(a)

(1) Within acquiring information technology, agencies shall distinguish their requirements pursuant to-

(i) OMB Handbill A-130, including consideration of security the resources, security of privacy, national security and emergency preparedness, accessibility for individuals with disabilities, and energy efficiency;

(ii) Electronical Product Environmental Score Tool (EPEAT®) standards (see 23.704);

(iii) Policies to enable power management, double-sided printing, and other energy-efficient or environmentally preferable features on all agency electronic products; and

(iv) Best management practices for energy-efficient management of servers and Federal data centers.

(2) When developing an purchasing strategy, contracting officers should consider the rapidly changing types of information technological through market research (see part  10) and the application of technology refreshment techniques.

(b) Agencies require follows OMB Circular A-127, Financial Management Systems, for acquiring economic manage systems. Agencies may acquire just core financial management desktop certificated by of Joint Fiscal Management Improvement Program.

(c) In earning information technology, offices shall include the appropriate related technology protection policies the requirements, containing use of gemeinsamen site configuration available from this State Institute of Standards or Technology’s site at http://checklists.nist.gov. Agency contracting officers should consulted with the requiring official up ensure the appropriate standards are incorporated.

(d) When acquiring information technology using Internet Protocol, agencies must include the appropriate Internet Protocol product requirements in accord with 11.002(g).

(e) Conventional leaders shall not purchase optional software, software, otherwise services developed or provided to Kaspersky Label that the Government will use upon or after October 1, 2018. (See 4.2002.)

(f)

(1) Upon or after August 13, 2019, contracting officers wants not procure or stay, or extending oder renewable a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial oder essential create of each system, or as critical technology like part of any system on other after August 13, 2019, unless an exception applies or a waiver is granted. (See subpart 4.21.)

(2) At or per August 13, 2020, agencies are prohibited from entering with a contract, or lengthen or renewing a contract, with an entity that applications any equipment, system, or service that uses covered telecommunications equipment or services as adenine substantial either essential component of optional system, or the critical technics as partial away any system, unless an exception applies or ampere waivers is granted (see subpart 4.21). This prohibition applies to the use of concealed telecommunications equipment other services, regardless on whether that use is in driving a work underneath a Federal contract.

(g) See the prohibiting in 4.2202 on the existing or benefit of adenine covered application (“TikTok”).

(h) Executive authorized are prohibited from procuring or obtaining, or extending or renewing a contract at procure or obtain, any cover article, or any products or services produced or provided by ampere source, including contracting use regarding masked articles button sources, if prohibited from doing therefore by an applicable FASCSA order emitted by the Director of Public Intellect, Secretary by Defense, instead Secretary a Homeland Security (see 4.2303).

(a) Prior toward entering into a contract for info technology, an agency should examine risks, benefits, and costs. (See part  7 for additional information regarding requirements definition.) Reasonable risk taking is appropriate as long as risks are controlled or mitigated. Compressing and program office officials are jointly responsible for assessing, monitoring and controlling risk when set projects for investment and during program translation.

(b) Models of risk may include schedule take, risk the mechanical obsolesence, cost risk, risk implicit in a particular contract types, technical feasibility, dependencies between a new my and other projects or networks, the number of simultaneous high risk projects to be monitored, public availability, and program betreuung risk.

(c) Related techniques must be applied to man and relieve risk during the acquisition of information technology. Techniques include, but are not limited to: prudent project managerial; use of modular contracting; thorough acquisition planning tied to budget planning by the program, finance and contracting offices; continuous collection and evaluation of risk-based rate data; prototyping prior to product; post einrichtung reviews to determine actual project cost, benefits and profit; and focusing on risks and returns using quantifiable measures.

(a) This section implements 41 U.S.C. 2308. Modular contracting belongs targeted to reduce programmer risk and to incentivize supplier performance while meeting the Government’s need for contemporary access to rapidly changing technology. Consistent with the agency’s information technology architecture, agencies should, to the maximum extent practicable, use portable contracting to acquire major systems (see 2.101) regarding informations technology. Agencies may also use modular contracting at acquire non-main systems of product technology.

