the United States, whose mission is the increase and diffusion of knowledge. Established by an Act of

Congress in 1846, the Smithsonian is the world’s largest museum and research complex consisting of 19 museums and galleries, the National Zoological Park and nine research facilities. Its collections are the basis for research, exhibitions and public programs in the arts, history and culture, and the sciences. Smithsonian Enterprises, the Institution’s retail, media, licensing and consumer products division, offers a range of programs that help to generate funding for Smithsonian’s core mission, museums and research, while remaining consistent with the Smithsonian mission, culture, governance, and status as a trust instrumentality of the United States and a tax-exempt organization.

ABOUT SMITHSONIAN ENTERPRISES

Smithsonian Enterprises (SE), which includes the Institution’s retail, media, consumer products and education products divisions, offers a range of products and services that help to generate funding for Smithsonian’s core mission, museums and research, while remaining consistent with the Smithsonian mission, culture, governance, and status as a trust instrumentality of the United

States and a tax-exempt organization. By providing products and services that reflect the mission of the museums and research centers, Smithsonian Enterprises plays a critical role in advancing the Institution’s mission: the increase and diffusion of knowledge.

ABOUT THE PROJECT

The Smithsonian Institution, in an effort to give our museum visitors the highest quality experience possible, would like to enter into a licensing agreement with a third party company to provide multi-media audio tour services (the “Product”) for its museums, starting with a pilot program at the National Museum of American History (NMAH) located on the National Mall in Washington, D.C.

The overarching goal of this Product is to provide an enhanced, high quality visitor experience for people coming to NMAH or any of the future museums participating in this program (“Future Museums”), using the best content available, as well as the latest multi-media technology. Ideally, the Product would prompt return visitation, word-of-mouth recommendations for the product, and interest in deeper exploration of

Smithsonian content.

The successful offeror will assume all costs of developing, creating, marketing, maintaining, and staffing the Product. The Smithsonian seeks offerors who are leaders in the field with significant and relevant expertise in the creation and operation of successful multi-media audio tours in museums and/or similar attractions. Minimum qualification requirements are set forth in Minimum Qualification Section below.

Although awarding of this program will carry with it the full support of Smithsonian

Enterprises (SE) and select museums, Smithsonian does not guarantee participation from all Smithsonian museums. Only those Smithsonian museums who elect to participate as part of their strategic plans will become part of the audio tour program. Each participating museum would begin with a pilot tour program.

SCOPE OF WORK

The pilot audio tour program will likely include both an overview tour and a tour for at least one special exhibition. Given those parameters, offeror will be required to:

1. Develop a comprehensive strategy for the Product, said strategy to include and be informed by consumer market research, insights, and experience, along with competitive sales analysis, target demographic(s), Product concepts (to include recommendations for the use of multi-media), recommendations/needs for appropriate technology/equipment, and financial goals.

2. Brainstorm with SI/SE staffers regarding parameters, content ideas, and possibilities for the Product in advance of development of Product. Offeror will work with

NMAH staff to determine nature of content, which will draw from existing sources.

3. Develop and produce all scripts for audio tours, in collaboration with SI and SE staff, making full use of content suggested by staff. These scripts might include, but are not required to include, other media such as video, photographs, primary sources, etc.

4. Ensure that any equipment chosen for use is appropriate for heavy use, employs the latest noise reduction technology, and is user friendly.

5. Create and implement a plan for all operational aspects of the Product, to include staffing and management of staff; ongoing maintenance of equipment, replacing units as necessary to maintain a program responsive to visitors’ needs; and managing the POS system, including financial reporting.

a. Plan should include reasonable accommodations for ADA, including but not limited to visual descriptions, neck loops, and mono-buds.

b. Plan should include a mobile-enabled credit card process which is PCI compliant, such as FD 130 with transformer. Must comply with

Smithsonian’s data policies as set forth in Attachment C of this document.

6. Perform Quality Control of final Product, to include testing of equipment, audience flow, POS systems and any other appropriate functions of the Product.

7. Provide ongoing customer and consumer support as needed.

8. With Smithsonian, devise a plan for the periodic updates of Tour content, to include the addition of new and/or special exhibits.

9. Propose a plan for a possible expansion of the Product into languages other than

English if it is determined that such an expansion will enhance the success of the

Product.

