02.02.01 Attachment 1 Contact Management Distribution System_SOW.pdf

Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

CONTACT MANAGEMENT AND DISTRIBUTION SYSTEM

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

Statement of Work (SOW) for Contact Management and Distribution System

1.0 GENERAL

1.1 BACKGROUND

The Office of External Affairs (OEA) manages the agency’s public and internal communications. This includes but is not limited to coordinating routine and special communications, ensuring accurate and synchronized messaging, and providing critical information to the appropriate people to meet mission needs. The office also advises FEMA leadership, program and support offices on decision-making, policies and programs to ensure that activities are responsive to stakeholder, media, congressional and other audiences.

OEA is responsible for the preparation and distribution of critical response and recovery information to state and local officials, agency stakeholders and the general public. FEMA External Affairs provides primary support to the FEMA Administrator, Deputy Administrator and FEMA senior leadership, with primary responsibility for the communication of agency goals, objectives and accomplishments.

The Public Affairs Division works within OEA to communicate internal and external stakeholders messaging, through a variety of communication products and graphics, before, during and after disasters. The division also establishes and maintains effective, ongoing relationships with the national, regional, and local media to provide accurate, timely information about the Agency's programs. It provides messaging through traditional and new digital outreach methods (including social media).

The division has been using Cision Public Relations/VOCUS for over seven years for reporter contact management and press release distribution. The current contract allows FEMA to distribute news releases, tracks communication with journalists/media outlets, tracks responses to media inquiries, and measure and analyze outreach campaign goals. In the last five years, the division has had over 300 active users per month, distributed over 10,000 news releases and engaged with over 500 journalists/reporters per month.

FEMA is seeking a new contract to continue support of contact management activities and stakeholder relationship management. Additionally, we anticipated having up to 400 active users by the end of 2020.

2.0 SCOPE

FEMA is seeking a commercial off-the-shelf web-based solution (compatible with FEMA standard Windows-based systems as well as iOS mobile devices) that meets applicable federal, DHS, and FEMA security protocols and provides the following features/capabilities:

2.1 Seamless access to a database of media contacts (print, TV, radio, and blogs, etc.)

and internal/non-media key stakeholders to facilitate more effective relationships. By having all media contacts centrally located, FEMA will access this one-single platform across the agency. We anticipate having access to over 50,000 journalists contact information. This includes national, local and regional media.

2.2 Track interactions with reporters including but not limited to media inquiries, interest, conversations, follow up action items/statuses. During steady-state, we receive over 100 media inquiries per month. During disaster activations, media inquiries can be upward of 600 per month. This solution will help us manage open and closed inquiries with the media and stay aware of deadlines and tasks.

2.3 Distribute internal and external press releases. Allow distribution lists to be filtered, created, saved and modified to permit communications to be targeted to media lists and specific distribution groups. Historically, we have distributed to over 700 recipients per news release. At peak disaster response such as COVID-19, we distributed 144 news releases in English and Spanish per month. The platform must be robust enough to meet this demand.

2.4 Streamline stakeholder engagement efforts with real-time data and deliver time-sensitive reports and information to FEMA. We use reporting and analytics to meet mission needs and support leadership awareness and decision-making daily. FEMA news releases, media advisories and fact sheets have produced positive placements in national, local and trade publications online.

2.5 The platform and technical support must be available to FEMA 24 hours a day, 7 days a week without the need of special software. This platform must have the capability to search for media contacts and outlets, and additional filters as described in the Tasks section below. We currently have over 300 platform users.

3.0 OBJECTIVE

FEMA provides up-to-date and accurate information before, during and after disasters. These communications promote the agency’s mission, programs, goals and core values.

The solution must provide a user-friendly website enabling first-time users to support the agency’s external affairs mission to engage, inform and educate all FEMA stakeholders, in support of the Agency’s programs and initiatives.

