W911SD19R0172.pdf

SEE ADDENDUM

(No Collect Calls)

W911SD19R0172 10-Sep-2019

b. TELEPHONE NUMBER

845-938-5050

8. OFFER DUE DATE/LOCAL TIME

11:00 AM 13 Sep 2019

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W911SD9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

ROBIN C. MEYER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

0011356587

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESSX

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - WEST POINT

681 HARDEE PLACE

WEST POINT NY 10996-1514

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W58EDZ 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

ARMY CYBER INSTITUTE

ERIK DEAN

2101 NEW SOUTH POST ROAD

WEST POINT NY 10996

TEL: 845.938.4021 FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$38,500,000

NAICS:

511210

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF75

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W911SD19R0172

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each CyberStakes competition

FFP

CyberStakes Competition Software - See Specifications included.

FOB: Destination

PURCHASE REQUEST NUMBER: 0011356587

PSC CD: 7030

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 30-NOV-2019 1 ARMY CYBER INSTITUTE

ERIK DEAN

2101 NEW SOUTH POST ROAD

WEST POINT NY 10996

845.938.4021 FOB: Destination

W58EDZ

SPECIFICATIONS

SPECIFICATIONS

Development of All-Army CyberStakes Capture-the-Flag Challenges

1.0. BACKGROUND AND INTRODUCTION

Army Cyber Command (ARCYBER) intends to leverage the Army Cyber Institute(ACI) All-Army CyberStakes (AACS) competition to identify and train top technical talent in the Army. AACS is an annual Capture-the-Flag (CTF) competition. Competitions typically span 10 days and are run in a virtual environment using a “Jeopardy” style format. The difficulty of the challenge generally starts at the level of the novice participant and progresses in difficulty level to keep those with advanced problem-solving skills engaged in the competition. These competitions are open to anyone in the Army, any federal government employee as well as all cadets in ROTC or attending the service academies.

This event is intended to reach a broad scope of technical talent throughout the Army and other DoD constituents.

2.0. OBJECTIVE

The Contractor shall develop a set of 50 problems for use on the picoCTF platform to run CTF exercises. The picoCTF platform has two main components: the shell server and the web server. Refer to the documentation online at https://github.com/picoCTF/picoCTF/wiki and the information provided in Appendix B concerning the challenge format. The Wiki mainly provides information on setting up the platform and adding your own challenges.

3.0. SCOPE

The Contractor shall develop and create a problem set to use in CTF exercises. Problem set categories shall include binary exploitation, reverse engineering, web security, forensics, and cryptography.

3.1. Deliverables

- 50 challenges and support as detailed in Sections 5, 6, and 7

- 12 weeks of performance as detailed in Section 5.2 sprint plan

4.0. GENERAL REQUIREMENTS

4.1. RESERVED

4.2. RESERVED

4.3 RESERVED

4.4 RESERVED

4.5. RESERVED

4.6. PRIVACY ACT AND PERSONALLY IDENTIFIABLE INFORMATION

The Contractor shall have access to Privacy Act and Personally Identifiable Information and shall maintain all measures required to appropriately protect the information. The Contractor shall complete annual Government Privacy Act and Personally Identifiable Information training and maintain training records.

4.7. TRAVEL

Travel will not be required.

4.8. RESERVED

4.9. DOCUMENTATION AND DISCLOSURES

Documents, data files, reports, correspondence, and all other documents and writings, with any charts, graphs, tables, illustrations, photographs, images, and other illustrative, explanatory, historical documents related thereto or independent thereof, regardless of the medium (or media) by which they were produced, preserved, stored, or created for purpose(s) of this contract, are property of the Government and shall be delivered promptly, upon request. All challenges delivered for this contract become the property of the ACI and cannot be re-used for other efforts on the part of the contractor.

