Text

Contract No. 31310020C0027
	ML21123A050
Person / Time
Issue date:	09/24/2020
From:	Domonique Malone; Acquisition Management Division
To:	Kennedy M; Competitive Innovations LLC
References
	Contract No. 31310020C0027
	Download: ML21123A050 (86)
	v • d • e

1. REQUISITION NUMBER PAGE OF SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30 OCIO-20-0240 1 86

2. CONTRACT NO. 3. AWARD/ 4. ORDER NUMBER 5. SOLICITATION NUMBER 6. SOLICITATION 31310020C0027 EFFECTIVE DATE ISSUE DATE 10/01/2020

7. FOR SOLICITATION a. NAME b. TELEPHONE NUMBER (No collect calls) 8. OFFER DUE DATE/LOCAL TIME INFORMATION CALL: BANU GOLDFEIZ

9. ISSUED BY CODE NRCHQ 10. THIS ACQUISITION IS UNRESTRICTED OR X SET ASIDE: 100.00 % FOR:

WOMEN-OWNED SMALL BUSINESS US NRC - HQ SMALL BUSINESS (WOSB) ELIGIBLE UNDER THE WOMEN-OWNED ACQUISITION MANAGEMENT DIVISION X HUBZONE SMALL SMALL BUSINESS PROGRAM NAICS: 518210 BUSINESS EDWOSB MAIL STOP TWFN-07B20M SERVICE-DISABLED WASHINGTON DC 20555-0001 VETERAN-OWNED 8(A)

SIZE STANDARD: $35.00 SMALL BUSINESS

11. DELIVERY FOR FOB DESTINA- 12. DISCOUNT TERMS 13b. RATING TION UNLESS BLOCK IS 13a. THIS CONTRACT IS A MARKED 30 RATED ORDER UNDER

14. METHOD OF SOLICITATION SEE SCHEDULE DPAS (15 CFR 700)

RFQ IFB RFP

15. DELIVER TO CODE NRCHQ 16. ADMINISTERED BY CODE NRCHQ NUCLEAR REGULATORY COMMISSION US NRC - HQ NUCLEAR REGULATORY COMMISSION ACQUISITION MANAGEMENT DIVISION WASHINGTON DC 20555-0001 MAIL STOP TWFN-07B20M WASHINGTON DC 20555-0001 17a. CONTRACTOR/ CODE 127407406 FACILITY 18a. PAYMENT WILL BE MADE BY CODE NRC PAYMENTS 1 OFFEROR CODE COMPETITIVE INNOVATIONS LLC NRC PAYMENTS ATTN MICHAEL KENNEDY NRCFISCALTREASURYGOV 200 N GLEBE RD STE 1025 ARLINGTON VA 222033759 TELEPHONE NO. 70369850002729 17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT Replacement of the Drupal 7 Intranet Platform with the Azure-base Kentico Content Management System.

Accounting Info:

2020-X0200-FEEBASED-10-10D011-10B112-6067-51-J-221

-2572S-51-J-221-6067 Period of Performance: 10/01/2020 to 09/30/2025 (Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

See schedule $1,547,997.73 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

X 27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE X ARE NOT ATTACHED.

X 28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 29. AWARD OF CONTRACT: OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER REF.

DATED . YOUR OFFER ON SOLICITATION (BLOCK 5),

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED. HEREIN, IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (Type or print) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print) 31c. DATE SIGNED DOMONIQUE MALONE 09/24/2020 AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 1449 (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

2 of 86

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 32a. QUANTITY IN COLUMN 21 HAS BEEN RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED 36. PAYMENT 37. CHECK NUMBER CORRECT FOR COMPLETE PARTIAL FINAL PARTIAL FINAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY 41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print) 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE 42b. RECEIVED AT (Location) 42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS STANDARD FORM 1449 (REV. 2/2012) BACK

31310020C0027 B - Supplies or Services/Prices .....................................................................................................6 B.1 BRIEF PROJECT TITLE AND WORK DESCRIPTION.......................................................6 B.2 TYPE OF CONTRACT (JULY 2020)...................................................................................6 B.3 CONSIDERATION AND OBLIGATION-FIRM-FIXED-PRICE.............................................6 B.4.1 LINE ITEM LIST ...........................................................................................................6 C - Statement of Work .................................................................................................................10 D - Packaging and Marking .........................................................................................................27 D.1 PACKAGING AND MARKING ..........................................................................................27 D.2 BRANDING .......................................................................................................................27 E - Inspection and Acceptance....................................................................................................28 E.1 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013)........................................28 F - Deliveries or Performance .....................................................................................................29 F.1 PLACE OF DELIVERY-REPORTS ...................................................................................29 F.2 PERIOD OF PERFORMANCE ALTERNATE III ...............................................................29 G - Contract Administration Data ................................................................................................30 G.1 REGISTRATION IN FEDCONNECT (JULY 2014) ........................................................30 G.2 ELECTRONIC PAYMENT (DEC 2017) ............................................................................30 G.3 2052.215-71 CONTRACTING OFFICER REPRESENTATIVE AUTHORITY. (OCT 1999)

.................................................................................................................................................30 H - Special Contract Requirements.............................................................................................33 H.1 SECURITY REQUIREMENTS FOR BUILDING ACCESS APPROVAL (SEP 2013) .......33 H.2 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY LEVEL I OR LEVEL II ACCESS APPROVAL (JUL 2016)........................................................................................34 H.3 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS - GENERAL (JUL 2016) .......................................................................................................................................38 H.4 IT SECURITY REQUIREMENTS - DEVELOPMENT AND OPERATIONS AND MAINTENANCE REQUIREMENTS (APR 2014).....................................................................42 H.5 GOVERNMENT FURNISHED EQUIPMENT/PROPERTY ...............................................49 H.6 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS ......................49 H.7 RULES OF BEHAVIOR FOR AUTHORIZED COMPUTER USE .....................................50 H.8 COMPLIANCE WITH U.S. IMMIGRATION LAWS AND REGULATIONS ........................51 H.9 INTERNET ........................................................................................................................51 H.10 SAFETY OF ON-SITE CONTRACTOR PERSONNEL...................................................51 H.11 NRC INFORMATION TECHNOLOGY SECURITY TRAINING (MAY 2016) ..................52 H.12 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TO NUCLEAR FACILITIES, ACCESS TO CLASSIFIED INFORMATION OR SAFEGUARDS INFORMATION, OR PERFORMING IN SPECIALLY SENSITIVE POSITIONS (MARCH 2019)

.................................................................................................................................................53 H.13 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLY IDENTIFIABLE INFORMATION (PII)................................................................................................................53 H.14 GREEN PURCHASING (SEP 2015 )..............................................................................55 H.15 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC PAYMENT/REMITTANCE ADDRESS ....................................................................................55 H.16 COMPLIANCE WITH INTERNET PROTOCOL VERSION 6 (IPV6) IN ACQUIRING ELECTRONIC AND INFORMATION TECHOLOGY (EIT) (OCT 2012) ..................................55 H.17 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS. (DEC 2014)..............................................................................................56 I - Contract Clauses.....................................................................................................................57 Page 3

31310020C0027 I.1 NRC ACQUISTION REGULATION (NRCAR) PROVISIONS AND CLAUSES (AUG 2011)

.................................................................................................................................................57 I.2 2052.204-70 SECURITY. (OCT 1999) ...............................................................................57 I.3 2052.204-71 SITE ACCESS BADGE REQUIREMENTS. (JAN 1993)...............................59 I.10 52.204-2 SECURITY REQUIREMENTS. (AUG 1996) .....................................................59 I.11 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL.

(JAN 2011) ..............................................................................................................................60 I.12 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE. (OCT 2018)........60 I.13 52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE MAINTENANCE. (AUG 2020) .......................................................................................................................................63 I.14 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS. (JUN 2016) ...........................................................................................................64 I.15 52.212-4 CONTRACT TERMS AND CONDITIONS - COMMERCIAL ITEMS. (OCT 2018)

.................................................................................................................................................65 I.16 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS - COMMERCIAL ITEMS. (AUG 2020).....................71 I.17 52.217-8 OPTION TO EXTEND SERVICES. (NOV 1999)...............................................80 I.18 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT. (MAR 2000) ...........80 I.19 52.219-3 NOTICE OF HUBZONE SET-ASIDE OR SOLE SOURCE AWARD. (MAR 2020) .......................................................................................................................................80 I.20 52.223-6 DRUG-FREE WORKPLACE. (MAY 2001)........................................................82 I.21 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS. (JUN 2013)...84 I.22 52.237-3 CONTINUITY OF SERVICES. (JAN 1991) .......................................................84 J - List of Documents, Exhibits and Other Attachments ..............................................................86 Page 4

31310020C0027 Page 5

31310020C0027 B - Supplies or Services/Prices B.1 BRIEF PROJECT TITLE AND WORK DESCRIPTION (a) The title of this project is: Replacement of the Drupal 7 Intranet Platform with the Azure-base Kentico Content Management System (b) Summary work description: The work under this acquisition consist of providing the support, tools and technologies to migrate Drupal 7 content and compenents to the COTS Kentico Content Management System software as a service (SaaS) residing in the NRC's Azure cloud tenant FedRAMP approved platform as a Service (PaaS).

B.2 TYPE OF CONTRACT (JULY 2020)

The contract type for this award is Firm Fixed Price.

B.3 CONSIDERATION AND OBLIGATION-FIRM-FIXED-PRICE The total amount of the Firm-Fixed-Price portion of this contract is $599,798.07, and this amount is fully-funded.

B.4.1 LINE ITEM LIST Item Description Quantity Unit Unit Price Amount Number 00001 599,798.07 BASE Period - Intranet Migration to CMS Line Item Ceiling $599,798.07 Incrementally Funded Amount:

$599,798.07 Period of Performance: 10/01/2020 to 09/30/2021 00002 0.00 BASE PERIOD TRAVEL (NTE)

Total Estimated Cost: $5,000.00 Amount: $5,000.00 (Option Line Item)

Anticipated Exercise Date:06/01/2021 Line Item Ceiling $0.00 Period of Performance: 10/01/2020 to 09/30/2021 00003 0.00 BASE PERIOD OPTIONAL ENHANCEMENT CLIN Amount: $79,413.00 (Option Line Item)

Page 6

31310020C0027 Item Description Quantity Unit Unit Price Amount Number Anticipated Exercise Date:01/01/2020 Period of Performance: 10/01/2020 to 09/30/2021 10001 0.00 OPTION PERIOD 1 - Intranet Migration to CMS Amount: $127,695.20 (Option Line Item)

Anticipated Exercise Date:08/31/2021 Period of Performance: 10/01/2021 to 09/30/2022 10002 0.00 OPTION PERIOD 1 - TRAVEL (NTE)

Amount: $5,000.00 (Option Line Item)

Anticipated Exercise Date:08/31/2021 Period of Performance: 10/01/2021 to 09/30/2022 10003 0.00 OPTION PERIOD 1 - OPTIONAL ENHANCEMENT CLIN Amount: $79,413.00 (Option Line Item)

Anticipated Exercise Date:01/01/2021 Period of Performance: 10/01/2021 to 09/30/2022 20001 0.00 OPTION PERIOD 2 - Intranet Migration to CMS Amount: $130,328.96 (Option Line Item)

Anticipated Exercise Date:08/30/2022 Period of Performance: 10/01/2022 to 09/30/2023 20002 0.00 OPTION PERIOD 2 - TRAVEL (NTE)

Amount: $5,000.00 (Option Line Item)

Anticipated Exercise Date:08/31/2022 Period of Performance: 10/01/2022 to 09/30/2023 Page 7

31310020C0027 Item Description Quantity Unit Unit Price Amount Number 20003 0.00 OPTION PERIOD 2 - OPTIONAL ENHANCEMENT CLIN Amount: $79,413.00 (Option Line Item)

Anticipated Exercise Date:01/01/2022 Period of Performance: 10/01/2022 to 09/30/2023 30001 0.00 OPTION PERIOD 3 - Intranet Migration to CMS Amount: $132,743.24 (Option Line Item)

Anticipated Exercise Date:08/30/2023 Period of Performance: 10/01/2023 to 09/30/2024 30002 0.00 OPTION PERIOD 3 - TRAVEL (NTE)

Amount: $5,000.00 (Option Line Item)

Anticipated Exercise Date:08/31/2023 Period of Performance: 10/01/2023 to 10/01/2024 30003 0.00 OPTION PERIOD 3 - OPTIONAL ENHANCEMENT CLIN Amount: $79,413.00 (Option Line Item)

Anticipated Exercise Date:01/01/2023 Period of Performance: 10/01/2023 to 09/30/2024 40001 0.00 OPTION PERIOD 4 - Intranet Migration to CMS Amount: $135,367.26 (Option Line Item)

Anticipated Exercise Date:08/30/2024 Period of Performance: 10/01/2024 to 10/01/2025 40002 0.00 OPTION PERIOD 4 - TRAVEL (NTE)

Page 8

31310020C0027 Item Description Quantity Unit Unit Price Amount Number Amount: $5,000.00 (Option Line Item)

Anticipated Exercise Date:08/31/2024 Period of Performance: 10/01/2024 to 09/30/2025 40003 0.00 OPTION PERIOD 4 - OPTIONAL ENHANCEMENT CLIN Amount: $79,413.00 (Option Line Item)

Anticipated Exercise Date:01/01/2024 Period of Performance: 10/01/2024 to 09/30/2025 Page 9

31310020C0027 C - Statement of Work Performance Work Statement C.1. BACKGROUNG The NRC intranet provides a central location on the NRC network to share information and access to NRC internal systems. The intranet is the internal enterprise environment that enables NRC leadership to share critical messaging, provide well organized and up to date access to information and encourage collaboration amongst NRC stakeholders by removing barriers to information.

The current NRC intranet uses Drupal 7 as the intranet platform suite of tools since 2016. The Drupal 7 and Drupal 8 platforms both reach end-of-life November 2021 and the effort to upgrade to Drupal 9 would require a total re-write of the application - significantly more effort than the term "upgrade" suggests. Therefore, OCIO intends to replace Drupal 7 and Drupal 8 with a modern, cloud-based CMS solution instead of using Drupal 9.

The NRC intranet must also comply with several statutory requirements to include FISMA/FedRAMP, Section 508 and the 21st Century Integrated Digital Experience Act.

C.2 OBJECTIVE The objective of this procurement is to provide a single integrated solution that includes licensing, services and infrastructure support to migrate the NRCs Intranet platform, content and layout into a Content Management System (CMS) in the Agencys Azure tenant.

The Intranet is a one-stop-shop for all services ranging from access to real-time announcements; what to do in case of an office or personal emergency; how to arrange travel, acquire hardware/software, benefits, office equipment, and more; where to find policy and procedures, information guides, and access to agency resources. The Intranet connects all individual office internal Web sites on one common page for employee access. In short, the Intranet is a critical tool for agency communications.

The result of this acquisition is to provide the NRC with a secure, scalable CMS Software as a Service (SaaS) that empowers NRC staff and management with the ability to update and manage intranet content with minimal technical support on a continuing basis. The CMS SaaS should incorporate best practices that achieve management efficiencies that enable the NRC

- to establish a corporate process for maintaining NRC intranet site consistency, links, and business logic;

- to quickly pre-stage changes for management review in advance of final publication, make any final changes and complete the publication to the NRC intranet with little human intervention;

- to automatically alert content authors and reviewers when their content is scheduled for review or expiration;

- to manage system-wide changes to intranet page format and intranet site structure by access to standard template, workflow, reporting, and searching technologies centrally hosted on the Page 10

31310020C0027 NRC Commercial Azure tenant as a Software as a Service (SaaS);

- to provide critical updates to internal stakeholders, rapidly change intranet site formats in the event of a significant event (i.e., pandemic, nuclear emergency or drill), and manage the resulting effects of changes across the site;

- to obtain and schedule reports on the state of all system artefacts, including intranet content, user responsibilities and tasks, and system performance;

- to ensure all site content complies with requirements of the U.S. Office of Management and Budget (OMB) and the National Archives and Records Administration (NARA) for security, currency, accuracy, referential integrity, historical preservation, and access by alternate viewing technologies; and

- to accomplish all the above objectives through a secure Web interface at anytime without a specialized knowledge of HTML or other Web coding languages.

or other Web coding languages.

C.3 SCOPE OF WORK The NRC's Office of Chief Information Officer (OCIO) seeks an integrated approach to web content management services that provide improved mission support, IT investment management, and consistent and repeatable service delivery. A consistent suite of tools across the internal and external web sites will facilitate cost savings across the agency.

NRC expects to improve its current Intranet content creation, review and approval, delivery and management tools processes and technology. As part of this process, the Agency seeks an automated solution to increase availability to the Offices of content creation/update, view, approval and publish processes.

By moving to a CMS solution from the currently static site, this will ensure a consistent look and feel with the NRC's public site. A consistent internal and external CMS solution also supports reuse of features already developed for the NRC's public site; therefore, reducing the overall cost and schedule to the NRC.

C.3.1 Tasks/Services The contractor shall provide all resources necessary (personnel, equipment, and material) to accomplish the tasks and deliverables described in this Performance Work Statement (PWS).

C.3.1.1 Project Management Services The Contractor shall provide project management services for all aspects of the contract, including any subcontracted services. This service shall include the responsibility of being the sole point of contact to the NRC regarding both the prime contract and any subcontracts established by the Contractor under the contract.

The contractor shall prepare a Project Plan and provide it to the NRC in MS Project format. The contractor shall update the project plan as needed.

C.3.1.2 Configuration, Implementation, and Integration Services The Contractor shall provide all services and materials necessary to configure, implement, and integrate the CMS SaaS within the NRC Commercial Azure tenant to include test, staging and production environments within 1 year (365 days) of contract award. The service shall include technical assistance to the NRC throughout the period of performance of the contract.

The Contractor shall convert and migrate all static content from the existing NRC intranet site to Page 11

31310020C0027 the contractor supplied CMS. Static content shall be converted to dynamic page components where necessary to improve management of shared page content by eliminating redundancy.

The Contractor shall provide tools and services to convert additional future content as it becomes available.

The contractor shall provide CMS licenses and annual maintenance support licensing.

The contractor shall provide a CMS Application Service Architecture and supporting documentation to illustrate how the contractor supplied Software as a Service (SaaS)/Platform as a Service (PaaS) will integrate with the NRC Commercial Azure tenant.