4.0 TASKS

The contractor shall provide a solution to support contact management, tracking and inquiry management, distribution of press releases, stakeholder engagement metrics, training and administrative support.

The solution must possess the capacity to transition, including transferring current contacts, distribution lists and recent activities from FEMA’s current service provider or system to the new system to ensure real-time data for continuity and execution of daily tasks.

4.1 CONTACT MANAGEMENT

The contractor shall provide a reliable, existing web-based solution with contact management capabilities that integrate essential external affairs functions into one browser-based, database-driven software suite.

The database must be current to reflect accurate contact information for all journalists and reporters.

• All contact information must be updated at minimum of every two weeks and include work email address and phone number(s).

4.1.1 Creating targeted/flexible lists to include domestic news media, ethnic and tribal media (including the language they are published in) for print, broadcast, cable, magazines, and blogs. The platform shall allow frequently used distribution lists to be created and saved for repeated use.

4.1.2 The contractor shall populate and update the database every two weeks with media contact information that can be searched and filtered by FEMA staff.

FEMA should have the ability to add additional contacts to the database. On occasion, FEMA staff will identify additional contacts to be added to the database.

4.1.3 While the responsibility of managing and updating media contact information lies with the vendor, the platform should allow FEMA users the ability to update contacts in the database. Integration with Microsoft Outlook, Excel and SharePoint are desirable.

4.1.4 The contractor shall provide the ability to target distribution to subject and/or beat reporter lists from the general contact database. This includes the ability to filter or target by factors such as geographic location (city, county, and state) outlet type (newspaper, radio, broadcast, web, magazines, etc.), circulation, editorial interest or beat, and primary language spoken, including but not limited to English and Spanish.

4.1.5 The ability to send distribution/emails to non-media stakeholders such as FEMA, DHS, or White House staff and contacts within the platform. The vendor will not be responsible for tracking or updating non-media stakeholder lists. FEMA will customize and add non-media stakeholders to designated distribution list(s).

4.2 TRACKING AND INQUIRY MANAGEMENT

4.2.1 Providing press inquiry management capability for entering, tracking and reporting on inquiries with media and stakeholders.

4.2.2 Providing the capability to track media inquiry deadlines. This function will allow FEMA to appropriately prioritize inquiries and ensure strong stakeholder relationships.

4.2.3 Using automation to record history, the system will provide abilities to manually enter or log interactions that take place outside of the system, such as phone calls, in-person meetings, or press event attendance.

4.2.4 Providing the capability to take notes of conversations and schedule follow-up activities for contacts within the system.

4.2.5 Viewing key information pertinent to a contact on one webpage with the ability to then access more detailed information including job title, company or news organization of affiliation, summary on professional background and previous employment.

4.2.6 Creating reports showing pertinent information. This includes but not limited to reporter name, affiliation, open inquiries, closed inquiries and inquiries by outlet/region.

The system will not contain any features that track or display the social media activity or other First Amendment-protected activities of journalists whose contact information is contained within the system. The system will also not contain any analytics or features that track the activities of individual journalists, including displaying whether an individual has opened a specific press release or specific links within a press release. The system should also not be searchable or filtered by personal identifiers (e.g., name, phone number, email address, social media handle) but rather should be searched or filtered by non-unique identifiers such as area of expertise or locality.

OEA will complete a Privacy Impact Assessment for publication prior to the deployment of this system.

4.3 DISTRIBUTION SYSTEM

The vendor shall provide a web-based solution to send documents and messages to a list of targeted contacts via email distribution. The vendor shall verify and mitigate any concerns regarding documents or messages not arriving in the user’s mail inbox software.

The distribution system shall integrate and build from the contact management portion of the solution and be able to support the following:

4.3.1 Distribution of press releases, media advisories, fact sheets, attachments, and any other external affairs campaign related documents via email and/or wire services 24 hours a day, 7 days a week. The system should be able to distribute emails up to 10,000 contacts.

