1.1.3 Attachment 1_Statement of Work.pdf

Federal Emergency Management Agency Logistics Management Directorate

Indefinite Delivery/Indefinite Quantity (IDIQ)

Statement of Work (SOW) for

Commercial Logistics Augmentation Support Services (CLASS)

1. BACKGROUND

A critical task of FEMA Logistics Management Directorate (LMD) is to ensure delivery of the right resources, at the right place, and at the right time to support state, local, tribal governments and territories. LMD delivers these necessary commodities to provide support during disaster operations. Previous seasons with multiple disasters occurring simultaneously have demonstrated challenges providing movement command and control personnel at critical transportation nodes and other FEMA logistic locations. To reduce any reoccurrence in future disaster operations, FEMA requires commercial augmentation of personnel to support movement control requirements for the management and tracking of resources from end-to-end during high disaster years. LMD will be the primary provider of personnel to support missions with augmented support from commercial entities.

During certain contingencies, FEMA may request contractor staff support to meet mission requirements. FEMA will manage the Movement Control enterprise with support from commercial entities during disaster operations. FEMA requires a contractor support team to manage, track, stage, and ship resources that may come directly from carriers or a FEMA owned location.

FEMA may consider activating contractor staffed Movement Control Units (MCUs) when the federal bandwidth has reached capacity. Supplemental services from the contractor for a FEMA staffed MCU can be requested at any time during the emergency response via task orders.

2. SCOPE OF SERVICE

FEMA requires logistics management service experts who possess the ability to develop and provide a network of logistics personnel to assist with ensuring resources are moved and delivered to the point of need in a timely manner. The services may be required throughout the continental United States (CONUS) and outside of continental U.S. (OCONUS) such as Alaska & Hawaii, and all the US Territories of Puerto Rico, US Virgin Islands, Guam, Commonwealth of The Mariana Islands, and American Samoa. As national emergency situations occur, the need for transportation and providing logistics services to the impacted areas are most critical. An efficient, reliable and highly flexible operation is needed to provide State, Local, Tribal and Territory (SLTT) governments the life sustaining supplies needed to deliver relief to survivors in the affected areas. Therefore, transportation service providers must possess the ability to manage, track, communicate and process various levels of commodities into the impacted area.

The contractor shall provide all personnel, training, and supervision to manage and perform key logistical aspects as set forth in requirements. The contractor shall be able to provide support services on a supplemental basis at Joint Federal Operation (JFO), Incident Staging Base (ISB), Federal Staging Area (FSA), Air Point of Debarkation (APOD) and Sea Point of Debarkation (SPOD) at any phase of the disaster response.

3. PERIOD OF PERFORMANCE

The IDIQ period of performance shall be one-year base period plus four one-year option periods.

4. PLACE OF PERFORMANCE

The place of performance will vary for each task order. The contractor MCU shall be located in the region designated as the lead for providing support to the disaster. The primary operation element for the overall command and control will be the Initial Operation Facility (IOF) or Joint Federal Operation (JFO) location of the deployed Incident Management Assistance Team (IMAT). This location could change based on mission requirements. Transportation support personnel will be located at various Incident Support Bases (ISB)/Federal Staging Area (FSA)/Aerial Port of Embarkation/Debarkation (APOE/D)/Sea Port of Embarkation/Debarkation (SPOE/D) locations. These personnel could be required to travel between multiple locations based on mission requirements.

GEOGRAPHICAL/SECTOR APPROACH

In an effort to provide transportation support services, and to maintain a consistent and resilient posture of readiness, FEMA has established a strategic geographical approach for management and tracking of resources that encompass all 10 FEMA Regions.

Sectors Geographical Coverage Sector 1 FEMA Regions I, II, III, IV, and V Sector 2 FEMA Regions VI, VII, VIII, IX, and X

FEMA has divided and grouped the 10 Regions (including states, territories and possessions) into two geographical sectors. This approach was determined based on 1) an evaluation of historical events (frequency and types of disasters) that have occurred in each sector and; 2) potential future events that could occur in both sectors. FEMA has determined that the Logistics Management Directorate Contract will require at least two service providers, one for each geographical zone.