The contractor shall configure the CMS to automate, some or all, corporate processes for maintaining Web site currency, consistency, links, and business logic.

The contractor shall configure the CMS to enable pre-stage changes for management review in advance of final publication, make any final changes and complete the publication to the NRC Intranet with little human intervention.

The contractor provided CMS shall automatically alert content authors and reviewers when their content is scheduled for review or expiration.

The contractor shall configure the CMS to enable the management of system-wide changes to web page format and web site structure by access to standard template, workflow, reporting, and searching technologies.

The contractor shall configure the CMS to provide critical updates to internal and external stakeholders, rapidly change Web site formats, and manage the resulting effects of changes across the site.

The contractor shall configure and schedule reports on the state of all system artifacts, including Web content, user responsibilities and tasks, and system performance.

The contractor shall configure the CMS to meet or exceed requirements of the U.S. Office of Management and Budget (OMB) and the National Archives and Records Administration (NARA) for security, currency, accuracy, referential integrity, historical preservation, and access by alternate viewing technologies.

The contractor shall prepare User Acceptance Testing (UAT) Plan to describe testing procedures, processes, and user roles.

C.3.1.3 Operations and Maintenance The Contractor shall be responsible for the continuous operations and maintenance of the CMS SaaS to include the application of patches, hot fixes, upgrades and general performance management throughout the life of the contract to meet performance requirements in Section C.3.2.

The contractor shall propose a Service Level Agreement (SLA) that define the levels of service, remediation timeline and escalation processes.

C.3.1.4 Search Service The Contractor shall provide a Web-based search function for no more than 5,000,000 files in multiple formats. There shall be no contractual limit to the number of concurrent user sessions.

The search capability shall extend through "spidering" both to the NRC public Web site and to external sites of the NRC's choice. Separate instances of this search service shall be provided for the staging and production environments of the NRC public Web site.

C.3.1.5 Training Services The Contractor shall provide formal training by Webex, Teams, Skype or other hosted live, interactive format compatible with NRCs infrastructure and archived for reuse in a publicly available Web-hosted video collection. The NRC will provide computers and facilities to host Page 12

31310020C0027 students who attend this training. The Contractor shall provide all training materials in electronic form for such training in advance of the first scheduled training session. The Contractor shall periodically revise the training as improvements and changes are made to the Commercial-Off-The-Shelf (COTS) CMS application.

The contractor shall prepare a Training Plan to describe course curriculum, objectives, training overview, and student requirements.

The contractor shall provide 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months of live training.

C.3.1.6 Documentation Services The Contractor (or the CMS as specified elsewhere herein) shall provide documentation to address all aspects of the functional, security, and project management requirements associated with this effort. This documentation shall be made available to the NRC upon request. The Contractor shall periodically revise the documentation as improvements and changes are made to the COTS CMS application.

The contractor shall prepare Meeting Minutes for all meetings between the contractor and the NRC to include requirements and task tracking.

C.3.1.7 OPTIONAL ENHANCEMENT:

Provide requirements, design, development, testing, deployment and maintenance consulting support to Offices requiring internal or website development activities in scope of the migration project/contract.

C.3.1.8 Excluded Services CMS shall not include any of the following:

The capability to dynamically retrieve or host content from the NRCs ADAMS document management system, which is hosted separately from the CMS.

The capability to host and secure data that was not previously cleared for public availability.

The capability to host or dynamically retrieve data from outside applications such as the NRCs ADAMS document management system, the NRC Public Meeting Notice System (PMNS) or other future public-facing NRC applications hosted outside the CMS platform.

o This limitation shall not apply to the passing of tokens between the CMS and the NRCs designated Lightweight Directory Access Protocol (LDAP) solution solely to authenticate privileged users.

o This limitation shall not preclude the ability of client-side code hosted in the CMS and rendered in the NRC public Web site users client software (e.g. Web browser) to interact with any outside Web source approved by the NRC, so long as no data from such client-side transactions is processed by or stored in the CMS.

The NRC does not anticipate that there will be software developed exclusively for this contract. However, if customized software is necessary, it shall not modify the Kentico code base nor effect the periodic updates or hotfixes. Any customized software shall not branch the code, but simply add any modifications as modules which can be removed or altered without effecting the system. Any customized software shall be consistent with Kentico CMS best practices and recommendations for implementation.

The Contractor shall provide the NRC and its public Web site users access to all future security patches, feature patches and updates of the CMS as they are made available to the Contractors other customers of the same services, enterprise-wide.

Page 13

31310020C0027 C.3.1.9 SECURITY Requirements The contractor shall assist NRC in preparing FISMA security documentation to necessary to achieve and maintain an agency Authority To Operate (ATO).

NOTE: See MD 12.5 - NRC Cybersecurity Program for a complete discussion of the Agencys Cybersecurity requirements. A copy is available at https://www.nrc.gov/docs/ML1727/ML17278B085.pdf.

C.3.2 DELIVERABLES Section Deliverable Due Date Format Submit to C3.1.1 Draft Project 45 days MS Project COR Plan following O365/SharePoint/Teams award C.3.1.2 Project On Going O365/SharePoint/Teams COR Documentation C.3.1.2 Kentico 30 days Electronic Delivery COR Software following Perpetual award Licenses C.3.1.2 Kentico 30 days Electronic Delivery COR Software following Maintenance award and and Annual each year Support thereafter C.4.1 1 [Monthly 20th of the Word Document CO/COR MLSR Report] following month C.4.2 2 [Final Report] When Word Document COR Final directed by Report COR or anytime pri or to contract expiration C.6.4.3 508 general When Word or Adobe PDF CO/COR exceptions needed, as Document documentation applicable.

C.6.6.1 Accessibility When new Word or Adobe PDF CO/COR Conformance or updated Document Report (ACR) ICT products, systems or applications are Page 14

31310020C0027 delivered, as applicable.

C.6.6.2 Supplemental When new Word Document CO/COR Accessibility or updated Report (SAR) ICT products, systems or applications are delivered, as applicable.

C.6.6.3 ICT support When new Word or Adobe PDF CO/COR documentation or updated Document ICT products, systems or applications are delivered, as applicable.

C.6.6.4 ICT support Upon Various, as specified in CO/COR documentation request, as section 602.4 of 36 CFR § (alternate applicable. 1194.

formats)

C.6.6.5 Document When Word or Adobe PDF CO/COR Accessibility tested Document Checklist documents are delivered, as applicable.

C.6.6.6 Communication When In accommodation with the ICT users to ICT users needed, as communication needs of applicable individuals with disabilities C.3.3 PERFORMANCE REQUIREMENTS Table 4. PERFORMANCE REQUIREMENTS

SUMMARY

Service Performance Acceptable Quality Method of Performance Criterion Level/Description Surveillance Incentives 1: CMS hosting 1.1 FedRAMP moderate Periodic Positive services inspection incentives:

Good to Page 15

31310020C0027 Exceptional ratings will be reflected in the Contractor's Performance Assessment Report (CPAR)

Disincentives:

If the quality of work delivered does not meet standards 25% of payment will be withheld until standards are met 1.2 99.95% availability Periodic See 1.1 inspection 1.3 6 second response Periodic See 1.1 inspection 1.4 10Mb/sec & 5M Periodic See 1.1 pageviews/month inspection throughput 1.5 100% backup accuracy Periodic See 1.1 inspection 1.6 No data destroyed / altered Periodic See 1.1 inspection 2: Web content 2.1 6 second response Periodic See 1.1 management (publishing tasks), 3 second inspection response (admin tasks),

2.2 100% support for 508 Periodic See 1.1 compliance inspection 2.3 All page URLs static. No Periodic See 1.1 page URLs requiring inspection persistent cookies.

2.4 All pages with NRC Periodic See 1.1 branding; no Contractor inspection branding 2.5 All pages managed with Periodic See 1.1 templates inspection 2.6 100% link accuracy for Periodic See 1.1 CMS-managed URLs inspection 2.7 100% links updated within 6 Periodic See 1.1 Page 16

31310020C0027 seconds of change for CMS- inspection managed URLs 2.8 Page owner notification in Periodic See 1.1 10 minutes of confirmed link inspection change 2.9 80% approval rating by CMS Periodic See 1.1 privileged users (based on inspection annual survey) 2.10 All site reports display within Periodic See 1.1 30 seconds of ad hoc inspection request in CMS user portal 2.11 Scheduled e-mail site Periodic See 1.1 reports arrive within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inspection of scheduled time 3: Site search 3.1 Unlimited search requests Periodic See 1.1 by site users inspection 3.2 Search index updates 1 GB Periodic See 1.1

/ 30 minutes; 5 million total inspection documents 3.3 Search request response Periodic See 1.1 time <= 5 seconds inspection 3.4 No invalid search result links Periodic See 1.1 upon search index inspection completion 3.5 Search experience matches Periodic See 1.1 capabilities of current NRC inspection search 4: Project 4.1 Continuous PM support Periodic See 1.1 management during government business inspection hours 5: 5.3.1 Imported content matches Periodic See 1.1 Configuration & current site structure and inspection implementation format 5.3.2 Metadata index to include Periodic See 1.1 HTML page title, date, key inspection words, and URL of each CMS-managed Web object imported from the NRCs current site 5.3.3 Testing, staging and Periodic See 1.1 production sites to match inspection the NRCs current intranet 6: Training 6.1 80% approval rating by CMS Periodic See 1.1 privileged users (based on inspection survey) 6.2 Final training materials Periodic See 1.1 address all CMS inspection Page 17

31310020C0027 features/functions & conform to reporting requirements 6.3 Final training materials Periodic See 1.1 delivered 1 government inspection business day before training 6.4 80% approval rating for final Periodic See 1.1 training materials by CMS inspection privileged users (based on survey) 6.5 Training at least 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months Periodic See 1.1 inspection 7: 7.1 All project documentation Periodic See 1.1 Documentation delivered on time & inspection conforming to reporting requirements 8: Technical 8.1 100% of issues resolved in Periodic See 1.1 Support 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months (subject to stated inspection limitations) 8.2 E-mail response in 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Periodic See 1.1 (subject to stated limitations) inspection C.3.4 Quality Assurance Surveillance Plan (QASP)

Required PWS Performance Acceptable Method of Services/ Section Standard(s) Quality Level Assessment Deliverables (Surveillance)

Software C.3.1.2 In the event that 100% available Random Licenses & an enterprise- from date of sampling by Maintenance wide software delivery COR license is not Kentico procured by the Software and NRC, new user Manufacturer licenses will be Maintenance provisioned/

deployed to NRC for use/access by user within 2 business days of Contractor receipt of written request by the COR Renew on time every year meets manufactures stated Page 18

31310020C0027 Required PWS Performance Acceptable Method of Services/ Section Standard(s) Quality Level Assessment Deliverables (Surveillance) performance standards Project C.3.1.1 Produce a Report shall Random Management monthly Project contain sampling by Status Report to accurate COR include, but not information.

limited to, accurate account of spending to date, completed tasks, issues that need NRC attentions, etc.

Project C.3.1.1 Accurate and No more than Random Management complete project 2 revisions will sampling by documents, using be allowed for COR NRC provided each templates, shall document.

be delivered to the COR, as specified In the Deliverable section of the SOO O&M C.3.1.3 Service is Deviation is Random Application available Monday not more than sampling by Support through Friday sixty (60) COR from 8am to 5pm minutes Customer input.

(Eastern Time), response time Self-reports by except for from when Contractor.

Federal Holidays service call is COR will review made for and analyze all issues call logs and pertaining to tracking reports workflows and prior to the bi-submissions. weekly meeting Deviation is with the not more than Contractor three (3) hours Random response time sampling by from when COR Page 19

31310020C0027 Required PWS Performance Acceptable Method of Services/ Section Standard(s) Quality Level Assessment Deliverables (Surveillance) service call is made for issues pertaining to internal processing.

Deviation is not more than six (6) hours response time from when service call is made for all issues that occur outside of the systems operating hours.

System C.3.1.3 System should Deviation is Random Availability be available not more than sampling by 24/7/365 thirty (30) COR Except for minutes Customer input.

emergency, response time Self-reports by maintenance from when Contractor.

should be service call is COR will review conducted made and analyze all outside operating Deviation is call logs and hours from 8am not more sixty tracking reports to 8pm (Eastern (60) minutes prior to the bi-Time), Monday response time weekly meeting through Friday from when with the service call is Contractor made for issues pertaining to internal processing.

Deviation is not more than four (4) hours response time from when service call is made for all Page 20

31310020C0027 Required PWS Performance Acceptable Method of Services/ Section Standard(s) Quality Level Assessment Deliverables (Surveillance) issues that occur outside of the systems operating hours.

C.4 REPORTING REQUIREMENTS C.4.1 Monthly Letter Status Report (MLSR)

The contractor shall provide a Monthly Letter Status Report which consists of a technical progress report. This report will be used by the Government to assess the adequacy of the resources proposed by the contractor to accomplish the work contained in this SOW and provide status of contractor progress in achieving tasks and producing deliverables. The report shall include contract/order summary information, work completed during the specified period, milestone schedule information, problem resolution, travel plans, and staff hour summary.

C.4.2 Final Report The contractor shall provide a final report summarizing the work performed and the results and conclusions under this contract/order.

C.5 Incremental Development for Software The Contractor shall use an incremental build model for software development. The Agency defines an incremental build model as a method of software development where the product is designed, implemented, and tested incrementally, with increasing functionality and/or capability added in each increment until the product is finished.

C.6 Section 508 - Information and Communication Technology Accessibility C.6.1 Introduction In December 2000, the Architectural and Transportation Barriers Compliance Board (Access Board) pursuant to Section 508(2)(A) of the Rehabilitation Act Amendments of 1998, established electronic and information technology (EIT) accessibility standards for the federal government.

The Standards for Section 508 of the Rehabilitation Act (codified at 36 CFR § 1194) were revised by the Access Board, published on January 18, 2017 and minor corrections were made on January 22, 2018, effective March 23, 2018.

The Revised 508 Standards have replaced the term EIT with information and communication technology (ICT). ICT is information technology (as defined in 40 U.S.C. 11101(6)) and other equipment, systems, technologies, or processes, for which the principal function is the creation, manipulation, storage, display, receipt, or transmission of electronic data and information, as well as any associated content. Examples of ICT include, but are not limited to: Computers and Page 21

31310020C0027 peripheral equipment; information kiosks and transaction machines; telecommunications equipment; customer premises equipment; multifunction office machines; software; applications; Web sites; videos; and, electronic documents.

The text of the Revised 508 Standards can be found in 36 CFR § 1194.1 and in Appendices A, C and D of 36 CFR § 1194 (at https://www.ecfr.gov/cgi-bin/text-idx?SID=caeb8ddcea26ba5002c2eea047698e85&mc=true&tpl=/ecfrbrowse/Title36/36cfr1194_

main_02.tpl).

C.6.2 General Requirements In order to help the NRC comply with Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d)(Section 508), the Contractor shall ensure that its deliverables (both products and services) within the scope of this contract/order are

1. in conformance with, and

2. support the requirements of the Standards for Section 508 of the Rehabilitation Act, as set forth in Appendices A, C and D of 36 CFR § 1194.

C.6.3 Applicable Provisions of the Revised 508 Standards The following is an outline of the Revised 508 Standards that identifies what provisions are always applicable and which ones may be applicable. If Maybe is stated in the table below, then those provisions are applicable only if they are within the scope of this acquisition.

Applicable to the Provision of 36 CFR Part 1194 Contract/Order?

1. Appendix A to Part 1194 - Section 508 of the Rehabilitation Act:

Yes Application and Scoping Requirements o Section 508 Chapter 1: Application and Administration - sets forth Yes general application and administration provisions o Section 508 Chapter 2: Scoping Requirements - containing scoping Yes requirements (which, in turn, prescribe which ICT - and, in some cases, how many - must comply with the technical specifications)

2. Appendix C to Part 1194 - Functional Performance Criteria and Maybe Technical Requirements o Chapter 3: Functional Performance Criteria - applies to ICT where required by 508 Chapter 2 (Scoping Requirements) and where Maybe otherwise referenced in any other chapter of the Revised 508 Standards Maybe o Chapter 4: Hardware Maybe o Chapter 5: Software o Chapter 6: Support Documentation and Services (applicable to, but not limited to, help desks, call centers, training services, and Maybe automated self-service technical support) (Always applies if Chapters 4 or 5 apply)

Yes o Chapter 7: Referenced Standards Maybe 3. Appendix D to Part 1194 - Electronic and Information Technology Accessibility Standards as Originally Published on December 21, Page 22

31310020C0027 Applicable to the Provision of 36 CFR Part 1194 Contract/Order?

2000 Refer to Chapter 2 (Scoping Requirements) first to confirm what provisions in Appendix C apply in a particular case.

Section E203.2 applies only to the NRC, except as specified below.

C.6.4 Exceptions C.6.4.1 Legacy ICT Unless a deliverable of this contract/order is identified in this contract/order as Legacy ICT, use by the Contractor of the Legacy ICT general exception (section E202.2 of 36 CFR § 1194) shall only be permitted on a case-by-case basis for applicable legacy ICT and with advance written approval from the COR.

C.6.4.2 Undue Burden The Undue Burden general exception (section E202.6 of 36 CFR § 1194) is not expected to be applicable to work performed by the Contractor. If there are questions about potential application of this exception please discuss with the CO.

C.6.4.3 Fundamental Alteration or Best Meets If the Contractor wishes to use the Fundamental Alteration (section E202.6 of 36 CFR § 1194) or Best Meets (section E202.7 of 36 CFR § 1194) general exceptions the Contractor shall do the following:

1. provide the COR with information necessary to support the agencys documentation requirements, as identified in sections E202.6.2 and E202.7.1 of 36 CFR § 1194, respectively

2. request and obtain written approval from the COR for development and/or use, as applicable to the scope of the contract/order, of an alternative means for providing individuals with disabilities access to and use of the information and data, as specified in sections E202.6.3 and E202.7.2 of 36 CFR § 1194, respectively.

C.6.4.4 National Security Systems Based on the definition at 40 U.S.C. 11103(a), the National Security Systems general exception (section E202.3 of 36 CFR § 1194) is not applicable to this contract/order.

C.6.4.5 ICT Functions Located in Maintenance or Monitoring Spaces The Contractor shall confirm with the COR that an ICT deliverable of this contract/order will be located in maintenance or monitoring spaces before assuming that the ICT Functions Located in Maintenance or Monitoring Spaces general exception (section E202.5 of 36 CFR § 1194) applies.