4.3.2 Distribution of up to 20,000 pages per month (estimated monthly distribution averages 350 documents of 2 pages to 1,000 contacts). The system must be able to accommodate multiple attachments/documents, links/hyperlinks ranging in length from 1-50 pages.

4.3.3 The solution must have the capacity for FEMA staff to review or share a preview template of a news release with the FEMA Office of External Affairs logo before disseminating to stakeholders.

4.3.4 The solution must have the capacity to include FEMA branding before disseminating to stakeholders.

• FEMA’s primary colors are blue, gray, dark grey and white; and secondary colors are red, light blue and green.

• FEMA’s typography includes Times New Roman, Joanna MT, Franklin Gothic and Arial.

• House Style Guidelines are available online.

4.3.5 The vendor must provide the ability to send group and individual emails, included in those emails up to 10 attachments in formats including but not limited to PDF, PNG, or JPEG, and/or publicly visible URL links to multiple attachments.

Due to the essential role FEMA needs in disseminating life-saving preparedness, disaster response and preparedness information to the media, there shall be no maximum amount of distribution lists or number of media contacts per distribution list.

4.4 STAKEHOLDER ENGAGEMENT METRICS

The platform must have a capability that allows FEMA users to download data for analytics purposes (Microsoft Word, Excel and PDF required) and generate reports on demand, using criteria such as date of inquiry received, outlet, medium, and inquiry category/subject.

4.4.1 Reporting capability that includes the ability to identify successful and unsuccessful delivery direct to the user initiating the distribution. Reports shall include success delivery rate, and other pertinent metrics/information that can be delineated by activities and tasks. This function should be completed after each distribution.

• A confirmation email with the pertinent metrics should be sent directly to the user who initiated the distribution immediately.

4.4.2 The vendor shall provide FEMA with easily accessible, statistical tracking capability to determine how many recipients successfully received and opened email messages, what documents or links were accessed in the email messages and summarized campaign results to assess program effectiveness. FEMA prefers visual graphics that allow the agency to compare different statistical tracking for two or more media products for assessment and action.

• FEMA users will download this data for analytical purposes to generate reports on demand.

4.4.3 The vendor shall provide a service that enables FEMA to organize and track progress on communications projects/campaigns including pitching opportunities, press releases, media interviews, speaking engagements and press/media events. This will enable FEMA to look for efficiencies in our https://connect.uscis.dhs.gov/org/OCOMM/BRND/Documents/opa_branding_house_guide.pdf messaging and reach out to appropriate stakeholders at the best time.

4.5 END USER SUPPORT

As directed by the FEMA Contracting Officer Representative (COR), the vendor will give rights to certain individuals who will have access as system administrators and enable permission to standard platform users. The system administrators shall have the ability to manually create and update user accounts for access.

The platform shall provide:

A minimum of 50 concurrent users to access the system on a regular basis and shall not restrict the total number of users with access accounts.

FEMA anticipates that no more than 400 active accounts will exist at any given point. These users will consist of staff located in FEMA's headquarters, regional offices, joint field offices, long-term recovery offices and transitional recovery offices or any other location where FEMA is conducting information dissemination activities.

4.5.1 The contractor shall provide 24/7 Help Desk Support. This support will help FEMA with technical questions such as formatting news releases, recalling distributions and account/user management.

4.5.2 The contractor shall provide FEMA with a minimum of six (6) FEMA-specific interactive training sessions annually. In the first year, an additional three shall be provided to assist with training all pertinent staff using the new solution. Webinars or virtual training sessions are preferred provided that the platform can effectively be used for these formats. Pre-recoded, on-demand trainings may also be provided in addition to the six interactive ones.

4.5.3 In addition to the training, the contractor shall provide additional training as needed to facilitate use of the system's full capabilities.

The vendor must use or have an existing online, web accessible platform or infrastructure (including accessibility within the FEMA/DHS-secured network) for Mozilla Firefox 78 or newer and/or Microsoft Edge 83 or newer.

