1.1.3 SOW_ FACT 20250319_V3_CGIS Review-Final -Security Verbiage.pdf

March 19, 2025 PAGE 1/33

STATEMENT OF WORK (SOW)

COAST GUARD INVESTIGATIVE SERVICE

FIELD ACTIVITY CASE TRACKING SYSTEM (FACTS)

INFORMATION TECHNOLOGY SUPPORT SERVICES

1.0 GENERAL

1.1 BACKGROUND

The United States Coast Guard (USCG) Investigative Service (CGIS) utilizes the online, Field Activity Case Tracking System (FACTS) that provides full capability for storing/sharing law enforcement investigative information including physical security, anti-terrorism/force protection (AT/FP), protective security information and case data across the enterprise. The USCG Civil Rights Directorate (CRD) stores historical Anti-Hate and Harassment Incident (AHHI) case file information The FACTS supports performance metrics analysis within CGIS and CRD operations and other USCG missions.

1.2 SCOPE

This SOW provides specific objectives for the following activities:

Requirements:

Software maintenance (See paragraph 2.1)

System sustainment (maintenance and upgrades) (See paragraph 2.2)

Offsite system management support (See paragraph 2.3)

Onsite system support (See paragraph 2.4)

D-DEx Data Transfers (See paragraph 2.5)

OCDETF Data Transfers (See paragraph 2.6)

National Incident-Based Reporting System (NIBRS) Data Transfers (See paragraph 2.7)

1.3 OBJECTIVE

The objective of this procurement is to procure software licenses and obtain ongoing software maintenance, system sustainment, and system refinement services for the system licenses associated with both the CGIS and CRD system functionality.

March 19, 2025 PAGE 2/33

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK ONE. Software Maintenance

The Contractor shall deliver, install and maintain software identified in Table 1 below.

The contractor shall include all version updates and conduct patch updates to the software in Table 1.

Part Number Description Quantity

Hexagon (HxGN) OnCall Records

IPS.M.RMS0016 HxGN OnCall Records(WebRMS) Server License – MNT 1

IPS.M.RMS0016TST HxGN OnCall Records(WebRMS) Server License - Test License - MNT

IPS.M.RMS0017 HxGN OnCall Records(WebRMS) Concurrent User License – MNT

IPS.M.RMS0017TST HxGN OnCall Records(WebRMS)Concurrent User License - Test License - MNT

IPS.M.PSA2100 NIBRS RMS - Federal - MNT 1

IPS.M.IPS3042 EdgeFrontier Runtime Engine MNT 1

IPS.M.IPS2105 MS SQL Server Reporting Services – MNT 3

IPS.M.IPS2304 HxGN OnCall Analytics - Records Essentials 4 Core MNT 1

Table 1 - Schedule of Maintained Software Products

2.2 TASK TWO. System Sustainment and Maintenance

The Contractor shall provide system sustainment support, to include the following:

(a) The Contractor shall attend CGIS’ Monthly CCB Working Group: the CCB Working Group to support CGIS’ FACTS administrator to prepare and answer questions of investigators.

(b) The Contractor shall provide on-call IT Customer Support Center support on a 24-hour per day, 7 days per week basis to assist with the resolution of problems within the operation of the CGIS FACTS server database, application software, development tools, report writers, productivity tools, network software and external interface software; not limited to, but including, OnCall Analytics, NIBRS Reporting Client, and Attachment Manager.

(c) The Contractor shall provide IT Support via telephone through a live representative for urgent critical function support and/or web-based support for non-critical trouble tickets as outlined in the response timetable Table 2 below.

March 19, 2025 PAGE 3/33

Priority Definition Response Timeline 1 Loss of data

Data corruption Productive use prohibited No workaround available Aborts

Mon-Fri, 0700-1600 Central Time – Immediate

Afterhours – Within two (2) hours of notification

2 Primary purpose compromised Productive use significantly impacted Workaround generally not available

Mon-Fri, 0700-1600 Central Time – Immediate

Afterhours – Within two

(2) hours of notification

3 Productive, but incomplete operation

Workarounds generally available

Afterhours – Within eight (8) hours of notification

4 Productive, mainly cosmetic in nature

Workarounds or configurable options generally available

Afterhours – Within eight (8) hours of notification

Table 2 - Trouble Ticket Response Timetable

(d) The Contractor shall provide implementation of software updates, patches, and vulnerability management of items found during vulnerability scans that apply to Hexagon software and software required in support of Hexagon’s software, e.g. TomCat; to include applying Security Technical Implementation Guides (STIG) for findings pertaining to the OnCall and related software, to include analytics, NIBRS, etc.

