* .'". PAGE OF PAGES.A. ,.ORDER FOR SUPPLIES OR SERVICES 36

IMP(RTANT:' Mark 'all packages and6papers with contract and/or order numbers.i

1. DATE OF ORDER 2. CONTRACT NO (If any) 6. SHIP TO:GS35F0229 K

02/27/2014 a. NAME OF CONSIGNEE

3. ORDER NO. 4. REQUISITION/REFERENCE NO

NRC-HQ-7S-14-T-0001 See Schedule US NUCLEAR REGULATORY COMMISSION-

5. ISSUING OFFICE (Address correspondence to) b. STREET ADDRESS

US NRC - HQ MAIL PROCESSING CENTERDIVISION OF CONTRACTS 4930 BOILING BROOK PARKWAY

MAIL STOP 3WFN-05-C64MPWASHINGTON DC 20555-0001

c. CITY d. STATE e. ZIP CODEROCKVILLE MD 20852

7 TO. DANIEL HACKENBERG f SHIP VIA

a. NAME OF CONTRACTORMAP, INCORPORATED 8. TYPE OF ORDER

b. COMPANY NAME Wa. PURCHASE El b DELIVERY

c. STREET ADDRESS REFERENCE YOUR:1803 RESEARCH BOULEVARD Except for billing instructions on the

SUITE 204 reverse, this delivery order is

subject to instructions contained on

this side only of this form and isPlease furnish the following on the terms issued sublect to the terms andand conditions specified on both sides of conditions of the above-numbered

d. CITY e. STATE f. ZIP CODE this order and on the attached sheet, if contract.ROCKVI LLE MD 2208506106 any. indudina delivery as indicated.

9. ACCOUNTING AND APPROPRIATION DATA 10 REQUISITIONING OFFICE

See Schedule COMPUTER SECURITY OFFICE11. BUSINESS CLASSIFICATION (Check appropriate box(es)) 12. F.O.B. POINT

a. SMALL F] b. OTHER THAN SMALL [] c. DISADVANTAGED Dd. WOMEN-OWNED W e. HUBZone

Df. -] g. WOMEN-OWNED SMALL BUSINESS (WOSB) ] h. EDWOSBSERVICE-DISABLED ELIGIBLE UNDER THE WOSB PROGRAM

13. PLACE OF 14. GOVERNMENT B/L NO. 15. DELIVER TO F.O.B. POINT 16 DISCOUNT TERMS

ON OR BEFORE (Date)a. INSPECTION b. ACCEPTANCE 03/07/2014Destination Destination

17. SCHEDULE (See reverse for Rejections)

QUANTITY UNIT QUANTITYITEM NO SUPPLIES OR SERVICES ORDERED UNIT PRICE AMOUNT ACCEPTED

(a) (b) (c) (d) (e) if) (g)

Accounting Info:2014-X0200--FEEBASED-7S-7SD001-51-J-145-N7343-252APeriod of Performance: 03/07/2014 to03/06/2015

Continued ...

18. SHIPPING POINT 19. GROSS SHIPPING WEIGHT 20. INVOICE NO. 17(h)TOTAL

(Cont.

pages)21. MAIL INVOICE TO

a. NAME $1,940,795.80 4US NUCLEAR REGULATORY COMMISSION

SEE BILLINGINSTRUCTIONS b. STREETADDRESS ONE WHITE FLINT NORTHON REVERSE (orP.O. Box) 11555 ROCKVILLE PIKE 17(i)

MAILSTOP 03-E17A GRANDTOTAL

c. CITY d. STATE - e. ZIP CODE $1,940,795.80 4ROCKVILLE MD 20852-2738

22. UNITED STATES OF 0-27 / 27 014 23. NAME (Typed)

AMERICA BY (Signature) -- HERIBERTO COLON

TITLE: CONTRACTING/ORDERING OFFICER

AUTHORIZED FOR LOCAL REPRODUCTIONPREVIOUS E•ITION NOT USABLE

TEMPLP[ATE- AnMO 1

OPTIONAL FORM 347 (R.. r2o212)pmnbd by GSA/FAR 48 CFR 53 213(f)

SUNSI REVIEW COMPLETLAUG 15 1110 07

ORDER FOR SUPPLIES OR SERVICES PAGE NO

SCHEDULE - CONTINUATION

IMPORTANT: Mark all packages and papers with contract and/or order numbers.

DATE OF ORDER ICONTRACT NO. ORDER NO.

02/27/2014 IGS35F0229K NRC-HQ-7S-14-T-0001

ITEM NO. SUPPLIES/SERVICES QUANTITYI UNIT UNIT AMOUNT QUANTITY

ORDERED PRICE ACCEPTED(a) (b) (c) I(d) (e) M (g)

00001 Incremental Funding for the CISSS Contract(DR-33-06-317 T071)

$31K for CSO/CSA APT$50K for CSO/CSA IR

kward Type: Labor-hour

Line Item Ceiling$1,940,795.80Incrementally Funded Amount: $291,000.00

Requisition No: CSO-14-0007,

3SO-14-0014

The obligated amount of award: $291,000.00.The total for this award is shown in box

17(i).

1,940,795.80

TOTAL CARRIED FORWARD TO 1 ST PAGE (ITEM 17(H)) [i $1,940,795.80AUTHORIZED FOR LOCAL REPODUCTION OPTIONAL FORM 348 (Re. 4/2006)PREVIOUS EDITION NOT USABLE

P-,,b.ý 1,y GSA FAR (ý CFR) 53 .13(n

Contents

SECTION B - SUPPLIES OR SERVICES/PRICES .......................................... 6B.1 CONSIDERATION AND OBLIGATION -TASK ORDERS ......................... 6SECTION D - PACKAGING AND MARKING .................................................. 7D .1 B R A N D IN G ................................................................................................ 7SECTION E - INSPECTION AND ACCEPTANCE ........................................... 8E.1 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013) ................ 8SECTION F - DELIVERIES OR PERFORMANCE ........................................... 9F.1 TASK/DELIVERY ORDER PERIOD OF PERFORMANCE (SEP 2013) ........ 9F.2 PLACE OF DELIVERY-REPORTS ............................................................. 9SECTION G - CONTRACT ADMINISTRATION DATA ................................... 10G.1 ELECTRONIC PAYMENT (SEP 2013) ..................................................... 10SECTION H - SPECIAL CONTRACT REQUIREMENTS ................................ 11H.1 2052.204-70 SECURITY (OCT 1999) ....................................................... 11H.2 2052.204-71 SITE ACCESS BADGE REQUIREMENTS (JAN 1993) ......... 13H.3 2052.215-71 CONTRACTING OFFICER'S REPRESENTATIVEA UTHO R ITY (O CT 1999) ................................................................................ 13H.4 2052.222-70 NONDISCRIMINATION BECAUSE OF AGE (JAN 1993) ..... 15H.5 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS ......... 15H.6 USE OF AUTOMATED CLEARING HOUSE (ACH) ELECTRONICPAYMENT/REMITTANCE ADDRESS ........................................................... 16H.7 GREEN PURCHASING (SEP 2013) ......................................................... 16H.8 CONTRACTOR RESPONSIBILITY FOR PROTECTING PERSONALLYIDENTIFIABLE INFORMATION (PII) ............................................................. 16H.9 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TONUCLEAR FACILITIES, ACCESS TO CLASSIFIED INFORMATION ORSAFEGUARDS INFORMATION, OR PERFORMING IN SPECIALLYS ENSITIV E PO S ITIO NS ................................................................................. 18H.10 AUTHORITY TO USE GOVERNMENT PROVIDED SPACE AT NRCHEADQ UARTERS (SEP 2013) ....................................................................... 18H.11 WHISTLEBLOWER PROTECTION FOR NRC CONTRACTOR ANDSUBCONTRACTOR EMPLOYEES .............................................................. 19H.12 SECURITY REQUIREMENTS RELATING TO THE PRODUCTION OFREPORT(S) OR THE PUBLICATION OF RESULTS UNDER CONTRACTS,AGREEMENTS, AND GRANTS .................................................................... 19H.13 NRC INFORMATION TECHNOLOGY SECURITY ................................. 20H.14 SAFETY OF ON-SITE CONTRACTOR PERSONNEL .......................... 21H.15 COMPLIANCE WITH U.S. IMMIGRATION LAWS AND REGULATIONS 22H.16 RULES OF BEHAVIOR FOR AUTHORIZED COMPUTER USE .............. 22H.17 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS

Page 4 of 36

....................................................................................................................... ,., 2 3H.18 IT SECURITY REQUIREMENTS - NRC AND CONTRACTOR (NON-NRC)F A C IL IT IE S ................................................................................................... . 2 3H.19 IT SECURITY REQUIREMENTS - CERTIFICATION ANDA C C R E D ITA TIO N ......................................................................................... 24H.20 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS -G E N E R A L .................................................................................................... . . 2 6H.21 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGYLEVEL I OR LEVEL II ACCESS APPROVAL (SEP 2013) ............................ 29H.22 NRC INFORMATION TECHNOLOGY SECURITY TRAINING ................. 33SECTION I - CONTRACT CLAUSES ............................................................ 341.2 52.227-17 RIGHTS IN DATA--SPECIAL WORKS. (DEC 2007) ................ 34SECTION J - LIST OF ATTACHMENTS ......................................................... 36

1 STATEM ENT O F W O RK ................................................................................................ 36

2 P R IC E SC H ED U LE .............................................................................................................. 3 6

3 BILLING INSTRUCTIONS FIXED PRICE ......................................................................... 36

4 BILLING INSTRUCTIONS LABOR HOUR .......................................................................... 36

Page 5 of 36

SECTION B - SUPPLIES OR SERVICES/PRICES

B.1 CONSIDERATION AND OBLIGATION -TASK ORDERS

(a) The ceiling of this order for the services is $1,940,795.80.

(b) This order is subject to the minimum and maximum ordering requirements set forth inthe contract GS35F0229K.

(c) The amount presently obligated with respect to this order is $291,000.00. Theobligated amount shall, at no time, exceed the order ceiling as specified in paragraph(a) above. When and if the amount(s) paid and payable to the Contractor hereundershall equal the obligated amount, the Contractor shall not be obligated to continueperformance of the work unless and until the Contracting Officer shall increase theamount obligated with respect to this order, in accordance with FAR Part 43 -Contract Modifications. Any work undertaken by the Contractor in excess of theobligated amount specified above is done so at the Contractor's sole risk and maynot be reimbursed by the Government.

(d) The Contractor shall comply with the provisions of FAR 52.232-22 - Limitation ofFunds, for incrementally-funded delivery orders or task orders.

Page 6 of 36

r

SECTION D - PACKAGING AND MARKING

D.1 BRANDING

The Contractor is required to use the statement below in any publications, presentations,articles, products, or materials funded under this contract/order, to the extent practical, inorder to provide NRC with recognition for its involvement in and contribution to theproject. If the work performed is funded entirely with NRC funds, then the contractormust acknowledge that information in its documentation/presentation.

Work Supported by the U.S. Nuclear Regulatory Commission (NRC), Office of ComputerSecurity, under Contract/order number (see page 1 of this order).

Page 7 of 36

SECTION E - INSPECTION AND ACCEPTANCE

E.1 INSPECTION AND ACCEPTANCE BY THE NRC (SEP 2013)

Inspection and acceptance of the deliverable items to be furnished hereunder shall bemade by the NRC Contracting Officer's Representative (COR) at the destination,accordance with FAR 52.247-34 - F.o.b. Destination.

Contract Deliverables:

1. See Attachment 1 - Statement of Work

Page 8 of 36

SECTION F - DELIVERIES OR PERFORMANCE

F.1 TASK/DELIVERY ORDER PERIOD OF PERFORMANCE (SEP 2013)

This order shall commence on March 7, 2014 and will expire on March 6, 2015.

F.2 PLACE OF DELIVERY-REPORTS

The items to be furnished hereunder shall be delivered, with all charges paid by theContractor, to:

a. Primary and Alternate Contracting Officer's Representatives (COR) (hardcopy oremail as directed)

See names and addresses in Section H.3

b. Contracting Officer (CO) (1 copy - via email)

Joseph L. Widdup

Email to: Joseph. Widdup(anrc.qov

Page 9 of 36

T

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 ELECTRONIC PAYMENT (SEP 2013)

The Debt Collection Improvement Act of 1996 requires that all payments except IRS taxrefunds be made by Electronic Funds Transfer. Payment shall be made in accordancewith FAR 52.232-33, entitled "Payment by Electronic Funds Transfer-System AwardManagement".

To receive payment, the contractor shall prepare invoices in accordance with NRC'sBilling Instructions. Claims shall be submitted on the payee's letterhead, invoice, or onthe Government's Standard Form 1034, "Public Voucher for Purchases and ServicesOther than Personal," and Standard Form 1035, "Public Voucher for Purchases Otherthan Personal - Continuation Sheet." The preferred method of submitting invoices iselectronically to: OCFO ObligationsResource@nrc.gov.

Page 10 of 36

r"

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 2052.204-70 SECURITY (OCT 1999)

(a) Security/Classification Requirements Form. The attached NRC Form 187 (See List ofAttachments) furnishes the basis for providing security and classification requirements toprime contractors, subcontractors, or others (e.g., bidders) who have or may have anNRC contractual relationship that requires access to classified information or matter,access on a continuing basis (in excess of 90 or more days) to NRC Headquarterscontrolled buildings, or otherwise requires NRC photo identification or card-key badges.

(b) It is the contractor's duty to safeguard National Security Information, Restricted Data,and Formerly Restricted Data. The contractor shall, in accordance with theCommission's security regulations and requirements, be responsible for safeguardingNational Security Information, Restricted Data, and Formerly Restricted Data, and forprotecting against sabotage, espionage, loss, and theft, the classified documents andmaterial in the contractor's possession in connection with the performance of work underthis contract. Except as otherwise expressly provided in this contract, the contractor shalltransmit to the Commission any classified matter in the possession of the contractor orany person under the contractor's control in connection with performance of this contractupon completion or termination of this contract.