The Contractor shall assume responsibility for protecting the confidentiality of Government records, which is not considered public information. Each contractor or employee of the Contractor to whom information may be provided or disclosed shall be notified in writing by the contractor that such information may be disclosed only for purposes and to the extent authorized. The Contractor shall not release any information related to this contract to the public, media or other unauthorized persons or organizations unless the Government has conducted the appropriate security review and granted written approval (e.g. posting information to a public website).

The Contractor shall obtain all non-disclosure agreements with all applicable corporate, supplier and subcontractors with proprietary, restricted, competition sensitive, or any other restricted (e.g. non-foreign disclosure due to public law) data used or accessed during the duration of this contract. The contractor shall complete a Non-Disclosure Agreement (NDA) at time of contract award.

4.10. RESERVED

5.0. SPECIFICATIONS

The deliverable requirements shall be met through Sprints for coordination with ACI.

5.1. CHALLENGES

The Contractor shall create 50 CTF challenges. Forty (40) of the questions shall be allocated to the following categories at the minimum quantity listed below. The remaining 10 questions can be allocated to one of the named categories or added to a miscellaneous category.

● Binary exploitation: 9

● Reverse engineering: 9

● Web security: 9

● Forensics: 8

● Cryptography: 5

For any miscellaneous challenges, the Contractor shall allocate novel challenge constructions that target big-data analysis and defensively relevant tasks.

Refer to Appendix A for a description of the challenge categories.

5.2 SPRINTS

The contractor shall develop and create the challenge problem set outlined in 5.1 through the use of sprints.

SPRINT 1 (2 weeks): The contractor shall start Sprint 1 at contract award. During this sprint, the contractor shall provide a draft list of challenges to the ACI for coordination.

The list of challenges shall include:

- Name;

- Category

- Intended point value;

- Short Description and learning objective.

SPRINT 2 (2 weeks): Sprint 2 shall immediately follow sprint 1. The Contractor shall provide at least four challenges per category for review. ACI will validate that the challenges deploy and function correctly on the PicoCTF platform.

Sprint 3 (2 weeks): Sprint 3 shall immediately follow sprint 2. The Contractor shall deliver 60% of the challenges for testing and evaluation.

Sprint 4 (2 weeks): Sprint 4 shall immediately follow sprint 3. The Contractor shall provide all 50 challenges per the requirements.

Sprint 5 (2 weeks): Sprint 5 shall immediately precede the execution of the competition.

The Contractor shall be available to troubleshoot any issues with deploying or integrating the challenges. This can include making modifications to challenges to adjust the difficulty as well as providing additional documentation or hints.

Sprint 6 (2 weeks): Sprint 6 covers the execution of the competition and is anticipated in early December 2019. The Contractor shall provide online remote support for the duration of the competition to include weekends. This support shall include support to competition organizers in the administration of challenge deployments. This shall include support to competitors as they solve challenges and shall will be provided in an online chat or forum style context where the contractor will be expected to field questions related to the challenges developed.

6.0. RESERVED

7.0. DELIVERABLE FORMAT

Requirement deliverables shall be submitted to the Government within the time frames identified in the specifications.

The Contractor shall deliver the following deliverables, 50 CTF challenges with the full source code that is compatible with the PicoCTF challenge format.

● The challenges within each category shall deliberately adhere to a progression of increasing difficulty.

● Challenges shall be creative, novel, and designed with a specific learning objective compatible with its category.

● Challenges delivered for this contract become the property of the ACI and cannot be re-used for other efforts on the part of the contractor.

● Refer to the documentation online at (https://github.com/picoCTF/picoCTF/wiki) and the information provided in Appendix B concerning the challenge format.

● The Government may reject or require correction of any deficiencies in the deliverables. In the event of a rejected deliverable, the Contractor shall be notified by the Government of the specific reasons for the rejection.

