06C25R0054 RABAS SOW .pdf

U.S. DEPARTMENT OF HOMELAND SECURITY

U.S. Customs and Border Protection

Office of Human Resources Management

STATEMENT OF WORK (SOW)

FOR

ADMINISTRATIVE SUPPORT PERSONNEL SERVICES

TO SUPPORT

THE OFFICE OF HUMAN RESOURCES MANAGEMENT

AND

NATIONAL PROGRAMS DIVISION

Table of Contents

STATEMENT OF WORK

ADMINISTRATIVE SUPPORT PERSONNEL SERVICES

1.0 BACKGROUND

2.0 SCOPE

3.0 REQUIREMENTS

4.0 TASKS

5.0 DELIVERABLES AND DELIVERY SCHEDULE

6.0 PLACE OF PERFORMANCE ………………………………………………………….13

7.0 SECURITY…………………………………………………………………………...13-21

8.0 SPECIAL CONSIDERATIONS……………………………………………………. 21-22

9.0 ATTACHMENTS……………………………………………………………………23-25

1.0 BACKGROUND

1.1 The United States Department of Homeland Security’s (DHS) primary mission is to protect the Nation from acts of terrorism while simultaneously ensuring the efficient flow of lawful traffic and commerce by managing, controlling, and securing the Nation’s land, air, and sea borders. The U.S. Customs and Border Protection (CBP) as the “frontline” border security component, is the largest and most complex within DHS. It is responsible for securing and facilitating trade and travel while enforcing hundreds of U.S.

regulations, including immigration and drug laws.

CBP workforce comprises of three uniformed law enforcement divisions. The CBP Officers (CBPO) protect America’s borders at official ports of entry, while the Border Patrol Agents (BPA) prevent illegal entry into the United States of people and contraband between the ports of entry. CBP’s Air and Marine Officers manage the largest law enforcement air force in the world, patrols the nation’s land and sea borders to stop terrorists, and drug smugglers before they enter the United States. CBP Agriculture Specialists prevent the entry of harmful plant pests and exotic foreign animal diseases and confront emerging threats in agro- and bioterrorism.

As a Federal law enforcement agency, CBP is responsible for ensuring that certain personnel are fully qualified to safely and effectively perform the essential job duties without undue risk or hazard to self or public. This includes but is not limited to instituting and administering job-related physical fitness and medical standards and facilitating medical examinations and consultations. Additionally, ensuring that its employees refrain from the illegal use, possession, distribution, or trafficking of controlled substances is of the utmost importance to CBP.

1.2 CBP Office of Human Resources Management (HRM), National Programs Division

(NPD), Retirement and Benefits Advisory Services Branch (RABAS) mission is to support U.S. Customs and Border Protection (CBP) employees by providing high-quality retirement and benefit services, which meet their administrative and human resources needs.

2.0 SCOPE

The purpose of this statement of work (SOW) is to acquire expert Federal retirement and benefit counseling services along with benefit processing services to support the National Programs Division (NPD), Retirement and Benefits Advisory Services (RABAS) Branch, located in Washington DC. The RABAS Branch currently services over 66,000 CBP law enforcement and mission support employees. The work responsibilities include the following:

• Reviewing, completing and processing health and life insurance requests and retirement applications submitted by employees.

• Answering questions regarding eligibility to change or enroll in health and life insurance due to qualifying life events.

• Counselling survivors/beneficiaries on eligible benefits due to death of a CBP employee.

• Data entry using automated systems/databases and commercial software applications (Word or Excel, etc.),

• Managing electronic records,

• Communicating both verbally and written,

• Data gathering for statistical reporting, and

• Researching and interpretating laws, rules, regulations and agency directives relevant to work performed.

The contractor shall be responsible for ensuring the accuracy, timeliness and completeness of assignments and tasks. During seasonal or peak periods additional contractor employees maybe requested.

3.0 REQUIREMENTS

3.1 The following performance requirements specific to the Office of Human Resources Management may include, but are not limited to:

3.1.1 Ability to use office automation software with varied functions to produce a wide range of documents, forms, reports etc. Transmit and receive documents and messages electronically using government furnished computers or workstations.

