07_Final Draft PWS Animal Care Support BPA 09242025.docx

United States Department of Agriculture Agricultural Research Service

Performance Work Statement

Animal Care Support Blanket Purchase Agreement (BPA)

Contents

Project Animal Care Support Blanket Purchase Agreement (BPA)

1.0 Background and Purpose

1.1 Background

The United States Department of Agriculture (USDA) provides leadership on food, agriculture, natural resources, rural development, nutrition, related issues based on sound public policy, and the best available science, and efficient management.

USDA expands economic opportunity through innovation, helping rural America to thrive; promotes agriculture production sustainability that better nourishes Americans while also helping feed others throughout the world; and preserves and conserves our Nation's natural resources through restored forests, improved watersheds, and healthy private working lands.

USDA is comprised of Departmental Management (DM) offices, Mission Areas (MA) and Agencies with employees located throughout the Continental United States (CONUS) and Outside CONUS (OCONUS).

The Agricultural Research Service (ARS) is the USDA’s chief scientific in-house research agency. ARS’s mission is to find solutions to agricultural problems that affect Americans every day from field to table. Here are a few numbers to illustrate the scope of the ARS organization:

More information about ARS to include its mission, vision, and core values can be found here- https://www.ars.usda.gov/about-ars/.

1.2 Purpose

The primary purpose of this commercial services contract is to establish a multiple award Blanket Purchase Agreement (BPA) to provide project focused animal care support for various ARS facilities nationwide. The list of facility locations subject to service requirements under this BPA are identified in Attachment A. This BPA will utilize Contractor on ramping utilizing original solicitation requirement and off ramping in accordance with FAR 52.249-2, Termination for the Convenience of the Government when required under this contract. A minimum of two awards is anticipated. However, the Government reserves the right to make additional awards as necessary.

Services provided under this BPA shall utilize agile program management methodologies including industry-recognized best practices recognized under the Project Management Institute (PMI) framework and the Program Management Improvement Accountability Act (PMIAA). Services provided by the Contractor(s) under this BPA shall be secured by issuance of a Call Order (Call). BPA Calls shall be placed In Accordance With (IAW) the ordering procedures outlined and governed by the Federal Acquisition Regulation (FAR) 13.3 (for BPA’s established in open market). ARS estimates, but does not guarantee, that the volume of the purchases through this BPA may be up to $9.9M per year or approximately $49.9 million over the life of the BPA contract. There is no required minimum guarantee, or maximum ceiling to perform the requirements of this Performance Work Statement (PWS).

Contractors must make clear their ability to meet the Government’s “Definition of Done” in their proposal. Upon award, the Contractor shall provide all management, supervision, labor, supplies, licenses, certifications, materials, transportation, equipment (except as otherwise specified herein), and plan, schedule, and coordinate, as necessary, to ensure the effective performance of services in accordance with the Terms and Conditions of this contract.

All monthly invoices shall be based on a calendar month. A Full-Time Equivalent (FTE) is defined as 1920 productive hours per year. Contractors should propose a Firm Fixed Price (FFP) Labor Rate Price Schedule with Labor Categories and Rates necessary to complete objectives identified herein this BPA. A precise amount of BPA Call awards cannot be predicted at this time. However, the Level of effort (LOE) for each new BPA Call will be identified at the Call Request for Quote (RFQ) level.

The Government recommends the Contractor appoint a Lead Point of Contact (POC) for Calls under this BPA. The Lead POC shall coordinate, plan, and propose all work to be awarded and issued as Calls under this contract. This resource should serve as the Contractor’s point of contact for all matters related to this BPA and should be provided at the Contractors’ expense. Alternatively, the Contractor shall propose any sustainable alternative approaches it believes necessary to perform work required of the resulting Call Orders. The Contractor must provide Contractor support to meet the following task area objectives:

Task Areas:

1. Program Management

1. Kickoff Meeting

1. Transition Support

1. Focused Animal Care Support

1. Animal Care Use

1. Continuity of Operations (COOP)/Disaster Recovery

1. Ad hoc Support Services (i.e., surge support)

1.3 Period of Performance

The anticipated BPA period of performance for the requirements of this PWS is one (1) base period of one (1) year with four (4) one (1) year option periods. Below is a projected summary:

Base Period: One Year (12 months) from time of award Option Period 1: 12 months from the end of the base period Option Period 2: 12 months from the end of Option Period 1 Option Period 3: 12 months from the end of Option Period 2 Option Period 4: 12 months from the end of Option Period 3

1.4 Place of Performance

Core services shall be performed, as needed, anywhere within the 50 States and the District of Columbia. The place of performance may be at any nationwide ARS facility location areas within the five (5) regional areas; Southeast, Northeast, Pacific, Midwest, Plains https://www.ars.usda.gov/people-locations/find-a-location

In situations or other activities that require Government involvement or review, the following eleven (11) federal holidays plus the Presidential Inauguration Day in the DC area shall be taken into consideration and not considered as working business days for Government resources as they will not be available:

· Martin Luther King’s Birthday

· Washington’s Birthday (President’s Day)

· Memorial Day

· Juneteenth Day

· Independence Day

· Labor Day

· Indigenous Peoples Day/Columbus Day

· Veterans Day

· Thanksgiving Day

· Christmas Day

· New Year’s Day

· Presidential Inauguration Day, third Monday in January (observed in the Washington, DC area)

2.0 Scope

The USDA ARS requires Project-focused Animal Care Support Services. The Contractor shall provide a variety of Animal Care support services within widely dispersed nationwide geographic areas. Requirements for the specific nature of project or program support at each site will be based on the defined task within this BPA PWS. Remote work will not be permitted and work is to be performed on site.

The Contractor shall perform all the services contemplated under this contract in an orderly, timely, and efficient manner. Assigned Contractor personnel must be able to pass a background check and be able to maintain security clearances at the level required of the respective site of the Call order. Typical security clearances are generally of varying Public Trust levels, but may be higher, and will be clarified at the Call level. Requirements for personnel qualifications and technical competence are detailed in Attachment B.

A general description of the functions for this requirement include:

· animal care and technical support

· cage and environmental sanitation

· routine maintenance of animal care equipment and supplies

· property, animal census tracking, data entry, and management

· personnel, animal, and equipment transportation

· supervision and management of Contractor staff

The Government does not anticipate requiring all the defined category levels to be filled by personnel at all times but should be optional to the Government. Labor categories are provided to provide a common definition to better understand the technical Contractor’s labor mix and expertise. Labor categories will further be used to assess performance for compliance with the offered solution. The Contractor may offer alternative categories but must include a description of position complexity, qualifications, requirements, and demonstrated proficiencies for the category.

The Contractor shall be responsible for the selection (subject to Government review of Key Personnel), certification, assessment, training, supervision, management, and control of personnel throughout the life of the contract in accordance with the performance requirements, policies and regulations specified in this PWS. The Contractor shall seek approval from the Contracting Officer’s Representative (COR) as it pertains to the hiring process of Key Personnel contract staff members only. In performing its responsibilities under the contract, the Contractor shall fully train, technically proficient personnel who are qualified under the specific Labor Category criteria.

All personnel assigned to work under this Contract must meet the minimum requirements/skill levels for the labor categories to which they are assigned and be capable of performing the functions of their duties in a competent and professional manner. Contractor personnel shall possess a thorough knowledge of the mission, goals, and objectives of the USDA and the ARS program of animal care and use. The Contractor shall ensure that minimum competency skills are achieved before personnel are permitted to work unsupervised.

The Contractor shall propose a broad-ranging FFP Labor Rate Price Schedule for services to be performed under this BPA that will facilitate future Call Order awards. The exact quantity and level of effort for future requirements is unknown at this time and shall be identified at the Call Order level, when needed, and requested.

This Price Schedule shall be based upon the Labor Category (LCAT) list identified in Attachment B and provide the Contractor with the flexibility to provide an appropriate amount of professional support personnel to provide any combination of the required types of service support necessary to fulfill future Call Orders under this BPA and include provisions for requirements evolution and future growth. Contractors are encouraged to provide pricing for these LCATs and/or any alternative LCAT Price Schedule mix it believes necessary to fulfill requirements that may result under this BPA.