The Government will provide the Contractor with all required STIG checklists and a Government POC who will work with the Contractor, as needed, on Contractor’s input on Cyber-related documents.

The Contractor shall be responsible for the application-layer security requirements which map to the application and the STIG/Checklist.

If there are associated STIGs/SRG’s that apply to the Contractor software runtime environment, the Contractor is responsible to apply them. C5ISC/PAAS manages the implementation of OS, Web and Database baseline STIG’ing for the FACTS servers. After the baseline OS, Web and DB STIGS are applied, the Contractor shall load its software and ensure the software solution and architecture meet the application and security STIG/SRG Checklist. All deviations from the application and development STIG are identified, documented and reviewed by the FACTS ISSO.

March 19, 2025 PAGE 4/33 o The Contractor is not responsible for OS, WEB and DB STIG implementation.

All application-layer software that the FACTS application depends upon shall be patched and kept up to date by the Contractor.

All FACTS application-layer software Common Weakness Enumeration (CWE) findings are identified, planned for and fixed by the Contractor.

All FACTS application-layer software Common Vulnerability Exposures (CVE) findings are identified, planned for and fixed by the Contractor.

o The Contractor is not responsible for CWE or CVE findings associated to the OS, WEB and DB.

CGCyber Task Orders related to the software boundary of the FACTS application shall be fixed by the Contractor.

The Contractor shall work with the C5ISC/PAAS team if changes to STIG’s, or if CWE’s and CVE’s are identified on the OS, WEB and DB, which could require testing, to ensure application functionality is not impacted.

(e) The Contractor shall update comprehensive FACTS OnCall Records architecture diagrams describing the structure of the OnCall Records & Analytics database on the server.

(f) The Contractor shall schedule system downtime in coordination with CGIS and the Command Control Communications Computers Cyber Intelligence Service Center (C5ISC) for FACTS system maintenance. Periods during which system is scheduled to be down for activities such as updates, and patches shall be conducted outside of the core working hours, whenever possible. Core working hours are identified in SOW Section 4.9. The Contractor shall notify the COR no later than 1 week in advance of planned system unavailability.

(g) The Contractor shall notify the CGIS FACTS Program Manager and the COR, in writing or email, of all delays associated with network access, administrator privileges, opening firewalls, CAC Credentials, via CGFixit help support.

2.3 TASK THREE. System Management Support

The Contractor shall provide the following off-site system management support for the existing CGIS FACTS system:

(a) The Contractor shall participate via teleconference in the monthly CGIS FACTS Configuration Control Board (CGIS FACTS CCB) meeting. The Contractor shall brief the progress and schedule for completion of the items listed at each CGIS FACTS CCB meeting.

March 19, 2025 PAGE 5/33

The Contractor shall provide project management support for project coordination, scheduling, reporting, and meeting attendance. The Project Manager shall attend a Post Award Conference per SOW Section 4.9 to define a mutually agreed upon project schedule as well as coordinate all contractor resources necessary to complete all tasks.

2.4 TASK FOUR. System Support: Contractor OnCall Records

Provide one (1) Full-time Subject Matter Expert (SME) onsite at USCG HQ. SME tasks may include, but not be limited to, the following: Maintain Current Custom Power BI reports and/or Custom models. Develop new custom Power BI reports and/or Custom models. Document all current and future USCG FACTS customizations. Support Contractor FACTS Technical Lead/SMEs. Change, configure, and manage reports for the OnCall Records/Analytics software where Contractor System Support procedures do not change. USCG submit Contractor Support Desk Tickets for triage and tracking.

Contractor resources receive direction from Contractor Program Manager and Contractor Technical Manager and provide virtual annual OnCall Analytics refresher training for the FACTS technical staff. Contractor shall provide consulting for USCG FACTS staff in development of workflows, operating procedures to improve efficiencies, deployment of new functionality, and assist USCG FACTS staff in limited and technically focused overviews. Contractor shall support the FACTS Team in OnCall application update testing, provide complex issue troubleshooting and resolution, travel to support in-person FACTS meetings within the scope of duties, and provide support for the entire suite of Contractor-provided products.