● Each challenge shall include the following:

1. Readme.md

2. problem.json

3. challenge.py

4. Source code required to compile, generate, or host the challenge.

5. A solve script which demonstrates how to solve the challenge given a specific generated instance.

7.1. Readme.md

The Readme shall provide all the necessary metadata for the challenge to include its name, category, recommended points (on a 500 point scale), estimated time to solve and estimated difficulty relative to other challenged.

The Readme shall provide a challenge description that explains in detail the way in which the challenge is constructed including software utilized, dependencies, as well as how the vulnerability or security concept is incorporated.

The Readme shall provide a detailed learning objective, including an explanation of prerequisite knowledge/skills/abilities that a competitor would require in order to successfully solve the problem in the estimated time period.

The Readme shall provide a written, step by step description of the solution, that fully captures the tools or techniques utilized to solve the challenge. This should clearly identify any steps a solver is required to perform. Additionally for any multi step solutions, this description should clearly capture the intermediate step as well as any analytic leaps required.

The Readme shall provide detailed development, testing, and deployment notes that address any unique dependencies, configurations, or tooling required to support the challenge creation, or deployment.

The Readme shall provide any additional recommended hints that are not included in the problem.json file.

7.2. problem.json

The problem.json file shall be complete and in accordance with the the picoCTF platform standard.

The problem.json “description” field shall contain a complete prompt and provide the context necessary for a competitor. This includes the necessary templated fields for file downloads or network service ports.

The problem.json “hints” field shall contain at least one (1) hint. For introductory challenges the expectation is that there are sufficient hints and references to solve the challenge in a reasonable amount of time with no additional prior knowledge.

7.3. challenge.py

The challenge.py file shall be complete and in accordance with the the picoCTF platform standard.

The challenge.py file shall to the maximum extent possible utilize the picoCTF platform’s instance generation and templating functionality to generate unique and randomized challenge instances.

The challenge.py file shall to the maximum extent possible generate each challenge instance from scratch utilizing source code or artifacts present in the repository.

7.4. Source code

The source code required to compile, generate, or host the challenge shall be provided.

To the maximum extent possible all challenges, services, and artifacts shall be generated from source. In the event that artifact generation is prohibitively time intensive, intermediate and cached portions are allowable so long as the generation of these artifacts is similarly documented and automated. Exceptions to this are allowable in order to support challenges where automated generation are not feasible however this require advance approval on a challenge by challenge basis.

The source of any pre-existing or external artifacts utilized in the creation of a challenge shall be clearly documented.

7.5. Solve script

All challenges require a solve script (bash, python, etc.) which demonstrates how to solve the challenge given a specific generated instance.

The solve script shall be suitable for use in a continuous integration testing environment and shall not rely on guilty knowledge of the challenge, such as fixed constants or offsets. To the maximum extent possible these elements shall be recovered from information or artifacts available to the competitor.

Some challenges require manual analysis that cannot be replicated in a simple script. In these cases, the solve scripts should include comments for actions that need to be taken. These exceptions are allowable in order to support challenges where automated solutions are not feasible however this require advance approval on a challenge by challenge basis.

The solve script shall come with all dependencies clearly documented, as well as an automated mechanism such as a Dockerfile or Virtual Machine with provisioning script in which it can be executed

Appendix A

Definition of Terms

Jeopardy Style Capture-the-Flag (CTF)

A traditional jeopardy style CTF is a time limited competition that involves individuals or teams solving challenges that are grouped into categories which generally follow a progression of increasing difficulty within each category. Challenges are discreet problems to be solved, which illustrate a specific topic/flaw/security principle, with objective success criteria through the acquisition and submission of a "flag". For additional information, please refer to the following documents:

• Trail of Bits CTF Field Guide (https://trailofbits.github.io/ctf/)

• The Many Maxims of Effective CTFs (http://captf.com/maxims.html)

• CTF-Time Frequently Asked Questions (FAQ) (https://ctftime.org/ctf-wtf/)

• Plaid Parliament of Pwning Guide (https://git.io/vpuei)

Binary Exploitation Category

Binary exploitation challenges typically run that participants connect to and exploit after discovering the vulnerability. Challenges can also be run on a server with SSH access, SUID permissions on the binary, and a flag in the challenge directory.