Within 15 calendar days of each Call Order award, the Contractor shall provide the Call COR a list of Contractor employees by labor category (listed in hierarchal order) indicating degrees, formal training, and professional/technical certifications held along with a copy of each professional/technical certificate listed; for board eligible veterinarians, submit an American College of Laboratory Animal Medicine (ACLAM) approved examination application notification letter. Information on how to obtain an ACLAM examination application form applications and information of certifications, phone 603-887-2467 or visit www.ACLAM.org.

The Contractor shall maintain a list of Contractor employees by labor category (listed in hierarchal order) indicating degrees, formal training, and professional/technical certifications held, this list shall be updated and included in the Monthly Status Report. Any changes shall be indicated, and a copy of new professional/technical certificates shall be provided (evidence of professional/technical certifications held should be provided to the COR for each Contractor employee once obtained).

3.0 Definitions

Contractor Requirements

4.0 Technical Requirements/Task Areas

This is a non-personal services contract meaning that a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

The primary objective of this contract is to obtain project focused animal care Contractor support for various ARS facility locations nationwide. In performance of duties, the Contractor shall ensure that all activities and technical support of routine husbandry and special care are conducted in accordance with the key animal care activity requirements of the PWS and applicable policies (e.g., local instructions, regulations, and Standard Operating Procedures (SOPs)).

In performance of the task area duties of this contract, the Contractor shall perform key animal care activities. Key activities include, but are not limited to:

1. Providing all necessary staffing supplies and ancillary services (except for those to be furnished by the Government as may be specified elsewhere in the contract) to perform the work required by the contract as set forth below.

2. Providing consistently high-quality and wide-ranging animal welfare support that is required for the proper care, use, and humane treatment of laboratory animals.

3. Providing consistently high-quality and wide-ranging technical services required for the scientific study, manipulation of animals, and animal products as described in each project-related call order.

Upon contract award, the Contractor shall coordinate and host an “orientation meeting” with the BPA COR either in-person or by virtual means such as Microsoft Teams as agreed upon between COR and Contractor. The meeting shall be attended by the Contractor and all relevant key personnel to discuss the implementation of the Contractor’s proposal and to ensure an understanding of the requirement. The COR and the Contractor shall collaborate on the planning of the overall project to include the approach, methodology, and prior work performed relevant to this contract.

Tasks Areas

4.1.1 Project Management

The Contractor shall designate a team lead responsible for project management (PM) duties necessary to perform the requirements of each Call made under this BPA. The Contractor shall:

1. Provide a project management plan within fifteen (15) business days of award and final within one (1) month in a format agreed upon by the COR and PM and organized by task, that contains details about how the work is going to be performed, including methods, work breakdown structures (WBS), timelines (project schedules), and milestones. Task dependencies on the Government may be provided at this time.

1. Ensure all personnel have appropriate training and equipment and resources to provide the required support.

1. Submit a final work plan no later than five (5) business days after the contract kickoff meeting, and update as needed.

1. Ensure that all deliverables for all tasks are complete, accurate, delivered according to established schedules to the Government for review, comment, and acceptance, and comply with all applicable federal regulations.

1. Maintain a day-to-day collaborative working relationship with the COR/designee.

1. Proactively identify and resolve issues and bottlenecks that may impact project timelines.

1. Provide timely and accurate progress updates to project stakeholders.

1. Coordinate and participate in a BPA Call Order kickoff meeting between the Contractor and the COR.

1. Prepare and submit a monthly Status Report (MSR) with the monthly invoice no later than (NLT) the fifth business day of each new month for previous month.

1. Prepare and submit a lessons learned report annually within 30 days after the end of the calendar year.

See Deliverables Table 1

4.1.2 Kickoff Meeting

Within five (5) days of Call Order award, the Contractor shall coordinate and host a Kickoff Meeting either in-person or by virtual means such as Microsoft Teams as agreed upon between the COR and Contractor. The meeting shall be attended by the Contractor and all relevant key personnel to discuss the implementation of the Contractor’s proposal and to ensure an understanding of the requirement. The Contractor shall prepare the Kickoff Meeting Agenda. The COR and the Contractor shall collaborate on the planning of the overall project to include the approach, methodology, and prior work performed relevant to the Call Order. The project initiation includes onboarding of support Contractor personnel, and review and update of project management plans and schedules for the effort.

Key activities include, but are not limited to:

1. Onboarding Contractor personnel (i.e., initiation of the background investigation process, signing disclosure statements, assignment of escorts, review of the performance plan, etc.).