3.1.2 Ability to obtain and manipulate data and generate reports from automated systems.

3.1.3 Ability to maintain records in accordance with CBP guidelines.

3.1.4 Ability to prepare multiple forms of communication for distribution an internal and external to CBP.

3.1.5 Knowledge of special retirement coverage, i.e. Law Enforcement Officer (LEO), Customs and Border Protection Officer CBPO).

3.2 The contractor will possess the following skills:

3.2.1 Must have experience using office equipment, including computers, scanners, and copiers.

3.2.2 Must have experience using Adobe Acrobat Pro and Microsoft Office

(Word/Excel/PowerPoint/Outlook).

3.2.3 Must have experience maintaining a consistent high-volume workflow while maintain accurate task completion.

3.2.4 Must have experience learning new/agency specific computer systems (i.e., Salesforce, FedHR navigator, etc.)

3.2.5 Must have experience as an effective communicator (oral and written).

3.2.6 Must have experience working with individuals and diverse groups.

3.2.7 Must be able to pass pre-employment and periodic background investigations.

3.3 The contractor will provide the resume for each labor category in accordance with the

HCATS labor category defined below:

Service Occupational Classifications (SOC) Number 13-1141: Compensation, Benefits, and Job Analysis Specialist Conduct programs of compensation and benefits and job analysis for employer. May specialize in specific areas, such as position classification and pension programs.

3.3.1 Project Manager

The Senior HCATS labor category has over 10 years of experience and a Master of Arts(MA)/Master of Science (MS) degree. A Senior HCATS labor category typically works on high-visibility or mission critical aspects of a given program and performs all functional duties independently. A Senior HCATS labor category may oversee the efforts of less senior staff and/or be responsible for the efforts of all staff assigned to a specific job.

The Project Manager will possess a comprehensive range of knowledge and experience in Federal retirement and benefits along with the function areas assigned. Ensures successful task completion within the scheduled timeframe consistent with the established scope of work to include technical solutions.

Applies knowledge of the entire customer organization to recommend and coordinate development, enhancement and maintenance of business processes and procedures. Develops project plans and milestones, status reports and other deliverables, and monitors the execution of the task for quality and against planned timelines.

3.3.2 Senior Human Resources Specialist

The Journeyman HCATS labor category has 3 to 10 years of experience and a Bachelor of Arts (BA)/Bachelor of Science (BS) or MA/MS degree. A Journeyman HCATS labor category typically performs all functional duties independently.

The Senior Human Resource Specialist will possess a comprehensive range of knowledge and experience in the area of Federal retirement and benefits. The individual(s) will be experienced and possess significant knowledge in providing retirement and benefits counseling, preparing annuity estimates, reviewing, completing and processing retirement applications. Provide support to resolve complex retirement and benefits issues. The individual(s) will have the knowledge to research and respond to general inquiries regarding retirement and benefits. The individual will have experience collaborating with other Federal agencies. The individual(s) will be experienced in creating and executing plans for actions with minimal supervision. The individual(s) will possess proven administrative skills relevant to HR operations. The individual(s) will possess strong oral and written communication capabilities. These communication skills will be used to participate in CBP employee outreach events, webinars/seminars, and congressional inquiry responses. The individual(s) will have ability to work independently in the performance of assigned duties.

3.3.3 Junior Human Resources Specialist

The Junior HCATS labor category has up to 3 years’ experience and a BA/BS degree. A Junior HCATS labor category is responsible for assisting more senior positions and/or performing functional duties under the oversight of more senior positions.

The Junior Human Resource Specialist will possess a comprehensive range of knowledge and experience in Federal retirement and benefits. The individual(s) will be experienced and possess significant knowledge reviewing and processing health benefits requests and life insurance requests. The individual(s) will have knowledge of Federal Human Resources programs for functional areas assigned and experience with file organization and maintenance procedures. The Junior HR Specialist also will be experienced in completing other long- and short-term projects with minimal supervision. The individual(s) will possess proven administrative skills relevant to HR operations. The individual(s) must possess strong oral and written communication capabilities.

