ML19184A043

Contract No. 31310019D0002

ML19184A043
Person / Time
Issue date:	07/03/2019
From:	Jeffrey Mitchell Acquisition Management Division
To:
References
31310019D0002
Download: ML19184A043 (76)

Text

1. THIS CONTRACT IS A RATED ORDER RATING PAGE OF PAGES AWARD/CONTRACT UNDER DPAS (15 CFR 700) 1 76

2. CONTRACT (Proc. Inst. Ident.) NO. 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUEST/PROJECT NO.

31310019D0002 See Block 20C ZEROREQ-RES-19-0057

5. ISSUED BY CODE NRCHQ 6. ADMINISTERED BY (If other than Item 5) CODE US NRC - HQ ACQUISITION MANAGEMENT DIVISION MAIL STOP TWFN-07B20M WASHINGTON DC 20555-0001 SCD-C

7. NAME AND ADDRESS OF CONTRACTOR (No., street, country, State and ZIP Code) 8. DELIVERY FOB ORIGIN X OTHER (See below)

INFORMATION SYSTEMS LABORATORIES INC 9. DISCOUNT FOR PROMPT PAYMENT ATTN 12900 BROOKPRINTER PLACE 30 SUITE 800 POWAY CA 92064

10. SUBMIT INVOICES ITEM (4 copies unless otherwise specified)

TO THE ADDRESS SHOWN IN CODE 960756138 FACILITY CODE

11. SHIP TO/MARK FOR CODE 12. PAYMENT WILL BE MADE BY CODE NRCPAYMENTS NUCLEAR REGULATORY COMMISSION FISCAL ACCOUNTING PROGRAM ATTN ADMIN TRAINING GROUP AVERY STREET A3-G 11555 ROCKVILLE PIKE BUREAU OF THE FISCAL SERVICE ROCKVILLE MD 20852 PO BOX 1328 PARKERSBURG WV 26106-1328

13. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION: 14. ACCOUNTING AND APPROPRIATION DATA 10 U.S.C. 2304 (c) ( ) X 41 U.S.C. 3304 (a) ( 0 ) See Schedule 15A. ITEM NO 15B. SUPPLIES/SERVICES 15C. 15D. 15E. UNIT PRICE 15F. AMOUNT QUANTITY UNIT Continued 15G. TOTAL AMOUNT OF CONTRACT $6,856,939.00

16. TABLE OF CONTENTS (X) SEC. DESCRIPTION PAGE(S) (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE PART II - CONTRACT CLAUSES A SOLICITATION/CONTRACT FORM I CONTRACT CLAUSES B SUPPLIES OR SERVICES AND PRICES/COSTS PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

C DESCRIPTION/SPECS./WORK STATEMENT J LIST OF ATTACHMENTS D PACKAGING AND MARKING PART IV - REPRESENTATIONS AND INSTRUCTIONS E INSPECTION AND ACCEPTANCE K REPRESENTATIONS, CERTIFICATIONS AND F DELIVERIES OR PERFORMANCE OTHER STATEMENTS OF OFFERORS G CONTRACT ADMINISTRATION DATA L INSTRS., CONDS., AND NOTICES TO OFFERORS H SPECIAL CONTRACT REQUIREMENTS M EVALUATION FACTORS FOR AWARD CONTRACTING OFFICER WILL COMPLETE ITEM 17 (SEALED-BID OR NEGOTIATED PROCUREMENT) OR 18 (SEALED-BID PROCUREMENT) AS APPLICABLE

17. X CONTRACTOR' S NEGOTIATED AGREEMENT (Contractor is required to sign this 18. SEALED-BID AWARD (Contractor is not required to sign this document.) Your bid on document and return copies to issuing office.) Contractor agrees to Solicitation Number 31310019R0008 ,

furnish and deliver all items or perform all the services set forth or otherwise identified including the additions or changes made by you which additions or changes are set forth above and on any continuation sheets for the consideration stated herein. The rights and in full above, is hereby accepted as to the items listed above and on any continuation obligations of the parties to this contract shall be subject to and governed by the following sheets. This award consummates the contract which consists of the following documents: (a) this award/contract, (b) the solicitation, if any, and (c) such provisions, documents: (a) the Government's solicitation and your bid, and (b) this award/contract.

representations, certifications, and specifications, as are attached or incorporated by No further contractual document is necessary. (Block 18 should be checked only when reference herein. (Attachments are listed herein.) awarding a sealed-bid contract.)

19A. NAME AND TITLE OF SIGNER (Type or print) 20A. NAME OF CONTRACTING OFFICER JEFFREY R. MITCHELL 19B. NAME OF CONTRACTOR 19C. DATE SIGNED 20B. UNITED STATES OF AMERICA 20C. DATE SIGNED BY BY 07/03/2019 (Signature of person authorized to sign) (Signature of the Contracting Officer)

STANDARD FORM 26 (Rev. 3/2013)

AUTHORIZED FOR LOCAL REPRODUCTION Prescribed by GSA - FAR (48 CFR) 53.214(a)

Previous edition is NOT usable

REFERENCE NO. OF DOCUMENT BEING CONTINUED PAGE OF CONTINUATION SHEET 31310019D0002 2 76 NAME OF OFFEROR OR CONTRACTOR INFORMATION SYSTEMS LABORATORIES INC ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT (A) (B) (C) (D) (E) (F)

The contractor shall perform the services described in the Statement of Work and Terms and Conditions.

Contract Type: Cost - Plus - Fixed - Fee Maximum Order Limitation including all options:

$6,856,939.00 Period of Performance: 08/01/2019 - 07/31/2020 with four additional one-year optional periods.

Period of Performance: 08/01/2019 to 07/31/2020 AUTHORIZED FOR LOCAL REPRODUCTION OPTIONAL FORM 336 (4-86)

Sponsored by GSA FAR (48 CFR) 53.110

SECTION A - Solicitation/Contract Form.............................................................................

SECTION B - Supplies or Services/Prices ..........................................................................

B.1 BRIEF DESCRIPTION OF WORK ALTERNATE I....................................................

B.2 CONSIDERATION AND OBLIGATIONINDEFINITE-QUANTITY CONTRACT.....

B.3 SCHEDULE OF ESTIMATED COST..

SECTION C - Statement of Work .......................................................................................

SECTION D - Packaging and Marking ................................................................................

D.1 BRANDING ...............................................................................................................

D.2 PACKAGING AND MARKING ..................................................................................

SECTION E - Inspection and Acceptance ...........................................................................

E.1 Clauses Incorporated by reference.

E.2 Quality Assurance..

E.3 Research Quality SECTION F - DELIVERIES OR PERFORMANCE..............................................................

F.1 CLAUSES INCORPORATED BY REFERENCE.

F.2 PREPARATION OF TECHNICAL REPORTS (JAN 1993)..

F.3 PERIOD OF PERFORMANCE ALTERNATE IV .......................................................

F.4 PLACE OF DELIVERY-REPORTS ...........................................................................

SECTION G - Contract Administration Data........................................................................

G.1 2052.215-71 CONTRACTING OFFICER REPRESENTATIVE (COR) (NOVEMBER 2006)

G.2 2052.215-77 TRAVEL APPROVALS AND REIMBURSEMENT. (OCT 1999)

G.3 2052.216-71 INDIRECT COST RATES. (JAN 1993)

G.4 2052.216-72 TASK ORDER PROCEDURES. (OCT 1999)

G.5 2052.216-73 ACCELERATED TASK ORDER PROCEDURES. (JAN 1993)

G.6 ORDERING PROCEDURES FOR MULTIPLE-AWARD INDEFINITE-DELIVERY/INDEFINITE-QUANTITY CONTRACTS (MAR 2014)

G.7 REGISTRATION IN FEDCONNECT (JULY 2014)

G.8 ELECTRONIC PAYMENT (DEC 2017)

SECTION H - Special Contract Requirements ....................................................................

H.1 2052.204-70 SECURITY. (OCT 1999)

H.2 2052.204-71 SITE ACCESS BADGE REQUIREMENTS. (JAN 1993)

H.3 2052.209-72 CONTRACTOR ORGANIZATIONAL CONFLICTS OF INTEREST.

(JAN 1993)

H.4 2052.215-70 KEY PERSONNEL. (JAN 1993)

H.5 2052.235-70 PUBLICATION OF RESEARCH RESULTS (OCT 1999)

H.6 2052.242-70 RESOLVING DIFFERING PROFESSIONAL VIEWS. (OCT 1999)

H.7 2052.242-71 PROCEDURES FOR RESOLVING DIFFERING PROFESSIONAL VIEWS. (OCT 1999)

H.8 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS H.9 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC PAYMENT/REMITTANCE ADDRESS H.10 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TO NUCLEAR FACILITIES, ACCESS TO CLASSIFIED INFORMATION OR SAFEGUARDS INFORMATION, OR PERFORMING IN SPECIALLY SENSITIVE POSITIONS (OCT 2014)

H.11 SECURITY REQUIREMENTS RELATING TO THE PRODUCTION OF REPORTS OR THE PUBLICATION OF RESULTS UNDER CONTRACTS, AGREEMENTS, AND GRANTS (JUL 2016)

H.12 NRC INFORMATION TECHNOLOGY SECURITY TRAINING (MAY 2016)

Page 1

H.13 NRCH030 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY LEVEL I OR LEVEL II ACCESS APPROVAL (JUL 2016)

H.14 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS H.15 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS - GENERAL (JUL 2016)

H.16 NRCH036 IT SECURITY REQUIREMENTS - DEVELOPMENT AND OPERATIONS AND MAINTENANCE REQUIREMENTS (APR 2014)

H.17 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLY IDENTIFIABLE INFORMATION (PII) (AUG 2011)

H.18 UPDATED STANDARDS FOR CONTRACTORS WHO PREPARE NUREG-SERIES MANUSCRIPTS H.19 COPYRIGHT OF CODES - SPECIAL NUCLEAR PURPOSE LICENSE SECTION I - Contract Clauses ............................................................................................

I.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE. (FEB 1998)

I.2 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

I.3 52.216-7 ALLOWABLE COST AND PAYMENT. (AUG 2018)

I.4 52.216-18 ORDERING. (OCT 1995)

I.5 52.216-19 ORDER LIMITATIONS. (OCT 1995)

I.6 52.216-22 INDEFINITE QUANTITY. (OCT 1995)

I.7 52.217-8 OPTION TO EXTEND SERVICES. (NOV 1999)

I.8 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT. (MAR 2000)I.8 I.9 52.232-20 LIMITATION OF COST (APR 1984)

I.10 52.232-22 LIMITATION OF FUNDS. (APR 1984)

I.11 52.244-2 SUBCONTRACTS. (OCT 2010) - ALTERNATE I (JUN 2007)

I.12 COMPLIANCE WITH SECTION 508 OF THE REHABILITATION ACT OF 1973, AS AMENDED (SEP 2013)

SECTION J - List of Documents, Exhibits and Other Attachments .....................................

Page 2

SECTION B - Supplies or Services/Prices B.1 BRIEF DESCRIPTION OF WORK ALTERNATE I (a) The title of this project is: MAINTENANCE OF NUCLEAR REGULATORY COMMISSION (NRC) COMPUTER CODES III (MONC-3)

(b) Summary work description: The contractor shall provide thermal-hydraulic (T/H) code and model development and improvements, as well as configuration control, correction of code errors, documentation updates, and user support to the NRC, its contractors, and members of CAMP and the domestic user community.

(c) Orders will be issued for work in accordance with FAR 52.216 Ordering.

(End of Clause)

B.2 CONSIDERATION AND OBLIGATIONINDEFINITE-QUANTITY CONTRACT (a) The estimated total quantity of this contract for the products/services under this contract is $6,856,938.00.

(b) The Contracting Officer will obligate funds on each task order issued.

(c) The minimum guarantee under this contract is $30,000.00 [Obligated under Task Order No. 1.

(d) The obligated amount for this contract at award shall result in the fulfilment of the

$30,000.00 guaranteed minimum obligation under this IDIQ contract.

(e) A total estimated cost and fee, if any, will be negotiated for each task order and will be incorporated as a ceiling in the resultant task order. The Contractor shall comply with the provisions of FAR 52.232 Limitation of Cost for fully-funded task orders and FAR 52.232 Limitation of Funds for incrementally-funded task orders, issued hereunder.

(End of Clause)

B.3 SCHEDULE OF ESTIMATED COST SCHEDULE OF ESTIMATED COST CLIN NO. DESCRIPTION OF ESTIMATED FIXED FEE TOTAL SUPPLIES/SERVICES COST ESTIMATED COST PLUS FIXED FEE FIVE YEARS FROM EFFECTIVE DATE (INCLUSIVE OF FOUR ONE-YEAR OPTION PERIODS)

Page 3

00001 Base Year $ $ $6,856,939.00 CLIN NO. SCHEDULE OF PERIOD OF PERFORMANCE 00001 Base Year (12 months)

August 1, 2019 - July 31, 2020 10001 Option Period 1 (12 months)

August 1, 2020 - July 31, 2021 20001 Option Period 2 (12 months)

August 1, 2021 - July 31, 2022 30001 Option Period 3 (12 months)

August 1, 2022 - July 31, 2023 40001 Option Period 4 (12 months)

August 1, 2023 - July 31, 2024 Page 4

SECTION C - Description/Specifications STATEMENT OF WORK BACKGROUND The Division of Safety Analysis (DSA), Office of Nuclear Regulatory Research (RES) has responsibility for the development, testing, assessment, maintenance, and user support of the NRC's thermal-hydraulic (T/H) computer codes. These codes include TRACE (TRAC/RELAP Advanced Computational Engine) is NRC's flagship thermal-hydraulics analysis tool. It is a modernized thermal-hydraulics code designed to consolidate the capabilities of NRC's 4 legacy safety codes - TRAC-P, TRAC-B, RELAP, and RAMONA. It is able to analyze large/small break LOCAs and system transients in PWRs, BWRs, SMRs, and other advanced reactor designs. The capability also exists to model thermal hydraulic phenomena in both 1-D and 3-D space. It also includes the ability to model 3-D kinetics through integration with the Purdue Advanced Reactor Core Simulator (PARCS) code. The combined integrated product of these two tools is called TRACE/PARCS throughout the remainder of this contract.

PARCS (Purdue Advanced Reactor Core Simulator) is a computer code that solves the time-dependent two-group neutron diffusion equation in three-dimensional Cartesian geometry using nodal methods to obtain the steady-state and transient neutron flux distribution. The code may be used in the analysis of reactivity-initiated accidents in light-water reactors where spatial effects may be important. It exists both as a stand-alone program and as a separate computational module coupled to other thermal-hydraulic codes. In this latter context, the source code for PARCS is tightly integrated with TRACE. PARCS may also be run in a coupled mode with RELAP5 using a looser coupling technology called the Generic Interface (GI). Associated with PARCS is the GENPMAXS tool which is used for converting macroscopic cross-sections generated by lattice physics codes like SCALE/TRITON/POLARIS, CASMO, or HELIOS into a form readable by PARCS.

RELAP5 (Reactor Excursion and Leak Analysis Program) is a one dimensional (1-D) best-estimate T/H code that is primarily used for small-break loss of coolant accidents (SBLOCAs) and other transients.

SNAP (Symbolic Nuclear Analysis Package) is a graphical user interface with pre-processor and post-processor capabilities which assists users in developing TRACE and RELAP5 input decks and running the codes.

AVScript (Automated Validation Script) is a script written in the PERL language designed to allow code users to automate the process of running T/H codes and generating figures that are used to analyze the simulation of interest. The current TRACE assessment framework (over 500 separate and integral effects tests) makes extensive use of this tool. The functionality provided by this tool has been captured in an SNAP plugin called AVF. It is expected that over time, the entire TRACE assessment framework will be migrated to this new plugin.

Page 5

ACAP (Automated Code Assessment Program) is a graphical program designed to allow code users to easily generate quantitative figures of merit regarding the goodness of fit between code predictions and experimental data or other code predictions. This tool is written in C/C++ and runs as a GUI on Windows or in batch mode on Windows or Linux. The batch functionality of this tool has been captured in a SNAP plugin written in Java.

REQUIREMENTS These codes are used to support independent regulatory decision-making in support of design reviews, power uprates, license extensions, generic safety issues, and the review of vendor evaluation models.

Additional responsibility of the Division includes maintenance of a thermal-hydraulic databank which contains the results of T/H experiments, tests, and assessments used to demonstrate applicability of T/H codes for their intended uses.

When requested by the NRC, the contractor shall make the codes available to NRC-approved domestic users via a User Support Group, and foreign users participating in the international Code Applications and Maintenance Program (CAMP). The use of the codes by these organizations provides calculations and assessments needed to validate and improve the codes. Semi-annual international workshops are conducted by the NRC to discuss code results and related issues.

Codes are currently provided to approved users for a nominal fee that covers shipping, handling, and assistance in installation of the codes. Some users opt to join the User Support Group and pay an annual membership fee. For the additional fee, members receive consultation over email or the telephone on possible problems encountered in use of the codes, including new versions of the codes, and may send a representative to annual code training conducted by the NRC. Both domestic users and CAMP members continue to assess the codes against reactor operational and/or experimental data. As a result of these comparisons and through use of the codes for plant safety assessment, many changes to the codes are suggested each year. When sufficient changes have been made to the codes, assessments shall be made by the contractor and new versions of the codes are released to the users.

The contractor may, at the request of NRC, assert copyright to these codes, subject to a special nuclear purpose license [Section H.19 entitled Copyright of Codes - Special Nuclear Purpose License] that gives NRC the right to distribute the code in the nuclear arena and transfer the copyright to new contractors as new contract vehicles are awarded.

FAR 52.227-17 Rights in Data -- Special Works (DEC 2007) applies to all special works data identified below in DELIVERABLES, while FAR 52.227-14 applies to data other than special works data generate under this contract.

The contractor shall provide a single point of contact to assist code users, performs code and model development for the TRACE code, provides maintenance in the form of version control, error corrections and code debugging, and provides support for CAMP activities for the TRACE and RELAP5 codes. As noted above, it is expected that code modifications will be required as a result of code usage/assessment. The contractor Page 6

shall develop and conduct training courses at the beginning, intermediate, and advanced levels for NRC staff as well as domestic and international code users.