10. Develop a comprehensive marketing plan for the launch and ongoing promotion of the Product to include in-museum signage, maps and sales materials, as well as promotion on social media and other media platforms.

11. Provide full reporting on Product revenue and usage metrics on a mutually-agreed-upon schedule.

12. Work with Smithsonian to integrate consumer messaging as appropriate and into

Smithsonian controlled platforms and media.

13. Create a timeline for implementation from dates of final SE approvals to launch.

14. If the successful offeror intends to use Smithsonian collection materials which require 3rd party rights clearances, it is understood that the offeror will be responsible for 3rd party rights clearances, including any costs associated with those clearances.

Smithsonian will advise which items, to the best of its knowledge, have 3rd party rights restrictions.

Offerors should note that:

Strategic plans for additional museums beyond the first shall be executed at each museum’s discretion.

The successful offeror will be required to assume all costs for product development, quality control, marketing, sales, staffing, maintenance, distribution, and customer support.

If the successful offeror intends to utilize Smithsonian collection materials which require 3rd party rights clearances, it is understood that the offeror will be responsible for 3rd party rights clearances, including any costs associated with those clearances. Smithsonian will advise which items, to the best of its knowledge, have 3rd party rights restrictions.

All right, title, and interest, including copyright, in the underlying Smithsonian assets and derivative artwork created from said assets, shall remain with

Smithsonian.

SE anticipates entering into a contract(s) that includes certain “Key Terms and

Conditions,” attached hereto in Attachment B (“Notable Concepts to be Included in Contract”) and incorporated by reference herein. Please read Attachment B carefully, as it contains information essential to the conduct of the project.

SMITHSONIAN ANTICIPATES PROVIDING THE FOLLOWING SUPPORT

AND ASSETS TO THE PROJECT:

1. Access to existing Smithsonian assets and content for use in development of the

Product.

2. Access to Smithsonian experts and curators for brainstorming, guidance, approvals, collaboration and narration as available and needed for development of the Product.

3. Space in the applicable museum lobby or other public area for a kiosk.

4. Storage space, if necessary, for equipment.

5. Wi-Fi for Product but not for transactions.

6. Use of the Smithsonian name and logo for marketing and branding of the Product.

7. Use of certain images and media, for which Smithsonian has commercial rights.

MINIMUM QUALIFICATIONS

The use of the brand and assets the Smithsonian seeks to license to the successful offeror requires unique expertise in order to be leveraged in a Product. The Smithsonian name and logo possess a special, unique and extraordinary character in the public and private mind, that only the most experienced, highest-quality audio tour companies are sought to license the Smithsonian Brand in this market.

Therefore, only respondents possessing all of the following minimum qualifications will be considered:

Demonstrated understanding of and experience launching and maintaining commercially successful audio tours in museum settings.

Demonstrated success with creation of robust marketing and PR plans for audio tours that show actual sales results.

High consumer rankings and positive feedback on customer interaction with the company and its products.

If a prospective offeror is unable to demonstrate that it meets these minimum qualifications, its proposal may be considered non-responsive.

PROPOSAL CONDITIONS

1. Proposals must comply with the instructions and proposal requirements contained in this document. Proposals that deviate from these instructions and requirements may be disqualified at the Smithsonian’s discretion.

2. The Smithsonian reserves the right to enter into negotiations with any or all companies at its discretion and based upon the best interests of the Smithsonian.

3. The Smithsonian is not responsible for paying any proposal preparation costs or any other costs associated with a response to this request.

4. This RFP does not obligate the Smithsonian to enter into any agreement, nor shall it be construed as authorization for companies to proceed with any work directly or indirectly related the project.

5. All information and materials submitted in response to this RFP for consideration by the Smithsonian will become the Smithsonian’s property and will be returned only at the Smithsonian’s discretion.

6. Smithsonian reserves the unconditional right to cancel this RFP or to terminate negotiations at any time without cost or liability of Smithsonian. Participation in this

RFP or any resulting contract constitutes an affirmative waiver by participants of any claim to proposal preparation costs.

7. Interested offerors should note that this is not a solicitation for a federal contract and is therefore not governed by federal procurement procedures.

8. The Smithsonian reserves the right to reject any and all proposals received as a result of this request. The Smithsonian may refuse to consider any proposal received after the date and time specified for receipt, or to disqualify proposals that do not comply with the instructions and requirements of this RFP.