This concept of two sectors will enable FEMA personnel and contract personnel to know, at the time of the disaster, the contractor who will be responsible for the disaster based on the sector in which the disaster is located. This concept further provides contractors a zone of responsibility and affords the designated sector contractor to be more knowledgeable about, and therefore better equipped to handle, their awarded sector. Offerors shall provide logistics support to all FEMA Regions and prospective Whole Community partners within, but not limited to, their sector, while maintaining a sufficient quantity of staff and resources. Offerors shall be ready and capable of providing backup support to the other sector as needed.

The size and scope of each offeror’s task or mission may vary based on the effected Region’s scale and magnitude of damage post-disaster.

5. TASKS

5.1 Disaster Support. FEMA requires contractor to provide logistics and transportation augmentation and assistance during a FEMA disaster response as communications operational node between MCC and ISB/FSA/APOD/SPOD.

5.2 Deployment of Resources

In coordination with the FEMA movement operations centers (MCC/MCU/JFO/IMAT) provide visibility on the mode (air, land, sea) type (container, trailer, pallet), quantity and time of projected incoming resources for every 12, 24, 72 hours. Provide throughput estimate of transportation nodes/facilities and keep all stakeholders informed to ensure efficient delivery of commodities and equipment. Provide logistics and transportation information to FEMA personnel to update logistics systems. Keep supervisors and all stakeholders apprised to enable adequate preparation to receive resources.

5.3 Movement Tracking

In coordination with the FEMA movement operations centers and forward deployed FEMA teams accurately capture visibility and status of deployed transportation resources (trailer number/license plate of each vehicle, containers, pallets) from point of origin to the destination.

Maintain visibility of all FEMA, contracted and commercial trailers at various transportation nodes. Ensure open communication at all levels.

5.4 Redistribution

In coordination with the onsite personnel and other identified stakeholders, execute transportation requirements to meet mission requirements (via shuttle trucks or other transportation modes). This execution must not hinder throughput at the distributing point or the receiving point. Ensure implementation of distribution plan and maintain visibility of incoming and outgoing deliveries for every 12, 24 and 72 hours. Ensure open communication at all levels.

5.5 Retrograde

Notify the FEMA movement operations centers for recovery of trailers/containers for return to carrier and retrograde of DHS trailers. In coordination with FEMA personnel assist in the identification and initiation of transportation requirements for retrograde.

5.6 Table Top Exercise. The exercises of consideration for evaluating MCU concepts will consists of discussion-based exercises such as seminars, tabletop exercises and workshops that will enable both FEMA and the contractor to better prepare and train for the implementation of the concept. FEMA will conduct an annual exercise that will be utilized primarily for testing and evaluating the concepts. The basic format of the exercise includes the roles of and contributions from each stakeholders involved in the emergency response concept. The duration, location and date/time will vary each year and task order award.

6. DELIVERABLES

6.1 Management Plan for the IDIQ award submission, the contractor shall submit a plan, not exceeding 5 pages, at a minimum provide an organization structure/chart showing operational lines of authority, responsibility, and communication for management, supervisory, and technical personnel for each site and as a whole organization, as it relates to this requirement.

Indicate what job classifications will be accomplishing the work items.

6.2 Daily Operations Report for each task order, during MCU activation, the contractor shall submit to FEMA COR a status/progress report (twice daily during 24 hour operations) at regularly scheduled intervals established by FEMA. These daily operations reports will consist of, at a minimum, personnel, commodity and POD status. The report shall have concise and detailed information to assist FEMA MCU, IMAT and MCC in deciding and strategizing future operations. The report will be utilized to manage flow of resources into incident area by synchronizing movement schedules with priorities; de-conflict movements based on identified and available transportation capabilities; and daily coordinate with the MCC for the metering the flow of strategic air, land, and maritime transportation requirements and priorities.