The NRC has transitioned from RELAP5 to TRACE as its primary thermal-hydraulic analysis tool. As such, RELAP5 code development activities are expected to be at a very low level, limited to bug fixes and porting features from RELAP5 into TRACE, as needed. Support for RELAP5 code maintenance will continue to address CAMP member needs as required by active international agreements.

OBJECTIVE The contractor shall provide the necessary personnel, management, materials, equipment, administrative and technical services as outlined in this Statement of Work.

The work performed will support the Agency's safety mission by providing high-quality and timely regulatory research, tools, expertise and other technical products that facilitate regulatory decision making and system safety.

SCOPE OF WORK Tasks under this contract will be accomplished through the issuance of task orders.

Each task order will provide specific levels of effort, deliverables, and a schedule.

Unless otherwise stated, these task areas may apply to any of the following codes:

TRACE, PARCS (both standalone and coupled versions), RELAP5, AVScript, and ACAP, SCALE, TRITON, AGREE, and GENPMAXS. It should be understood that PARCS- related application and development work may involve the development and testing of cross-section libraries and SCALE sequences necessary to support project objectives, as well as the use of commercially available lattice physics codes like HELIOS or CASMO.

The NRC may, at its discretion, issue task orders for work in any of the following areas:

1. Engineering analyses related to code errors, modeling gaps, or deficiencies and document those analyses and their safety significance.

2. Code and/or model development to add new modeling capabilities or features to the codes. This may include the integration of changes developed by others into official code update submittals (including all necessary SQA). All development will be performed according to accepted SQA practices.

3. Code and/or model development to change existing modeling capabilities or features in the codes. This may include the integration of changes developed by others into official code update submittals (including all necessary SQA). All development will be performed according to accepted SQA practices.

4. Typical code maintenance activities, such as (but not necessarily limited to) tracking & fixing bugs, version control and configuration management, developing and maintaining installation packages across multiple platforms, and maintaining documentation.

Page 7

5. Evaluation of new experimental and/or assessment results and make recommendations to the NRC concerning their implementation.

6. Developmental assessment and documentation of (i.e. V&V) the codes against new or existing experimental data. This may involve assessing codes against a wide range of pre-existing test cases in an automated framework and documenting the results in an assessment addendum prior to code release. This may also include reviewing the assessment data base and expanding it with applicable test cases and automated validation frameworks, as appropriate.

7. Have new versions of codes tested or peer reviewed by independent organizations.

8. Maintenance and updates of code documentation, as appropriate. This may include converting documentation to different formats.

9. Specific technical studies and technical support related to the codes as requested by the NRC.

10. Development of input models to address issues that may arise from the NRC review of new or existing reactor designs and generic or safety issues related to operating reactors.

11. Maintenance and improvement of the NRC Data Bank. This may include (but is not limited to) such tasks as

a. Converting raw data to the NRC PIB binary format and arranging for placement into the NRCs Agency-wide Documentation And Management System (ADAMS)

b. Identifying and acquiring relevant technical reports and reference material for inclusion in the Data Bank

c. Reorganizing electronic files already in the Data Bank to new hierarchical structures

d. Migration of the Data Bank to a version control system

e. Development of a queuing system to allow tracking of the file conversion process

f. Changes to the conversion process or storage format

12. CAMP and Domestic User Group program management. Typical activities would include maintaining a current list of approved users/organizations, organizing and participating in bi-annual CAMP conferences, taking meeting minutes, maintaining a user support site, reviewing in-kind contributions, providing telephone and email assistance to code users, developing and distributing bi-annual newsletters, distributing codes to approved users, establishing CAMP licensing agreements with foreign commercial organizations on NRCs behalf, Page 8

and handling invoicing and fee collection for domestic and international organizations.

13. Special development projects designed to improve the capabilities or maintenance of electronic tools used to support code users and the CAMP program.

14. Develop and/or conduct training courses for NRC T/H codes as well as general thermal-hydraulics and reactor safety topics (i.e. LBLOCA, SBLOCA, transients, stability analysis, two-phase flow fundamentals, etc). Training materials may take the form of on-line web-based training videos as opposed to traditional classroom-based learning.

TECHNICAL AND OTHER SPECIAL QUALIFICATIONS REQUIRED This project shall require engineers who have experience (minimal of 5 years) and knowledge (enough to train others) of (a) various versions of TRACE, RELAP5, PARCS, SNAP, TRITON, PATHS, AGREE, GENPMAXS, APTPlot, AVScript, ACAP and the NRC Data Bank, (b) thermal-hydraulic and reactor physics principles, (c) numerical methods, (d) code uncertainty analysis, and (e) modeling for both transient and accident analyses of both operating and advanced PWRs and BWRs, as well as non-LWR designs. Since analysis using PARCS may involve the generation of cross section libraries, the project shall also require engineers skilled in the use of lattice physics codes like SCALE, POLARIS, CASMO and HELIOS. Individuals shall also possess strong programming skills in Fortran 90/95/2003/2008/2018, C/C++, and Python. In addition, computer capabilities to perform code development and validation are required. Finally, there shall also be diversity in computer hardware availability (specifically, SUN, IBM, Intel (32 & 64 bit), AMD (32 & 64 bit), Linux, Windows, Apple Mac/OSX) and compiler technologies (Compaq Visual Fortran, Intel Visual Fortran, NAG, Lahey. Salford, gfortran, & Absoft) used for compiling and running TRACE by most of the users. Code documentation is generally maintained in variety of formats. Knowledge of software tools such as Word, Framemaker and Latex, as well as skills for efficiently converting between these formats, is required.

The contractor is responsible for assigning technical staff, employees, subcontractors, or specialists who have the required educational background, experience, or combination thereof to meet the technical objectives of the work specified in this statement of work. In addition, the contractor and personnel assigned to this work must be approved for handling and working with proprietary information.

DELIVERABLES In general, deliverables under this contract may take the form of the following:

1) Code distribution packages appropriate for external dissemination Page 9

2) Code update transmittal packages (includes updated source code, executables, patch files, associated scripts, README files, html content, code input and output files, AVScript files, code documentation, reference material, calculation notebooks and any other files necessary for NRC to reproduce the work and reach the same (or similar) conclusions as the contractor.

3) Code assessment transmittal packages (includes code input and output files, patch files, executables, associated scripts, README files, html content, experimental data files, AVScript files, code documentation, analysis reports, reference material, calculation notebooks and any other files necessary for NRC to reproduce the work and reach the same (or similar) conclusions as the contractor.

4) Code versions in source and executable form

5) Software quality assurance documentation

6) Version control files

7) Code input models and associated code outputs

8) Website content

9) License management data

10) Training workshop content (presentations, inputs & outputs, exercises, instructions, executables & scripts, agendas)

11) Periodic bug report status updates and database files

12) Experimental data files in binary or ASCII form

13) Meeting minutes

14) Periodic newsletters

15) Summary reports of independent assessments performed by CAMP participants

16) Presentation materials (other than for training workshops)

17) Letter reports describing any work performed

18) Technical progress reports

19) Financial status reports The above list is not all-inclusive. Specific deliverables, schedules, and/or milestones appropriate to the task will be developed at the time the task orders are developed.

Unless otherwise stated in the SOW for a task order, categories 1-12 are to be considered special works and are subject to FAR 52.227-17 Rights in Data - Special Works (DEC 2007). FAR 52.227-14 shall apply to data other than special works data generated under this contract.

MEETINGS AND TRAVEL Meetings and travel requirements will be determined and specified in individual task orders.

NRC-FURNISHED MATERIAL Page 10

Materials to be furnished by NRC will be determined and specified in individual task orders CONTRACTOR ACQUIRED EQUIPMENT/PROPERTY The contractor may purchase, upon the NRC Contracting Officer's approval, high performance workstations, and/or upgrade or replace existing computer hardware as needed during the period of the contract to assure that the codes properly utilize state-of-the-art workstation capabilities and to maintain compatibility with the workstations used by NRC, its contractors and CAMP members. Identification of upgrade and/or replacement hardware shall be presented to the NRC Contracting Officer and Contracting Officer Representative and purchases made only after prior written approval of the NRC Contracting Officer. The contractor shall provide a written request each year to the NRC Contracting Officer and Contracting Officer Representative as to the equipment and/or any upgrades required for the performance of this contract.

(To be specified in each Task Order.)

Page 11

SECTION D - Packaging and Marking D.1 BRANDING The Contractor is required to use the statement below in any publications, presentations, articles, products, or materials funded under this contract/order, to the extent practical, in order to provide NRC with recognition for its involvement in and contribution to the project. If the work performed is funded entirely with NRC funds, then the contractor must acknowledge that information in its documentation/presentation.

Work Supported by the U.S. Nuclear Regulatory Commission (NRC), Office of Nuclear Regulatory Regulation, under Contract/order number incorporated into resultant contract.

(End of Clause)

D.2 PACKAGING AND MARKING (a) The Contractor shall package material for shipment to the NRC in such a manner that will ensure acceptance by common carrier and safe delivery at destination.

Containers and closures shall comply with the Surface Transportation Board, Uniform Freight Classification Rules, or regulations of other carriers as applicable to the mode of transportation.

(b) On the front of the package, the Contractor shall clearly identify the contract number under which the product is being provided.

(c) Additional packaging and/or marking requirements are as follows: N/A.

(End of Clause)

Page 12

SECTION E - Inspection and Acceptance E.1 Clauses The following contract clauses pertinent to this section are hereby incorporated by reference (by Citation Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" in Section I of this contract.

See FAR 52.252-2 for an internet address (if specified) for electronic access to the full text of a clause.

NUMBER TITLE DATE FEDERAL ACQUISITION REGULATION (48 CFR Chapter1) 52.246-5 INSPECTION OF SERVICES--COST-REIMBURSEMENT (APR 1984)

E.2 QUALITY ASSURANCE Section 515 of the Treasury and General Government Appropriations Act for Fiscal Year 2001 (Public Law 106-554) directs the Office of Management and Budget (OMB) to issue government-wide guidelines (FR Vol. 67, No. 36, pp. 8452-8460) that provide policy and procedural guidance to federal agencies for ensuring and maximizing the quality, objectivity, utility, and integrity of information (including statistical information) disseminated by federal agencies. NRC Information Quality Guidelines are provided in FR Vol. 67, No. 190, pp. 61695-61699.

The Contractor shall cite contractor quality assurance procedures to be used in the conduct of this work that provide for compliance with OMB and NRC. With regard to the code development and maintenance activities outlined above, this should, at a minimum, include accepted software quality assurance (QA) procedures, as set forth in NUREG/BR-0167 Software Quality Assurance Program and Guidelines, and NUREG-1737, "Software Quality Assurance Procedures for NRC Thermal Hydraulic Codes" (See Section L.11).

E.3 RESEARCH QUALITY The quality of NRC research programs are assessed each year by the Advisory Committee on Reactor Safeguards. Within the context of their reviews of RES programs, the definition of quality research is based upon several major characteristics:

Results meet the objectives (75% of overall score)

Justification of major assumptions (12%)

Soundness of technical approach and results (52%)

Uncertainties and sensitivities addressed (11%)

Documentation of research results and methods is adequate (25% of overall score)

Clarity of presentation (16%)

Identification of major assumptions (9%)

Page 13

It is the responsibility of the contractor to ensure that these quality criteria are adequately addressed throughout the course of the research that is performed. The NRC COR will review all research products with these criteria in mind.

Page 14

SECTION F - Deliveries or Performance F.1 NOTICE LISTING CONTRACT CLAUSES INCORPORATED BY REFERENCE The following contract clauses pertinent to this section are hereby incorporated by reference (by Citation Number, Title, and Date) in accordance with the clause at FAR "52.252-2 CLAUSES INCORPORATED BY REFERENCE" in Section I of this contract.

NUMBER TITLE DATE 52.242-15 STOP-WORK ORDER AUG 1989 ALTERNATE I (APR 1984) 52.247-34 F.O.B. DESTINATION NOV 1991 F.2 2052.211-70 PREPARATION OF TECHNICAL REPORTS (JAN 1993)

All technical reports required by Section C and all Technical Progress Reports required by Section F are to be prepared in accordance with the Management Directive 3.7, NUREG-Series Publications. Management Directive 3.7 is not applicable to any Contractor Spending Plan (CSP) and any Financial Status Report that may be included in this contract.

F.3 PERIOD OF PERFORMANCE ALTERNATE IV The ordering period for this contract shall commence on August 1, 2019 and will expire on July 31, 2020. Any orders issued during this period shall be completed within the time specified in the order, unless otherwise specified herein. (See 52.216 Ordering.) The term of this contract may be extended at the option of the Government for an additional four 1-year options.

Base Period: 12 Months August 1, 2019 - July 31, 2020 Option Period 1: 12 Months August 1, 2020 - July 31, 2021 Option Period 2: 12 Months August 1, 2021 - July 31, 2022 Option Period 3: 12 Months August 1, 2022 - July 31, 2023 Option Period 4: 12 Months August 1, 2023 - July 31, 2024 (End of Clause)

F.4 PLACE OF DELIVERY-REPORTS The items to be furnished hereunder shall be delivered, with all charges paid by the Contractor, to:

a. Name:

b. Contracting Officers Representative (COR)

c. U.S. Nuclear Regulatory Commission Page 15

e. Electronic copies to: NRC Contracting Officer NRC Contracting Officers Representative:

(End of Clause)

Page 16

SECTION G - Contract Administration Data G.1 2052.215-71 CONTRACTING OFFICER REPRESENTATIVE (COR) (NOVEMBER 2006)

(a) The contracting officer's authorized representative (hereinafter referred to as the COR) for this contract is:

Name:

(b) Performance of the work under this contract is subject to the technical direction of the NRC COR. The term "technical direction" is defined to include the following:

(1) Technical direction to the contractor which shifts work emphasis between areas of work or tasks, authorizes travel which was unanticipated in the Schedule (i.e., travel not contemplated in the Statement of Work (SOW) or changes to specific travel identified in the SOW), fills in details, or otherwise serves to accomplish the contractual SOW.

(2) Provide advice and guidance to the contractor in the preparation of drawings, specifications, or technical portions of the work description.

(3) Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the contractor to the Government under the contract.

(c) Technical direction must be within the general statement of work stated in the contract. The COR does not have the authority to and may not issue any technical direction which:

(1) Constitutes an assignment of work outside the general scope of the contract.

(2) Constitutes a change as defined in the "Changes" clause of this contract.

(3) In any way causes an increase or decrease in the total estimated contract cost, the fixed fee, if any, or the time required for contract performance.

(4) Changes any of the expressed terms, conditions, or specifications of the contract.

(5) Terminates the contract, settles any claim or dispute arising under the contract, or issues any unilateral directive whatever.

(d) All technical directions must be issued in writing by the COR or must be confirmed by the COR in writing within ten (10) working days after verbal issuance. A copy of the written direction must be furnished to the contracting officer. A copy of NRC Form 445, Request for Approval of Official Foreign Travel, which has received final approval from the NRC must be furnished to the contracting officer.

(e) The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this clause and within the COR's authority under the provisions of this clause.

Page 17

(f) If, in the opinion of the contractor, any instruction or direction issued by the COR is within one of the categories as defined in paragraph (c) of this section, the contractor may not proceed but shall notify the contracting officer in writing within five (5) working days after the receipt of any instruction or direction and shall request the contracting officer to modify the contract accordingly. Upon receiving the notification from the contractor, the contracting officer shall issue an appropriate contract modification or advise the contractor in writing that, in the contracting officer's opinion, the technical direction is within the scope of this article and does not constitute a change under the "Changes" clause.

(g) Any unauthorized commitment or direction issued by the COR may result in an unnecessary delay in the contractor's performance and may even result in the contractor expending funds for unallowable costs under the contract.

(h) A failure of the parties to agree upon the nature of the instruction or direction or upon the contract action to be taken with respect thereto is subject to 52.233 Disputes.

(i) In addition to providing technical direction as defined in paragraph (b) of the section, the COR shall:

(1) Monitor the contractor's technical progress, including surveillance and assessment of performance, and recommend to the contracting officer changes in requirements.

(2) Assist the contractor in the resolution of technical problems encountered during performance.

(3) Review all costs requested for reimbursement by the contractor and submit to the contracting officer recommendations for approval, disapproval, or suspension of payment for supplies and services required under this contract.

(4) Assist the contractor in obtaining the badges for the contractor personnel.

(5) Immediately notify the Security Branch, Division of Facilities and Security (SB/DFS) (via e-mail) when a contractor employee no longer requires access authorization and return of any NRC issued badge to SB/DFS within three days after their termination.

(6) Ensure that all contractor employees that require access to classified Restricted Data or National Security Information or matter, access to sensitive unclassified information (Safeguards, Official Use Only, and Proprietary information) access to sensitive IT systems or data, unescorted access to NRC controlled buildings/space, or unescorted access to protected and vital areas of nuclear power plants receive approval of SB/DFS prior to access in accordance with Management Directive and Handbook 12.3.

(7) For contracts for the design, development, maintenance or operation of Privacy Act Systems of Records, obtain from the contractor as part of closeout procedures, written certification that the contractor has returned to NRC, transferred to the successor Page 18

contractor, or destroyed at the end of the contract in accordance with instructions provided by the NRC Systems Manager for Privacy Act Systems of Records, all records (electronic or paper) which were created, compiled, obtained or maintained under the contract.

(End of Clause)

G.2 2052.215-77 TRAVEL APPROVALS AND REIMBURSEMENT. (OCT 1999)

(a) All foreign travel must be approved in advance by the NRC on NRC Form 445, Request for Approval of Official Foreign Travel, and must be in compliance with FAR 52.247-63 Preference for U.S. Flag Air Carriers. The contractor shall submit NRC Form 445 to the NRC no later than 30 days before beginning travel.

(b) The contractor must receive written approval from the NRC Project Officer before taking travel that was unanticipated in the Schedule (i.e., travel not contemplated in the Statement of Work, or changes to specific travel identified in the Statement of Work).

(c) The contractor will be reimbursed only for travel costs incurred that are directly related to this contract and are allowable subject to the limitations prescribed in FAR 31.205-46.

(d) It is the responsibility of the contractor to notify the contracting officer in accordance with the Limitations of Cost clause of this contract when, at any time, the contractor learns that travel expenses will cause the contractor to exceed the estimated costs specified in the Schedule.