4.6 TRANSITION PLAN

The transition plan shall include integration of legacy communication between FEMA and media stakeholders to manage the lifecycle of relationships with journalists across the country and U.S.

territories.

4.6.1 Transition account users and safeguard FEMA employees contact information such as email addresses.

4.6.2 Data conversion of existing contact lists and contact management data.

Currently, there are approximately 5,000 media contacts. Contact lists are saved in Microsoft Word, Excel and/or PDF formats.

4.6.3 Transition media inquiries up to 100,000 activities.

4.6.4 Transition news releases and distributions from FEMA's headquarters, regional offices, joint field offices, long-term recovery offices and transitional recovery offices.

5.0 DELIVERABLES

ACTION WHEN ITS DELIVERED DELIVERED TO HOW’S IT VERIFIED?

Contact Management (4.1)

Every two weeks FEMA database FEMA user finds incorrect, the COR will notify the vendor

Tracking/Inquiry Management (4.2)

Daily To the platform FEMA users will verify.

Inquiry reports will be pulled daily.

Distribution System (4.3)

Immediately/daily FEMA stakeholders FEMA stakeholders should receive the distributions/email.

Confirmation email sent to the person who initiated the email.

Stakeholder Engagement Metrics (4.4)

Right after distribution/when FEMA user wants to pull information

Platform users Reports can be pulled by a generator tab/link

End User Support (4.5) *Should be resolved within 24-hours

Platform users *Should be resolved within 24-hours

Training (4.5) 6x annually, 9x in the base period.

Platform users *6x annually, 9x in the base period.

Transition Plan (4.6) Deliver by end of the first month (Dec. 2020);

Execution within the next 30-days

COR Based on transition of all legacy data to new solution/platform.

6.0 KEY PERSONNEL

6.1 The vendor will identify a POC for standard government business work hours. (9 a.m. to 6 p.m.).

6.2 On occasion, during heightened disaster-response, the POC should be available outside standard government business hours. The FEMA COR will inform the vendor on time/work hour changes.

6.3 In the event, the POC is not available, the vendor is responsible for notifying the COR that there will be a replacement of similar experience and knowledge.

6.4 CONTRACTOR PERSONNEL ADMINISTRATION

6.4.1 Vendor should operate/facilitate the platform from their place of business.

6.4.2. Contractor travel shall not be required for this requirement unless requested and needed for in-person training or under case-specific circumstances.

7.0 PERIOD OF PERFORMANCE

The period of performance for this contract is a twelve (12) month base period with four one-year option periods as follows:

Base Period September 24, 2026 through September 23, 2027 Option Period One September 24, 2027 through September 23, 2028 Option Period Two September 24, 2028 through September 23, 2029 Option Period Three September 24, 2029 through September 23, 2030

7.1 PLACE OF PERFORMANCE

The primary place of performance will be the contractor’s facilities. This will be a web-based solution.

8.0 GOVERNMENT FURNISHED EQUIPMENT

No government furnished will be provided to contractors.

9.0 OTHER APPLICABLE CONDITONS

All data and instruments such as back up, memory and archive tools, processes, studies/research, or other tools and deliverables developed under this contract (to include, without limitation, any survey questionnaires, sampling methodologies, participant lists and resulting analysis) shall be the sole property of the Federal Emergency Management Agency

(FEMA).

10.0 SECURITY

Personnel may require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees receive a favorably adjudicated suitability prior to entry on duty (EOD). All individuals will be U.S. citizens. The contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information:

Contractors and Subcontractors who are working on this contract shall receive Unauthorized Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at: Unauthorized Disclosure of Classified Information and Controlled Unclassified Information (usalearning.gov) https://securityawareness.usalearning.gov/disclosure/index.html https://securityawareness.usalearning.gov/disclosure/index.html

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

OPSEC Training:

Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief.