3.3.4 Junior Administrative/Office Automation Clerk

The Junior HCATS labor category has up to 3 years’ experience and a BA/BS degree. A Junior HCATS labor category is responsible for assisting more senior positions and/or performing functional duties under the oversight of more senior positions.

The Junior Administrative/Office Automation Clerk contractor will possess 1 to 5 years of administrative experience. The individual(s) will provide administrative support to the RABAS Branch. The individual(s) will perform work by creating and manipulating data for various reports. The individual(s) will have knowledge and experience with personal computers and office software to perform their duties. The individual(s) will obtain data and generate reports for a variety of automated tracking systems. Other duties include answering the telephone and processing incoming and outgoing mail in support of the HR Mission. The individual(s) must possess strong oral and written communication capabilities.

3.3.5 CORE and Optional FTE Locations and Quantities

Location CBP Labor Category

OSAIS Labor Categories QTY. Hours/FTE

Washington Core Position

Project Manager Senior 1 1920

Washington Core Position

Sr. Human Resources Specialist Journeyman 5 1920

Washington Core Position

Junior Human Resources Specialist Junior 3 1920

Washington Core Position

Junior Administrative/ Office Automation Clerk Junior 1 1920

3.4 Background Investigation

Eligible personnel must be a U.S. Citizen and must already have or be able to obtain a complete and active Single-Scope Background Investigation (SSBI) with CBP.

Contractor employees will not begin working under this task order until a favorable suitability determination is made by CBP’s Personnel Security Division within the Office of Professional Responsibility (OPR).

3.5 Employee Identification

Contractor employees visiting Government facilities will wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, the contractor employees name, clearance-level and badge expiration date. Visiting Contractor employees will comply with all Government escort rules and requirements. All Contractor employees will identify themselves as Contractors when their status is not readily apparent and always display all identification and visitor badges in plain view above the waist.

Contractor employees working on-site at Government facilities will wear a Government issued identification badge. All Contractor employees will identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.6 Employee Conduct

Contractor’s employees will comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor will ensure Contractor employees present a professional appearance at all times and that their conduct will not reflect discredit on the United States or the Department of Homeland Security. The contractor will ensure its employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

The Government, at its sole discretion, may direct the Contractor to remove any Contractor employee from DHS facilities for misconduct (i.e., poor performance, not following proper procedures/guidelines, etc.) or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contractor will be provided with a written explanation to support any request to remove an employee from DHS facilities.

3.7 Contractor’s Internal Quality Control Plan (QCP)

• The contractor’s internal QCP must document how the contractor will meet and comply with the standards specified in this SOW and in accordance with U. S. Office of Personnel Management (OPM), Civil Service Retirement System (CSRS) and Federal Employee Retirement System (FERS) Handbook. At a minimum, the QCP must include an outline of the procedures that the contractor will use to maintain quality, timeliness, responsiveness, and other requirements set forth in this solicitation.

3.7.1 The contractor will be responsible for the quality and timely completion of all contractor services. The QCP will include measures for the contractor to achieve all performance goals. The following serves as outlined guidance on performance expectations based on workload.

3.8.1.1 The contractor employee should process retirement, benefits and other relevant cases within the specified timeframe designated by the CBP Program Office (which includes the USDA-National Finance Center and/or the Office of Personnel Management guidance/requirements). For retirement case processing, this would be within 30 calendar days prior to the effective date or 30 calendar days of receipt of a late retirement package. For benefits processing, this would be within 10 calendar days of the receipt of the benefits form. For all other duties outside of the direct scope of a retirement package or a benefits form, the expectation would be a 10-calendar day turnaround unless explicit instruction otherwise is given by assigning RABAS leadership. There will be an 85% standard requirement for timely completion of assignments. If there are more than three (3) unapproved or uninstructed late assignments, the contractor will take corrective action. If the performance has not been satisfied within 90-days, the contractor employee will be removed from the contract.