Challenges in this category help participants demonstrate their ability to exploit stack-based buffer overflows, heap based buffer overflows, type confusion, integer errors, format string vulnerabilities, use after free, and other common vulnerabilities. These challenges also incorporate varying levels of software projections to include stack canaries, no-execute stack, address space layout randomization, and position independent executables.

Reverse Engineering Category

Reverse engineering challenges cover a wide variety of reverse engineering tasks and can include compiled software for various target computer architectures and operating systems. Challenges in this category can also include techniques used in the wild to obfuscate malware, javascript, or powershell, but more commonly represent license checks that require manual reverse engineering of compiled binaries.

Web Security Category

Web security challenges or web exploitation challenges focus on vulnerabilities that occur in web technologies. Good challenges in this category distill real world vulnerabilities from the last couple years into something that can be solved in a few hours. The web security category includes technologies such as PHP, Flask, and dotNet, the backend database vulnerabilities in SQL and no-SQL systems, and new technologies such as WASM.

Forensics Category

Forensics challenges include network forensics (PCAP analysis), host forensics (file recovery), various file formats and protocols. Challenges in this category can be derived from the real world incident response (IR) activities, but large artifact size (full disk images) needs to be considered and avoided if possible.

Cryptography Category

In cryptography challenges participants attack poorly implemented crypto, outdated crypto, or use well-known vulnerabilities to attack encrypted messages.

Miscellaneous Category

Miscellaneous challenges include everything that doesn’t fit elsewhere. In the past challenges in this category have been linux/unix security related challenges, but this category provides a “creative” outlet for new challenges that would expose a participant to a new topic area they may be unfamiliar with. Examples of challenges that would not be suitable are recon, trivia, or multiple choice style questions. All challenges shall have either a security relevant focus, support baseline technical knowledge, or capture an unexpected insight.

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984 52.203-6 Alt I Restrictions On Subcontractor Sales To The Government

(Sep 2006) -- Alternate I

OCT 1995

52.203-11 Certification And Disclosure Regarding Payments To Influence Certain Federal Transactions

SEP 2007

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber Content Paper

MAY 2011

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards

OCT 2018

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

AUG 2019

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations--Representation

NOV 2015

52.209-6 Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment

OCT 2015

52.212-4 Contract Terms and Conditions--Commercial Items OCT 2018 52.215-1 Instructions to Offerors--Competitive Acquisition JAN 2017 52.219-6 (Dev) Notice of Total Small Business Set-Aside (DEVIATION

2019-O0003).

JAN 2019

52.219-8 Utilization of Small Business Concerns OCT 2018 52.222-3 Convict Labor JUN 2003

52.222-21 Prohibition Of Segregated Facilities APR 2015 52.222-26 Equal Opportunity SEP 2016 52.222-37 Employment Reports on Veterans FEB 2016 52.222-40 Notification of Employee Rights Under the National Labor

Relations Act

DEC 2010

52.222-50 Combating Trafficking in Persons JAN 2019 52.223-16 Alt I Acquisition of EPEAT - Registered Personal Computer

Products - Alternate I

JUN 2014

52.223-18 Encouraging Contractor Policies To Ban Text Messaging While Driving

AUG 2011

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.225-18 Place of Manufacture AUG 2018 52.227-1 Authorization and Consent DEC 2007 52.227-2 Notice And Assistance Regarding Patent And Copyright

Infringement

DEC 2007

52.233-3 Protest After Award AUG 1996 52.242-13 Bankruptcy JUL 1995 52.247-34 F.O.B. Destination NOV 1991 52.253-1 Computer Generated Forms JAN 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.209-7004 Subcontracting With Firms That Are Owned or Controlled By

The Government of a Country that is a State Sponsor of Terrorism

MAY 2019

252.225-7002 Qualifying Country Sources As Subcontractors DEC 2017 252.225-7012 Preference For Certain Domestic Commodities DEC 2017 252.225-7031 Secondary Arab Boycott Of Israel JUN 2005 252.225-7051 Prohibition on Acquisition of Certain Foreign Commercial

Satellite Services.