PROPOSAL REQUIREMENTS

All proposals must include the following:

1. A brief overview of your organization to include:

Management structure and key management bios

Key distribution markets

Market penetration

Current licensors and/or product brands leveraged

A description of the size of your existing consumer base

The number of years your company has been in business

Location(s) of company office(s)

Projected sales and profits for 2017-2019

Annual reports for the last three (3) years; if annual reports are not available, please provide financial statements for the last three (3) years

A description of all categories of business in which your organization is involved

2. An overview of your organization’s capabilities and experience to include descriptions of:

Your current product offering(s). Please also highlight those that are relevant to this RFP, along with other products in the education, museum, or non-profit arena.

Product development and technical expertise. Please also outline your expertise in working with 3rd party assets.

Audio Tour expertise and current customers in that area.

Sales and marketing expertise; Please include an estimation of your company’s market penetration, and examples of marketing campaigns around a Tour launch.

Description of your company’s quality control procedures.

Differentiating factors (i.e., what is unique about your company’s offerings within the marketplace).

How your company meets the minimum qualifications in Minimum

Qualification Section above. If an offeror is unable to demonstrate that it meets these minimum qualifications through its submittal, its proposal may be considered non-responsive.

3. At least one example of how your company has leveraged a similar brand within your current or past product offering(s), and a description of the track record of success for such offering(s).

4. A brief outline of your strategic approach to the selection of content and use of

Smithsonian brand, development process, roll-out and marketing of a Product, consistent with the Scope of Work set forth in Minimum Qualification Section above. This brief outline should include a description of the target audience(s) for museum tours.

5. A breakdown of your financial offer, to include:

Advance or Minimum Guarantee to the Smithsonian

Revenue share to the Smithsonian

Explicit description of how revenue share will be attributed and calculated

Requested Term of the agreement

Financial projections for at least years 1, 2, and 3. These must include the assumptions/logic used to generate said projections, as well as a basic timeline for developing and launching the product(s).

If your offer includes any level of exclusivity, describe the parameters of such exclusivity, and the rationale for such exclusivity, in detail. If your offer does not require any level of exclusivity, please indicate “no exclusivity required.”

An explanation of any exceptions or deviations your company will require with respect to Attachment Three (Notable Concepts), attached.

Exceptions will not automatically cause a proposal to be deemed unacceptable. However, exceptions not providing obvious benefit to the

Smithsonian Institution may result in rejection of a proposal as unacceptable.

6. An overview of the timeline for launching the Product, including major milestones.

7. References. A list and brief description of a minimum of three (3) relevant licensors with whom you have developed a Product of a similar nature and scope within the last five (5) years. Please provide a contact name, address, and phone number that the Smithsonian may contact for reference purposes.

8. A statement from your company certifying that there is no material litigation, either pending or threatened, or any contractual or business relationship involving your company or any of its principals, shareholders, partners, officers, or employees which would prevent or limit your company from providing any services described in this RFP, or would hinder your company’s ability to achieve fully the stated objectives and an affirmative statement that your company is responsible and able to conduct business in the District of Columbia and throughout the United States.

To be provided as a signed, certified document with your proposal.

SUBMISSION PROCESS

1. Please submit a letter notifying the Smithsonian of your intent to submit a proposal

Wednesday, February 15, 2017. The notification letter should be submitted via email to the attention of Treffaney R. Lowe, Esq. at LoweTR@si.edu. Failure to submit this notice will not prohibit you from submitting a proposal.

2. Offerors must submit (a) one (1) original and five (5) copies of its Technical

Proposal; (b) one (1) original and two (2) copies of its Business Proposal. All proposals must be submitted via courier in sealed envelopes or packages mailto:preid@si.edu addressed to the office specified below, by 2:00 P.M. E.S.T. Wednesday, February 22, 2017, with the subject matter of the RFP and the name and address of the company clearly identified on the packaging. Materials sent via email, fax or to any other address will not be considered. Please also include links to any live demonstrable Product, if applicable.

Proposals must be sent to:

DELIVERY BY U.S. POSTAL SERVICE –

Office of Contracting and Personal Property Management

ATTN: Treffaney Lowe, Attorney Advisor

P.O. Box 37012

MRC 1200

Washington, DC 20013-7012

-or-

DELIVERY BY COMMERCIAL CARRIER (FEDERAL

EXPRESS, UPS, ETC.) –

Smithsonian Institution

Office of Contracting and Personal Property Management

ATTN: Treffaney Lowe, Attorney Advisor

2011 Crystal Drive

Suite 350

Arlington, VA 22202-3709

3. Questions. All substantive and administrative questions about this RFP must be submitted in writing by email to the attention of Treffaney Lowe at lowetr@si.edu.