Note that this exception does not apply to features of the ICT (such as Web interfaces) that can be accessed remotely, outside the maintenance or monitoring space where the ICT is located.

C.6.5 Additional Requirements C.6.5.1 Notification Due to Impact from NRC Policies, Procedures, Tools and/or ICT Infrastructure Page 23

31310020C0027 If and when 1) the Contractor is dependent upon NRC policies, procedures, tools and/or ICT infrastructure for Revised-508-Standards-conformant delivery of any of the products or services under this acquisition, and 2) the Contractor is aware that conformance of products or services will be negatively impacted by capability gaps in NRC policies, procedures, tools and/or ICT infrastructure, the Contractor shall inform the COR so that the NRC can both be aware and take corrective action.

C.6.5.2 Accessibility of Electronic Content For electronic content (as defined in section E103 of 36 CFR § 1194) deliverables of this contract/order:

1. If a deliverable is in the form of an Adobe Portable Document Format (PDF) file and is either Public Facing or Agency Official Communication (as defined in sections E103 and E205.3 of 36 CFR § 1194, respectively) the Contractor shall ensure that it conforms to both section E205.4 of 36 CFR § 1194 and ISO 14289-1 (PDF/UA-1)

2. Unless the Contractor requests and obtains advance written approval from the COR for a specific deliverable or class of deliverables, the contractor shall ensure that

1. deliverables that are not Public Facing and not Agency Official Communication (as defined in sections E103 and E205.3 of 36 CFR § 1194, respectively) shall conform to section E205.4 of 36 CFR § 1194

2. deliverables that are in the form of PDF files, are not Public Facing and are not Agency Official Communication (as defined in sections E103 and E205.3 of 36 CFR § 1194, respectively) shall conform to section E205.4 of 36 CFR § 1194 and ISO 14289-1 (PDF/UA-1).

C.6.5.3 Other It is desirable that the Contractor address the applicable provisions of the Revised 508 Standards throughout product and service lifecycles rather than only performing a conformance check toward the end of a process.

If and when the Contractor provides custom ICT development services pursuant to this acquisition, the Contractor shall ensure the ICT products and services fully support the applicable provisions of the Revised 508 Standards prior to delivery and before final acceptance.

If and when the Contractor provides installation, configuration or integration services for ICT products (equipment and/or software) pursuant to this acquisition, the Contractor shall not install, configure or integrate the ICT equipment and software in a way that reduces the level of conformance with the applicable provisions of the Revised 508 Standards.

If and when the scope of this contract/order includes work by the Contractor to collect, directly from NRC employees or the Public, requirements for the procurement, development, maintenance or use of ICT the Contractor shall identify the needs of users with disabilities in conformance to section E203.2.

C.6.6 ICT Accessibility Deliverables The Contractor shall provide the following ICT accessibility deliverables, when within the scope of this contract/order.

Page 24

31310020C0027 C.6.6.1 Accessibility Conformance Report (ACR)

This report shall be submitted for ICT products, systems or application deliverables. A written ACR shall be based on the Voluntary Product Accessibility Template (VPAT), as specified at https://www.itic.org/policy/accessibility/vpat or provide equivalent information. This report has the purpose to document the state of conformance to the Revised 508 Standards for the subject product, system or application.

C.6.6.2 Supplemental Accessibility Report (SAR)

This report shall be submitted for ICT products, systems or application deliverables that have been custom developed or integrated by the Contractor to meet contract/order requirements. A written SAR shall contain:

a) Description of evaluation methods used to produce the ACR, to demonstrate due diligence in supporting conformance claims; b) Information on core functions that cant be used by persons with disabilities; and, c) Information on how to configure and install the ICT item to support accessibility C.6.6.3 ICT Support Documentation This documentation shall be submitted for ICT products, systems or application deliverables.

The support documentation shall include:

a) Documentation of features that help achieve accessibility and compatibility with assistive technology for persons with disabilities (as required by section 602 of 36 CFR § 1194);

b) For authoring tools that generate content (documents, reports, videos, multimedia, web content, etc.): Information on how the tool enables the creation of accessible electronic content that conforms to the Revised 508 Standards (see section 504 of 36 CFR § 1194), including the range of accessible user interface elements the tool can create; c) For platform software (as defined in section E103.4 of 36 CFR § 1194) and software tools that are provided by a platform developer: Documentation on the set of accessibility services that support applications running on the platform to interoperate with assistive technology, as required by section 502.3 of 36 CFR § 1194.

C.6.6.4 ICT Support Documentation (Alternate Formats)

Upon request, alternate formats for non-electronic support documentation shall be provided (as required by section 602.4 of 36 CFR § 1194).

C.6.6.5 Document Accessibility Checklist This checklist shall be submitted for ICT electronic content deliverables that are documents (as defined in section E103 of 36 CFR § 1194), if the requirement is specified elsewhere in this acquisition that testing be performed. A completed checklist summarising the subject documents state of conformance to the applicable WCAG 2.0 Level A and AA Success Criteria (as referenced in section E205.4 and 702.10 of 36 CFR § 1194) and, for PDF files, ISO 14289-1 Page 25

31310020C0027 (PDF/UA-1).

C.6.6.6 Communication to ICT Users When the Contractor is providing ICT support services (including, but not limited to help desks, call centers, training services, and automated self-service technical support), any communication to ICT users shall accommodate the communication needs of individuals with disabilities (see section 603.3 of 36 CFR § 1194) and include information on accessibility and compatibility features (see 603.2 of 36 CFR § 1194).

C.7 Release of Publications Any documents generated by the contractor under this contract/order shall not be released for publication or dissemination without CO and COR prior written approval.

C.8 Applicable Publications (if not applicable delete text below and insert N/A)

List any publications, manuals, and/or regulations that the contractor shall abide by.

For example:

NUREG publication #______

IEEE publication #______

The contractor shall comply with the following applicable regulations, publications, manuals, and local policies and procedures:

1. ____________________

2. ____________________

C.9 Security Requirements The contractor shall be required to return NRC issued Personal Identification Verification (PIV) cards/badges to the COR at the end of the contract period of performance. If a contractor voluntarily leaves the company, the badge must be returned on the employees final day of employment. Once the badge is returned to the NRC, he contractor will no longer have access to NRC buildings, sensitive automated information technology systems or data. Additional information related to the returning of PIV badges can be found in Management Directive 12.1, Section 5.

Page 26

31310020C0027 D - Packaging and Marking D.1 PACKAGING AND MARKING (a) The Contractor shall package material for shipment to the NRC in such a manner that will ensure acceptance by common carrier and safe delivery at destination. Containers and closures shall comply with the Surface Transportation Board, Uniform Freight Classification Rules, or regulations of other carriers as applicable to the mode of transportation.

(b) On the front of the package, the Contractor shall clearly identify the contract number under which the product is being provided.

(c) Additional packaging and/or marking requirements are as follows: NA.

D.2 BRANDING The Contractor is required to use the statement below in any publications, presentations, articles, products, or materials funded under this contract/order, to the extent practical, in order to provide NRC with recognition for its involvement in and contribution to the project. If the work performed is funded entirely with NRC funds, then the contractor must acknowledge that information in its documentation/presentation.

Work Supported by the U.S. Nuclear Regulatory Commission (NRC), Office of Chief Information Officer, under Contract/order number 31310020C0027.

Page 27

31310020C0027 E - Inspection and Acceptance E.1 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013)

Inspection and acceptance of the deliverable items to be furnished hereunder shall be made by the NRC Contracting Officers Representative (COR) at the destination, accordance with FAR 52.247 F.o.b. Destination.

Contract Deliverables:

1. See Section C.3.2.

Page 28

31310020C0027 F - Deliveries or Performance F.1 PLACE OF DELIVERY-REPORTS The items to be furnished hereunder shall be delivered, with all charges paid by the Contractor, to:

Gary Young, Contracting Officers Representative (COR)

U.S. Nuclear Regulatory Commission 11555 Rockville Pike, Rockville MD 20852 Gary.Young@nrc.gov 301-415-7104 F.2 PERIOD OF PERFORMANCE ALTERNATE III This contract shall commence on October 1, 2020 and will expire on September 31, 2021. The term of this contract may be extended at the option of the Government for an additional four years, from October 1, 2021 to September 30, 2025.

The term of this contract may be extended at the option of the Government for an additional six (not to exceed six months).

Base Period: October 1, 2020 - September 30, 2021 Option Period(s): Option Period 1: October 1, 2021 - September 30, 2022 Option Period 2 : October 1, 2022 - September 30, 2023 Option Period 2 : October 1, 2023 - September 30, 2024 Option Period 2 : October 1, 2024 - September 30, 2025 Page 29

31310020C0027 G - Contract Administration Data NRC Local Clauses Incorporated by Full Text G.1 REGISTRATION IN FEDCONNECT (JULY 2014)

The Nuclear Regulatory Commission (NRC) uses Unison Software Systems secure and auditable two-way web portal, FedConnect, to communicate with vendors and contractors.

FedConnect provides bi-directional communication between the vendor/contractor and the NRC throughout pre-award, award, and post-award acquisition phases. Therefore, in order to do business with the NRC, vendors and contractors must register to use FedConnect at https://www.fedconnect.net/FedConnect. The individual registering in FedConnect must have authority to bind the vendor/contractor. There is no charge for using FedConnect. Assistance with FedConnect is provided by Unison Software Systems, not the NRC. FedConnect contact and assistance information is provided on the FedConnect web site at https://www.fedconnect.net/FedConnect.

G.2 ELECTRONIC PAYMENT (DEC 2017)

The Debt Collection Improvement Act of 1996 requires that all payments except IRS tax refunds be made by Electronic Funds Transfer. Payment shall be made in accordance with FAR 52.232-33, entitled Payment by Electronic Funds Transfer-System for Award Management.

To receive payment, the contractor shall prepare invoices in accordance with NRCs Billing Instructions. Claims shall be submitted through the Invoice Processing Platform (IPP)

(https://www.ipp.gov/). Back up documentation shall be included as required by the NRCs Billing Instructions.

NRCAR Clauses Incorporated By Full Text G.3 2052.215-71 CONTRACTING OFFICER REPRESENTATIVE AUTHORITY. (OCT 1999)

(a) The contracting officer's authorized representative (hereinafter referred to as the COR) for this contract is:

Name: Gary Young email: Gary.Young@nrc.gov Phone: 3001-415-7104 (b) Performance of the work under this contract is subject to the technical direction of the NRC COR. The term "technical direction" is defined to include the following:

(1) Technical direction to the contractor which shifts work emphasis between areas of work or tasks, authorizes travel which was unanticipated in the Schedule (i.e., travel not contemplated in the Statement of Work (SOW) or changes to specific travel identified in the SOW), fills in details, or otherwise serves to accomplish the contractual SOW.

(2) Provide advice and guidance to the contractor in the preparation of drawings, specifications, or technical portions of the work description.

Page 30

31310020C0027 (3) Review and, where required by the contract, approval of technical reports, drawings, specifications, and technical information to be delivered by the contractor to the Government under the contract.

(c) Technical direction must be within the general statement of work stated in the contract. The COR does not have the authority to and may not issue any technical direction which:

(1) Constitutes an assignment of work outside the general scope of the contract.

(2) Constitutes a change as defined in the "Changes" clause of this contract.

(3) In any way causes an increase or decrease in the total estimated contract cost, the fixed fee, if any, or the time required for contract performance.

(4) Changes any of the expressed terms, conditions, or specifications of the contract.

(5) Terminates the contract, settles any claim or dispute arising under the contract, or issues any unilateral directive whatever.

(d) All technical directions must be issued in writing by the COR or must be confirmed by the COR in writing within ten (10) working days after verbal issuance. A copy of the written direction must be furnished to the contracting officer. A copy of NRC Form 445, Request for Approval of Official Foreign Travel, which has received final approval from the NRC must be furnished to the contracting officer.

(e) The contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this clause and within the COR's authority under the provisions of this clause.

(f) If, in the opinion of the contractor, any instruction or direction issued by the COR is within one of the categories as defined in paragraph (c) of this section, the contractor may not proceed but shall notify the contracting officer in writing within five (5) working days after the receipt of any instruction or direction and shall request the contracting officer to modify the contract accordingly. Upon receiving the notification from the contractor, the contracting officer shall issue an appropriate contract modification or advise the contractor in writing that, in the contracting officer's opinion, the technical direction is within the scope of this article and does not constitute a change under the "Changes" clause.

(g) Any unauthorized commitment or direction issued by the COR may result in an unnecessary delay in the contractor's performance and may even result in the contractor expending funds for unallowable costs under the contract.

(h) A failure of the parties to agree upon the nature of the instruction or direction or upon the contract action to be taken with respect thereto is subject to 52.233 Disputes.

(i) In addition to providing technical direction as defined in paragraph (b) of the section, the COR shall:

Page 31

31310020C0027 (1) Monitor the contractor's technical progress, including surveillance and assessment of performance, and recommend to the contracting officer changes in requirements.

(2) Assist the contractor in the resolution of technical problems encountered during performance.

(3) Review all costs requested for reimbursement by the contractor and submit to the contracting officer recommendations for approval, disapproval, or suspension of payment for supplies and services required under this contract.

(4) Assist the contractor in obtaining the badges for the contractor personnel.

(5) Immediately notify the Security Branch, Division of Facilities and Security (SB/DFS) (via e-mail) when a contractor employee no longer requires access authorization and return of any NRC issued badge to SB/DFS within three days after their termination.

(6) Ensure that all contractor employees that require access to classified Restricted Data or National Security Information or matter, access to sensitive unclassified information (Safeguards, Official Use Only, and Proprietary information) access to sensitive IT systems or data, unescorted access to NRC controlled buildings/space, or unescorted access to protected and vital areas of nuclear power plants receive approval of SB/DFS prior to access in accordance with Management Directive and Handbook 12.3.

(7) For contracts for the design, development, maintenance or operation of Privacy Act Systems of Records, obtain from the contractor as part of closeout procedures, written certification that the contractor has returned to NRC, transferred to the successor contractor, or destroyed at the end of the contract in accordance with instructions provided by the NRC Systems Manager for Privacy Act Systems of Records, all records (electronic or paper) which were created, compiled, obtained or maintained under the contract.

(End of Clause)

Page 32

31310020C0027 H - Special Contract Requirements NRC Local Clauses Incorporated by Full Text H.1 SECURITY REQUIREMENTS FOR BUILDING ACCESS APPROVAL (SEP 2013)

The Contractor shall ensure that all its employees, subcontractor employees or consultants who are assigned to perform the work herein for contract performance for periods of more than 30 calendar days at NRC facilities, are approved by the NRC for unescorted NRC building access.

The Contractor shall conduct a preliminary federal facilities security screening interview or review for each of its employees, subcontractor employees, and consultants and submit to the NRC only the names of candidates for contract performance that have a reasonable probability of obtaining approval necessary for access to NRC's federal facilities. The Contractor shall pre-screen its applicants for the following:

(a) felony arrest in the last seven (7) years; (b) alcohol related arrest within the last five (5) years; (c) record of any military courts-martial convictions in the past ten (10) years; (d) illegal use of narcotics or other controlled substances possession in the past year, or illegal purchase, production, transfer, or distribution of narcotics or other controlled substances in the last seven (7) years; and (e) delinquency on any federal debts or bankruptcy in the last seven (7) years.

The Contractor shall make a written record of its pre-screening interview or review (including any information to mitigate the responses to items listed in (a) - (e)), and have the applicant verify the pre-screening record or review, sign and date it. Two (2) copies of the pre-screening signed record or review shall be supplied to the Division of Facilities and Security, Personnel Security Branch (DFS/PSB) with the Contractor employee's completed building access application package.

The Contractor shall further ensure that its employees, any subcontractor employees and consultants complete all building access security applications required by this clause within fourteen (14) calendar days of notification by DFS/PSB of initiation of the application process.

Timely receipt of properly completed records of the Contractor's signed pre-screening record or review and building access security applications (submitted for candidates that have a reasonable probability of obtaining the level of access authorization necessary for access to NRC's facilities) is a contract requirement. Failure of the Contractor to comply with this contract administration requirement may be a basis to cancel the award, or terminate the contract for default, or offset from the contract's invoiced cost or price the NRC's incurred costs or delays as a result of inadequate pre-screening by the Contractor. In the event of cancellation or termination, the NRC may select another firm for contract award.

A Contractor, subcontractor employee or consultant shall not have access to NRC facilities until he/she is approved by DFS/PSB. Temporary access may be approved based on a favorable NRC review and discretionary determination of their building access security forms. Final building access will be approved based on favorably adjudicated checks by the Government.

However, temporary access approval will be revoked and the Contractor's employee may subsequently be denied access in the event the employee's investigation cannot be favorably determined by the NRC. Such employee will not be authorized to work under any NRC contract requiring building access without the approval of DFS/PSB. When an individual receives final Page 33

31310020C0027 access, the individual will be subject to a review or reinvestigation every five (5) or ten (10) years, depending on their job responsibilities at the NRC.

The Government shall have and exercise full and complete control and discretion over granting, denying, withholding, or terminating building access approvals for individuals performing work under this contract. Individuals performing work under this contract at NRC facilities for a period of more than 30 calendar days shall be required to complete and submit to the Contractor representative an acceptable OPM Standard Form 85 (Questionnaire for Non-Sensitive Positions), and two (2) FD 258 (Fingerprint Charts). Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of their legal residency. This documentation can be a Permanent Resident Card, Temporary Work Visa, Employment Authorization Card, or other official documentation issued by the U.S. Citizenship and Immigration Services. Any applicant with less than five (5) years residency in the U.S. will not be approved for building access. The Contractor shall submit the documents to the NRC Contracting Officers Representative (COR) who will give them to DFS/PSB.

DFS/PSB may, among other things, grant or deny temporary unescorted building access approval to an individual based upon its review of the information contained in the OPM Standard Form 85 and the Contractor's pre-screening record. Also, in the exercise of its authority, the Government may, among other things, grant or deny permanent building access approval based on the results of its review or investigation. This submittal requirement also applies to the officers of the firm who, for any reason, may visit the NRC work sites for an extended period of time during the term of the contract. In the event that DFS/PSB are unable to grant a temporary or permanent building access approval, to any individual performing work under this contract, the Contractor is responsible for assigning another individual to perform the necessary function without any delay in the contract's performance schedule, or without adverse impact to any other terms or conditions of the contract. The Contractor is responsible for informing those affected by this procedure of the required building access approval process (i.e., temporary and permanent determinations), and the possibility that individuals may be required to wait until permanent building access approvals are granted before beginning work in NRC's buildings.

