1.1.3 Attachment 2 - BPA Statement of Objectives - On-Site COVID 19 Screening Testing Final.pdf

STATEMENT OF OBJECTIVES 1

COVID 19 Rapid Field Testing 3

BACKGROUND: Enabling a rapid response health and welfare capability for federal staff 7 during emergency events is a mission-critical requirement. The Federal Emergency Management 8 Agency (FEMA) leads the nation in preventing, preparing for, responding to, and recovering 9 from the adverse effects emergencies and disasters create, by supporting our communities' 10 ability to withstand adversity, strengthening our resilience and response systems, and enhancing 11 readiness. FEMA provides resources to their federal partners to enable effective response to 12 emergencies and catastrophic events, which overwhelm the capacity of state and local 13 emergency systems. 14 SCOPE OF WORK/SPECIFICATIONS: FEMA intends to acquire commercial services to 16 provide equipment and personnel to conduct rapid antigen COVID-19 Testing of Federal 17 Responders, their partners, and any other individual designated to receive these tests by the 18 government. This requirement is inclusive of the United States and its outlying areas, as defined 19 in FAR 2.101 to be determined based on damaged area and availability. While certain tests and 20 capabilities are described below, the government reserves the right to introduce new 21 technologies and testing capabilities for the vendor to administer, as they come online. The 22 government expects that the contractor shall keep up to date on new and emerging testing 23 capabilities and be prepared to utilize them if required by the government. 24 The contractor shall provide all the resources necessary to carry out these requirements, such as 26 (but not limited to) personnel, administration, PPE, diagnostic testing, vital sign measurement, 27 and biomedical waste collection. The contractor shall provide near real time results in 15 to 45 28 minutes and convey those results to the individuals being tested in a manner that ensures privacy 29 standards are maintained. The contractor must have a CLIA waiver in order to perform the 30 requested lab tests. The contractor shall process a volume of 150-200 personnel at a minimum 31 per day for screening. 32 The contractor shall provide this capability based on State and local Public Health requirements. 34 The government reserves the right to expand the requirement to include concurrent operations at 35 multiple facilities. The contractor shall provide confirmatory reverse transcriptase-polymerase 36 chain reaction (RT- PCR) testing where positives are identified from the initial screening and/or 37 where false positives are suspected (e.g., antigen or isothermal amplification testing). 38 The contractor shall provide adequate environmental controls (e.g. HVAC and humidity control) 40 for all required equipment, storage, and use. The contractor shall be responsible for the disposal 41 of any biomedical waste generated during the testing process, as per local, state, and federal 42 regulations. 43 The contractor shall provide the government with a Performance Work Statement (PWS) that 45 outlines specifically how they intend to meet the requirements listed in this Statement Of 46 Objectives (SOO), the sequence of instituting said requirements, and a timeline acceptable to the 47 government of when each of these capabilities will be fully activated. The contractor shall abide 48 by all local, state, and federal safety protocols, legal requirements, and information security 49 requirements. The contractor shall provide in the PWS specific actions they will take to ensure 50 privacy, protected personally identifiable information (PII) pursuant to the Privacy Act of 1974, 51 and protected health information (PHI), as appropriate per the Health Insurance Portability and 52 Accountability Act (HIPAA), as applicable. 53 The contractor shall provide COVID-19 diagnostic testing and associated services as a managed 55 service, to include on-site screening, testing, and results tracking, on a routine basis at DHS 56 designated locations. The contractor shall provide managed services with FDA approved or FDA 57 EUA test kits or using government furnished test kits. Specific requirements will be stated at the 58 order level. 59 Services shall include: 61

• Provisioning of all personnel, equipment, supplies, facilities, tools, materials, supervision and 64 other items and services necessary to conduct testing and provide results. This includes a 65 requirement to provide Personal Protective Equipment (PPE) for medical personnel 66 administering tests, in accordance with Centers for Disease Control and Prevention (CDC) 67 and Occupational Safety and Health Administration (OSHA) guidelines for “Preferred PPE.” 68

• FDA approved or emergency authorized use COVID-19 antigen test that detects for the 69 presence of the SARS-CoV-2 virus with an accuracy rate aligned to best technology and 70 current industry practice 71