Questions must be submitted by 10:00 A.M. Eastern time on Wednesday, February 8, 2017 in order to ensure a response. All questions having a material impact on the solicitation shall be answered in writing and issued to all bidders in the form of an amendment to this solicitation on or around Monday, February 13, 2017.

4. At Smithsonian’s option, any or all of the Offerors may be invited to meet with

Smithsonian representatives in person in Washington D.C. or over the telephone to discuss their proposals and answer questions. Travel and per diem for any such meeting will be the responsibility of each offering Respondents.

SELECTION CRITERIA

Subject to the discretion of the Smithsonian, any company may be selected who is deemed responsible, whose proposal conforms to the requirements in all of the RFP documents, and is judged, based on the evaluation criteria below, to represent the best mailto:preid@si.edu value to the Smithsonian. The Smithsonian will not select a company whose proposal is determined to be unacceptable to the Smithsonian.

Offerors will be judged on the criteria listed below, in order of descending importance.

The Smithsonian reserves the right in all cases to be the sole judge determining whether a company meets the evaluation criteria.

1. Qualifications and experience, including demonstrated success creating and operating an audio tour program in museum settings. (Must meet minimum qualifications described in the Minimum Qualifications Section above to be considered.)

2. An understanding of and ability to align with the Smithsonian Brand as it pertains to Product discussed in this RFP, as demonstrated in the outline of your strategic approach (Proposal Requirements #4 ).

3. The overall favorability of the financial offer, including business and legal terms proposed. Note that financial offers must include detailed assumptions to support revenue projections.

4. Demonstration of robust, current quality control measures to ensure a best in class visitor experience.

5. The proposed timeline for completing the project.

6. Past Performance of your company (e.g., compliance with contract requirements, quality of products/services provided, timeliness of performance, business relations). The Smithsonian may use past performance information obtained from other than the references identified by the Offeror.

ATTACHMENT A: SMITHSONIAN & SMITHSONIAN ENTERPRISES

OVERVIEW

SMITHSONIAN OVERVIEW

The Smithsonian Institution was established in 1846 with funds bequeathed to the United

States by James Smithson. Currently, the Institution holds more than 136 million artifacts and specimens in its trust for "the increase and diffusion of knowledge." The Institution is also a center for research dedicated to public education, national service, and scholarship in the sciences, arts, and history.

The Smithsonian receives funding from federal government appropriations, from other governmental entities, and from private sources. Private funds enable the Institution to undertake new ventures and provide the means for carrying out innovative research, expanding and strengthening its national collections, developing and building new facilities, opening state-of-the art exhibitions, and reaching out to America’s diverse communities. Federal appropriations conserve our national collections; sustain basic research; educate the public; operate, maintain, and protect the large Smithsonian museum and research complex; and fund other administrative and support services.

SMITHSONIAN VISITATION, FACILITIES AND LOCATIONS

The Smithsonian is the world's largest museum complex. The National Mall in

Washington D.C., where all but two Smithsonian museums are located, is the #2 ranked tourism destination in the United States. In terms of total outreach, Smithsonian reaches over 200 million people annually through its museums and National Zoo, websites, and its traveling exhibits and affiliate museum program.

Smithsonian museums include:

Anacostia Community Museum

Arts and Industries Building*

Cooper-Hewitt, National Design Museum (New York City)

Freer Gallery of Art

Hirshhorn Museum and Sculpture Garden

National Air and Space Museum

National Air and Space Museum’s Steven F. Udvar-Hazy Center (Chantilly, Va.)

National Museum of African American History and Culture

National Museum of African Art

National Museum of American History

National Museum of the American Indian

National Museum of the American Indian’s George Gustav Heye Center (New

York City)

National Museum of Natural History

National Portrait Gallery

National Postal Museum

Renwick Gallery

Arthur M. Sackler Gallery

Smithsonian American Art Museum

Smithsonian Institution Building (“Castle”)

* Currently closed for renovation.

