Inactive Total Small Business Set-Aside (FAR 19.5)

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information i... This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotations are being requested and a written solicitation will not be issued. Solicitation No. 6913G619Q300169 is issued as a Request for Quotation (RFQ). This solicitation is being conducted in accordance with the policies and procedures prescribed in FAR Part 12, Acquisition of Commercial Items and FAR Part 13, Simplified Acquisition Procedures. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2019-03, effective July 12, 2019. The NAICS Code is 541690 and the Small Business size standard is $15 million dollars. This procurement is a 100% small business set-aside. The U.S. Department of Transportation, John A. Volpe National Transportation Systems Center (Volpe Center), Cambridge, MA, requires Aircraft Emissions CO2 Standard Support Services to resolve remaining technical work items for the CO2 emissions standard as within the Annex 16 Vol. III and the associated Environmental Technical Manual Vol. III guidance document. The work will be conducted in the form of information exchanges on teleconferences and webexes regarding procedures and methods for flight testing as well as data analysis necessary for determining airplane fuel consumption. The contractor is required to provide all requested specifications and delivery of services in accordance with the attached Statement of Work (SOW). REQUIREMENTS/SPECIFICATIONS The Government intends to award a firm fixed price purchase order as a result of this Combined Synopsis/Solicitation. This notice is expected to result in a single award, subject to receipt of an acceptable proposal. The Offeror's proposal shall be prepared in accordance with Attachment 1, Instructions, Conditions, and Notice to Offerors. The Offeror's price quotation for CLINs 00100-00400 and Optional CLINs 00500-01600 shall include a firm fixed price for each CLIN and shall be included as identified in the attached CLIN pricing sheet. NOTICE TO OFFERORS FAR 52.212-1, Instructions to Offerors-Commercial Items applies to this acquisition and is incorporated by reference. All Offerors must include a completed copy of the provision at FAR 52.212-3, Offeror Representations and Certification-Commercial Items (the complete provision is provided in Attachment 2). An Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certifications electronically using the System for Award Management (SAM) accessible via http://www.Sam.gov. If the Offeror has not completed the annual representations and certifications electronically in SAM, the Offeror shall complete only paragraphs (c) through (o) of this provision. All Contractors must be registered in SAM in order to receive an award from a DOT Agency. The Government intends to award one (1) purchase order on a firm-fixed price basis as a result of this solicitation. This RFQ is expected to result in a single purchase order award, subject to receipt of an acceptable proposal. FAR Clauses and Provisions 52.212-4, Contract Terms and Conditions-Commercial Items, 52.212-5, Contract Terms and Conditions Required to Implement Statutes or Executive Orders-Commercial Items, 52.232-40, Providing Accelerated Payments to Small Business Subcontractors are hereby incorporated by reference. Additional clauses cited in 52.212-5 that apply to this acquisition are: 52.209.6, 52.219-6, 52.222-3, 52.222-19, 52.222-21, 52.222-26, 52.222-35, 52.222-36, 52.222-37, 52.222-50, 52.223-18 and 52.232-33. The FAR provisions and clauses cited in this notice can be viewed at http://www.acquisition.gov/far. This combined synopsis/solicitation hereby incorporates all Federal Acquisition Regulation (FAR) provisions and clauses contained herein. The offer should be addressed to the following: U.S. Department of Transportation, Volpe National Transportation Systems Center, Attn: Christine Guy, V222, 55 Broadway, Cambridge, MA 02142. The signed offer must be submitted via e-mail to Christine.guy@dot.gov by closing date of August 9, 2019 at 12:00 p.m. ET. No telephone requests will be honored. The Government will not pay for any information received. It is anticipated that an award resulting from this combined synopsis/solicitation will be made on or about August 16, 2019. The following FAR provision is incorporated by full text: 52.217-7 Option for Increased Quantity-Separately Priced Line Item (Mar 1989) The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within [insert in the clause the period of time in which the Contracting Officer has to exercise the option]. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree. (End of clause) FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (JUN 2016) (a) Definitions. As used in this clause- "Covered contractor information system" means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information. "Federal contract information" means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments. "Information" means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009). "Information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502). "Safeguarding" means measures or controls that are prescribed to protect information systems. (b) Safeguarding requirements and procedures. (1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls: (i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems). (ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute. (iii) Verify and control/limit connections to and use of external information systems. (iv) Control information posted or processed on publicly accessible information systems. (v) Identify information system users, processes acting on behalf of users, or devices. (vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems. (vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse. (viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. (ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices. (x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems. (xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. (xii) Identify, report, and correct information and information system flaws in a timely manner. (xiii) Provide protection from malicious code at appropriate locations within organizational information systems. (xiv) Update malicious code protection mechanisms when new releases are available. (xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. (2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556. (c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system. 1252.239-70 CYBERSECURITY REQUIREMENTS FOR UNCLASSIFIED AND SENSITIVE INFORMATION TECHNOLOGY (IT) RESOURCES (JUNE 2012) (a) Required Policies and Regulations - Compliance with applicable Federal statutes, policies, standards, and guidelines is the responsibility of the Federal government and may not be abdicated to the Contractor. To achieve such compliance, the government requires the Contractor to conform to all U. S. Department of Transportation (DOT) and applicable Federal IT Security statutes, policies, standards, and reporting requirements, including, but not limited to: (1) Federal Information Security Management Act (FISMA) of 2002, 44 U.S.C § 3541 et seq. (2) Clinger-Cohen Act of 1996 also known as the "Information Technology Management Reform Act of 1996," 40 U.S.C § 1401 et seq. (3) Privacy Act of 1974, 5 U.S.C. § 552a, as amended. (4) Office of Management and Budget (OMB) Circular A-130, "Management of Federal Information Resources," and Appendix III, "Security of Federal Automated Information Systems," as amended. (5) OMB Memorandum M-04-04, "E-Authentication Guidance for Federal Agencies." (6) Homeland Security Presidential Directive (HSPD-12), "Policy for a Common Identification Standard for Federal Employees and Contractors," August 27, 2004. (7) DOT Order 1351.37, "Departmental Cybersecurity Policy." (8) DOT Departmental Cybersecurity Compendium "Supplement to DOT Order 1351.37: Departmental Cybersecurity Policy." (9) DOT Order 1681.1, "Department of Transportation (DOT) Implementation Policy for Identity, Credential, and Access Management (lCAM) and Homeland Security Presidential Directive - 12 (HSPD-12)." (10) National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Publication (PUB) 140, "Security Requirements for Cryptographic Modules." (11) NIST FIPS PUB 199, "Standards for Security Categorization of Federal Information and Information Systems." (12) NIST FIPS PUB 200, "Minimum Security Requirements for Federal Information and Information Systems." (13) NIST FIPS PUB 201, "Personal Identity Verification (PIV) of Federal Employees and Contractors" and all related NIST Special Publications. (14) NIST Special Publication 800-18, "Guide for Developing Security Plans for Federal Information Systems." (15) NIST Special Publication 800-30, "Risk Management Guide for Information Technology Security Risk Assessment Procedures for Information Technology Systems." (16) NIST Special Publication 800-34, "Contingency Planning Guide for Information Technology Systems." (17) NIST Special Publication 800-37, "Guide for the Security Certification and Accreditation of Federal Information Systems." (18) NIST Special Publication 800-47, "Security Guide for Interconnecting Information Technology Systems." (19) NIST Special Publication 800-53, "Recommended Security Controls for Federal Information Systems." (20) NIST Special Publication 800-53A, "Guide for Assessing the Security Controls in Federal Information Systems." (21) NIST Special Publication 800-63, "Electronic Authentication Guidance." (b) Applicability - The Contractor shall be responsible for Information Technology security for all systems connected to a DOT network operated by the Contractor for DOT, or for Contractor Systems that contains DOT information regardless of location. The term Information Technology, as used in this clause, means any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. For purposes of this definition, equipment is used by DOT whether DOT uses the equipment directly or it is used by a contractor under a contract with the agency which (1) requires the use of such equipment or (2) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. Information Technology includes computers, ancillary equipment, software, firmware and similar procedures, services (including support services), and related resources. It does not include any equipment acquired by a Federal contractor incidental to a Federal contract. (c) Security Categorization - In accordance