(e) Reasonable travel costs for research and related activities performed at State and nonprofit institutions, in accordance with Section 12 of Pub. L. 100-679, must be charged in accordance with the contractor's institutional policy to the degree that the limitations of Office of Management and Budget (OMB) guidance are not exceeded. Applicable guidance documents include OMB Circular A-87, Cost Principles for State and Local Governments; OMB Circular A-122, Cost Principles for Nonprofit Organizations; and OMB Circular A-21, Cost Principles for Educational Institutions.

(End of Clause)

G.3 2052.216-71 INDIRECT COST RATES. (JAN 1993)

(a) Pending the establishment of final indirect rates which must be negotiated based on audit of actual costs, the contractor shall be reimbursed for allowable indirect costs as follows:

Provisional Indirect Rates Day of Award through Contract Expiration Cost Center Rate G&A Energy OH Energy OH Off-Site Fringe (Full) Benefits Fringe (Statutory) Benefits Page 19

[FAR 31.201-2 Determining allowability and FAR 31.203 Indirect Costs apply to costs incurred by the contractor during the performance of the resultant contract and task orders issued thereunder.]

(b) The contracting officer may adjust these rates as appropriate during the term of the contract upon acceptance of any revisions proposed by the contractor. It is the contractor's responsibility to notify the contracting officer in accordance with FAR 52.232-20, Limitation of Cost, or FAR 52.232-22, Limitation of Funds, as applicable, if these changes affect performance of work within the established cost or funding limitations.

Indirect Costs (Ceiling) - Alternate 2 (Oct 1999)

(a) For this contract, the ceiling amount reimbursable for indirect costs shall not exceed the following:

Ceiling Indirect Rates Day of Award through Contract Expiration Cost Center Ceiling Cap Rate G&A Energy OH Energy OH Off-Site Fringe (Full) Benefits Fringe (Statutory) Benefits (b) In the event that indirect rates developed by the cognizant audit activity on the basis of actual allowable costs result in a lower amount for indirect costs, the lower amount will be paid. The Government may not be obligated to pay any additional amounts for indirect costs above the ceiling rates set forth above for the applicable period.

(End of Clause)

G.4 2052.216-72 TASK ORDER PROCEDURES. (OCT 1999)

(a) Task order request for proposal. When a requirement within the scope of work for this contract is identified, the contracting officer shall transmit to the contractor a Task Order Request for Proposal (TORFP) which may include the following, as appropriate:

(1) Scope of work/meetings/travel and deliverables; (2) Reporting requirements; (3) Period of performance - place of performance; (4) Applicable special provisions; (5) Technical skills required; and Page 20

(6) Estimated level of effort.

(b) Task order technical proposal. By the date specified in the TORFP, the contractor shall deliver to the contracting officer a written or verbal (as specified in the TORFP technical proposal submittal instructions) technical proposal that provides the technical information required by the TORFP.

(c) Cost proposal. The contractor's cost proposal for each task order must be fully supported by cost and pricing data adequate to establish the reasonableness of the proposed amounts. When the contractor's estimated cost for the proposed task order exceeds $100,000 and the period of performance exceeds six months, the contractor may be required to submit a Contractor Spending Plan (CSP) as part of its cost proposal. The TORP indicates if a CSP is required.

(d) Task order award. The contractor shall perform all work described in definitized task orders issued by the contracting officer. Definitized task orders include the following:

(1) Statement of work/meetings/travel and deliverables; (2) Reporting requirements; (3) Period of performance; (4) Key personnel; (5) Applicable special provisions; and (6) Total task order amount including any fixed fee.

(End of Clause)

G.5 2052.216-73 ACCELERATED TASK ORDER PROCEDURES. (JAN 1993)

(a) The NRC may require the contractor to begin work before receiving a definitized task order from the contracting officer. Accordingly, when the contracting officer verbally authorizes the work, the contractor shall proceed with performance of the task order subject to the monetary limitation established for the task order by the contracting officer.

(b) When this accelerated procedure is employed by the NRC, the contractor agrees to begin promptly negotiating with the contracting officer the terms of the definitive task order and agrees to submit a cost proposal with supporting cost or pricing data. If agreement on a definitized task order is not reached by the target date mutually agreed upon by the contractor and contracting officer, the contracting officer may determine a reasonable price and/or fee in accordance with Subpart 15.8 and Part 31 of the FAR, subject to contractor appeal as provided in 52.233-1, Disputes. In any event, the contractor shall proceed with completion of the task order subject only to the monetary limitation established by the contracting officer and the terms and conditions of the basic contract.

(End of Clause)

G.6 ORDERING PROCEDURES FOR MULTIPLE-AWARD INDEFINITE-DELIVERY/INDEFINITE-QUANTITY CONTRACTS (MAR 2014)

Page 21

[The contracting officer is responsible for providing further specificity to supplement the standard information contained in the ordering procedures set forth below to address the specific requirements of each contract.]

General.

This clause applies to solicitations and contracts for multiple-award Indefinite-Delivery contracts. For the work specified in the SOW, PWS or SOO, the CO may issue an order to one of the IDC contractors. The contractor agrees that issuance of an order in accordance with any of the procedures described below is deemed to have provided the contractor a fair opportunity to be considered as that phrase is used at FAR 16.505(b)(1).

Ordering Process.

Under this RFTOP this agency will follow the procedures set forth in FAR 16.505.

To the extent that the RFTOP requirements or aspects of the proposal that deviate from the governments requirements and are not within established scope or pricing of the IDC the contractor shall immediately contact the CO for appropriate guidance.

Task/Delivery Order Ombudsman.

To further ensure that all contractors are afforded a fair opportunity to be considered to task or delivery orders pursuant to FAR 16.505, the NRC has an Ombudsman. The purpose of the Ombudsman is not to diminish the authority of the CO, but to receive on behalf of and to communicate to the appropriate Government personnel concerns and disagreements of contractors not receiving a specific order and to work to resolve the matter. When requested, the Ombudsman will maintain strict confidentiality as to the source of the concern. The Ombudsman does not participate in the original selection of contractors or in the evaluation or determination of the issuance of task or delivery orders under the applicable IDC contract. He/She does not act in the capacity of a CO and does not participate in the adjudication of contract disputes in regard to multiple award task or delivery order contracts awarded pursuant to FAR Subpart 16.5.

Interested parties may contact the Ombudsman with concerns or disagreements. Issues or concerns to the NRC task/delivery order Ombudsman may be forwarded to:

U.S. Nuclear Regulatory Commission Acquisition Management Division Attn: Ombudsman Washington, DC 20555 G.7 REGISTRATION IN FEDCONNECT (JULY 2014)

The Nuclear Regulatory Commission (NRC) uses Compusearch Software Systems secure and auditable two-way web portal, FedConnect, to communicate with vendors and contractors. FedConnect provides bi-directional communication between the vendor/contractor and the NRC throughout pre-award, award, and post-award acquisition phases. Therefore, in order to do business with the NRC, vendors and Page 22

contractors must register to use FedConnect at https://www.fedconnect.net/FedConnect. The individual registering in FedConnect must have authority to bind the vendor/contractor. There is no charge for using FedConnect. Assistance with FedConnect is provided by Compusearch Software Systems, not the NRC. FedConnect contact and assistance information is provided on the FedConnect web site at https://www.fedconnect.net/FedConnect.

G.8 ELECTRONIC PAYMENT (DEC 2017)

The Debt Collection Improvement Act of 1996 requires that all payments except IRS tax refunds be made by Electronic Funds Transfer. Payment shall be made in accordance with FAR 52.232-33, entitled Payment by Electronic Funds Transfer-System for Award Management.

To receive payment, the contractor shall prepare invoices in accordance with NRCs Billing Instructions. Claims shall be submitted through the Invoice Processing Platform (IPP) (https://www.ipp.gov/). Back up documentation shall be included as required by the NRCs Billing Instructions.

(End of Clause)

Page 23

SECTION H - Special Contract Requirements H.1 2052.204-70 SECURITY. (OCT 1999)

As prescribed at 2004.404(a), the contracting officer shall insert the following clause in solicitations and contracts during which the contractor may have access to, or contact with classified information, including National Security information, restricted data, formerly restricted data, and other classified data:

SECURITY (OCT 1999)

(a) Security/Classification Requirements Form. The attached NRC Form 187 (See List of Attachments) furnishes the basis for providing security and classification requirements to prime contractors, subcontractors, or others (e.g., bidders) who have or may have an NRC contractual relationship that requires access to classified information or matter, access on a continuing basis (in excess of 90 or more days) to NRC Headquarters controlled buildings, or otherwise requires NRC photo identification or card-key badges.

(b) It is the contractor's duty to safeguard National Security Information, Restricted Data, and Formerly Restricted Data. The contractor shall, in accordance with the Commission's security regulations and requirements, be responsible for safeguarding National Security Information, Restricted Data, and Formerly Restricted Data, and for protecting against sabotage, espionage, loss, and theft, the classified documents and material in the contractor's possession in connection with the performance of work under this contract. Except as otherwise expressly provided in this contract, the contractor shall transmit to the Commission any classified matter in the possession of the contractor or any person under the contractor's control in connection with performance of this contract upon completion or termination of this contract.

(1) The contractor shall complete a certificate of possession to be furnished to the Commission specifying the classified matter to be retained if the retention is:

(i) Required after the completion or termination of the contract; and (ii) Approved by the contracting officer.

(2) The certification must identify the items and types or categories of matter retained, the conditions governing the retention of the matter and their period of retention, if known. If the retention is approved by the contracting officer, the security provisions of the contract continue to be applicable to the matter retained.

(c) In connection with the performance of the work under this contract, the contractor may be furnished, or may develop or acquire, proprietary data (trade secrets) or confidential or privileged technical, business, or financial information, including Commission plans, policies, reports, financial plans, internal data protected by the Privacy Act of 1974 (Pub. L.93-579), or other information which has not been released to the public or has been determined by the Commission to be otherwise exempt from disclosure to the public. The contractor agrees to hold the information in confidence and not to directly or indirectly duplicate, disseminate, or disclose the information, in whole or in part, to any other person or organization except as necessary to perform the work under this contract. The contractor agrees to return the information to the Commission or Page 24

otherwise dispose of it at the direction of the contracting officer. Failure to comply with this clause is grounds for termination of this contract.

(d) Regulations. The contractor agrees to conform to all security regulations and requirements of the Commission which are subject to change as directed by the NRC Division of Facilities and Security and the Contracting Officer. These changes will be under the authority of the FAR Changes clause referenced in Section I of this document.

(e) Definition of National Security Information. As used in this clause, the term National Security Information means information that has been determined pursuant to Executive Order 12958 or any predecessor order to require protection against unauthorized disclosure and that is so designated.

(f) Definition of Restricted Data. As used in this clause, the term Restricted Data means all data concerning design, manufacture, or utilization of atomic weapons; the production of special nuclear material; or the use of special nuclear material in the production of energy, but does not include data declassified or removed from the Restricted Data category under to Section 142 of the Atomic Energy Act of 1954, as amended.

(g) Definition of Formerly Restricted Data. As used in this clause the term Formerly Restricted Data means all data removed from the Restricted Data category under Section 142-d of the Atomic Energy Act of 1954, as amended.

(h) Security clearance personnel. The contractor may not permit any individual to have access to Restricted Data, Formerly Restricted Data, or other classified information, except in accordance with the Atomic Energy Act of 1954, as amended, and the Commission's regulations or requirements applicable to the particular type or category of classified information to which access is required. The contractor shall also execute a Standard Form 312, Classified Information Nondisclosure Agreement, when access to classified information is required.

(i) Criminal liabilities. Disclosure of National Security Information, Restricted Data, and Formerly Restricted Data relating to the work or services ordered hereunder to any person not entitled to receive it, or failure to safeguard any Restricted Data, Formerly Restricted Data, or any other classified matter that may come to the contractor or any person under the contractor's control in connection with work under this contract, may subject the contractor, its agents, employees, or subcontractors to criminal liability under the laws of the United States. (See the Atomic Energy Act of 1954, as amended, 42 U.S.C. 2011 et seq.; 18 U.S.C. 793 and 794; and Executive Order 12958.)

(j) Subcontracts and purchase orders. Except as otherwise authorized, in writing, by the contracting officer, the contractor shall insert provisions similar to the foregoing in all subcontracts and purchase orders under this contract.

(k) In performing contract work, the contractor shall classify all documents, material, and equipment originated or generated by the contractor in accordance with guidance issued by the Commission. Every subcontract and purchase order issued under the contract that involves originating or generating classified documents, material, and equipment must provide that the subcontractor or supplier assign the proper classification to all documents, material, and equipment in accordance with guidance furnished by the contractor.

Page 25

(End of Clause)

H.2 2052.204-71 SITE ACCESS BADGE REQUIREMENTS. (JAN 1993)

During the life of this contract, the rights of ingress and egress for contractor personnel must be made available as required. In this regard, all contractor personnel whose duties under this contract require their presence on-site shall be clearly identifiable by a distinctive badge furnished by the Government. The Project Officer shall assist the contractor in obtaining the badges for contractor personnel. It is the sole responsibility of the contractor to ensure that each employee has proper identification at all times. All prescribed identification must be immediately delivered to the Security Office for cancellation or disposition upon the termination of employment of any contractor personnel. Contractor personnel shall have this identification in their possession during on-site performance under this contract. It is the contractor's duty to assure that contractor personnel enter only those work areas necessary for performance of contract work and to assure the safeguarding of any Government records or data that contractor personnel may come into contact with.

(End of Clause)

H.3 2052.209-72 CONTRACTOR ORGANIZATIONAL CONFLICTS OF INTEREST.

(JAN 1993)

(a) Purpose. The primary purpose of this clause is to aid in ensuring that the contractor:

(1) Is not placed in a conflicting role because of current or planned interests (financial, contractual, organizational, or otherwise) which relate to the work under this contract; and (2) Does not obtain an unfair competitive advantage over other parties by virtue of its performance of this contract.

(b) Scope. The restrictions described apply to performance or participation by the contractor, as defined in 48 CFR 2009.570-2 in the activities covered by this clause.

(c) Work for others.

(1) Notwithstanding any other provision of this contract, during the term of this contract, the contractor agrees to forego entering into consulting or other contractual arrangements with any firm or organization the result of which may give rise to a conflict of interest with respect to the work being performed under this contract. The contractor shall ensure that all employees under this contract abide by the provision of this clause.

If the contractor has reason to believe, with respect to itself or any employee, that any proposed consultant or other contractual arrangement with any firm or organization may involve a potential conflict of interest, the contractor shall obtain the written approval of the contracting officer before the execution of such contractual arrangement.

(2) The contractor may not represent, assist, or otherwise support an NRC licensee or applicant undergoing an NRC audit, inspection, or review where the activities that are the subject of the audit, inspection, or review are the same as or substantially similar to the services within the scope of this contract (or task order as appropriate) except where Page 26

the NRC licensee or applicant requires the contractor's support to explain or defend the contractor's prior work for the utility or other entity which NRC questions.

(3) When the contractor performs work for the NRC under this contract at any NRC licensee or applicant site, the contractor shall neither solicit nor perform work in the same or similar technical area for that licensee or applicant organization for a period commencing with the award of the task order or beginning of work on the site (if not a task order contract) and ending one year after completion of all work under the associated task order, or last time at the site (if not a task order contract).

(4) When the contractor performs work for the NRC under this contract at any NRC licensee or applicant site, (i) The contractor may not solicit work at that site for that licensee or applicant during the period of performance of the task order or the contract, as appropriate.

(ii) The contractor may not perform work at that site for that licensee or applicant during the period of performance of the task order or the contract, as appropriate, and for one year thereafter.

(iii) Notwithstanding the foregoing, the contracting officer may authorize the contractor to solicit or perform this type of work (except work in the same or similar technical area) if the contracting officer determines that the situation will not pose a potential for technical bias or unfair competitive advantage.

(d) Disclosure after award.

(1) The contractor warrants that to the best of its knowledge and belief, and except as otherwise set forth in this contract, that it does not have any organizational conflicts of interest as defined in 48 CFR 2009.570-2.

(2) The contractor agrees that if, after award, it discovers organizational conflicts of interest with respect to this contract, it shall make an immediate and full disclosure in writing to the contracting officer. This statement must include a description of the action which the contractor has taken or proposes to take to avoid or mitigate such conflicts.

The NRC may, however, terminate the contract if termination is in the best interest of the Government.

(3) It is recognized that the scope of work of a task-order-type contract necessarily encompasses a broad spectrum of activities. Consequently, if this is a task-order-type contract, the contractor agrees that it will disclose all proposed new work involving NRC licensees or applicants which comes within the scope of work of the underlying contract.

Further, if this contract involves work at a licensee or applicant site, the contractor agrees to exercise diligence to discover and disclose any new work at that licensee or applicant site. This disclosure must be made before the submission of a bid or proposal to the utility or other regulated entity and must be received by the NRC at least 15 days before the proposed award date in any event, unless a written justification demonstrating urgency and due diligence to discover and disclose is provided by the contractor and approved by the contracting officer. The disclosure must include the statement of work, the dollar value of the proposed contract, and any other documents that are needed to fully describe the proposed work for the regulated utility or other regulated entity. NRC may deny approval of the disclosed work only when the NRC has issued a task order Page 27

which includes the technical area and, if site-specific, the site, or has plans to issue a task order which includes the technical area and, if site-specific, the site, or when the work violates paragraphs (c)(2), (c)(3) or (c)(4) of this section.

(e) Access to and use of information.

(1) If, in the performance of this contract, the contractor obtains access to information, such as NRC plans, policies, reports, studies, financial plans, internal data protected by the Privacy Act of 1974 (5 U.S.C. Section 552a (1988)), or the Freedom of Information Act (5 U.S.C. Section 552 (1986)), the contractor agrees not to:

(i) Use this information for any private purpose until the information has been released to the public; (ii) Compete for work for the Commission based on the information for a period of six months after either the completion of this contract or the release of the information to the public, whichever is first; (iii) Submit an unsolicited proposal to the Government based on the information until one year after the release of the information to the public; or (iv) Release the information without prior written approval by the contracting officer unless the information has previously been released to the public by the NRC.