Smithsonian facilities also include:

National Zoological Park

Archives of American Art

National Zoo’s Conservation Biology Institute

Smithsonian Astrophysical Observatory

Smithsonian Environmental Research Center

Museum Conservation Institute

Smithsonian Institution Libraries

Smithsonian Institution Archives

Smithsonian Tropical Research Institute

The Marine Station at Fort Pierce, FL.

Some key statistics about Smithsonian and its reach:

Smithsonian Museum Outreach:

There were over 30M visitors to the museums and the National Zoo in 2015.

There are approximately 196 Smithsonian Affiliate Museums across the US in 45 states

188M unique web visits in 2015 and has more than 30 mobile apps

277 Smithsonian Facebook pages with 5.4M Facebook Fans

100 Smithsonian Twitter accounts with 4.3M Twitter Followers

259M YouTube Views

Smithsonian Enterprises Metrics:

Smithsonian’s media venture with Showtime, Smithsonian Networks, is now accessible via subscription to more than 34 million homes

8 Million monthly Smithsonian and Air & Space Magazine Readers and 2 Million

National Associate Members

4 Million Smithsonian Magazine Digital subscribers

2 Million Tween Tribune registered users

10 Million Direct-to-consumer catalog mailings

Smithsonian Museums and Collections:

138 Million objects and specimens within Smithsonian’s collections

20 museums and the National Zoo

9 Global Research Centers

2 Million Library Volumes

2.2 Million digitized collection images

156,000 cubic feet of Archival documents.

Smithsonian Staff and Volunteers:

6,373 Employees

10,152 Volunteers

4,701 Digital Volunteers

475,003 On-site Volunteer Hours in 2014

909 Research Associates

SMITHSONIAN BRAND

Brand Statistics:

Smithsonian has 94% brand recognition among Americans

The Smithsonian brand ranked among the most trusted brands in the Harris

Equitrend brand survey.

In the Harris survey, Smithsonian ranked in the top 10 non-profit brands for both trust and equity.

SMITHSONIAN ENTERPRISES

Smithsonian Enterprises is a division of the Smithsonian Institution. Smithsonian

Enterprises operates retail, media, consumer products and other services which promote the Smithsonian mission while generating an essential source of unrestricted funding for the Institution. Smithsonian Enterprises programs must be consistent with the

Smithsonian’s mission and status as a trust instrumentality of the United States and a tax-exempt organization, and ensure the integrity of the Smithsonian brand. By providing products and services that reflect the mission of the museums and research centers, Smithsonian Enterprises plays a critical role in advancing the Institution’s mission: the increase and diffusion of knowledge.

MEDIA GROUP

Smithsonian Enterprises’ media offerings include Smithsonian and Air & Space magazines. With over 7 million monthly readers, the award-winning Smithsonian

Magazine has been reporting from around the globe for over 40 years. Smithsonian

Books, publishes a select list of narrative non-fiction books. The publishing program includes categories in which Smithsonian's authority is unparalleled, such as history, culture, science and technology, art, as well as works based on museums, collections and artifacts. The Smithsonian Channel HD, now accessible via subscription to 70 million households, offers award winning non-fiction programs about art, history, science, and culture from locations around the world.

RETAIL GROUP

Smithsonian Enterprises’ Retail Group manages 11 restaurants with a variety of dining experiences; 3 IMAX theatres with 1.35 million annual attendees; simulators offering thrilling experiences to over 500,000 visitors; and 24 museum retail stores, handling over

1.8 million annual transactions. The Retail Group also includes Smithsonian Catalog, distributing about 13 million catalogs annually, and SmithsonianStore.com with a diverse product offering inspired by Smithsonian’s collections which together generate 300,000 transactions annually.

CONSUMER AND EDUCATION PRODUCTS GROUP

The Consumer Products Group develops and manages a wide range of Smithsonian-branded products, services and partnerships. Smithsonian Travel includes Journeys which has offered tours for 40 years, providing over 200 international and domestic trips annually, as well as a successful domestic Smithsonian Student Travel program. The

Licensing division includes more than 70 Offerors whose various products are available to a nationwide audience through traditional and electronic distribution. Product categories include home, licensed publishing, decorative gifts and collectibles, children’s toys and activities, graphics, media, jewelry, affinity marketing and promotional licensing.