• A HIPAA and Privacy Act compliant, secure portal for information collection and 72 notification of results. Scripts of engagement between the vendor and responder must be 73 provided in advance to ensure meeting FEMA privacy requirements 74

• Access to licensed physician(s) who can answer any questions by test takers about the test 75 results and help determine next steps in care 76

• A capability to provide a phone call notification when the virus is detected, with prompt 77 access to a licensed health professional 78

• An anonymized aggregate report with the total number of participants tested and the total 79 number of participants who tested positive for the virus versus negative for the virus 80

• Any other pertinent reports required by the government as directed by the Contracting 81 Officer (CO) or Contracting Officer’s Representative (COR) 82

• The capability to provide an Individual results report in electronic fashion, downloadable by 83 the identified employee or a hard copy of the report if requested by the identified employee. 84

• Access to individual results and reports with customizable access restriction to ensure 85 compliance with privacy and information security requirements 86

• The ability to enable contact tracing, meeting CDC guidance and state and local reporting 87 requirements 88

ADDITIONAL REQUIREMENTS: COVID-19 diagnostic testing acquired through this 89 vehicle must be carried out in compliance with 5 C.F.R Part 339, the Rehabilitation Act, 29 90 U.S.C. § 701 et seq., and Americans with Disabilities Act (ADA), 42 U.S.C. §§ 12102 et seq. 91 Components may only carry out such testing after a determination has been made that their 92 planned testing program complies with the Fourth Amendment, Rehabilitation Act, the ADA, 5 93

C.F.R. Part 339, and any other applicable law. In carrying out COVID-19 diagnostic testing 94 Components must ensure compliance with its collective bargaining requirements. 95 Any information collected and disclosed pursuant to COVID-19 diagnostic testing acquired 97 through this IDIQ must be collected and disclosed in compliance with, as applicable, the Privacy 98 Act of 1974, as amended, 5 U.S.C. § 552a, the CARES Act, HIPAA (when otherwise applicable) 99 and any other applicable law. 100 Privacy Act compliance requires that information collected and disclosed pursuant to COVID-19 102 diagnostic testing acquired through this BPA be covered by an applicable system or records 103 notice (SORN) prior to such collection and disclosure. Components shall coordinate with their 104 Component Privacy Office and legal counsel in planning testing in order to ensure that a SORN 105 governs the population to be tested and the information to be collected and disclosed. 106

DELIVERABLES: 108

• As described in Scope/Specifications sections above 109

• Itemized Invoice every thirty (30) days during the period of performance 110

PERIOD OF PERFORMANCE: Three Months from date of award, with one three-month 112 Option period. The implementation date should be as soon as practicable. 113

GOVERNMENT FURNISHED PROPERTY: In some cases, the Government will provide 114 testing kits and if needed the proper medical machinery to diagnose tests. 115 CONTRACTOR FURNISHED PROPERTY: All the required materials to support the 117 implementation of the SOO per PWS. 118

REPORTING REQUIREMENTS: The contractor shall report on all activities supported as 120 directed by the COR and provide an itemized Invoice every thirty (30) days during the period of 121 performance. 122

INFORMATION SHARING: 123

The FEMA contractor shall only collect or maintain information from and about FEMA employees only. 124 To accomplish the tasks outlined in this contract, FEMA may only share with or allow access to by the 125 contractor the following PII data elements: 126 Identification number/Account number 128 Name 129 Date of birth (DOB) 130 Gender 131 Mailing address 132 Email address 133 Occupation (Optional) 134 Testing Kits 135 Testing Results 136

The information sharing outlined in this contract is authorized by the following System of Records 138 Notice(s) and Routine Use(s): DHS/ALL-047 Records Related to DHS Personnel, Long-Term Trainees, 139 Contractors, and Visitors During a Declared Public Health Emergency System of Records, Routine use G. 140

The contractor shall limit access to the PII provided by FEMA under this contract only to the contractor’s 141 authorized personnel who need to know the information to accomplish the tasks outlined in this contract. 142

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will 143 occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind 144 assistance or payments under federal benefit programs. 145

If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor 146 obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon 147 termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days 148 thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request 149 destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and 150 certify in writing to FEMA that such tasks have been completed. 151