CANCELLATION OR TERMINATION OF BUILDING ACCESS/ REQUEST The Contractor shall immediately notify the COR when a Contractor or subcontractor employee or consultant's need for NRC building access approval is withdrawn or the need by the Contractor employee's for building access terminates. The COR will immediately notify DFS/PSB (via e-mail) when a Contractor employee no longer requires building access. The Contractor shall be required to return any NRC issued badges to the COR for return to DFS/FSB (Facilities Security Branch) within three (3) days after their termination.

H.2 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY LEVEL I OR LEVEL II ACCESS APPROVAL (JUL 2016)

The contractor must identify all individuals selected to work under this contract. The NRC Contracting Officers Representative (COR) shall make the final determination of the level, if any, of IT access approval required for all individuals working under this contract/order using the following guidance. The Government shall have full and complete control and discretion over granting, denying, withholding, or terminating IT access approvals for contractor personnel performing work under this contract/order.

Page 34

31310020C0027 The contractor shall conduct a preliminary security interview or review for each employee requiring IT level I or II access and submit to the Government only the names of candidates that have a reasonable probability of obtaining the level of IT access approval for which the employee has been proposed. The contractor shall pre-screen its applicants for the following:

(a) felony arrest in the last seven (7) years; (b) alcohol related arrest within the last five (5) years; (c) record of any military courts-martial convictions in the past ten (10) years; (d) illegal use of narcotics or other controlled substances possession in the past year, or illegal purchase, production, transfer, or distribution of narcotics or other controlled substances in the last seven (7) years; and (e) delinquency on any federal debts or bankruptcy in the last seven (7) years.

The contractor shall make a written record of its pre-screening interview or review (including any information to mitigate the responses to items listed in (a) - (e)), and have the employee verify the pre-screening record or review, sign and date it. The contractor shall supply two (2) copies of the signed contractor's pre-screening record or review to the NRC Contracting Officers Representative (COR), who will then provide them to the NRC Office of Administration, Division of Facilities and Security, Personnel Security Branch with the employees completed IT access application package.

The contractor shall further ensure that its personnel complete all IT access approval security applications required by this clause within fourteen (14) calendar days of notification by the NRC Contracting Officers Representative (COR) of initiation of the application process. Timely receipt of properly completed records of the pre-screening record and IT access approval applications (submitted for candidates that have a reasonable probability of obtaining the level of security assurance necessary for access to NRC's IT systems/data) is a requirement of this contract/order. Failure of the contractor to comply with this requirement may be a basis to terminate the contract/order for cause, or to offset from the contract's invoiced cost or price the NRC's incurred costs or delays as a result of inadequate pre-screening by the contractor.

SECURITY REQUIREMENTS FOR IT LEVEL I Performance under this contract/order will involve contractor personnel who perform services requiring direct access to or operation of agency sensitive information technology systems or data (IT Level I). The IT Level I involves responsibility for: (a) the planning, direction, and implementation of a computer security program; (b) major responsibility for the direction, planning, and design of a computer system, including hardware and software; (c) the capability to access a computer system during its operation or maintenance in such a way that could cause or that has a relatively high risk of causing grave damage; or (d) the capability to realize a significant personal gain from computer access.

Contractor personnel shall not have access to sensitive information technology systems or data until they are approved by DFS/PSB and they have been so informed in writing by the NRC Contracting Officers Representative (COR). Temporary IT access may be approved by DFS/PSB based on a favorable review or adjudication of their security forms and checks. Final IT access may be approved by DFS/PSB based on a favorably review or adjudication of a completed background investigation. However, temporary access authorization approval will be revoked and the employee may subsequently be denied IT access in the event the employees investigation cannot be favorably adjudicated. Such an employee will not be authorized to work under any NRC contract/order requiring IT access without the approval of DFS/PSB, as communicated in writing to the contractor by the NRC Contracting Officers Representative Page 35

31310020C0027 (COR). Where temporary access authorization has been revoked or denied by DFS/PSB, the contractor shall assign another contractor employee to perform the necessary work under this contract/order without delay to the contract/order performance schedule, or without adverse impact to any other terms or conditions of the contract/order. When an individual receives final IT access approval from DFS/PSB, the individual will be subject to a reinvestigation every ten (10) years thereafter (assuming continuous performance under contracts/orders at NRC) or more frequently in the event of noncontinuous performance under contracts/orders at NRC.

CORs are responsible for submitting the completed access/clearance request package as well as other documentation that is necessary to DFS/PSB. The contractor shall submit a completed security forms packet, including the OPM Standard Form (SF) 86 (online Questionnaire for National Security Positions), two (2) copies of the Contractor's signed pre-screening record, and two (2) FD 258 fingerprint charts, to DFS/PSB for review and adjudication, prior to the individual being authorized to perform work under this contract/order requiring access to sensitive information technology systems or data. Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of their legal residency. This documentation can be a Permanent Resident Card, Temporary Work Visa, Employment Authorization Card, or other official documentation issued by the U.S. Citizenship and Immigration Services. Any applicant with less than seven (7) years residency in the U.S. will not be approved for IT Level I access. The Contractor shall submit the documents to the NRC Contracting Officers Representative (COR) who will give them to DFS/PSB. The contractor shall ensure that all forms are accurate, complete, and legible. Based on DFS/PSB review of the contractor employees security forms and/or the receipt of adverse information by NRC, the contractor individual may be denied access to NRC facilities and sensitive information technology systems or data until a final determination is made by DFS/PSB. The contractor individuals clearance status will thereafter be communicated to the contractor by the NRC Contracting Officers Representative (COR) regarding the contractor persons eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level I contractors shall be subject to the attached NRC Form 187 and SF-86. Together, these furnish the basis for providing security requirements to contractors that have or may have an NRC contractual relationship which requires access to or operation of agency sensitive information technology systems, remote development and/or analysis of sensitive information technology systems or data, or other access to such systems and data; access on a continuing basis (in excess more than 30 calendar days) to NRC buildings; or otherwise requires issuance of an unescorted NRC badge.

SECURITY REQUIREMENTS FOR IT LEVEL II Performance under this contract/order will involve contractor personnel that develop and/or analyze sensitive information technology systems or data or otherwise have access to such systems or data (IT Level II).

The IT Level II involves responsibility for the planning, design, operation, or maintenance of a computer system and all other computer or IT positions.

Contractor personnel shall not have access to sensitive information technology systems or data until they are approved by DFS/PSB and they have been so informed in writing by the NRC Contracting Officers Representative (COR). Temporary access may be approved by DFS/PSB based on a favorable review of their security forms and checks. Final IT access may be approved by DFS/PSB based on a favorably adjudication. However, temporary access Page 36

31310020C0027 authorization approval will be revoked and the contractor employee may subsequently be denied IT access in the event the employee's investigation cannot be favorably adjudicated.

Such an employee will not be authorized to work under any NRC contract/order requiring IT access without the approval of DFS/PSB, as communicated in writing to the contractor by the NRC Contracting Officers Representative (COR). Where temporary access authorization has been revoked or denied by DFS/PSB, the contractor is responsible for assigning another contractor employee to perform the necessary work under this contract/order without delay to the contract/order performance schedule, or without adverse impact to any other terms or conditions of the contract/order. When a contractor employee receives final IT access approval from DFS/PSB, the individual will be subject to a review or reinvestigation every ten (10) years (assuming continuous performance under contract/order at NRC) or more frequently in the event of noncontinuous performance under contract/order at NRC.

CORs are responsible for submitting the completed access/clearance request package as well as other documentation that is necessary to DFS/PSB. The contractor shall submit a completed security forms packet, including the OPM Standard Form (SF) 86 (online Questionnaire for National Security Positions), two (2) copies of the Contractor's signed pre-screening record and two (2) FD 258 fingerprint charts, to DFS/PSB for review and adjudication, prior to the contractor employee being authorized to perform work under this contract/order. Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of their legal residency. This documentation can be a Permanent Resident Card, Temporary Work Visa, Employment Authorization Card, or other official documentation issued by the U.S. Citizenship and Immigration Services. Any applicant with less than seven (7) years residency in the U.S. will not be approved for IT Level II access. The Contractor shall submit the documents to the NRC Contracting Officers Representative (COR) who will give them to DFS/PSB. The contractor shall ensure that all forms are accurate, complete, and legible. Based on DFS/PSB review of the contractor employees security forms and/or the receipt of adverse information by NRC, the contractor employee may be denied access to NRC facilities, sensitive information technology systems or data until a final determination is made by DFS/PSB regarding the contractor persons eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level II contractors shall be subject to the attached NRC Form 187, SF-86, and contractor's record of the pre-screening. Together, these furnish the basis for providing security requirements to contractors that have or may have an NRC contractual relationship which requires access to or operation of agency sensitive information technology systems, remote development and/or analysis of sensitive information technology systems or data, or other access to such systems or data; access on a continuing basis (in excess of more than 30 calendar days) to NRC buildings; or otherwise requires issuance of an unescorted NRC badge.

CANCELLATION OR TERMINATION OF IT ACCESS/REQUEST When a request for IT access is to be withdrawn or canceled, the contractor shall immediately notify the NRC Contracting Officers Representative (COR) by telephone so that the access review may be promptly discontinued. The notification shall contain the full name of the contractor employee and the date of the request. Telephone notifications must be promptly confirmed by the contractor in writing to the NRC Contracting Officers Representative (COR),

who will forward the confirmation to DFS/PSB. Additionally, the contractor shall immediately notify the NRC Contracting Officers Representative (COR) in writing, who will in turn notify DFS/PSB, when a contractor employee no longer requires access to NRC sensitive automated Page 37

31310020C0027 information technology systems or data, including the voluntary or involuntary separation of employment of a contractor employee who has been approved for or is being processed for IT access.

The contractor shall flow the requirements of this clause down into all subcontracts and agreements with consultants for work that requires them to access NRC IT resources.

H.3 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS - GENERAL (JUL 2016)

Basic Contract IT Security Requirements The contractor agrees to insert terms that conform substantially to the language of the IT security requirements, excluding any reference to the Changes clause of this contract, into all subcontracts under this contract.

For unclassified information used for the effort, the contractor shall provide an information security categorization document indicating the sensitivity of the information processed as part of this contract if the information security categorization was not provided in the statement of work. The determination shall be made using National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60 and must be approved by the Office of the Chief Information Officer (OCIO). The NRC contracting officer (CO) and Contracting Officers Representative (COR) shall be notified immediately before the contractor begins to process information at a higher sensitivity level.

If the effort includes use or processing of classified information, the NRC CO and COR shall be notified before the contractor begins to process information at a more restrictive classification level.

All work under this contract shall comply with the latest version of policy, procedures and standards. Individual task orders will reference latest versions of standards or exceptions as necessary. These policy, procedures and standards include: NRC Management Directive (MD) volume 12, Security; Computer Security Office policies, procedures and standards; National Institute of Standards and Technology (NIST) guidance and Federal Information Processing Standards (FIPS); and Committee on National Security Systems (CNSS) policy, directives, instructions, and guidance. This information is available at the following links:

NRC Policies, Procedures and Standards (OCIO/ISD - Director, Information Security Directorate, internal website):

http://www.internal.nrc.gov/CSO/policies.html All NRC Management Directives (public website):

http://www.nrc.gov/reading-rm/doc-collections/management-directives/

NIST SP and FIPS documentation is located at:

http://csrc.nist.gov/

CNSS documents are located at:

Page 38

31310020C0027 http://www.cnss.gov/

When e-mail is used, the contractors shall only use NRC provided e-mail accounts to send and receive sensitive information (information that is not releasable to the public) or mechanisms to protect the information during transmission to NRC that have been approved by OCIO/ISD.

All contractor employees must sign the NRC Agency-Wide Rules of Behavior for Authorized Computer Use prior to being granted access to NRC computing resources.

The contractor shall adhere to following NRC policies, including but not limited to:

Must meet all federally mandated and NRC defined cybersecurity requirements.

Management Directive 12.5, NRC Cybersecurity Program

Computer Security Policy for Encryption of Sensitive Data When Outside of Agency Facilities

Policy for Copying, Scanning, Printing, and Faxing SGI & Classified Information

Computer Security Information Protection Policy

Remote Access Policy

Laptop Security Policy

Computer Security Incident Response Policy Contractor will adhere to NRCs use of personal devices to process and store NRC sensitive information. The NRCs BYOD program allows NRC employees and contractors to conduct official government business using supported personal smart phones and tablets.

All work performed at non-NRC facilities shall be in facilities, networks, and computers that have been accredited by NRC for processing information at the sensitivity level of the information being processed.

Contract Performance and Closeout The contractor shall ensure that the NRC data processed during the performance of this contract shall be purged from all data storage components of the contractors computer facility, and the contractor will retain no NRC data within 30 calendar days after contract is completed.

Until all data is purged, the contractor shall ensure that any NRC data remaining in any storage component will be protected to prevent unauthorized disclosure.

When a contractor employee no longer requires access to an NRC system, the contractor shall notify the COR within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Upon contract completion, the contractor shall provide a status list of all contractor employees who were users of NRC systems and shall note if any users still require access to the system to perform work if a follow-on contract or task order has been issued by NRC.

Control of Information and Data Page 39

31310020C0027 The contractor shall not publish or disclose in any manner, without the COs written consent, the details of any security controls or countermeasures either designed or developed by the contractor under this contract or otherwise provided by the NRC.

Any IT system used to process NRC sensitive information shall:

Include a mechanism to require users to uniquely identify themselves to the system before beginning to perform any other actions that the system is expected to provide.

Be able to authenticate data that includes information for verifying the claimed identity of individual users (e.g., passwords).

Protect authentication data so that it cannot be accessed by any unauthorized user.

Be able to enforce individual accountability by providing the capability to uniquely identify each individual computer system user.

Report to appropriate security personnel when attempts are made to guess the authentication data whether inadvertently or deliberately.

Access Controls Any contractor system being used to process NRC data shall be able to define and enforce access privileges for individual users. The discretionary access controls mechanisms shall be configurable to protect objects (e.g., files, folders) from unauthorized access.

The contractor system being used to process NRC data shall provide only essential capabilities and specifically prohibit and/or restrict the use of functions, ports, protocols, and/or services, as specified in the contract/grant.

The contractors shall only use NRC approved methods to send and receive information considered sensitive or classified. Specifically,

Classified Information - All NRC Classified data being transmitted over a network shall use NSA approved encryption and adhere to guidance in MD 12.2, NRC Classified Information Security Program; MD 12.5, NRC Cybersecurity Program; and any classified encryption guidance provided by the Committee on National Security Systems. Classified processing shall be only within facilities, computers, and spaces that have been specifically approved for classified processing. All NRC personnel who have been or will be granted an account to access any system or network (to include a stand-alone system or network) on which classified information resides must be an NRC authorized classifier. Contractors must follow the above guidance and procedures when requiring access to or handling classified information. Only designated and authorized classifiers of the contractor may have access to classified information or systems.

SGI Information - All SGI being transmitted over a network shall adhere to guidance in MD 12.7, NRC Safeguards Information Security Program; and MD 12.5, NRC Cybersecurity Program. SGI processing shall be only within facilities, computers, and spaces that have been specifically approved for SGI processing. Cryptographic modules provided as part of the system shall be validated under the Cryptographic Module Validation Program to conform to NIST FIPS 140-2 overall level 2 and must be operated in FIPS mode. The contractor shall provide the FIPS Page 40

31310020C0027 140-2 cryptographic module certificate number and a brief description of the encryption module that includes the encryption algorithm(s) used, the key length, and the vendor of the product.

All NRC personnel who have been or will be granted an account to access any system or network (to include a stand-alone system or network) on which SGI resides must be an NRC authorized classifier.

The most restrictive set of rights/privileges or accesses needed by users (or processes acting on behalf of users) for the performance of specified tasks must be enforced by the system through assigned access authorizations.

Separation of duties for contractor systems used to process NRC information must be enforced by the system through assigned access authorizations.

The mechanisms within the contractor system or application that enforces access control and other security features shall be continuously protected against tampering and/or unauthorized changes.

Configuration Standards All systems used to process NRC sensitive information shall meet NRC configuration standards available at: http://www.internal.nrc.gov/CSO/standards.html.

Information Security Training and Awareness Training Contractors shall ensure that their employees, consultants, and subcontractors that have significant IT responsibilities (e.g., IT administrators, developers, project leads) receive in-depth IT security training in their area of responsibility. This training is at the employers expense.

In compliance with OMB policy, individuals with significant cybersecurity responsibilities (e.g.,

ISSOs, System Administrators) must complete required role-based training before assuming the role. NRC contractors must ensure that their staff receives the requisite role-based cybersecurity training at the contractors expense.

Media Handling All media used by the contractor to store or process NRC information shall be controlled in accordance with the sensitivity level.

The contractor shall not perform sanitization or destruction of media approved for processing NRC information designated as SGI or Classified. The contractor must provide the media to NRC for destruction.

Vulnerability Management The Contractor must adhere to NRC patch management processes for all systems used to process NRC information. Patch Management reports will made available to the NRC upon request for following security categorizations and reporting timeframes:

5 calendar days after being requested for a high sensitivity system Page 41

31310020C0027

10 calendar days after being requested for a moderate sensitivity system

15 calendar days after being requested for a low sensitivity system For any contractor system used to process NRC information, the contractor must ensure that information loaded into the system is scanned for viruses prior to posting; servers are scanned for malware, including viruses, adware, and spyware, on a regular basis; and virus signatures are updated at the following frequency:

1 calendar day for a high sensitivity system

3 calendar days for a moderate sensitivity system

7 calendar days for a low sensitivity system For any contractor deliverables or information loaded on external hard drives or other electronic devices, the contractor must ensure that, prior to delivery to the NRC, the device, including software and files, is free of malware, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, browser hijacking software, mobile code, or other malicious code.

H.4 IT SECURITY REQUIREMENTS - DEVELOPMENT AND OPERATIONS AND MAINTENANCE REQUIREMENTS (APR 2014)

O&M Security Requirements All system modifications to classified systems must comply with NRC security policies and procedures for classified systems, as well as federal laws, guidance, and standards to ensure Federal Information Security Management Act (FISMA) compliance.