(1) The contractor shall complete a certificate of possession to be furnished to the

Commission specifying the classified matter to be retained if the retention is:

(i) Required after the completion or termination of the contract; and

(ii) Approved by the contracting officer.

(2) The certification must identify the items and types or categories of matter retained,the conditions governing the retention of the matter and their period of retention, ifknown. If the retention is approved by the contracting officer, the security provisions ofthe contract continue to be applicable to the matter retained.

(c) In connection with the performance of the work under this contract, the contractormay be furnished, or may develop or acquire, proprietary data (trade secrets) orconfidential or privileged technical, business, or financial information, includingCommission plans, policies, reports, financial plans, internal data protected by thePrivacy Act of 1974 (Pub. L. 93-579), or other information which has not been releasedto the public or has been determined by the Commission to be otherwise exempt fromdisclosure to the public. The contractor agrees to hold the information in confidence andnot to directly or indirectly duplicate, disseminate, or disclose the information, in whole orin part, to any other person or organization except as necessary to perform the workunder this contract. The contractor agrees to return the information to the Commission orotherwise dispose of it at the direction of the contracting officer. Failure to comply withthis clause is grounds for termination of this contract.

(d) Regulations. The contractor agrees to conform to all security regulations andrequirements of the Commission which are subject to change as directed by the NRCDivision of Facilities and Security and the Contracting Officer. These changes will be

Page 11 of 36

under the authority of the FAR Changes clause referenced in Section I of this document.

(e) Definition of National Security Information. As used in this clause, the term NationalSecurity Information means information that has been determined pursuant to ExecutiveOrder 12958 or any predecessor order to require protection against unauthorizeddisclosure and that is so designated.

(f) Definition of Restricted Data. As used in this clause, the term Restricted Data meansall data concerning design, manufacture, or utilization of atomic weapons; the productionof special nuclear material; or the use of special nuclear material in the production ofenergy, but does not include data declassified or removed from the Restricted Datacategory under to Section 142 of the Atomic Energy Act of 1954, as amended.

(g) Definition of Formerly Restricted Data. As used in this clause the term FormerlyRestricted Data means all data removed from the Restricted Data category underSection 142-d of the Atomic Energy Act of 1954, as amended.

(h) Security clearance personnel. The contractor may not permit any individual to haveaccess to Restricted Data, Formerly Restricted Data, or other classified information,except in accordance with the Atomic Energy Act of 1954, as amended, and theCommission's regulations or requirements applicable to the particular type or category ofclassified information to which access is required. The contractor shall also execute aStandard Form 312, Classified Information Nondisclosure Agreement, when access toclassified information is required.

(i) Criminal liabilities. Disclosure of National Security Information, Restricted Data, andFormerly Restricted Data relating to the work or services ordered hereunder to anyperson not entitled to receive it, or failure to safeguard any Restricted Data, FormerlyRestricted Data, or any other classified matter that may come to the contractor or anyperson under the contractor's control in connection with work under this contract, maysubject the contractor, its agents, employees, or subcontractors to criminal liability underthe laws of the United States. (See the Atomic Energy Act of 1954, as amended, 42U.S.C. 2011 et seq.; 18 U.S.C. 793 and 794; and Executive Order 12958.)

(j) Subcontracts and purchase orders. Except as otherwise authorized, in writing, by thecontracting officer, the contractor shall insert provisions similar to the foregoing in allsubcontracts and purchase orders under this contract.

(k) In performing contract work, the contractor shall classify all documents, material, andequipment originated or generated by the contractor in accordance with guidance issuedby the Commission. Every subcontract and purchase order issued under the contractthat involves originating or generating classified documents, material, and equipmentmust provide that the subcontractor or supplier assign the proper classification to alldocuments, material, and equipment in accordance with guidance furnished by thecontractor.

Page 12 of 36

H.2 2052.204-71 SITE ACCESS BADGE REQUIREMENTS (JAN 1993)

During the life of this contract, the rights of ingress and egress for contractor personnelmust be made available as required. In this regard, all contractor personnel whoseduties under this contract require their presence on-site shall be clearly identifiable by adistinctive badge furnished by the Government. The COR shall assist the contractor inobtaining the badges for contractor personnel. It is the sole responsibility of thecontractor to ensure that each employee has proper identification at all times. Allprescribed identification must be immediately delivered to the Security Office forcancellation or disposition upon the termination of employment of any contractorpersonnel. Contractor personnel shall have this identification in their possession duringon-site performance under this contract. It is the contractor's duty to assure thatcontractor personnel enter only those work areas necessary for performance of contractwork and to assure the safeguarding of any Government records or data that contractorpersonnel may come into contact with.

H.3 2052.215-71 CONTRACTING OFFICER'S REPRESENTATIVE AUTHORITY (OCT1999)

(a) The contracting officer's authorized representatives hereinafter referred to as the

Contracting Officer's Representatives (COR) for this contract are:

Primary Contracting Officer's Representative:

Name: William DabbsAddress: Two White Flint North, Mail Stop: TWFN/ 2 D9

11545 Rockville PikeRockville, MD 20852-2738

Telephone Number: 301-415-0524Email: william.dabbs@nrc.gov

Alternate Contracting Officer's Representatives:

Name: Kathy Lyons-BurkeAddress: Two White Flint North, Mail Stop: TWFN/ 2 D1 3

11545 Rockville PikeRockville, MD 20852-2738

Telephone Number: 301-415-6595Email: kathy.lyons-burke@nrc.gov

(b) Performance of the work under this contract is subject to the technical direction of theNRC COR. The term technical direction is defined to include the following:

(1) Technical direction to the contractor which shifts work emphasis between areas ofwork or tasks, authorizes travel which was unanticipated in the Schedule (i.e., travel notcontemplated in the Statement of Work or changes to specific travel identified in theStatement of Work), fills in details, or otherwise serves to accomplish the contractualstatement of work.

Page 13 of 36

(2) Provide advice and guidance to the contractor in the preparation of drawings,specifications, or technical portions of the work description.

(3) Review and, where required by the contract, approve technical reports, drawings,specifications, and technical information to be delivered by the contractor to theGovernment under the contract.

(c) Technical direction must be within the general statement of work stated in thecontract. The COR does not have the authority to and may not issue any technicaldirection which:

(1) Constitutes an assignment of work outside the general scope of the contract.

(2) Constitutes a change as defined in the "Changes" clause of this contract.

(3) In any way causes an increase or decrease in the total estimated contract cost, thefixed fee, if any, or the time required for contract performance.

(4) Changes any of the expressed terms, conditions, or specifications of the contract.

(5) Terminates the contract, settles any claim or dispute arising under the contract, orissues any unilateral directive whatever.

(d) All technical directions must be issued in writing by the COR or must be confirmed bythe COR in writing within ten (10) working days after verbal issuance. A copy of thewritten direction must be furnished to the contracting officer. A copy of NRC Form 445,Request for Approval of Official Foreign Travel, which has received final approval fromthe NRC must be furnished to the contracting officer.

(e) The contractor shall proceed promptly with the performance of technical directionsduly issued by the COR in the manner prescribed by this clause and within the COR'sauthority under the provisions of this clause.

(f) If, in the opinion of the contractor, any instruction or direction issued by the COR iswithin one of the categories defined in paragraph (c) of this section, the contractor maynot proceed but shall notify the contracting officer in writing within five (5) working daysafter the receipt of any instruction or direction and shall request that contracting officer tomodify the contract accordingly. Upon receiving the notification from the contractor, thecontracting officer shall issue an appropriate contract modification or advise thecontractor in writing that, in the contracting officer's opinion, the technical direction iswithin the scope of this article and does not constitute a change under the "Changes"clause.

(g) Any unauthorized commitment or direction issued by the COR may result in anunnecessary delay in the contractor's performance and may even result in the contractorexpending funds for unallowable costs under the contract.

(h) A failure of the parties to agree upon the nature of the instruction or direction or uponthe contract action to be taken with respect to the instruction or direction is subject to52.233-1 - Disputes.

Page 14 of 36

(i) In addition to providing technical direction as defined in paragraph (b) of the section,the COR shall:

(1) Monitor the contractor's technical progress, including surveillance and assessment ofperformance, and recommend to the contracting officer changes in requirements.

(2) Assist the contractor in the resolution of technical problems encountered duringperformance.

(3) Review all costs requested for reimbursement by the contractor and submit to thecontracting officer recommendations for approval, disapproval, or suspension ofpayment for supplies and services required under this contract.

H.4 2052.222-70 NONDISCRIMINATION BECAUSE OF AGE (JAN 1993)

It is the policy of the Executive Branch of the Government that:

(a) Contractors and subcontractors engaged in the performance of Federal contractsmay not, in connection with the employment, advancement, or discharge of employeesor in connection with the terms, conditions, or privileges of their employment,discriminate against persons because of their age except upon the basis of a bona fideoccupational qualification, retirement plan, or statutory requirement; and

(b) That contractors and subcontractors, or persons acting on their behalf, may notspecify, in solicitations or advertisements for employees to work on Governmentcontracts, a maximum age limit for employment unless the specified maximum age limitis based upon a bona fide occupational qualification, retirement plan, or statutoryrequirement.

H.5 AWARD NOTIFICATION AND COMMITMENT OF PUBLIC FUNDS

(a) All offerors will receive preaward and postaward notices in accordance with FAR15.503.

(b) It is also brought to your attention that the contracting officer is the only individualwho can legally obligate funds or commit the NRC to the expenditure of public funds inconnection with this procurement. This means that unless provided in a contractdocument or specifically authorized by the contracting officer, NRC technical personnelmay not issue contract modifications, give formal contractual commitments, or otherwisebind, commit, or obligate the NRC contractually. Informal unauthorized commitments,which do not obligate the NRC and do not entitle the contractor to payment, may include:

(1) Encouraging a potential contractor to incur costs prior to receiving a contract;

(2) Requesting or requiring a contractor to make changes under a contract withoutformal contract modifications;

(3) Encouraging a contractor to incur costs under a cost-reimbursable contract in excessof those costs contractually allowable; and

(4) Committing the Government to a course of action with regard to a potential contract,

Page 15 of 36

(2) Use, Ownership, and Nondisclosure. A contractor may use NRC owned orcontrolled PII solely for purposes of this contract, and may not collect or use such PII forany purpose outside the contract without the prior written approval of the NRCContracting Officer. The contractor must restrict access to such information to onlythose contractor employees who need the information to perform work under thiscontract, and must ensure that each such contractor employee (including subcontractors'employees) signs a nondisclosure agreement, in a form suitable to the NRC ContractingOfficer, prior to being granted access to the information. The NRC retains soleownership and rights to its PII. Unless the contract states otherwise, upon completion ofthe contract, the contractor must turn over all PII in its possession to the NRC, and mustcertify in writing that it has not retained any NRC owned or controlled PHI except asotherwise authorized in writing by the NRC Contracting Officer.

(3) Security Plan. When applicable, and unless waived in writing by the NRCContracting Officer, the contractor must work with the NRC to develop and implement asecurity plan setting forth adequate procedures for the protection of NRC owned orcontrolled PII as well as the procedures which the contractor must follow for notifying theNRC in the event of any security breach. The plan will be incorporated into the contractand must be implemented and followed by the contractor once it has been approved bythe NRC Contracting Officer. If the contract does not include a security plan at the timeof contract award, a plan must be submitted for the approval of the NRC ContractingOfficer within 30 days after contract award.

(4) Breach Notification. The contractor must immediately notify the NRC ContractingOfficer and the NRC Contracting Officer's Representative (COR) upon discovery of anysuspected or confirmed breach in the security of NRC owned or controlled PII.

(5) Legal Demands for Information. If a legal demand is made for NRC owned orcontrolled PII (such as by subpoena), the contractor must immediately notify the NRCContracting Officer and the NRC Contracting Officer's Representative (COR). Afternotification, the NRC will determine whether and to what extent to comply with the legaldemand. The Contracting Officer will then notify the contractor in writing of thedetermination and such notice will indicate the extent of disclosure authorized, if any.The contractor may only release the information specifically demanded with the writtenpermission of the NRC Contracting Officer.

(6) Audits. The NRC may audit the contractor's compliance with the requirements ofthis clause, including through the use of online compliance software.

(7) Flow-down. The prime contractor will flow this clause down to subcontractors thatwould be covered by any portion of this clause, as if they were the prime contractor.

(8) Remedies:

(a) The contractor is responsible for implementing and maintaining adequate securitycontrols to prevent the loss of control or unauthorized disclosure of NRC owned orcontrolled PII in its possession. Furthermore, the contractor is responsible for reportingany known or suspected loss of control or unauthorized access to PII to the NRC in

Page 17 of 36

accordance with the provisions set forth in Article 4 above.

(b) Should the contractor fail to meet its responsibilities under this clause, the NRCreserves the right to take appropriate steps to mitigate the contractor's violation of thisclause. This may include, at the sole discretion of the NRC, termination of the subjectcontract.

(9) Indemnification. Notwithstanding any other remedies available to the NRC, thecontractor will indemnify the NRC against all liability (including costs and fees) for anydamages arising out of violations of this clause.