(2) In addition, the contractor agrees that, to the extent it receives or is given access to proprietary data, data protected by the Privacy Act of 1974 (5 U.S.C. Section 552a (1988)), or the Freedom of Information Act (5 U.S.C. Section 552 (1986)), or other confidential or privileged technical, business, or financial information under this contract, the contractor shall treat the information in accordance with restrictions placed on use of the information.

(3) Subject to patent and security provisions of this contract, the contractor shall have the right to use technical data it produces under this contract for private purposes provided that all requirements of this contract have been met.

(f) Subcontracts. Except as provided in 48 CFR 2009.570-2, the contractor shall include this clause, including this paragraph, in subcontracts of any tier. The terms contract, contractor, and contracting officer, must be appropriately modified to preserve the Government's rights.

(g) Remedies. For breach of any of the above restrictions, or for intentional nondisclosure or misrepresentation of any relevant interest required to be disclosed concerning this contract or for such erroneous representations that necessarily imply bad faith, the Government may terminate the contract for default, disqualify the contractor from subsequent contractual efforts, and pursue other remedies permitted by law or this contract.

(h) Waiver. A request for waiver under this clause must be directed in writing to the contracting officer in accordance with the procedures outlined in 48 CFR 2009.570-9.

(i) Follow-on effort. The contractor shall be ineligible to participate in NRC contracts, subcontracts, or proposals therefor (solicited or unsolicited) which stem directly from the Page 28

contractor's performance of work under this contract. Furthermore, unless so directed in writing by the contracting officer, the contractor may not perform any technical consulting or management support services work or evaluation activities under this contract on any of its products or services or the products or services of another firm if the contractor has been substantially involved in the development or marketing of the products or services.

(1) If the contractor under this contract, prepares a complete or essentially complete statement of work or specifications, the contractor is not eligible to perform or participate in the initial contractual effort which is based on the statement of work or specifications.

The contractor may not incorporate its products or services in the statement of work or specifications unless so directed in writing by the contracting officer, in which case the restrictions in this paragraph do not apply.

(2) Nothing in this paragraph precludes the contractor from offering or selling its standard commercial items to the Government.

(End of Clause)

H.4 2052.215-70 KEY PERSONNEL. (JAN 1993)

(a) The following individuals are considered to be essential to the successful performance of the work hereunder:

[To be completed at resultant award]

Labor Category Personnel Name Principal Engineer Principal Engineer Senior Engineer Engineer

• The contractor agrees that personnel may not be removed from the contract work or replaced without compliance with paragraphs (b) and (c) of this section.

(b) If one or more of the key personnel, for whatever reason, becomes, or is expected to become, unavailable for work under this contract for a continuous period exceeding 30 work days, or is expected to devote substantially less effort to the work than indicated in the proposal or initially anticipated, the contractor shall immediately notify the contracting officer and shall, subject to the concurrence of the contracting officer, promptly replace the personnel with personnel of at least substantially equal ability and qualifications.

(c) Each request for approval of substitutions must be in writing and contain a detailed explanation of the circumstances necessitating the proposed substitutions. The request Page 29

must also contain a complete resume for the proposed substitute and other information requested or needed by the contracting officer to evaluate the proposed substitution.

The contracting officer and the project officer shall evaluate the contractor's request and the contracting officer shall promptly notify the contractor of his or her decision in writing.

(d) If the contracting officer determines that suitable and timely replacement of key personnel who have been reassigned, terminated, or have otherwise become unavailable for the contract work is not reasonably forthcoming, or that the resultant reduction of productive effort would be so substantial as to impair the successful completion of the contract or the service order, the contract may be terminated by the contracting officer for default or for the convenience of the Government, as appropriate.

If the contracting officer finds the contractor at fault for the condition, the contract price or fixed fee may be equitably adjusted downward to compensate the Government for any resultant delay, loss, or damage.

(End of Clause)

H.5 2052.235-70 PUBLICATION OF RESEARCH RESULTS (OCT 1999)

(a) The principal investigator(s)/contractor shall comply with the provisions of NRC Management Directive 3.8 (Vol. 3, Part 1) and NRC Handbook 3.8 (Parts I-IV) regarding publication in refereed scientific and engineering journals or dissemination to the public of any information, oral or written, concerning the work performed under this contract.

Failure to comply with this clause shall be grounds for termination of this contract.

(b) The principal investigator(s)/contractor may publish the results of this work in refereed scientific and engineering journals or in open literature and present papers at public or association meetings at interim stages of work, in addition to submitting to NRC the final reports and other deliverables required under this contract. However, such publication and papers shall focus on advances in science and technology and minimize conclusions and/or recommendations which may have regulatory implications.

(c) The principal investigator(s) shall coordinate all such publications with, and transmit a copy of the proposed article or paper to, the NRC Contracting Officer or Contracting Officers Representative, prior to publication. The NRC agrees to review and provide comments within thirty (30) days after receipt of a proposed publication.

However, in those cases where the information to be published is (1) subject to Commission approval, (2) has not been ruled upon, or (3) disapproved by the Commission, the NRC reserves the right to disapprove or delay the publication. Further, if the NRC disagrees with the proposed publication for any reason, it reserves the right to require that any publication not identify the NRC's sponsorship of the work and that any associated publication costs shall be borne by the contractor.

H.6 2052.242-70 RESOLVING DIFFERING PROFESSIONAL VIEWS. (OCT 1999)

(a) The Nuclear Regulatory Commission's (NRC) policy is to support the contractor's expression of professional health and safety related concerns associated with the contractor's work for NRC that may differ from a prevailing NRC staff view, disagree with an NRC decision or policy position, or take issue with proposed or established agency practices. An occasion may arise when an NRC contractor, contractor's personnel, or subcontractor personnel believes that a conscientious expression of a competent Page 30

judgement is required to document such concerns on matters directly associated with its performance of the contract. The NRC's policy is to support these instances as Differing Professional Views (DPVs).

(b) The procedure that will be used provides for the expression and resolution of differing professional views (DPVs) of health and safety related concerns associated with the mission of the agency by NRC contractors, contractor personnel or subcontractor personnel on matters directly associated with its performance of the contract. This procedure may be found in Attachments to this document. The contractor shall provide a copy of the NRC DPV procedure to all of its employees performing under this contract and to all subcontractors who shall, in turn, provide a copy of the procedure to its employees. The prime contractor or subcontractor shall submit all DPV's received but need not endorse them.

(End of Clause)

H.7 2052.242-71 PROCEDURES FOR RESOLVING DIFFERING PROFESSIONAL VIEWS. (OCT 1999)

(a) The following procedure provides for the expression and resolution of differing professional views (DPVs) of health and safety related concerns of NRC contractors and contractor personnel on matters connected to the subject of the contract. Subcontractor DPVs must be submitted through the prime contractor. The prime contractor or subcontractor shall submit all DPV's received but need not endorse them.

(b) The NRC may authorize up to eight reimbursable hours for the contractor to document, in writing, a DPV by the contractor, the contractor's personnel, or subcontractor personnel. The contractor shall not be entitled to any compensation for effort on a DPV which exceeds the specified eight hour limit.

(c) Before incurring costs to document a DPV, the contractor shall first determine whether there are sufficient funds obligated under the contract which are available to cover the costs of writing a DPV. If there are insufficient obligated funds under the contract, the contractor shall first request the NRC contracting officer for additional funding to cover the costs of preparing the DPV and authorization to proceed.

(d) Contract funds shall not be authorized to document an allegation where the use of this NRC contractor DPV process is inappropriate. Examples of such instances are:

allegations of wrongdoing which should be addressed directly to the NRC Office of the Inspector General (OIG), issues submitted anonymously, or issues raised which have already been considered, addressed, or rejected, absent significant new information.

This procedure does not provide anonymity. Individuals desiring anonymity should contact the NRC OIG or submit the information under NRC's Allegation Program, as appropriate.

(e) When required, the contractor shall initiate the DPV process by submitting a written statement directly to the NRC Office Director or Regional Administrator responsible for the contract, with a copy to the Contracting Officer, Division of Contracts and Property Management, Office of Administration. Each DPV submitted will be evaluated on its own merits.

Page 31

(f) The DPV, while being brief, must contain the following as it relates to the subject matter of the contract:

(1) A summary of the prevailing NRC view, existing NRC decision or stated position, or the proposed or established NRC practice.

(2) A description of the submitter's views and how they differ from any of the above items.

(3) The rationale for the submitter's views, including an assessment based on risk, safety and cost benefit considerations of the consequences should the submitter's position not be adopted by NRC.

(g) The Office Director or Regional Administrator will immediately forward the submittal to the NRC DPV Review Panel and acknowledge receipt of the DPV, ordinarily within five (5) calendar days of receipt.

(h) The panel will normally review the DPV within seven calendar days of receipt to determine whether enough information has been supplied to undertake a detailed review of the issue. Typically, within 30 calendar days of receipt of the necessary information to begin a review, the panel will provide a written report of its findings to the Office Director or Regional Administrator and to the Contracting Officer, which includes a recommended course of action.

(i) The Office Director or Regional Administrator will consider the DPV Review Panel's report, make a decision on the DPV and provide a written decision to the contractor and the Contracting Officer normally within seven calendar days after receipt of the panel's recommendation.

(j) Subsequent to the decision made regarding the DPV Review Panel's report, a summary of the issue and its disposition will be included in the NRC Weekly Information Report submitted by the Office Director. The DPV file will be retained in the Office or Region for a minimum of one year thereafter. For purposes of the contract, the DPV shall be considered a deliverable under the contract. Based upon the Office Director or Regional Administrator's report, the matter will be closed.

(End of Clause)

H.8 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS (a) All offerors will receive preaward and postaward notices in accordance with FAR 15.503.

(b) It is also brought to your attention that the contracting officer is the only individual who can legally obligate funds or commit the NRC to the expenditure of public funds in connection with this procurement. This means that unless provided in a contract document or specifically authorized by the contracting officer, NRC technical personnel may not issue contract modifications, give formal contractual commitments, or otherwise bind, commit, or obligate the NRC contractually. Informal unauthorized commitments, which do not obligate the NRC and do not entitle the contractor to payment, may include:

(1) Encouraging a potential contractor to incur costs prior to receiving a contract; Page 32

(2) Requesting or requiring a contractor to make changes under a contract without formal contract modifications; (3) Encouraging a contractor to incur costs under a cost-reimbursable contract in excess of those costs contractually allowable; and (4) Committing the Government to a course of action with regard to a potential contract, contract change, claim, or dispute.

(End of Clause)

H.9 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC PAYMENT/REMITTANCE ADDRESS The Debt Collection Improvement Act of 1996 requires that all Federal payments except IRS tax refunds be made by Electronic Funds Transfer. lt is the policy of the Nuclear Regulatory Commission to pay government vendors by the Automated Clearing House (ACH) electronic funds transfer payment system. Item 15C of the Standard Form 33 may be disregarded.

(End of Clause)

H.10 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TO NUCLEAR FACILITIES, ACCESS TO CLASSIFIED INFORMATION OR SAFEGUARDS INFORMATION, OR PERFORMING IN SPECIALLY SENSITIVE POSITIONS (OCT 2014)

All contractor employees, subcontractor employees, applicants, and consultants proposed for performance or performing under this contract shall be subject to pre-assignment, random, reasonable suspicion, and post-accident drug testing applicable to:

(1) individuals who require unescorted access to nuclear power plants, (2) individuals who have access to classified or safeguards information, (3) individuals who are required to carry firearms in performing security services for the NRC, (4) individuals who are required to operate government vehicles or transport passengers for the NRC, (5) individuals who are required to operate hazardous equipment at NRC facilities, or (6) individuals who admit to recent illegal drug use or those who are found through other means to be using drugs illegally.

The NRC Drug Program Manager will schedule the drug testing for all contractor employees, subcontractor employees, applicants, and consultants who are subject to testing under this clause. The consequences of refusing to undergo drug testing or a refusal to cooperate in such testing, including not appearing at the scheduled appointment time, will result in the Agencys refusal of the contractor employee to work under any NRC contract. Any NRC contractor employee found to be using, distributing or possessing illegal drugs, or any contractor employee who fails to receive a verified negative drug test result under this program while in a duty status will immediately be removed from working under the NRC contract. The contractor's employer will be notified of the denial or revocation of the individual's authorization to have access to information and ability to perform under the contract. The individual may not work on any NRC contract for a period of not less than one year from the date of the failed, positive drug test and will not be considered for reinstatement unless evidence of rehabilitation, Page 33

as determined by the NRC "drug testing contractor's" Medical Review Officer, is provided.

Contractor drug testing records are protected under the NRC Privacy Act Systems of Records, System 35, "Drug Testing Program Records - NRC" found at:

http://www.nrc.gov/reading-rm/foia/privacy-systems.html (End of Clause)

H.11 SECURITY REQUIREMENTS RELATING TO THE PRODUCTION OF REPORTS OR THE PUBLICATION OF RESULTS UNDER CONTRACTS, AGREEMENTS, AND GRANTS (JUL 2016)

Review and Approval of Reports (a) Reporting Requirements. The contractor/grantee shall comply with the terms and conditions of the contract/grant regarding the contents of the draft and final report, summaries, data, and related documents, to include correcting, deleting, editing, revising, modifying, formatting, and supplementing any of the information contained therein, at no additional cost to the NRC. Performance under the contract/grant will not be deemed accepted or completed until it complies with the NRCs directions, as applicable. The reports, summaries, data, and related documents will be considered draft until approved by the NRC. The contractor/grantee agrees that the direction, determinations, and decisions on approval or disapproval of reports, summaries, data, and related documents created under this contract/grant remain solely within the discretion of the NRC.

(b) Publication of Results. Prior to any dissemination, display, publication, or release of articles, reports, summaries, data, or related documents developed under the contract/grant, the contractor/grantee shall submit them to the NRC for review and approval. The contractor/ grantee shall not release, disseminate, display or publish articles, reports, summaries, data, and related documents, or the contents therein, that have not been reviewed and approved by the NRC for release, display, dissemination or publication. The contractor/grantee agrees to conspicuously place any disclaimers, markings or notices, directed by the NRC, on any articles, reports, summaries, data, and related documents that the contractor/grantee intends to release, display, disseminate or publish to other persons, the public, or any other entities. The contractor/grantee agrees, and grants, a royalty-free, nonexclusive, irrevocable worldwide license to the government, to use, reproduce, modify, distribute, prepare derivative works, release, display or disclose the articles, reports, summaries, data, and related documents developed under the contract/grant, for any governmental purpose and to have or authorize others to do so.

(c) Identification/Marking of Sensitive Unclassified Non-Safeguards Information (SUNSI) and Safeguards Information (SGI). The decision, determination, or direction by the NRC that information possessed, formulated or produced by the contractor/grantee constitutes SUNSI or SGI is solely within the authority and discretion of the NRC. In performing the contract/grant, the contractor/grantee shall clearly mark SUNSI and SGI, to include for example, OUO-Allegation Information or OUO-Security Related Information on any reports, documents, designs, data, materials, and written information, as directed by the NRC. In addition to marking the information as directed by the NRC, the contractor shall use the applicable NRC cover sheet (e.g., NRC Form 461 Page 34

Safeguards Information) in maintaining these records and documents. The contractor/grantee shall ensure that SUNSI and SGI is handled, maintained and protected from unauthorized disclosure, consistent with NRC policies and directions. The contractor/grantee shall comply with the requirements to mark, maintain, and protect all information, including documents, summaries, reports, data, designs, and materials in accordance with the provisions of Section 147 of the Atomic Energy Act of 1954 as amended, its implementing regulations (10 CFR 73.21), Sensitive Unclassified Non-Safeguards and Safeguards Information policies, and NRC Management Directives and Handbooks 12.5, 12.6 and 12.7.

(d) Remedies. In addition to any civil, criminal, and contractual remedies available under the applicable laws and regulations, failure to comply with the above provisions, and/or NRC directions, may result in suspension, withholding, or offsetting of any payments invoiced or claimed by the contractor/grantee.

(e) Flowdown. If the contractor/grantee intends to enter into any subcontracts or other agreements to perform this contract/grant, the contractor/grantee shall include all of the above provisions in any subcontracts or agreements.

H.12 NRC INFORMATION TECHNOLOGY SECURITY TRAINING (MAY 2016)

NRC INFORMATION TECHNOLOGY SECURITY TRAINING (MAY 2016)

NRC contractors shall ensure that their employees, consultants, and subcontractors with access to the agency's information technology (IT) equipment and/or IT services complete NRC's online initial and refresher IT security training requirements to ensure that their knowledge of IT threats, vulnerabilities, and associated countermeasures remains current. Both the initial and refresher IT security training courses generally last an hour or less and can be taken during the employee's regularly scheduled work day.

Contractor employees, consultants, and subcontractors shall complete the NRC's online annual, "Computer Security Awareness" course on the same day that they receive access to the agency's IT equipment and/or services, as their first action using the equipment/service. For those contractor employees, consultants, and subcontractors who are already working under this contract, the on-line training must be completed in accordance with agency Network Announcements issued throughout the year, within three weeks of issuance of this modification.

Additional annual required online NRC training includes but is not limited to the following:

(1) Information Security (INFOSEC) Awareness (2) Continuity of Operations (COOP) Awareness (3) Defensive Counterintelligence and Insider Threat Awareness (4) No FEAR Act (5) Personally Identifiable Information (PII) and Privacy Act Responsibilities Awareness Contractor employees, consultants, and subcontractors who have been granted access to NRC information technology equipment and/or IT services must continue to take IT Page 35

security refresher training offered online by the NRC throughout the term of the contract.

Contractor employees will receive notice of NRC's online IT security refresher training requirements through agency-wide notices.

Contractor Monthly Letter Status Reports (MLSR) must include the following information for all completed training:

(1) the name of the individual completing the course; (2) the course title; and (3) the course completion date.

The MLSR must also include the following information for those individuals who have not completed their required training:

(1) the name of the individual who has not yet completed the training; (2) the title of the course(s) which must still be completed; and (3) the anticipated course completion date(s).

The NRC reserves the right to deny or withdraw Contractor use or access to NRC IT equipment and/or services, and/or take other appropriate contract administrative actions (e.g., disallow costs, terminate for cause) should the Contractor violate the Contractor's responsibility under this clause.