3.8.1.2 The contractor employee will maintain an 85% or higher accuracy rating as will be determined by a quarter case quality review performed by RABAS leadership. Retirement and benefits cases will be reviewed for errors in calculation, processing, customer communications, and overall case accuracy.

There will be an 85% standard requirement for accurate completion of assignments. If in any quarterly case a quality review of the contractor employee’s percentage of accuracy drops below 85%, the contractor will take corrective action. If the performance has not been satisfied within 90-days, the contractor employee will be removed from the contract

3.8.1.3 The contractor will receive no more than three (3) justified written customer service complaints from customers or Program Office Management within one calendar year. RABAS management along with the Contractor supervisor will review all written complaints to ensure they are indeed justified to prevent any complaints from customers who may be disgruntled for reasons with no nexus to the performance of the contractor employee. CBP has the final determination of complaint validity. If more than three (3) written complaints are received, the contractor will take corrective action. If the performance has not been satisfied within 90-days, the contractor employee will be removed from the contract. The contractor will prepare and submit an electronic copy of the QCP Report to the COR by the 10th of each month for the previous month’s services.

3.8.3 The contractor will submit a draft copy of the QCP no later than 5 calendar days after contract award date.

3.8.4 The contractor’s finalized QCP will be submitted to the COR no later than 15 calendar days after contract award date.

3.9 Transition Plan

CBP’s ability to provide consistent and timely retirement and benefit services to CBP employees is critical to our administrative mission; therefore, it is vitally important that the contractor be able to perform all requirements in this SOW within one month of contract award. During this transition period, the incumbent contractor will continue to perform the required services.

3.9.1 Transition-In Plan

The contractor will submit a draft copy of a detailed Transition-In Plan at the time of the proposal. The Transition-In Plan will include the following:

• A detailed transition methodology in logical sequence to ensure a smooth transition of all tasks of the contract without interruption or degradation of service levels;

• A timeline for completion; and

• Associated risk, issues, and risk mitigation strategies.

3.9.2 The final Transition-In Plan will be submitted to the COR no later than 5 calendar days after contract award date.

3.9.3 Transition-Out Plan

At the expiration of this contract, the contractor will ensure that all records, documents, and files are shipped under the terms of the contract by the U. S.

Postal Service Priority Mail with receipted delivery (i.e., returned receipt, certified or registered mail) to ensure secure delivery is made to the appropriate recipient; or in a manner as designated by the COR. All documents should be secured in accordance with the DHS Handbook for Safeguarding Sensitive Personally Identifiable Information (PII).

3.10 Non-Disclosure Agreement (NDA)

All contractor personnel performing work under the terms of this contract will complete and sign DHS Form 1100-6, Non-Disclosure Agreement. The contractor will provide the completed form to the COR before a contract employee has access to any information, materials, or documents pertaining to the Contract.

4.0 TASKS

4.1 The contractor will provide HRM with expert retirement counseling services to employees as needed and requested, including providing advice and assistance on questions regarding service computation dates and eligibility of certain periods of Federal and/or military service where retirement coverage is or might be questionable; providing retirement estimates (Civil Service Retirement System (CSRS) to include CSRS Offset and Federal Employees’ Retirement System (FERS); and explaining Thrift Savings Plan (TSP) options; Federal employees’ Health Benefits (FEHB) coverage, Federal Employees Group Life Insurance (FEGLI) coverage, Social Security (SS) coverage, and deposits and re-deposits to the retirement fund as these issues relate to the retirement program.

4.2 The contractor will provide HRM with expert assistance to employees in the preparation and submission of retirement applications and all related benefits forms and requirements. The contractor will ensure that the application package is complete and accurate before it is submitted by RABAS for final preparation and submission to the Office of Personnel Management (OPM). The contractor will verify that assigned completed cases have been uploaded to USDA’s ServiceNow (SNOW) database and that the personnel separation action has applied to the USDA NFC database, and when necessary, determine when NFC has submitted the retirement application to OPM.