H.9 DRUG FREE WORKPLACE TESTING: UNESCORTED ACCESS TO NUCLEARFACILITIES, ACCESS TO CLASSIFIED INFORMATION OR SAFEGUARDSINFORMATION, OR PERFORMING IN SPECIALLY SENSITIVE POSITIONS

All contractor employees, subcontractor employees, and consultants proposed forperformance or performing under this contract shall be subject to pre-assignment,random, reasonable suspicion, and post-accident drug testing applicable to: (1)individuals who require unescorted access to nuclear power plants, (2) individuals whohave access to classified or safeguards information, (3) individuals who are required tocarry firearms in performing security services for the NRC, (4) individuals who arerequired to operate government vehicles or transport passengers for the NRC, (5)individuals who are required to operate hazardous equipment at NRC facilities, or (6)individuals who admit to recent illegal drug use or those who are found through othermeans to be using drugs illegally. The Plan includes a contractor's employees and theirsubcontractors are subject to the procedures and terms of their employment agreementswith their employer.

The NRC Drug Program Manager will schedule the drug testing for all contractoremployees, subcontractor employees, and consultants who are subject to testing underthis clause. Any NRC contractor found to be using, selling, or possessing illegal drugs,or any contractor with a verified positive drug test result under this program while in aduty status will immediately be removed from working under the NRC contract. Thecontractor's employer will be notified of the denial or revocation of the individual'sauthorization to have access to information and ability to perform under the contract. Theindividual may not work on any NRC contract for a period of not less than one year fromthe date of the failed drug test and will not be considered for reinstatement unlessevidence of rehabilitation, as determined by the NRC "drug testing contractor's" MedicalReview Officer, is provided.

Contractor drug testing records are protected under the NRC Privacy Act Systems ofRecords, System 35, "Drug Testing Program Records - NRC" found at:http://www.nrc.gov/reading-rm/foia/privacy-systems.html

H.10 AUTHORITY TO USE GOVERNMENT PROVIDED SPACE AT NRCHEADQUARTERS (SEP 2013)

Prior to occupying any Government provided space at NRC Headquarters in RockvilleMaryland, the Contractor shall obtain written authorization to occupy specifically

Page 18 of 36

designated government space, via the NRC Contracting Officer's Representative (COR),from the Chief, Space Design Branch, Office of Administration. Failure to obtain thisprior authorization can result in one, or a combination, of the following remedies asdeemed appropriate by the Contracting Officer.

(1) Rental charge for the space occupied will be deducted from the invoice amount duethe Contractor

(2) Removal from the space occupied

(3) Contract Termination

H.11 WHISTLEBLOWER PROTECTION FOR NRC CONTRACTOR ANDSUBCONTRACTOR EMPLOYEES

(a) The U.S. Nuclear Regulatory Commission (NRC) contractor and its subcontractor aresubject to the Whistleblower Employee Protection public law provisions as codified at 42U.S.C. 5851. NRC contractor(s) and subcontractor(s) shall comply with therequirements of this Whistleblower Employee Protection law, and the implementingregulations of the NRC and the Department of Labor (DOL). See, for example, DOLProcedures on Handling Complaints at 29 C.F.R. Part 24 concerning the employerobligations, prohibited acts, DOL procedures and the requirement for prominent postingof notice of Employee Rights at Appendix A to Part 24 entitled: "Your Rights Under theEnergy Reorganization Act".

(b) Under this Whistleblower Employee Protection law, as implemented by regulations,NRC contractor and subcontractor employees are protected from discharge, reprisal,threats, intimidation, coercion, blacklisting or other employment discrimination practiceswith respect to compensation, terms, conditions or privileges of their employmentbecause the contractor or subcontractor employee(s) has provided notice to theemployer, refused to engage in unlawful practices, assisted in proceedings or testifiedon activities concerning alleged violations of the Atomic Energy Act of 1954 (asamended) and the Energy Reorganization Act of 1974 (as amended).

(c) The contractor shall insert this or the substance of this clause in any subcontractsinvolving work performed under this contract.

H.12 SECURITY REQUIREMENTS RELATING TO THE PRODUCTION OFREPORT(S) OR THE PUBLICATION OF RESULTS UNDER CONTRACTS,AGREEMENTS, AND GRANTS

Review and Approval of Reports

(a) Reporting Requirements. The contractor/grantee shall comply with the terms andconditions of the contract/grant regarding the contents of the draft and final report,summaries, data, and related documents, to include correcting, deleting, editing,revising, modifying, formatting, and supplementing any of the information containedtherein, at no additional cost to the NRC. Performance under the contract/grant will notbe deemed accepted or completed until it complies with the NRC's directions. Thereports, summaries, data, and related documents will be considered draft until approvedby the NRC. The contractor/grantee agrees that the direction, determinations, and

Page 19 of 36

decisions on approval or disapproval of reports, summaries, data, and relateddocuments created under this contract/grant remain solely within the discretion of theNRC.

(b) Publication of Results. Prior to any dissemination, display, publication, or release ofarticles, reports, summaries, data, or related documents developed under thecontract/grant, the contractor/grantee shall submit them to the NRC for review andapproval. The contractor/ grantee shall not release, disseminate, display or publisharticles, reports, summaries, data, and related documents, or the contents therein, thathave not been reviewed and approved by the NRC for release, display, dissemination orpublication. The contractor/grantee agrees to conspicuously place any disclaimers,markings or notices, directed by the NRC, on any articles, reports, summaries, data, andrelated documents that the contractor/grantee intends to release, display, disseminate orpublish to other persons, the public, or any other entities. The contractor/grantee agrees,and grants, a royalty-free, nonexclusive, irrevocable worldwide license to thegovernment, to use, reproduce, modify, distribute, prepare derivative works, release,display or disclose the articles, reports, summaries, data, and related documentsdeveloped under the contract/grant, for any governmental purpose and to have orauthorize others to do so.

(c) Identification/Marking of Sensitive Unclassified Non-Safeguards Information (SUNSI)and Safeguards Information (SGI). The decision, determination, or direction by the NRCthat information possessed, formulated or produced by the contractor/granteeconstitutes SUNSI or SGI is solely within the authority and discretion of the NRC. Inperforming the contract/grant, the contractor/grantee shall clearly mark SUNSI and SGI,to include for example, OUO-Allegation Information or OUO-Security RelatedInformation on any reports, documents, designs, data, materials, and written information,as directed by the NRC. In addition to marking the information as directed by the NRC,the contractor shall use the applicable NRC cover sheet (e.g., NRC Form 461Safeguards Information) in maintaining these records and documents. Thecontractor/grantee shall ensure that SUNSI and SGI is handled, maintained andprotected from unauthorized disclosure, consistent with NRC policies and directions. Thecontractor/grantee shall comply with the requirements to mark, maintain, and protect allinformation, including documents, summaries, reports, data, designs, and materials inaccordance with the provisions of Section 147 of the Atomic Energy Act of 1954 asamended, its implementing regulations (10 CFR 73.21), Sensitive Unclassified Non-Safeguards and Safeguards Information policies, and NRC Management Directives andHandbooks 12.5, 12.6 and 12.7.

(d) Remedies. In addition to any civil, criminal, and contractual remedies available underthe applicable laws and regulations, failure to comply with the above provisions, and/orNRC directions, may result in suspension, withholding, or offsetting of any paymentsinvoiced or claimed by the contractor/grantee.

(e) Flowdown. If the contractor/grantee intends to enter into any subcontracts or otheragreements to perform this contract/grant, the contractor/grantee shall include all of theabove provisions in any subcontracts or agreements.

H.13 NRC INFORMATION TECHNOLOGY SECURITY

NRC contractors shall ensure that their employees, consultants, and subcontractors with

Page 20 of 36

access to the agency's information technology (IT) equipment and/or IT servicescomplete NRC's online initial and refresher IT security training requirements to ensurethat their knowledge of IT threats, vulnerabilities, and associated countermeasuresremains current. Both the initial and refresher IT security training courses generally lastan hour or less and can be taken during the employee's regularly scheduled work day.

Contractor employees, consultants, and subcontractors shall complete the NRC's onlineannual, "Computer Security Awareness" course on the same day that they receiveaccess to the agency's IT equipment and/or services, as their first action using theequipment/service. For those contractor employees, consultants, and subcontractorswho are already working under this contract, the on-line training must be completed inaccordance with agency Network Announcements issued throughout the year, withinthree weeks of issuance of this modification.

Contractor employees, consultants, and subcontractors who have been granted accessto NRC information technology equipment and/or IT services must continue to take ITsecurity refresher training offered online by the NRC throughout the term of the contract.Contractor employees will receive notice of NRC's online IT security refresher trainingrequirements through agency-wide notices.

The NRC reserves the right to deny or withdraw Contractor use or access to NRC ITequipment and/or services, and/or take other appropriate contract administrative actions(e.g., disallow costs, terminate for cause) should the Contractor violate the Contractor'sresponsibility under this clause.

H.14 SAFETY OF ON-SITE CONTRACTOR PERSONNEL

Ensuring the safety of occupants of Federal buildings is a responsibility shared by theprofessionals implementing our security and safety programs and the persons beingprotected. The NRC's Office of Administration (ADM) Division of Facilities and Security(DFS) has coordinated an Occupant Emergency Plan (OEP) for NRC Headquartersbuildings with local authorities. The OEP has been approved by the MontgomeryCounty Fire and Rescue Service. It is designed to improve building occupants' chancesof survival, minimize damage to property, and promptly account for building occupantswhen necessary.

The contractor's Project Director shall ensure that all personnel working full time on-siteat NRC Headquarters read the NRC's OEP, provided electronically on the NRC Intranetat http://www.internal.nrc.gov/ADM/OEP.pdf. The contractor's Project Director also shallemphasize to each staff member that they are to be familiar with and guided by theOEP, as well as by instructions given by emergency response personnel in situationswhich pose an immediate health or safety threat to building occupants.

The NRC Contracting Officer's Representative (COR) shall ensure that the contractor'sProject Director has communicated the requirement for on-site contractor staff to followthe guidance in the OEP. The NRC Contracting Officer's Representative (COR) also willassist in accounting for on-site contract persons in the event of a major emergency (e.g.,explosion occurs and casualties or injuries are suspected) during which a full evacuationwill be required, including the assembly and accountability of occupants. The NRC DFSwill conduct drills periodically to train occupants and assess these procedures.

Page 21 of 36

H.15 COMPLIANCE WITH U.S. IMMIGRATION LAWS AND REGULATIONS

NRC contractors are responsible to ensure that their alien personnel are not in violationof United States immigration laws and regulations, including employment authorizationdocuments and visa requirements. Each alien employee of the Contractor must belawfully admitted for permanent residence as evidenced by Permanent Resident Form I-551 (Green Card), or must present other evidence from the U.S. Department ofHomeland Security/U.S. Citizenship and Immigration Services that employment will notaffect his/her immigration status. The U.S. Citizenship and Immigration Servicesprovides information to contractors to help them understand the employment eligibilityverification process for non-US citizens. This information can be found on their website,http://www.uscis.gov/portal/site/uscis.

The NRC reserves the right to deny or withdraw Contractor use or access to NRCfacilities or its equipment/services, and/or take any number of contract administrativeactions (e.g., disallow costs, terminate for cause) should the Contractor violate theContractor's responsibility under this clause.

H.16 RULES OF BEHAVIOR FOR AUTHORIZED COMPUTER USE

In accordance with Appendix III, "Security of Federal Automated InformationResources," to Office of Management and Budget (OMB) Circular A-1 30, "Managementof Federal Information Resources," NRC has established rules of behavior for individualusers who access all IT computing resources maintained and operated by the NRC oron behalf of the NRC. In response to the direction from OMB, NRC has issued the"Agency-wide Rules of Behavior for Authorized Computer Use" policy, hereafter referredto as the rules of behavior. The rules of behavior for authorized computer use will beprovided to NRC computer users, including contractor personnel, as part of the annualcomputer security awareness course.

The rules of behavior apply to all NRC employees, contractors, vendors, and agents(users) who have access to any system operated by the NRC or by a contractor oroutside entity on behalf of the NRC. This policy does not apply to licensees. The nextrevision of Management Directive 12.5, "NRC Cyber Security Program,"will include thispolicy. The rules of behavior can be viewed athttp://www.internal.nrc.gov/CSO/documents/ROB.pdf or use NRC's external Web-basedADAMS at http://wba.nrc.gov:8080/ves/ (Under Advanced Search, type ML082190730 inthe Query box).

The rules of behavior are effective immediately upon acknowledgement of them by theperson who is informed of the requirements contained in those rules of behavior. Allcurrent contractor users are required to review and acknowledge the rules of behavior aspart of the annual computer security awareness course completion. All new NRCcontractor personnel will be required to acknowledge the rules of behavior within oneweek of commencing work under this contract and then acknowledge as current usersthereafter. The acknowledgement statement can be viewed athttp://www.internal.nrc.gov/CSO/documents/ROBAck.pdf or use NRC's external Web-based ADAMS at http://wba.nrc.gov:8080/ves/ (Under Advanced Search, typeML082190730 in the Query box).

The NRC Computer Security Office will review and update the rules of behavior annually

Page 22 of 36

beginning in FY 2011 by December 31st of each year. Contractors shall ensure thattheir personnel to which this requirement applies acknowledge the rules of behaviorbefore beginning contract performance and, if the period of performance for the contractlasts more than one year, annually thereafter. Training on the meaning and purpose ofthe rules of behavior can be provided for contractors upon written request to the NRCContracting Officer's Representative (COR).

The contractor shall flow down this clause into all subcontracts and other agreementsthat relate to performance of this contract/order if such subcontracts/agreements willauthorize access to NRC electronic and information technology (EIT) as that term isdefined in FAR 2.101.

H.17 ANNUAL AND FINAL CONTRACTOR PERFORMANCE EVALUATIONS

Annual and final evaluations of contractor performance under this contract will beprepared in accordance with FAR Subpart 42.15, "Contractor Performance Information,"normally at or near the time the contractor is notified of the NRC's intent to exercise thecontract option. Final evaluations of contractor performance will be prepared at theexpiration of the contract during the contract closeout process.