with FIPS 199, "Standards for Security Categorization of Federal Information and Information Systems," DOT has determined that the security category of the information or information system under this contract is Confidentiality [Indicate LOW, MODERATE, or HIGH)], Integrity [Indicate LOW, MODERATE, or HIGH)], Availability [Indicate LOW, MODERATE, or HIGH)] with an overall security impact level of [Indicate LOW, MODERATE, or HIGH)]. (d) Baseline Security Controls and System Security Plan - The Contractor shall develop and maintain the System Security Plan and associated Baseline Security Controls for the system as defined in the DOT Departmental Cybersecurity Compendium. To aid DOT senior officials and Contractors in determining applicable security controls, the Departmental Cybersecurity Compendium assigns security requirements (also referred to as controls and policy) to the DOT Component and Information System levels. The Contractor is responsible for all "System-level" security requirements in accordance with the FIPS PUB 199 Categorization approved for the system unless otherwise indicated in the Statement of Work or Performance Work Statement. The Contractor shall follow DOT policy and guidance specified in DOT Order 1357.31 and the Departmental Cybersecurity Compendium to appropriately tailor the set of baseline security controls and define the implementation owner of each control. The Contractor shall obtain the written approval of the System Security Plan and corresponding Baseline Security Controls from the DOT Authorizing Official or his/her designee. (e) Information System Contingency Plan (ISCP) and Testing -- The Contractor shall develop and maintain the ISCP for the system as defined in the DOT Departmental Cybersecurity Compendium. The Contractor shall regularly test the ISCP and document test results in accordance with the DOT Departmental Cybersecurity Compendium. (f) Security Assessment and Authorization - All applicable Contractor systems/applications must support risk management processes, and produce and maintain the documents and artifacts as specified in the DOT Departmental Cybersecurity Policy and the DOT Departmental Cybersecurity Compendium. The Contractor shall prepare and submit the required documents as specified in the Deliverables section of the contract. For systems categorized as High or Moderate security impact per FIPS PUB 199, the Contractor must obtain a qualified independent Security Control Assessor and obtain the approval of this assessor from the DOT Authorizing Official. The Contractor may not begin the processing of DOT information, interconnecting with DOT networks or systems, or any other production operation of the system until the DOT Authorizing Official grants security authorization in accordance with DOT policy and procedures specified in the Departmental Cybersecurity Policy and Compendium. (g) Continuous Monitoring - Upon attainment of security authorization from the DOT Authorizing Official, the Contractor must implement and perform continuous monitoring of the security state and controls of the information system as specified in the Departmental Cybersecurity Policy and Compendium producing the specified reports and other artifacts to demonstrate ongoing risk management. (h) Contract Compliance - Upon approval by DOT, the Systems Security Plan, FIPS 199 Categorization, Contingency Plan, Security Assessment Report, Security Authorization, Plan of Action and Milestones (including any required updates), and other documents that are required based on the type of information system in accordance with the Departmental Cybersecurity Policy and Compendium, shall be incorporated into the contract file as compliance documents. (i) Availability of Data, Documents and Access - (1) The Contractor shall ensure that all DOT data remains within the United States except as approved in writing by the DOT Authorizing Official or his/her designee. (2) The Contractor shall provide DOT (or DOT- designated third party contractors) access to the Contractor's and subcontractors' facilities, installations, operations, documents, records, databases, and personnel used in performance of the contract. The Contractor shall have the means to support DOT's request for access 24 hours per day, 7 days per week which may be necessitated due to a security incident, breach or other security matter. (3) The Contractor shall provide access to the extent required to carry out IT security inspections, investigations, and/or audits to safeguard against threats and hazards to the integrity, availability, and confidentiality of DOT information or to the functions of information technology operated on behalf of DOT, and to preserve evidence of criminal activity. (4) Upon termination of the contract or earlier, upon request, the Contactor shall provide to the DOT Authorizing Official or his/her designee all DOT data, source code, or database files, in a format specified by the DOT Authorizing Official or his/her designee. (j) Monthly Deliverables: The Contractor shall provide, on a monthly basis, the following information in NIST Security Content Automation Protocols (SCAP) XML data formats: (1) Device inventory (type of device and software); (2) Medium and High Vulnerabilities