|
Permanent Note: On May 1, 2006, the Interim Internal Purchasing Guidelines were replaced by the Postal Service’s Supplying Principles and Practices (SPs and Ps).
Effective September 1, 2021, the following parts and sections of the SPs and Ps have been revised:
1— Identify Needs
- 1-14.2, Issue RFI, has been revised to reflect the change in publicizing of RFPs to the new Government-wide Point of Entry, System for Award Management (https://sam.gov).
2 — Evaluate Sources
5 — Measure and Manage Supply
7 — General Practices
- 7-7.1.19, Clauses and Provisions, is revised to 7-7.1.19, National Defense Authorization Act (NDAA) Section 889, implementing the fundamental aspects of Section 889(a)(1)(A) prohibiting contracting for certain telecommunications and video surveillance services or equipment from the covered foreign country, The People‘s Republic of China, for the purpose of public safety, security of facilities, physical security surveillance, and other security purposes.
- 7-7.1.19.1, General, is new and establishes the Postal Services’ voluntary compliance with the fundamental aspects of the Act; the prohibition; and the related provision and clause.
- 7-7.1.19.2, Definitions, is new and provides the definitions to terms used within the guidance, provision, and clause.
- 7-7.1.19.3, Exceptions and Waivers, is new and describes the exceptions to the prohibition and waiver considerations.
- 7-7.1.19.4, Eligibility, is new and requires contracting officers to review and confirm the selected offeror’s eligibility for award in https://sam.gov. This review must include the list of entities excluded from receiving federal awards for “covered telecommunications equipment or services.” Additionally, offerors must review the list of excluded parties in SAM for the same purpose and complete the certification found in Provision 7-6: Covered Telecommunications Equipment Certificate. This certification must be provided by the offeror as part of the proposal and resubmitted whenever the resulting contract is modified by adding services or equipment for performance, or the Postal Service elects to exercise an available option.
- 7-7.1.19.5, Disclosure Requirements, is new and describes the disclosure processes and roles for when contracting officers, internal business partners, or suppliers identify covered telecommunications equipment or services used as a substantial or essential component of any system, during contract performance.
- 7-7.1.19.6, Other Topics Considered, is revised to add a reference to section 8-4, Information Technology.
- 7-7.1.20, Clauses and Provisions, is revised to add a reference to new Provision 7-6: Covered Telecommunications Equipment Certificate, and new Clause 7-19: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.
- 7-9.2, Characterizing the Material and Property is revised to increase the capital property dollar threshold from $3,000 to $10,000.
- 7-13, Supply Chain Security, is revised to incorporate a new guide, the Postal Service Information Security Requirements for Suppliers, issued by Corporate Information Security Office (CISO) to be included within solicitations by any Supply Management Category Management Center (CMC) where information and information resources are being procured or shared. This section is also revised to update the references to applicable provisions and clauses.
- 7-14, Privacy Considerations, is revised to remove the reference to Handbook AS-805 Information Security and update the references to applicable provisions and clauses.
8 — Commodity Specific
- 8-4.1, Definitions, is revised to incorporate additional definitions.
- 8-4.2, Technical Standards, title is revised from 8-4.2 General.
- 8-4.3, Accessibility, is revised to incorporate 8-4.4, Documentation as 8-4.3.5, Documentation, and add subsection numbering.
- 8-4.4, Information Technology Guidance, title is revised from 8-4.5, Information Technology Guidance and subsection numbering was added.
- 8-4.5, Security Considerations, title is revised from 8-4.6, Security Considerations and incorporate additional guidance regarding CISO’s policies and procedures.
- 8-4.6, Technological Substitutions and Enhancements, is revised to add subsection numbering and the title is revised from 8-4.7, Technological Substitutions and Enhancements.
- 8-4.7, Sources, title is revised from 8-4.8, Sources.
- 8-4.8, Solicitation Provisions, title is revised from 8-4.9, Provisions, and title of Provision 4-10: Application of Information Security Requirements was revised from Provision 4-10: Information Security Requirements.
- 8-4.9, Clauses, title was revised from 8-4.10, Clauses, prescriptions were added for new clauses.
- 8-4.10, Other Topics Considered, is revised to incorporate a reference to Section 7-13, Supply Chain Security, and title is revised from 8-4.11, Other Topics Considered.
9 — Solicitation Provisions
- Provision 1-1: Supplier Clearance Requirements is revised to replace the word “offices” to “offers” within the second paragraph of the provision.
- Provision 4-3: Representations and Certifications is revised to eliminate duplicate paragraphs under e. Certification Regarding Debarment, Proposed Debarment, and Other Matters, (1)(d) and (e). The date of the clause remains as (October 2019).
- Provision 4-7 : Postal Computing Environment, is revised to delete reference to Handbook AS-820, Postal Computing Environment which is an obsolete handbook.
- Provision 4-10: Application of Information Security Requirements, is revised to remove reference to Handbook AS-805, Information Security, and replaces it with the Postal Service Information Security Requirements for Suppliers guide. Retains the language for the Handbook AS-805-A, Information Resource Certification and Accreditation Process. Provides new language on actions to be taken by a supplier in the event of an actual or suspected security incident on its network(s) or systems. And, provides for the pre-award and post-award risk assessments, and post-award risk remediation and monitoring requirements.
- Provision 7-6: Covered Telecommunications Equipment Certificate, is new and requires offerors to review the list of excluded parties in the System for Award Management (SAM) at: https://sam.gov for entities excluded from receiving federal awards for “covered telecommunications equipment or services.” It requires offerors to certify that each end product to be provided to the Postal Service or used by the offeror to perform services for the Postal Service, except those identified, does not include any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system. The certification must be provided as part of the proposal and resubmitted whenever the resulting contract is modified by adding services or equipment, or the Postal Service elects to exercise an available option.
10 — Clauses
- Clause B-9: Claims and Disputes, is revised to re-instate the version date of March 2006. The date was omitted in February 2018 update of the SPs and Ps.
- Clause 2-20: Option Period, the word “or” is deleted from the second sentence to correct a material typographical error. A contracting officer may exercise an option by giving the supplier at least 60 days written notice.
- Clause 4-1: General Terms and Conditions, has minor revisions.
- Clause 4-19: Information Security Requirements, title is revised from Clause 4-19: Information Security Requirements Resource. Information regarding Handbook AS-805, Information Security, is removed and prescribes the use of the Postal Service Information Security Requirements for Suppliers guide be used in solicitations where information and information resources are being procured. Requirements for incident response and mitigation are also described within the clause. The security requirements are applicable to the supplier and its subcontractors. Reference to Handbook AS-805-A, Information Resource Certification and Accreditation Process, is removed and incorporated within new Clause 4-22: Certification and Accreditation of Information Systems.
- Clause 4-21: Supplier Security Risk Assessment, is new and incorporates post-award supplier risk assessment process, and risk mitigation process.
- Clause 4-22: Certification and Accreditation of Information Systems, is new and includes language from original Clause 4-19: Information Security Requirements Resources regarding the Postal Service’s certification and accreditation (C&A) process. In addition, the clause provides for the ability of the Postal Service to perform Site Security Reviews, where Postal Service data will be stored or the ability for a supplier to submit a Service Organization Control Type II (SOC 2) report.
- Clause 4-23: Cloud Computing Security Requirements, is new and incorporates the security requirements for cloud computing. [Do not see this addition]
- Clause 7-19: Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment, is new and provides the definitions used for the Act; the prohibition and its exceptions; considerations for requesting a waiver of the prohibition; the supplier’s reporting requirements; and the necessity for the supplier to flow the clause down to their subcontractors.
|
|