DEC 2018

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.239-7001 Information Assurance Contractor Training and Certification JAN 2008 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.243-7002 Requests for Equitable Adjustment DEC 2012 252.247-7023 Transportation of Supplies by Sea FEB 2019

CLAUSES INCORPORATED BY FULL TEXT

52.203-18 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS--REPRESENTATION (JAN 2017)

(a) Definition. As used in this provision-- Internal confidentiality agreement or statement, subcontract, and subcontractor, are defined in the clause at 52.203- 19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements.

(b) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions), Government agencies are not permitted to use funds appropriated (or otherwise made available) for contracts with an entity that requires employees or subcontractors of such entity seeking to report waste, fraud, or abuse to sign internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting such waste, fraud, or abuse to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information.

(c) The prohibition in paragraph (b) of this provision does not contravene requirements applicable to Standard Form 312, (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(d) Representation. By submission of its offer, the Offeror represents that it will not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

(End of provision)

52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS OR

STATEMENTS (JAN 2017)

(a) Definitions. As used in this clause-- Internal confidentiality agreement or statement means a confidentiality agreement or any other written statement that the contractor requires any of its employees or subcontractors to sign regarding nondisclosure of contractor information, except that it does not include confidentiality agreements arising out of civil litigation or confidentiality agreements that contractor employees or subcontractors sign at the behest of a Federal agency.

Subcontract means any contract as defined in subpart 2.1 entered into by a subcontractor to furnish supplies or services for performance of a prime contract or a subcontract. It includes but is not limited to purchase orders, and changes and modifications to purchase orders.

Subcontractor means any supplier, distributor, vendor, or firm (including a consultant) that furnishes supplies or services to or for a prime contractor or another subcontractor.

(b) The Contractor shall not require its employees or subcontractors to sign or comply with internal confidentiality agreements or statements prohibiting or otherwise restricting such employees or subcontractors from lawfully reporting waste, fraud, or abuse related to the performance of a Government contract to a designated investigative or law enforcement representative of a Federal department or agency authorized to receive such information (e.g., agency Office of the Inspector General).

(c) The Contractor shall notify current employees and subcontractors that prohibitions and restrictions of any preexisting internal confidentiality agreements or statements covered by this clause, to the extent that such prohibitions and restrictions are inconsistent with the prohibitions of this clause, are no longer in effect.

(d) The prohibition in paragraph (b) of this clause does not contravene requirements applicable to Standard Form 312 (Classified Information Nondisclosure Agreement), Form 4414 (Sensitive Compartmented Information Nondisclosure Agreement), or any other form issued by a Federal department or agency governing the nondisclosure of classified information.

(e) In accordance with section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015, (Pub. L. 113-235), and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions) use of funds appropriated (or otherwise made available) is prohibited, if the Government determines that the Contractor is not in compliance with the provisions of this clause.

(f) The Contractor shall include the substance of this clause, including this paragraph (f), in subcontracts under such contracts.

(End of clause)

52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS (DEC

2014)

The Contractor's representations and certifications, including those completed electronically via the System for Award Management (SAM), are incorporated by reference into the contract.

52.204-23 PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE, AND SERVICES

DEVELOPED OR PROVIDED BY KASPERSKY LAB AND OTHER COVERED ENTITIES (JUL 2018)

(a) Definitions. As used in this clause--

Covered article means any hardware, software, or service that--

(1) Is developed or provided by a covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a covered entity.

Covered entity means--

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L.