ATTACHMENT B

NOTABLE CONCEPTS TO BE INCLUDED IN CONTRACT

Note: The language below expresses certain concepts to be included in the agreement with the successful Offeror and not the actual contract language that would be incorporated in the agreement.

1. APPROVALS. All materials bearing the Smithsonian names, trademarks, or images are subject to the advance written approval of the Smithsonian. This includes materials such as the Products, textual materials, and advertising and promotional materials. The parties will agree upon a reasonable timetable for concept and design approvals. Silence shall not be deemed approval at any stage.

2. USE OF SMITHSONIAN NAME. If at any time the continued development, manufacture or sale of any Product developed pursuant to the program will harm the reputation and integrity of the

Smithsonian or the Smithsonian name, or is not in keeping with the dignity, history and traditions of the Smithsonian Institution, Smithsonian shall have the right to withdraw approvals previously given or terminate the agreement. The parties will negotiate a definition of “harm” and “not in keeping,” to be included in the agreement. Company is not permitted to refer to the Smithsonian in its own advertising, marketing, promotion, publicity, or on any letterhead or website by any company.

3. DATA SECURITY AND PRIVACY. The company will meet the most stringent Payment Card

Industry (“PCI”) Data Security Standards applicable to a service provider of its type and size, as well as the data security standards identified in Attachment C, and the privacy standards identified in

Attachment D.

4. BOOKS AND RECORDS. Smithsonian and its authorized representatives will have a reasonable right to conduct audits or examinations of the company’s books of account and other documents and records related to the subject matter and the terms of the agreement.

5. INDEMNIFICATION; INSURANCE. The company will indemnify and hold the Smithsonian harmless for third party claims arising out of the subject matter of the agreement, including but not limited to the Product's compliance with the court decisions in Tasini v. New York Times, 533 U.S.

483 (2001), Faulkner v. National Geographic Society, 409 F.3d 26 (2d Cir. 2005) and Greenberg v.

National Geographic Society, 488 F.3d 1331 (11th Cir. 2007) regarding the privilege accorded to magazine publishers under Section 201(c) of the Copyright Act of 1976 (see “Scope of Work” section above). The company also will carry, for the term of the agreement, commercial general liability insurance and errors and omissions insurance in such amounts and on such terms and conditions as shall be customary for entities of established reputation engaged in similar businesses. The company will be required to name the Smithsonian as an additional insured to the commercial general liability insurance policy.

6. NO ASSIGNMENT. The Smithsonian is entering into the agreement with the successful Offeror in part because of particular attributes of the successful Offeror (the “company”) and its operations.

The company may not assign the agreement without the permission of the Smithsonian. If the company sells or otherwise disposes of substantially all of its business or assets to a third party, the agreement may be assigned only if the Smithsonian receives certain assurances of the continued quality of the operation and consistency with the Smithsonian’s reputation. The parties will negotiate what those assurances must be, and that will be included in the agreement.

7. BANKRUPTCY. In the event the company enters into proceedings relating to bankruptcy, whether voluntary or involuntary, the company will provide the Smithsonian with immediate notice and will expedite its election to assume or reject the agreement.

8. CONFIDENTIALITY. The application of the Non-Disclosure Agreement (NDA) entered into by the parties in advance of distribution of the Request for Proposals will be expanded in the agreement to cover additional information disclosed in the course of the program. However, the nature of the applicability of the NDA will remain the same.

9. FEDERAL TORT CLAIMS ACT. The Smithsonian Institution is covered by the Federal Tort

Claims Act (28 U.S.C. §§ 1346(b) and 2671-80) which provides an exclusive remedy for claims against the United States (the Smithsonian) for damage to property, personal injury, or death caused by the negligent act or failure to act of a Smithsonian Institution employee in the course of his or her employment.

10. APPLICABLE LAW. This Agreement shall be construed in accordance with the applicable federal laws and laws of the District of Columbia, which shall also be the forum for any lawsuit under this

Agreement, regardless of its place of execution or performance.

ATTACHMENT C – DATA SECURITY STANDARDS

1. Data Security.

a. Safeguarding personally identifiable information (“PII”), including credit card information, collected or possessed by XXINC in the course of this Agreement, and preventing its disclosure are essential. The physical and logical design of

XXINC’s information technology network, procurement of the network elements and the ongoing configuration and maintenance of the network shall be the responsibility of XXINC. The security of the network is of paramount importance and should prevent unauthorized access, loss, or modification of

Smithsonian data and PII.

b. XXINC shall use its own merchant account at its credit card processing bank.