(End of Clause)

H.13 NRCH030 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY LEVEL I OR LEVEL II ACCESS APPROVAL (JUL 2016)

The contractor must identify all individuals selected to work under this contract. The NRC Contracting Officers Representative (COR) shall make the final determination of the level, if any, of IT access approval required for all individuals working under this contract/order using the following guidance. The Government shall have full and complete control and discretion over granting, denying, withholding, or terminating IT access approvals for contractor personnel performing work under this contract/order.

The contractor shall conduct a preliminary security interview or review for each employee requiring IT level I or II access and submit to the Government only the names of candidates that have a reasonable probability of obtaining the level of IT access approval for which the employee has been proposed. The contractor shall pre-screen its applicants for the following:

(a) felony arrest in the last seven (7) years; (b) alcohol related arrest within the last five (5) years; (c) record of any military courts-martial convictions in the past ten (10) years; (d) illegal use of narcotics or other controlled substances possession in the past year, or illegal purchase, production, transfer, or distribution of narcotics or other controlled substances in the last seven (7) years; and (e) delinquency on any federal debts or bankruptcy in the last seven (7) years.

Page 36

The contractor shall make a written record of its pre-screening interview or review (including any information to mitigate the responses to items listed in (a) - (e)), and have the employee verify the pre-screening record or review, sign and date it. The contractor shall supply two (2) copies of the signed contractor's pre-screening record or review to the NRC Contracting Officers Representative (COR), who will then provide them to the NRC Office of Administration, Division of Facilities and Security, Personnel Security Branch with the employees completed IT access application package.

The contractor shall further ensure that its personnel complete all IT access approval security applications required by this clause within fourteen (14) calendar days of notification by the NRC Contracting Officers Representative (COR) of initiation of the application process. Timely receipt of properly completed records of the pre-screening record and IT access approval applications (submitted for candidates that have a reasonable probability of obtaining the level of security assurance necessary for access to NRC's IT systems/data) is a requirement of this contract/order. Failure of the contractor to comply with this requirement may be a basis to terminate the contract/order for cause, or to offset from the contract's invoiced cost or price the NRC's incurred costs or delays as a result of inadequate pre-screening by the contractor.

SECURITY REQUIREMENTS FOR IT LEVEL I Performance under this contract/order will involve contractor personnel who perform services requiring direct access to or operation of agency sensitive information technology systems or data (IT Level I). The IT Level I involves responsibility for: (a) the planning, direction, and implementation of a computer security program; (b) major responsibility for the direction, planning, and design of a computer system, including hardware and software; (c) the capability to access a computer system during its operation or maintenance in such a way that could cause or that has a relatively high risk of causing grave damage; or (d) the capability to realize a significant personal gain from computer access.

Contractor personnel shall not have access to sensitive information technology systems or data until they are approved by DFS/PSB and they have been so informed in writing by the NRC Contracting Officers Representative (COR). Temporary IT access may be approved by DFS/PSB based on a favorable review or adjudication of their security forms and checks. Final IT access may be approved by DFS/PSB based on a favorably review or adjudication of a completed background investigation. However, temporary access authorization approval will be revoked and the employee may subsequently be denied IT access in the event the employees investigation cannot be favorably adjudicated. Such an employee will not be authorized to work under any NRC contract/order requiring IT access without the approval of DFS/PSB, as communicated in writing to the contractor by the NRC Contracting Officers Representative (COR).

Where temporary access authorization has been revoked or denied by DFS/PSB, the contractor shall assign another contractor employee to perform the necessary work under this contract/order without delay to the contract/order performance schedule, or without adverse impact to any other terms or conditions of the contract/order. When an individual receives final IT access approval from DFS/PSB, the individual will be subject to a reinvestigation every ten (10) years thereafter (assuming continuous performance under contracts/orders at NRC) or more frequently in the event of noncontinuous Page 37

performance under contracts/orders at NRC.

CORs are responsible for submitting the completed access/clearance request package as well as other documentation that is necessary to DFS/PSB. The contractor shall submit a completed security forms packet, including the OPM Standard Form (SF) 86 (online Questionnaire for National Security Positions), two (2) copies of the Contractor's signed pre-screening record, and two (2) FD 258 fingerprint charts, to DFS/PSB for review and adjudication, prior to the individual being authorized to perform work under this contract/order requiring access to sensitive information technology systems or data. Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of their legal residency. This documentation can be a Permanent Resident Card, Temporary Work Visa, Employment Authorization Card, or other official documentation issued by the U.S. Citizenship and Immigration Services. Any applicant with less than seven (7) years residency in the U.S. will not be approved for IT Level I access. The Contractor shall submit the documents to the NRC Contracting Officers Representative (COR) who will give them to DFS/PSB. The contractor shall ensure that all forms are accurate, complete, and legible. Based on DFS/PSB review of the contractor employees security forms and/or the receipt of adverse information by NRC, the contractor individual may be denied access to NRC facilities and sensitive information technology systems or data until a final determination is made by DFS/PSB. The contractor individuals clearance status will thereafter be communicated to the contractor by the NRC Contracting Officers Representative (COR) regarding the contractor persons eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level I contractors shall be subject to the attached NRC Form 187 and SF-86. Together, these furnish the basis for providing security requirements to contractors that have or may have an NRC contractual relationship which requires access to or operation of agency sensitive information technology systems, remote development and/or analysis of sensitive information technology systems or data, or other access to such systems and data; access on a continuing basis (in excess more than 30 calendar days) to NRC buildings; or otherwise requires issuance of an unescorted NRC badge.

SECURITY REQUIREMENTS FOR IT LEVEL II Performance under this contract/order will involve contractor personnel that develop and/or analyze sensitive information technology systems or data or otherwise have access to such systems or data (IT Level II).

The IT Level II involves responsibility for the planning, design, operation, or maintenance of a computer system and all other computer or IT positions.

Contractor personnel shall not have access to sensitive information technology systems or data until they are approved by DFS/PSB and they have been so informed in writing by the NRC Contracting Officers Representative (COR). Temporary access may be approved by DFS/PSB based on a favorable review of their security forms and checks. Final IT access may be approved by DFS/PSB based on a favorably adjudication.

However, temporary access authorization approval will be revoked and the contractor employee may subsequently be denied IT access in the event the employee's Page 38

investigation cannot be favorably adjudicated. Such an employee will not be authorized to work under any NRC contract/order requiring IT access without the approval of DFS/PSB, as communicated in writing to the contractor by the NRC Contracting Officers Representative (COR). Where temporary access authorization has been revoked or denied by DFS/PSB, the contractor is responsible for assigning another contractor employee to perform the necessary work under this contract/order without delay to the contract/order performance schedule, or without adverse impact to any other terms or conditions of the contract/order. When a contractor employee receives final IT access approval from DFS/PSB, the individual will be subject to a review or reinvestigation every ten (10) years (assuming continuous performance under contract/order at NRC) or more frequently in the event of noncontinuous performance under contract/order at NRC.

CORs are responsible for submitting the completed access/clearance request package as well as other documentation that is necessary to DFS/PSB. The contractor shall submit a completed security forms packet, including the OPM Standard Form (SF) 86 (online Questionnaire for National Security Positions), two (2) copies of the Contractor's signed pre-screening record and two (2) FD 258 fingerprint charts, to DFS/PSB for review and adjudication, prior to the contractor employee being authorized to perform work under this contract/order. Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of their legal residency. This documentation can be a Permanent Resident Card, Temporary Work Visa, Employment Authorization Card, or other official documentation issued by the U.S.

Citizenship and Immigration Services. Any applicant with less than seven (7) years residency in the U.S. will not be approved for IT Level II access. The Contractor shall submit the documents to the NRC Contracting Officers Representative (COR) who will give them to DFS/PSB. The contractor shall ensure that all forms are accurate, complete, and legible. Based on DFS/PSB review of the contractor employees security forms and/or the receipt of adverse information by NRC, the contractor employee may be denied access to NRC facilities, sensitive information technology systems or data until a final determination is made by DFS/PSB regarding the contractor persons eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level II contractors shall be subject to the attached NRC Form 187, SF-86, and contractor's record of the pre-screening. Together, these furnish the basis for providing security requirements to contractors that have or may have an NRC contractual relationship which requires access to or operation of agency sensitive information technology systems, remote development and/or analysis of sensitive information technology systems or data, or other access to such systems or data; access on a continuing basis (in excess of more than 30 calendar days) to NRC buildings; or otherwise requires issuance of an unescorted NRC badge.

CANCELLATION OR TERMINATION OF IT ACCESS/REQUEST When a request for IT access is to be withdrawn or canceled, the contractor shall immediately notify the NRC Contracting Officers Representative (COR) by telephone so that the access review may be promptly discontinued. The notification shall contain the full name of the contractor employee and the date of the request. Telephone notifications must be promptly confirmed by the contractor in writing to the NRC Contracting Officers Representative (COR), who will forward the confirmation to Page 39

DFS/PSB. Additionally, the contractor shall immediately notify the NRC Contracting Officers Representative (COR) in writing, who will in turn notify DFS/PSB, when a contractor employee no longer requires access to NRC sensitive automated information technology systems or data, including the voluntary or involuntary separation of employment of a contractor employee who has been approved for or is being processed for IT access.

The contractor shall flow the requirements of this clause down into all subcontracts and agreements with consultants for work that requires them to access NRC IT resources.

(End of Clause)

H.14 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS Annual and final evaluations of contractor performance under this contract will be prepared in accordance with FAR Subpart 42.15, "Contractor Performance Information,"

normally at or near the time the contractor is notified of the NRC's intent to exercise the contract option. If the multi-year contract does not have option years, then an annual evaluation will be prepared annually. Final evaluations of contractor performance will be prepared at the expiration of the contract during the contract closeout process.

The Contracting Officer will transmit the NRC Contracting Officers Representatives (COR) annual and final contractor performance evaluations to the contractor's Project Manager, unless otherwise instructed by the contractor. The contractor will be permitted thirty days to review the document and submit comments, rebutting statements, or additional information.

Where a contractor concurs with, or takes no exception to an annual performance evaluation, the Contracting Officer will consider such evaluation final and releasable for source selection purposes. Disagreements between the parties regarding a performance evaluation will be referred to an individual one level above the Contracting Officer, whose decision will be final.

The Contracting Officer will send a copy of the completed evaluation report, marked "Source Selection Information, to the contractor's Project Manager for their records as soon as practicable after it has been finalized. The completed evaluation report also will be used as a tool to improve communications between the NRC and the contractor and to improve contract performance.

The completed annual performance evaluation will be used to support future award decisions in accordance with FAR 42.1502 and 42.1503. During the period the information is being used to provide source selection information, the completed annual performance evaluation will be released to only two parties - the Federal government personnel performing the source selection evaluation and the contractor under evaluation if the contractor does not have a copy of the report already.

(End of Clause)

H.15 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS - GENERAL (JUL 2016)

Page 40

Basic Contract IT Security Requirements The contractor agrees to insert terms that conform substantially to the language of the IT security requirements, excluding any reference to the Changes clause of this contract, into all subcontracts under this contract.

For unclassified information used for the effort, the contractor shall provide an information security categorization document indicating the sensitivity of the information processed as part of this contract if the information security categorization was not provided in the statement of work. The determination shall be made using National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60 and must be approved by the Office of the Chief Information Officer (OCIO). The NRC contracting officer (CO) and Contracting Officers Representative (COR) shall be notified immediately before the contractor begins to process information at a higher sensitivity level.

If the effort includes use or processing of classified information, the NRC CO and COR shall be notified before the contractor begins to process information at a more restrictive classification level.

All work under this contract shall comply with the latest version of policy, procedures and standards. Individual task orders will reference latest versions of standards or exceptions as necessary. These policy, procedures and standards include: NRC Management Directive (MD) volume 12, Security; Computer Security Office policies, procedures and standards; National Institute of Standards and Technology (NIST) guidance and Federal Information Processing Standards (FIPS); and Committee on National Security Systems (CNSS) policy, directives, instructions, and guidance. This information is available at the following links:

NRC Policies, Procedures and Standards (OCIO/ISD - Director, Information Security Directorate, internal website):

http://www.internal.nrc.gov/CSO/policies.html All NRC Management Directives (public website):

http://www.nrc.gov/reading-rm/doc-collections/management-directives/

NIST SP and FIPS documentation is located at:

http://csrc.nist.gov/

CNSS documents are located at:

http://www.cnss.gov/

When e-mail is used, the contractors shall only use NRC provided e-mail accounts to send and receive sensitive information (information that is not releasable to the public) or mechanisms to protect the information during transmission to NRC that have been approved by OCIO/ISD.

All contractor employees must sign the NRC Agency-Wide Rules of Behavior for Authorized Computer Use prior to being granted access to NRC computing resources.

Page 41

The contractor shall adhere to following NRC policies, including but not limited to:

Must meet all federally mandated and NRC defined cybersecurity requirements.

• Management Directive 12.5, NRC Cybersecurity Program

• Computer Security Policy for Encryption of Sensitive Data When Outside of Agency Facilities

• Policy for Copying, Scanning, Printing, and Faxing SGI & Classified Information

• Computer Security Information Protection Policy

• Remote Access Policy

• Laptop Security Policy

• Computer Security Incident Response Policy Contractor will adhere to NRCs use of personal devices to process and store NRC sensitive information. The NRCs BYOD program allows NRC employees and contractors to conduct official government business using supported personal smart phones and tablets.

All work performed at non-NRC facilities shall be in facilities, networks, and computers that have been accredited by NRC for processing information at the sensitivity level of the information being processed.

Contract Performance and Closeout The contractor shall ensure that the NRC data processed during the performance of this contract shall be purged from all data storage components of the contractors computer facility, and the contractor will retain no NRC data within 30 calendar days after contract is completed. Until all data is purged, the contractor shall ensure that any NRC data remaining in any storage component will be protected to prevent unauthorized disclosure.

When a contractor employee no longer requires access to an NRC system, the contractor shall notify the COR within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Upon contract completion, the contractor shall provide a status list of all contractor employees who were users of NRC systems and shall note if any users still require access to the system to perform work if a follow-on contract or task order has been issued by NRC.

Control of Information and Data The contractor shall not publish or disclose in any manner, without the COs written consent, the details of any security controls or countermeasures either designed or developed by the contractor under this contract or otherwise provided by the NRC.

Any IT system used to process NRC sensitive information shall:

Page 42

• Include a mechanism to require users to uniquely identify themselves to the system before beginning to perform any other actions that the system is expected to provide.

• Be able to authenticate data that includes information for verifying the claimed identity of individual users (e.g., passwords).

• Protect authentication data so that it cannot be accessed by any unauthorized user.

• Be able to enforce individual accountability by providing the capability to uniquely identify each individual computer system user.

• Report to appropriate security personnel when attempts are made to guess the authentication data whether inadvertently or deliberately.

Access Controls Any contractor system being used to process NRC data shall be able to define and enforce access privileges for individual users. The discretionary access controls mechanisms shall be configurable to protect objects (e.g., files, folders) from unauthorized access.

The contractor system being used to process NRC data shall provide only essential capabilities and specifically prohibit and/or restrict the use of functions, ports, protocols, and/or services, as specified in the contract/grant.

The contractors shall only use NRC approved methods to send and receive information considered sensitive or classified. Specifically,

• Classified Information - All NRC Classified data being transmitted over a network shall use NSA approved encryption and adhere to guidance in MD 12.2, NRC Classified Information Security Program; MD 12.5, NRC Cybersecurity Program; and any classified encryption guidance provided by the Committee on National Security Systems.

Classified processing shall be only within facilities, computers, and spaces that have been specifically approved for classified processing. All NRC personnel who have been or will be granted an account to access any system or network (to include a stand-alone system or network) on which classified information resides must be an NRC authorized classifier. Contractors must follow the above guidance and procedures when requiring access to or handling classified information. Only designated and authorized classifiers of the contractor may have access to classified information or systems.

• SGI Information - All SGI being transmitted over a network shall adhere to guidance in MD 12.7, NRC Safeguards Information Security Program; and MD 12.5, NRC Cybersecurity Program. SGI processing shall be only within facilities, computers, and spaces that have been specifically approved for SGI processing. Cryptographic modules provided as part of the system shall be validated under the Cryptographic Module Validation Program to conform to NIST FIPS 140-2 overall level 2 and must be operated in FIPS mode. The contractor shall provide the FIPS 140-2 cryptographic module certificate number and a brief description of the encryption module that includes the encryption algorithm(s) used, the key length, and the vendor of the product.

Page 43

• All NRC personnel who have been or will be granted an account to access any system or network (to include a stand-alone system or network) on which SGI resides must be an NRC authorized classifier.

The most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks must be enforced by the system through assigned access authorizations.

Separation of duties for contractor systems used to process NRC information must be enforced by the system through assigned access authorizations.

The mechanisms within the contractor system or application that enforces access control and other security features shall be continuously protected against tampering and/or unauthorized changes.

Configuration Standards All systems used to process NRC sensitive information shall meet NRC configuration standards available at: http://www.internal.nrc.gov/CSO/standards.html.

Information Security Training and Awareness Training Contractors shall ensure that their employees, consultants, and subcontractors that have significant IT responsibilities (e.g., IT administrators, developers, project leads) receive in-depth IT security training in their area of responsibility. This training is at the employers expense.

In compliance with OMB policy, individuals with significant cybersecurity responsibilities (e.g., ISSOs, System Administrators) must complete required role-based training before assuming the role. NRC contractors must ensure that their staff receives the requisite role-based cybersecurity training at the contractors expense.

Media Handling All media used by the contractor to store or process NRC information shall be controlled in accordance with the sensitivity level.

The contractor shall not perform sanitization or destruction of media approved for processing NRC information designated as SGI or Classified. The contractor must provide the media to NRC for destruction.