Access to the briefing can be obtained at OPSEC Awareness for Military Members, DOD Employees and Contractors (usalearning.gov)

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

Insider Threat Training:

Insider Threat training for Contractors can be found at: Insider Threat Awareness (usalearning.gov)

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

For Official Use Only (FOUO) Information:

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The contractor will:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information. Other https://securityawareness.usalearning.gov/opsec/index.htm https://securityawareness.usalearning.gov/opsec/index.htm https://securityawareness.usalearning.gov/itawareness/index.htm individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager.

Execution of the NDA shall be effective upon date of the DHS Policy and not applied retroactively.

Foreign Travel and Government-Issued Equipment:

Per DHS and FEMA IT policy, FEMA employees and contractors are not authorized to take government-issued equipment, including cell phones, computers, or tablets such as iPads, outside of the United States regardless of the reason for travel. If government-issued equipment is required for official foreign travel, FEMA government employees may request a temporary loaner device through the Mobility Service Center.Office of the Chief Information Officer, Service Center for the duration of their trip. FEMA contractors must contact their contracting officer’s representative (COR) for further guidance.

If your device is detected as operating outside of the United States and its territories it will be disabled, and your information will be forwarded to the Office of Professional Responsibility for review.

Background Investigations:

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access:

Contractor personnel occupying positions or performing functions with a Low Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1 investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract. (also reference Facility Access).

Low Risk with Information System Access:

Contractor personnel occupying positions or performing functions with a Low Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

https://usfema.sharepoint.com/teams/FEMAET/it_tools/tsc/Pages/default.aspx

Moderate Risk:

Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

High Risk:

Contractor personnel occupying positions or performing functions with a High Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Background Investigation Process:

To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 11000-25, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 11000-25 are complete prior to submitting the form to FEMA PSD for processing.

The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

the investigation was completed within the last five years, it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract, the contractor personnel have not had a break in employment since the prior favorable adjudication, and, FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the contractor applicant/personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the National Background Investigation Services (NBIS) e-Application (eAPP) online system and instructions for submitting the necessary information:

Standard Form 85P, “Questionnaire for Public Trust Positions”

Optional Form 306, “Declaration for Federal Employment”

SF 87, “Fingerprint Card” (2 copies)

DHS Form 11000-6, “Non-Disclosure Agreement”

DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the National Background Investigation Services (NBIS) e-Application (eAPP) online system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation:

Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer:

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

Facility Access:

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

Separation of Contract:

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

10.1 POST AWARD CONFERENCE

The contractor shall attend a Post Award Conference with the Contracting Officer, COR and Program Manager no later than 10 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held via videoconference and/or teleconference.

FEMA External Affairs will set-up and initiate the meeting.

11.0 RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their

FEMA contract; and

• may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor shall not create or maintain any records containing any non-public

FEMA

information that are not specifically tied to or authorized by the contract.

7. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

8. The FEMA owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

12.0 Sec. 508 INFORMATION TECHNOLOGY CLAUSE

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105- 220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

Accessibility Requirements (Section 508)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt. Specifically, the following applicable EIT accessibility standards have been identified:

Section 508 Applicable EIT Accessibility Standards

36 CFR 1194.21 Software Applications and Operating Systems, applies to all EIT software applications and operating systems procured or developed under this work statement including but not limited to GOTS and COTS software. In addition, this standard is to be applied to Web-based applications when needed to fulfill the functional performance criteria. This standard also applies to some Web based applications as described within 36

CFR 1194.22.

36 CFR 1194.22 Web-based Intranet and Internet Information and Applications, applies to all Web-based deliverables, including documentation and reports procured or developed under this work statement. When any Web application uses a dynamic (non-static) interface, embeds custom user control(s), embeds video or multimedia, uses proprietary or technical approaches such as, but not limited to, Flash or Asynchronous Javascript and XML (AJAX) then 1194.21 Software standards also apply to fulfill functional performance criteria.