XXINC acknowledges that it is responsible for the security of the card holder data that it processes in the course of this Agreement. Parking Panda shall meet the most stringent Payment Card Industry (“PCI”) Data Security Standards applicable to a merchant or service provider of its size. Upon request, XXXINC will provide

Smithsonian with updated certificates of compliance. XXINC will inform

Smithsonian within twenty-four (24) hours of any changes to its PCI compliance status.

c. XXINC shall immediately report to Smithsonian any incident or suspected incident that results in unauthorized access, loss or modification of Smithsonian data or PII collected or stored in the course of this Agreement or denial of service affecting the availability of such data.

d. If new or unanticipated threats or hazards are discovered by XXINC, or if existing safeguards have ceased to function, XXINC shall immediately bring the situation to the attention of the Smithsonian.

ATTACHMENT D – PRIVACY STANDARDS

1. PII refers to information about individuals, including information which can be used to distinguish or trace an individual's identity and any other information that is linked or linkable to an individual, such as medical, educational, financial or employment information. Work to be performed under this agreement requires the handling of the following types of PII: [name, address, telephone number, and e-mail address]. Sensitive

Personally Identifiable Information (SPII) is defined as information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Work to be performed under this agreement requires the handling of the following types of SPII: [name, address, email address, full date of birth, social security number, capacity rating, credit card number, etc.]. PII, SPII and other sensitive Smithsonian data is collectively referred to herein as “Smithsonian Data.”

2. Safeguarding Smithsonian Data collected or possessed by Offeror in the course of this

Agreement and preventing its disclosure are essential. The physical and logical design of

Offeror’s information technology network, procurement of the network elements and the ongoing configuration and maintenance of the network shall be the responsibility of

Offeror. The security of the network is of paramount importance and should prevent unauthorized access, loss, or modification of Smithsonian Data.

3. Privacy Impact Assessments (PIAs) will be completed for the work product produced hereunder to the extent that it collects, maintains, or disseminates PII or SPII in electronic form from or about members of the public. The privacy notice in the final Product shall include a link to the Smithsonian’s current PIAs.

4. Offeror shall limit access to Smithsonian Data to those employees and subcontractors who require the information in order to perform their official duties under this

Agreement. Offeror employees, and subcontractors must physically secure Smithsonian

Data when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Smithsonian Data is no longer needed or required to be retained under applicable Smithsonian records retention policies, it must be destroyed through means that will make the Smithsonian Data irretrievable.

5. Offeror shall use Smithsonian Data obtained hereunder solely for purposes of this

Agreement, and shall not collect or use such information for any other purpose without the prior written approval of the Smithsonian Contracting Officer. At expiration or termination of this Agreement, the Offeror shall turn over all Smithsonian Data obtained under the agreement that is in its possession to the Smithsonian as provided in the termination provisions set forth herein.

6. Security Standards. In performing its duties related to management, operation, and/or access of systems containing Smithsonian Data under this Agreement, the Offeror, its employees and subcontractors shall comply with applicable security requirements set forth herein as well as those set forth in the Smithsonian OCIO IT Security Standards (to be provided by the Smithsonian Contracting Officer upon request).

a. If the work product collects PII or SPII, the communication must be encrypted using secure socket layer (SSL) 3.0 or transport layer security (TLS) 1.0 or higher. Offeror is responsible for the costs and implementation of authentication technology, including security certificates for the work product.

b. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Smithsonian

Data, Offeror shall afford Smithsonian access to Offeror’s facilities, installations, technical capabilities, operations, documentation, records, and databases, and shall otherwise cooperate with the Smithsonian in ensuring compliance with such requirements. Smithsonian access shall include independent validation testing of controls, system penetration testing by the Smithsonian, data reviews, and access by Smithsonian Inspectors General for its reviews.

c. Use of Offeror laptops or other media storage devices to process or store

Smithsonian Data is prohibited under this Agreement unless and until the Offeror provides, and the Contracting Officer approves, written certification by the

Offeror that the following requirements have been met:

(i.) Laptops employ encryption using standards to be provided by Smithsonian

OCIO.

(ii.) The Offeror has developed and implemented a process to ensure that security and other applications software are kept current.