Vulnerability Management The Contractor must adhere to NRC patch management processes for all systems used to process NRC information. Patch Management reports will made available to the NRC upon request for following security categorizations and reporting timeframes:

• 5 calendar days after being requested for a high sensitivity system

• 10 calendar days after being requested for a moderate sensitivity system

• 15 calendar days after being requested for a low sensitivity system Page 44

For any contractor system used to process NRC information, the contractor must ensure that information loaded into the system is scanned for viruses prior to posting; servers are scanned for malware, including viruses, adware, and spyware, on a regular basis; and virus signatures are updated at the following frequency:

• 1 calendar day for a high sensitivity system

• 3 calendar days for a moderate sensitivity system

• 7 calendar days for a low sensitivity system For any contractor deliverables or information loaded on external hard drives or other electronic devices, the contractor must ensure that, prior to delivery to the NRC, the device, including software and files, is free of malware, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, browser hijacking software, mobile code, or other malicious code.

(End of Clause)

H.16 NRCH036 IT SECURITY REQUIREMENTS - DEVELOPMENT AND OPERATIONS AND MAINTENANCE REQUIREMENTS (APR 2014)

O&M Security Requirements All system modifications to classified systems must comply with NRC security policies and procedures for classified systems, as well as federal laws, guidance, and standards to ensure Federal Information Security Management Act (FISMA) compliance.

The Contractor shall correct errors in contractor developed software and applicable documentation that are not commercial off-the-shelf which are discovered by the NRC or the contractor. Inability of the parties to determine the cause of software errors shall be resolved in accordance with the Disputes clause in Section I, FAR 52.233-1, incorporated by reference in the contract.

The Contractor shall adhere to the guidance outlined in NIST, SP 800-53, FIPS 200 and NRC guidance for the identification and documentation of minimum security controls.

The contractor shall provide the system requirements traceability matrix at the end of the initiation phase, development/acquisition phase, implementation/assessment phase, operation & maintenance phase and disposal phase that provides the security requirements in a separate section so that they can be traced through the development life cycle. The contractor shall also provide the software and hardware designs and test plan documentation, and source code upon request to the NRC for review.

All development and testing of the systems shall be protected at their assigned system sensitivity level and shall be performed on a network separate and isolated from the NRC operational network.

All system computers must be properly configured and hardened according to NRC policies, guidance, and standards and comply with all NRC security policies Page 45

and procedures as commensurate with the system security categorization.

All contractor provided deliverables identified in the project plan will be subject to the review and approval of NRC Management. The contractor will make the necessary modifications to project deliverables to resolve any identified issues. Project deliverables include but are not limited to: requirements, architectures, design documents, test plans, and test reports.

Access Controls The contractor shall not hardcode any passwords into the software unless the password only appears on the server side (e.g. using server-side technology such as ASP, PHP, or JSP).

The contractor shall ensure that the software does not contain undocumented functions and undocumented methods for gaining access to the software or to the computer system on which it is installed. This includes, but is not limited to, master access keys, back doors, or trapdoors.

Cryptography Cryptographic modules provided as part of the system shall be validated under the Cryptographic Module Validation Program to conform to NIST FIPS 140-2 and must be operated in FIPS mode. The contractor shall provide the FIPS 140-2 cryptographic module certificate number and a brief description of the encryption module that includes the encryption algorithm(s) used, the key length, and the vendor of the product.

Configuration Management and Control The contractor must ensure that the system will be divided into configuration items (CIs). CIs are parts of a system that can be individually managed and versioned. The system shall be managed at the CI level.

The contractor must have a configuration management plan that includes all hardware and software that is part of the system and contains at minimum the following sections:

a. Introduction

i. Purpose & Scope ii. Definitions iii. References

b. Configuration Management

i. Organization ii. Responsibilities iii. Tools and Infrastructure Page 46

c. Configuration Management Activities

i. Specification Identification ii. Change control form identification iii. Project baselines

d. Configuration and Change Control

i. Change Request Processing and Approval ii. Change Control Board

e. Milestones

i. Define baselines, reviews, audits ii. Training and Resources The Information System Security Officers (ISSO's) role in the change management process must be described. The ISSO is responsible for the security posture of the system. Any changes to the system security posture must be approved by the ISSO.

The contractor should not have the ability to make changes to the system's security posture without the appropriate involvement and approval of the ISSO.

The contractor shall track and record information specific to proposed and approved changes that minimally include:

a. Identified configuration change

b. Testing of the configuration change

c. Scheduled implementation the configuration change

d. Track system impact of the configuration change

e. Track the implementation of the configuration change

f. Recording & reporting of configuration change to the appropriate party

g. Back out/Fall back plan

h. Weekly Change Reports and meeting minutes

i. Emergency change procedures

j. List of team members from key functional areas The contractor shall provide a list of software and hardware changes in advance of placing them into operation within the following timeframes:

• 30 calendar days for a classified, SGI, or high sensitivity system Page 47

• 20 calendar days for a moderate sensitivity system

• 10 calendar days for a low sensitivity system The contractor must maintain all system documentation that is current to within:

• 10 calendar days for a classified, SGI, or high sensitivity system

• 20 calendar days for a moderate sensitivity system

• 30 calendar days for a low sensitivity system Modified code, tests performed and test results, issue resolution documentation, and updated system documentation shall be deliverables on the contract.

Any proposed changes to the system must have written approval from the NRC Contracting Officers Representative (COR).

The contractor shall maintain a list of hardware, firmware and software changes that is current to within:

• 15 calendar days for a classified, SGI or high sensitivity system

• 20 calendar days for a moderate sensitivity system

• 30 calendar days for a low sensitivity system The contractor shall analyze proposed hardware and software configurations and modification as well as addressed security vulnerabilities in advance of NRC accepted operational deployment dates within:

• 15 calendar days for a classified, SGI, or high sensitivity system

• 20 calendar days for a moderate sensitivity system

• 30 calendar days for a low sensitivity system The contractor shall provide the above analysis with the proposed hardware and software for NRC testing in advance of NRC accepted operational deployment dates within:

• 15 calendar days for a classified, SGI, or high sensitivity system

• 20 calendar days for a moderate sensitivity system

• 30 calendar days for a low sensitivity system Control of Hardware and Software The contractor shall demonstrate that all hardware and software meet security requirements prior to being placed into the NRC production environment.

Page 48

The contractor shall ensure that the development environment is separated from the operational environment using NRC CSO approved controls.

The contractor shall only use licensed software and in-house developed authorized software (including NRC and contractor developed) on the system and for processing NRC information. Public domain, shareware, or freeware shall only be installed after prior written approval is obtained from the NRC Chief Information Security Officer (CISO).

The contractor shall provide proof of valid software licensing upon request of the Contracting Officer, the NRC COR, a Senior Information Technology Security Officer (SITSO), or the Designated Approving Authorities (DAAs).

Information Security Training and Awareness Training The contractor shall ensure that its employees, in performance of the contract, receive Information Technology (IT) security training in their role at the contractors expense.

The Contractor must provide the NRC written certification that training is complete, along with the title of the course and dates of training as a prerequisite to start of work on the contract.

The IT security role and associated type of training course and periodicity required to be completed are as follows:

Role Type of Training Required Frequency of Training Auditor Vendor specific operating system and application security training, database security training Prior to appointment and then every three years IT Functional Manager Vendor specific operating system and application security training, database security training Prior to appointment and then every two years Additional system specific training upon a major system update/change System Administrator Vendor specific operating system and application security training Prior to appointment and then every year:

• Training in operating system security in the area of responsibility occurs every 2 years

• Training in application security in the area of responsibility occurs every 2 years Information Systems Security Officer ISSO role specific training (not awareness) provided by a government agency or by a vendor such as SANS Vendor specific operating system and application security training Prior to appointment and then every year:

• Training in the ISSO role occurs every 3 years

• Training in operating system security in the area of responsibility occurs every 3 years

• Training in application security in the area of responsibility occurs every 3 Page 49

years Database Administrator Vendor specific database security training Prior to appointment and then every 2 years:

• Training in database security in the area of responsibility occurs every 2 years Network Administrator Network administrator role specific training (not awareness) provided by a government agency or by a vendor such as SANS Network specific security training Prior to appointment and then every year:

• Training in the Network administrator role occurs every 3 years

• Training in network security in the area of responsibility occurs every year where network administrator role training does not occur IT Managers Vendor specific operating system and application security training, database security training. Prior to appointment and then every two years Additional system specific training upon a major system update/change IT System Developer Vendor specific operating system and application security training, database security training Prior to appointment and then every year- training with system-specific training (ISS LoB or commercial) upon assuming the role, to become biannual with NRC provided training every other year.

The contractor must ensure that required refresher training is accomplished in accordance with the required frequency specifically associated with the IT security role.

Auditing The system shall be able to create, maintain and protect from modification or unauthorized access or destruction an audit trail of accesses to the objects it protects. The audit data shall be protected so that read access to it is limited to those who are authorized.

The system shall be able to record the following types of events: use of identification and authentication mechanisms, introduction of objects into a users address space (e.g., file open, program initiation), deletion of objects, and actions taken by computer operators and system administrators or system security officers and other security relevant events. The system shall be able to audit any override of security controls.

The Contractor shall ensure auditing is implemented on the following:

• Operating System

• Application

• Web Server Page 50

• Web Services

• Network Devices

• Database

• Wireless The contractor shall perform audit log reviews daily using automated analysis tools.

Contractor must log at least the following events on systems that process NRC information:

• Audit all failures

• Successful logon attempt

• Failure of logon attempt

• Permission Changes

• Unsuccessful File Access

• Creating users & objects

• Deletion & modification of system files

• Registry Key/Kernel changes

• Startup & shutdown

• Authentication

• Authorization/permission granting

• Actions by trusted users

• Process invocation

• Controlled access to data by individually authenticated user

• Unsuccessful data access attempt

• Data deletion

• Data transfer

• Application configuration change

• Application of confidentiality or integrity labels to data

• Override or modification of data labels or markings

• Output to removable media Page 51

• Output to printer (End of Clause)

H.17 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLY IDENTIFIABLE INFORMATION (PII) (AUG 2011)

In accordance with the Office of Management and Budget's guidance to Federal agencies and the Nuclear Regulatory Commission's (NRC) implementing policy and procedures, a contractor (including subcontractors and contractor employees), who performs work on behalf of the NRC, is responsible for protecting, from unauthorized access or disclosure, personally identifiable information (PII) that may be provided, developed, maintained, collected, used, or disseminated, whether in paper, electronic, or other format, during performance of this contract.

A contractor who has access to NRC owned or controlled PII, whether provided to the contractor by the NRC or developed, maintained, collected, used, or disseminated by the contractor during the course of contract performance, must comply with the following requirements:

(1) General. In addition to implementing the specific requirements set forth in this clause, the contractor must adhere to all other applicable NRC guidance, policy and requirements for the handling and protection of NRC owned or controlled PII. The contractor is responsible for making sure that it has an adequate understanding of such guidance, policy and requirements.

(2) Use, Ownership, and Nondisclosure. A contractor may use NRC owned or controlled PII solely for purposes of this contract, and may not collect or use such PII for any purpose outside the contract without the prior written approval of the NRC Contracting Officer. The contractor must restrict access to such information to only those contractor employees who need the information to perform work under this contract, and must ensure that each such contractor employee (including subcontractors' employees) signs a nondisclosure agreement, in a form suitable to the NRC Contracting Officer, prior to being granted access to the information. The NRC retains sole ownership and rights to its PII. Unless the contract states otherwise, upon completion of the contract, the contractor must turn over all PII in its possession to the NRC, and must certify in writing that it has not retained any NRC owned or controlled PII except as otherwise authorized in writing by the NRC Contracting Officer.

(3) Security Plan. When applicable, and unless waived in writing by the NRC Contracting Officer, the contractor must work with the NRC to develop and implement a security plan setting forth adequate procedures for the protection of NRC owned or controlled PII as well as the procedures which the contractor must follow for notifying the NRC in the event of any security breach. The plan will be incorporated into the contract and must be implemented and followed by the contractor once it has been approved by the NRC Contracting Officer. If the contract does not include a security plan at the time of contract award, a plan must be submitted for the approval of the NRC Contracting Officer within 30 days after contract award.

Page 52

(4) Breach Notification. The contractor must immediately notify the NRC Contracting Officer and the NRC Contracting Officer's Representative (COR) upon discovery of any suspected or confirmed breach in the security of NRC owned or controlled PII.

(5) Legal Demands for Information. If a legal demand is made for NRC owned or controlled PII (such as by subpoena), the contractor must immediately notify the NRC Contracting Officer and the NRC COR. After notification, the NRC will determine whether and to what extent to comply with the legal demand. The Contracting Officer will then notify the contractor in writing of the determination and such notice will indicate the extent of disclosure authorized, if any. The contractor may only release the information specifically demanded with the written permission of the NRC Contracting Officer.

(6) Audits. The NRC may audit the contractor's compliance with the requirements of this clause, including through the use of online compliance software.

(7) Flow-down. The prime contractor will flow this clause down to subcontractors that would be covered by any portion of this clause, as if they were the prime contractor.

(8) Remedies:

(a) The contractor is responsible for implementing and maintaining adequate security controls to prevent the loss of control or unauthorized disclosure of NRC owned or controlled PII in its possession. Furthermore, the contractor is responsible for reporting any known or suspected loss of control or unauthorized access to PII to the NRC in accordance with the provisions set forth in Article 4 above.

(b) Should the contractor fail to meet its responsibilities under this clause, the NRC reserves the right to take appropriate steps to mitigate the contractor's violation of this clause. This may include, at the sole discretion of the NRC, termination of the subject contract.

(9) Indemnification. Notwithstanding any other remedies available to the NRC, the contractor will indemnify the NRC against all liability (including costs and fees) for any damages arising out of violations of this clause.

H.18 UPDATED STANDARDS FOR CONTRACTORS WHO PREPARE NUREG-SERIES MANUSCRIPTS The U.S. Nuclear Regulatory Commission (NRC) began to capture most of its official records electronically on January 1, 2000. The NRC will capture each final NUREG-series publication in its native application. Therefore, please submit your final manuscript that has been approved by the NRC Contracting Officers Representative (COR) in both electronic and camera-ready copy.

All format guidance, as specified in NUREG-0650, Revision 2, will remain the same with one exception. You will no longer be required to include the NUREG-series designator on the bottom of each page of the manuscript. The NRC will assign this designator when we send the camera-ready copy to the printer and will place the designator on the cover, title page, and spine. The designator for each report will no longer be assigned when the decision to prepare a publication is made. The NRC's Page 53

Publishing Services Branch will inform the NRC COR for the publication of the assigned designator when the final manuscript is sent to the printer.

For the electronic manuscript, prepare the text in Microsoft Word, and use any of the following file types for charts, spreadsheets, and the like.

File Types to be used for NUREG-Series Publications:

File Type (File Extension)

Microsoft Word (.doc)

Microsoft PowerPoint (.ppt)

Microsoft Excel (.xls)

Portable Document Format (.pdf)

This list is subject to change if new software packages come into common use at NRC or by our licensees or other stakeholders that participate in the electronic submission process. If a portion of your manuscript is from another source and you cannot obtain an acceptable electronic file type for this portion (e.g., an appendix from an old publication), the NRC can, if necessary, create a tagged image file format (file extension.tif) for that portion of your report.

Note that you should continue to submit original photographs, which will be scanned, since digitized photographs do not print well.

H.19 COPYRIGHT OF CODES - SPECIAL NUCLEAR PURPOSE LICENSE (A) The NRC may, pursuant to Section (c) of FAR Clause 52-227-14 permit and may pursuant to paragraph (c) of FAR 52.227-17, direct the contractor to claim a copyright in computer software and associated data first produced in the performance of this contract. In addition to the general government license rights identified in Section (c) of FAR Clause 52.227-14, and paragraph (c) of FAR 52.227-17, such copyright shall be subject to the following Special Nuclear Purpose License rights:

In addition to the license rights granted the government under paragraph (c) of the clause at 52.227-14, RIGHTS IN DATA-GENERAL (DEC 2007) and paragraph (c) of FAR 52.227-17, RIGHTS IN DATA- Special Works, whenever copyright to software is asserted by the Contractor, the contractor grants the NRC and others acting on its behalf an exclusive, paid up, worldwide, irrevocable license to use, disclose, reproduce, prepare derivative works and distribute any code developed in the performance of the award for nuclear health and safety purposes, which may include analyses of operational, decommissioned, or designs of nuclear reactor systems and other such facilities involving nuclear technology performed by parties which may include but are not limited to licensees, vendors, contractors, educational institutions, public interest groups, participants in NRC international agreement programs and other government agencies. Further, consistent with NRCAR 2052.209-72, CONTRACTOR ORGANIZATIONAL CONFLICTS OF INTEREST, the contractor agrees that it will not sell or distribute the code to or for the use of such parties or participants identified in NRCAR 2052.209-72(c)(1) and (c)(2) and that it will not provide technical services relating to the code to such parties or participants, unless authorized by NRC.

Page 54

In addition, the contractor grants NRC the right to use, disclose, reproduce, prepare derivative works and distribute any future improvements or derivative works made to the code in the field of nuclear health and safety. Per 41 USC § 2302(b)(2), NRC retains the right to improvements made to the code resulting from the contractor's commercial activity that the NRC contracting officer determines are necessary to operate and maintain software developed under this contract. Further, the contractor agrees to include in any licensing agreement that it may enter into with a third party such limitations as are necessary to preserve the rights of the government, and limit the sale and distribution of the software as described above and as limited by the U.S.

Departments of Commerce and State concerning foreign sales.

(B) The NRC reserves the right to direct the contractor to transfer the copyright in codes and associated data developed under this contract to successor contractors subject to the above general government and special license rights. Should NRC determine that it is in the government's interest to have NRC staff perform the software development and maintenance work required under this contract, the contractor agrees to maintain the copyright subject to the above general government and special license rights.

For the electronic manuscript, prepare the text in MS Word, and use any of the following file types for charts, spreadsheets, and the like.

File Types to be used for NUREG-Series Publications:

File Type (File Extension) Word (.doc) Microsoft PowerPoint (.ppt) Microsoft Excel

(.xls) Portable Document Format (.pdf)

This list is subject to change if new software packages come into common use at NRC or by our licensees or other stakeholders that participate in the electronic submission process. If a portion of your manuscript is from another source and you cannot obtain an acceptable electronic file type for this portion (e.g., an appendix from an old publication), the NRC can, if necessary, create a tagged image file format (file extension.tif) for that portion of your report.

Note that you should continue to submit original photographs, which will be scanned, since digitized photographs do not print well.