6.3 Table Top Exercise After Action Report (TTX-AAR). The contractor shall submit an after action/lessoned learned report, not exceeding 10 pages, after participating annual exercise that summarizes concept test and evaluation result. The contractor shall include any recommendations for the government to consider for consideration on future concept of operations (CONOPS). The report shall be submitted to the COR within one week after exercise completion.

7. CONTRACTOR PERSONNEL

7.1 Performance Shifts and Hours. All MCUs may be required to work 24/7 and cannot pause to account for a shortage of personnel. The contractors shall work in two 12-hour shifts that rotate and transition between day and night shifts. The contractors may be required to work through weekends and federal holidays. FEMA will not authorize overtime for worked preformed during holidays and / or weekends. All rates for each professional services discipline will not exceed the contract IDIQ maximum rate.

7.2 Lodging and Transportation. The contractor shall be responsible for coordination and management of personnel lodging and transportation. The contractor shall ensure safety and security of own personnel following all federal, state and local laws.

7.3 Safety. The contractor shall ensure the personnel are provided with measures that protect them in accordance with the Occupational Safety and Health Administration (OSHA) and Centers for Disease Control and Prevention (CDC) guidance.

7.4 Staffing. For each task order, the contractor shall have an on-site manager who will be the primary POC with FEMA. Contract staffing levels will be determined at each task order depended on the level of disaster response. Task orders will indicate the number of staffing needed (in accordance with Table 1) as predicated by mission requirements. FEMA will monitor performance and will require the contractor to provide additional personnel if not meeting FEMA requirements. ADVON is a group of personnel that are sent out in advance to do the setup/prep work for the main group so that when everyone arrives, operations can fully begin.

Level represents the size and scope of the response to a emergency/disaster operation. Level 3 is the smallest followed by Level 2 then Level 1 being the largest.

7.5 Surge Capability. Depending on the level of disaster activity and as response increases, the contractor shall provide capability to bring on additional personnel support to aid the government MCU. The duration of personnel deployment shall depend on requirement workload and duration of response. Activation and deactivation will remain flexible depending on disaster level and complexity of operation. The “Optional Surge Force – All Positions” serves as flexibility for FEMA to plus up any or all positions as response and recovery efforts dictates.

Table 1 – Staffing Level Matrix

Disaster / Incident Level

Position Advon Level 3 Level 2 Level 1 Program/Project Manager – MCU Leadership

MCU Leader / On-site Manager* 1 1 1 1 MCU Deputy Leader / On-site Dep Mgr* 1 1 Transportation Management

Transportation Management Manager 1 1 1 1 Transportation Specialist 1 1 1 Transportation Specialist 1 1 Transportation Specialist 1 Transportation Planning Transportation Planning Manager* 1 1 1 1

Sealift Planning Specialist* 1 1 Retrograde/Trailer Specialist* 1 1 Airlift Specialist* 1 1 Movement Tracking Movement Tracking Manager 1 1 1 1 Movement Tracking Specialist 1 1 1 Movement Tracking Specialist 1 1 Movement Tracking Specialist 1

TOTAL 4 6 12 14

7.6 Qualifications. It is the responsibility of the contractor to provide qualified contractor personnel to perform all requirement specified in the SOW. Qualified personnel shall have significant experience in transportation management services.

* Noted labor categories from Table 1 above shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. See below sections 13 – 16 and the SOW Addendum for additional requirement details.

7.7 Contracts Program Manager (Key Personnel)

Contracts Program Manager must possess at least ten years of experience in the logistical arena with a strong concentration in all modes of transportation and cross docking functions; and must demonstrate experience in government and / or commercial contracts administration.

Demonstrates strong analytical and problem-solving skills. Experience managing programs directly related to business planning processes that drive improvements in contract administration, service, cost, scope, scheduling, systems or other areas as deemed necessary.