for each device; (3) Deviations from approved Configuration Baselines for each device; and (4) Additional information as required by OMB or the Department of Homeland Security (DHS) as indicated in the Departmental Cybersecurity Compendium. (k) Quarterly Deliverables: The Contractor shall provide, on a quarterly basis, the following information in a format specified by the COTR: (1) Plan of Action and Milestones (POA&M) - The Contractor shall prepare a draft of the POA&M associated with known weaknesses at the completion of the initial security assessment. The Contractor shall collaborate with the DOT System Owner, Information System Security Officer/Manager (ISSO/ISSM) and DOT Authorizing Official to obtain necessary information to complete the POA&M to meet DOT guidelines specified in the DOT Departmental Compendium. The POA&M approved by the DOT Authorizing Official shall be included in the initial authorization package. Upon entering Continuous Monitoring phase, the Contractor shall update the POA&M at least quarterly to ensure it contains all known system security weaknesses discovered through security assessment, continuous monitoring, internal and external audits, and related activities that examine security and IT controls of the contractor information system. The POA&M update shall also include progress on corrective actions for weaknesses previously identified. (l) Annual Deliverables: The Contractor shall provide, on an annual basis, the following documents to the contracting officer and COTR: 1. Updated security risk management documentation: a. System Security Plan - The Contractor shall review and update the System Security Plan at least annually to ensure the plan is current, accurately describes implemented system controls and reflects changes to the Contractor system and its environment of operation. b. Security Assessment Report - The Contractor shall provide an update to the Security Assessment Report, based on the results of continuous monitoring performed. For systems categorized as High and Moderate security impact level, the independent Security Control Assessor must issue this report. c. Information System Contingency Plan (ISCP) - The Contractor shall provide an annual update to the ISCP completed in accordance the Departmental Cybersecurity Compendium. d. FIPS PUB 199 Categorization - The Contractor shall provide an update to the FIPS PUB 199 Categorization which shall identify any and all information type changes and resulting security impact levels for Confidentiality, Integrity and Availability in accordance with the DOT Departmental Cybersecurity Compendium. The DOT Authorizing Official must approve all changes in FIPS PUB categorization. 2. Information Security Awareness and Training Records - The Contractor shall ensure its personnel complete both general awareness training and role-based training for personnel that perform roles deemed by DOT to require annual specialized security training (refer to Compendium Appendix D). The Contractor shall comply with awareness and training policy specified in the DOT Departmental Cybersecurity Compendium and evidence of completion of training shall be provided to the COTR upon request by the Government. 3. Information System Interconnection Agreements - The Contractor shall identify all interconnections between its system and other parties. (Refer to the DOT Departmental Cybersecurity Compendium for definitions and requirements for documentation, security controls and authorization of interconnections). 4. All Other Applicable Documents as Specified in the Departmental Cybersecurity Compendium. (m) HSPD-12 / Identity, Credential and Access Management Requirements - The Contractor shall ensure, at a minimum, that all systems that it develops for or operates on behalf of the Government support the use of Personal Identity Verification (PIV) smart cards, and PIV interoperable (PIV-I) smart cards as appropriate, for authentication and access to those systems, for the digital signature of documents and workflows, and for the encryption of documents and information, in accordance with NIST PUB 201 and related special publications. When explicitly required, or by September 30, 2012, whichever occurs earlier, the Contractor shall ensure that all systems it develops for or operates on behalf of the Government meet applicable DOT policy requirements for identity, credential, and access management (ICAM) and require the use of a PIV card or PIV-I for authentication, access, digital signature, and encryption. The Contractor shall ensure that services and products it purchases involving facility or system access control are on the current FIPS 201 Approved Products List, found at http://www.idmanagement.gov/. (n) US Government Configuration Baseline - The Contractor shall certify applications are fully functional and operate correctly as intended on systems using the US Government Configuration Baseline (USGCB). This includes Internet Explorer configured to operate in Windows. The standard installation, operation, maintenance, updates, and/or patching of software shall not alter the configuration settings from the approved USGCB configuration. The information technology should also use the Windows Installer Service for installation to the