The Contractor shall correct errors in contractor developed software and applicable documentation that are not commercial off-the-shelf which are discovered by the NRC or the contractor. Inability of the parties to determine the cause of software errors shall be resolved in accordance with the Disputes clause in Section I, FAR 52.233-1, incorporated by reference in the contract.

The Contractor shall adhere to the guidance outlined in NIST, SP 800-53, FIPS 200 and NRC guidance for the identification and documentation of minimum security controls.

The contractor shall provide the system requirements traceability matrix at the end of the initiation phase, development/acquisition phase, implementation/assessment phase, operation

& maintenance phase and disposal phase that provides the security requirements in a separate section so that they can be traced through the development life cycle. The contractor shall also provide the software and hardware designs and test plan documentation, and source code upon request to the NRC for review.

All development and testing of the systems shall be protected at their assigned system sensitivity level and shall be performed on a network separate and isolated from the NRC operational network.

Page 42

31310020C0027 All system computers must be properly configured and hardened according to NRC policies, guidance, and standards and comply with all NRC security policies and procedures as commensurate with the system security categorization.

All contractor provided deliverables identified in the project plan will be subject to the review and approval of NRC Management. The contractor will make the necessary modifications to project deliverables to resolve any identified issues. Project deliverables include but are not limited to:

requirements, architectures, design documents, test plans, and test reports.

Access Controls The contractor shall not hardcode any passwords into the software unless the password only appears on the server side (e.g. using server-side technology such as ASP, PHP, or JSP).

The contractor shall ensure that the software does not contain undocumented functions and undocumented methods for gaining access to the software or to the computer system on which it is installed. This includes, but is not limited to, master access keys, back doors, or trapdoors.

Cryptography Cryptographic modules provided as part of the system shall be validated under the Cryptographic Module Validation Program to conform to NIST FIPS 140-2 and must be operated in FIPS mode. The contractor shall provide the FIPS 140-2 cryptographic module certificate number and a brief description of the encryption module that includes the encryption algorithm(s) used, the key length, and the vendor of the product.

Configuration Management and Control The contractor must ensure that the system will be divided into configuration items (CIs). CIs are parts of a system that can be individually managed and versioned. The system shall be managed at the CI level.

The contractor must have a configuration management plan that includes all hardware and software that is part of the system and contains at minimum the following sections:

a. Introduction

i. Purpose & Scope ii. Definitions iii. References

b. Configuration Management

i. Organization ii. Responsibilities iii. Tools and Infrastructure

c. Configuration Management Activities Page 43

31310020C0027

i. Specification Identification ii. Change control form identification iii. Project baselines

d. Configuration and Change Control

i. Change Request Processing and Approval ii. Change Control Board

e. Milestones

i. Define baselines, reviews, audits ii. Training and Resources The Information System Security Officers (ISSO's) role in the change management process must be described. The ISSO is responsible for the security posture of the system. Any changes to the system security posture must be approved by the ISSO. The contractor should not have the ability to make changes to the system's security posture without the appropriate involvement and approval of the ISSO.

The contractor shall track and record information specific to proposed and approved changes that minimally include:

a. Identified configuration change

b. Testing of the configuration change

c. Scheduled implementation the configuration change

d. Track system impact of the configuration change

e. Track the implementation of the configuration change

f. Recording & reporting of configuration change to the appropriate party

g. Back out/Fall back plan

h. Weekly Change Reports and meeting minutes

i. Emergency change procedures

j. List of team members from key functional areas The contractor shall provide a list of software and hardware changes in advance of placing them into operation within the following timeframes:

30 calendar days for a classified, SGI, or high sensitivity system Page 44

31310020C0027

20 calendar days for a moderate sensitivity system

10 calendar days for a low sensitivity system The contractor must maintain all system documentation that is current to within:

10 calendar days for a classified, SGI, or high sensitivity system

20 calendar days for a moderate sensitivity system

30 calendar days for a low sensitivity system Modified code, tests performed and test results, issue resolution documentation, and updated system documentation shall be deliverables on the contract.

Any proposed changes to the system must have written approval from the NRC Contracting Officers Representative (COR).

The contractor shall maintain a list of hardware, firmware and software changes that is current to within:

15 calendar days for a classified, SGI or high sensitivity system

20 calendar days for a moderate sensitivity system

30 calendar days for a low sensitivity system The contractor shall analyze proposed hardware and software configurations and modification as well as addressed security vulnerabilities in advance of NRC accepted operational deployment dates within:

15 calendar days for a classified, SGI, or high sensitivity system

20 calendar days for a moderate sensitivity system

30 calendar days for a low sensitivity system The contractor shall provide the above analysis with the proposed hardware and software for NRC testing in advance of NRC accepted operational deployment dates within:

15 calendar days for a classified, SGI, or high sensitivity system

20 calendar days for a moderate sensitivity system

30 calendar days for a low sensitivity system Control of Hardware and Software The contractor shall demonstrate that all hardware and software meet security requirements prior to being placed into the NRC production environment.

Page 45

31310020C0027 The contractor shall ensure that the development environment is separated from the operational environment using NRC CSO approved controls.

The contractor shall only use licensed software and in-house developed authorized software (including NRC and contractor developed) on the system and for processing NRC information.

Public domain, shareware, or freeware shall only be installed after prior written approval is obtained from the NRC Chief Information Security Officer (CISO).

The contractor shall provide proof of valid software licensing upon request of the Contracting Officer, the NRC COR, a Senior Information Technology Security Officer (SITSO), or the Designated Approving Authorities (DAAs).

Information Security Training and Awareness Training The contractor shall ensure that its employees, in performance of the contract, receive Information Technology (IT) security training in their role at the contractors expense. The Contractor must provide the NRC written certification that training is complete, along with the title of the course and dates of training as a prerequisite to start of work on the contract.

The IT security role and associated type of training course and periodicity required to be completed are as follows:

Role Type of Training Required Frequency of Training Auditor Vendor specific operating system and application security training, database security training Prior to appointment and then every three years IT Functional Manager Vendor specific operating system and application security training, database security training Prior to appointment and then every two years Additional system specific training upon a major system update/change System Administrator Vendor specific operating system and application security training Prior to appointment and then every year:

Training in operating system security in the area of responsibility occurs every 2 years

Training in application security in the area of responsibility occurs every 2 years Information Systems Security Officer ISSO role specific training (not awareness) provided by a government agency or by a vendor such as SANS Vendor specific operating system and application security training Prior to appointment and then every year:

Training in the ISSO role occurs every 3 years

Training in operating system security in the area of responsibility occurs every 3 years

Training in application security in the area of responsibility occurs every 3 years Database Administrator Vendor specific database security training Page 46

31310020C0027 Prior to appointment and then every 2 years:

Training in database security in the area of responsibility occurs every 2 years Network Administrator Network administrator role specific training (not awareness) provided by a government agency or by a vendor such as SANS Network specific security training Prior to appointment and then every year:

Training in the Network administrator role occurs every 3 years

Training in network security in the area of responsibility occurs every year where network administrator role training does not occur IT Managers Vendor specific operating system and application security training, database security training.

Prior to appointment and then every two years Additional system specific training upon a major system update/change IT System Developer Vendor specific operating system and application security training, database security training Prior to appointment and then every year

- training with system-specific training (ISS LoB or commercial) upon assuming the role, to become biannual with NRC provided training every other year.

The contractor must ensure that required refresher training is accomplished in accordance with the required frequency specifically associated with the IT security role.

Auditing The system shall be able to create, maintain and protect from modification or unauthorized access or destruction an audit trail of accesses to the objects it protects. The audit data shall be protected so that read access to it is limited to those who are authorized.

The system shall be able to record the following types of events: use of identification and authentication mechanisms, introduction of objects into a users address space (e.g., file open, program initiation), deletion of objects, and actions taken by computer operators and system administrators or system security officers and other security relevant events. The system shall be able to audit any override of security controls.

The Contractor shall ensure auditing is implemented on the following:

Operating System

Application

Web Server

Web Services Page 47

31310020C0027

Network Devices

Database

Wireless The contractor shall perform audit log reviews daily using automated analysis tools.

Contractor must log at least the following events on systems that process NRC information:

Audit all failures

Successful logon attempt

Failure of logon attempt

Permission Changes

Unsuccessful File Access

Creating users & objects

Deletion & modification of system files

Registry Key/Kernel changes

Startup & shutdown

Authentication

Authorization/permission granting

Actions by trusted users

Process invocation

Controlled access to data by individually authenticated user

Unsuccessful data access attempt

Data deletion

Data transfer

Application configuration change

Application of confidentiality or integrity labels to data

Override or modification of data labels or markings

Output to removable media

Output to a printer Page 48

31310020C0027 H.5 GOVERNMENT FURNISHED EQUIPMENT/PROPERTY (a) The NRC will provide the contractor with the following items for use under this contract:

1. Laptops

2. []

3. []

Include an asterisk (*) if the item also applies to paragraph (b) below.

(b) The equipment/property listed below is hereby transferred from contract/agreement number:31310019C0015, to contract/agreement number:31310020C0027:

1. []

2. []

3. []

(c) Only the equipment/property listed above in the quantities shown will be provided by the Government. The contractor shall be responsible and accountable for all Government property provided under this contract and shall comply with the provisions of the FAR Government Property Clause under this contract and FAR Subpart 45.5, as in effect on the date of this contract. The contractor shall investigate and provide written notification to the NRC Contracting Officer (CO) and the NRC Division of Facilities and Security, Physical Security Branch of all cases of loss, damage, or destruction of Government property in its possession or control not later than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after discovery. The contractor must report stolen Government property to the local police and a copy of the police report must be provided to the CO and to the Division of Facilities and Security, Office of Administration.

(d) All other equipment/property required in performance of the contract shall be furnished by the Contractor.

H.6 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS Annual and final evaluations of contractor performance under this contract will be prepared in accordance with FAR Subpart 42.15, "Contractor Performance Information," normally at or near the time the contractor is notified of the NRC's intent to exercise the contract option. If the multi-year contract does not have option years, then an annual evaluation will be prepared []. Final evaluations of contractor performance will be prepared at the expiration of the contract during the contract closeout process.

The Contracting Officer will transmit the NRC Contracting Officers Representatives (COR) annual and final contractor performance evaluations to the contractor's Project Manager, unless otherwise instructed by the contractor. The contractor will be permitted thirty days to review the document and submit comments, rebutting statements, or additional information.

Where a contractor concurs with, or takes no exception to an annual performance evaluation, the Contracting Officer will consider such evaluation final and releasable for source selection Page 49

31310020C0027 purposes. Disagreements between the parties regarding a performance evaluation will be referred to an individual one level above the Contracting Officer, whose decision will be final.

The Contracting Officer will send a copy of the completed evaluation report, marked "Source Selection Information, to the contractor's Project Manager for their records as soon as practicable after it has been finalized. The completed evaluation report also will be used as a tool to improve communications between the NRC and the contractor and to improve contract performance.

The completed annual performance evaluation will be used to support future award decisions in accordance with FAR 42.1502 and 42.1503. During the period the information is being used to provide source selection information, the completed annual performance evaluation will be released to only two parties - the Federal government personnel performing the source selection evaluation and the contractor under evaluation if the contractor does not have a copy of the report already.

H.7 RULES OF BEHAVIOR FOR AUTHORIZED COMPUTER USE In accordance with Appendix III, "Security of Federal Automated Information Resources," to Office of Management and Budget (OMB) Circular A-130, "Management of Federal Information Resources," NRC has established rules of behavior for individual users who access all IT computing resources maintained and operated by the NRC or on behalf of the NRC. In response to the direction from OMB, NRC has issued the "Agency-wide Rules of Behavior for Authorized Computer Use" policy, hereafter referred to as the rules of behavior. The rules of behavior for authorized computer use will be provided to NRC computer users, including contractor personnel, as part of the annual computer security awareness course.

The rules of behavior apply to all NRC employees, contractors, vendors, and agents (users) who have access to any system operated by the NRC or by a contractor or outside entity on behalf of the NRC. This policy does not apply to licensees. The next revision of Management Directive 12.5, "NRC Automated Information Security Program," will include this policy. The rules of behavior can be viewed at https://www.nrc.gov/docs/ML1724/ML17244A084.pdf or use NRCs external Web-based ADAMS at https://www.nrc.gov/reading-rm/adams.html.

The rules of behavior are effective immediately upon acknowledgement of them by the person who is informed of the requirements contained in those rules of behavior. All current contractor users are required to review and acknowledge the rules of behavior as part of the annual computer security awareness course completion. All new NRC contractor personnel will be required to acknowledge the rules of behavior within one week of commencing work under this contract and then acknowledge as current users thereafter. The acknowledgement statement can be viewed at https://www.nrc.gov/docs/ML1724/ML17244A086.pdf or use NRCs external Web-based ADAMS at https://www.nrc.gov/reading-rm/adams.html.

The NRC Computer Security Office will review and update the rules of behavior annually beginning in FY 2011 by December 31st of each year. Contractors shall ensure that their personnel to which this requirement applies acknowledge the rules of behavior before beginning contract performance and, if the period of performance for the contract lasts more than one year, annually thereafter. Training on the meaning and purpose of the rules of behavior can be Page 50

31310020C0027 provided for contractors upon written request to the NRC Contracting Officers Representative (COR).

The contractor shall flow down this clause into all subcontracts and other agreements that relate to performance of this contract/order if such subcontracts/agreements will authorize access to NRC electronic and information technology (EIT) as that term is defined in FAR 2.101.

H.8 COMPLIANCE WITH U.S. IMMIGRATION LAWS AND REGULATIONS NRC contractors are responsible to ensure that their alien personnel are not in violation of United States immigration laws and regulations, including employment authorization documents and visa requirements. Each alien employee of the Contractor must be lawfully admitted for permanent residence as evidenced by Permanent Resident Form I-551 (Green Card), or must present other evidence from the U.S. Department of Homeland Security/U.S. Citizenship and Immigration Services that employment will not affect his/her immigration status. The U.S.

Citizenship and Immigration Services provides information to contractors to help them understand the employment eligibility verification process for non-US citizens. This information can be found on their website, http://www.uscis.gov/portal/site/uscis.

The NRC reserves the right to deny or withdraw Contractor use or access to NRC facilities or its equipment/services, and/or take any number of contract administrative actions (e.g., disallow costs, terminate for cause) should the Contractor violate the Contractor's responsibility under this clause.

H.9 INTERNET Neither NRC nor its third party contractors that manage or develop the NRC web site shall send persistent cookies, place persistent cookies on users' computers, nor collect personally identifiable information from visitors to the NRC web site unless in addition to clear and conspicuous notice, each of the following conditions are met: there is a compelling need to gather the data on the site; there are appropriate and publicly disclosed privacy safeguards for handling of information derived from "cookies"; and personal approval is obtained from the head of the agency.

H.10 SAFETY OF ON-SITE CONTRACTOR PERSONNEL Ensuring the safety of occupants of Federal buildings is a responsibility shared by the professionals implementing our security and safety programs and the persons being protected.

The NRC's Office of Administration (ADM) Division of Facilities and Security (DFS) has coordinated an Occupant Emergency Plan (OEP) for NRC Headquarters buildings with local authorities. The OEP has been approved by the Montgomery County Fire and Rescue Service.

It is designed to improve building occupants' chances of survival, minimize damage to property, and promptly account for building occupants when necessary.

The contractor's Project Director shall ensure that all personnel working full time on-site at NRC Headquarters read the NRC's OEP, provided electronically on the NRC Intranet at https://www.nrc.gov/docs/ML1401/ML14013A036.pdf. The contractor's Project Director also shall emphasize to each staff member that they are to be familiar with and guided by the OEP, as well as by instructions given by emergency response personnel in situations which pose an immediate health or safety threat to building occupants.

Page 51

31310020C0027 The NRC Contracting Officers Representative (COR) shall ensure that the contractor's Project Director has communicated the requirement for on-site contractor staff to follow the guidance in the OEP. The NRC Contracting Officers Representative (COR) also will assist in accounting for on-site contract persons in the event of a major emergency (e.g., explosion occurs and casualties or injuries are suspected) during which a full evacuation will be required, including the assembly and accountability of occupants. The NRC DFS will conduct drills periodically to train occupants and assess these procedures.

H.11 NRC INFORMATION TECHNOLOGY SECURITY TRAINING (MAY 2016)

NRC contractors shall ensure that their employees, consultants, and subcontractors with access to the agency's information technology (IT) equipment and/or IT services complete NRC's online initial and refresher IT security training requirements to ensure that their knowledge of IT threats, vulnerabilities, and associated countermeasures remains current. Both the initial and refresher IT security training courses generally last an hour or less and can be taken during the employee's regularly scheduled work day.

Contractor employees, consultants, and subcontractors shall complete the NRC's online annual, "Computer Security Awareness" course on the same day that they receive access to the agency's IT equipment and/or services, as their first action using the equipment/service. For those contractor employees, consultants, and subcontractors who are already working under this contract, the on-line training must be completed in accordance with agency Network Announcements issued throughout the year, within three weeks of issuance of this modification.

Additional annual required online NRC training includes but is not limited to the following:

(1) Information Security (INFOSEC) Awareness (2) Continuity of Operations (COOP) Awareness (3) Defensive Counterintelligence and Insider Threat Awareness (4) No FEAR Act (5) Personally Identifiable Information (PII) and Privacy Act Responsibilities Awareness Contractor employees, consultants, and subcontractors who have been granted access to NRC information technology equipment and/or IT services must continue to take IT security refresher training offered online by the NRC throughout the term of the contract. Contractor employees will receive notice of NRC's online IT security refresher training requirements through agency-wide notices.

Contractor Monthly Letter Status Reports (MLSR) must include the following information for all completed training:

(1) the name of the individual completing the course; (2) the course title; and (3) the course completion date.

Page 52

31310020C0027 The MLSR must also include the following information for those individuals who have not completed their required training:

(1) the name of the individual who has not yet completed the training; (2) the title of the course(s) which must still be completed; and (3) the anticipated course completion date(s).

The NRC reserves the right to deny or withdraw Contractor use or access to NRC IT equipment and/or services, and/or take other appropriate contract administrative actions (e.g., disallow costs, terminate for cause) should the Contractor violate the Contractor's responsibility under this clause.