4.3 The contractor will provide HRM with counseling to Custom and Border Protection (CBP) management, employees, retirees, and family members on benefit program entitlements/options and on interpretations of the law, regulations, and policies to CBP and DHS employees. This involves meeting with employees, including employees covered by the Customs and Border Protection Officers, and law enforcement officers to explain the different aspects of both FERS and CSRS/CSRS Offset, and will also include any other pay initiative such as Customs Officers Pay Reform Act (COPRA); Border Patrol Agent Pay Reform Act; Law Enforcement Availability Pay or any other premium pay that impacts employee retirement.

4.4 The contractor shall provide a single point of contact that shall serve as the Project Manager for the life of the Contract. The Project Manager will track the progress of performance for contractor employees. Specifically, the Project Manager is responsible for:

4.4.1 Setting task priorities, revisiting task priorities, when necessary,

4.4.2 Communicating these priorities to the contractor,

4.4.3 Managing attendance and hours worked by contractor employees,

4.4.4 Submission of Monthly Status Report Plan, and

4.4.5 Assessment of contractor employee to determine if acceptable performance levels and quality assurance requirements are being met.

4.5 The contractor’s duties and responsibilities are as follows:

4.5.1 Validation of service computation dates.

4.5.2 Verification of the retirement coverage code.

4.5.3 Verification of Federal service.

4.5.4 The employee’s entitlements under the TSP.

4.5.5 The employee’s options under FEHB.

4.5.6 The employee’s options under FEGLI.

4.5.7 The employee’s options regarding Social Security eligibility, Medicare, etc.

4.5.8 Assist with counseling employees concerning making service credit payments and post-1956 military service deposits.

4.5.9 Estimated retirement computations.

4.5.10 Obtain additional information from potential retirees as needed.

4.5.11 Complete Retirement Applications.

4.5.12 Assist with follow-up communication with retiree to ensure receipt of leave/retirement payments.

4.5.13 Assist with providing employees and survivors of deceased employees’ estimates of expected benefits.

4.5.14 Participate in Special projects.

4.5.15 Support and participate in outreach initiatives and retirement seminars, etc.

4.5.16 Interpret and prepare informative material for employees on new, changed, and pending policy, and outlines impact on existing benefit program entitlements.

4.5.17 Assist with difficult and complex cases such as disability retirements involving sensitive and controversial problems.

4.5.18 Assist with counseling employees to ensure that all pertinent information has been received before employee benefit-related decisions is rendered.

4.5.19 Assist with explaining the process to employees wanting information regarding making post-56 military deposit and how they may receive additional service credit towards retirement.

4.5.20 Assist with preparing sensitive correspondence on complex retirement and benefits matters and prepare responses to congressional inquiries.

5.0 DELIVERABLES AND DELIVERY SCHEDULE

5.1 Deliverables

The contractor will deliver a Monthly Status Report (MSR) detailing updated activities support by task. MSRs will summarize the contractor’s accomplishments related to the effort and will identify developments, current status and any issues that may affect performance, cost or schedule. The MSR will also provide recommendations to resolve or alleviate any problems identified.

The MSR is due to CBP by the 7th day (calendar day) of each month. Should the 7th day of the month fall on the weekend, or Federal Holiday, the report is to be submitted the first Federal workday after the preceding weekend or Federal Holiday. The MSR for each task order will include the following:

5.1.1 CBP task number and description;

5.1.2 NPD-RABAS Branch breakdown of hours completed by labor category;

5.1.3 Total funding for the NPD-RABAS Branch task;

5.1.4 Positions and name of the contract employees on board;

5.1.5 Positions and name of the contract employees with Background Investigation (BI) pending (Must notify COR in writing immediately if any contractor employee with pending BI is no longer available for the CBP position);

5.1.6 Positions vacant

5.1.7 Running total on amount billed by months;

5.1.8 Total funding remain on the task; and

5.1.9 Notes to provide explanation and clarity on updated activities and invoice revision or unusual issues such as errors in invoice billing or unplanned risk.