(iii.) Mobile computing devices utilize anti-viral software and a host-based firewall mechanism.

(iv.) When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with

Smithsonian security requirements.

(v.) The Offeror shall maintain an accurate inventory of devices used in the performance of this Agreement.

(vi.) Offeror shall immediately report to Smithsonian any incident that results in unauthorized access, loss or modification of Smithsonian Data collected or stored in the course of this Agreement or denial of service affecting the availability of such data.

(vii.) If new or unanticipated threats or hazards are discovered by either

Smithsonian or Offeror, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

7. Breach Notification. “Breach” as used herein shall mean the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Smithsonian Data, in usable form whether physical or electronic. In the event of any actual or suspected breach of

Smithsonian Data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), Offeror shall immediately, and in no event later than one (1) hour of discovery, report the breach to the individuals identified below. The Offeror is responsible for positively verifying that notification is received and acknowledged by at least one of the following parties:

COR named herein

Smithsonian Privacy Officer

Offeror hereby represents and warrants that it has in place procedures and the capability to promptly notify any individual whose PII or SPII was, or is reasonably believed to have been, breached, as the Smithsonian deems appropriate. The method and content of any notification by Offeror shall be coordinated with, and subject to the prior approval of the Smithsonian Privacy

Council, based upon a risk-based analysis conducted by the Smithsonian in accordance with Smithsonian Directive 118, Privacy Breach Notification Policy.

Offeror shall not proceed unless the Smithsonian has determined that such notification is appropriate.

b. Subject to the Smithsonian’s analysis of the breach and the terms of its instructions to the Offeror regarding any resulting breach notification, a method of notification may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Smithsonian. At minimum, a notification shall include: (1) a brief description of how the breach occurred; (2) a description of the types of personal information involved in the breach; (3) a statement as to whether the information was encrypted or protected by other means; (4) steps an individual may take to protect themselves; (5) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (6) point of contact information identifying who affected individuals may contact for further information.

c. In the event of a breach, the Offeror may be held liable in whole or in part for such breach, to the extent that the Offeror, by virtue of its own acts or omissions, or those of its agents, bears responsibility for the breach, as determined by the

Smithsonian. Such acts or omissions include, but are not limited to: failure to comply with applicable privacy or security requirements; failure to take other reasonable and appropriate precautions to prevent such a breach; or failure to report a breach immediately, such that the delay results in a harm that could have been avoided or mitigated had the breach been reported immediately. Remedies may include, but shall not be limited to: costs of forensic analysis or other investigation; breach notification to affected individuals or entities; credit monitoring services for such individuals or entities; training; or other costs associated with mitigating or remedying the breach, or preventing further breaches. Such costs may be withheld from payments otherwise due to the

Offeror under this Agreement.

8. Pass Through of Clauses to Subcontractors. The Offeror shall incorporate the substance of this clause, its terms and requirements, in all subcontracts under this Agreement, and to require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Offeror.

9. Web Tracking/Geolocation Technologies. The work product may make use of persistent web tracking or geolocation technologies, including, but not limited to, cookies, web bugs, and web beacons only if visitors are provided a prior opportunity to accept or decline such technology (”opt-in”) without denying them access to content if they decline.

10. Handling Smithsonian Data upon Termination. Upon termination or earlier expiration of the Term, Offeror shall provide the Smithsonian with all Smithsonian Data and content provided hereunder within thirty (30) calendar days. All such Smithsonian

Data shall be provided in a commonly used file or database format as the Smithsonian deems appropriate. Offeror shall delete from its files and remove from its information technology assets all Smithsonian Data, including without limitation all data obtained in

Offeror’s performance hereunder. Certification of data removal shall be performed by

Offeror and written notification confirming certification will be delivered to the

Smithsonian Contracting Officer within fifteen (15) calendar days of termination/expiration of this Agreement. Furthermore, Offeror shall cease any use of the Smithsonian Names and shall not exploit in any manner its association with

Smithsonian, unless the parties otherwise agree in the writing at the time of termination.

11. Data Transfer. Offeror may not transfer any personally identifiable information in the event of a Offeror merger, acquisition, or other transaction, including sale in bankruptcy, without the written approval of the Smithsonian Contracting Officer. If the

Smithsonian does not approve of the transfer, Offeror shall provide the Smithsonian with all Smithsonian Data and ensure removal of Smithsonian Data as described in Section 10 above.