The Contracting Officer will transmit the NRC Contracting Officer's Representative's(COR) annual and final contractor performance evaluations to the contractor's ProjectManager, unless otherwise instructed by the contractor. The contractor will be permittedthirty days to review the document and submit comments, rebutting statements, oradditional information.

Where a contractor concurs with, or takes no exception to an annual performanceevaluation, the Contracting Officer will consider such evaluation final and releasable forsource selection purposes. Disagreements between the parties regarding a performanceevaluation will be referred to an individual one level above the Contracting Officer,whose decision will be final.

The Contracting Officer will send a copy of the completed evaluation report, marked"Source Selection Information", to the contractor's Project Manager for their records assoon as practicable after it has been finalized. The completed evaluation report also willbe used as a tool to improve communications between the NRC and the contractor andto improve contract performance.

The completed annual performance evaluation will be used to support future awarddecisions in accordance with FAR 42.1502 and 42.1503. During the period theinformation is being used to provide source selection information, the completed annualperformance evaluation will be released to only two parties - the Federal governmentpersonnel performing the source selection evaluation and the contractor underevaluation if the contractor does not have a copy of the report already.

H.18 IT SECURITY REQUIREMENTS - NRC AND CONTRACTOR (NON-NRC)

FACILITIES

BACKUPS

Page 23 of 36

The contractor shall ensure that backup media is created, encrypted (in accordance withinformation sensitivity) and verified to ensure that data can be retrieved and is restorableto NRC systems based on information sensitivity levels. Backups shall be executed tocreate readable media that allows successful file/data restoration at the followingfrequencies:

-At least every 1 calendar day for a high sensitivity system-At least every 1 calendar day for a moderate sensitivity system-At least every 7 calendar days for a low sensitivity system

PERIMETER PROTECTION

The Contractor must employ perimeter protection mechanisms, such as firewalls androuters, to deny all communications unless explicitly allowed by exception.

The contractor must deploy and monitor intrusion detection capability and have analways deployed and actively engaged security monitoring capability in place forsystems placed in operation for the NRC. Intrusion detection and monitoring reports willmade available to the NRC upon request for following security categorizations andreporting timeframes:

-5 calendar days after being requested for a high sensitivity system-10 calendar days after being requested for a moderate sensitivity system-15 calendar days after being requested for a low sensitivity system

CONTRACTOR FACILITY REVIEW AND APPROVAL PROCESS

The contractor shall complete a security survey of the proposed facility in accordancewith MD 12.1 in order for NRC to determine the adequacy and effectiveness of theadministration of the security program and the protection afforded NRC information,employees, and assets before the facility is used for any NRC effort that includes IT.

Upon facility approval per MD 12.1, the contractor shall perform a full certification andobtain accreditation of the facility and computing systems that will be used by thecontractor as part of the NRC effort that includes IT prior to commencing the effort. Thecertification shall be performed at the level of the highest sensitivity of the data that isused at the facility or will ultimately be used by the product of the effort.

H.19 IT SECURITY REQUIREMENTS - CERTIFICATION AND ACCREDITATION

SECURITY RISK ASSESSMENT

The contractor shall work with the NRC Contracting Officer's Representative (COR) inperforming Risk Assessment activities according to NRC policy, standards, andguidance. The contractor shall perform Risk Assessment activities that include analyzinghow the architecture implements the NRC documented security policy for the system,assessing how management, operational, and technical security control features areplanned or implemented and how the system interconnects to other systems or networkswhile maintaining security.

SYSTEM SECURITY PLAN

Page 24 of 36

The contractor shall develop the system security plan (SSP) according to NRC policy,standards, and guidance to define the implementation of IT security controls necessaryto meet both the functional assurance and security requirements. The contractor willensure that all controls required to be implemented are documented in the SSP.

ASSESSMENT PROCEDURES - SECURITY TEST & EVALUATION

The contractor shall follow NRC policy, standards, and guidance for execution of the testprocedures. These procedures shall be supplemented and augmented by tailored testprocedures based on the control objective as it applies to NRC. The contractor shallinclude verification and validation to ensure that appropriate corrective action was takenon identified security weaknesses.

The contractor shall perform ST&E activities, including but not limited to, coordinatingthe ST&E and developing the ST&E Plan, execution ST&E test cases anddocumentation of test results. The contractor shall prepare the Plan of Action andMilestones (POA&M) based on the ST&E results.

PLAN OF ACTION AND MILESTONES (POA&M) MAINTENANCE & REPORTING

The contractor shall provide a determination, in a written form agreed to by the NRCContracting Officer's Representative (COR) and Computer Security Office, on whetherthe implemented corrective action was adequate to resolve the identified informationsecurity weaknesses and provide the reasons for any exceptions or risked-baseddecisions. The contractor shall document any vulnerabilities indicating which portions ofthe security control have not been implemented or applied.

The contractor shall develop and implement solutions that provide a means of planningand monitoring corrective actions; define roles and responsibilities for risk mitigation;assist in identifying security funding requirements; track and prioritize resources; andinform decision-makers of progress of open POA&M items.

The contractor shall perform verification of IT security weaknesses to ensure that allweaknesses identified through third party (e.g., OIG) audits are included in the POA&Msthat the quarterly reporting to OMB is accurate, and the reasons for any exceptions orrisked-based decisions are reasonable and clearly documented. This verificationprocess will be done in conjunction with the continuous monitoring activities.

CERTIFICATION & ACCREDITATION DOCUMENTATION

The contractor shall create, update maintain all Certification and Accreditation (C&A)documentation in accordance with the following NRC Certification and Accreditationprocedures and guidance:

-C&A Non-SGI Unclassified Systems-C&A SGI Unclassified Systems-C&A Classified Systems

The Contractor must develop contingency plan and ensure annual contingency testing iscompleted within one year of previous test and provide an updated security plan and test

Page 25 of 36

report according to NRC's policy and procedure.

The Contractor must conduct annual security control testing according to NRC's policyand procedure and update POA&M, SSP, etc. to reflect any findings or changes tomanagement, operational and technical controls.

H.20 INFORMATION TECHNOLOGY (IT) SECURITY REQUIREMENTS - GENERAL

Basic Contract IT Security Requirements

For unclassified information used for the effort, the contractor shall provide aninformation security categorization document indicating the sensitivity of the informationprocessed as part of this contract if the information security categorization was notprovided in the statement of work. The determination shall be made using NationalInstitute of Standards and Technology (NIST) Special Publication (SP) 800-60 and mustbe approved by CSO. The NRC contracting officer and Contracting Officer'sRepresentative (COR) shall be notified immediately before the contractor begins toprocess information at a higher sensitivity level.

If the effort includes use or processing of classified information, the NRC contractingofficer and Contracting Officer's Representative (COR) shall be notified before thecontractor begins to process information at a more restrictive classification level.

All work under this contract shall comply with the latest version of policy, procedures andstandards. Individual task orders will reference latest versions of standards or exceptionsas necessary. These policy, procedures and standards include: NRC ManagementDirective (MD) volume 12 Security, Computer Security Office policies, procedures andstandards, National Institute of Standards and Technology (NIST) guidance and FederalInformation Processing Standards (FIPS), and Committee on National Security Systems(CNSS) policy, directives, instructions, and guidance. This information is available at thefollowing links:

NRC Policies, Procedures and Standards (CSO internal website):http://www.internal.nrc.gov/CSO/policies.html

NRC Policy and Procedures For Handling, Marking and Protecting SensitiveUnclassified Non-Safeguards Information (SUNSI):http://www.internal.nrc.gov/sunsi/pdf/SUNSI-Policy-Procedures.pdf

All NRC Management Directives (public website):http://www.nrc.gov/reading-rm/doc-collections/management-directives/

NIST SP and FIPS documentation is located at:http://csrc.nist.gov/

CNSS documents are located at:http://www.cnss.gov/

The Contractor shall ensure compliance with the latest version of NIST guidance andFIPS standards available at contract issuance and continued compliance with the latestversions within one year of the release date.

Page 26 of 36

When e-mail is used, the Contractors shall only use NRC provided e-mail accounts tosend and receive sensitive information (information that is not releasable to the public) ormechanisms to protect the information during transmission to NRC that have beenapproved by CSO.

All Contractor employees must sign the NRC Agency-Wide Rules of Behavior forAuthorized Computer Use prior to being granted access to NRC computing resources.

The Contractor shall adhere to following NRC policies:

1. Management Directive 12.5, NRC Cyber Security Program2. NRC Sensitive Unclassified Non-Safeguards Information (SUNSI)3. Computer Security Policy for Encryption of Data at Rest When Outside of AgencyFacilities4. Policy for Copying, Scanning, Printing, and Faxing SGI & Classified Information5. Computer Security Information Protection Policy6. Remote Access Policy7. Use of Commercial Wireless Devices, Services and Technologies Policy8. Laptop Security Policy9. Computer Security Incident Response Policy

Contractor will adhere to NRC's prohibition of use of personal devices to process andstore NRC sensitive information.

All electronic process of NRC sensitive information, including system development andoperations and maintenance performed at non-NRC facilities shall be in facilities,networks, and computers that have been accredited by NRC for processing informationat the highest sensitivity of the information that is processed or will ultimately beprocessed.

Contract Performance And Closeout

The contractor shall ensure that the NRC data processed during the performance of thiscontract shall be purged from all data storage components of the contractor's computerfacility. Tools used to perform data purging shall be approved by the CISO. Thecontractor shall provide written certification to the NRC contracting officer that thecontractor does not retain any NRC data within 30 calendar days after contractcompletion. Until all data is purged, the contractor shall ensure that any NRC dataremaining in any storage component will be protected to prevent unauthorizeddisclosure.

When contractor employees no longer require access to an NRC system, the contractorshall notify the Contracting Officer's Representative (COR) within 24 hours.

Upon contract completion, the contractor shall provide a status list of all contractoremployees who were users of NRC systems and shall note if any users still requireaccess to the system to perform work if a follow-on contract or task order has beenissued by NRC.

Control Of Information And Data

Page 27 of 36

The contractor shall not publish or disclose in any manner, without the contractingofficer's written consent, the details of any security controls or countermeasures eitherdesigned or developed by the contractor under this contract or otherwise provided by theNRC.

Any IT system used to process NRC sensitive information shall:

1. Include a mechanism to require users to uniquely identify themselves to the systembefore beginning to perform any other actions that the system is expected to provide.2. Be able to authenticate data that includes information for verifying the claimed identityof individual users (e.g., passwords)3. Protect authentication data so that it cannot be accessed by any unauthorized user4. Be able to enforce individual accountability by providing the capability to uniquelyidentify each individual computer system user5. Report to appropriate security personnel when attempts are made to guess theauthentication data whether inadvertently or deliberately.

Access Controls

Any contractor system being used to process NRC data shall be able to define andenforce access privileges for individual users. The discretionary access controlsmechanisms shall be configurable to protect objects (e.g., files, folders) fromunauthorized access.

The contractor system being used to process NRC data shall provide only essentialcapabilities and specifically prohibit and/or restrict the use of specified functions, ports,protocols, and/or services.

The contractors shall only use NRC approved methods to send and receive informationconsidered sensitive or classified. Specifically,

1. Classified Information - All NRC Classified data being transmitted over a networkshall use NSA approved encryption and adhere to guidance in MD 12.2 NRC ClassifiedInformation Security Program, MD 12.5 NRC Automated Information Security Programand Committee on National Security Systems. Classified processing shall be only withinfacilities, computers, and spaces that have been specifically approved for classifiedprocessing.

2. SGI Information - All SGI being transmitted over a network shall adhere to guidancein MD 12.7 NRC Safeguards Information Security Program and MD 12.5NRC CyberSecurity Program . SGI processing shall be only within facilities, computers, and spacesthat have been specifically approved for SGI processing. Cryptographic modulesprovided as part of the system shall be validated under the Cryptographic ModuleValidation Program to conform to NIST FIPS 140-2 overall level 2 and must be operatedin FIPS mode. The contractor shall provide the FIPS 140-2 cryptographic modulecertificate number and a brief description of the encryption module that includes theencryption algorithm(s) used, the key length, and the vendor of the product.

The most restrictive set of rights/privileges or accesses needed by users (or processesacting on behalf of users) for the performance of specified tasks must be enforced by the

Page 28 of 36

system through assigned access authorizations.

Separation of duties for contractor systems used to process NRC information must beenforced by the system through assigned access authorizations.

The mechanisms within the contractor system or application that enforces access controland other security features shall be continuously protected against tampering and/orunauthorized changes.

Configuration Standards

All systems used to process NRC sensitive information shall meet NRC configurationstandards available at: http://www.internal.nrc.gov/CSO/standards.html

Media Handling

All media used by the contractor to store or process NRC information shall be controlledin accordance with the sensitivity level.

The contractor shall not perform sanitization or destruction of media approved forprocessing NRC information designated as SGI or Classified. The contractor mustprovide the media to NRC for destruction.

Vulnerability Management

The Contractor must adhere to NRC patch management processes for all systems usedto process NRC information. Patch Management reports will made available to the NRCupon request for following security categorizations and reporting timeframes:

-5 calendar days after being requested for a high sensitivity system-10 calendar days after being requested for a moderate sensitivity system-15 calendar days after being requested for a low sensitivity system

For any contractor system used to process NRC information, the contractor must ensurethat information loaded into the system is scanned for viruses prior to posting; serversare scanned for viruses, adware, and spyware on a regular basis; and virus signaturesare updated at the following frequency:

-1 calendar day for a high sensitivity system-3 calendar days for a moderate sensitivity system-7 calendar days for a low sensitivity system

H.21 SECURITY REQUIREMENTS FOR INFORMATION TECHNOLOGY LEVEL I ORLEVEL II ACCESS APPROVAL (SEP 2013)

The contractor must identify all individuals selected to work under this contract. TheNRC Contracting Officer's Representative (COR) shall make the final determination ofthe level, if any, of IT access approval required for all individuals working under thiscontract/order using the following guidance. The Government shall have full andcomplete control and discretion over granting, denying, withholding, or terminating ITaccess approvals for contractor personnel performing work under this contract/order.