Must demonstrate experience in process analysis, root cause analysis, risk management and preventative action measures. Experience in large scale emergency and disaster response and recovery initiatives with emphasis on logistical planning is a plus.

7.8 MCU Leader/Deputy On-site Managers (Key Personnel)

The On-Site Project Managers must possess at least ten years of experience in logistics and transportation operations and demonstrate experience in all facets of the transportation and logistics management area. Must demonstrate strong analytical, communication and problem-solving skills. Must have a solid government and / or commercial experience in managing multifaceted, multi-operational logistics projects supporting commercial industry or government operations such as the Department of Defense or United States Agency for International Development (USAID). Must be experience managing logistical projects directly related to business planning processes that drive improvements in task order execution, service, cost, scope, scheduling, in-transit visibility (ITV) and other areas as deemed necessary. Demonstrate experience in large scale emergency and disaster response and recovery initiatives with emphasis on operational response and recovery.

7.9 Managers

Must possess at least five years of experience in logistics and transportation operations. Must demonstrate strong analytical, communication and problem-solving skills. Must have experience working in commercial or governmental operations. Experienced in large scale emergency and disaster response and recovery missions with emphasis on multi-modal operations is desired.

Demonstrate capability/experience of providing logistics augmentation of Multi-Modal Transportation Operations. Must be able to deploy to designated disaster locations within the appointed call period to any location with the United Sates including Alaska and Hawaii to the US Territories. Managers shall be experienced in tracking transportation assets from origin, destination and through retrograde.

7.10 Specialists

Must possess at least one year of experience in logistics and transportation operations.

Experience in large scale emergency and disaster response and recovery missions with emphasis on multimodal operations is desired.

8. DUTIES.

Below are minimum duties for each labor categorgy, and not limited to:

8.1 Contracts Program Manager (Key Personnel)

• Serve as the primary representative to interface between the contractor, CO, and the COR located at FEMA Headquarters.

• Maintains and manages the customer interface at all levels of the customer organization, to include direct reporting and coordination with FEMA CO, Program Managers and COR.

• Organizes, directs, and manages all contract administration activities, project operations and support initiatives necessary to satisfactorily perform the work required in this SOW.

• Provides contract status reports to the designated CO, COR and FEMA Program Managers.

• Ensures full conformance and compliance with contract requirements, scope, schedules, and costs.

8.2 MCU Leader/On-site Manager (Key Personnel)

• Serves as primary POC on-site with decision making authority for all contractor personnel and routine operational decisions as it relates to the operational functions.

• Manages and controls the sites or base operations in concert with the FEMA Manager /

FEMA COR on site.

• Responsible for communicating all tasks defined above in sections 5 and 6.

• Ensures appropriate level of staffing for managing the operations.

• Anticipate customer’s needs and work with FEMA COR and technical personnel to achieve

FEMA mission tactical, operational and strategic goals.

• Understand that FEMA’s mission goals can change for a variety of reasons and is adaptable to those changes to support the overall FEMA objective.

8.3 MCU Deputy Leader / On-site Dep Manager

• Serves as quality control for all movement requirements received in FEMA and other forms of communication for movement requirements.

• Ensures all movement information is complete before giving it to the Transportation

Management Branch (TMB) for scheduling movement.

• Collaborates with the Transportation Specialist and Transportation Planning Manager when identifying and fulfilling designated transportation requirements.

8.4 Transportation Management Manager and Specialists

• Maintain oversight of incident-level movements for all modes across all transportation service providers.

• Identify and seek resolution of movement or transportation issues of federal resource providers and transportation partners with the MCU.

• Provide oversight and guidance to all transportation specialists.

8.5 Transportation Planning Manager and Specialists

• Monitor the entire transportation plan, requests, and capabilities assessments to maintain situational awareness to allow for future planning and estimating new requirements.