default "program files" directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The Contractor shall use Security Content Automation Protocol (SCAP) validated tools with USGCB Scanner capability to certify their products operate correctly with USGCB configurations and do not alter USGCB settings, and shall provide documentation of such validation to the Government as a prerequisite for Government acceptance of the Contractor's products. The Contractor shall follow guidance in the DOT Departmental Cybersecurity Compendium for tracking and reporting deviations from these baselines. (o) System Access Notice - The Contractor shall implement DOT- approved warning banners on all DOT systems (both public and private) operated by the Contractor prior to allowing authenticated access to the system(s). The DOT Departmental Cybersecurity Compendium specifies requirements for this warning banner and permitted deviations depending on the end user device. (p) Privacy Act Notifications - As prescribed in the Federal Acquisition Regulation (FAR) clause 24.104, if the system involves the design, development, or operation of a system of records on individuals, the Contractor shall implement requirements in FAR clause 52.224-1, "Privacy Act Notification" and FAR clause 52.224-2, "Privacy Act." The Contractor shall ensure that the following banner is displayed on all DOT systems that contain Privacy Act information operated by the Contractor prior to allowing anyone access to the system: "This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed shall be protected from unauthorized disclosure. Individuals who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both." (q) Non-Disclosure Agreements - The Contractor shall cooperate in good faith in defining non-disclosure agreements that other third parties must sign when acting as the Federal government's agent. (r) Nondisclosure of Security Safeguards - In accordance with the Federal Acquisitions Regulations (FAR) clause 52.239-1, the Contractor shall be responsible for the following privacy and security safeguards: the Contractor shall not publish or disclose in any manner, without the contracting officer's written consent, the details of any safeguards either designed or developed by the Contractor under the contract. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. (s) Subcontracts - The Contractor shall incorporate the substance of this clause in all subcontracts that meet the conditions described in paragraph (b). SOLICITATION PROVISIONS The provisions listed below are incorporated either in full text or by reference in the solicitation. Please include the completed representations and certifications with your quote or offer. NOTE: These provisions will not be included in any resulting award. FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (Feb 1998) This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es): www.acquisition.gov 52.204-7 SYSTEM FOR AWARD MANAGEMENT (OCT 2018) 52.204-16 COMMERCIAL AND GOVERNMENT ENTITY CODE REPORTING (JUL 2016) 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS-COMMERCIAL ITEMS (OCT 2018) The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (u)) of this provision. (a) Definitions. As used in this provision-- "Economically disadvantaged women-owned small business (EDWOSB) concern" means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127. It automatically qualifies as a women-owned small business eligible under the WOSB Program. "Forced or indentured child labor" means all work or service- (6) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or (7) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties. "Highest-level owner" means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner. "Immediate owner" means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees. "Inverted domestic corporation," means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C. 395(b), applied in accordance with the rules and definitions of 6 U.S.C. 395(c). "Manufactured end product" means any end product in product and service codes (PSCs) 1000-9999, except- (1) PSC 5510, Lumber and Related Basic Wood Materials; (2) Product or Service Group (PSG) 87, Agricultural Supplies; (3) PSG 88, Live Animals; (4) PSG 89, Subsistence; (5) PSC 9410, Crude Grades of Plant Materials; (6) PSC 9430, Miscellaneous Crude Animal Products, Inedible; (7) PSC 9440, Miscellaneous Crude Agricultural and Forestry Products; (8) PSC 9610, Ores; (9) PSC 9620, Minerals, Natural and Synthetic; and (10) PSC 9630, Additive Metal Materials. "Place of manufacture" means the place where an end product is assembled out of components, or otherwise made or processed from raw materials into the finished product that is to be provided to the Government. If a product is disassembled and reassembled, the place of reassembly is not the place of manufacture. "Predecessor" means an entity that is replaced by a successor and includes any predecessors of the predecessor. "Restricted business operations" means business operations in Sudan that include power production activities, mineral extraction activities, oil-related activities, or the production of military equipment, as those terms are defined in the Sudan Accountability and Divestment Act of 2007 (P...