Page 29 of 36

The contractor shall conduct a preliminary security interview or review for eachemployee requiring IT level I or II access and submit to the Government only the namesof candidates that have a reasonable probability of obtaining the level of IT accessapproval for which the employee has been proposed. The contractor shall pre-screen itsapplicants for the following:

(a) felony arrest in the last seven (7) years; (b) alcohol related arrest within the last five(5) years; (c) record of any military courts-martial convictions in the past ten (10) years;(d) illegal use of narcotics or other controlled substances possession in the past year, orillegal purchase, production, transfer, or distribution of narcotics or other controlledsubstances in the last seven (7) years; and (e) delinquency on any federal debts orbankruptcy in the last seven (7) years.

The contractor shall make a written record of its pre-screening interview or review(including any information to mitigate the responses to items listed in (a) - (e)), and havethe employee verify the pre-screening record or review, sign and date it. The contractorshall supply two (2) copies of the signed contractor's pre-screening record or review tothe NRC Contracting Officer's Representative (COR), who will then provide them to theNRC Office of Administration, Division of Facilities and Security, Personnel SecurityBranch with the employee's completed IT access application package.

The contractor shall further ensure that its personnel complete all IT access approvalsecurity applications required by this clause within fourteen (14) calendar days ofnotification by the NRC Contracting Officer's Representative (COR) of initiation of theapplication process. Timely receipt of properly completed records of the pre-screeningrecord and IT access approval applications (submitted for candidates that have areasonable probability of obtaining the level of security assurance necessary for accessto NRC's IT systems/data) is a requirement of this contract/order. Failure of thecontractor to comply with this requirement may be a basis to terminate the contract/orderfor cause, or offset from the contract's invoiced cost or price the NRC's incurred costs ordelays as a result of inadequate pre-screening by the contractor.

SECURITY REQUIREMENTS FOR IT LEVEL I

Performance under this contract/order will involve contractor personnel who performservices requiring direct access to or operate agency sensitive information technologysystems or data (IT Level I). The IT Level I involves responsibility for the planning,direction, and implementation of a computer security program; major responsibility forthe direction, planning, and design of a computer system, including hardware andsoftware; or the capability to access a computer system during its operation ormaintenance in such a way that could cause or that has a relatively high risk of causinggrave damage; or the capability to realize a significant personal gain from computeraccess.

Contractor personnel shall not have access to sensitive information technology systemsor data until they are approved by DFS/PSB and they have been so informed in writingby the NRC Contracting Officer's Representative (COR). Temporary IT access may beapproved by DFS/PSB based on a favorable review or adjudication of their securityforms and checks. Final IT access may be approved by DFS/PSB based on a favorablyreview or adjudication of a completed background investigation. However, temporary

Page 30 of 36

access authorization approval will be revoked and the employee may subsequently bedenied IT access in the event the employee's investigation cannot be favorablyadjudicated. Such an employee will not be authorized to work under any NRCcontract/order requiring IT access without the approval of DFS/PSB, as communicated inwriting to the contractor by the NRC Contracting Officer's Representative (COR). Wheretemporary access authorization has been revoked or denied by DFS/PSB, the contractorshall assign another contractor employee to perform the necessary work under thiscontract/order without delay to the contract/order performance schedule, or withoutadverse impact to any other terms or conditions of the contract/order. When anindividual receives final IT access approval from DFS/PSB, the individual will be subjectto a reinvestigation every ten (10) years thereafter (assuming continuous performanceunder contract/order at NRC) or more frequently in the event of noncontinuousperformance under contract/order at NRC.

CORs are responsible for submitting the completed access/clearance request packageas well as other documentation that is necessary to DFS/PSB. The contractor shallsubmit a completed security forms packet, including the OPM Standard Form (SF) 86(online Questionnaire for National Security Positions), two (2) copies of the Contractor'ssigned pre-screening record and two (2) FD 258 fingerprint charts, to DFS/PSB forreview and adjudication, prior to the individual being authorized to perform work underthis contract/order requiring access to sensitive information technology systems or data.Non-U.S. citizens must provide official documentation to the DFS/PSB, as proof of theirlegal residency. This documentation can be a Permanent Resident Card, TemporaryWork Visa, Employment Authorization Card, or other official documentation issued bythe U.S. Citizenship and Immigration Services. Any applicant with less than seven (7)years residency in the U.S. will not be approved for IT Level I access. The Contractorshall submit the documents to the NRC Contracting Officer's Representative (COR) whowill give them to DFS/PSB. The contractor shall ensure that all forms are accurate,complete, and legible. Based on DFS/PSB review of the contractor employee's securityforms and/or the receipt of adverse information by NRC, the contractor individual may bedenied access to NRC facilities and sensitive information technology systems or datauntil a final determination is made by DFS/PSB and thereafter communicated to thecontractor by the NRC Contracting Officer's Representative (COR) regarding thecontractor person's eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level I contractors shall besubject to the attached NRC Form 187 and SF-86 which furnishes the basis for providingsecurity requirements to contractors that have or may have an NRC contractualrelationship which requires access to or operation of agency sensitive informationtechnology systems or remote development and/or analysis of sensitive informationtechnology systems or data or other access to such systems and data; access on acontinuing basis (in excess more than 30 calendar days) to NRC buildings; or otherwiserequires issuance of an unescorted NRC badge.

SECURITY REQUIREMENTS FOR IT LEVEL II

Performance under this contract/order will involve contractor personnel that developand/or analyze sensitive information technology systems or data or otherwise haveaccess to such systems or data (IT Level II).

The IT Level II involves responsibility for the planning, design, operation, or maintenance

Page 31 of 36

of a computer system and all other computer or IT positions.

Contractor personnel shall not have access to sensitive information technology systemsor data until they are approved by DFS/PSB and they have been so informed in writingby the NRC Contracting Officer's Representative (COR). Temporary access may beapproved by DFS/PSB based on a favorable review of their security forms and checks.Final IT access may be approved by DFS/PSB based on a favorably adjudication.However, temporary access authorization approval will be revoked and the contractoremployee may subsequently be denied IT access in the event the employee'sinvestigation cannot be favorably adjudicated. Such an employee will not be authorizedto work under any NRC contract/order requiring IT access without the approval ofDFS/PSB, as communicated in writing to the contractor by the NRC Contracting Officer'sRepresentative (COR). Where temporary access authorization has been revoked ordenied by DFS/PSB, the contractor is responsible for assigning another contractoremployee to perform the necessary work under this contract/order without delay to thecontract/order performance schedule, or without adverse impact to any other terms orconditions of the contract/order. When a contractor employee receives final IT accessapproval from DFS/PSB, the individual will be subject to a review or reinvestigationevery ten (10) years (assuming continuous performance under contract/order at NRC) ormore frequently in the event of noncontinuous performance under contract/order atNRC.

CORs are responsible for submitting the completed access/clearance request packageas well as other documentation that is necessary to DFS/PSB. The contractor shallsubmit a completed security forms packet, including the OPM Standard Form (SF) 86(online Questionnaire for National Security Positions), two (2) copies of the Contractor'ssigned pre-screening record and two (2) FD 258 fingerprint charts, to DFS/PSB forreview and adjudication, prior to the contractor employee being authorized to performwork under this contract/order. Non-U.S. citizens must provide official documentation tothe DFS/PSB, as proof of their legal residency. This documentation can be a PermanentResident Card, Temporary Work Visa, Employment Authorization Card, or other officialdocumentation issued by the U.S. Citizenship and Immigration Services. Any applicantwith less than seven (7) years residency in the U.S. will not be approved for IT Level IIaccess. The Contractor shall submit the documents to the NRC Contracting Officer'sRepresentative (COR) who will give them to DFS/PSB. The contractor shall ensure thatall forms are accurate, complete, and legible. Based on DFS/PSB review of thecontractor employee's security forms and/or the receipt of adverse information by NRC,the contractor employee may be denied access to NRC facilities, sensitive informationtechnology systems or data until a final determination is made by DFS/PSB regardingthe contractor person's eligibility.

In accordance with NRCAR 2052.204-70 "Security," IT Level II contractors shall besubject to the attached NRC Form 187, SF-86, and contractor's record of the pre-screening which furnishes the basis for providing security requirements to contractorsthat have or may have an NRC contractual relationship which requires access to oroperation of agency sensitive information technology systems or remote developmentand/or analysis of sensitive information technology systems or data or other access tosuch systems or data; access on a continuing basis (in excess of more than 30 calendardays) to NRC buildings; or otherwise requires issuance of an unescorted NRC badge.

CANCELLATION OR TERMINATION OF IT ACCESS/REQUEST

Page 32 of 36

When a request for IT access is to be withdrawn or canceled, the contractor shallimmediately notify the NRC Contracting Officer's Representative (COR) by telephone sothat the access review may be promptly discontinued. The notification shall contain thefull name of the contractor employee and the date of the request. Telephonenotifications must be promptly confirmed by the contractor in writing to the NRCContracting Officer's Representative (COR), who will forward the confirmation toDFS/PSB. Additionally, the contractor shall immediately notify the NRC ContractingOfficer's Representative (COR) in writing, who will in turn notify DFS/PSB, when acontractor employee no longer requires access to NRC sensitive automated informationtechnology systems or data, including the voluntary or involuntary separation ofemployment of a contractor employee who has been approved for or is being processedfor IT access.

The contractor shall flow the requirements of this clause down into all subcontracts andagreements with consultants for work that requires them to access NRC IT resources.

H.22 NRC INFORMATION TECHNOLOGY SECURITY TRAINING

Agencies/Contractors shall ensure that their employees, consultants, and subcontractorswith access to the NRC's information technology (IT) equipment and/or IT servicescomplete NRC's online initial and refresher IT security training requirements to ensurethat their knowledge of IT threats, vulnerabilities, and associated countermeasuresremains current. Both the initial and refresher IT security training courses generally lastan hour or less and can be taken during the employee's regularly scheduled work day.Agency/Contractor shall ensure that their employees, consultants, and subcontractors,with access to the NRC's IT equipment, complete the Information Security (INFOSec)Awareness Training annually; no later than December 31.

Agency/Contractor employees, consultants, and subcontractors shall complete theNRC's online, "Computer Security Awareness" course on the. same day that they receiveaccess to the NRC's IT equipment and/or services, as their first action using theequipment/service. For those Agency/Contractor employees, consultants, andsubcontractors who are already working under an existing agreement/contract, theonline training must be completed in accordance with agency Network Announcementsissued throughout the year.

Agency/Contractor employees, consultants, and subcontractors who have been grantedaccess to NRC information technology equipment and/or IT services must continue totake IT security refresher training offered online by the NRC throughout the term of theagreement/contract.

Agency/Contractor employees will receive notice of NRC's online IT security refreshertraining requirements through agency-wide notices.

The NRC reserves the right to deny or withdraw Agency/Contractor use or access toNRC IT equipment and/or services should the Agency/Contractor violate theAgency/Contractor's responsibility under this clause.

Page 33 of 36

SECTION I - CONTRACT CLAUSES

1.2 52.227-17 RIGHTS IN DATA--SPECIAL WORKS. (DEC 2007)

(a) Definitions. As used in this clause--

Data means recorded information, regardless of form or the media on which it may berecorded. The term includes technical data and computer software. The term does notinclude information incidental to contract administration, such as financial,administrative, cost or pricing, or management information.

Unlimited rights means the rights of the Government to use, disclose, reproduce,prepare derivative works, distribute copies to the public, and perform publicly and displaypublicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of Rights. (1) The Government shall have--

(i) Unlimited rights in all data delivered under this contract, and inall data first produced in the performance of this contract, exceptas provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced inthe performance of this contract, and to obtain assignment ofcopyright in that data, in accordance with paragraph (c)(1) of thisclause.

(iii) The right to limit the release and use of certain data inaccordance with paragraph (d) of this clause.

(2) The Contractor shall have, to the extent permission is granted inaccordance with paragraph (c)(1) of this clause, the right to assert claimto copyright subsisting in data first produced in the performance of thiscontract.

(c) Copyright--(1) Data first produced in the performance of this contract. (i) TheContractor shall not assert or authorize others to assert any claim to copyrightsubsisting in any data first produced in the performance of this contract withoutprior written permission of the Contracting Officer. When copyright is asserted,the Contractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402and acknowledgment of Government sponsorship (including contract number) tothe data when delivered to the Government, as well as when the data arepublished or deposited for registration as a published work in the U.S. CopyrightOffice. The Contractor grants to the Government, and others acting on its behalf,a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data toreproduce, prepare derivative works, distribute copies to the public, and performpublicly and display publicly, by or on behalf of the Government.

(ii) If the Government desires to obtain copyright in data firstproduced in the performance of this contract and permission hasnot been granted as set forth in paragraph (c)(1)(i) of this clause,

Page 34 of 36

the Contracting Officer shall direct the Contractor to assign (withor without registration), or obtain the assignment of, the copyrightto the Government or its designated assignee.

(2) Data not first produced in the performance of this contract. TheContractor shall not, without prior written permission of the ContractingOfficer, incorporate in data delivered under this contract any data not firstproduced in the performance of this contract and that contain thecopyright notice of 17 U.S.C. 401 or 402, unless the Contractor identifiessuch data and grants to the Government, or acquires on its behalf, alicense of the same scope as set forth in paragraph (c)(1) of this clause.