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015) 153

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 155 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert 156 the substance of this clause in all subcontracts. 157

(b) Definitions. As used in this clause— 159

“Personally Identifiable Information (PII)” means information that can be used to distinguish 161 or trace an individual's identity, such as name, social security number, or biometric records, 162 either alone, or when combined with other personal or identifying information that is linked or 163 linkable to a specific individual, such as date and place of birth, or mother’s maiden name. 164 The definition of PII is not anchored to any single category of information or technology. 165 Rather, it requires a case-by-case assessment of the specific risk that an individual can be 166 identified. In performing this assessment, it is important for an agency to recognize that non-167 personally identifiable information can become personally identifiable information whenever 168 additional information is made publicly available—in any medium and from any source—169 that, combined with other available information, could be used to identify an individual. 170

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, 172 date of birth, mailing address, telephone number, Social Security number (SSN), email 173 address, zip code, account numbers, certificate/license numbers, vehicle identifiers including 174 license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric 175 identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other 176 unique identifying number or characteristic, and any information where it is reasonably 177 foreseeable that the information will be linked with other information to identify the 178 individual. 179

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee 181 Access, as any information, which if lost, misused, disclosed, or, without authorization is 182 accessed, or modified, could adversely affect the national or homeland security interest, the 183 conduct of Federal programs, or the privacy to which individuals are entitled under section 184 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically 185 authorized under criteria established by an Executive Order or an Act of Congress to be kept 186 secret in the interest of national defense, homeland security or foreign policy. This definition 187 includes the following categories of information: 188

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure 190 Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 191 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of 192 Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as 193 amended, and any supplementary guidance officially communicated by an authorized official 194 of the Department of Homeland Security (including the PCII Program Manager or his/her 195 designee); 196

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, 198 Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as 199 amended, and any supplementary guidance officially communicated by an authorized 200 official of the Department of Homeland Security (including the Assistant Secretary for the 201 Transportation Security Administration or his/her designee); 202

(2) Information designated as “For Official Use Only,” which is unclassified information of a 204 sensitive nature and the unauthorized disclosure of which could adversely impact a person’s 205 privacy or welfare, the conduct of Federal programs, or other programs or operations essential 206 to the national or homeland security interest; and 207

(3) Any information that is designated “sensitive” or subject to other controls, safeguards 209 or protections in accordance with subsequently adopted homeland security information 210 handling procedures. 211 “Sensitive Information Incident” is an incident that includes the known, potential, or 213 suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized 214 acquisition, or unauthorized access or attempted access of any Government system, 215 Contractor system, or sensitive information. 216 “Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, 217 compromised or disclosed without authorization, could result in substantial harm, 218 embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive 219 as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), 220 driver’s license or state identification number, Alien Registration Numbers (A-number), 221 financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. 222 Additional examples include any groupings of information that contain an individual’s name 223 or other unique identifier plus one or more of the following elements: 224

(1) Truncated SSN (such as last 4 digits) 226

(2) Date of birth (month, day, and year) 227

(3) Citizenship or immigration status 228

(4) Ethnic or religious affiliation 229

(5) Sexual orientation 230

(6) Criminal History 231

(7) Medical Information 232

(8) System authentication information such as mother’s maiden name, account passwords 233 or personal identification numbers (PIN) 234

Other PII may be “sensitive” depending on its context, such as a list of employees and their 236 performance ratings or an unlisted home address or phone number. In contrast, a business 237 card or public telephone directory of agency employees contains PII but is not sensitive. 238

(c) Authorities. The Contractor shall follow all current versions of Government policies and 240 guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-241 contractors, or available upon request from the Contracting Officer, including but not 242 limited to: 243

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for 245 Official Use Only) Information 246

(2) DHS Sensitive Systems Policy Directive 4300A 247

(3) DHS 4300A Sensitive Systems Handbook and Attachments 248

(4) DHS Security Authorization Process Guide 249

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information 250

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security 251 Personnel Suitability and Security Program 252

(7) DHS Information Security Performance Plan (current fiscal year) 253

(8) DHS Privacy Incident Handling Guidance 254

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for 255 Cryptographic Modules accessible at 256 http://csrc.nist.gov/groups/STM/cmvp/standards.html 257