5.2 Delivery Schedule

The following table specifies the delivery schedule for this requirement:

SOW

Reference Deliverable Title Delivery Time Frequency

Section 3.8.3 Draft Quality Control Plan NLT 5 calendar days after contract award date Once

Section 3.8.4 Final Quality Control Plan NLT 15 calendar days after contract award date

Once

Section 3.9.2 Final Transition-In Plan NLT 5 calendar days after contract award date Once

Section 3.9.3 Transition-Out Plan NLT 60 calendar days prior to end of the option year three

Once

Section 3.10 Non-disclosure Agreement Prior to onboarding new contractor employees

Once

Section 5.1 Monthly Status Report 7th day (calendar day) of each month. Monthly

Section 7.2 Security Awareness and Privacy Training

Prior to work on this contract and thereafter annually

Prior to work on this contract and thereafter annually

6.0 PLACE OF PERFORMANCE

The contracting staff will be provided workspace in NPD/RABAS, currently located at 90 K Street, N.E., Washington DC 20002, Minneapolis, MN and Indianapolis, IN and other remote locations. The physical workspace and/or approved telework location is subject to change or may be expanded based on agency needs or natural disaster.

Activities requiring the participation of CBP employees shall be conducted during normal business hours. The standard workday for the contractor employees shall range Monday to Friday from 6:00AM to 6:00PM. Due to the nature of services provided to CBP employees, support services may be needed outside of the standard workday and timeframe. Due to the ongoing pandemic, the CBP Office of Human Resources Management is exercising use of maximum telework flexibilities in conjunction with meeting operational requirements.

Circumstances regarding telework flexibilities may change at the discretion of CBP.

7.0 SECURITY

7.1 The Contractor is fully responsible and accountable for ensuring compliance with all

Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS), and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance).

All services provided under this contract must be compliant with DHS Information Security Policy, identified in MD140-01, Information Technology Systems Security and 4300A Sensitive Systems Handbook.

7.2 Security and Privacy Awareness Training

All contractor employees and subcontractors that have access to sensitive DHS/CBP data and to Sensitive Personally Identifiable Information (SPII) are required to complete IT security awareness training on an annual basis. Contractors are required to submit an annual notification to the COR indicating the required training has been completed for all contractor employees and subcontractors. This notification will be in the form of an email. This email must include the last name, first name, and date training was completed. This initial training and notification will be completed before any contract employee or subcontractor will be allowed to perform work related to this SOW.

During the course of this effort, any new contract employees and/or subcontractors must complete this training before they will be allowed to perform work related to this SOW;

and documentation of completion of training must be submitted to the COR. Any contractor employee or subcontractor who did not complete this training will not be allowed to perform work related to this SOW.

Each contractor employee and subcontractor must annually complete this training during the transition period of the option year.

CBP Contractor Handling PII Level “When a contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the contractor will Accredit (ATO) this information system to the (HHM) FIPS level”

Unclassified Requests ISO Terms and Conditions for Sensitive but Unclassified Requests DHS Security Policy Requirement The following terms and conditions should be included in all acquisition documents.

All hardware, software, and services provided under this task order must be compliant with DHS 4300A Policy Directive (Version 13.3, February 13, 2023).

Encryption Compliance Requirement The following terms and conditions should be included in all acquisition documents.

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI) (please see DHS 4300A Policy Directive (Version

13.3, February 13, 2023) attachment U).

Security Review Requirement The following requirements should be included in all acquisition documents.

Security Review The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Technical Representative (COTR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

Interconnection Security Agreement (ISA)

The following requirements should be included in the acquisition document if the service being supplied requires a connection to a non-DHS, Contractor system, or DHS system of different sensitivity.

Interconnection Security Agreement Requirements Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnect service agreements.

Required Protections for DHS Systems Hosted in Non-DHS Data Centers The following requirements should be included in acquisition documents for information systems which are hosted, operated, maintained, and used on behalf of DHS at non-DHS facilities. Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance). The contractor security procedures shall be the same or greater than those that are provided by DHS Enterprise Data Center(s). Please note that all of the subsections from Security Authorization to Log Retention are included in this requirement.

Security Authorization A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the FIPS 199 security categorization of the DHS information system.

At the beginning of the contract, and annually thereafter, the contractor shall provide the results of an independent assessment and verification of security controls. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COTR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process. The contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with contractor activities shall also be subject to such assessments.