If you chose to publish a compact disk (CD) of your publication, place on the CD copies of the manuscript in both (1) a portable document format (PDF); and (2) a Word file format.

Page 55

SECTION I - Contract Clauses I.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE. (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es): https://www.acquisition.gov/

52.202-1 DEFINITIONS. (NOV 2013) 52.203-3 GRATUITIES. (APR 1984) 52.203-5 COVENANT AGAINST CONTINGENT FEES. (MAY 2014) 52.203-6 RESTRICTIONS ON SUBCONTRACTOR SALES TO THE GOVERNMENT. (SEP 2006) 52.203-7 ANTI-KICKBACK PROCEDURES. (MAY 2014) 52.203-8 CANCELLATION, RESCISSION, AND RECOVERY OF FUNDS FOR ILLEGAL OR IMPROPER ACTIVITY. (MAY 2014) 52.203-10 PRICE OR FEE ADJUSTMENT FOR ILLEGAL OR IMPROPER ACTIVITY. (MAY 2014) 52.203-12 LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS. (OCT 2010) 52.203-13 CONTRACTOR CODE OF BUSINESS ETHICS AND CONDUCT. (OCT 2015) 52.204-4 PRINTED OR COPIED DOUBLE-SIDED ON POSTCONSUMER FIBER CONTENT PAPER. (MAY 2011) 52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2018) 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL. (JAN 2011) 52.204-10 REPORTING EXECUTIVE COMPENSATION AND FIRST-TIER SUBCONTRACT AWARDS. (OCT 2018) 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE. (OCT 2018) 52.204-15 SERVICE CONTRACT REPORTING REQUIREMENTS FOR INDEFINITE-DELIVERY CONTRACTS. (OCT 2016) 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS. (DEC 2014) 52.209-6 PROTECTING THE GOVERNMENT'S INTEREST WHEN SUBCONTRACTING WITH CONTRACTORS DEBARRED, SUSPENDED, OR PROPOSED FOR DEBARMENT. (OCT 2015) 52.209-9 UPDATES OF PUBLICLY AVAILABLE INFORMATION REGARDING RESPONSIBILITY MATTERS. (OCT 2018) 52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL LAW. (FEB 2016) 52.210-1 MARKET RESEARCH. (APR 2011) 52.215-2 AUDIT AND RECORDS - NEGOTIATION. (OCT 2010) 52.215-8 ORDER OF PRECEDENCE - UNIFORM CONTRACT FORMAT. (OCT 1997) 52.215-10 PRICE REDUCTION FOR DEFECTIVE CERTIFIED COST OR PRICING DATA. (AUG 2011) 52.215-12 SUBCONTRACTOR CERTIFIED COST OR PRICING DATA. (OCT 2010) 52.215-14 INTEGRITY OF UNIT PRICES. (OCT 2010)

Page 56

52.215-23 LIMITATIONS ON PASS-THROUGH CHARGES. (OCT 2009) 52.216-8 FIXED FEE. (JUN 2011) 52.216-26 PAYMENTS OF ALLOWABLE COSTS BEFORE DEFINITIZATION. (DEC 2002) 52.219-8 UTILIZATION OF SMALL BUSINESS CONCERNS. (OCT 2018) 52.219-16 LIQUIDATED DAMAGES - SUBCONTRACTING PLAN. (JAN 1999) 52.222-3 CONVICT LABOR. (JUN 2003) 52.222-19 CHILD LABOR - COOPERATION WITH AUTHORITIES AND REMEDIES. (JAN 2018) 52.222-21 PROHIBITION OF SEGREGATED FACILITIES. (APR 2015) 52.222-26 EQUAL OPPORTUNITY. (SEP 2016) 52.222-35 EQUAL OPPORTUNITY FOR VETERANS. (OCT 2015) 52.222-36 EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES. (JUL 2014) 52.222-37 EMPLOYMENT REPORTS ON VETERANS. (FEB 2016) 52.222-40 NOTIFICATION OF EMPLOYEE RIGHTS UNDER THE NATIONAL LABOR RELATIONS ACT. (DEC 2010) 52.222-50 COMBATING TRAFFICKING IN PERSONS. (MAR 2015) 52.222-54 EMPLOYMENT ELIGIBILITY VERIFICATION. (OCT 2015) 52.223-6 DRUG-FREE WORKPLACE. (MAY 2001) 52.223-18 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT MESSAGING WHILE DRIVING. (AUG 2011) 52.225-13 RESTRICTIONS ON CERTAIN FOREIGN PURCHASES. (JUN 2008) 52.227-1 AUTHORIZATION AND CONSENT. (DEC 2007) 52.227-2 NOTICE AND ASSISTANCE REGARDING PATENT AND COPYRIGHT INFRINGEMENT. (DEC 2007) 52.227-14 RIGHTS IN DATA-GENERAL. (MAY 2014) ALTERNATE III (DEC 2007) 52.227-16 ADDITIONAL DATA REQUIREMENTS. (JUN 1987) 52.227-17 RIGHTS IN DATA--SPECIAL WORKS. (DEC 2007) 52.228-7 INSURANCE - LIABILITY TO THIRD PERSONS. (MAR 1996) 52.230-2 COST ACCOUNTING STANDARDS. (OCT 2015) 52.230-6 ADMINISTRATION OF COST ACCOUNTING STANDARDS. (JUN 2010) 52.232-17 INTEREST. (MAY 2014) 52.232-18 AVAILABILITY OF FUNDS. (APR 1984) 52.232-23 ASSIGNMENT OF CLAIMS. (MAY 2014) 52.232-25 PROMPT PAYMENT. (JAN 2017) 52.232-33 PAYMENT BY ELECTRONIC FUNDS TRANSFER - SYSTEM FOR AWARD MANAGEMENT. (OCT 2018) 52.233-1 DISPUTES. (MAY 2014) 52.233-3 PROTEST AFTER AWARD. (AUG 1996) - ALTERNATE I (JUN 1985) 52.233-4 APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM. (OCT 2004) 52.242-1 NOTICE OF INTENT TO DISALLOW COSTS. (APR 1984) 52.242-3 PENALTIES FOR UNALLOWABLE COSTS. (MAY 2014) 52.242-4 CERTIFICATION OF FINAL INDIRECT COSTS. (JAN 1997) 52.242-5 PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS. (JAN 2017) 52.242-13 BANKRUPTCY. (JUL 1995) 52.243-2 CHANGES - COST-REIMBURSEMENT. (AUG 1987) 52.244-5 COMPETITION IN SUBCONTRACTING (DEC 1996) 52.244-6 SUBCONTRACTS FOR COMMERCIAL ITEMS. (OCT 2018)

Page 57

52.245-1 GOVERNMENT PROPERTY. (JAN 2017) 52.245-9 USE AND CHARGES. (APR 2012) 52.246-25 LIMITATION OF LIABILITY - SERVICES. (FEB 1997) 52.248-1 VALUE ENGINEERING. (OCT 2010) 52.249-6 TERMINATION (COST-REIMBURSEMENT). (MAY 2004) 52.253-1 COMPUTER GENERATED FORMS. (JAN 1991)

I.2 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities.

1. (a) (a) Definitions. As used in this clause Covered article means any hardware, software, or service that-

a. (1) Is developed or provided by a covered entity;

b. (2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or

c. (3) Contains components using any hardware or software developed in whole or in part by a covered entity.

Covered entity means-

d. (1) Kaspersky Lab;

e. (2) Any successor entity to Kaspersky Lab;

f. (3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

g. (4) Any entity of which Kaspersky Lab has a majority ownership.

2. (b) (b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any covered article. The Contractor is prohibited from

a. (1) Providing any covered article that the Government will use on or after October 1, 2018; and

b. (2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.

3. (c) (c) Reporting requirement.

a. (1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil.

b. (2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

i. (i) Within 1 business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item Page 58

description; and any readily available information about mitigation actions undertaken or recommended.

ii. (ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles.

4. (d) (d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items.

(End of clause)

I.3 52.216-7 ALLOWABLE COST AND PAYMENT. (AUG 2018)

(a) Invoicing. (1) The Government will make payments to the Contractor when requested as work progresses, but (except for small business concerns) not more often than once every 2 weeks, in amounts determined to be allowable by the Contracting Officer in accordance with Federal Acquisition Regulation (FAR) subpart 31.2 in effect on the date of this contract and the terms of this contract. The Contractor may submit to an authorized representative of the Contracting Officer, in such form and reasonable detail as the representative may require, an invoice or voucher supported by a statement of the claimed allowable cost for performing this contract.

(2) Contract financing payments are not subject to the interest penalty provisions of the Prompt Payment Act. Interim payments made prior to the final payment under the contract are contract financing payments, except interim payments if this contract contains Alternate I to the clause at 52.232-25.

(3) The designated payment office will make interim payments for contract financing on the 30th day after the designated billing office receives a proper payment request.

In the event that the Government requires an audit or other review of a specific payment request to ensure compliance with the terms and conditions of the contract, the designated payment office is not compelled to make payment by the specified due date.

(b) Reimbursing costs. (1) For the purpose of reimbursing allowable costs (except as provided in paragraph (b)(2) of the clause, with respect to pension, deferred profit sharing, and employee stock ownership plan contributions), the term costs includes only-(i) Those recorded costs that, at the time of the request for reimbursement, the Contractor has paid by cash, check, or other form of actual payment for items or services purchased directly for the contract; (ii) When the Contractor is not delinquent in paying costs of contract performance in the ordinary course of business, costs incurred, but not necessarily paid, for-(A) Supplies and services purchased directly for the contract and associated financing payments to subcontractors, provided payments determined due will be made-Page 59

(1) In accordance with the terms and conditions of a subcontract or invoice; and (2) Ordinarily within 30 days of the submission of the Contractor's payment request to the Government; (B) Materials issued from the Contractor's inventory and placed in the production process for use on the contract; (C) Direct labor; (D) Direct travel; (E) Other direct in-house costs; and (F) Properly allocable and allowable indirect costs, as shown in the records maintained by the Contractor for purposes of obtaining reimbursement under Government contracts; and (iii) The amount of financing payments that have been paid by cash, check, or other forms of payment to subcontractors.

(2) Accrued costs of Contractor contributions under employee pension plans shall be excluded until actually paid unless-(i) The Contractor's practice is to make contributions to the retirement fund quarterly or more frequently; and (ii) The contribution does not remain unpaid 30 days after the end of the applicable quarter or shorter payment period (any contribution remaining unpaid shall be excluded from the Contractor's indirect costs for payment purposes).

(3) Notwithstanding the audit and adjustment of invoices or vouchers under paragraph (g) below, allowable indirect costs under this contract shall be obtained by applying indirect cost rates established in accordance with paragraph (d) below.

(4) Any statements in specifications or other documents incorporated in this contract by reference designating performance of services or furnishing of materials at the Contractor's expense or at no cost to the Government shall be disregarded for purposes of cost-reimbursement under this clause.

(c) Small business concerns. A small business concern may receive more frequent payments than every 2 weeks.

(d) Final indirect cost rates. (1) Final annual indirect cost rates and the appropriate bases shall be established in accordance with subpart 42.7 of the Federal Acquisition Regulation (FAR) in effect for the period covered by the indirect cost rate proposal.

(2)(i) The Contractor shall submit an adequate final indirect cost rate proposal to the Contracting Officer (or cognizant Federal agency official) and auditor within the 6-month period following the expiration of each of its fiscal years. Reasonable extensions, for exceptional circumstances only, may be requested in writing by the Contractor and granted in writing by the Contracting Officer. The Contractor shall support its proposal with adequate supporting data.

Page 60

(ii) The proposed rates shall be based on the Contractor's actual cost experience for that period. The appropriate Government representative and the Contractor shall establish the final indirect cost rates as promptly as practical after receipt of the Contractor's proposal.

(iii) An adequate indirect cost rate proposal shall include the following data unless otherwise specified by the cognizant Federal agency official:

(A) Summary of all claimed indirect expense rates, including pool, base, and calculated indirect rate.

(B) General and Administrative expenses (final indirect cost pool). Schedule of claimed expenses by element of cost as identified in accounting records (Chart of Accounts).

(C) Overhead expenses (final indirect cost pool). Schedule of claimed expenses by element of cost as identified in accounting records (Chart of Accounts) for each final indirect cost pool.

(D) Occupancy expenses (intermediate indirect cost pool). Schedule of claimed expenses by element of cost as identified in accounting records (Chart of Accounts) and expense reallocation to final indirect cost pools.

(E) Claimed allocation bases, by element of cost, used to distribute indirect costs.

(F) Facilities capital cost of money factors computation.

(G) Reconciliation of books of account (i.e., General Ledger) and claimed direct costs by major cost element.

(H) Schedule of direct costs by contract and subcontract and indirect expense applied at claimed rates, as well as a subsidiary schedule of Government participation percentages in each of the allocation base amounts.

(I) Schedule of cumulative direct and indirect costs claimed and billed by contract and subcontract.

(J) Subcontract information. Listing of subcontracts awarded to companies for which the contractor is the prime or upper-tier contractor (include prime and subcontract numbers; subcontract value and award type; amount claimed during the fiscal year; and the subcontractor name, address, and point of contact information).

(K) Summary of each time-and-materials and labor-hour contract information, including labor categories, labor rates, hours, and amounts; direct materials; other direct costs; and, indirect expense applied at claimed rates.

(L) Reconciliation of total payroll per IRS form 941 to total labor costs distribution.

(M) Listing of decisions/agreements/approvals and description of accounting/organizational changes.

(N) Certificate of final indirect costs (see 52.242-4, Certification of Final Indirect Costs).

Page 61

(O) Contract closing information for contracts physically completed in this fiscal year (include contract number, period of performance, contract ceiling amounts, contract fee computations, level of effort, and indicate if the contract is ready to close).

(iv) The following supplemental information is not required to determine if a proposal is adequate, but may be required during the audit process:

(A) Comparative analysis of indirect expense pools detailed by account to prior fiscal year and budgetary data.

(B) General organizational information and limitation on allowability of compensation for certain contractor personnel. See 31.205-6(p). Additional salary reference information is available at https://www.whitehouse.gov/ wp-content/uploads/2017/11/ContractorCompensationCapContractsAwardedBeforeJune24.

pdf and https://www.whitehouse.gov/wp-content/uploads/2017/11/ContractorCompensationCapContractsAwardedafterJune24.pd f.

(C) Identification of prime contracts under which the contractor performs as a subcontractor.

(D) Description of accounting system (excludes contractors required to submit a CAS Disclosure Statement or contractors where the description of the accounting system has not changed from the previous year's submission).

(E) Procedures for identifying and excluding unallowable costs from the costs claimed and billed (excludes contractors where the procedures have not changed from the previous year's submission).

(F) Certified financial statements and other financial data (e.g., trial balance, compilation, review, etc.).

(G) Management letter from outside CPAs concerning any internal control weaknesses.

(H) Actions that have been and/or will be implemented to correct the weaknesses described in the management letter from subparagraph (G) of this section.

(I) List of all internal audit reports issued since the last disclosure of internal audit reports to the Government.

(J) Annual internal audit plan of scheduled audits to be performed in the fiscal year when the final indirect cost rate submission is made.

(K) Federal and State income tax returns.

(L) Securities and Exchange Commission 10-K annual report.

(M) Minutes from board of directors meetings.

(N) Listing of delay claims and termination claims submitted which contain costs relating to the subject fiscal year.

Page 62

(O) Contract briefings, which generally include a synopsis of all pertinent contract provisions, such as: Contract type, contract amount, product or service(s) to be provided, contract performance period, rate ceilings, advance approval requirements, pre-contract cost allowability limitations, and billing limitations.

(v) The Contractor shall update the billings on all contracts to reflect the final settled rates and update the schedule of cumulative direct and indirect costs claimed and billed, as required in paragraph (d)(2)(iii)(I) of this section, within 60 days after settlement of final indirect cost rates.

(3) The Contractor and the appropriate Government representative shall execute a written understanding setting forth the final indirect cost rates. The understanding shall specify (i) the agreed-upon final annual indirect cost rates, (ii) the bases to which the rates apply, (iii) the periods for which the rates apply, (iv) any specific indirect cost items treated as direct costs in the settlement, and (v) the affected contract and/or subcontract, identifying any with advance agreements or special terms and the applicable rates. The understanding shall not change any monetary ceiling, contract obligation, or specific cost allowance or disallowance provided for in this contract. The understanding is incorporated into this contract upon execution.

(4) Failure by the parties to agree on a final annual indirect cost rate shall be a dispute within the meaning of the Disputes clause.

(5) Within 120 days (or longer period if approved in writing by the Contracting Officer) after settlement of the final annual indirect cost rates for all years of a physically complete contract, the Contractor shall submit a completion invoice or voucher to reflect the settled amounts and rates. The completion invoice or voucher shall include settled subcontract amounts and rates. The prime contractor is responsible for settling subcontractor amounts and rates included in the completion invoice or voucher and providing status of subcontractor audits to the contracting officer upon request.

(6)(i) If the Contractor fails to submit a completion invoice or voucher within the time specified in paragraph (d)(5) of this clause, the Contracting Officer may-(A) Determine the amounts due to the Contractor under the contract; and (B) Record this determination in a unilateral modification to the contract.

(ii) This determination constitutes the final decision of the Contracting Officer in accordance with the Disputes clause.

(e) Billing rates. Until final annual indirect cost rates are established for any period, the Government shall reimburse the Contractor at billing rates established by the Contracting Officer or by an authorized representative (the cognizant auditor), subject to adjustment when the final rates are established. These billing rates-(1) Shall be the anticipated final rates; and (2) May be prospectively or retroactively revised by mutual agreement, at either party's request, to prevent substantial overpayment or underpayment.

Page 63

(f) Quick-closeout procedures. Quick-closeout procedures are applicable when the conditions in FAR 42.708(a) are satisfied.

(g) Audit. At any time or times before final payment, the Contracting Officer may have the Contractor's invoices or vouchers and statements of cost audited. Any payment may be (1) reduced by amounts found by the Contracting Officer not to constitute allowable costs or (2) adjusted for prior overpayments or underpayments.