115-91) prohibits Government use of any covered article. The Contractor is prohibited from--

(1) Providing any covered article that the Government will use on or after October 1, 2018; and

(2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 1 business day from the date of such identification or notification: The contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (AUG 2019)

(a) Definitions. As used in this provision--

Covered telecommunications equipment or services, Critical technology, and Substantial or essential component have the meanings provided in clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition. Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Contractors are not prohibited from providing--

(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Representation. The Offeror represents that--

It [ ] will, [ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation.

(d) Disclosures. If the Offeror has responded affirmatively to the representation in paragraph (c) of this provision, the Offeror shall provide the following information as part of the offer--

(1) All covered telecommunications equipment and services offered (include brand; model number, such as original equipment manufacturer (OEM) number, manufacturer part number, or wholesaler number; and item description, as applicable);

(2) Explanation of the proposed use of covered telecommunications equipment and services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b) of this provision;

(3) For services, the entity providing the covered telecommunications services (include entity name, unique entity identifier, and Commercial and Government Entity (CAGE) code, if known); and

(4) For equipment, the entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known).

52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (OCT 2015)

(a)(1) The Offeror certifies, to the best of its knowledge and belief, that-

(i) The Offeror and/or any of its Principals-

(A) Are ( ) are not ( ) presently debarred, suspended, proposed for debarment, or declared ineligible for the award of contracts by any Federal agency;

(B) Have ( ) have not ( ), within a three-year period preceding this offer, been convicted of or had a civil judgment rendered against them for: commission of fraud or a criminal offense in connection with obtaining, attempting to obtain, or performing a public (Federal, State, or local) contract or subcontract; violation of Federal or State antitrust statutes relating to the submission of offers; or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records, making false statements, tax evasion, violating Federal criminal tax laws, or receiving stolen property (if offeror checks “have”, the offeror shall also see 52.209-7, if included in this solicitation); and

(C) Are ( ) are not ( ) presently indicted for, or otherwise criminally or civilly charged by a governmental entity with, commission of any of the offenses enumerated in paragraph (a)(1)(i)(B) of this provision.;

and

(D) Have , have not , within a three-year period preceding this offer, been notified of any delinquent Federal taxes in an amount that exceeds $3,500 for which the liability remains unsatisfied.

(1) Federal taxes are considered delinquent if both of the following criteria apply:

(i) The tax liability is finally determined. The liability is finally determined if it has been assessed. A liability is not finally determined if there is a pending administrative or judicial challenge. In the case of a judicial challenge to the liability, the liability is not finally determined until all judicial appeal rights have been exhausted.

(ii) The taxpayer is delinquent in making payment. A taxpayer is delinquent if the taxpayer has failed to pay the tax liability when full payment was due and required. A taxpayer is not delinquent in cases where enforced collection action is precluded.

(2) Examples. (i) The taxpayer has received a statutory notice of deficiency, under I.R.C. Sec. 6212, which entitles the taxpayer to seek Tax Court review of a proposed tax deficiency. This is not a delinquent tax because it is not a final tax liability. Should the taxpayer seek Tax Court review, this will not be a final tax liability until the taxpayer has exercised all judicial appeal rights.

(ii) The IRS has filed a notice of Federal tax lien with respect to an assessed tax liability, and the taxpayer has been issued a notice under I.R.C. Sec. 6320 entitling the taxpayer to request a hearing with the IRS Office of Appeals contesting the lien filing, and to further appeal to the Tax Court if the IRS determines to sustain the lien filing. In the course of the hearing, the taxpayer is entitled to contest the underlying tax liability because the taxpayer has had no prior opportunity to contest the liability. This is not a delinquent tax because it is not a final tax liability. Should the taxpayer seek tax court review, this will not be a final tax liability until the taxpayer has exercised all judicial appeal rights.