On a periodic basis, the DHS and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the contractor under these requirements. Evaluation could include, but it not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

Enterprise Security Architecture The contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COTR.

Areas of consideration could include:

1. Use of multi-tier design (separating web, application and data base) with policy enforcement between tiers

2. Compliance to DHS Identity Credential Access Management (ICAM)

3. Security reporting to DHS central control points (i.e. the DHS Security Operations

Center (SOC) and integration into DHS Security Incident Response

4. Integration into DHS Change Management (for example, the Infrastructure Change

Control Board (ICCB) process)

5. Performance of activities per continuous monitoring requirements Continuous Monitoring The contractor shall participate in DHS’ Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that the DHS determines acceptable.

The DHS Chief Information Security Officer (CISO) issues annual updates to its Continuous Monitoring requirements via the Annual Information Security Performance Plan. At a minimum, the contractor shall implement the following processes:

1. Asset Management

2. Vulnerability Management

3. Configuration Management

4. Malware Management

5. Log Integration

6. Security Information Event Management (SIEM) Integration

7. Patch Management

8. Providing near-real-time security status information to the DHS SOC Specific Protections Specific protections that shall be provided by the contractor include, but are not limited to the following:

Security Operations The Contractor shall operate a SOC to provide the security services described below.

The Contractor shall support regular reviews with the DHS Information Security Office to coordinate and synchronize the security posture of the contractor hosting facility with that of the DHS Data Centers. The SOC personnel shall provide 24x7x365 staff to monitor the network and all of its devices. The contractor staff shall also analyze the information generated by the devices for security events, respond to real-time events, correlate security device events, and perform continuous monitoring. It is recommended that the contractor staff shall also maintain a trouble ticket system in which incidents and outages are recorded. In the event of an incident, the contractor facility SOC shall adhere to the incident response plan.

Computer Incident Response Services The Contractor shall provide Computer Incident Response Team (CIRT) services. The contractor shall adhere to the standard Incident Reporting process as determined by the Component and is defined by a DHS-specific incident response plan that adheres to DHS policy and procedure for reporting incidents. The contractor shall conduct Incident Response Exercises to ensure all personnel are familiar with the plan. The contractor shall notify the DHS SOC of any incident in accordance with the Incident Response Plan and work with DHS throughout the incident duration.

Firewall Management and Monitoring The Contractor shall provide firewall management services that include the design, configuration, implementation, maintenance, and operation of all firewalls within the hosted DHS infrastructure in accordance with DHS architecture and security policy. The contractor shall provide all maintenance to include configuration, patching, rule maintenance (add, modify, delete), and comply with DHS’ configuration management / release management requirements when changes are required. Firewalls shall operate 24x7x365. Analysis of the firewall logs shall be reported to DHS COTR in weekly status reports. If an abnormality or anomaly is identified, the contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Intrusion Detection Systems and Monitoring The Contractor shall provide the design, configuration, implementation, and maintenance of the sensors and hardware that are required to support the NIDS solution.

The contractor is responsible for creating and maintaining the NIDS rule sets. The NIDS solution should provide real-time alerts. These alerts and other relevant information shall be located in a central repository. The NIDS shall operate 24x7x365. A summary of alerts shall be reported to DHS COTR in weekly status reports. If an abnormality or anomaly is identified, the contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Physical and Information Security and Monitoring The Contractor shall provide a facility using appropriate protective measures to provide for physical security. The facility will be located within the United States and its territories. The contractor shall maintain a process to control physical access to DHS IT assets. DHS IT Assets shall be monitored 24x7x365. A summary of unauthorized access attempts shall be reported to the appropriate DHS security office.

Vulnerability Assessments The Contractor shall provide all information from any managed device to DHS, as requested, and shall assist, as needed, to perform periodic vulnerability assessments of the network, operating systems, and applications to identify vulnerabilities and propose mitigations. Vulnerability assessments shall be included as part of compliance with the continuous monitoring of the system.