USCG will provide the Contractor SME with USCG laptop Administrator Access to

FACTS

2.5 TASK FIVE. D-DEx Data Transfers

Upon USCG obtaining the appropriate Interoperability Service Agreement, the Contractor shall prepare and provide .xml data transfers from the CGIS FACTS database to the Department of Defense Law Enforcement Data Exchange (D-DEx) as per the following:

The Contractor shall prepare and electronically submit a weekly D-Dex data transfer consisting of closed CGIS FACTS Agency case information, with the exception of attachments and data related to Task Force Operations, ADMIN, OIG, and Background Investigations, to D-DEx. The first data transfer is required 90 days after the performance period start date with automated weekly submissions occurring thereafter. The Contractor shall notify the COR and FACTS Program Manager upon the successful transmission of all weekly data transfers.

March 19, 2025 PAGE 6/33

2.6 TASK SIX. OCDETF Data Transfers

The Contractor shall prepare and provide data transfers from the CGIS FACTS database to the Organized Crime Drug Enforcement Task Force Fusion Center (OCDETF) as per the following:

The Contractor shall prepare and electronically submit a weekly FACTS .xml data transfer consisting of CGIS FACTS Agency case information to OCDETF. The first data transfer is required 90 days after the task order performance period start date with automated weekly submissions occurring thereafter. This data transfer shall be provided in .xml format. This data transfer shall include all CGIS FACTS Agency data with the exception of attachments and data related to ADMIN, OIG, and Background Investigations. The Contractor shall notify the COR and FACTS Program Manager upon the successful transmission of all weekly data transfers.

2.7 TASK SEVEN: National Incident Based Reporting System (NIBRS) Data

Transfers

Upon USCG obtaining the appropriate Interoperability Service Agreement, the Contractor shall develop, prepare, and provide data transfers from the CGIS FACTS database to the NIBRS as per the following:

The Contractor shall install (to include all patch available upgrades) and configure NIBRS and prepare and electronically submit a weekly NIBRS data transfer to the FBI via FBI-compatible webservice. This report shall consist of closed CGIS FACTS Agency case information, with the exception of attachments and data related to ADMIN, OIG, and Background Investigations, and NIBRS. The first data transfer is required 90 days after the performance period start date with automated, electronic monthly submissions occurring thereafter. The Contractor shall notify the COR and FACTS Program Manager upon the successful transmission of all data transfers.

2.8 TASK EIGHT: Data Migration (Optional)

The USCG may identify the need for Data Migration wherein the Contracting Officer directs the Contractor to migrate any stored data to a Coast Guard system, or for the Contractor to provide the data to the Coast Guard in another form which is acceptable to the Coast Guard. Since the cost impact of this direction is not included in the Contractor’s proposal, when the Contracting Officer provides notification of the intent to exercise this optional Task, they shall also request a Change Proposal and provide a mutually agreeable updated with sufficient detail to support the preparation of the requested proposal. The USCG shall evaluate the proposal and award the effort by modifying the existing contract exercising the optional CLIN accordingly. Only when the contract is modified and the optional task funded shall the Contractor begin the data migration task.

March 19, 2025 PAGE 7/33

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. All contractor employees executing this task order shall comply with SOW Section 4.4, Citizenship and Clearance Requirements. The USCG reserves the right to remove unqualified and inexperience personnel from this task order if deemed necessary.

3.2 Key Personnel

The Contractor shall provide Key personnel critical to the successful execution of this task order. Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement:

1) Program Manager (see SOW sections 3.2.2 and 4.11 for requirements)

Note: The Government may designate additional Contractor personnel as Key at the time of award.

3.2.1 Contractor Key personnel shall not be assigned by the Contractor to more than one key position for this requirement.

3.2.2 Program Manager

The Contractor shall provide a Program Manager who shall be responsible for all Contractor work performed under this SOW. The Program Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Program Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of the Program Manager shall be provided to the Government as part of the Contractor's proposal. The Program Manager is further designated as Key by the Government. During any absence of the Program Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. Additionally, the Contractor shall not replace the Program Manager without prior approval from the Contracting Officer.

3.2.2.1 The Program Manager shall be available to the COR and shall respond to a request for discussion or resolution of technical problems within two (2) business days of notification.

March 19, 2025 PAGE 8/33

3.3 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all task order support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel shall not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence (or as soon as practicable). Otherwise, the Contractor shall provide a fully qualified replacement.

3.4 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

3.5 Employee Conduct

Personnel shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas and possession of weapons) when visiting or working at USCG facilities.

Contractor personnel shall present a professional appearance at all times. Personnel conduct shall not reflect discredit on the United States, the Department of Homeland Security (DHS), or the USCG.

3.6 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the task order. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

March 19, 2025 PAGE 9/33

4.0 OTHER APPLICABLE CONDITIONS

4.1 Security

This SOW details mandatory DHS and USCG security and information assurance requirements.