1. The Contractor shall provide a Quality Control Plan (QCP) based on the performance standards, which focuses on the quality, quantity, timeliness, etc. of the performance outputs to be delivered by the Contractor, but not on the steps required or procedures used to provide the services. Due at Kickoff Meeting.

1. The Contractor shall collaborate with the COR on the process for drafting, reviewing, finalizing, and delivering reports, meeting notes, and presentations as required.

1. The Contractor shall prepare and submit a transition in/out plan to the COR that enables the smooth transition of performance on the work requirements from one Contractor to another (or to the Government) which includes but is not limited to the hiring of new personnel. Additionally, the transition plan shall include milestones, risk analysis, mitigation strategies, and any other factor needed to ensure the work is properly transitioned from one Contractor to the next. Due at Kickoff Meeting.

1. The Contractor shall prepare and provide Kickoff meeting minutes not later than (NLT) five (5) business days of meeting.

See Deliverables Table 1

4.1.3 Transition In/Out

The Contractor shall prepare a transition-in plan and a transition-out plan at the kickoff meeting that describes how the Contractor shall prepare for and transition into and out of the current contract services when the contract begins and ends. The COR will provide information on whether services will transition to the Government or a new contract award to ensure that the Contractor plans appropriately. The team leader shall execute the transition-in plan during the transition period, which will be thirty (30) days in duration. The transition-out plan must be completed 60 days prior to the end of the contract and executed during the last thirty (30) days of the contract. The Contractor shall demonstrate collaboration, cooperation, and communication throughout the transition-in process, prioritizing the stability, functioning, and success of the Government.

Onboarding and knowledge transfer are necessary activities to ensure continuity of the program delivery for the Government and to prepare the incoming Contractor for full performance. During transition in, the focus is on knowledge transfer to understand the existing and expected environments.

Government onboarding may begin immediately upon Call Order award. The Government onboarding process with expected timeframes is included within Attachment C – Onboarding Process. Incoming contract resources may begin interacting with the Government and incumbent personnel for knowledge transfer upon receipt of the security initial determination (SID).

Incumbent Contractors may continue to work under an existing Security Initial Determination (SID) while they are undergoing the onboarding process for receiving a new SID under their new contract number. Onboarding packages need to be submitted as soon as possible, with an initial turn-around target of four (4) business days after each Contractor personnel receives the packet from Government personnel.

Due to the large volume of current and expected onboarding requests, the estimated average time to complete the onboarding process is at least six (6) to eight (8) weeks. The timeframe to obtain a SID varies based on several factors. No other Government personnel are privy to reasoning behind an unfavorable SID from Homeland Security Division (HSD).

Key transition activities include, but are not limited to:

1. Identification of all services to be transferred in or out, and actions that shall be taken to make these transfers.

1. Describe how knowledge shall be transferred to new personnel, including identification of where knowledge resides.

1. A repository of all reports, testing results, technical and business requirement documentation, etc.

1. Issuance and return of Government Furnished Equipment (GFE).

1. Identification of the status of ongoing efforts.

1. Coordination and communication efforts to ensure an effective transition both in and out.

1. Describe the transition of for all working applications.

See Deliverables Table 1

4.1.4 Focused Animal Care Support

The Contractor shall provide animal care services in support of ARS facilities nationwide. These services include but are not limited to providing food, water, cleaning of cages/spaces and basic care of the animals based on instructions, regulations SOPs, and instructions from staff veterinarians. The Contractor shall provide documentation of all required records as agreed upon between the COR and Contractor and reported in the MSR including but not limited to food consumed and refused, weight, birth date including condition at birth and parentage, mortality date, general conditions, etc.

The Contractor shall perform the following Key activities.

1. Routine observances of animals for appearance and activity and signs of illness, disease, discontent behavior, and/or refusal of feed shall be conducted. This also includes observations concerning normal exercise and movement, rate of growth, weight change, appetite, feces, skin lesions, and discolored or rough fur or skin as a sign of internal parasites or improper diet.

2. Initiate routine care according to available guidance. The work includes interacting with the following types of animals; mice, rats, rabbits, guinea pigs, bison, cattle, chickens, elk, equine, ferret, fish, geese, goats, guinea pigs, hamsters, sheep, swine, turkey, and white-tail deer.