Anti-malware (e.g., virus, spam) The Contractor shall design, implement, monitor and manage to provide comprehensive anti-malware service. The contractor shall provide all maintenance for the system providing the anti-malware capabilities to include configuration, definition updates, and comply with DHS’ configuration management / release management requirements when changes are required. A summary of alerts shall be reported to DHS COTR in weekly status reports. If an abnormality or anomaly is identified, the contractor shall notify the appropriate DHS point of contact in accordance with the incident response plan.

Patch Management The Contractor shall perform provide patch management services. The contractor shall push patches that are required by vendors and the DHS system owner. This is to ensure that the infrastructure and applications that directly support the DHS information system are current in their release and that all security patches are applied. The contractor shall be informed by DHS which patches that are required by DHS through the Information Security Vulnerability Management bulletins and advisories. Core applications, the ones DHS utilizes to fulfill their mission, shall be tested by DHS. However, the contractor shall be responsible for deploying patches as directed by DHS. It is recommended that all other applications (host-based intrusion detection system (HIDS), network intrusion detection system (NIDS), Anti-malware, and Firewall) shall be tested by the contractor prior to deployment in a test environment.

Log Retention Log files for all infrastructure devices, physical access, and anti-malware should be retained online for 180 days and offline for three years.

Supply Chain Risk Management Requirement Supply Chain risks result from adversarial exploitation of the organizations, people, activities, information, resources, or facilities that provide hardware, software, or services. These risks can result in a loss of confidentiality, integrity, or availability of information or information systems. A compromise to even minor system components can lead to adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Authorities:

Comprehensive National Cybersecurity Initiative (CNCI) Initiative 11, Develop Multi- Pronged Approach for Global Supply Chain Risk Management DHS 4300A Policy Directive (Version 13.3, February 13, 2023) Homeland Security Presidential Directive 23, Cyber Security and Monitoring, 8 January Office of Budget and Management Circulation A-130, Appendix III

National Institute of Standards and Technology, Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, April

Supply Chain Risk Management The following requirements should be included in all hardware and software requests to ensure the confidentiality, integrity, and availability of government information.

The Contractors supplying the Government hardware and software shall provide the manufacture’s name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

1. How risks from the supply chain will be identified,

2. What processes and security measures will be adopted to manage these risks to the system or system components, and

3. How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Technical Representative (COTR) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents an unacceptable risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standards certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the Contracting Officer (CO). Contractors shall only provide Original

Equipment Manufacturers (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. “grey market,” previously used) components only with formal Government approval. Such components shall be procured from their original genuine source and have the components shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e. until the “end of life.”). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the US Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government’s request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipment and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

4.1.3.8 Personal Identification Verification (PIV) Credential Compliance If the ITAR request is for products, systems, services, hardware, or software that enables access to controlled facilities and information systems, please include the PIV Credential Compliance requirement below.

Examples of when to use this requirement:

• The ITAR request is for a commercial-off-the-shelf (COTS) product that the Component requires to fulfill its mission requirements. The COTS product must be enabled to use PIV credential, in accordance with NIST guidelines including Federal Information Processing Standard Publication (FIPS) 201 (Demonstrated progress toward integration with AppAuth would be considered a confirmation to PIV enablement).

• The ITAR request is for the procurement of 1500 desktops as part of a technology refresh. The desktops must have a PIV card reader.

• The Component is requesting a custom software product to be developed. The custom software product must be able to use PIV credential for authentication purpose.

Personal Identification Verification (PIV) Credential Compliance Authorities:

• HSPD-12 “Policies for a Common Identification Standard for Federal Employees and Contractors”

• OMB M-11-11 "Continued Implementation of Homeland Security Presidential Directive (HSPD) 12– Policy for a Common Identification Standard for Federal Employees and Contractors"

• OMB M-06-16 “Acquisition of Products and Services for Implementation of

HSPD-12”

• NIST FIPS 201 “Personal Identity Verification (PIV) of Federal Employees and Contractors”

• NIST SP 800-63 “Electronic Authentication Guideline”

• OMB M-10-15 “FY 2010 Reporting Instructions for the Federal Information

Security…