<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="id195GG20507F"
            audience="GSAR"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title xtrc="GSAR" class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">552.238-109</ph> Authentication
Supplies and Services.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p audience="GSAR" class="- topic/p ">As prescribed in <xref outputclass="fm:ParaNumOnly"
                  href="GSAM-KOSVKQYR.dita#KOSVKQYR"
                  base="KOSVKQYR"
                  class="- topic/xref "/>(d)(33)
insert the following clause:</p>
         <p audience="GSAR" outputclass="Ctr_SmCaps" class="- topic/p ">Authentication Supplies
and Services (May 2019)</p>
         <ol class="- topic/ol ">
            <li props="Runin" audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(a)</ph>  <i class="+ topic/ph hi-d/i ">General background.</i>
               </p>
               <ol class="- topic/ol ">
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(1)</ph>  The
General Services Administration (GSA) established the “Identity
and Access Management Services” (IAMS) Program to clearly define
the kinds of digital certificates and PKI services that meet the requirements
for service providers and supplies that support FISMA-compliant
IAM systems deployed by Federal agencies.</p>
                  </li>
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(2)</ph>  Homeland
Security Presidential Directive 12 (HSPD-12), “Policy for a Common
Identification Standard for Federal Employees and Contractors” establishes
the requirement for a mandatory Government-wide standard for secure and
reliable forms of identification issued by the Federal Government
to its employees and Contractor employees assigned to Government
contracts in order to enhance security, increase Government efficiency,
reduce identity fraud, and protect personal privacy. Further, the
Directive requires the Department of Commerce to promulgate a Federal
standard for secure and reliable forms of identification within
six months of the date of the Directive. As a result, the National
Institute of Standards and Technology (NIST) released Federal Information
Processing Standard (FIPS) 201-2: Personal Identity Verification
of Federal Employees and Contractors August 2013. FIPS 201-2 requires
that the digital certificates incorporated into the Personal Identity
Verification (PIV) identity credentials comply with the X.509 Certificate
Policy for the U.S. Federal PKI Common Policy Framework. In addition,
FIPS 201-2 requires that Federal identity badges referred to as
PIV credentials, issued to Federal employees and Contractors comply
with the Standard and associated NIST Special Publications 800-73,
800-76, 800-78, and 800-79.</p>
                  </li>
               </ol>
            </li>
            <li audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(b)</ph>  Special
item numbers. GSA has established the e-Authentication Initiative
(see URL: <xref href="http://www.idmanagement.gov"
                        format="html"
                        scope="external"
                        class="- topic/xref ">http://www.idmanagement.gov</xref>) to
provide common infrastructure for the authentication of the public
and internal Federal users for logical access to Federal e-Government
applications and electronic services. To support the government-wide
implementation of HSPD-12 and the Federal e-Authentication Initiative,
GSA has established Special Item Numbers (SINs) pertaining to Authentication Products
and Services, including Electronic Credentials, Digital Certificates,
eAuthentication, Identify and Access Management, PKI Shared Service
Providers, and HSPD-12 Product and Service Components.</p>
            </li>
            <li props="Runin" audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(c)</ph>  <i class="+ topic/ph hi-d/i ">Qualification information.</i>
               </p>
               <ol class="- topic/ol ">
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(1)</ph>  All
Authentication supplies and services must be qualified as being
compliant with Government-wide requirements before they will be
included on a GSA Information Technology (IT) Schedule contract.
The Qualification Requirements and associated evaluation procedures
against the Qualification Requirements for each SIN and the specific
Qualification Requirements for HSPD-12 implementation components
are presented at the following URL: <xref href="http://www.idmanagement.gov"
                              format="html"
                              scope="external"
                              class="- topic/xref ">http://www.idmanagement.gov</xref>.</p>
                  </li>
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(2)</ph>  In
addition, the National Institute of Standards and Technology (NIST)
has established the NIST Personal Identity Verification Program
(NPIVP) to evaluate integrated circuit chip cards and supplies against
conformance requirements contained in FIPS 201. GSA has established
the FIPS 201Evaluation Program to evaluate other supplies needed
for agency implementation of HSPD-12 requirements where normative
requirements are specified in FIPS 201 and to perform card and reader
interface testing for interoperability. Products that are approved
as FIPS-201 compliant through these evaluation and testing programs
may be offered directly through HSPD-12 Supplies and Services Components SIN
under the category “Approved FIPS 201-Compliant Products and services.</p>
                  </li>
               </ol>
            </li>
            <li audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(d)</ph>  <i class="+ topic/ph hi-d/i ">Qualification
requirements</i>. Offerors proposing Authentication supplies and
services under the established SINs are required to provide the
following:</p>
               <ol class="- topic/ol ">
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(1)</ph>  Proposed items must
be determined to be compliant with Federal requirements for that
SIN. Qualification Requirements and procedures for the evaluation
of supplies and services are posted at the URL:<xref href="http://www.idmanagement.gov"