3. Provide research technical support, routine maintenance of animal care equipment and logistical and clerical support. The work shall also include performing minor veterinary procedures such as wound cleaning and flushing, bandaging, microchipping, ear tagging, nail/hoof/claw trims, and others, as well as assisting with necropsy with tissue collection.

See Deliverables Table

4.1.5 Animal Care and Use

Proper management of the animal care and use program is essential for the welfare of the animals, integrity of research data, and the health and safety of the animal care staff. All activities performed must be managed in a manner that is responsive to ARS requirements. ARS requires that all staff meet the highest standard of humane, appropriate care, and provide medical treatment to the animals in their charge.

The Contractor shall ensure that all animal care and use is conducted in accordance with ARS and the Institutional Animal Care and Use Committee (IACUC) Requirements and report inconsistency or non-compliance, as necessary, to the COR and Alternate COR, the IACUC, and/or the ARS location’s identified compliance officer.

Use of the words ‘ARS Requirements’ shall hereafter be interpreted as strict adherence to: USDA supported institute Animal Care and Use Committee (IACUC) approved Animal Study Proposals (ASPs) and Approved Policies; Investigator Orientations; established IACUC and ARS SOPs and Special Care Instructions; Disaster Plans and Safety requirements in place at the ARS location to be supported; and/or established performance standards and schedules as they are provided, developed, or revised by the COR.

See Deliverables Table 1

4.1.6 Continuity of Operations (COOP)/Disaster Recovery

The Contractor shall propose and provide its plan for maintaining support in the event of a disaster. The proposed strategy should include that, in the event of a COOP or disaster recovery event, the Contractor will facilitate and manage a coordinated effort with ARS to stand up support services back online as soon as feasible. When disaster occurs, an assessment of the impact and proposed mitigation strategies should be provided to the ARS COR within 24 hours of event, as needed.

See Deliverables Table 1

4.1.7 Ad Hoc Support Services

The delivery of services under this contract is not limited to the current environment. There is the potential that in addition to the work related to this requirement, additional support services may be needed. If additional support is required, the Contractor shall provide support for optional additional projects, if needed. The Contractor shall provide the following additional support services:

Performance Objectives Key activities include, but are not limited to:

1. Providing reliable surge support as needed.

0. Surge work shall be approved by the CO prior to commencement of work via a funded modification.

See Deliverables Table 1

5.0 Government Furnished

The Government will provide the Contractor with the following:

· Access to Government computers with appropriate VPN access capability and standard office software (Microsoft 365).

· Desk space with typical office space amenities.

· Government email address.

· USDA LincPass (HSPD-12 PIV card) contingent upon the Contractor personnel passing background requirements. This PIV card will be used in the Government furnished computer to access the USDA network to perform contract requirements.

6.0 Deliverables / Schedule

The following table summarizes the deliverables related to this PWS. All days are listed as business days. If a due date falls on a federal holiday, Saturday, or Sunday, the deliverable due date shall be the next scheduled federal workday.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reason(s) for rejection. The Contractor will have five (5) business days to correct the rejected deliverable and return it per delivery instructions.

Table 1 (Key Deliverables)

See Section 4.1.1.1

6.1 Delivery Method

Electronic copies of deliverables shall be delivered using Adobe PDF format or Microsoft Office suite 2007 or higher (e.g., MS Word, MS Excel, MS PowerPoint, MS Project, or MS Access format), unless otherwise specified by the COR. Electronic submission shall be made via email, unless otherwise agreed to by the COR.

6.2 Inspection and Acceptance

The Government will perform Inspection and Quality Assurance in accordance with the contract Quality Assurance Surveillance Plan (QASP). This is not the same as the Contractor’s QCP. The Government has the right to perform periodic surveillance of the Contractor to ensure that the Contractor’s work products and Quality Control processes are in compliance with the contract requirements. The Government and the Contractor will coordinate Government surveillance in a manner that will not unduly delay or disrupt the Contractor’s performance of the contract.

The COR will have ten (10) business days to review draft deliverables and make comments. The Contractor will have ten (10) business days to make corrections. Upon receipt of the final deliverables, the COR will have five (5) business days for final review prior to acceptance or providing documented reasons for non-acceptance. Should the Government fail to complete the review within the review period the deliverable will become acceptable by default.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor shall have five (5) business days to correct the rejected deliverable and return it per delivery instructions.