(iii) The taxpayer has entered into an installment agreement pursuant to I.R.C. Sec. 6159. The taxpayer is making timely payments and is in full compliance with the agreement terms. The taxpayer is not delinquent because the taxpayer is not currently required to make full payment.

(iv) The taxpayer has filed for bankruptcy protection. The taxpayer is not delinquent because enforced collection action is stayed under 11 U.S.C. 362 (the Bankruptcy Code).

(ii) The Offeror has ( ) has not ( ), within a three-year period preceding this offer, had one or more contracts terminated for default by any Federal agency.

(2) Principal, for the purposes of this certification, means an officer, director, owner, partner, or a person having primary management or supervisory responsibilities within a business entity (e.g., general manager; plant manager;

head of a division or business segment; and similar positions).

(b) The Offeror shall provide immediate written notice to the Contracting Officer if, at any time prior to contract award, the Offeror learns that its certification was erroneous when submitted or has become erroneous by reason of changed circumstances.

(c) A certification that any of the items in paragraph (a) of this provision exists will not necessarily result in withholding of an award under this solicitation. However, the certification will be considered in connection with a determination of the Offeror's responsibility. Failure of the Offeror to furnish a certification or provide such additional information as requested by the Contracting Officer may render the Offeror nonresponsible.

(d) Nothing contained in the foregoing shall be construed to require establishment of a system of records in order to render, in good faith, the certification required by paragraph (a) of this provision. The knowledge and information of an Offeror is not required to exceed that which is normally possessed by a prudent person in the ordinary course of business dealings.

(e) The certification in paragraph (a) of this provision is a material representation of fact upon which reliance was placed when making award. If it is later determined that the Offeror knowingly rendered an erroneous certification, in addition to other remedies available to the Government, the Contracting Officer may terminate the contract resulting from this solicitation for default.

52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A

FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

(a) As required by sections 744 and 745 of Division E of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235), and similar provisions, if contained in subsequent appropriations acts, the Government will not enter into a contract with any corporation that--

(1) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless an agency has considered suspension or debarment of the corporation and made a determination that suspension or debarment is not necessary to protect the interests of the Government; or

(2) Was convicted of a felony criminal violation under any Federal law within the preceding 24 months, where the awarding agency is aware of the conviction, unless an agency has considered suspension or debarment of the corporation and made a determination that this action is not necessary to protect the interests of the Government.

(b) The Offeror represents that--

(1) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability; and

(2) It is [ ] is not [ ] a corporation that was convicted of a felony criminal violation under a Federal law within the preceding 24 months.

52.209-13 VIOLATION OF ARMS CONTROL TREATIES OR AGREEMENTS--CERTIFICATION (JUN 2018)

(a) This provision does not apply to acquisitions below the simplified acquisition threshold or to acquisitions of commercial items as defined at FAR 2.101.

(b) Certification. [Offeror shall check either (1) or (2).]

____ (1) The Offeror certifies that--

(i) It does not engage and has not engaged in any activity that contributed to or was a significant factor in the President's or Secretary of State's determination that a foreign country is in violation of its obligations undertaken in any arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. The determinations are described in the most recent unclassified annual report provided to Congress pursuant to section 403 of the Arms Control and Disarmament Act (22 U.S.C. 2593a). The report is available via the internet at https://www.state.gov/t/avc/rls/rpt/; and

(ii) No entity owned or controlled by the Offeror has engaged in any activity that contributed to or was a significant factor in the President's or Secretary of State's determination that a foreign country is in violation of its obligations undertaken in any arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. The determinations are described in the most recent unclassified annual report provided to Congress pursuant to section 403 of the Arms Control and Disarmament Act (22 U.S.C. 2593a). The report is available via the internet at https://www.state.gov/t/avc/rls/rpt/; or

____ (2) The Offeror is providing separate information with its offer in accordance with paragraph (d)(2) of this provision.