• Develop movement courses of action (COA) based on existing and future conditions for traffic congestion, traffic incidents, roadways, rail lines, waterways and air traffic.

• Coordinate with the Incident Management Assistance Team (IMAT) Planners for response to the current incident and informs the MCU of transportation actions and issues or challenges.

• Maintain awareness of the resource phasing plan (RPP) and its synchronization with the execution checklist.

8.6 Movement Tracking Manager and Specialists

• Maintain in-transit visibility (ITV) for all strategic movements, regardless of mode or transportation service provider.

• Verify and track incident-level resource movements and transportation information from federal resource providers and federal interagency partners.

• Anticipate and inform the MCU lead when a required delivery date (RDD) will not be met and is the reason for missing the RDD.

• Provide MCU leadership with updated tracking reports for the next 24, 48, and72 hours and beyond.

8.7 Contractor Employee Conduct and Identification.

8.8 Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees always present a professional appearance and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. Contractor employees understand and abide by Department of Homeland Security established rules, regulations and policies concerning safety and security.

8.9 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

8.10 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

9. TRAVEL

Government-directed travel will be required under this contract, and the task orders will be funded with Travel CLIN for this purpose.

For each instance of Government-directed travel under the Travel CLIN, the COR will provide advance notice of the trip, and the contractor will provide a not-to-exceed price quotation for the trip for the COR’s approval. The trip can occur only after the COR has agreed to the not-to-exceed price; provided, the Travel CLIN has sufficient available funds to cover the not-to-exceed price.

The contractor’s invoice shall include evidence of actual costs incurred by the contractor. The guidelines of FAR 31.205-46 apply. Payment shall not exceed the not-to-exceed price established by paragraph above.

The Government will fund the Travel CLIN based on its estimate of travel costs. The Government may unilaterally raise or lower the amount during performance of the Travel CLIN to reflect an up-to-date estimate.

10. GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

The government will provide mission related information and workspace necessary to perform assigned tasks. No equipment will be provided to the contractor.

11. CONTRACTOR-FURNISHED EQUIPMENT AND INFORMATION

The contractor shall provide personnel with equipment, computers, software, office supplies, communication devices and related service necessary to perform assigned tasks at the contractor and government facilities.

12. TASK ORDER ACTIVATION & DEACTIVATION PROCESS

12.1 Activation

When required, the CLASS contractor will be notified upon National Response Coordination Center (NRCC) and MCC/MCU activation has occurred. There will be circumstances where FEMA will notify after a disaster response is already under way.

Based on guidance received from key FEMA senior leadership, CLASS contract activation is as follows:

a. The FEMA NRCC Contracting Officer (CO) and the FEMA Contracting Officer

Representative (COR) will notify the contractor when disaster operations are underway.

The contractor is not required to begin preparing for CLASS support until the task order is issued. FEMA will ensure the contractor maintain situational awareness throughout the process.

b. The FEMA CO will send the contractor a task order Request for Quote (RFQ). The RFQ will include reporting location(s), estimated minimum support personnel required, and the anticipated duration of the support.

c. The contractor will have twenty-four (24) hours to respond to the task order RFQ with the technical and price proposal response.

d. FEMA will inform the contractor within six hours of the response deadline if a task order will be issued from their proposal.

e. The contractor, will have 12 hours to initialize operations after being awarded a task order. Initializing operations identifying advance personnel to deploy MCU will be activated.

f. The contractor will have a total of 72 hours to reach full operational capacity (FOC) after being awarded a task order. Full operational capacity means having appropriate personnel report to the designated site and operating at the full capacity specified in the task order

RFQ.

g. FEMA may cancel the requirement after requesting proposals, but prior to making task order award. The contractor will not be reimbursed for any costs prior to receiving an award as part of the proposal submission.

h. By exception only, the FEMA CO may adjust the timeline following a task order award as necessary due to the circumstances of the specific disaster, including when the disaster occurs in a remote area, etc. If such circumstances arise, FEMA could increase the original timeline up to 72 hours.