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 258 Security and Privacy Controls for Federal Information Systems and Organizations accessible 259 at http://csrc.nist.gov/publications/PubsSPs.html 260

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible 261 http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://csrc.nist.gov/groups/STM/cmvp/standards.html http://csrc.nist.gov/publications/PubsSPs.html at http://csrc.nist.gov/publications/PubsSPs.html 262

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as 264 the policies and procedures described below, is required. 265

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel 267 security requirements are set forth in various Management Directives (MDs), Directives, and 268 Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) 269 Information describes how Contractors must handle sensitive but unclassified information. 270 DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified 271 information that is not otherwise categorized by statute or regulation. Examples of sensitive 272 information that are categorized by statute or regulation are PCII, SSI, etc. The DHS 273 Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook 274 provide the policies and procedures on security for Information Technology (IT) resources. 275 The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides 276 guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction 277 Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security 278 Program establishes procedures, program responsibilities, minimum standards, and reporting 279 protocols for the DHS Personnel Suitability and Security Program. 280

(2) The Contractor shall not use or redistribute any sensitive information processed, 282 stored, and/or transmitted by the Contractor except as specified in the contract. 283

(3) All Contractor employees with access to sensitive information shall execute DHS Form 285 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition 286 of access to such information. The Contractor shall maintain signed copies of the NDA for 287 all employees as a record of compliance. The Contractor shall provide copies of the signed 288 NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after 289 execution of the form. 290

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to 292 support financial or other administrative functions shall not maintain SPII. It is acceptable 293 to maintain in these systems the names, titles and contact information for the COR or other 294 Government personnel associated with the administration of the contract, as needed. 295

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or 297 transmit sensitive information within a Contractor IT system without an Authority to 298 Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation 299 with the Headquarters or Component Privacy Officer. Unless otherwise specified in the 300 ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current 301 Government policies, procedures, and guidance for the Security Authorization (SA) process 302 as defined below. 303 http://csrc.nist.gov/publications/PubsSPs.html

(1) Complete the Security Authorization process. The SA process shall proceed according to 305 the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any 306 successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), 307 or any successor publication, and the Security Authorization Process Guide including 308 templates. 309

(i) Security Authorization Process Documentation. SA documentation shall be 311 developed using the Government provided Requirements Traceability Matrix and 312 Government security documentation templates. SA documentation consists of the 313 following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration 314 Management Plan, Security Assessment Plan, Security Assessment Report, and 315 Authorization to Operate Letter. Additional documents that may be required include a 316 Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the 317 development of SA documentation, the Contractor shall submit a signed SA package, 318 validated by an independent third party, to the COR for acceptance by the Headquarters or 319 Component CIO, or designee, at least thirty (30) days prior to the date of operation of the 320 IT system. The Government is the final authority on the compliance of the SA package 321 and may limit the number of resubmissions of a modified SA package. Once the ATO has 322 been accepted by the Headquarters or Component CIO, or designee, the Contracting 323 Officer shall incorporate the ATO into the contract as a compliance document. The 324 Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to 325 ensure the IT system controls are implemented and operating effectively. 326

(ii) Independent Assessment. Contractors shall have an independent third party validate 328 the security and privacy controls in place for the system(s). The independent third party 329 shall review and analyze the SA package, and report on technical, operational, and 330 management level deficiencies as outlined in NIST Special Publication 800-53 Security 331 and Privacy Controls for Federal Information Systems and Organizations. The 332 Contractor shall address all deficiencies before submitting the SA package to the 333 Government for acceptance. 334

Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of 336 the SA process, the Contractor may be required to support the Government in the 337 completion of the PTA. The requirement to complete a PTA is triggered by the creation, 338 use, modification, upgrade, or disposition of a Contractor IT system that will store, 339 maintain and use PII, and must be renewed at least every three (3) years. Upon review of 340 the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) 341 and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are 342 required. The Contractor shall provide all support necessary to assist the Department in 343 completing the PIA in a timely manner and shall ensure that project management plans 344 and schedules include time for the completion of the PTA, PIA, and SORN (to the extent 345 required) as milestones. Support in this context includes responding timely to requests for 346 information from the Government about the use, access, storage, and maintenance of PII 347 on the Contractor’s system, and providing timely review of relevant compliance 348 documents for factual accuracy. Information on the DHS privacy compliance process, 349 including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-350 compliance. 351

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be 353 renewed every three (3) years. The Contractor is required to update its SA package as part 354 of the ATO renewal process. The Contractor shall update its SA package by one of the 355 following methods: 356

(1) Updating the SA documentation in the DHS automated information assurance tool for 357 acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the 358 ATO expiration date for review and verification of security controls; or (2) Submitting an 359 updated SA package directly to the COR for approval by the Headquarters or Component 360 CIO, or designee, at least 90 days before the ATO expiration date for review and verification 361 of security controls. The 90 day review process is independent of the system production date 362 and therefore it is important that the Contractor build the review into project schedules. The 363 reviews may include onsite visits that involve physical or logical inspection of the Contractor 364 environment to ensure controls are in place. 365

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure 367 that the security requirements contained in this contract are being implemented and enforced. 368 The Contractor shall afford DHS, the Office of the Inspector General, and other Government 369 organizations access to the Contractor’s facilities, installations, operations, documentation, 370 databases and personnel used in the performance of this contract. The Contractor shall, 371 through the Contracting Officer and COR, contact the Headquarters or Component CIO, or 372 designee, to coordinate and participate in review and inspection activity by Government 373 organizations external to the DHS. Access shall be provided, to the extent necessary as 374 determined by the Government, for the Government to carry out a program of inspection, 375 investigation, and audit to safeguard against threats and hazards to the integrity, availability 376 and confidentiality of Government data or the function of computer systems used in 377 performance of this contract and to preserve evidence of computer crime. 378

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, 380 and/or transmit sensitive information shall meet or exceed the continuous monitoring 381 requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, 382 or successor publication. The plan is updated on an annual basis. The Contractor shall also 383 store monthly continuous monitoring data at its location for a period not less than one year 384 from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 385 Security Requirements for Cryptographic Modules and shall not be stored on systems that are 386 shared with other commercial or Government entities. The Government may elect to perform 387 continuous monitoring and IT security scanning of Contractor systems from Government 388 tools and infrastructure. 389 http://www.dhs.gov/privacy-compliance http://www.dhs.gov/privacy-compliance

(5) Revocation of ATO. In the event of a sensitive information incident, the Government 391 may suspend or revoke an existing ATO (either in part or in whole). If an ATO is 392 suspended or revoked in accordance with this provision, the Contracting Officer may direct 393 the Contractor to take additional security measures to secure sensitive information. These 394 measures may include restricting access to sensitive information on the Contractor IT 395 system under this 396 contract. Restricting access may include disconnecting the system processing, storing, or 397 transmitting the sensitive information from the Internet or other networks or applying 398 additional security controls. 399

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of 401 the Government or operating systems containing sensitive information shall comply with 402 Federal reporting requirements. Annual and quarterly data collection will be coordinated by 403 the Government. Contractors shall provide the COR with requested information within three 404

(3) business days of receipt of the request. Reporting requirements are determined by the 405 Government and are defined in the Fiscal Year 2014 DHS Information Security Performance 406 Plan, or successor publication. The Contractor shall provide the Government with all 407 information to fully satisfy Federal reporting requirements for Contractor systems. 408

(f) Sensitive Information Incident Reporting Requirements. 410

(1) All known or suspected sensitive information incidents shall be reported to the 412 Headquarters or Component Security Operations Center (SOC) within one hour of discovery 413 in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting 414 requirements. When notifying the Headquarters or Component SOC, the Contractor shall also 415 notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-416 CERT using the contact information identified in the contract. If the incident is reported by 417 phone or the Contracting Officer’s email address is not immediately available, the Contractor 418 shall contact the Contracting Officer immediately after reporting the incident to the 419 Headquarters or Component SOC. The Contractor shall not include any sensitive information 420 in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall 421 use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption 422 methods to protect sensitive information in attachments to email. Passwords shall not be 423 communicated in the same email as the attachment. A sensitive information incident shall not, 424 by itself, be interpreted as evidence that the Contractor has failed to provide adequate 425 information security safeguards for sensitive information, or has otherwise failed to meet the 426 requirements of the contract. 427

(2) If a sensitive information incident involves PII or SPII, in addition to the reporting 429 requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, 430 Contractors shall also provide as many of the following data elements that are available at 431 the time the incident is reported, with any remaining data elements provided within 24 432 hours of submission of the initial incident report: 433

(i) Data Universal Numbering System (DUNS); 435

(ii) Contract numbers affected unless all contracts by the company are affected; 436

(iii) Facility CAGE code if the location of the event is different than the prime 437 contractor location; 438

(iv) Point of contact (POC) if different than the POC recorded in the System for 439 Award Management (address, position, telephone, email); 440

(v) Contracting Officer POC (address, telephone, email); 441

(vi) Contract clearance level; 442

(vii) Name of subcontractor and CAGE code if this was an incident on a 443 subcontractor network; 444

(viii) Government programs, platforms or systems involved; 445

(ix) Location(s) of incident; 446

(x) Date and time the incident was discovered; 447

(xi) Server names where sensitive information resided at the time of the incident, both at 448 the Contractor and subcontractor level; 449

(xii) Description of the Government PII and/or SPII contained within the system; 450

(xiii) Number of people potentially affected and the estimate or actual number of 451 records exposed and/or contained within the system; and 452

(xiv) Any additional information relevant to the incident. 453

(g) Sensitive Information Incident Response Requirements. 455

(1) All determinations related to sensitive information incidents, including response 457 activities, notifications to affected individuals and/or Federal agencies, and related services 458 (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation 459 with the Headquarters or Component CIO and Headquarters or Component Privacy 460 Officer. 461

(2) The Contractor shall provide full access and cooperation for all activities determined by 463 the Government to be required to ensure an effective incident response, including providing 464 all requested images, log files, and event information to facilitate rapid resolution of 465 sensitive information incidents. 466

(3) Incident response activities determined to be required by the Government may include, 468 but are not limited to, the following: 469

(i) Inspections, 471

(ii) Investigations, 472

(iii) Forensic reviews, and 473

(iv) Data analyses and processing. 474

(4) The Government, at its sole discretion, may obtain the assistance from other Federal 476 agencies and/or third-party firms to aid in incident response activities. 477

(h) Additional PII and/or SPII Notification Requirements. 479

(1) The Contractor shall have in place procedures and the capability to notify any individual 481 whose PII resided in the Contractor IT system at the time of the sensitive information 482 incident not later than 5 business days after being directed to notify individuals, unless 483 otherwise approved by the Contracting Officer. The method and content of any 484 notification by the Contractor shall be coordinated with, and subject to prior written 485 approval by the Contracting 486 Officer, in consultation with the Headquarters or Component Privacy Officer, utilizing the 487 DHS Privacy Incident Handling Guidance. The Contractor shall not proceed with 488 notification unless the Contracting Officer, in consultation with the Headquarters or 489 Component Privacy Officer, has determined in writing that notification is appropriate. 490

(2) Subject to Government analysis of the incident and the terms of its instructions to the 492 Contractor regarding any resulting notification, the notification method may consist of letters 493 to affected individuals sent by first class mail, electronic means, or general public notice, as 494 approved by the Government. Notification may require the Contractor’s use of address 495 verification and/or address location services. At a minimum, the notification shall include: 496

(i) A brief description of the incident; 498

(ii) A description of the types of PII and SPII involved; 499

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means; 500

(iv) Steps individuals may take to protect themselves; 501

(v) What the Contractor and/or the Government are doing to investigate the incident, 502 to mitigate the incident, and to protect against any future incidents; and 503

(vi) Information identifying who individuals may contact for additional information. 504

(i) Credit Monitoring Requirements. In the event that a sensitive information incident 506 involves PII or SPII, the Contractor may be required to, as directed by the Contracting 507 Officer: 508

(1) Provide notification to affected individuals as described above; and/or 510

(2) Provide credit monitoring services to individuals whose data was under the control of the 512 Contractor or resided in the Contractor IT system at the time of the sensitive information 513 incident for a period beginning the date of the incident and extending not less than 18 months 514 from the date the individual is notified. Credit monitoring services shall be provided from a 515 company with which the Contractor has no affiliation. At a minimum, credit monitoring 516 services shall include: 517

(i) Triple credit bureau monitoring; 519

(ii) Daily customer service; 520

(iii) Alerts provided to the individual for changes and fraud; and 521

(iv) Assistance to the individual with enrollment in the services and the use of fraud 522 alerts; and/or 523

(3) Establish a dedicated call center. Call center services shall include: 525

(i) A dedicated telephone number to contact customer service within a fixed period; 527

(ii) Information necessary for registrants/enrollees to access credit reports and 528 credit scores; 529

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot 530 be handled by call center staff and must be resolved by call center management or DHS, 531 as appropriate), and other key metrics; 532

(iv) Escalation of calls that cannot be handled by call center staff to call center 533 management or DHS, as appropriate; 534

(v) Customized FAQs, approved in writing by the Contracting Officer in coordination 535 with the Headquarters or Component Chief Privacy Officer; and 536

(vi) Information for registrants to contact customer service representatives and 537 fraud resolution representatives for credit monitoring assistance. 538

(j) Certification of Sanitization of Government and Government-Activity-Related Files and 540 Information. As part of contract closeout, the Contractor shall submit the certification to the 541 COR and the Contracting Officer following the template provided in NIST Special 542 Publication 800-88 Guidelines for Media Sanitization. 543

INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 545

2015) 546 Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 548 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the 549 substance of this clause in all subcontracts. 550 Security Training Requirements. 552 All users of Federal information systems are required by Title 5, Code of Federal Regulations, 554 Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually 555 or whenever system security changes occur, or when the user’s responsibilities change. The 556

Department of Homeland Security (DHS) requires that Contractor employees take an annual 557 Information Technology Security Awareness Training course before accessing sensitive 558 information under the contract. Unless otherwise specified, the training shall be completed 559 within thirty (30) days of contract award and be completed on an annual basis thereafter not 560 later 561 than October 31st of each year. Any new Contractor employees assigned to the contract shall 562 complete the training before accessing sensitive information under the contract. The training is 563 accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The 564 Contractor shall maintain copies of training certificates for all Contractor and subcontractor 565 employees as a record of compliance. Unless otherwise specified, initial training certificates for 566 each Contractor and subcontractor employee shall be provided to the Contracting Officer’s 567 Representative (COR) not later than thirty (30) days after contract award. Subsequent training 568 certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail 569 notification not later than October 31st of each year. The e-mail notification shall state the 570 required training has been completed for all Contractor and subcontractor employees. 571 The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that 573 will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall 574 be signed before accessing DHS systems and sensitive information. The DHS Rules of 575 Behavior is a document that informs users of their responsibilities when accessing DHS systems 576 and holds users accountable for actions taken while accessing DHS systems and using DHS 577 Information Technology resources capable of inputting, storing, processing, outputting, and/or 578 transmitting sensitive information. The DHS Rules of Behavior is accessible at 579 http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise 580 specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. 581 Any new Contractor employees assigned to the contract shall also sign the DHS Rules of 582 Behavior before accessing DHS systems and sensitive information. The Contractor shall 583 maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor 584 employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail 585 copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after 586 contract award for each employee. The DHS Rules of Behavior will be reviewed annually and 587 the COR will provide notification when a review is required. 588 Privacy Training Requirements. All Contractor and subcontractor employees that will have 590 access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to 591 take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The 592 training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-593 contractors. 594 Training shall be completed within thirty (30) days of contract award and be completed on an 596 annual basis thereafter not later than October 31st of each year. Any new Contractor employees 597 assigned to the contract shall also complete the training before accessing PII and/or SPII. The 598 Contractor shall maintain copies of training certificates for all Contractor and subcontractor 599 employees as a record of compliance. Initial training certificates for each Contractor and 600 subcontractor employee shall be provided to the COR not later than thirty (30) days after 601 http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors contract award. Subsequent training certificates to satisfy the annual training requirement shall 602 be submitted to the COR via e-mail notification not later than October 31st of each year. The e- 603 mail notification shall state the required training has been completed for all Contractor and 604 subcontractor employees. 605

Records Management Obligations: 607

A. Applicability 608

This clause applies to all Contractors whose employees create, work with, or otherwise handle 609 Federal records, as defined in Section B, regardless of the medium in which the record exists. 610

B. Definitions 611

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of 612 form or characteristics, made or received by a Federal agency under Federal law or in connection 613 with the transaction of public business and preserved or appropriate for preservation by that 614 agency or its legitimate successor as evidence of the organization, functions, policies, decisions, 615 procedures, operations, or other activities of the United States Government or because of the 616 informational value of data in them. 617

The term Federal record: 618

1. includes FEMA records. 619

2. does not include personal materials. 620

3. applies to records created, received, or maintained by Contractors pursuant to their 621

FEMA contract. 622

4. may include deliverables and documentation associated with deliverables. 623

C. Requirements 625

1. Contractor shall comply with all applicable records management laws and 626 regulations, as well as National Archives and Records Administration (NARA) 627 records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 628 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those 629 policies associated with the safeguarding of records covered by the Privacy Act of 630 1974 (5 U.S.C. 552a). These policies include the preservation of all records, 631 regardless of form or characteristics, mode of transmission, or state of completion. 632

2. In accordance with 36 CFR 1222.32, all data created for Government use and 633 delivered to, or falling under the legal control of, the Government are Federal records 634 subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of 635 Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 636 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as 637 permitted by statute or regulation. 638

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for 639

Government use or created in the course of performing the contract and/or delivered 640 to, or under the legal control of the Government and must be managed in accordance 641 with Federal law. Electronic records and associated metadata must be accompanied 642 by sufficient technical documentation to permit understanding and use of the records 643 and data. 644

4. FEMA and its contractors are responsible for preventing the alienation or 645 unauthorized destruction of records, including all forms of mutilation. Records may 646 not be removed from the legal custody of FEMA or destroyed except for in 647 accordance with the provisions of the agency records schedules and with the written 648 concurrence of the Head of the Contracting Activity. Willful and unlawful 649 destruction, damage or alienation of Federal records is subject to the fines and 650 penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental 651 removal, defacing, alteration, or destruction of records, Contractor must report to 652 FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230. 653

5. The Contractor shall immediately notify the appropriate Contracting Officer upon 654 discovery of any inadvertent or unauthorized disclosures of information, data, 655 documentary materials, records or equipment. Disclosure of non-public information is 656 limited to authorized personnel with a need-to-know as described in the SOW. The 657 Contractor shall ensure that the appropriate personnel, administrative, technical, and 658 physical safeguards are established to ensure the security and confidentiality of this 659 information, data, documentary material, records and/or equipment is properly 660 protected. The Contractor shall not remove material from Government facilities or 661 systems, or facilities or systems operated or maintained on the Government’s behalf, 662 without the express written permission of the Head of the Contracting Activity. When 663 information, data, documentary material, records and/or equipment is no longer 664 required, it shall be returned to FEMA control or the Contractor must hold it until 665 otherwise directed. Items returned to the government will be hand carried, mailed, 666 emailed, or securely electronically transmitted to the Contracting Officer or address 667 prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless 668 in accordance with Paragraph (4). 669

6. The Contractor is required to obtain the Contracting Officer's approval prior to 670 engaging in any contractual relationship (sub-contractor) in support of this contract 671 requiring the disclosure of information, documentary material and/or records 672 generated under, or relating to, contracts. The Contractor (and any sub-contractor) is 673 required to abide by Government and FEMA guidance for protecting sensitive, 674 proprietary information, classified, and controlled unclassified information. 675

7. The Contractor shall only use Government IT equipment for purposes specifically 676 tied to or authorized by the contract and in accordance with FEMA policy. 677

8. The Contractor shall not create or maintain any records containing any non-public 678 FEMA information that are not specifically tied to or authorized by the contract. 679

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that 680 contains information covered by the Privacy Act of 1974 or that which is generally 681 protected from public disclosure by an exemption to the Freedom of Information Act. 682

10. The FEMA owns the rights to all data and records produced as part of this contract. 683 All deliverables under the contract are the property of the U.S. Government for which 684 FEMA shall have unlimited rights to use, dispose of, or disclose such data contained 685 therein as it determines to be in the public interest. Any Contractor rights in the data 686 or deliverables must be identified as required by FAR 52.227-11 through FAR 687 52.227-20. 688

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)