(c) Procedures for reviewing the annual unclassified report (see paragraph (b)(1) of this provision). For clarity, references to the report in this section refer to the entirety of the annual unclassified report, including any separate reports that are incorporated by reference into the annual unclassified report.

(1) Check the table of contents of the annual unclassified report and the country section headings of the reports incorporated by reference to identify the foreign countries listed there. Determine whether the Offeror or any person owned or controlled by the Offeror may have engaged in any activity related to one or more of such foreign countries.

(2) If there may have been such activity, review all findings in the report associated with those foreign countries to determine whether or not each such foreign country was determined to be in violation of its obligations undertaken in an arms control, nonproliferation, or disarmament agreement to which the United States is a party, or to be not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. For clarity, in the annual report an explicit certification of non-compliance is equivalent to a determination of violation. However, the following statements in the annual report are not equivalent to a determination of violation:

(i) An inability to certify compliance.

(ii) An inability to conclude compliance.

(iii) A statement about compliance concerns.

(3) If so, determine whether the Offeror or any person owned or controlled by the Offeror has engaged in any activity that contributed to or is a significant factor in the determination in the report that one or more of these foreign countries is in violation of its obligations undertaken in an arms control, nonproliferation, or disarmament agreement to which the United States is a party, or is not adhering to its arms control, nonproliferation, or disarmament commitments in which the United States is a participating state. Review the narrative for any such findings reflecting a determination of violation or non-adherence related to those foreign countries in the report, including the finding itself, and to the extent necessary, the conduct giving rise to the compliance or adherence concerns, the analysis of compliance or adherence concerns, and efforts to resolve compliance or adherence concerns.

(4) The Offeror may submit any questions with regard to this report by email to NDAA1290Cert@state.gov. To the extent feasible, the Department of State will respond to such email inquiries within 3 business days.

(d) Do not submit an offer unless--

(1) A certification is provided in paragraph (b)(1) of this provision and submitted with the offer; or

(2) In accordance with paragraph (b)(2) of this provision, the Offeror provides with its offer information that the President of the United States has--

(i) Waived application under U.S.C. 2593e(d) or (e); or

(ii) Determined under 22 U.S.C. 2593e(g)(2) that the entity has ceased all activities for which measures were imposed under 22 U.S.C.2593e(b).

(e) Remedies. The certification in paragraph (b)(1) of this provision is a material representation of fact upon which reliance was placed when making award. If it is later determined that the Offeror knowingly submitted a false certification, in addition to other remedies available to the Government, such as suspension or debarment, the Contracting Officer may terminate any contract resulting from the false certification.

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL ITEMS (OCT 2018)

ALTERNATE I (OCT 2014)

The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u)) of this provision.

(a) Definitions. As used in this provision--

“Economically disadvantaged women-owned small business (EDWOSB) concern” means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

“Forced or indentured child labor” means all work or service—

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

“Highest-level owner” means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

“Immediate owner” means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

“Inverted domestic corporation,” means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c).

“Manufactured end product” means any end product in product and service codes (PSCs) 1000-9999, except—

(1) PSC 5510, Lumber and Related Basic Wood Materials;

(2) Product or Service Group (PSG) 87, Agricultural Supplies;

(3) PSG 88, Live Animals;

(4) PSG 89, Subsistence;

(5) PSC 9410, Crude Grades of Plant Materials;

(6) PSC 9430, Miscellaneous Crude Animal Products, Inedible;

(7) PSC 9440, Miscellaneous Crude Agricultural and Forestry Products;

(8) PSC 9610, Ores;

(9) PSC 9620, Minerals, Natural and Synthetic; and

(10) PSC 9630, Additive Metal Materials.

“Place of manufacture” means the place where an end product is assembled out of components, or otherwise made or processed from raw materials into the finished product that is to be provided to the Government. If a product is disassembled and reassembled, the place of reassembly is not the place of manufacture.

“Restricted business operations” means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (Pub. L. 110-174).