(h) Final payment. (1) Upon approval of a completion invoice or voucher submitted by the Contractor in accordance with paragraph (d)(5) of this clause, and upon the Contractor's compliance with all terms of this contract, the Government shall promptly pay any balance of allowable costs and that part of the fee (if any) not previously paid.

(2) The Contractor shall pay to the Government any refunds, rebates, credits, or other amounts (including interest, if any) accruing to or received by the Contractor or any assignee under this contract, to the extent that those amounts are properly allocable to costs for which the Contractor has been reimbursed by the Government. Reasonable expenses incurred by the Contractor for securing refunds, rebates, credits, or other amounts shall be allowable costs if approved by the Contracting Officer. Before final payment under this contract, the Contractor and each assignee whose assignment is in effect at the time of final payment shall execute and deliver-(i) An assignment to the Government, in form and substance satisfactory to the Contracting Officer, of refunds, rebates, credits, or other amounts (including interest, if any) properly allocable to costs for which the Contractor has been reimbursed by the Government under this contract; and (ii) A release discharging the Government, its officers, agents, and employees from all liabilities, obligations, and claims arising out of or under this contract, except-(A) Specified claims stated in exact amounts, or in estimated amounts when the exact amounts are not known; (B) Claims (including reasonable incidental expenses) based upon liabilities of the Contractor to third parties arising out of the performance of this contract; provided, that the claims are not known to the Contractor on the date of the execution of the release, and that the Contractor gives notice of the claims in writing to the Contracting Officer within 6 years following the release date or notice of final payment date, whichever is earlier; and (C) Claims for reimbursement of costs, including reasonable incidental expenses, incurred by the Contractor under the patent clauses of this contract, excluding, however, any expenses arising from the Contractor's indemnification of the Government against patent liability.

(End of clause)

I.4 52.216-18 ORDERING. (OCT 1995)

(a) Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in Page 64

the Schedule. Such orders may be issued from date of award through contract expiration.

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c) If mailed, a delivery order or task order is considered "issued" when the Government deposits the order in the mail. Orders may be issued orally, by facsimile, or by electronic commerce methods only if authorized in the Schedule.

(End of clause)

I.5 52.216-19 ORDER LIMITATIONS. (OCT 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than $500.00, the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor-(1) Any order for a single item in excess of $30,000.00; (2) Any order for a combination of items in excess of $5,000,000.00; or (3) A series of orders from the same ordering office within 30 days that together call for quantities exceeding the limitation in subparagraph (b)(1) or (2) above.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph (b) above.

(d) Notwithstanding paragraphs (b) and (c) above, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within 5 days after issuance, with written notice stating the Contractor's intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

(End of clause)

I.6 52.216-22 INDEFINITE QUANTITY. (OCT 1995)

(a) This is an indefinite-quantity contract for the supplies or services specified, and effective for the period stated, in the Schedule. The quantities of supplies and services specified in the Schedule are estimates only and are not purchased by this contract.

(b) Delivery or performance shall be made only as authorized by orders issued in accordance with the Ordering clause. The Contractor shall furnish to the Government, when and if ordered, the supplies or services specified in the Schedule up to and including the quantity designated in the Schedule as the maximum. The Government Page 65

shall order at least the quantity of supplies or services designated in the Schedule as the minimum.

(c) Except for any limitations on quantities in the Order Limitations clause or in the Schedule, there is no limit on the number of orders that may be issued. The Government may issue orders requiring delivery to multiple destinations or performance at multiple locations.

(d) Any order issued during the effective period of this contract and not completed within that period shall be completed by the Contractor within the time specified in the order.

The contract shall govern the Contractor's and Government's rights and obligations with respect to that order to the same extent as if the order were completed during the contract's effective period; provided, that the Contractor shall not be required to make any deliveries under this contract after 12 months from the expiration date of the contract.

(End of clause)

I.7 52.217-8 OPTION TO EXTEND SERVICES. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days before exercising the option.

(End of clause)

I.8 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30days (60 days unless a different number of days is inserted) before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years.

(End of clause)

I.9 52.232-20 LIMITATION OF COST (APR 1984)

(a) The parties estimate that performance of this contract, exclusive of any fee, will not cost the Government more than (1) the estimated cost specified in the Schedule or, (2) if this is a cost-sharing contract, the Government's share of the estimated cost specified in the Schedule. The Contractor agrees to use its best efforts to perform the work specified in the Schedule and all obligations under this contract within the estimated cost, which, if Page 66

this is a cost-sharing contract, includes both the Government's and the Contractor's share of the cost.

(b) The Contractor shall notify the Contracting Officer in writing whenever it has reason to believe that -

(1) The costs the Contractor expects to incur under this contract in the next 60 days, when added to all costs previously incurred, will exceed 75 percent of the estimated cost specified in the Schedule; or (2) The total cost for the performance of this contract, exclusive of any fee, will be either greater or substantially less than had been previously estimated.

(c) As part of the notification, the Contractor shall provide the Contracting Officer a revised estimate of the total cost of performing this contract.

(d) Except as required by other provisions of this contract, specifically citing and stated to be an exception to this clause -

(1) The Government is not obligated to reimburse the Contractor for costs incurred in excess of (i) the estimated cost specified in the Schedule or, (ii) if this is a cost-sharing contract, the estimated cost to the Government specified in the Schedule; and (2) The Contractor is not obligated to continue performance under this contract (including actions under the Termination clause of this contract) or otherwise incur costs in excess of the estimated cost specified in the Schedule, until the Contracting Officer (i) notifies the Contractor in writing that the estimated cost has been increased and (ii) provides a revised estimated total cost of performing this contract. If this is a cost-sharing contract, the increase shall be allocated in accordance with the formula specified in the Schedule.

(e) No notice, communication, or representation in any form other than that specified in subparagraph (d)(2) above, or from any person other than the Contracting Officer, shall affect this contract's estimated cost to the Government. In the absence of the specified notice, the Government is not obligated to reimburse the Contractor for any costs in excess of the estimated cost or, if this is a cost-sharing contract, for any costs in excess of the estimated cost to the Government specified in the Schedule, whether those excess costs were incurred during the course of the contract or as a result of termination.

(f) If the estimated cost specified in the Schedule is increased, any costs the Contractor incurs before the increase that are in excess of the previously estimated cost shall be allowable to the same extent as if incurred afterward, unless the Contracting Officer issues a termination or other notice directing that the increase is solely to cover termination or other specified expenses.

(g) Change orders shall not be considered an authorization to exceed the estimated cost to the Government specified in the Schedule, unless they contain a statement increasing the estimated cost.

Page 67

(h) If this contract is terminated or the estimated cost is not increased, the Government and the Contractor shall negotiate an equitable distribution of all property produced or purchased under the contract, based upon the share of costs incurred by each.

(End of clause)

I.10 52.232-22 LIMITATION OF FUNDS. (APR 1984)

(a) The parties estimate that performance of this contract will not cost the Government more than (1) the estimated cost specified in the Schedule or, (2) if this is a cost-sharing contract, the Government's share of the estimated cost specified in the Schedule. The Contractor agrees to use its best efforts to perform the work specified in the Schedule and all obligations under this contract within the estimated cost, which, if this is a cost-sharing contract, includes both the Government's and the Contractor's share of the cost.

(b) The Schedule specifies the amount presently available for payment by the Government and allotted to this contract, the items covered, the Government's share of the cost if this is a cost-sharing contract, and the period of performance it is estimated the allotted amount will cover. The parties contemplate that the Government will allot additional funds incrementally to the contract up to the full estimated cost to the Government specified in the Schedule, exclusive of any fee. The Contractor agrees to perform, or have performed, work on the contract up to the point at which the total amount paid and payable by the Government under the contract approximates but does not exceed the total amount actually allotted by the Government to the contract.

(c) The Contractor shall notify the Contracting Officer in writing whenever it has reason to believe that the costs it expects to incur under this contract in the next 60 days, when added to all costs previously incurred, will exceed 75 percent of (1) the total amount so far allotted to the contract by the Government or, (2) if this is a cost-sharing contract, the amount then allotted to the contract by the Government plus the Contractor's corresponding share. The notice shall state the estimated amount of additional funds required to continue performance for the period specified in the Schedule.

(d) Sixty days before the end of the period specified in the Schedule, the Contractor shall notify the Contracting Officer in writing of the estimated amount of additional funds, if any, required to continue timely performance under the contract or for any further period specified in the Schedule or otherwise agreed upon, and when the funds will be required.

(e) If, after notification, additional funds are not allotted by the end of the period specified in the Schedule or another agreed-upon date, upon the Contractor's written request the Contracting Officer will terminate this contract on that date in accordance with the provisions of the Termination clause of this contract. If the Contractor estimates that the funds available will allow it to continue to discharge its obligations beyond that date, it may specify a later date in its request, and the Contracting Officer may terminate this contract on that later date.

(f) Except as required by other provisions of this contract, specifically citing and stated to be an exception to this clause (1) the Government is not obligated to reimburse the Contractor for costs incurred in excess of the total amount allotted by the Government to this contract and (2) the Contractor is not obligated to continue performance under this Page 68

contract (including actions under the Termination clause of this contract) or otherwise incur costs in excess of (i) the amount then allotted to the contract by the Government or (ii) if this is a cost-sharing contract, the amount then allotted by the Government to the contract plus the Contractor's corresponding share, until the Contracting Officer notifies the Contractor in writing that the amount allotted by the Government has been increased and specifies an increased amount, which shall then constitute the total amount allotted by the Government to this contract.

(g) The estimated cost shall be increased to the extent that (1) the amount allotted by the Government or, (2) if this is a cost-sharing contract, the amount then allotted by the Government to the contract plus the Contractor's corresponding share, exceeds the estimated cost specified in the Schedule. If this is a cost-sharing contract, the increase shall be allocated in accordance with the formula specified in the Schedule.

(h) No notice, communication, or representation in any form other than that specified in subparagraph (f)(2) above, or from any person other than the Contracting Officer, shall affect the amount allotted by the Government to this contract. In the absence of the specified notice, the Government is not obligated to reimburse the Contractor for any costs in excess of the total amount allotted by the Government to this contract, whether incurred during the course of the contract or as a result of termination.

(i) When and to the extent that the amount allotted by the Government to the contract is increased, any costs the Contractor incurs before the increase that are in excess of (1)

The amount previously allotted by the Government or (2) if this is a cost-sharing contract, the amount previously allotted by the Government to the contract plus the Contractor's corresponding share, shall be allowable to the same extent as if incurred afterward, unless the Contracting Officer issues a termination or other notice and directs that the increase is solely to cover termination or other specified expenses.

(j) Change orders shall not be considered an authorization to exceed the amount allotted by the Government specified in the Schedule, unless they contain a statement increasing the amount allotted.

(k) Nothing in this clause shall affect the right of the Government to terminate this contract. If this contract is terminated, the Government and the Contractor shall negotiate an equitable distribution of all property produced or purchased under the contract, based upon the share of costs incurred by each.

(l) If the Government does not allot sufficient funds to allow completion of the work, the Contractor is entitled to a percentage of the fee specified in the Schedule equaling the percentage of completion of the work contemplated by this contract.

(End of clause)

I.11 52.244-2 SUBCONTRACTS. (OCT 2010) - ALTERNATE I (JUN 2007)

(a) Definitions. As used in this clause-Approved purchasing system means a Contractor's purchasing system that has been reviewed and approved in accordance with Part 44 of the Federal Acquisition Regulation (FAR).

Page 69

Consent to subcontract means the Contracting Officer's written consent for the Contractor to enter into a particular subcontract.

Subcontract means any contract, as defined in FAR Subpart 2.1, entered into by a subcontractor to furnish supplies or services for performance of the prime contract or a subcontract. It includes, but is not limited to, purchase orders, and changes and modifications to purchase orders.

(b) When this clause is included in a fixed-price type contract, consent to subcontract is required only on unpriced contract actions (including unpriced modifications or unpriced delivery orders), and only if required in accordance with paragraph (c) or (d) of this clause.

(c) If the Contractor does not have an approved purchasing system, consent to subcontract is required for any subcontract that-(1) Is of the cost-reimbursement, time-and-materials, or labor-hour type; or (2) Is fixed-price and exceeds-(i) For a contract awarded by the Department of Defense, the Coast Guard, or the National Aeronautics and Space Administration, the greater of the simplified acquisition threshold or 5 percent of the total estimated cost of the contract; or (ii) For a contract awarded by a civilian agency other than the Coast Guard and the National Aeronautics and Space Administration, either the simplified acquisition threshold or 5 percent of the total estimated cost of the contract.

(d) If the Contractor has an approved purchasing system, the Contractor nevertheless shall obtain the Contracting Officer's written consent before placing the following subcontracts:

All Subcontracts (e)(1) The Contractor shall notify the Contracting Officer reasonably in advance of placing any subcontract or modification thereof for which consent is required under paragraph (b), (c), or (d) of this clause, including the following information:

(i) A description of the supplies or services to be subcontracted.

(ii) Identification of the type of subcontract to be used.

(iii) Identification of the proposed subcontractor.

(iv) The proposed subcontract price.

(v) The subcontractor's current, complete, and accurate certified cost or pricing data and Certificate of Current Cost or Pricing Data, if required by other contract provisions.

(vi) The subcontractor's Disclosure Statement or Certificate relating to Cost Accounting Standards when such data are required by other provisions of this contract.

Page 70

(vii) A negotiation memorandum reflecting-(A) The principal elements of the subcontract price negotiations; (B) The most significant considerations controlling establishment of initial or revised prices; (C) The reason certified cost or pricing data were or were not required; (D) The extent, if any, to which the Contractor did not rely on the subcontractor's certified cost or pricing data in determining the price objective and in negotiating the final price; (E) The extent to which it was recognized in the negotiation that the subcontractor's certified cost or pricing data were not accurate, complete, or current; the action taken by the Contractor and the subcontractor; and the effect of any such defective data on the total price negotiated; (F) The reasons for any significant difference between the Contractor's price objective and the price negotiated; and (G) A complete explanation of the incentive fee or profit plan when incentives are used.

The explanation shall identify each critical performance element, management decisions used to quantify each incentive element, reasons for the incentives, and a summary of all trade-off possibilities considered.

(2) If the Contractor has an approved purchasing system and consent is not required under paragraph (c) or (d) of this clause, the Contractor nevertheless shall notify the Contracting Officer reasonably in advance of entering into any (i) cost-plus-fixed-fee subcontract, or (ii) fixed-price subcontract that exceeds either the simplified acquisition threshold or 5 percent of the total estimated cost of this contract. The notification shall include the information required by paragraphs (e)(1)(i) through (e)(1)(iv) of this clause.

(f) Unless the consent or approval specifically provides otherwise, neither consent by the Contracting Officer to any subcontract nor approval of the Contractor's purchasing system shall constitute a determination-(1) Of the acceptability of any subcontract terms or conditions; (2) Of the allowability of any cost under this contract; or (3) To relieve the Contractor of any responsibility for performing this contract.

(g) No subcontract or modification thereof placed under this contract shall provide for payment on a cost-plus-a-percentage-of-cost basis, and any fee payable under cost-reimbursement type subcontracts shall not exceed the fee limitations in FAR 15.404-4(c)(4)(i).

(h) The Contractor shall give the Contracting Officer immediate written notice of any action or suit filed and prompt notice of any claim made against the Contractor by any subcontractor or vendor that, in the opinion of the Contractor, may result in litigation related in any way to this contract, with respect to which the Contractor may be entitled to reimbursement from the Government.

Page 71

(i) The Government reserves the right to review the Contractor's purchasing system as set forth in FAR Subpart 44.3.

(j) Paragraphs (c) and (e) of this clause do not apply to the following subcontracts, which were evaluated during negotiations:

[Incorporated into the contract award.]

I.12 COMPLIANCE WITH SECTION 508 OF THE REHABILITATION ACT OF 1973, AS AMENDED (SEP 2013)

In 1998, Congress amended the Rehabilitation Act of 1973 (29 U.S.C. §794d) as amended by the Workforce Investment Act of 1998 (P.L. 105 - 220), August 7, 1998 to require Federal agencies to make their electronic and information technology (EIT) accessible to people with disabilities. Inaccessible technology interferes with an ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, open new opportunities for people with disabilities, and encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508 (29 U.S.C. §794d), agencies must give disabled employees and members of the public access to information that is comparable to access available to others.

Specifically, Section 508 of that Act requires that when Federal agencies develop, procure, maintain, or use EIT, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. (36 C.F.R. §1194 implements Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at: http://www.access-board.gov/sec508/standards.htm)

Exceptions.

All EIT that the government acquires by purchase or by lease/rental under this contract must meet the applicable accessibility standards at 36 C.F.R. Part 1194, unless one or more of the following exceptions at FAR 39.204 applies to this acquisition (applicable if checked):

[ ] The EIT is for a national security system.

[ ] The EIT is acquired by a contractor incidental to a contract.

[ ] The EIT is located in spaces frequented only by service personnel for maintenance, repair or occasional monitoring of equipment.

[ ] Compliance with the applicable 36 C.F.R. Part 1194 provisions would impose an undue burden on the agency.

Applicable Standards.

Page 72

The following accessibility standards from 36 C.F.R. Part 1194 have been determined to be applicable to this contract/order. See www.section508.gov for more information:

[ ] 1194.21 Software applications and operating systems.

[ ] 1194.22 Web-based intranet and internet information and applications. 16 rules.

[ ] 1194.23 Telecommunications products.

[ ] 1194.24 Video and multimedia products.

[ ] 1194.25 Self contained, closed products.

[ ] 1194.26 Desktop and portable computers.

[ ] 1194.31 Functional performance criteria.

[ ] 1194.41 Information, documentation, and support.

Note: Under the Exceptions paragraph, the Contracting Officer should check the boxes for any exceptions that apply. If no exceptions apply, then the Contracting Officer should, under the Applicable Standards paragraph, check the boxes that indicate which of the standards apply. See FAR Subpart 39.2 and www.section508.gov for additional guidance.

(End of Clause)

Page 73

SECTION J - List of Documents, Exhibits and Other Attachments Attachment Title Date Number 1 Contractor Spending Plan 2 SUBPART 2009.5 Organizational Conflict of Interest 3 Billing Instructions for Cost Reimbursement Contracts Monthly Letter Status Report Instructions for Contracts 4

and Orders 5 NRC Form 187 Page 74