(d) Release and use restrictions. Except as otherwise specifically provided for inthis contract, the Contractor shall not use, release, reproduce, distribute, orpublish any data first produced in the performance of this contract, nor authorizeothers to do so, without written permission of the Contracting Officer.

(e) Indemnity. The Contractor shall indemnify the Government and its officers,agents, and employees acting for the Government against any liability, includingcosts and expenses, incurred as the result of the violation of trade secrets,copyrights, or right of privacy or publicity, arising out of the creation, delivery,publication, or use of any data furnished under this contract; or any libelous orother unlawful matter contained in such data. The provisions of this paragraph donot apply unless the Government provides notice to the Contractor as soon aspracticable of any claim or suit, affords the Contractor an opportunity underapplicable laws, rules, or regulations to participate in the defense of the claim orsuit, and obtains the Contractor's consent to the settlement of any claim or suitother than as required by final decree of a court of competent jurisdiction; andthese provisions do not apply to material furnished to the Contractor by theGovernment and incorporated in data to which this clause applies.

Page 35 of 36

ATTACHMENT

1

2

3

4

SECTION J - LIST OF ATTACHMENTS

TITLE

STATEMENT OF WORK

PRICE SCHEDULE

BILLING INSTRUCTIONS FIXED PRICE

BILLING INSTRUCTIONS LABOR HOUR

Page 36 of 36

I DELIVERY ORDER NRC-HQ-7S-14-T-0001

Computer Security Office (CSO)

General Support Services

1.0 OBJECTIVE

The Contractor shall support the Nuclear Regulatory Commission (NRC) in its efforts to developand implement the organization's Information Security Program.

2.0 SCOPE OF WORK

The Contractor must ensure NRC's Information Security Program meets federally mandatedand NRC defined security requirements. The Contractor shall provide the following services tothe CSO:

* Provide Integrated Project Planning and Activity Scheduling

* Develop Supporting Documentation

* Provide Communications Support

* Support the Information Security Program

* Provide Security Engineering Support

The Contractor shall provide the necessary security support staff to meet the requirementsspecified in this Statement of Work (SOW).

3.0 TASKS

The Contractor shall support the organization according to the schedule of supplies, services,and prices found in the Consolidated Information Security Support Services (CISSS) contract aswell as support the management and of active task orders under CISSS.

Note: At no time is the Contractor allowed to configure an NRC operational system.

Subtask 1: Provide Integrated Project Planning and Activity Scheduling

The proiect plan shall include an inteqrated Level 5 Work Breakdown Structure (WBS) across alltask orders that have been defined under the contract. The WBS shall include a definition of thework to be conducted decomposed into distinct discrete manageable tasks or groups of tasks(work packages) with decisive outputs and specific measurable entry and exit criteria. Eachwork package shall be assigned a start and finish date, a budget value, and is integrated withthe project plans from other task orders.

Also, the project plan shall provide resource utilization information that identifies the budget toaccomplish the work, the resources needed to complete the work, and the effort required in thespecified time frame for the completion of each of the tasks in the WBS. The Contractor shallallocate a portion of the budget for each work package that comprises the WBS and ensure thatthe WBS adequately defines all work necessary to meet the requirements for the project.

Microsoft Project Plan that incorporates all tasks and projects such that the individual projectsroll up into an Integrated Security project schedule encompassing all NRC security relatedactivities, services, and deliverables. The Microsoft Project Plan shall identify resources foreach activity and include the Work Breakdown Structure levels.

Subtask 2: Develop Supporting Documentation

The Contractor shall develop documentation that supports the CSO's efforts to develop andimplement a robust Information Security Program. Documentation will be used to ensure thesecurity program meets enacted federal laws (Federal Information Security Management Act(FISMA), Privacy Act, etc.), federally mandated requirements (Office of Management andBudget (OMB), Code of Federal Regulations (CFR), Presidential Directives, etc.) and NRCdefined security requirements. Also, the contractor shall assist the CSO in developingprocedures, standards, and guidance that supports the organization's Security Policies.

The following describes some of the documentation the Contractor will have to develop underthis subtask:

* New Security Policies (resulting from new technology, new attack methodologies, newfederally mandated requirements)

* New Procedures (Continuous Monitoring Qtrly Scanning, FISMA Compliance Plans)

" Process Improvement Documentation

" New Standards (Windows 2003 or currently available Hardening Guidelines, LinuxHardeninq Guidelines)

* New Guidance (How the NRC intends to implement a new Presidential Directive, Howthe NRC intends to implement new technology, How a new policy should beimplemented)

Subtask 3: Provide Communications Support

The Contractor shall provide communications support (briefings, demonstrations, etc.) whenCSO is communicating with upper management or the user community. These activities willfocus on assisting the CSO as it communicates NRC policy, standards, procedures, or securityrelated requirements.

Subtask 4: Support Information Security Program

The Contractor shall support the CSO in the development, implementation, and continuousimprovement of the agency's Information Security Program and ensure the risks/deficiencies inthe program are being addressed in a timely and effective manner. An Information SecurityProgram includes the following: security policies, incident handling, security training, capitalplanning, information system development life cycle, certification and accreditation, continuousmonitoring, contingency planning, and system inventory.

The following identifies the support the contractor will provide under this subtask:

* The Contractor shall support the NRC's efforts to certify and accredit its informationsystems.

" The Contractor shall support the NRC's efforts to establish a contingency planningprocess that addresses the needs of the agency.

" The Contractor shall support the NRC staff in the development and documentation ofsecurity controls and security requirements and associated technical resolutions, riskmitigation, and implementations.

" The Contractor shall review, verify, and validate all security controls and securityrequirements and associated technical resolutions, risk mitigation, and implementationscontained within various NRC security and systems development documentation suchthat confirmation that the system and associated controls are operating as intended.

" The Contractor shall perform quarterly analysis, penetration, vulnerability, configuration,systems integrity, and patch management scans. The Contractor shall identify, analyze,and propose tested corrective actions that ensure the agency's security posture is up todate and the security controls are operating as intended.

* The Contractor shall support the functional alignment of common security control setsand standard operating procedures consistent with FISMA and NIST SP 800-53 thatintegrates with the NRC's Proiect Management Methodology.

" Support the NRC in the development of a security line of business program and supportthe agency in assessing, documenting., and implementing common security solutions.

* The Contractor shall provide support to assist the CSO in meeting its FISMA reportingrequirements and responding to Data Calls by the Office of Inspector General (OIG) andother government agencies.

* The Contractor shall provide technical support services to develop, implement,administer, and maintain the information systems tools that support the NRC'sInformation Security Program.

Subtask 5: Provide Security Engineering Support

The Contractor shall provide Security Engineering support to verify and validate that proposedarchitectures and implementations are based on sound security engineering principles andpractices. The Contractor shall ensure that all federally mandated and NRC defined securityrequirements are met.

Subtask 6: Special Projects

The Computer Security Office (CSO) will need the following support services to ensure a robustinformation security program is developed and implemented at the NRC:

" Software Quality Assurance:

The contractor will assist the CSO in developing a Software Quality Assurance Program thatgives the NRC the capability to scan customized source code and object files forvulnerabilities and deficiencies. Under this program two types the following will beestablished:

1. Developer Verification - Auditing software will be put in the hands of the developers soflaws and inadequacies that exist in their source code can be identified, prioritized, andunderstood. This will allow the developer to fix their source code Immediately ensuringonly hardened source code is used in NRC systems.

2. CSO Verification - A service will be used to independently verify and validate thatsubmitted source code has been properly hardened. This review will not only examinethe developer's source code but any third party applications or libraries that are in use.This review should be done after major milestones have been accomplished.

By utilizing these methods, the NRC will be able to develop a Software Quality AssuranceProgram that is robust and ensure customized source code is properly protected fromattackers.

" Residual Risks:

The contractor will develop and implement a process for determining the residual risk thatexists in the NRC infrastructure. The contractor should focus on risks that occur at anenterprise level or impact multiple NRC information systems. Also, the contractor will developa reporting template (Quarterly Residual Risk Report) and will brief the Computer InformationSecurity Officer (CISO) and Director of Office of Information Systems (01S) on a quarterlybasis.

The contractor will use the following sources to determine these risks: audits, the EnterpriseRisk Assessment, computer security incidents, Strategic Plan, Inspector General Reports,Plan of Action & Milestone items, vendor reported vulnerabilities & exploits, and observalionslThe contractor will identify and prioritize these risks and will map these risks to businessneeds and objectives.

During the quarterly presentation, the contractor will identify new risks, all risks that have beenclosed in a quarter, and the top twenty risks that exist in the NRC. The contractor shouldprovide options on how all risks identified in the Quarterly Residual Risk Report could bemitigated.

Web Application Assessments:

The contractor shall develop and implement a process to conduct Web ApplicationAssessments at the NRC using Cenezic's Hailstorm Professional. The contractor will installHailstorm Professional on three scanning laptops, develop procedures for configuring &executing an assessment, work with the CSO & OIS to test Hailstorm Professional in NRC'sConsolidated Testing Facility, and work with CISSS scanning team to ensure assessments ofproductions web applications can be performed effectively and safely.

- The configuration of the dedicated server and dedicated laptop analyzing the traffic ofinterest must meet NRC configuration standards and must be independently assessedby the NRC to determine compliance. Analysis will not begin until this is accomplished.

- All communications between the server and laptop used to analyze traffic must beprotected using NIST FIPS 140-2 (level 2) validated encryption.

• Only cleared personnel will be allowed to install, operate, or maintain the hardware andsoftware used to support this effort.

* All outbound traffic that is captured and unencrypted (no longer public) must be protectEusing NIST FIPS 140-2 (level 2) validated encryption at all times (including at rest).

* All configuration changes to the dedicated server and dedicated laptop analyzing the traof interest must be approved by the NRC prior to change implementation. The NRC ProjEOfficers will provide a list of changes that do not require NRC approval.

* The Contractor will notify the NRC immediately if any serious or catastrophic risk orvulnerability is detected.

* The NRC reserves the right to determine how all security incidents are handled.

" The Contractor will participate in Bi-weekly conference calls to discuss task status withthe Project Officer, alternate Project Officer, and task sponsors.

- The Contractor will submit Monthly Technical Reports summarizing activities that haveoccurred on the task within the last 30 days. The Monthly Technical Reports must bedelivered to the NRC Project Officer and Alternate Project Officer no later than the 5thworking day of each month. The Contractor will meet with the NRC in person to discussthese reports.

•The Contractor will provide the NRC with a Formal Management Report that describesall threats and risks seen each quarter. The Formal Management Report is due to theNRC Project Officer and Alternate Project Officer no later than the is" business day ofthe following quarter. The Contractor will meet with the NRC in person to discuss thesereports.

• The Contractor will provide and the NRC will host the tap and the device that collectstraffic of interest. The Contractor will host at their facilities the dedicated server anddedicated laptop that analyzes the traffic of interest. All analysis of suspicious traffic willbe performed on this dedicated equipment.

Subtask 7: Red Team Penetration Testing

The Contractor shall conduct external penetration tests and social engineering tests against theNRC infrastructure. The Contractor shall use a variety of testing tools, manual and automatic,including proprietary and modified open source, to attempt to penetrate NRC systems.

In order to conduct this testing, the Contractor shall procure, lease, or otherwise obtain thecommercially available tools needed to complete the testing. A designated government officialmust be present during all active penetration testing activities. Before testing commences, thecontractor will submit a test plan that describes the effort in detail.

The NRC must approve the test plan and all tools used during the assessment in writing beforetesting begins. During testing, all sensitive NRC data (e.g., Sensitive Unclassified Non-Safeguards Information) must be encrypted using NIST FIPS 140-2 validated encryption whilein transit. All NRC data related to testing must be encrypted using NIST FIPS 140-2 validatedencryption while at rest.

The NRC's use of its domain space includes both internal as well as external trusted informationservices providers.

The Contractor will not conduct any testing until they have received written approval in anauthorized and completed Rules of Engagement document from the NRC. The Contractor shallinform the Project Officers and the CSA SITSO before each activity that actively accesses NRCIT or parties operating IT resources'on behalf of the NRC is conducted as part of this test. TheProject Officers and the CSA SITSO do not need to be notified for activities that do not activelyaccess NRC IT resources or parties operating IT resources on behalf of the NRC.

Penetration Testing Phases

The contractor may use company processes and techniques that enhance or provide a bestpractices red team penetration test environment for this sub task; however at a minimum, thefollowing phases and / or steps shall be included as part of the testing engagement:

Phase 1 - Planning, Preparation and Authorization -

o Step 1 -Identify Penetration Test Tools and Proposed Test Plan- The

contractor shall develop a Tools and Proposed Red Team Test Plan that

identifies the automated tools that are going to be used for this sub task. At a

minimum, the test plan will identify the analysts who will conduct red team

testing, the testing tools that will be used, the tests that will be run during the

discovery and penetration testing phase, the time windows (dates) for the

discovery and testing phases, the physical and Internet Protocol addresses that

will be used to conduct the tests and the potential impact on NRC IT systems as

a result of testing.

o Step 2 - Complete and Receive.an NRC Authorized Rules of Engagement

Agreement - The contractor will complete a Rules of Engagement Document for

this sub task that follows the format and security principles outlined in the

National Standard of Institute's Special Publication 800-115, Technical Guide to

Information Security Testing and Assessment as applicable for external

penetration test. An ROE template example which may be modified as necessary

to execute this Sub Task is attached as Appendix A.

* Phase 2 - Discovery

o Information Gathering - The contractor shall gather information through

fingerprinting and mapping of the *.nrc.gov domain space using information

available via the Internet such as, but not limited to DNS, who-is, agency

information available through internet search engines and social engineering,

and network mapping and topology generated from the discovery phase to

identify the touch points that need to be tested (for example: Routers, Firewalls,

Gateways, Remote Access Services, Web Applications, Adherence to policies &

standards, etc.). The Contractor will provide the NRC with the complete

information gathered during the discovery phase and will prioritize the testing of

this list after consultation with the NRC CSA SITSO and the Project Officers.