7.0 Travel

Travel may be required for the individual(s) providing support. Travel (within fifty (50) miles of the Contractor’s facilities) shall not be reimbursed. COR approval is required prior to the Contractor holding meetings with Government staff. The COR reserves the right to approve the number of Contractor staff traveling. A separate CLIN shall be proposed for anticipated travel. Travel will be reimbursed in accordance with the Federal Travel Regulation (FTR).

8.0 Contractor’s Key Personnel

The Contractor shall designate one of its staff as key personnel for each Call awarded, specifically an onsite team lead, to perform overall management duties of its personnel. The team leader shall have extensive knowledge and competence in animal care and use programs, regulations, operations and maintenance of supporting systems unique to animal care and support.

Prior to the replacement of any individual designated as Key Personnel by the Client, the Contractor shall notify the CO fifteen (15) business days in advance of the off-boarding or within two (2) business days of the individual notifying the Contractor of their resignation from the organization – providing the Government with sufficient notice to process off-boarding requirements, submit written justification for the replacement and provide the name and qualification of any proposed substitute. All proposed substitutes shall possess qualifications equal to or superior to those of the Key Personnel as described below.

Key personnel shall have a minimum of 7-10 years of experience supporting animal care and use support, leadership, and management.

The team leader shall be available to the COR and CO via telephone between the core hours of 9:00 a.m. to 3:00 p.m. CTZ Mondays through Fridays and shall respond to a request for discussion or resolutions of technical problems within twenty-four (24) hour notification.

9.0 Security Requirements

9.1 General Procedures

Personnel employed by the Contractor or any representative of, or agent of the Contractor, entering this facility shall conform to the facility security requirements. The Contractor shall provide all information required for background checks to meet facility access requirements as performed by the facility security office. Contractor personnel shall comply with all personal identity verification requirements as directed by USDA-ARS Security office. Each person accessing the site will be required to provide personal details, (full name, date of birth (DOB), social security number (SSN), government issued identification) and will undergo a routine background check, such as a National Agency Check with Inquiries (NACI) , which may include a criminal and credit check.

Details required for the check should be submitted to the security office NLT five (5) days prior to the visit. Results of this check may return earlier. However, it should not be planned to have results earlier than five (5) days. If, while on site the contractor/vendor will have access to sensitive information, they must complete a National Disclosure Agreement (NDA), along with the required training. This training will most likely be completed by reviewing a series of slides or other training delivery methods covering the topics of the definition of controlled unclassified information (CUI), access, handling, distribution, storage, and destruction of CUI. Each person will acknowledge receiving and understanding the training on the NDA. The process should not exceed two (2) hours. Acknowledgement and completion of the NDA will be turned in with the form required for the background check. Results will be returned through the CO or COR. Contractors need to follow Title 41, Code of Federal Regulations, Part 102-74, Subpart C Rules, and Regulation Governing Conduct on Federal Property.

Additional security requirements may be imposed when the Federal Government raises the Homeland Security Alert Level. Additional directions will be provided if the situation occurs.

The Contractor shall safeguard all USDA-ARS equipment, information and property provided for Contractor use. At the close of each work period, USDA-ARS facilities, equipment, and materials shall be secured.

9.2 Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

9.2.1 Information Security Incident Reporting Requirements

All Information Security Incidents must be reported in accordance with the requirements below, even if it is believed the Incident may be limited, small, or insignificant.

a) The Contractor must report all Information Security Incidents immediately, but not later than 30 minutes after becoming aware of the Incident.

b) Copy the COR if possible, or if COR email is not immediately available; contact the COR immediately after reporting the incident.

c) Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

9.2.2 Information Security Incident Response Requirements

a) All determinations related to Information Security Incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) must be made by authorized USDA officials.

b) The Contractor must provide full access and cooperation for all activities (determined by the authorized Government official to be required) to ensure an effective Incident Response, including providing all requested images, log files, and event information to facilitate rapid resolution of Information Security Incidents.

c) Incident Response activities determined to be required may include, but are not limited to inspections, investigations, forensic reviews, data analyses & processing, and final determinations of responsibility for the Incident and/or liability for any additional Response activities.

d) USDA, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in Incident Response activities.