Note: USCG Headquarters system support shall be performed only by individuals with full SECRET clearance as necessary for access to USCG data networks and physical access to USCG Headquarters. In addition, the contractor’s technical support personnel must either possess or obtain (within 30 days of receiving access to USCG Information Systems) current information technology certifications as required in the USCG Privileged User Access Management process.

4.2 Security Certification/Accreditation

Information Assurance (IA) professionals in significant information security roles are required to have a professional certification in accordance with DoD 8570.01-M (series).

This is required to comply with the professional certification requirements within USCG COMDTINST M5500.13 (series).

Contractor personnel supporting IA functions must obtain the appropriate DOD approved IA baseline certification specified by DoD 8570.01-M (series) prior to being engaged.

At a minimum, a level 1 (IAT1) certification shall be obtained prior to being authorized privileged access.

All personnel holding an approved IA baseline certification listed in Appendix 3 of DoD 8570.01-M (series) must provide their certification information utilizing the Defense Workforce Certification Application (DWCA) at:

https://www.dmdc.osd.mil/appj/dwc/index.jsp

4.2.1 FBI Security Addendum Requirements for Contractors

The security addendum is required for any contractor who may have access to, or may come into contact with, Criminal Justice Information (CJI) IAW the Criminal Justice Information Services (CJIS) Security Policy. This includes any contractor that is granted access to CJI either through an application front end or via technical/ administrative access via networks/network appliance. The CJIS helpdesk is responsible for identifying contractors and requesting completion of the security addendum before access to CJI and CJI-related systems. The intent of this Security Addendum is to require that the Contractor maintain a security program consistent with federal and state laws, regulations, and standards (including the CJIS Security Policy in effect when the contract is executed), as well as with policies and standards established by the CJIS Advisory Policy Board (APB). This Security

March 19, 2025 PAGE 10/33

Addendum identifies the duties and responsibilities with respect to the installation and maintenance of adequate internal controls within the contractual relationship so that the security and integrity of the FBI's information resources are not compromised. The security program shall include consideration of personnel security, site security, system security, data security, and technical security. The provisions of this Security Addendum apply to all personnel, systems, networks and support facilities supporting and/or acting on behalf of the government agency. The security addendum must be signed by the Contractor Employee and the COR.

4.3 Interconnection Security Agreements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be accredited at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements, memoranda of understanding, service level agreements or interconnect service agreements.

Commandant Instruction 5500.13 requires an ISA for all interconnections.

FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance:

All hardware and software interfaces shall meet FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption compliance.

4.4Separation of Duties

The Contractor shall comply with NIST 800-53 Rev 3, Security Control CA-2 Security Assessments - enhancement 1 which requires "The organization employs an independent assessor or assessment team to conduct an assessment of the security controls in the information system." Consequently, the vendor that provides C&A services may not perform the security controls testing. This requirement shall ensure compliance with DHS Sensitive Systems Policy Directive 4300 A, Section 4.1.4.

4.5 Contract Classified Information

Classified information is Government information which requires protection in accordance with Executive Order 13526, “Classified National Security Information, and supplemental directives. The Contractor shall abide by the requirements set forth in the DD Form 254, Contract Security Classification Specification, an attachment to the contract, and the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117 for protection of classified information, as directed by the Federal Acquisition Regulation (FAR) Clause 52.204-2, “Security Requirements (Mar 2021).”

All Contractor employees handling classified information shall be covered by the DD

Form 254 and comply with the security requirement clause contained in the terms

March 19, 2025 PAGE 11/33 and conditions of this Contract.

4.6 Clearance Requirements

The Prime Contractor must possess at least a Secret Facility Clearance (FCL) for the overall condition of this contract. Any subcontractors identified for approval must possess a FCL at the appropriate classification to support classified-related tasks.

There is no safeguarding requirement for the contractor to process or store any classified information at the company own facilities.

All personnel requiring access to classified spaces on USCG units as applicable to the contract must hold U.S. citizenship and must have a current Personnel Clearance (PCL) with a minimum level of secret. Contractor’s request for authorization shall be submitted in accordance with NISPOM, 32 CFR Part 117. Contractor personnel requiring a PCL must have a Classified Information Non-Disclosure Agreement (SF-312) properly executed by their contracting company’s Facility Security Officer (FSO) and file with their clearance granting authority. The contractor must provide a list of employees’ PCL with assigned functions to the COR. The contractor will advise the COR and KO immediately upon reassignments of personnel to other duties not associated with this contract.