H.12 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TO NUCLEAR FACILITIES, ACCESS TO CLASSIFIED INFORMATION OR SAFEGUARDS INFORMATION, OR PERFORMING IN SPECIALLY SENSITIVE POSITIONS (MARCH 2019)

The following Contractor employees, subcontractor personnel, and consultants proposed for performance or performing under this contract shall be subject to pre-assignment, random, reasonable suspicion, and post-accident drug testing: (1) individuals who have access to classified information (National Security Information and/or Restricted Data); (2) individuals who have access to Safeguards information (section 147 of the Atomic Energy Act of 1954, as amended); (3) individuals who are authorized to carry firearms while performing work under this contract; (4) individuals who are required to operate government vehicles or transport passengers for the NRC; (5) individuals who are required to operate hazardous equipment at NRC facilities; (6) individuals who administer the agencys drug program or who have Employee Assistance Program duties; (7) individuals who have unescorted access to vital or protected areas of Nuclear Power Plants, Category 1 Fuel Cycle Facilities, or Uranium Enrichment Facilities; or (8) incident/emergency response personnel (including on-call).

H.13 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLY IDENTIFIABLE INFORMATION (PII)

In accordance with the Office of Management and Budget's guidance to Federal agencies and the Nuclear Regulatory Commission's (NRC) implementing policy and procedures, a contractor (including subcontractors and contractor employees), who performs work on behalf of the NRC, is responsible for protecting, from unauthorized access or disclosure, personally identifiable information (PII) that may be provided, developed, maintained, collected, used, or disseminated, whether in paper, electronic, or other format, during performance of this contract.

A contractor who has access to NRC owned or controlled PII, whether provided to the contractor by the NRC or developed, maintained, collected, used, or disseminated by the contractor during the course of contract performance, must comply with the following requirements:

(1) General. In addition to implementing the specific requirements set forth in this clause, the contractor must adhere to all other applicable NRC guidance, policy and requirements for the handling and protection of NRC owned or controlled PII. The contractor is responsible for making sure that it has an adequate understanding of such guidance, policy and requirements.

Page 53

31310020C0027 (2) Use, Ownership, and Nondisclosure. A contractor may use NRC owned or controlled PII solely for purposes of this contract, and may not collect or use such PII for any purpose outside the contract without the prior written approval of the NRC Contracting Officer. The contractor must restrict access to such information to only those contractor employees who need the information to perform work under this contract, and must ensure that each such contractor employee (including subcontractors' employees) signs a nondisclosure agreement, in a form suitable to the NRC Contracting Officer, prior to being granted access to the information. The NRC retains sole ownership and rights to its PII. Unless the contract states otherwise, upon completion of the contract, the contractor must turn over all PII in its possession to the NRC, and must certify in writing that it has not retained any NRC owned or controlled PII except as otherwise authorized in writing by the NRC Contracting Officer.

(3) Security Plan. When applicable, and unless waived in writing by the NRC Contracting Officer, the contractor must work with the NRC to develop and implement a security plan setting forth adequate procedures for the protection of NRC owned or controlled PII as well as the procedures which the contractor must follow for notifying the NRC in the event of any security breach. The plan will be incorporated into the contract and must be implemented and followed by the contractor once it has been approved by the NRC Contracting Officer. If the contract does not include a security plan at the time of contract award, a plan must be submitted for the approval of the NRC Contracting Officer within 30 days after contract award.

(4) Breach Notification. The contractor must immediately notify the NRC Contracting Officer and the NRC Contracting Officers Representative (COR) upon discovery of any suspected or confirmed breach in the security of NRC owned or controlled PII.

(5) Legal Demands for Information. If a legal demand is made for NRC owned or controlled PII (such as by subpoena), the contractor must immediately notify the NRC Contracting Officer and the NRC Contracting Officers Representative (COR). After notification, the NRC will determine whether and to what extent to comply with the legal demand. The Contracting Officer will then notify the contractor in writing of the determination and such notice will indicate the extent of disclosure authorized, if any. The contractor may only release the information specifically demanded with the written permission of the NRC Contracting Officer.

(6) Audits. The NRC may audit the contractor's compliance with the requirements of this clause, including through the use of online compliance software.

(7) Flow-down. The prime contractor will flow this clause down to subcontractors that would be covered by any portion of this clause, as if they were the prime contractor.

(8) Remedies:

(a) The contractor is responsible for implementing and maintaining adequate security controls to prevent the loss of control or unauthorized disclosure of NRC owned or controlled PII in its possession. Furthermore, the contractor is responsible for reporting any known or suspected loss of control or unauthorized access to PII to the NRC in accordance with the provisions set forth in Article 4 above.

(b) Should the contractor fail to meet its responsibilities under this clause, the NRC reserves the right to take appropriate steps to mitigate the contractor's violation of this clause. This may include, at the sole discretion of the NRC, termination of the subject contract.

Page 54

31310020C0027 (9) Indemnification. Notwithstanding any other remedies available to the NRC, the contractor will indemnify the NRC against all liability (including costs and fees) for any damages arising out of violations of this clause.

H.14 GREEN PURCHASING (SEP 2015 )

(a) In furtherance of the sustainable acquisition goals of Executive Order (EO) 13693, "Planning for Federal Sustainability in the Next Decade," products and services provided under this contract/order shall be energy efficient (EnergyStar or Federal Energy Management Program -

FEMP-designated products), water efficient, biobased, environmentally preferable (excluding EPEAT-registered products), non-ozone depleting, contain recycled content, or are non- or low toxic alternatives or hazardous constituents (e.g., non-VOC paint), where such products and services meet agency performance requirements. See: Executive Order (EO) 13693, "Planning for Federal Sustainability in the Next Decade."

(b) The NRC and contractor may negotiate during the contract term to permit the substitution or addition of designated recycled content products (i.e., Comprehensive Procurement Guidelines

- CPG), EPEAT-registered products, EnergyStar- and FEMP designated energy efficient products and appliances, USDA designated biobased products (Biopreferred program),

environmentally preferable products, WaterSense and other water efficient products, products containing non- or lower-ozone depleting substances (i.e., SNAP), and products containing non-or low-toxic or hazardous constituents (e.g., non-VOC paint), when such products and services are readily available at a competitive cost and satisfy the NRCs performance needs.

(c) The contractor shall flow down this clause into all subcontracts and other agreements that relate to performance of this contract/order.

H.15 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONIC PAYMENT/REMITTANCE ADDRESS The Debt Collection Improvement Act of 1996 requires that all Federal payments except IRS tax refunds be made by Electronic Funds Transfer. lt is the policy of the Nuclear Regulatory Commission to pay government vendors by the Automated Clearing House (ACH) electronic funds transfer payment system. Item 15C of the Standard Form 33 may be disregarded.

H.16 COMPLIANCE WITH INTERNET PROTOCOL VERSION 6 (IPV6) IN ACQUIRING ELECTRONIC AND INFORMATION TECHOLOGY (EIT) (OCT 2012)

(a) This procurement involves the acquisition of electronic and information technology (EIT), as defined in FAR 2.101, that uses the Internet Protocol (IP).

(b) As used in this clause, IPv6 Capable Products means any product that meets the minimum set of mandatory requirements, appropriate to its Product Class, necessary for it to interoperate with other IPv6 products employed in IPv6 networks.

(c) In its quotation or proposal, the offeror shall provide a complete and signed USGv6 Suppliers Declaration of Conformity (SDOC) for all IPv6 capable products. See Internet site at www.nist.gov/itl/antd/usgv6.cfm. The offerors submitted SDOC should address all of the IPv6 capabilities/stacks claimed for the specific product being offered and report appropriate conformance and interoperability testing results obtained from an accredited USGv6 testing Page 55

31310020C0027 laboratory. If an offeror does not have an SDOC, the firm should sufficiently address the path forward relating to IPv6 certification.

(d) If the offeror plans to offer a deliverable that involves EIT that may not comply with IPv6 requirements at the time of delivery and receives the award for the contract/order, then the contractor shall obtain the Contracting Officers written approval before commencing work on the deliverable.

(e) Should the offeror find that the Statement of Work/Specifications of this contract/order does not conform to IPv6 standards, it must notify the contracting officer in a timely manner of such nonconformance.

(f) The contractor shall flow down this clause into all subcontracts and other agreements that relate to performance of this contract/order.

(g) The contractor shall ensure that all deliverables that involve EIT that use IP (products, services, software, etc.) comply with IPv6 standards and interoperate with both IPv6 and IPv4 systems and products.

H.17 52.204-19 INCORPORATION BY REFERENCE OF REPRESENTATIONS AND CERTIFICATIONS. (DEC 2014)

The Contractor's representations and certifications, including those completed electronically via the System for Award Management (SAM), are incorporated by reference into the contract.

(End of clause)

Page 56

31310020C0027 I - Contract Clauses NRC Local Clauses Incorporated by Full Text I.1 NRC ACQUISTION REGULATION (NRCAR) PROVISIONS AND CLAUSES (AUG 2011)

Applicable NRCAR provisions and clauses located in 48 CFR Chapter 20 are hereby incorporated by reference into this contract/order.

NRCAR Clauses Incorporated By Full Text I.2 2052.204-70 SECURITY. (OCT 1999)

(a) Security/Classification Requirements Form. The attached NRC Form 187 (See List of Attachments) furnishes the basis for providing security and classification requirements to prime contractors, subcontractors, or others (e.g., bidders) who have or may have an NRC contractual relationship that requires access to classified information or matter, access on a continuing basis (in excess of 90 or more days) to NRC Headquarters controlled buildings, or otherwise requires NRC photo identification or card-key badges.

(b) It is the contractor's duty to safeguard National Security Information, Restricted Data, and Formerly Restricted Data. The contractor shall, in accordance with the Commission's security regulations and requirements, be responsible for safeguarding National Security Information, Restricted Data, and Formerly Restricted Data, and for protecting against sabotage, espionage, loss, and theft, the classified documents and material in the contractor's possession in connection with the performance of work under this contract. Except as otherwise expressly provided in this contract, the contractor shall transmit to the Commission any classified matter in the possession of the contractor or any person under the contractor's control in connection with performance of this contract upon completion or termination of this contract.

(1) The contractor shall complete a certificate of possession to be furnished to the Commission specifying the classified matter to be retained if the retention is:

(i) Required after the completion or termination of the contract; and (ii) Approved by the contracting officer.

(2) The certification must identify the items and types or categories of matter retained, the conditions governing the retention of the matter and their period of retention, if known. If the retention is approved by the contracting officer, the security provisions of the contract continue to be applicable to the matter retained.

(c) In connection with the performance of the work under this contract, the contractor may be furnished, or may develop or acquire, proprietary data (trade secrets) or confidential or privileged technical, business, or financial information, including Commission plans, policies, reports, financial plans, internal data protected by the Privacy Act of 1974 (Pub. L.93-579), or other information which has not been released to the public or has been determined by the Commission to be otherwise exempt from disclosure to the public. The contractor agrees to hold the information in confidence and Page 57

31310020C0027 not to directly or indirectly duplicate, disseminate, or disclose the information, in whole or in part, to any other person or organization except as necessary to perform the work under this contract. The contractor agrees to return the information to the Commission or otherwise dispose of it at the direction of the contracting officer. Failure to comply with this clause is grounds for termination of this contract.

(d) Regulations. The contractor agrees to conform to all security regulations and requirements of the Commission which are subject to change as directed by the NRC Division of Facilities and Security and the Contracting Officer. These changes will be under the authority of the FAR Changes clause referenced in Section I of this document.

(e) Definition of National Security Information. As used in this clause, the term National Security Information means information that has been determined pursuant to Executive Order 12958 or any predecessor order to require protection against unauthorized disclosure and that is so designated.

(f) Definition of Restricted Data. As used in this clause, the term Restricted Data means all data concerning design, manufacture, or utilization of atomic weapons; the production of special nuclear material; or the use of special nuclear material in the production of energy, but does not include data declassified or removed from the Restricted Data category under to Section 142 of the Atomic Energy Act of 1954, as amended.

(g) Definition of Formerly Restricted Data. As used in this clause the term Formerly Restricted Data means all data removed from the Restricted Data category under Section 142-d of the Atomic Energy Act of 1954, as amended.

(h) Security clearance personnel. The contractor may not permit any individual to have access to Restricted Data, Formerly Restricted Data, or other classified information, except in accordance with the Atomic Energy Act of 1954, as amended, and the Commission's regulations or requirements applicable to the particular type or category of classified information to which access is required. The contractor shall also execute a Standard Form 312, Classified Information Nondisclosure Agreement, when access to classified information is required.

(i) Criminal liabilities. Disclosure of National Security Information, Restricted Data, and Formerly Restricted Data relating to the work or services ordered hereunder to any person not entitled to receive it, or failure to safeguard any Restricted Data, Formerly Restricted Data, or any other classified matter that may come to the contractor or any person under the contractor's control in connection with work under this contract, may subject the contractor, its agents, employees, or subcontractors to criminal liability under the laws of the United States. (See the Atomic Energy Act of 1954, as amended, 42 U.S.C. 2011 et seq.; 18 U.S.C. 793 and 794; and Executive Order 12958.)

(j) Subcontracts and purchase orders. Except as otherwise authorized, in writing, by the contracting officer, the contractor shall insert provisions similar to the foregoing in all subcontracts and purchase orders under this contract.

(k) In performing contract work, the contractor shall classify all documents, material, and equipment originated or generated by the contractor in accordance with guidance issued by the Commission. Every subcontract and purchase order issued under the contract Page 58

31310020C0027 that involves originating or generating classified documents, material, and equipment must provide that the subcontractor or supplier assign the proper classification to all documents, material, and equipment in accordance with guidance furnished by the contractor.

(End of Clause)

I.3 2052.204-71 SITE ACCESS BADGE REQUIREMENTS. (JAN 1993)

During the life of this contract, the rights of ingress and egress for contractor personnel must be made available as required. In this regard, all contractor personnel whose duties under this contract require their presence on-site shall be clearly identifiable by a distinctive badge furnished by the Government. The Project Officer shall assist the contractor in obtaining the badges for contractor personnel. It is the sole responsibility of the contractor to ensure that each employee has proper identification at all times. All prescribed identification must be immediately delivered to the Security Office for cancellation or disposition upon the termination of employment of any contractor personnel. Contractor personnel shall have this identification in their possession during on-site performance under this contract. It is the contractor's duty to assure that contractor personnel enter only those work areas necessary for performance of contract work and to assure the safeguarding of any Government records or data that contractor personnel may come into contact with.

(End of Clause)

FAR Clauses Incorporated By Reference I.4 52.203-16 PREVENTING PERSONAL CONFLICTS OF INTEREST. (JUN 2020)

I.5 52.203-17 CONTRACTOR EMPLOYEE WHISTLEBLOWER RIGHTS AND REQUIREMENT TO INFORM EMPLOYEES OF WHISTLEBLOWER RIGHTS. (JUN 2020)

I.6 52.227-16 ADDITIONAL DATA REQUIREMENTS. (JUN 1987)

I.7 52.227-18 RIGHTS IN DATA - EXISTING WORKS. (DEC 2007)

I.8 52.227-19 COMMERCIAL COMPUTER SOFTWARE LICENSE. (DEC 2007)

I.9 52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS. (DEC 2013)

FAR Clauses Incorporated By Full Text I.10 52.204-2 SECURITY REQUIREMENTS. (AUG 1996)

(a) This clause applies to the extent that this contract involves access to information classified Confidential, Secret, or Top Secret.

(b) The Contractor shall comply with (1) the Security Agreement (DD Form 441),

including the National Industrial Security Program Operating Manual (DOD 5220.22-M),

and (2) any revisions to that manual, notice of which has been furnished to the Contractor.

Page 59

31310020C0027 (c) If, subsequent to the date of this contract, the security classification or security requirements under this contract are changed by the Government and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract.

(d) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

(End of clause)

I.11 52.204-9 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL. (JAN 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract.

The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee's employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d),

in all subcontracts when the subcontractor's employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

(End of clause)

I.12 52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE. (OCT 2018)

(a) Definitions. As used in this clause-Electronic Funds Transfer (EFT) indicator means a four-character suffix to the unique entity identifier. The suffix is assigned at the discretion of the commercial, nonprofit, or Page 60

31310020C0027 Government entity to establish additional System for Award Management (SAM) records for identifying alternative EFT accounts (see subpart 32.11) for the same entity.

Registered in the System for Award Management (SAM) means that-(1) The Contractor has entered all mandatory information, including the unique entity identifier and the EFT indicator (if applicable), the Commercial and Government Entity (CAGE) code, as well as data required by the Federal Funding Accountability and Transparency Act of 2006 (see subpart 4.14), into SAM; (2) The Contractor has completed the Core, Assertions, Representations and Certifications, and Points of Contact sections of the registration in SAM; (3) The Government has validated all mandatory data fields, to include validation of the Taxpayer Identification Number (TIN) with the Internal Revenue Service (IRS). The Contractor will be required to provide consent for TIN validation to the Government as a part of the SAM registration process; and (4) The Government has marked the record "Active".

System for Award Management (SAM) means the primary Government repository for prospective Federal awardee and Federal awardee information and the centralized Government system for certain contracting, grants, and other assistance-related processes. It includes-(1) Data collected from prospective Federal awardees required for the conduct of business with the Government; (2) Prospective contractor-submitted annual representations and certifications in accordance with FAR subpart 4.12; and (3) Identification of those parties excluded from receiving Federal contracts, certain subcontracts, and certain types of Federal financial and non-financial assistance and benefits.

Unique entity identifier means a number or other identifier used to identify a specific commercial, nonprofit, or Government entity. See www.sam.gov for the designated entity for establishing unique entity identifiers.

(b) If the solicitation for this contract contained the provision 52.204-7 with its Alternate I, and the Contractor was unable to register prior to award, the Contractor shall be registered in SAM within 30 days after award or before three days prior to submission of the first invoice, whichever occurs first.

(c) The Contractor shall maintain registration in SAM during contract performance and through final payment of any contract, basic agreement, basic ordering agreement, or blanket purchasing agreement. The Contractor is responsible for the currency, accuracy and completeness of the data within SAM, and for any liability resulting from the Government's reliance on inaccurate or incomplete data. To remain registered in SAM after the initial registration, the Contractor is required to review and update on an annual Page 61

31310020C0027 basis, from the date of initial registration or subsequent updates, its information in SAM to ensure it is current, accurate and complete. Updating information in SAM does not alter the terms and conditions of this contract and is not a substitute for a properly executed contractual document.