                              format="html"
                              scope="external"
                              class="- topic/xref "> http://www.idmanagement.gov</xref>. GSA
will follow these procedures in qualifying offeror's supplies and
services against the Qualification Requirements for applicable to
SIN. Offerors must submit all documentation certification letter(s)
for Authentication Supplies and Services offerings at the same time
as submission of proposal. Award will be dependent upon receipt
of official documentation from the Acquisition Program Management
Office (APMO) listed below verifying satisfactory qualification against
the Qualification Requirements of the proposed SIN(s).</p>
                  </li>
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(2)</ph>  After
award, Contractor agrees that certified supplies and services will
not be offered under any other SIN on any Federal Supply Schedule</p>
                  </li>
                  <li props="Runin" audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(3)</ph>
                     </p>
                     <ol class="- topic/ol ">
                        <li audience="GSAR" class="- topic/li ">
                           <p audience="GSAR" class="- topic/p ">
                              <ph props="autonumber" class="- topic/ph ">(i)</ph>  If
the Contractor changes the supplies or services previously qualified,
GSA may require the Contractor to resubmit the supplies or services
for re-qualification.</p>
                        </li>
                        <li audience="GSAR" class="- topic/li ">
                           <p audience="GSAR" class="- topic/p ">
                              <ph props="autonumber" class="- topic/ph ">(ii)</ph>  If
the Federal Government changes the qualification requirements or
standards, Contractor must resubmit the supplies and services for
re-qualification.</p>
                        </li>
                     </ol>
                  </li>
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(4)</ph>  Immediately
prior to making an award, Contracting Officers MUST consult the
following website to ensure that the supplies and/or services recommended
for award under any Authentication Supplies and Services SINs are
in compliance with the latest APL qualification standards: www.idmanagement.gov.
A dated copy of the applicable page should be made and included
with the award documents.</p>
                  </li>
               </ol>
            </li>
            <li audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(e)</ph>  <i class="+ topic/ph hi-d/i ">Demonstrating
conformance.</i>
               </p>
               <ol class="- topic/ol ">
                  <li audience="GSAR" class="- topic/li ">
                     <p audience="GSAR" class="- topic/p ">
                        <ph props="autonumber" class="- topic/ph ">(1)</ph>  The Federal Government
has established Qualification Requirements for demonstrating conformance
with the Standards. The following websites provide additional information
regarding the evaluation and qualification processes</p>
                     <ol class="- topic/ol ">
                        <li audience="GSAR" class="- topic/li ">
                           <p audience="GSAR" class="- topic/p ">
                              <ph props="autonumber" class="- topic/ph ">(i)</ph>  For
Identify and Access Management Services (IAMS) and PKI Shared Service
Provider (SSP) Qualification Requirements and evaluation procedures: <xref href="http://www.idmanagement.gov"
                                    format="html"
                                    scope="external"
                                    class="- topic/xref ">http://www.idmanagement.gov</xref>;</p>
                        </li>
                        <li audience="GSAR" class="- topic/li ">
                           <p audience="GSAR" class="- topic/p ">
                              <ph props="autonumber" class="- topic/ph ">(ii)</ph>  For
HSPD-12 Product and Service Components Qualification Requirements
and evaluation procedures: <xref href="http://www.idmanagement.gov"
                                    format="html"
                                    scope="external"
                                    class="- topic/xref ">http://www.idmanagement.gov</xref>;</p>
                        </li>
                        <li audience="GSAR" class="- topic/li ">
                           <p audience="GSAR" class="- topic/p ">
                              <ph props="autonumber" class="- topic/ph ">(iii)</ph>  For
FIPS 201 evaluation program testing and certification procedures: <xref href="https://www.idmanagement.gov/fips201/"
                                    format="html"
                                    scope="external"
                                    class="- topic/xref ">https://www.idmanagement.gov/fips201/</xref>.</p>
                        </li>
                     </ol>
                  </li>
               </ol>
            </li>
            <li audience="GSAR" class="- topic/li ">
               <p audience="GSAR" class="- topic/p ">
                  <ph props="autonumber" class="- topic/ph ">(f)</ph>  <i class="+ topic/ph hi-d/i ">Acquisition
Program Management Office (APMO).</i> GSA has established the APMO
to provide centralized technical oversight and management regarding
the qualification process to industry partners and Federal agencies.
Contact the following APMO for information on the eAuthentication
Qualification process. Technical, APMO, FIPS 201, and HSPD-12 Points
of Contact can be found below, or in an additional attachment to
the solicitation.</p>
               <p audience="GSAR" class="- topic/p ">[<i class="+ topic/ph hi-d/i ">The contracting officer
should insert the points of contact information below, unless otherwise
included elsewhere in the solicitation.</i>]</p>
               <p audience="GSAR" class="- topic/p ">*<cite outputclass="MultiLine" xtrc="552.238-109_d947e262">_____</cite>*</p>
            </li>
         </ol>
         <p audience="GSAR" outputclass="Endofclause" class="- topic/p ">(End of clause)</p>
      </conbody>
   </concept>
</dita>