Contractor must adhere to the Security Executive Agent Directive [SEAD 3] according to NISPOM, 32 CFR Part 117. SEAD 3 requires reporting by all contractor cleared personnel to report specific activities that may adversely impact their continuous national security eligibility, such as reporting of foreign travel and foreign contacts.

Access to all classified information is based on a strict need-to-know principle.

Classification markings on the material to be furnished will provide the classification guidance necessary for the performance of this contract. Cleared personnel will access classified areas/systems where classified information is located. Contractor will require to participate in classified meeting and to review classified documents. Access to classified information cannot be precluded by escorting personnel due to the nature of work.

On-site contractor personnel require attending and participating in the USCG Security Education and Awareness Training program as appropriate to the responsibilities associated with assigned duties. Also, this includes contractor personnel to participate in training in rules, practices, procedures, and systems on government requirements.

Contractor shall utilize the Mission partner Identify, Credential and Access Management (MP ICAM) to obtain a DoD Common Access Card (CAC) for their employees that requires access both physical access to USCG facility and logical access, via logon, to Coast Guard networks on-site or remotely.

4.7 Security Deliverables

The contractor is responsible for controlling and safeguarding FOUO information in accordance with DHS MD 11042.1, “Safeguarding SBU/FOUO information.” Contractor

March 19, 2025 PAGE 12/33 shall provide an OPSEC Plan detailing how Sensitive but Unclassified/For Official Use Only material will be handled, discussed, disseminated and protected by their employee within 45 days after contract award. Contractor’s existing plans are acceptable.

Contractor shall provide a Training Plan detailing how procedures are implemented for employee’s security briefings and certification that appropriate employees have executed a current SF-312 according to the NISPOM within 45 days after contract award. Contractor’s existing plans are acceptable.

4.8 Sensitive Information

The Contractor will adhere to all applicable government laws, regulations, orders, guides, and directives for protection of sensitive information (e.g., For Official Use Only (FOUO), etc.,) to which they have access under this PWS. In accordance with DHS Management Directive (MD) 11042.1 “Safeguarding Sensitive but Unclassified (For Official Use Only) Information,” all Contractor personnel with access to sensitive information must execute DHS Form 11000-6, Department of Homeland Security Non- Disclosure Agreement (NDA), as a condition of access to such information. The Contractor must maintain signed copies of the NDA for all employees as a record of compliance. The Contractor must provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

Sensitive information must be protected in accordance with DHS Class Deviation 15-0, Revision 1 for proper handling and safeguarding of the security of all such USCG information, as defined in the terms and conditions of this contract.

Any access to data, categorized as Controlled Unclassified Information (CUI), must adhere to the servicing DoD guidance to handle such information.

4.9 Access to Unclassified Facilities, IT Resources, and Sensitive Information

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential. The Computer Security Act of 1987, Public Law 100-235, defines "sensitive information" as "any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of Title 5, United States Code (the Privacy Act) but which has not been specifically authorized under criteria established by an executive order or an act of Congress to be kept secret in the interest of national defense or foreign policy."

However, with the exception of certain types of information protected by statute, specific, standard criteria and terminology defining the types of information warranting designation as "sensitive information" does not exist within the Federal government.

Such designations are left to the discretion of each individual agency. In order to assure this information is protected as required by DHS Management Directive (MD)

11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information, March 19, 2025 PAGE 13/33 contractors shall comply with the following paragraphs.

4.8.1 Contractors shall execute a DHS Form 11000-6, Sensitive But Unclassified Information Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two

(2) days after execution of the form.

Further, sensitive information shall be protected in accordance with DHS Class Deviation 15-01 for proper handling and safeguarding of the security of all such USCG information, as defined in the terms and conditions of this task order.

4.8.2 General Handling Procedures. Although Controlled Unclassified Information (CUI) is a standard caveat used by the U.S. government for identifying sensitive unclassified information, some types of CUI information may be more sensitive than others and thus warrant additional safeguarding measures beyond the minimum requirements established in this manual. For example, certain types of information may be considered extremely sensitive based on the repercussions that could result should the information be released or compromised. Such repercussions could be the loss of life or compromise of an informant or operation. Additional control requirements may be added as necessary to afford appropriate protection to the information. Contractors must use sound judgment coupled with an evaluation of the risks, vulnerabilities, and the potential damage to personnel or property as the basis for determining the need for safeguards in excess of the minimum requirements and protect the information accordingly. When removed from an authorized storage location and persons without a need-to-know are present, or where casual observation would reveal CUI information to unauthorized persons, a " Controlled Unclassified Information " cover sheet shall be used to prevent unauthorized or inadvertent disclosure. When forwarding CUI information, a CUI cover sheet shall be placed on top of the transmittal letter, memorandum or document.