36 CFR 1194.23 Telecommunications Products, applies to all telecommunications products including end-user interfaces such as telephones and non end-user interfaces such as http://www.access-board.gov/ http://www.section508.gov/ switches, circuits, etc. that are procured, developed or used by the Federal Government.

36 CFR 1194.26 Desktop and Portable Computers, applies to all desktop and portable computers, including but not limited to laptops and personal data assistants (PDA) that are procured or developed under this work statement.

36 CFR 1194.31 Functional Performance Criteria, applies to all EIT deliverables regardless of delivery method. All EIT deliverable shall use technical standards, regardless of technology, to fulfill the functional performance criteria.

36 CFR 1194.41 Information Documentation and Support, applies to all documents, reports, as well as help and support services. To ensure that documents and reports fulfill the required 1194.31 Functional Performance Criteria, they shall comply with the technical standard associated with Web-based Intranet and Internet Information and Applications at a minimum. In addition, any help or support provided in this work statement that offer telephone support, such as, but not limited to, a help desk shall have the ability to transmit and receive messages using TTY.

Section 508 Applicable Exceptions

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the COTR and determination will be made in accordance with DHS MD 4010.2. DHS has identified the following exceptions that may apply: 36 CFR 1194.3(b) Incidental to Contract, all EIT that is exclusively owned and used by the contractor to fulfill this work statement does not require compliance with Section 508. This exception does not apply to any EIT deliverable, service or item that will be used by any Federal employee(s) or member(s) of the public. This exception only applies to those contractors assigned to fulfill the obligations of this work statement and for the purposes of this requirement, are not considered members of the public.

Section 508 Compliance Requirements

36 CFR 1194.2(b) (COTS/GOTS products), When procuring a product, each agency shall procure products which comply with the provisions in this part when such products are available in the commercial marketplace or when such products are developed in response to a Government solicitation. Agencies cannot claim a product as a whole is not commercially available because no product in the marketplace meets all the standards. If products are commercially available that meet some but not all of the standards, the agency must procure the product that best meets the standards. When applying this standard, all procurements of EIT shall have documentation of market research that identify a list of products or services that first meet the agency business needs, and from that list of products or services, an analysis that the selected product met more of the accessibility requirements than the non-selected products as required by FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) in accordance with DHS

MD 4010.2.

All tasks for testing of functional and/or technical requirements must include specific testing for Section 508 compliance and must use DHS Office of Accessible Systems and Technology approved testing methods and tools. For information about approved testing methods and tools send an email to accessibility@dhs.gov.

14.0 DHS ENTERPRISE ARCHITECTURE COMPLIANCE

All solutions and services shall meet DHS Enterprise Architecture policies, standards, and procedures. Specifically, the Contractor shall comply with the following Homeland Security Enterprise Architecture (HLS EA) requirements:

(a) All developed solutions and requirements shall be compliant with the HLS/FEMA EA.

(b) All IT hardware and/or software shall be compliant with the HLS/FEMA EA Technical Reference Model (TRM) Standards and Products Profile.

(c) Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

(d) Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01[1] and all data-related artifacts will be developed and validated according to DHS data management architectural guidelines.

(e) Applicability of IPv6 to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

15.0 FAR 52.224-3 PRIVACY TRAINING – ALTERNATE I (SEE FAR CLASS DEVIATION 17-03, REVISION 1)

(a) Definition. As used in this clause, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other https://www.dhs.gov/sites/default/files/publications/mgmt_directive_103_01_enterprise_data_management_policy.pdf information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A–130, Managing Federal Information as a Strategic Resource).

(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or

(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.1 and 39.105).

(c) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract. Contractor employees shall satisfy this requirement by completing Privacy at DHS: Protecting Personal Information accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within 30 days of contract award and be completed on an annual basis thereafter not later than October 31st of each year.

(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

16.0 HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS…