Inactive

Bids are being solicited under solicitation number 1019220155_01. This announcement constitutes the only solicitation; bids are being requested and a written solicitation will not be issued. The solic... Bids are being solicited under solicitation number 1019220155_01. This announcement constitutes the only solicitation; bids are being requested and a written solicitation will not be issued. The solicitation is issued as a Request for Quote (RFQ), unless otherwise indicated herein. If your company can provide the product/services listed on the solicitation and comply with all of the solicitation instructions, please respond to this notice. To view the specifications, please go to https://marketplace.unisonglobal.com and reference Buy No. 1091021_02. GSA Schedule Bids Only: Sellers bidding on this opportunity MUST have the items requested on an existing GSA Schedule. The Schedule must either be in the Seller's name or the Seller must be able to document its ability to act as an agent of a partner's Schedule. Sellers must not bid more than their applicable contract ceiling price, excluding the Unison Marketplace Fee, for contract-specific items. If Unison receives notice that, due to inclusion of the Unison Marketplace Fee, the Selected Bid's line item pricing is higher than the Selected Seller's applicable published government contract pricing, the Unison Marketplace Fee will be reduced to ensure the Selected Bid's line item pricing does not exceed the Selected Seller's applicable contract pricing. Sellers may offer Open Market items only in accordance with the approved Terms and Conditions of their respective GSA Schedule AND upon approval from the soliciting Contracting Officer. Information regarding GSA Schedules can be found at www.GSA.gov. This requirement is unrestricted and only qualified sellers may submit bids. The solicitation pricing on https://marketplace.unisonglobal.com will start on the date this solicitation is posted, and, unless otherwise displayed at https://marketplace.unisonglobal.com, will end on: 2022-01-27 15:00:00.0 Eastern Time. This time supersedes the Offers Due Time listed above. FOB Destination shall be Springfield, VA 22153 The Department of State requires the following items, Brand Name or Equal, to the following: LI 001: 1 year 8 x 5 Support SIGSRV Docker, Part Number: SIGSRV_DC_STD Period of Performance: 9/30/2021 to 9/29/2022, 2, EA; LI 002: 1 year 8 x 5 Support EJBCA Docker, Part Number: EJBCA_DC_STD Period of Performance: 9/30/2021 to 9/29/2022, 1, EA; LI 003: 1 year 8 x 5 Support SIGSRV Docker, Part Number: SIGSRV_DC_STD Period of Performance: 9/30/2021 to 9/29/2022, 1, EA; LI 004: 1 year 8 x 5 Support EJBCA Docker, Part Number: EJBCA_DC_STD Period of Performance: 9/30/2021 to 9/29/2022, 1, EA; LI 005: 1 year 24 x 7 Support SIGSRV Docker, Part Number: SIGSRV_DC_PRE Period of Performance: 9/30/2021 to 9/29/2022, 4, EA; LI 006: 1 year 24 x 7 Support Small App, Part Number: PKS_APP_S_PRE Period of Performance: 9/30/2021 to 9/29/2022, 1, EA; LI 007: 1 year 8 x 5 Support EJBCA Docker, Part Number: EJBCA_DC_STD Period of Performance: 9/30/2021 to 9/29/2022, 1, EA; LI 008: 1 year 24 x 7 Support EJBCA Docker, Part Number: EJBCA_DC_PRE Period of Performance: 9/30/2021 to 9/29/2022, 3, EA; Solicitation and Buy Attachments ***Question Submission: Interested offerors must submit any questions concerning the solicitation at the earliest time possible to enable the Buyer to respond. Questions must be submitted by using the 'Submit a Question' feature at https://marketplace.unisonglobal.com. Questions not received within a reasonable time prior to close of the solicitation may not be considered.*** For this solicitation, Department of State intends to conduct an online competitive reverse auction to be facilitated by the third-party reverse auction provider, Unison Marketplace. Unison Marketplace has developed an online, anonymous, browser based application to conduct the reverse auction. A Seller may submit a series of pricing bids, which descend in price during the specified period of time for the aforementioned reverse auction. Department of State is taking this action in an effort to improve both seller access and awareness of requests and the agency's ability to gather multiple, completed, real-time bids. All responsible Sellers that respond to this solicitation MUST submit the pricing portion of their bid using the online exchange located at https://marketplace.unisonglobal.com. There is no cost to register, review procurement data or make a bid on https://marketplace.unisonglobal.com. Sellers that are not currently registered to use https://marketplace.unisonglobal.com should proceed to https://marketplace.unisonglobal.com to complete their free registration. Sellers that require special considerations or assistance may contact the Marketplace Support at 1.877.933.3243 or via email at marketplacesupport@unisonglobal.com. Sellers may not artificially manipulate the price of a transaction on https://marketplace.unisonglobal.com by any means. It is unacceptable to place bad faith bids, to use decoys in the https://marketplace.unisonglobal.com process or to collude with the intent or effect of hampering the competitive https://marketplace.unisonglobal.com process. Should Sellers require additional clarification, contact Marketplace Support at 1.877.933.3243 or marketplacesupport@unisonglobal.com. Use of Unison Marketplace: Buyers and Sellers agree to conduct this transaction through Unison Marketplace in compliance with the Unison Marketplace Terms of Use. Failure to comply with the below terms and conditions may result in offer being determined as non-responsive. If this is a “Brand Name Only” procurement, Seller certifies that it is an authorized distributer of the brand name product being sold to the Department of State and that it has the certification/specialization level required by the manufacturer, to support both the product sale and product pricing, in accordance with applicable manufacturer certification/specialization requirements. Unless otherwise specified, Seller warrants that the products are new and in their original box(es). In addition to providing pricing at www.UnisonMarketplace.com for this solicitation, each Offeror must provide any required, NON-PRICING responses (e.g. technical proposal, representations and certifications, etc.) so that they are received no later than the closing date and time for this solicitation; these shall be uploaded with the Offeror's bid via Unison Marketplace. This solicitation requires registration with the System for Award Management (SAM) prior to award, pursuant to FAR 4.1102 and other applicable regulations and guidelines. Information can be found at www.sam.gov. Registration must be "ACTIVE" at the time of award. All Bids must be valid for 30 days from the closing date for this solicitation. No exceptions or qualifications. New equipment ONLY, NO grey market or refurbished products. Items must be in original packaging, never used, and not altered in any way. Components of the requested equipment, to include memory, must be manufacturer-approved and may not be compatible, remanufactured, or refurbished equipment. All items must be covered by manufacturer’s warranty and procured through a manufacturer approved distribution channel. Sellers must be able to document their ability to provide items through manufacturer approved distribution channels upon request. The Seller confirms to have sourced all products submitted in this Bid from manufacturer-approved channels for Federal sales, in accordance with all applicable laws and manufacturer’s current applicable policies at the time of purchase. Seller must be able to support both the product sale and product pricing, in accordance with applicable manufacturer certification / specialization requirements. If software is provided or included, Seller shall, upon request, provide Buyer with a copy of the End User License Agreement. Seller certifies that all software is licensed originally to Buyer as the original licensee authorized to use the software. All bid prices must include shipping FOB Destination. No partial shipments are permitted, unless otherwise specified by Contracting Officer at time of award. GSA schedule orders may include "open market" items, i.e., items not on the awardee's list of GSA schedule items, only in compliance with FAR 8.402(f). Offerors should verify in writing which items are listed on their GSA schedule contracts and which items are "open market" items. For an offer to qualify as an offer based on a GSA schedule contract, the value of "open market" items included in the offer may not exceed the applicable micro-purchase threshold as defined in FAR 2.101. In order to notate which items are open market, in accordance with FAR 8.402(f)(3), Seller must write "open market" in the Line Item Description for any item not currently active on the cited contract, or list in the Seller Bid Description field all open market line numbers (e.g. "Open Market Items: Lines 1, 2, 3.") Delivery order awards shall only be made to the firm that has the GSA FSS contract awarded to them. The Government views a team arrangement as a prime and subcontractor relationship with the delivery order only being awarded to one GSA FSS holder. To ensure compliance, prior to award the offeror MUST provide written proof from the GSA FSS contract holder that they have the right to offer the GSA schedule items on behalf of the GSA FSS holder; AND a statement that the offeror accepts that the government will make award to the GSA schedule contract holder as the sole awardee and they understand the Government will only accept invoices from and make payments to the GSA FSS contract holder. ATTENTION: Should a solicitation be set aside for a specific socio-economic status, such as a small business, the FSS contract holder must meet the socio-economic requirement in order to be considered for award. Be advised only equipment that is on the catalog is eligible to be proposed. Proposing equipment that is not on the catalog will render your bid as unacceptable and will automatically be rejected from consideration. To be considered for award, all Sellers must be manufacturer federally authorized distributors/resellers of the equipment/services they are offering with a demonstrated capability of delivering the entire order within the timeframes specified by the Buyer on the award. Sellers shall be required to provide documentation as proof of authorization to be considered for award. Offerors must identify each line item being offered on a bid as Buy American Act (BAA) or Trade Agreements Act (TAA)-compliant or request a waiver on solicitations against VCES. All items that are not TAA or BAA compliant must be approved by a DOS Contracting Officer before award can be issued”. Reference FAR clause 52.225-5, Trade Agreements. The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it “does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument” in the provision at 52.204-26, Covered Telecommunications Equipment or Services—Representation, or in paragraph (v) of the provision at 52.212-3, Offeror Representations and Certifications-Commercial Items. (a) Definitions. As used in this provision— Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to— (i)Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (ii)Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles. (2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to— (i)Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (ii)Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles. (c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered telecommunications equipment or services”. (d) Representation. The Offeror represents that— (1)It ? will, ? will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds “will” in paragraph (d)(1) of this section; and (2)After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that— It ? does, ? does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds “does” in paragraph (d)(2) of this section. (e) Disclosures. (1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded “will” in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer: (i)For covered equipment— (A)The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known); (B)A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and (C)Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision. (ii)For covered services— (A)If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or (B)If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision. (2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded “does” in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer: (i)For covered equipment— (A)The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known); (B)A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and (C)Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision. (ii)For covered services— (A)If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or (B)If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision. (End of provision) (a) Definitions. As used in this clause— Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet). Covered foreign country means The People’s Republic of China. Covered telecommunications equipment or services means– (1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities); (2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities); (3) Telecommunications or video surveillance services provided by such entities or using such equipment; or (4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country. Critical technology means– (1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations; (2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled- (i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or (ii) For reasons relating to regional stability or surreptitious listening; (3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities); (4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material); (5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or (6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817). Interconnection arrangements means arrangements governing the physical connection of two or more networks to allow the use of another's network to hand off traffic where it is ultimately delivered (e.g., connection of a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources. Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit. Roaming means cellular communications services (e.g., voice, video, data) received from a visited network when unable to connect to the facilities of the home network either because signal coverage is too weak or because traffic is too high. Substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service. (b) Prohibition. (1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. The Contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. (2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract, or extending or renewing a contract, with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, unless an exception at paragraph (c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described in FAR 4.2104. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. c) Exceptions. This clause does not prohibit contractors from providing— (1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or (2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles. (d) Reporting requirement. (1) In the event the Contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system, or as critical technology as part of any system, during contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other source, the Contractor shall report the information in paragraph (d)(2) of this clause to the Contracting Officer, unless elsewhere in this contract are established procedures for reporting the information; in the case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil. (2) The Contractor shall report the following information pursuant to paragraph (d)(1) of this clause (i) Within one business day from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; supplier unique entity identifier (if known); supplier Commercial and Government Entity (CAGE) code (if known); brand; model number (original equipment manufacturer number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended. (ii) Within 10 business days of submitting the information in paragraph (d)(2)(i) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of covered telecommunications equipment or services, and any additional efforts that will be incorporated to prevent future use or submission of covered telecommunications equipment or services. (e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e) and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items. (End of clause) To be considered for award, all vendors submitting bids for this requirement must self-certify conformance in their SAM.gov representations as required in FAR 52.204-24, FAR 52.204-25 and FAR 52.204-26 in accordance with FAR Interim Rule 2019-009. Vendors that fail to complete this self-certification or present with a record that does not reflect conformance at FAR 52.204-26 and FAR 52.212-3 (v) within SAM.gov will not be considered for award. (a) Definitions. As used in this provision, “covered telecommunications equipment or services” has the meaning provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (b) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for “covered telecommunications equipment or services”. (c) Representation. The Offeror represents that it ? does, ? does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument. (a) The Department of State's Advocate for Competition is responsible for assisting industry in removing restrictive requirements from Department of State solicitations and removing barriers to full and open competition and use of commercial items. If such a solicitation is considered competitively restrictive or does not appear properly conducive to competition and commercial practices, potential offerors are encouraged first to contact the contracting officer for the solicitation. If concerns remain unresolved, contact: (a) Definitions. As used in this provision: “Foreign person” means any person other than a United States person as defined below. “United States person” means any United States resident or national (other than an individual resident outside the United States and employed by other than a United States person), any domestic concern (including any permanent domestic establishment of any foreign concern), and any foreign subsidiary or affiliate (including any permanent foreign establishment) of any domestic concern which is controlled in fact by such domestic concern, as provided under the Export Administration Act of 1979, as amended. (b) Certification. By submitting this offer, the offeror certifies that it is not: (1) Taking or knowingly agreeing to take any action, with respect to the boycott of Israel by Arab League countries, which Section 8(a) of the Export Administration Act of 1979, as amended (50 U.S.C. 2407(a)) prohibits a United States person from taking; or, (2) Discriminating in the award of subcontracts on the basis of religion. (End of provision) All offers/bids submitted in response to this solicitation must address the approach for completing the security plan and certification and accreditation requirements as required by the clause at 652.239-71, Security Requirements for Unclassified Information Technology Resources. (End of provision) (a) General. The Contractor shall be responsible for information technology (IT) security, based on Department of State (DOS) risk assessments, for all systems connected to a Department of State (DOS) network or operated by the Contractor for DOS, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor has physical or electronic access to DOS's information that directly supports the mission of DOS. The term “information technology”, as used in this clause, means any equipment, including telecommunications equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130. Examples of tasks that require security provisions include: (1) Hosting of DOS e-Government sites or other IT operations; (2) Acquisition, transmission or analysis of data owned by DOS with significant replacement cost should the Contractor's copy be corrupted; and (3) Access to DOS general support systems/major applications at a level beyond that granted the general public; e.g., bypassing a firewall. (b) IT Security Plan. The Contractor shall develop, provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan shall describe those parts of the contract to which this clause applies. The Contractor's IT Security Plan shall comply with applicable Federal laws that include, but are not limited to, 40 U.S.C. 11331, the Federal Information Security Management Act (FISMA) of 2002, and the E-Government Act of 2002. The plan shall meet IT security requirements in accordance with Federal and DOS policies and procedures, as they may be amended from time to time during the term of this contract that include, but are not limited to: (1) OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources; (2) National Institute of Standards and Technology (NIST) Guidelines (see NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Technology Systems (http://csrc.nist.gov/publications/nistpubs/800-37/SP800-37-final.pdf)); and (3)...