4.8.3 When receiving CUI equivalent information from another government agency, handle in accordance with the guidance provided by the other government agency. Where no guidance is provided, handle in accordance with the requirements of this directive.

4.8.4 Dissemination and Access. CUI information shall not be disseminated in any manner (orally, visually, or electronically) to unauthorized personnel. Access to CUI information is based on "need-to-know" as determined by the holder of the information. Where there is uncertainty as to a person's need-to-know, the holder of the information shall request dissemination instructions from their next-level supervisor or the information's originator. The holder of the information will comply with any access and dissemination restrictions. A security clearance is not required for access to CUI information. When discussing or transferring CUI information to another individual(s), ensure that the individual with whom the discussion is to be held or the information is to be transferred has a valid need-to-know, and that precautions are taken to prevent unauthorized individuals from

March 19, 2025 PAGE 14/33 overhearing the conversation, observing the materials, or otherwise obtaining the information.

CUI information may be shared with other agencies, federal, state, tribal, or local government and law enforcement officials, provided a specific need-to-know has been established and the information is shared in furtherance of a coordinated and official governmental activity.

If the information requested or to be discussed belongs to another agency or organization, comply with that agency's policy concerning third party discussion and dissemination. When discussing CUI information over a telephone, the use of a STU III (Secure Telephone Unit), or Secure Telephone Equipment (STE), is encouraged, but not required.

When unattended, CUI materials shall, at a minimum, be stored in a locked file cabinet, locked desk drawer, a locked overhead storage compartment such as a systems furniture credenza, or similar locked compartment. Materials can also be stored in a room or area that has sufficient physical access control measures to afford adequate protection and prevent unauthorized access by members of the public, visitors, or other persons without a need-to-know, such as a locked room, or an area where access is controlled by a guard, cipher lock, or card reader.

CUI information shall not be stored in the same container used for the storage of classified information unless there is a correlation between the information. When CUI materials are stored in the same container used for the storage of classified materials, they shall be segregated from the classified materials to the extent possible, i.e. separate folders, separate drawers, etc.

IT systems that store CUI information shall be certified and accredited for operation in accordance with federal and DHS standards. Consult the DHS Information Technology Security Program Handbook for Sensitive Systems, Publication 4300A, for more detailed information.

Laptop computers and other media containing CUI information will be stored and protected to prevent loss, theft, unauthorized access and unauthorized disclosure.

Storage and control shall be in accordance with DHS Information Technology Security Program Handbook for Sensitive Systems, Publication 4300A.

Transmission of hard copy CUI within the U.S. and its Territories. Material shall be placed in a single opaque envelope or container and sufficiently sealed to prevent inadvertent opening and to show evidence of tampering. The envelope or container shall bear the complete name and address of the sender and addressee, to include program office and the name of the intended recipient (if known). CUI materials may be mailed by U.S. Postal Service First Class Mail or an accountable commercial delivery service such as Federal Express or United Parcel Service. CUI materials may be entered into an inter-office mail system provided it is afforded sufficient protection to prevent unauthorized access, e.g., sealed envelope.

March 19, 2025 PAGE 15/33

Electronic Transmission. Unless otherwise restricted by the originator, CUI information may be sent via non-secure fax. However, the use of a secure fax machine is highly encouraged. Where a non-secure fax is used, the sender shall coordinate with the recipient to ensure that the materials faxed shall not be left unattended or subjected to possible unauthorized disclosure on the receiving end. The holder of the material shall comply with any access, dissemination, and transmittal restrictions cited on the material or verbally communicated by the originator. CUI information transmitted via email shall be protected by encryption or transmitted within secure communications systems.

When this is impractical or unavailable, CUI may be transmitted over regular email channels. For added security, when transmitting CUI over a regular email channel, the information can be included as a password protected attachment with the password provided under separate cover. Recipients of CUI information shall comply with any email restrictions imposed by the originator. CUI information shall not be sent to personal email accounts.

CUI information shall not be posted on any other internet (public-facing) website. CUI information may be posted on the DHS intranet or other government controlled or sponsored protected encrypted data networks. However, the official authorized to post the information shall be aware that access to the information is open to all personnel who have been granted access to that particular intranet site. The official must determine the nature of the information is such that need-to-know applies to all personnel; the benefits of posting the information outweigh the risk of potential compromise; the information posted is prominently marked as Controlled Unclassified Information; and information posted does not violate any provisions of the Privacy Act.

Destruction. CUI material shall be destroyed when no longer needed. Destruction may be accomplished by shredding, burning, pulping, pulverizing of hard copy material so as to assure destruction beyond recognition and reconstruction. After destruction, materials may be disposed of with normal waste. Electronic storage media shall be sanitized appropriately by overwriting or degaussing. Paper products containing CUI information shall not be disposed of in regular trash or recycling receptacles unless the materials have first been destroyed as specified above.

Incident Reporting. Contractors who observe or become aware of the loss, compromise, suspected compromise, or unauthorized disclosure of CUI information shall report it immediately, but not later than the next duty day, to the originator and the local Security Official.

4.9 PERIOD OF PERFORMANCE

The period of performance for this task order is for three months with no option years.

POP: March 28, 2025 – June 27, 2025

4.10 PLACE OF PERFORMANCE

March 19, 2025 PAGE 16/33

The primary place of performance shall be the Contractor’s facilities. The secondary place of performance shall be at USCG Headquarters at 2703 Martin Luther King Jr. Dr.

SE, Washington DC 20593.

4.10.1 RELOCATION OF PERFORMANCE

In the event of an emergency event such as nuclear, biological, chemical, or radiological attack, natural disaster, or health emergency, such as a pandemic, the contractor shall change the location of the critical elements of task order performance as directed by the Contracting Officer. Unless otherwise stated in this task order, the cost impact of such direction, such as the cost of relocation or cost differentials of working in a new location, is not included in the price of this task order and shall be at no additional cost to the government. The change of location is applicable to work performed at USCG facilities.

4.11HOURS OF OPERATION

Contractor personnel shall perform tasks during normal work hours (0700 – 1600, Monday through Friday). Working weekends and holidays are not required to fulfill requirements under this SOW, other than to resolve a critical system failure which prevents access or use of the system. Overtime is not authorized for this task order.

4.12 TRAVEL

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) shall be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

4.13 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 10 business days after the date of award or as mutually agreed between the Contractor and USCG. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer or Contract Specialist, is to discuss technical and contracting objectives of this task order. The Post Award Conference location will be determined by the Contracting Officer after award of this task order.

4.14 Monthly Progress Reports

Upon 45 days of award, and provided on the 15th business day of every month thereafter, the Contractor shall submit a monthly progress report via electronic mail to the COR. The monthly report shall include at a minimum, the following:

1) Activities performed in previous month, problems and/or delays encountered and

March 19, 2025 PAGE 17/33 proposed and enacted solutions

2) Planned activities for the upcoming reporting period and anticipated problems and/or delays

3) Any pertinent information regarding the project

4) Maintenance logs pertaining to the monthly (and any other) updates to the baseline configuration.

4.15 Meetings

The Contractor’s Program Manager shall be available via conference call or in person to discuss performance status, monthly progress report, exchange information, and resolve emergent technical problems and issues. These conference calls shall take place as needed or as requested by the CGIS Program Manager and/or COR.

4.16 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows XP and Microsoft Office Applications).

4.17 PROTECTION OF INFORMATION

Contractor access to information protected under the Privacy Act is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

4.18 SECTION 508 COMPLIANCE

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology (EIT), they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public. All EIT deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt.

DHS Office of Accessible Systems and Technology has reviewed this acquisition request and has determined that a National Security Exception for the purposes of Section 508 applies and is thereby authorized. National Security Exception (USCG- 20120703-001) signed by DHS Director OAST on 03 July 2012 has been attached and included in the contract file.

March 19, 2025 PAGE 18/33

5.0 GOVERNMENT FURNISHED RESOURCES

The Government will provide the workspace, equipment and supplies necessary to perform the on-site portion of Contractor services required in this task order unless specifically stated otherwise in this work statement. At the Government’s discretion, a CG-configured laptop may be provided to facilitate remote access via VPN. The primary method for accessing the CG-network while performing work at the Contractor site shall be via VDI, using a contractor-provided computer.

The Contractor shall use Government furnished equipment, information, data and documents only for the performance of work under this task order, and shall be responsible for returning all Government furnished equipment, information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished equipment, information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

6.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0 and SOW 5.0.

7.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables, in accordance with 7.3, prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

7.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

7.2 The COR will have 5 business days to review deliverables and make comments.

The Contractor shall have 5 business days to make corrections and redeliver.

7.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

March 19, 2025 PAGE 19/33

8.0 DELIVERABLES

ITEM

SOW

REFERENCE

DELIVERABLE /

EVENT

DELIVER

Y

METHOD

DELIVERY

FORMAT

DUE DATE

2.1

Software Licenses

Electronic Mail

Electronic Mail Notification

5 days after award and no later than start of option periods

2.2.b

Contractor Call (Service Request) Task Tracking Report Listing All Service Requests, Enhancement Requests, etc.

submitted by the

CG

Electronic Mail

MS Excel

Weekly

2.2.d

FACTS

Transition/Migrati on to USCG Data Center Formal Notification of Completion

Notification

NLT 30 Nov

4 2.2.d

FACTS System Migration Plan

Electronic Mail

MS Word 10 days after modification issuance

2.2.d

FACTS System Migration Rollback/Failback Plan

MS Word

10 days after

March 19, 2025 PAGE 20/33

REFERENCE

DELIVERABLE /

EVENT

DELIVER

Y

METHOD

DELIVERY

2.2. f

Architecture diagrams and data dictionaries

Various:

PDF, MS

Word, Excel, Visio, as needed.

30 days after award and within 30 days of system changes.

2.5

D-DEx Data

Secure File Transfer Protocol

(SFTP)

xml

90 days after award and Weekly thereafter

2.6

OCDETF Data

SFTP

90 days after award and Weekly

2.7

NIBRS Data Transfers via FBI-compatible webservice

SFTP

The first transmission via webservice should occur no later than 01JUL2021 and continue monthly, 2.8(a)1

SME Input to System Security Plan

Various

As agreed to by CGIS PM and Contractor PM

2.8(a)2

System and network topology diagram(s)

Electronic Mail/SFTP, as appropriate

2.8(a)3

System Contingency Plan

5 days after

2.8(a)4

Configuration Management Plan

2.8(a)5

SME Input to Audit and Accountability Plan

March 19, 2025 PAGE 21/33

REFERENCE

DELIVERABLE /

EVENT

DELIVER

Y

METHOD

DELIVERY

2.8(a)6

Information System Maintenance Plan

2.8(a)7

Identification and Authentication Plan

2.8(a)8i

Technical Reference Guide

Electronic Mail/SFTP, 2.8(a)8ii

Interface Design Document

Electronic Mail/SFTP, 2.8(a)8iii

Implement Security Controls / STIGS

CGIS PM and Contractor PM and, as needed, throughout the Assessment and Authorization Process

2.8(a)8iv

Standard Operating Procedures for FACTS Application Administrators

Electronic Mail/SFTP, 4.1

Monthly Progress Report

MS Word

45 days after award and 15th of each Month after activity

11.4.1

IT Security Plan

PDF

30 days after base-period award and within 30 days of system changes requiring IT Security Plan Updates

March 19, 2025 PAGE 22/33

9.0 U.S. COAST GUARD SPECIFIC INFORMATION ASSURANCE AND SECURITY

REQUIREMENTS

9.1 Security Certification/Accreditation

Information Assurance (IA) professionals in significant information security roles are required by COMDTINST 5500.13D to have a professional certification.

Contractor personnel supporting IA functions shall be appropriately certified and obtain the appropriate DOD-approved IA baseline certification PRIOR to being engaged.

At a minimum a level 1 (IAT1) certification shall be obtained prior to being authorized privileged access.

The Contracting Officer’s Representative will ensure that contractor personnel are appropriately certified and provide verification to the Defense Manpower Data Center (DMDC) database: https://www.dmdc.osd.mil/dmdcomn/owa/dmdc.main

During all SDLC phases of USCG systems, the Contractor personnel shall develop documentation and provide any required information for all levels of classification in support of the certification / accreditation process. In addition, all security certification / accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

9.1.1 Separation of Duties

DHS Sensitive Systems Policy Directive 4300 A, Section 4.1.4 requires the "Separation of duties to prevent a single individual from being able to disrupt or corrupt a critical security process." The Policy requires the following: "Components shall divide and separate duties and responsibilities of critical IT system functions among different individuals to minimize the possibility that any one individual would have the necessary authority or system access to be able to engage in fraudulent or criminal activity."

Security testing is but one critical systems function that needs to be performed by a provider (either government or contractor) other than the system designer / developer / operator.

This requirement is based, in part, on NIST 800-53 Rev 3, Security Control CA-2 Security Assessments - enhancement 1 which requires "The organization employs an independent assessor or assessment…