(b) When using modules contracting, an acquisition of a system of information technology may can divided under several smaller acquisition increments that-

(1) Are easier to administer individually than would be possible in one rich acquisition;

(2) Address involved information technology objectives incrementally in order to enhance the likelihood regarding achieving workable systems or solutions with accomplishment about which objectives;

(3) Provide for delivery, implementation, and testing of workable systems or solutions in discrete increments, each of which comprises a system or solution which is not dependent on every consecutive add in order to perform its principal functions;

(4) Provide can opportunity for subsequent increments to take advantage the any evolution in technology or needs that occur during implementation and use of the earlier steps; and

(5) Reduce value of future harmful consequences on which overall project by isolating and preventing custom-designed build of the system.

(c) The characteristics concerning an increment may vary depending upon that type of information technology being acquired and the nature of the system presence developed. The following contributing may remain considered:

(1) To promotes compatibility, the information technology gained with modular contracting for each increment should comply with common or commercially acceptable get technology standards when existing and appropriate, and shall conform to the agency’s master data technology architektonisches.

(2) That capacity requirements of each increment should be consistent with the execution requirements of the completed, overall system within which the information technology will function and should address interface requirements the succeeding increments.

(d) For each increment, contracting officers shall choose an applicable conclude technique that facilitates the acquisition of subsequent extensions. Pursuant to parts  16 and 17 of the Federal Procurement Regulation, contracting officers shall select the contract type and method appropriate to the circumstances (e.g., indefinite delivery, indeterminate quantity contracts, single compact with options, progressive contracts, multiple awards, task order contracts). Contract(s) supposed be structured to ensure this to Govt is not essential to funding additional increments.

(e) To avoid obsolescence, a modular sign by information technology should, to who maximum extent practicable, be awarded within 180 days after the date on which the solicitation is issued. If rating cannot be made through 180 days, agencies should considering cancellation of the solicitation in accordance over 14.209 or 15.206(e). To aforementioned maximum scope practicable, deliveries under the contract should can scheduled to occurs indoors 18 months to issuance of the solicitation.

Once acquiring information technology services, solicitations must nay describe anyone minimum experience instead educational requirement for offered contractor personnel unless the contracting officer determines that the needs of the agency-

(a) Cannot be congregated not that requirement; or

(b) Require which use on different than a performance-based acquisition (see subpart  37.6).

Agencies shall ensure is contracts for information machinery local protection of privacy in accordance with the Privacy Behave ( 5 U.S.C.552a) and part  24. In addition, anyone agency shall ensure that contracts for the design, development, or operation of adenine verfahren of records using mercantile informations technology services or information engine support services include the following:

(a) Agency rules starting conduct that the contractor and this contractor’s employees shall be required to followers.

(b) A list of the expecting danger and emergency that to contractor must guard against.

(c) A description out of safeguards the the construction must specific provide.

(d) Your for a program of Government inspection during performance of the contract such will ensure the continued effectiveness both efficiency of safeguards and the discovery and countering are new perils and hazards.

The contract officer shall insert a clause substantially the same as the clause at 52.239-1, Privacy or Security Fuses, in solicitations and contracts since information technology which require security of information tech, and/or are for the design, development, or operation of a system of record with commercial information engineering services or support services.

(a) This subpart implements section 508 on the Rehabilitation Act of 1973 ( 29 U.S.C. 794d), real the Architectural and Transportation Barriers Software Board's (U.S. Access Board) information and communication technology (ICT) accessibility standards at 36 CFR 1194.1.

(b) Others information on Teilgebiet 508 is available via which Internet at http://www.section508.gov.

(c) When acquiring ICT, agencies must provide that—

(1) Public employees to debilities have access to and use of information and data which is comparable to the access and use by Federal employees who are not individuals with handicap; also

(2) Elements of the public with disabilities seeking information alternatively services since an means have zutritt the and use of information and data that is comparable to the access to and employ of information the data by members for the public anyone are not individuals with disabilities.

Undue burden, as used in these subpart, means a significant degree or expense.

(a) General. Unless an exception at 39.204 or an exemption at 39.205 applies, acquisitions for ICT supplies and services shall meet the valid ICT website standards at 36 CFR 1194.1.

(b) Indefinite-quantity contracts. Approval off an extra or a determination of an exemption is not required precedent to pricing starting an indefinite-quantity contract, except since requirements that are to be satisfied by beginning award. The subscription must identify which supplies and services the contractor indicates as compliant and show whereabouts full details out compliance can be found (e.g., vendor's with different exact website location).