12.2 Deactivation

FEMA may deactivate operations at any time as the disaster shifts from response to recovery and where fewer movements are performed. The FEMA CO will notify the contractor as soon as FEMA leadership determines that support is no longer required. FEMA will provide a deactivation date and the contractor will have a minimum of 48 hours from that date to leave the operation site. The contractor is responsible for relocating its own personnel and resources associated with the operation.

13. POST AWARD CONFERENCE

The Contractor shall attend a Post-Award Conference with the CO, COR and LMD Transportation Management Branch no later than ten business days after the date of award. The purpose of the Post-Award Conference, which will be chaired by the CO, is to discuss technical and contracting objectives of the contract. The Post-Award Conference will be held at the government’s facility, located at 500 C Street SW Washington DC 20024, or via teleconference (ZoomGov).

14. BACKGROUND INVESTIGATIONS/SECURITY

Background Investigations

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a low risk designation and who do not require access to DHS or FEMA information systems shall undergo a Tier 1 (T1) background investigation which is equivalent to the previously identified National Agency Check with Inquiries (NACI). Either of these investigations must be supported by a separate credit check and must receive a favorable adjudication thereof from FEMA PSD prior to holder performing work under this contract. A favorably adjudicated NACI & C will remain acceptable for the purpose of reciprocity where a T1 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI), and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Moderate Risk

Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI), and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

High Risk

Contractor personnel occupying positions or performing functions with a high risk designation shall undergo a Tier 4 (T4) background investigation which is equivalent to the previously identified Background Investigation (BI), and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated BI will remain acceptable for the purpose of reciprocity where a T4 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Background Investigation Process

Contractors performing on this contract must be United States Citizens. Contractor applicants must also be 18 years of age or older to allow for the conduct of certain security related queries.

To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• the investigation was completed within the last d years;

• it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract;

• the contractor personnel have not had a break in employment since the prior favorable adjudication; and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports

Pursuant to the Fair Credit Reporting Act”

Applicants born outside the United States will be required to provide proof of citizenship in the form of a Certificate of Naturalization (Form N550 or N570), an unexpired U.S. Passport, or State Department issued Consular Report of Birth Abroad (CRBA) (FS-240)

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Residency requirements apply to the background investigation process. Persons subject to investigation and final adjudication for fitness or suitability must have lived within the United States for no less than 3 of the last 5 years as defined in the DHS Instruction 121-01-007-01, The Department of Homeland Security, Personnel Security, Suitability and Fitness Program (June 14, 2016). DHS has determined this to be the amount of time required to be the sufficient minimum investigative period for the purpose of performing a suitability or fitness adjudication.

Both, OPM and OMB require a final adjudicative decision to support the issuance of the HSPD- 12 compliant PIV Card that contractors are issued by FEMA Physical Security.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel

Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation

Eligibility determinations based on a T1, T2S, or T4 (or the equivalent OPM investigation) are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

15. FACILITY ACCESS

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

16. SEPARATION FROM CONTRACT

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

17. SECURITY

All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees’ receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S.

citizens. The contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information:

Contractors and Subcontractors who are working on this contract shall receive Unauthorized Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at:

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm

OPSEC Training:

Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief.

Access to the briefing can be obtained at:

https://securityawareness.usalearning.gov/opsec/index.htm

Insider Threat Training:

Contractors and Subcontractors who are working on this contract shall receive the Insider Threat Training at.

https://securityawareness.usalearning.gov/unauthorizedrefresher/index.htm

Insider Threat training for Contractors can be found at:

https://securityawareness.usalearning.gov/itawareness/index.htm

For Official Use Only (FOUO) Information:

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The contractor will:

1. be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information.

Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager. Execution of the NDA shall be effective upon date of the DHS Policy and not applied retroactively.

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten

(10) business days of joining the contract.

18. SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

http://www.dhs.gov/dhs-security-and-training-requirements-contractors

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the…