(d)(1)(i) If a Contractor has legally changed its business name or "doing business as" name (whichever is shown on the contract), or has transferred the assets used in performing the contract, but has not completed the necessary requirements regarding novation and change-of-name agreements in subpart 42.12, the Contractor shall provide the responsible Contracting Officer a minimum of one business day's written notification of its intention to-(A) Change the name in SAM; (B) Comply with the requirements of subpart 42.12 of the FAR; and (C) Agree in writing to the timeline and procedures specified by the responsible Contracting Officer. The Contractor shall provide with the notification sufficient documentation to support the legally changed name.

(ii) If the Contractor fails to comply with the requirements of paragraph (d)(1)(i) of this clause, or fails to perform the agreement at paragraph (d)(1)(i)(C) of this clause, and, in the absence of a properly executed novation or change-of-name agreement, the SAM information that shows the Contractor to be other than the Contractor indicated in the contract will be considered to be incorrect information within the meaning of the "Suspension of Payment" paragraph of the electronic funds transfer (EFT) clause of this contract.

(2) The Contractor shall not change the name or address for EFT payments or manual payments, as appropriate, in SAM record to reflect an assignee for the purpose of assignment of claims (see FAR subpart 32.8, Assignment of Claims).

Assignees shall be separately registered in SAM. Information provided to the Contractor's SAM record that indicates payments, including those made by EFT, to an ultimate recipient other than that Contractor will be considered to be incorrect information within the meaning of the "Suspension of Payment" paragraph of the EFT clause of this contract.

(3) The Contractor shall ensure that the unique entity identifier is maintained with the entity designated at www.sam.gov for establishment of the unique entity identifier throughout the life of the contract. The Contractor shall communicate any change to the unique entity identifier to the Contracting Officer within 30 days after the change, so an appropriate modification can be issued to update the data on the contract. A change in the unique entity identifier does not necessarily require a novation be accomplished.

(e) Contractors may obtain additional information on registration and annual confirmation requirements at https://www.sam.gov.

Page 62

31310020C0027 (End of clause)

I.13 52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE MAINTENANCE. (AUG 2020)

(a) Definition. As used in this clause-Commercial and Government Entity (CAGE) code means-(1) An identifier assigned to entities located in the United States or its outlying areas by the Defense Logistics Agency (DLA) Commercial and Government Entity (CAGE) Branch to identify a commercial or government entity by unique location; or (2) An identifier assigned by a member of the North Atlantic Treaty Organization (NATO) or by the NATO Support and Procurement Agency (NSPA) to entities located outside the United States and its outlying areas that the DLA Commercial and Government Entity (CAGE) Branch records and maintains in the CAGE master file. This type of code is known as a NATO CAGE (NCAGE) code.

(b) Contractors shall ensure that the CAGE code is maintained throughout the life of the contract for each location of contract, including subcontract, performance. For contractors registered in the System for Award Management (SAM), the DLA Commercial and Government Entity (CAGE) Branch shall only modify data received from SAM in the CAGE master file if the contractor initiates those changes via update of its SAM registration. Contractors undergoing a novation or change-of-name agreement shall notify the contracting officer in accordance with subpart 42.12. The contractor shall communicate any change to the CAGE code to the contracting officer within 30 days after the change, so that a modification can be issued to update the CAGE code on the contract.

(c) Contractors located in the United States or its outlying areas that are not registered in SAM shall submit written change requests to the DLA Commercial and Government Entity (CAGE) Branch. Requests for changes shall be provided at https://cage.dla.mil.

Change requests to the CAGE master file are accepted from the entity identified by the code.

(d) Contractors located outside the United States and its outlying areas that are not registered in SAM shall contact the appropriate National Codification Bureau (points of contact available at http://www.nato.int/structur/AC/135/main/links/contacts.htm) or NSPA at https://eportal.nspa.nato.int/AC135Public/scage/CageList.aspx to request CAGE changes.

(e) Additional guidance for maintaining CAGE codes is available at https://cage.dla.mil.

(f) If the contract includes Federal Acquisition Regulation clause 52.204-2, Security Requirements, the contractor shall ensure that subcontractors maintain their CAGE code(s) throughout the life of the contract.

(End of clause)

Page 63

31310020C0027 I.14 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION SYSTEMS. (JUN 2016)

(a) Definitions. As used in this clause-Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

Safeguarding means measures or controls that are prescribed to protect information systems.

(b) Safeguarding requirements and procedures. (1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

Page 64

31310020C0027 (vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e.,

information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.

(End of clause)

I.15 52.212-4 CONTRACT TERMS AND CONDITIONS - COMMERCIAL ITEMS. (OCT 2018)

Page 65

31310020C0027 (a) Inspection/Acceptance. The Contractor shall only tender for acceptance those items that conform to the requirements of this contract. The Government reserves the right to inspect or test any supplies or services that have been tendered for acceptance. The Government may require repair or replacement of nonconforming supplies or reperformance of nonconforming services at no increase in contract price. If repair/replacement or reperformance will not correct the defects or is not possible, the Government may seek an equitable price reduction or adequate consideration for acceptance of nonconforming supplies or services. The Government must exercise its postacceptance rights (1) within a reasonable time after the defect was discovered or should have been discovered; and (2) before any substantial change occurs in the condition of the item, unless the change is due to the defect in the item.

(b) Assignment. The Contractor or its assignee may assign its rights to receive payment due as a result of performance of this contract to a bank, trust company, or other financing institution, including any Federal lending agency in accordance with the Assignment of Claims Act (31 U.S.C. 3727). However, when a third party makes payment (e.g., use of the Governmentwide commercial purchase card), the Contractor may not assign its rights to receive payment under this contract.

(c) Changes. Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

(d) Disputes. This contract is subject to 41 U.S.C. chapter 71, Contract Disputes. Failure of the parties to this contract to reach agreement on any request for equitable adjustment, claim, appeal or action arising under or relating to this contract shall be a dispute to be resolved in accordance with the clause at FAR 52.233-1, Disputes, which is incorporated herein by reference. The Contractor shall proceed diligently with performance of this contract, pending final resolution of any dispute arising under the contract.

(e) Definitions. The clause at FAR 52.202-1, Definitions, is incorporated herein by reference.

(f) Excusable delays. The Contractor shall be liable for default unless nonperformance is caused by an occurrence beyond the reasonable control of the Contractor and without its fault or negligence such as, acts of God or the public enemy, acts of the Government in either its sovereign or contractual capacity, fires, floods, epidemics, quarantine restrictions, strikes, unusually severe weather, and delays of common carriers. The Contractor shall notify the Contracting Officer in writing as soon as it is reasonably possible after the commencement of any excusable delay, setting forth the full particulars in connection therewith, shall remedy such occurrence with all reasonable dispatch, and shall promptly give written notice to the Contracting Officer of the cessation of such occurrence.

(g) Invoice. (1) The Contractor shall submit an original invoice and three copies (or electronic invoice, if authorized) to the address designated in the contract to receive invoices. An invoice must include-(i) Name and address of the Contractor; Page 66

31310020C0027 (ii) Invoice date and number; (iii) Contract number, line item number and, if applicable, the order number; (iv) Description, quantity, unit of measure, unit price and extended price of the items delivered; (v) Shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading; (vi) Terms of any discount for prompt payment offered; (vii) Name and address of official to whom payment is to be sent; (viii) Name, title, and phone number of person to notify in event of defective invoice; and (ix) Taxpayer Identification Number (TIN). The Contractor shall include its TIN on the invoice only if required elsewhere in this contract.

(x) Electronic funds transfer (EFT) banking information.

(A) The Contractor shall include EFT banking information on the invoice only if required elsewhere in this contract.

(B) If EFT banking information is not required to be on the invoice, in order for the invoice to be a proper invoice, the Contractor shall have submitted correct EFT banking information in accordance with the applicable solicitation provision, contract clause (e.g.,

52.232-33, Payment by Electronic Funds Transfer-System for Award Management, or 52.232-34, Payment by Electronic Funds Transfer-Other Than System for Award Management), or applicable agency procedures.

(C) EFT banking information is not required if the Government waived the requirement to pay by EFT.

(2) Invoices will be handled in accordance with the Prompt Payment Act (31 U.S.C. 3903) and Office of Management and Budget (OMB) prompt payment regulations at 5 CFR part 1315.

(h) Patent indemnity. The Contractor shall indemnify the Government and its officers, employees and agents against liability, including costs, for actual or alleged direct or contributory infringement of, or inducement to infringe, any United States or foreign patent, trademark or copyright, arising out of the performance of this contract, provided the Contractor is reasonably notified of such claims and proceedings.

(i) Payment- (1) Items accepted. Payment shall be made for items accepted by the Government that have been delivered to the delivery destinations set forth in this contract.

Page 67

31310020C0027 (2) Prompt payment. The Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and prompt payment regulations at 5 CFR part 1315.

(3) Electronic Funds Transfer (EFT). If the Government makes payment by EFT, see 52.212-5(b) for the appropriate EFT clause.

(4) Discount. In connection with any discount offered for early payment, time shall be computed from the date of the invoice. For the purpose of computing the discount earned, payment shall be considered to have been made on the date which appears on the payment check or the specified payment date if an electronic funds transfer payment is made.

(5) Overpayments. If the Contractor becomes aware of a duplicate contract financing or invoice payment or that the Government has otherwise overpaid on a contract financing or invoice payment, the Contractor shall-(i) Remit the overpayment amount to the payment office cited in the contract along with a description of the overpayment including the-(A) Circumstances of the overpayment (e.g., duplicate payment, erroneous payment, liquidation errors, date(s) of overpayment);

(B) Affected contract number and delivery order number, if applicable; (C) Affected line item or subline item, if applicable; and (D) Contractor point of contact.

(ii) Provide a copy of the remittance and supporting documentation to the Contracting Officer.

(6) Interest. (i) All amounts that become payable by the Contractor to the Government under this contract shall bear simple interest from the date due until paid unless paid within 30 days of becoming due. The interest rate shall be the interest rate established by the Secretary of the Treasury as provided in 41 U.S.C. 7109, which is applicable to the period in which the amount becomes due, as provided in (i)(6)(v) of this clause, and then at the rate applicable for each six-month period as fixed by the Secretary until the amount is paid.

(ii) The Government may issue a demand for payment to the Contractor upon finding a debt is due under the contract.

(iii) Final decisions. The Contracting Officer will issue a final decision as required by 33.211 if-(A) The Contracting Officer and the Contractor are unable to reach agreement on the existence or amount of a debt within 30 days; Page 68

31310020C0027 (B) The Contractor fails to liquidate a debt previously demanded by the Contracting Officer within the timeline specified in the demand for payment unless the amounts were not repaid because the Contractor has requested an installment payment agreement; or (C) The Contractor requests a deferment of collection on a debt previously demanded by the Contracting Officer (see 32.607-2).

(iv) If a demand for payment was previously issued for the debt, the demand for payment included in the final decision shall identify the same due date as the original demand for payment.

(v) Amounts shall be due at the earliest of the following dates:

(A) The date fixed under this contract.

(B) The date of the first written demand for payment, including any demand for payment resulting from a default termination.

(vi) The interest charge shall be computed for the actual number of calendar days involved beginning on the due date and ending on-(A) The date on which the designated office receives payment from the Contractor; (B) The date of issuance of a Government check to the Contractor from which an amount otherwise payable has been withheld as a credit against the contract debt; or (C) The date on which an amount withheld and applied to the contract debt would otherwise have become payable to the Contractor.

(vii) The interest charge made under this clause may be reduced under the procedures prescribed in 32.608-2 of the Federal Acquisition Regulation in effect on the date of this contract.

(j) Risk of loss. Unless the contract specifically provides otherwise, risk of loss or damage to the supplies provided under this contract shall remain with the Contractor until, and shall pass to the Government upon:

(1) Delivery of the supplies to a carrier, if transportation is f.o.b. origin; or (2) Delivery of the supplies to the Government at the destination specified in the contract, if transportation is f.o.b. destination.

(k) Taxes. The contract price includes all applicable Federal, State, and local taxes and duties.

Page 69

31310020C0027 (l) Termination for the Government's convenience. The Government reserves the right to terminate this contract, or any part hereof, for its sole convenience. In the event of such termination, the Contractor shall immediately stop all work hereunder and shall immediately cause any and all of its suppliers and subcontractors to cease work. Subject to the terms of this contract, the Contractor shall be paid a percentage of the contract price reflecting the percentage of the work performed prior to the notice of termination, plus reasonable charges the Contractor can demonstrate to the satisfaction of the Government using its standard record keeping system, have resulted from the termination. The Contractor shall not be required to comply with the cost accounting standards or contract cost principles for this purpose. This paragraph does not give the Government any right to audit the Contractor's records. The Contractor shall not be paid for any work performed or costs incurred which reasonably could have been avoided.

(m) Termination for cause. The Government may terminate this contract, or any part hereof, for cause in the event of any default by the Contractor, or if the Contractor fails to comply with any contract terms and conditions, or fails to provide the Government, upon request, with adequate assurances of future performance. In the event of termination for cause, the Government shall not be liable to the Contractor for any amount for supplies or services not accepted, and the Contractor shall be liable to the Government for any and all rights and remedies provided by law. If it is determined that the Government improperly terminated this contract for default, such termination shall be deemed a termination for convenience.

(n) Title. Unless specified elsewhere in this contract, title to items furnished under this contract shall pass to the Government upon acceptance, regardless of when or where the Government takes physical possession.

(o) Warranty. The Contractor warrants and implies that the items delivered hereunder are merchantable and fit for use for the particular purpose described in this contract.

(p) Limitation of liability. Except as otherwise provided by an express warranty, the Contractor will not be liable to the Government for consequential damages resulting from any defect or deficiencies in accepted items.

(q) Other compliances. The Contractor shall comply with all applicable Federal, State and local laws, executive orders, rules and regulations applicable to its performance under this contract.

(r) Compliance with laws unique to Government contracts. The Contractor agrees to comply with 31 U.S.C. 1352 relating to limitations on the use of appropriated funds to influence certain Federal contracts; 18 U.S.C. 431 relating to officials not to benefit; 40 U.S.C. chapter 37, Contract Work Hours and Safety Standards; 41 U.S.C. chapter 87, Kickbacks; 41 U.S.C. 4712 and 10 U.S.C. 2409 relating to whistleblower protections; 49 U.S.C. 40118, Fly American; and 41 U.S.C. chapter 21 relating to procurement integrity.

(s) Order of precedence. Any inconsistencies in this solicitation or contract shall be resolved by giving precedence in the following order: (1) the schedule of supplies/services; (2) The Assignments, Disputes, Payments, Invoice, Other Compliances, Compliance with Laws Unique to Government Contracts, and Unauthorized Obligations paragraphs of this clause; (3) the clause at 52.212-5; (4)

Page 70

31310020C0027 addenda to this solicitation or contract, including any license agreements for computer software; (5) solicitation provisions if this is a solicitation; (6) other paragraphs of this clause; (7) the Standard Form 1449; (8) other documents, exhibits, and attachments; and (9) the specification.

(t) Removed and reserved.

(u) Unauthorized Obligations. (1) Except as stated in paragraph (u)(2) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation (31 U.S.C. 1341), the following shall govern:

(i) Any such clause is unenforceable against the Government.

(ii) Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an "I agree" click box or other comparable mechanism (e.g., "click-wrap" or "browse-wrap" agreements), execution does not bind the Government or any Government authorized end user to such clause.

(iii) Any such clause is deemed to be stricken from the EULA, TOS, or similar legal instrument or agreement.

(2) Paragraph (u)(1) of this clause does not apply to indemnification by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures.

(v) Incorporation by reference. The Contractor's representations and certifications, including those completed electronically via the System for Award Management (SAM),

are incorporated by reference into the contract.

(End of clause)

I.16 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS - COMMERCIAL ITEMS. (AUG 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

Page 71

31310020C0027 (2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018)

(Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AUG 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

[X] (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (OCT 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

[ ] (2) 52.203-13, Contractor Code of Business Ethics and Conduct (JUN 2020)

(41 U.S.C. 3509).

[X] (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (JUN 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

[X] (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109-282) (31 U.S.C. 6101 note).

(5) (Reserved)

[ ] (6) 52.204-14, Service Contract Reporting Requirements (OCT 2016) (Pub. L.

111-117, section 743 of Div. C).

[ ] (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (OCT 2016) (Pub. L. 111-117, section 743 of Div. C).

[ ] (8) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (JUN 2020) (31 U.S.C. 6101 note).

[ ] (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (OCT 2018) (41 U.S.C. 2313).

[ ] (10) (Reserved)

Page 72

31310020C0027

[X] (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole Source Award (MAR 2020) (15 U.S.C. 657a).

[ ] (ii) Alternate I (MAR 2020) of 52.219-3.

[X] (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (MAR 2020) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

[ ] (ii) Alternate I (MAR 2020) of 52.219-4.

[ ] (13) (Reserved)

[X] (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (MAR 2020) (15 U.S.C. 644).

[ ] (ii) Alternate I (MAR 2020) of 52.219-6.

[ ] (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (MAR 2020) (15 U.S.C. 644).

[ ] (ii) Alternate I (MAR 2020) of 52.219-7.

[ ] (16) 52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C.

637(d)(2) and (3)).

[ ] (17)(i) 52.219-9, Small Business Subcontracting Plan (JUN 2020) (15 U.S.C.

637(d)(4)).

[ ] (ii) Alternate I (NOV 2016) of 52.219-9.

[ ] (iii) Alternate II (NOV 2016) of 52.219-9.

[ ] (iv) Alternate III (JUN 2020) of 52.219-9.

[ ] (v) Alternate IV (JUN 2020) of 52.219-9.

[ ] (18)(i) 52.219-13, Notice of Set-Aside of Orders (MAR 2020) (15 U.S.C.

644(r)).

[ ] (ii) Alternate I (MAR 2020) of 52.219-13.

[ ] (19) 52.219-14, Limitations on Subcontracting (MAR 2020) (15 U.S.C.

637(a)(14)).

[ ] (20) 52.219-16, Liquidated Damages-Subcontracting Plan (JAN 1999) (15 U.S.C. 637(d)(4)(F)(i)).

[ ] (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (MAR 2020) (15 U.S.C. 657f).

Page 73

31310020C0027

[ ] (22)(i) 52.219-28, Post-Award Small Business Program Rerepresentation (MAY 2020) (15 U.S.C. 632(a)(2)).

[ ] (ii) Alternate I (MAR 2020) of 52.219-28.