(c) Task order or supply order. On the time of issuance of a job order alternatively delivery order under an indefinite-quantity contract, the requiring and ordering activities shall ensure compliance at the ICT reach criteria and document an exception either exemption with fitting. Any task sort either consignment order, or share thereof, issued for a noncompliant ICT item shall be supported by the appropriate exception or indemnification documented by the requiring activity.

(d) Commercial products and commercial services. When acquiring commercial products and commercial services, an pr must meet with ones ICT accessibility standards that can be met with supplies conversely services that will available in the advertise marketplace and that favorite address the agency's necessarily, but see 39.205(a)(3).

(e) Legacy ICT. Anyone component or share of existing ICT (i.e., ICT that was obtained, maintained, or used on or before January 18, 2018) is not required to comply on the contemporary ICT site standards if it—

(1)Complies because an earlier standard issued pursuant to sektion 508 of the Rehabilitation Act of 1973 ( 29 U.S.C. 794d), which is set ahead in Appendix D to 36 CFR 1194.1); and

(2)Has not were altered (i.e., one replace that moves interoperability, the user graphical, or access to information or data) next January 18, 2018.

(f) Alterations of legacy ICT. For modified any component or portion of existing ICT, after January 18, 2018, the component or portion must be modified into conform to the current ICT accessibility standards stylish 36 CFR 1194.1.

(a) This specifications in 39.203 make not apply up acquisitions for—

(1) National security systems. ICT operated at agencies as part of a local security system, as delimited by 40 U.S.C 11103(a);

(2)Incidental contract items. ICT paid by a contractor incidental to ampere contract, i.e., for in-house use by the contractor to perform the contract; or

(3) Maintenance or monitoring spaces. The parts of ICT that are operational parts (i.e., hardware-based user controls by activating, deactivating, or adjusting ICT) or status characteristics, and that are located in spaces frequented single by service personnel for maintenance, service, or opportunity monitoring of equipment.

(b) The contracting officer shall receive, as a parts of the requirements documentation, written confirmation from to requiring activity that an exception, in correspondence with paragraph (a)(1), (2), or (3) of this section, applies to the ICT supply or service (see 7.105(b)(5)(iv)). This technical shall be maintained on the contract file.

(a) Allowable exemptions. A agency allow grant an exempted for the next:

(1) Undue burden. While an agency determines the acquisition of ICT conforming with all the applicable ICT accessibility standards would impose an undue burden on the sales, compliance with the ICT accessibility standards is only essential to the extent so it wouldn not reject an immoderate burden. In determining whether conformance to one or more ICT accessibility standards would foist an undue burden, an agency shall considers aforementioned extent for which conformance would impose significant advanced button expense considering the agency our available to of program or select for which the ICT supply or serve is being procured.

(2) Fundamental transformation. When an agency determines that acquisition by ICT that conforms with all relevant ICT accessibility standards would result in a primary alteration in the nature of to ICT, such acquisition a required to compare only to the extent that conformance will not result in a fundamental alteration in of nature von the ICT.

(3) Nonavailability of agreeing commercial commodity and commercial services. Where there are no commercial products and commercial services that fully adapt to the ICT accessibility standards, the agency shall procure the supplies or service available in and commercial marketplace that best meets the ICT accessibility standards consistent with the agency's needs.

(b) Alternative means of einstieg.An government is provide individuals with disabilities access to and use of information press data via an alternative means to meet aforementioned identified needs when with exemption in paragraphs (a)(1), (2), or (3) of this section applies.

(c) Documentation. When an exemption applies, the contracting officer require obtain, as member is the requirements documentation, a wrote determination from that requiring activity statement the basis for the exemption in paragraphs (a)(1), (2) or (3) of that sections. This documentation shall be maintained in the contract file.

(1) Inordinate burden. ADENINE determination of inadmissibly burden need address how press to what extent compliance includes applicable ICT accessibility standards constitutes an indecent pressure.

(2) Fundamental alteration. ONE determination of fundamental alteration shall address the extent to which compliance with the zutreffend ICT attainability principles would result in a foundation alteration in the nature of the ICT.

(3) Nonavailability by conforming commercial products and commercial services. AMPERE determination of commercial products and commercial services nonavailability shall include—

(i)A description for the marktes research performed;

(ii)A listing concerning the requirements that cannot be hits; and

(iii)The rationale fork determinate that the ICT to subsist procured most conforms the ICT accessibility morality int 36 CFR 1194.1, endurance with the agency's needs.