9.3 Information Types

The term Information is synonymous with Data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

9.3.1 Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical/Health, Legal, Strategic, Security, Intellectual Property & Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

9.3.2 Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-07-16, refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information [that is publicly available] — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual but alone may not constitute Sensitive PII.

9.3.3 Sensitive PII

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), is also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

9.4 Compliance with Security IT Policies

Information systems and system services provided by the Contractor must comply with the current USDA IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

The Contractor is required to comply with current federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E-Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies; Office of Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA must comply.

House Resolution 83-15 “Consolidated and Further Continuing Appropriations Act, 2015” requires that USDA demonstrate each project/investment is “being managed in accordance with applicable lifecycle management policies and guidance.” This mandates that USDA development projects are required to follow the Agency’s System Development Lifecycle (SDLC). All projects listed in Farm Service Agency Farm Programs IT plan for expenditure can expect to be audited for compliance. Audits may occur at any time after the plan for expenditure is submitted to Congress.

The Contractor must protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor shall review and remediate the vulnerabilities and present the results for Government approval within the timeframes documented in USDA IT security policies.

9.5 Security Assessment and Authorization

a) This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor must cooperate and support the Government in the development of required documentation and artifacts.

b) All information systems that input, store, process, and/or output Government information must be provided with an Authority to Operate (ATO) signed by the authorizing official as identified by the Chief Information Officer (CIO). The Contractor must adhere to current policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.

9.6 Federal Reporting Requirements

Contractors operating information systems must comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors must provide the Government with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB) and may change each reporting period. The Contractor must provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

9.7 Processing, Storing, Transmitting Government Data to Non-Government System

The Contractor or other external organizations must develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by the Government with significant replacement cost should the Contractor’s and other external organization’s copy be corrupted. This plan must describe the processes and procedures that must be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan must describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan must be compliant with applicable Federal laws that include, but are not limited to: (e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan must meet IT security requirements in accordance with Government policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

The Contractor and other external organizations must ensure that the appropriate security banners are displayed on all Government systems (both public and private) operated by the Contractors and other external organizations prior to allowing anyone access to the system.

9.8 Personnel

9.8.1 Personnel Security

The following Background Investigation Requirements apply to this contract. Contractor personnel must be able to obtain a favorable suitability decision in accordance with 5 CFR part 731. The duties of this contract range from low-risk to high-risk positions and, as such, Contractor personnel will be required to submit all required documentation necessary for the agency to provide a favorable preliminary decision on suitability. This decision is required prior to commencing work on the contract. Contractor personnel who receive an unfavorable suitability decision must be immediately removed from consideration for work on the contract.

The Contractor is accountable for selecting personnel capable of receiving favorable suitability determinations; consequences for advancing personnel not able to pass Government background checks may include providing invoice credits effectively reimbursing the Government for background check expenses. Performance delays or detrimental project outcomes due to not onboarding or removal of staff will be directly attributable to the vendor and documented.

9.8.2 HSPD-12 - Credentials

Contractor personnel must complete necessary requirements to obtain HSPD-12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD-12 credentials is grounds for removal/suspension of Contractor personnel from the contract.

9.8.3 Conduct and Removal

While performing the work under this contract, Contractor Agents must comply with applicable contract terms, State and Federal rules, regulations, policies, and requests regarding personal and professional conduct; and otherwise conduct themselves in a businesslike and professional manner. If USDA-ARS determines in good faith that a particular Contractor Agent is not conducting himself or herself in accordance with the terms of the Contract, USDA-ARS may provide Contractor with notice and documentation regarding its concerns.

Upon receipt of such notice, the Contractor must promptly investigate the matter and at USDA-ARS’ election, take appropriate action that may include removing the Contractor Agent from performing and work under the contract and replacing the Contractor Agent with a similarly qualified individual acceptable to USDA-ARS as soon as reasonably practicable or as otherwise agreed to by USDA-ARS.

10.0 Data Rights

10.1 Data Collected, Generated or Managed

The Contractor shall be responsible for properly protecting all information used, gathered, or developed because of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

The Contractor will cooperate with federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information. Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

All work performed under this task will be the exclusive property of the Government free from restrictions or claims of intellectual property of the Contractor.

10.2 Privacy Act

Th…