* Phase 3 - Testing - The contractor will perform external penetration testing and social

engineering attacks against the NRC under observation by a designated government

official. All raw scans, observations, and testing results will be captured and

documented in the corrective action report.

Monthly Report

The Contractor shall provide a Monthly Performance Report that provides status of workaccomplished, work forecast, and any concerns or potential problem areas. The format of theMonthly Performance Report must be agreed upon before work under this sub task may begin.The Monthly Performance Report will be provided on the 5th of every month in Microsoft WordVersion 2007 format (a later version may be used with the approval of the NRC).

0 Phase 4 - Red Team Report and Presentation -

The Contractor will develop a draft and final report and a presentation designed for departmentheads and other senior executives that summarize the findings of the Red Team PenetrationTest, identifying the current risks to NRC sensitive information and the information systems thatexhibit these risks.

The report and presentation should be developed in a format readable by Microsoft Office Wordand PowerPoint Version 2007 (a later version may be used with the approval of the NRC). TheNRC will have five business days to review and comment on the draft documents. Thecontractor, upon receiving the NRC comments, will have five additional business days toincorporate agency comments and provide final documents reports to the Director, OIS, theChief Information Security Officer, the CSA SITSO and the Project Officers.

" The Red Team Report and Presentation shall contain but shall not be limited to

addressing the following areas:

o Summarize how the tests were performed and how risk was evaluated.

o Identify the tool and type of test that was run (e.g.; Nessus, Backtrack,

fingerprinting SQL injection, etc.)

o Specify the IP addresses, hostnames and users that were tested and the

information systems/organizations that the tested components form as a system

configuration item (to the extent that the information is available or can be

derived to make an assignment).

o Describe the vulnerabilities and deficiencies that were discovered during testing.

o Identify the risks associated with these vulnerabilities and deficiencies. Risks will

be organized with the most significant risk listed first.

o Provide recommendations on how to mitigatethese risks. A recommendation will

be provided for every risk.

* Phase 5: Cleanup - The contractor shall wipe all devices used during testing and

certify in writing that the task was completed using Department of Defense (DoD)

approved sanitization methods. All contractors associated with this sub task will sign

non-disclosure agreements and not publish, discuss or otherwise communicate the test

findings to individuals outside the NRC without rewritten authorization by the

Government.

Schedule

The contractor shall provide a project schedule for all tasks, monthly reports, draft and finalreports identified within this sub task to be completed not later than 80 days from award. Withthe exception of the deliverable identified in Section 3.2 of this sub task, one copy of eachdeliverable shall be provided as required electronically to the NRC CSA SITSO or his designee.All report formats not identified in this sub task must be agreed to by the NRC before the reportsare delivered. Deliverables shall be considered accepted by NRC if no edits have been sent toContractor dated within five business days of receipt.

Personnel

The Contractor shall assign a single individual to serve as the primary point of contact andproject manager to support this sub task. All Contractor personnel will be knowledgeable in oneor more disciplines directly related to information. All personnel working on this sub task mustbe pre-approved by the NRC.

Access to classified information is required. Since information protection is a very sensitiveissue, Contractor personnel must have an approved background check that corresponds to theNRC information they need access too. It is anticipated that the Contractor will need an NRC"L" clearance.

Subtask 8: Automated Compliance

The phases for the initiative are

a. Phase 1 -Contractor will conduct a Best Practice/Configuration Review of theNRC's nCircle implementation and will provide configuration changes that shouldbe made to more effectively use the tool.

b. Phase 2 - Contractor will develop two (2) templates that can be utilized with theNRC's nCircle implementation to assess NRC information technology resourcesin an automated fashion ensuring the resources address federally mandated andNRC defined cyber security requirements.

c. Phase 3 - Contractor will develop six (6) templates that can be utilized with theNRC's nCircle implementation to assess NRC information technology resourcesin an automated fashion ensuring the resources address federally mandated andNRC defined cyber security requirements.

d. Phase 4 - Contractor will develop six (6) templates that can be utilized with theNRC's nCircle implementation to assess NRC information technology resourcesin an automated fashion ensuring the resources address federally mandated andNRC defined cyber security requirements.

Phase DetailThe following describe each phase and identifies the services that the contractor is expectedto provide.

Phase 1 - Perform Best Practices/Configuration Review (Optional)

The Best Practices/Configuration Review includes the contractor's investigation of theimplementation of the nCircle within the NRC environment, covering specific aspects ofthe configuration, reporting, management processes, and maintenance of the nCirclesuite of tools. The review will investigate NRC's deployment from two majorperspectives:

" Technology - the configuration of the software itself.

" Processes and Workflow - the scanning, reporting, and remediation lifecycle.

Technoloqgy

The contractor will use a combination of hands-on investigation, reviews of availableprocess documentation, and interviews with key stakeholders to conduct the review.The contractor will carefully manage the level of detail to ensure all topics are addressedat least at a high level. The following are the standard topic areas that will be included inthis review:

-Tonig reatConfiguration Review NRC's goals and expectations forAuditing Configuration Auditing Goals configuration auditing.Program

Review status and resolution of all nCircle supportTicket Revietickets since the last tune up.

Operations -Review any outstanding issues as noted by NRC

Operational Issues staff.

Review deployment of scan engines,

Architecture Architecture Review management servers, and SQL databases andcompare against best practices; suggestimprovements as needed.

Review naming conventions and structure forNetwork network profiles, asset groups, and meta-assetProfiles Naming Conventions groups and compare to best practices; determine

optimal settings for nCircle's Intelligence Hub if in

use.

Asset Review licensed assets and recommend theLicensing License Cleanup removal of invalid or obsolete assets to free up

license capacity.

Auto Auto Group Configuration Review configuration of auto-grouping andGrouping recommended improvements as needed.

ustom CReview custom properties against business needsProperties Custom Property Creation and recommend improvements.

Toi Are Tas Decito

Port Profiles Port Profile ConfigurationReview port profiles in use and recommend waysto optimize discovery and performance.

s Risk Level Configuration Review assigned risk levels and ensure they mapRisk Levels Rto business needs.

Scan Credentials Configuration Review structure and use of credentials forCCredentials scanning and compare to best practices.

Scan Engines DNS Server Configuration Review DNS settings and validate domain nameresolution functionality.

Security Audit Log ConfigurationReview NRC's audit requirements and compareagainst audit log settings.

User Review configuration of the nCircle users and

Management User and Roles Review roles, and the permissions granted; compare tobest practices.

Software Review any issues or improvements delivered byUpgrades Current Version Installation newer versions of the nCircle product.

System Health Events Review any system health events.Health

Review configuration of Checkpoint, NAC, HPThird Party Third Party Configuration CMDB, Remedy, and Vulnerability ScannerIntegration settings.

Review configuration of discovery ping sweepsDiscovery Ping Sweep including TCP SYN, ARP, etc. and compareConfiguration against best practices.

Review configuration of port scans includingbanner checking, OS socket usage, NMAP

Port Scan Configuration fingerprints, etc. and compare against best

practices.

Review configuration of advanced scancategories, including Antivirus settings, file

ced Scan Configuration monitoring for both Windows and UNIX, OracleConfiguration database instance configuration, Users

configuration, etc. and compare against NRC'sneeds and best practices.

Review configuration of host informationGather Host Information gathering, including fingerprinting, NetBIOSConfiguration probes, and DNS settings and compare against

best practices.

Web Content Scan Review configuration of web content scanning,WConiuontent Scincluding paths, crawling, ports, and page depth,Configuration and compare against best practices.

Review configuration and operation of theDashboard Dashboard Configuration nCircle's dashboard; validate settings and test

NRC's implementation of the dashboard.

CompliancePolicies

Compliance PolicyConfiguration

Review usage of nCircle policies and compare tobest practice; suggest improvements or additionalscanning based on typical peer groupconfigurations.

Review design and functionality of custom testsCustom Test Usage implemented at the NRC.

Review NRC use of "Create Policy from Asset"Create Policy From Asset capabilities; assist with the creation of policiesUsage from Gold image systems as required.

Review NRC use of nCircle reports and compareReports Report Usage to best practices.

Integration External System Integration Review capabilities for integration with externalProposals systems (ArcSight, Remedy, etc.)

Roadmap Presentation Discuss future capabilities and estimatedtimeframes for future versions of the nCircle.

RoadmapDocument NRC feature requests and submit

Feature Requests tickets for tracking and follow up.

Operations Best Practice Review findings and provide documentationRecommendations detailing what needs to be done.

Overall Tool Assess the overall tool Determine if any tool configuration changes couldConfiguration configuration be made to improve tool effectiveness

As the contractor identifies quick fix recommendations during the review, the contractorwill document these changes and provide them to NRC. Most of the quick fixrecommendations will fall into the category of tuning, i.e. adjustments to the nCircleconfiguration parameters that can be implemented very quickly. There will likely beother needed changes identified that will be longer range in scope, especially if theseentail modifications to NRC's current processes and workflow.

Processes and Workflow

The contractor will review NRC's processes and workflow surrounding NRC's use of thenCircle and other tools that might be involved in remediation of vulnerabilities andcompliance issues. This investigation covers key questions such as:

" Are current nCircle processes understood and followed?

" Will current nCircle processes be able to scale as the nCircle implementation isextended to other network segments and to include additional templates?

" What other impediments exist to achieving full nCircle deployment and how canthese be mitigated?

" Is there significant manual effort that could be addressed through increasedautomation?

During the review, the contractor will work with NRC staff directly responsible for theday-to-day administration and management of the nCircle, to provide focused knowledgetransfer on topics of interest or concern to NRC. During this knowledge transfer, thecontractor will demonstrate and explore key concepts in the nCircle allowing for technicalQ&A from NRC staff.

The contractor will conduct a technical debrief for NRC staff, covering the major findingsand recommendations arising from the Best Practices/Configuration Review for thenCircle implementation. The contractor will discuss the modifications and optimizationrecommendations interactively with NRC.

The contractor will document all review findings and recommendations and will providethese to NRC in a narrative document, covering all the topic areas addressed during thereview.

List of Deliverables

The contractor will provide the following Deliverable(s) to NRC during this phase:

DELIVERABLE. DESCRIPTIONFindings and INarrative document covering topic areasRecommendations Report I addressed during the configuration review and

associated recommendations

Completion Criteria

The contractor will have fulfilled all of their responsibilities under this task upon NRC'sacceptance of a final Findings and Recommendations Report.

Schedule and Work Location

The contractor will perform the review during a single visit to the NRC's offices inRockville, MD. The schedule for the on-site portion of the review will be confirmed bymutual agreement between the contractor and NRC.

NRC Responsibilities

In order for the contractor to successfully perform the Services described in this task, thecontractor requests the following from NRC:

1. Provide a conference room for meetings between the contractor staff and NRCstaff

2. Provide adequate workspace facilities for contractor staff while working on site

3. Provide access to test and/or production implementations of nCircle.

4. Assign and engage review participants (subject matter experts) to work with thecontractor to provide requirements and validate finding

5. Ensure some review participants are familiar with NRC's specific implementationof nCircle and can provide detailed technical information about NRC's currentimplementation of the tool and the networks being scanned.

Phase 2- Develop two (2) nCircle Templlate~s (Optional)

The contractor will develop two (2) nCircle Templates that will be used in conjunctionwith the nCircle tool to assess NRC information technology resources in an automatedfashion ensuring the resources address federally mandated and NRC defined cybersecurity requirements. NRC will provide the NRC defined cyber security requirementsthat must be incorporated into the nCircle templates.

The templates developed by the contractor must be approved by the NRC before theyare considered complete.

The contractor will provide the following Deliverable(s) to NRC during this phase:

DELIVERABLE DESCRIPTION

Develop two (2) nCircle Templates that work with NRC'stemplates that reflect NRC implementation of nCircle to assessdefined cyber security implementation compliance against NRCrequirements specific cyber security requirements.

Phase 3 - Develop six (6) nCircle Templates (Optional)

The contractor will develop six (6) nCircle Templates that will be used in conjunction withthe nCircle tool to assess NRC information technology resources in an automatedfashion ensuring the resources address federally mandated and NRC defined cybersecurity requirements. NRC will provide the NRC defined cyber security requirementsthat must be incorporated into the nCircle templates.

The templates developed by the contractor must be approved by the NRC before theyare considered complete.

The contractor will provide the following Deliverable(s) to NRC during this phase:

DELIVERABLE DESCRIPTIONDevelop six (6) nCircle Templates that work with NRC'stemplates that reflect NRC implementation of nCircle to assessdefined cyber security implementation compliance against NRCrequirements specific cyber security requirements.

Phase 4 - Develop six (6) nCircle Templates (Optional)

The contractor will develop six (6) nCircle Templates that will be used in conjunction withthe nCircle tool to assess NRC information technology resources in an automatedfashion ensuring the resources address federally mandated and NRC defined cybersecurity requirements. NRC will provide the NRC defined cyber security requirementsthat must be incorporated into the nCircle templates.

The templates developed by the contractor must be approved by the NRC before theyare considered complete.

The contractor will provide the following Deliverable(s) to NRC during this phase:

DELIVERABLE DESCRIP ION

Develop six (6) nCircle Templates that work with NRC'stemplates that reflect NRC implementation of nCircle to assessdefined cyber security implementation compliance against NRCrequirements specific cyber security requirements.

Develop six (6) nCircle Templates that work with NRC'stemplates that reflect NRC implementation of nCircle to assessdefined cyber security implementation compliance against NRCrequirements specific cyber security requirements.