[ ] (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women-Owned Small Business (EDWOSB)

Concerns (MAR 2020) (15 U.S.C. 637(m)).

[ ] (24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (MAR 2020) (15 U.S.C. 637(m)).

[ ] (25) 52.219-32, Orders Issued Directly Under Small Business Reserves (MAR 2020) (15 U.S.C. 644(r)).

[ ] (26) 52.219-33, Nonmanufacturer Rule (MAR 2020) (15 U.S.C. 637(a)(17)).

[X] (27) 52.222-3, Convict Labor (JUN 2003) (E.O. 11755).

[ ] (28) 52.222-19, Child Labor-Cooperation with Authorities and Remedies (JAN 2020) (E.O. 13126).

[ ] (29) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

[ ] (30)(i) 52.222-26, Equal Opportunity (SEP 2016) (E.O. 11246).

[ ] (ii) Alternate I (FEB 1999) of 52.222-26.

[ ] (31)(i) 52.222-35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C.

4212).

[X] (ii) Alternate I (JUL 2014) of 52.222-35.

[ ] (32)(i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020)

(29 U.S.C. 793).

[ ] (ii) Alternate I (JUL 2014) of 52.222-36.

[X] (33) 52.222-37, Employment Reports on Veterans (JUN 2020) (38 U.S.C.

4212).

[ ] (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

[ ] (35)(i) 52.222-50, Combating Trafficking in Persons (JAN 2019) (22 U.S.C.

chapter 78 and E.O. 13627).

[ ] (ii) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

Page 74

31310020C0027

[ ] (36) 52.222-54, Employment Eligibility Verification (OCT 2015). (E. O. 12989).

(Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial items as prescribed in 22.1803.)

[ ] (37)(i) 52.223-9, Estimate of Percentage of Recovered Material Content for EPA-Designated Items (MAY 2008) (42 U.S.C. 6962(c)(3)(A)(ii)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

[ ] (ii) Alternate I (MAY 2008) of 52.223-9 (42 U.S.C. 6962(i)(2)(C)). (Not applicable to the acquisition of commercially available off-the-shelf items.)

[ ] (38) 52.223-11, Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons (JUN 2016) (E.O. 13693).

[ ] (39) 52.223-12, Maintenance, Service, Repair, or Disposal of Refrigeration Equipment and Air Conditioners (JUN 2016) (E.O. 13693).

[ ] (40)(i) 52.223-13, Acquisition of EPEAT-Registered Imaging Equipment (JUN 2014) (E.O.s 13423 and 13514).

[ ] (ii) Alternate I (OCT 2015) of 52.223-13.

[ ] (41)(i) 52.223-14, Acquisition of EPEAT-Registered Televisions (JUN 2014)

(E.O.s 13423 and 13514).

(ii) Alternate I (JUN 2014) of 52.223-14.

[ ] (42) 52.223-15, Energy Efficiency in Energy-Consuming Products (MAY 2020)

(42 U.S.C. 8259b).

[ ] (43)(i) 52.223-16, Acquisition of EPEAT-Registered Personal Computer Products (OCT 2015) (E.O.s 13423 and 13514).

[ ] (ii) Alternate I (JUN 2014) of 52.223-16.

[ ] (44) 52.223-18, Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020) (E.O. 13513).

[ ] (45) 52.223-20, Aerosols (JUN 2016) (E.O. 13693).

[X] (46) 52.223-21, Foams (JUN 2016) (E.O. 13693).

[ ] (47)(i) 52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a).

[X] (ii) Alternate I (JAN 2017) of 52.224-3.

[ ] (48) 52.225-1, Buy American-Supplies (MAY 2014) (41 U.S.C. chapter 83).

[ ] (49)(i) 52.225-3, Buy American-Free Trade Agreements-Israeli Trade Act (MAY 2014) (41 U.S.C. chapter 83, 19 U.S.C. 3301 note, 19 U.S.C. 2112 note, 19 U.S.C. 3805 note, 19 U.S.C. 4001 note, Pub. L. 103-182, 108-77, 108-78, Page 75

31310020C0027 108-286, 108-302, 109-53, 109-169, 109-283, 110-138, 112-41, 112-42, and 112-43.

[ ] (ii) Alternate I (MAY 2014) of 52.225-3.

[ ] (iii) Alternate II (MAY 2014) of 52.225-3.

[ ] (iv) Alternate III (MAY 2014) of 52.225-3.

[ ] (50) 52.225-5, Trade Agreements (OCT 2019) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

[ ] (51) 52.225-13, Restrictions on Certain Foreign Purchases (JUN 2008) (E.O.'s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

[ ] (52) 52.225-26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

[ ] (53) 52.226-4, Notice of Disaster or Emergency Area Set-Aside (NOV 2007)

(42 U.S.C. 5150).

[ ] (54) 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area (NOV 2007) (42 U.S.C. 5150).

[ ] (55) 52.229-12, Tax on Certain Foreign Procurements (JUN 2020).

[ ] (56) 52.232-29, Terms for Financing of Purchases of Commercial Items (FEB 2002) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

[X] (57) 52.232-30, Installment Payments for Commercial Items (JAN 2017) (41 U.S.C. 4505, 10 U.S.C. 2307(f)).

[X] (58) 52.232-33, Payment by Electronic Funds Transfer-System for Award Management (OCT 2018) (31 U.S.C. 3332).

[ ] (59) 52.232-34, Payment by Electronic Funds Transfer - Other than System for Award Management (JUL 2013) (31 U.S.C. 3332).

[X] (60) 52.232-36, Payment by Third Party (MAY 2014) (31 U.S.C. 3332).

[ ] (61) 52.239-1, Privacy or Security Safeguards (AUG 1996) (5 U.S.C. 552a).

[ ] (62) 52.242-5, Payments to Small Business Subcontractors (JAN 2017)(15 U.S.C. 637(d)(13)).

[ ] (63)(i) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631).

[ ] (ii) Alternate I (APR 2003) of 52.247-64.

Page 76

31310020C0027

[ ] (iii) Alternate II (FEB 2006) of 52.247-64.

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

[ ] (1) 52.222-41, Service Contract Labor Standards (AUG 2018) (41 U.S.C.

chapter 67).

[ ] (2) 52.222-42, Statement of Equivalent Rates for Federal Hires (MAY 2014)

(29 U.S.C. 206 and 41 U.S.C. chapter 67).

[ ] (3) 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (Multiple Year and Option Contracts) (AUG 2018)

(29 U.S.C. 206 and 41 U.S.C. chapter 67).

[ ] (4) 52.222-44, Fair Labor Standards Act and Service Contract Labor Standards-Price Adjustment (MAY 2014) (29 U.S.C 206 and 41 U.S.C. chapter 67).

[ ] (5) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (MAY 2014) (41 U.S.C. chapter 67).

[ ] (6) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014) (41 U.S.C. chapter 67).

[ ] (7) 52.222-55, Minimum Wages Under Executive Order 13658 (DEC 2015).

[ ] (8) 52.222-62, Paid Sick Leave Under Executive Order 13706 (JAN 2017)

(E.O. 13706).

[ ] (9) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) (42 U.S.C. 1792).

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records - Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period Page 77

31310020C0027 specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) of this paragraph in a subcontract for commercial items.

Unless otherwise indicated below, the extent of the flow down shall be as required by the clause-(i) 52.203-13, Contractor Code of Business Ethics and Conduct (JUN 2020) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (JUL 2018) (Section 1634 of Pub. L. 115-91).

(iv) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AUG 2020) (Section 889(a)(1)(A) of Pub. L. 115-232).

(v) 52.219-8, Utilization of Small Business Concerns (OCT 2018) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219-8 in lower tier subcontracts that offer subcontracting opportunities.

(vi) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

(vii) 52.222-26, Equal Opportunity (SEP 2016) (E.O. 11246).

(viii) 52.222-35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C.

4212).

Page 78

31310020C0027 (ix) 52.222-36, Equal Opportunity for Workers with Disabilities (JUN 2020)

(29 U.S.C. 793).

(x) 52.222-37, Employment Reports on Veterans (JUN 2020) (38 U.S.C.

4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (AUG 2018) (41 U.S.C.

chapter 67).

(xiii) [ ] (A) 52.222-50, Combating Trafficking in Persons (JAN 2019) (22 U.S.C. chapter 78 and E.O. 13627).

[ ] (B) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment-Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services-Requirements (MAY 2014)

(41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (OCT 2015) (E. O.

12989).

(xvii) 52.222-55, Minimum Wages Under Executive Order 13658 (DEC 2015).

(xviii) 52.222-62 Paid Sick Leave Under Executive Order 13706 (JAN 2017) (E.O. 13706).

(xix)(A) 52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xx) 52.225-26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xxi) 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (FEB 2006) (46 U.S.C. Appx. 1241(b) and 10 U.S.C. 2631). Flow Page 79

31310020C0027 down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor May include in its subcontracts for commercial items a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of clause)

I.17 52.217-8 OPTION TO EXTEND SERVICES. (NOV 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within the period of performance.

(End of clause)

I.18 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT. (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within anytme before the contract expires; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least anytmedays before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 5 years and 6 months. .

(End of clause)

I.19 52.219-3 NOTICE OF HUBZONE SET-ASIDE OR SOLE SOURCE AWARD. (MAR 2020)

(a) Definition. See 13 CFR 125.1 and 126.103 for definitions of terms used in the clause.

(b) Applicability. This clause applies only to-(1) Contracts that have been set aside, or awarded on a sole source basis to, HUBZone small business concerns; (2) Part or parts of a multiple-award contract that have been set aside for HUBZone small business concerns; (3) Orders set-aside for HUBZone small business concerns under multiple-award contracts as described in 8.405-5 and 16.505(b)(2)(i)(F); and Page 80

31310020C0027 (4) Orders issued directly to HUBZone small business concerns under multiple-award contracts as described in 19.504(c)(1)(ii).

(c) General. (1) Offers are solicited only from HUBZone small business concerns. Offers received from concerns that are not HUBZone small business concerns will not be considered.

(2) Any award resulting from this solicitation will be made to a HUBZone small business concern.

(d) Limitations on subcontracting. The Contractor shall spend-(1) For services (except construction), at least 50 percent of the cost of contract performance incurred for personnel on its own employees or employees of other HUBZone small business concerns; (2) For supplies (other than acquisition from a nonmanufacturer of the supplies),

at least 50 percent of the cost of manufacturing, excluding the cost of materials, on the concern or other HUBZone small business concerns; (3) For general construction-(i) At least 15 percent of the cost of contract performance incurred for personnel on its own employees; (ii) At least 50 percent of the cost of the contract performance incurred for personnel on its own employees or on a combination of its own employees and employees of HUBZone small business concern subcontractors; and (iii) No more than 50 percent of the cost of contract performance incurred for personnel on concerns that are not HUBZone small business concerns; or (4) For construction by special trade contractors-(i) At least 25 percent of the cost of contract performance incurred for personnel on its own employees; (ii) At least 50 percent of the cost of the contract performance incurred for personnel on its own employees or on a combination of its own employees and employees of HUBZone small business concern subcontractors; (iii) No more than 50 percent of the cost of contract performance to be incurred for personnel on concerns that are not HUBZone small business concerns.

(e) A HUBZone small business contractor shall comply with the limitations on subcontracting as follows:

Page 81

31310020C0027 (1) For contracts, in accordance with paragraph (b)(1) or (2) of this clause-(Contracting Officer check as appropriate.)

[ ] By the end of the base term of the contract and then by the end of each subsequent option period; or

[ ] By the end of the performance period for each order issued under the contract.

(2) For orders, in accordance with paragraph (b)(3) or (4) of this clause, by the end of the performance period for the order.

(f) A HUBZone joint venture agrees that, in the performance of the contract, the applicable percentage specified in paragraph (d) of this clause shall be performed by the aggregate of the HUBZone small business participants.

(g) Notice. The HUBZone small business offeror acknowledges that a prospective HUBZone awardee must be a HUBZone small business concern at the time of award of this contract. The HUBZone offeror shall provide the Contracting Officer a copy of the notice required by 13 CFR 126.501 if material changes occur before contract award that could affect its HUBZone eligibility. If the apparently successful HUBZone offeror is not a HUBZone small business concern at the time of award of this contract, the Contracting Officer will proceed to award to the next otherwise successful HUBZone small business concern or other offeror.

(End of clause)

I.20 52.223-6 DRUG-FREE WORKPLACE. (MAY 2001)

(a) Definitions. As used in this clause-Controlled substance means a controlled substance in schedules I through V of section 202 of the Controlled Substances Act (21 U.S.C. 812) and as further defined in regulation at 21 CFR 1308.11-1308.15.

Conviction means a finding of guilt (including a plea of nolo contendere) or imposition of sentence, or both, by any judicial body charged with the responsibility to determine violations of the Federal or State criminal drug statutes.

Criminal drug statute means a Federal or non-Federal criminal statute involving the manufacture, distribution, dispensing, possession or use of any controlled substance.

Drug-free workplace means the site(s) for the performance of work done by the Contractor in connection with a specific contract where employees of the Contractor are prohibited from engaging in the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance.

Employee means an employee of a Contractor directly engaged in the performance of work under a Government contract. Directly engaged is defined to include all direct cost employees and any other Contractor employee who has other than a minimal impact or involvement in contract performance.

Page 82

31310020C0027 Individual means an offeror/contractor that has no more than one employee including the offeror/contractor.

(b) The Contractor, if other than an individual, shall-within 30 days after award (unless a longer period is agreed to in writing for contracts of 30 days or more performance duration); or as soon as possible for contracts of less than 30 days performance duration-(1) Publish a statement notifying its employees that the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance is prohibited in the contractor's workplace and specifying the actions that will be taken against employees for violations of such prohibition; (2) Establish an ongoing drug-free awareness program to inform such employees about-(i) The dangers of drug abuse in the workplace; (ii) The contractor's policy of maintaining a drug-free workplace; (iii) Any available drug counseling, rehabilitation, and employee assistance programs; and (iv) The penalties that may be imposed upon employees for drug abuse violations occurring in the workplace.

(3) Provide all employees engaged in performance of the contract with a copy of the statement required by subparagraph (b)(1) of this clause; (4) Notify such employees in writing in the statement required by subparagraph (b)(1) of this clause that, as a condition of continued employment on this contract, the employee will-(i) Abide by the terms of the statement; and (ii) Notify the employer in writing of the employee's conviction under a criminal drug statute for a violation occurring in the workplace no later than 5 days after such conviction.

(5) Notify the Contracting Officer in writing within 10 days after receiving notice under subdivision (b)(4)(ii) of this clause, from an employee or otherwise receiving actual notice of such conviction. The notice shall include the position title of the employee; (6) Within 30 days after receiving notice under subdivision (b)(4)(ii) of this clause of a conviction, take one of the following actions with respect to any employee who is convicted of a drug abuse violation occurring in the workplace:

(i) Taking appropriate personnel action against such employee, up to and including termination; or Page 83

31310020C0027 (ii) Require such employee to satisfactorily participate in a drug abuse assistance or rehabilitation program approved for such purposes by a Federal, State, or local health, law enforcement, or other appropriate agency; and (7) Make a good faith effort to maintain a drug-free workplace through implementation of subparagraphs (b)(1) through (b)(6) of this clause.

(c) The Contractor, if an individual, agrees by award of the contract or acceptance of a purchase order, not to engage in the unlawful manufacture, distribution, dispensing, possession, or use of a controlled substance while performing this contract.

(d) In addition to other remedies available to the Government, the Contractor's failure to comply with the requirements of paragraph (b) or (c) of this clause may, pursuant to FAR 23.506, render the Contractor subject to suspension of contract payments, termination of the contract for default, and suspension or debarment.

(End of clause)

I.21 52.232-39 UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS. (JUN 2013)

(a) Except as stated in paragraph (b) of this clause, when any supply or service acquired under this contract is subject to any End User License Agreement (EULA), Terms of Service (TOS), or similar legal instrument or agreement, that includes any clause requiring the Government to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation (31 U.S.C. 1341), the following shall govern:

(1) Any such clause is unenforceable against the Government.

(2) Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the EULA, TOS, or similar legal instrument or agreement. If the EULA, TOS, or similar legal instrument or agreement is invoked through an "I agree" click box or other comparable mechanism (e.g., "click-wrap" or "browse-wrap" agreements),

execution does not bind the Government or any Government authorized end user to such clause.

(3) Any such clause is deemed to be stricken from the EULA, TOS, or similar legal instrument or agreement.

(b) Paragraph (a) of this clause does not apply to indemnification by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures.

(End of clause)

I.22 52.237-3 CONTINUITY OF SERVICES. (JAN 1991)

(a) The Contractor recognizes that the services under this contract are vital to the Government and must be continued without interruption and that, upon contract Page 84

31310020C0027 expiration, a successor, either the Government or another contractor, may continue them. The Contractor agrees to (1) furnish phase-in training and (2) exercise its best efforts and cooperation to effect an orderly and efficient transition to a successor.

(b) The Contractor shall, upon the Contracting Officer's written notice, (1) furnish phase-in, phase-out services for up to 90 days after this contract expires and (2) negotiate in good faith a plan with a successor to determine the nature and extent of phase-in, phase-out services required. The plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, and shall be subject to the Contracting Officer's approval. The Contractor shall provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

(c) The Contractor shall allow as many personnel as practicable to remain on the job to help the successor maintain the continuity and consistency of the services required by this contract. The Contractor also shall disclose necessary personnel records and allow the successor to conduct on-site interviews with these employees. If selected employees are agreeable to the change, the Contractor shall release them at a mutually agreeable date and negotiate transfer of their earned fringe benefits to the successor.

(d) The Contractor shall be reimbursed for all reasonable phase-in, phase-out costs (i.e.,

costs incurred within the agreed period after contract expiration that result from phase-in, phase-out operations) and a fee (profit) not to exceed a pro rata portion of the fee (profit) under this contract.

(End of clause)

Other Clauses Incorporated by Reference Other Clauses Incorporated By Full Text Page 85

31310020C0027 J - List of Documents, Exhibits and Other Attachments Number Attachment Title Date of Number Pages 1 Attachment 1 - Intranet Repl Requirements - CI 09/21/2020 1 Attachment 2- Instructions_ IPP Billing Instructions 2 09/21/2020 2 for Fixed Price Contracts Page 86

ML21123A050

Text

SUMMARY

Navigation menu

Search