5.0 TRAVEL

Travel may be required for this effort and should not exceed $20K per year.

6.0 MEETINGS

As needed, the Contractor's Project Manager and technical lead shall attend status meetings atNRC Headquarters to discuss issues and work being performed under this task order.

NRC-HQ-11-14-T-0002 Price Schedule

Labor Category Labor Rate Hours Cost

Program Manager $153.98 100 $15,398.00

Project Manager $138.09 960 $132,566.40

Computer Forensic and Intrusion Analyst $252.56 100 $25,256.00

Sr. Cyber Security Consultant $241.95 100 $24,195.00

Senior INFOSEC Engineer $209.86 400 $83,944.00

Security Specialist IV $163.59 5640 $922,647.60

Security Specialist Ill $144.47 100 $14,447.00

Security Specialist II $138.09 2200 $303,798.00

Security Specialist I $116.09 100 $11,609.00

Documentation Specialist $91.22 2200 $200,684.00

Information Engineer $85.28 200 $17,056.00

Technical Writer II $67.33 1880 $126,580.40

Technical Writer I $44.39 960 $42,614.40

LABOR TOTAL $1,920,795.80NTE TRAVEL TOTAL $20,000.00

GRAND TOTAL $1,940,795.80

.U.S.NRCAa.- , gha.dg , C1. INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALS/LABOR-HOUR TYPE CONTRACTS (MAY 2013)

General: During performance and through final payment of this contract, the contractor isresponsible for the accuracy and completeness of data within the System for AwardManagement (SAM) database and for any liability resulting from the Government's reliance oninaccurate or incomplete SAM data.

The contractor shall prepare invoices/vouchers for reimbursement of costs in the manner andformat described herein. FAILURE TO SUBMIT INVOICESNOUCHERS IN ACCORDANCEWITH THESE INSTRUCTIONS WILL RESULT IN REJECTION OF THE INVOICENOUCHERAS IMPROPER.

Standard Forms: Claims shall be submitted on the payee's letterhead, invoice/voucher, or onthe Government's Standard Form 1034, "Public Voucher for Purchases and Services Other thanPersonal," and Standard Form 1035, "Public Voucher for Purchases Other than Personal--Continuation Sheet."

Electronic Invoice/Voucher Submissions: The preferred method of submittingvouchers/invoices is electronically to the U.S. Nuclear Regulatory Commission, via email to:NRCPaymentstanrc..ov.

Hard-Copy Invoice/Voucher Submissions: If you submit a hard-copy of the invoice/voucher,a signed original and supporting documentation shall be submitted to the following address:

NRC PaymentsU.S. Nuclear Regulatory CommissionOne White Flint North11555 Rockville PikeMailstop 03-E17ARockville, MD 20852-2738

Purchase of Capital Property: ($50,000 or more with life of one year or longer)

Contractors must report to the Contracting Officer, electronically, any capital property acquiredwith contract funds having an initial cost of $50,000 or more, in accordance with procedures setforth in NRC Management Directive (MD) 13.1, IV, C- "Reporting Requirements" (revised2/16/2011).

Agency Payment Office: Payment will continue to be made by the office designated in thecontract in Block 12 of the Standard Form 26, or Block 25 of the Standard Form 33, whicheveris applicable.

Frequency: The contractor shall submit claims for reimbursement once each month, unlessotherwise authorized by the Contracting Officer.

S- U.S.NRCtl-d~s.. N.s&- k.S- Ca..-or1,-,ý Papk and ,*r,,,,sINVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIM E-AND-MATERIALS/LABOR-HOUR TYPE CONTRACTS (MAY 2013)

Format: Invoices/Vouchers shall be submitted in the format depicted on the attached sampleform entitled "Invoice/Voucher for Purchases and Services Other Than Personal". Alternateformats are permissible only if they address all requirements of the Billing Instructions. Theinstructions for preparation and itemization of the invoice/voucher are included with the sampleform.

Task Order Contracts: The contractor must submit a separate invoice/voucher for eachindividual task order with detailed cost information. This includes all applicable cost elementsand other items discussed in paragraphs (a) through (q) of the attached instructions. Inaddition, the invoice/voucher must specify the contract number, and the NRC-assignedtask/delivery order number.

Billing of Costs after Expiration of Contract: If costs are incurred during the contract periodand claimed after the contract has expired, you must cite the period during which these costswere incurred. To be considered a proper expiration invoice/voucher, the contractor shallclearly mark it "EXPIRATION INVOICE" or "EXPIRATION VOUCHER".

Final invoices/vouchers shall be marked "FINAL INVOICE" or "FINAL VOUCHER".

Currency: Invoices/Vouchers must be expressed in U.S. Dollars.

Supersession: These instructions supersede previous Billing Instructions for Time-and-Materials/Labor-Hour Type Contracts (July 2011).

S1U.S.NRCU-dt S-. Nu-kr., la~r C -n 1-1-r

htmu- •au,,, w,,, INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALSILABOR-HOUR TYPE CONTRACTS (MAY 2013)

INVOICE/VOUCHER FOR PURCHASES AND SERVICES OTHER THAN PERSONAL(SAMPLE FORMAT - COVER SHEET)

1. Official Agency Billing Office

NRC PaymentsU.S. Nuclear Regulatory CommissionOne White Flint North11555 Rockville PikeMailstop 03-E17ARockville, MD 20852-2738

2. Invoice/Voucher Information

a. Payee's DUNS Number or DUNS+4. The Payee shall include the Payee's Data UniversalNumber (DUNS) or DUNS+4 number that identifies the Payee's name and address. TheDUNS+4 number is the DUNS number plus a 4-character suffix that may be assigned at thediscretion of the Payee to identify alternative Electronic Funds Transfer (EFT) accounts for thesame parent concern.

b. Payee's Name and Address. Show the name of the Payee as it appears in the contract andits correct address. If the Payee assigns the proceeds of this contract as provided for in theassignment of claims terms of this contract, the Payee shall require as a condition of any suchassignment, that the assignee shall register separately in the System for Award Management(SAM) database at http://sam.gov and shall be paid by EFT in accordance with the terms of thiscontract. See Federal Acquisition Regulation (FAR) 52.232-33(g) Payment by Electronic FundsTransfer - Central Contractor Registration (October 2003).

c. Taxpayer Identification Number. The Payee shall include the Payee's taxpayer identificationnumber (TIN) used by the Internal Revenue Service (IRS) in the administration of tax laws.(See IRS Web site:http://www.irs.gov/Businesses/Small-Businesses-&-Self-Employed/Employer-ID-Numbers-(EINs)).

d. Contract Number. Insert the NRC contract number (including Enterprise-wide Contract(EWC)), GSA Federal Supply Schedule (FSS), Governmentwide Agency Contract (GWAC)number, or Multiple Agency Contract (MAC) number, as applicable.

e. Task Order Number. Insert the task/delivery order number (If Applicable). Do not includemore than one task order per invoice or the invoice may be rejected as improper.

S-U.S.NRC•wh•,-,br,'a,*,, ,w, INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALS/LABOR-HOUR TYPE CONTRACTS (MAY 2013)

f. Invoice/Voucher. The appropriate sequential number of the invoice/voucher, beginning with001 should be designated. Contractors may also include an individual internal accountingnumber, if desired, in addition to the 3-digit sequential number.

g. Date of Invoice/Voucher. Insert the date the invoice/voucher is prepared.

h. Billing period. Insert the beginning and ending dates (day, month, year) of the period duringwhich costs were incurred and for which reimbursement is requested.

i. Labor Hours Expended. Provide a general summary description of the services performedand associated labor hours utilized during the invoice period. Specify the Contract Line ItemNumber (CLIN) or SubCLIN, as applicable, and information pertaining to the contract's laborcategories/positions, and corresponding authorized hours.

j. Property. For contractor acquired property, list each item with an initial acquisition cost of$50,000 or more and provide: (1) an item description, (2) manufacturer, (3) model number,(4) serial number, (5) acquisition cost, (6) date of purchase, and (7) a copy of the purchasingdocument.

k. Shipping. Insert weight and zone of shipment, if shipped by parcel post.

I. Charges for freight or express shipments. Attach prepaid bill if shipped by freight or express.

m. Instructions. Include instructions to consignee to notify the Contracting Officer of receipt ofshipment.

n. For Indefinite Delivery contracts, the final invoice/voucher shall be marked "FINAL INVOICE"or "FINAL VOUCHER".

o. Direct Costs. Insert the amount billed for the following cost elements, adjustments,suspensions, and total amounts, for both the current billing period and for the cumulative period(from contract inception to end date of this billing period).

(1) Direct (Burdened) Labor. This consists of salaries and wages paid (or accrued)for direct performance of the contract itemized, including a burden (or load) for indirectcosts (i.e., fringe, overhead, General and Administrative, as applicable), and profitcomponent, as follows:

Labor Hours Burdened CumulativeCategory Billed Hourly Rate Total Hours Billed

j U.S.NRChlu 1k*1rug&,,,E,, INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALS/LABOR-HOUR TYPE CONTRACTS (MAY 2013)

(2) Contractor-acquired property ($50,000 or more). List each item costing $50,000or more and having a life expectancy of more than one year. List only those items ofequipment for which reimbursement is requested. For each such item, list the following(as applicable): (a) an item description, (b) manufacturer, (c) model number, (d) serialnumber, (e) acquisition cost, (f) date of purchase, and (g) a copy of the purchasingdocument.

(3) Contractor-acquired property (under $50,000), Materials, and Supplies. Theseare equipment other than that described in (2) above, plus consumable materials andsupplies. List by category. List items valued at $1,000 or more separately. Provide theitem number for each piece of equipment valued at $1,000 or more.

(4) Materials Handling Fee. Indirect costs allocated to direct materials in accordancethe contractor's usual accounting procedures.

(5) Consultant Fee. The supporting information must include the name, hourly ordaily rate of the consultant, and reference the NRC approval (if not specifically approvedin the original contract).

(6) Travel. Total costs associated with each trip must be shown in the followingformat:

Start Date Destination CostsFrom To From To $

(Must include separate detailed costs for airfare, per diem, and other transportationexpenses. All costs must be adequately supported by copies of receipts or otherdocumentation.)

(7) Subcontracts. Include separate detailed breakdown of all costs paid to approved

subcontractors during the billing period.

p. Total Amount Billed. Insert columns for total amounts for the current and cumulative periods.

q. Adiustments. Insert columns for any adjustments, including outstanding suspensions forunsupported or unauthorized hours or costs, for the current and cumulative periods.

r. Grand Totals.

Ij U.S.NRC1U-2 5- N-duk-Awe7 -- INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALSILABOR-HOUR TYPE CONTRACTS (MAY 2013)

3. Sample InvoiceNoucher Information

Sample Invoice/Voucher Information (Supporting Documentation must be attached)

This invoice/voucher represents reimbursable costs forthe billing period from through

Amount BilledCurrent Period Cumulative

(a) Direct Costs

(1) Direct burdened labor(2) Government property ($50,000 or more)(3) Government property, Materials, and

Supplies (under $50,000 per item)(4) Materials Handling Fee(5) Consultants Fee(6) Travel(7) Subcontracts

Total Direct Costs:

(b) Total Amount Billed

(c) Adjustments (+/-)

$$

$$$$$

$

$.

$

$

$$

$$$$$

$.

$

$.

$(d) Grand Total

(The invoice/voucher format provided above must include information similar to that includedbelow in the following to ensure accuracy and completeness.)

SAMPLE SUPPORTING INFORMATION

The budget information provided below is for format purposes only and is illustrative.

Cost Elements:

1) Direct Burdened Labor - $4,800

LaborCategory

HoursBilled

BurdenedRate

CumulativeHours BilledTotal

StU.S.NRCINVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALSILABOR-HOUR TYPE CONTRACTS (MAY 2013)

Senior Engineer I 100 $28.00 $2,800 975Engineer 50 $20.00 $1,000 465Computer Analyst 100 $10.00 $1,000 320

$4,800 1,760 hrs.

Burdened labor rates must come directly from the contract.

2) Government-furnished and contractor-acquired property ($50,000 or more) - $60,000

Prototype Spectrometer - item number 1000-01 = $60,000

3) Government-furnished and contractor-acquired Property (under $50,000), Materials, andSupplies - $2,000

10 Radon tubes @ $110.00 = $1,1006 Pairs Electrostatic gloves @ $150.00 = $ 900

$2,0004) Materials Handlinq Fee - $40

(2% of $2,000 in item #3)

5) Consultants' Fee - $100

Dr. Carney - 1 hour fully-burdened @ $100 = $100

6) Travel - $2,640

(i) Airfare: (2 Roundtrip trips for 1 person @ $300 per r/t ticket)

Start Date End Date Days From To Cost4/1/2011 4/7/2011 7 Philadelphia, PA Wash, D.C. $3007/1/2011 7/8/2011 8 Philadelphia, PA Wash, D.C. $300

(ii) Per Diem: $136/day x 15 days = $2,040

7) Subcontracting - $30,000

Company A = $10,000Company B = $20,000

$30,000

(EX: Subcontracts for Companies A & B were consented to by the Contracting Officerby letter dated 6/15/2011.)

U.S.NRCr-IpandrbEmu INVOICE FORMAT FOR LH AND TM

Version Control Date: May 2, 2013

ATTACHMENT

BILLING INSTRUCTIONS FORTIME-AND-MATERIALS/LABOR-HOUR TYPE CONTRACTS (MAY 2013)

Total Amount Billed $99,580Adjustments (+/-) 0Grand Total $99,580

4. Definitions

Material handling costs. When included as part of material costs, material handling costs shallinclude only costs clearly excluded from the labor-hour rate. Material handling costs mayinclude all appropriate indirect costs allocated to direct materials in accordance with thecontractor's usual accounting procedures.