1.1.4 DR-4860-KY Direct Lease SOW Final.pdf

DR-4860-KY

STATEMENT

OF WORK:

DISASTER-

4860-KY

DIRECT LEASE PROGRAM

UNITED STATES DEPARTMENT OF HOMELAND

SECURITY FEDERAL EMERGENCY

MANAGEMENT AGENCY

PURPOSE:

The Department of Homeland Security (DHS)/Federal Emergency Management Agency (FEMA) specifies certain requirements for Direct Lease Vendors/Property Management Companies

(Vendors/PMCs) and/or Property Owners (POs). FEMA Direct Lease is a housing assistance program designed to lease turnkey, existing rental units to provide temporary housing for eligible applicants displaced by the presidentially declared major disaster designated as Disaster-4860-KY, which caused

Severe Storms, Straight-line Winds, Flooding, Landslides, and Mudslides. This Statement of Work

(SOW) applies to Disaster-4864-Kentucky, Disaster-4875-Kentucky, and any future Presidentially

Declared disasters, including all declared counties eligible for Direct Housing assistance, occurring within the period of performance of this twelve-month Blanket Purchase Agreement (BPA). The BPA will commence in Fiscal Year 2026 and consists of a six-month base period, with one additional six-month option period, which may be exercised at the discretion of the Government.

Note: The term Contractor will be used to refer to Direct Lease Vendors/PMCs/or POs from this point on.

SCOPE:

The Contractor shall identify and provide 1-, 2-, 3-, and 4-bedroom turnkey residential properties in specified Kentucky counties (Breathitt, Clay, Estill, Floyd, Harlan, Johnson, Knott, Lee, Leslie, Letcher, Martin, Owsley, Perry, Pike, and any future counties) to support eligible disaster applicants.

The following items and services are to be performed by the Contractor for the Direct Lease program:

1. Identify Properties. Contractor shall identify and curate a list of residential properties. The list should include details such as property location, type, rental/sale price, availability status, accessibility features, background check requirements, and pet requirements (including breed restrictions, security deposits and associated fees).

a. Residential properties provided by the Contractor must fulfill the following criteria:

i. Provide complete and independent living facilities for one or more persons, including permanent provisions for living, sleeping, cooking, and sanitation.

ii. Must be turnkey ready and comply with federal, state, and local occupancy standards. All units, including utilities, appliances, and furnishings provided must be safe, sanitary, secure, and functional.

1. Safe means no hazards or threats to occupants are present.

2. Sanitary means free of all health hazards.

3. Functional means an item or home is capable of being used for its intended purpose.

4. Secure means free from danger or harm.

iii. Must be located within a 60-minute travel distance from specified damaged dwellings.

iv. Eligible properties include existing residential properties advertised for lease (e.g., corporate apartments, vacation rentals, second homes); vacant residential properties available for sale or lease (single-family homes and multiple occupancy units); bank-owned properties (e.g., foreclosures); and any other type of residential property that meets the criteria of a Direct Lease property as accepted by FEMA.

v. Contractor may only lease properties that are currently vacant and the property owner must certify in writing that they are not terminating an existing lease for the sole purpose of listing their unit for FEMA Direct Lease.

vi. Contractor shall prioritize properties that include accessibility features or can easily be conformed to accessible requirements.

vii. Contractor shall prioritize properties that are near accessible public transportation as well as wrap-around services, such as schools, emergency services, hospitals, pharmacies, etc.

viii. Contractor shall inform PMCs or POs that credit checks will be waived in their entirety for all applicants occupying FEMA units.

ix. Contractor is suggested to inform PMCs or POs to waive application and background-check fees associated with the process of screening applicants.

1. Contractors are responsible for the costs and fees associated with application or background-check fees of applicants, if required by PMCs or POs.

x. Contractor shall prioritize properties that do not require applicants to complete a background check or are able to waive background check requirements.

xi. The monthly cost per unit may not exceed the amounts established by the

Department of Housing and Urban Development (HUD), unless an increase is approved by the Contracting Officer (CO).

1. The Government will establish a contract line item for one (1) month security deposit not-to-exceed one (1) month rent. The security deposit is a cost reimbursable contract line item and will not be disbursed at the signing of the contract. The security deposit will be held by the Government in the event any damages (other than normal wear and tear) occur and will be invoiced based on the actual costs of damages verified between the Government and the Contractor.

All damages above the cost of monthly rent shall be the responsibility of the Contractor and or applicant upon confirmation of the cause of damage.

2. Damages-Security Deposit must be approved by the CO prior to submission of invoice. Contractor must submit request for damages/security deposits within 30 days of a Move-Out Inspection (MOI). Documentation including repair costs and time stamp photo documentation must be submitted with request.

b. Contractor shall implement and regularly update a tracking system for property inventory throughout the Direct Lease process. The tracking system must be approved by the Contracting Officer's Representative (COR) prior to implementation. An example is provided in Attachment 1: Direct Lease Property Tracking Sheet. The tracking system must include property location, type, rental/sale price, availability status, accessibility features, background check requirements, pet requirements including security deposits and associated fees, and challenges encountered during the property acquisition process.

Figure 1 - Maximum Monthly Rent FY2026 Fair Market Rent (FMR) Documentation1

County 1 BED 2 BED 3 BED 4 BED

Breathitt $714 $866 $1,204 $1,259

Clay

$759 $866 $1,176 $1,308

Estill

$790

$866

$1,120 $1,259

Floyd

$689 $904 $1,109 $1,212

Harlan

$699 $866 $1,142 $1,147

Johnson

$696 $866 $1,154 $1,280

Knott

$683 $866 $1,038 $1,209

Lee $740 $939 $1,126 $1,311

Leslie

$790 $866 $1,204 $1,209

Letcher

$759

$866

$1,166 $1,316

Martin

$683 $866 $1,081 $1,209

Owsley

$683 $866 $1,115 $1,209

Perry

$731

$959

$1,150 $1,270

Pike

$745 $977 $1,171 $1,552

Note: Once Fiscal Year 2027 pricing becomes available through HUD, adjustments will be made accordingly to reflect the updated rates.

2. Unit Inspections. Contractor and FEMA shall inspect each unit to ensure compliance with HUD's Housing Quality Standards (HQS) and with federal, state, and local occupancy standards prior to executing lease agreements. Each inspection will also verify the Contractor's capability to provide all property management services, including building maintenance.

a. All Direct Lease units managed by the Contractor are subject to inspection by FEMA and other applicable government agencies. The Contractor is required to actively participate in inspections by responding promptly to all requests for information and addressing any findings from regulatory agencies.

b. Contractor must permit FEMA, or any entity or organization approved by FEMA, to conduct inspections of rental units as necessary. The inspections ensure that the services provided and the conditions of housing meet FEMA's standards and requirements.

c. Contractors are required to submit the completed and signed Attachment 2:

Direct Lease Property Inspection Checklist HUD Form to FEMA 48-hours after award and prior to FEMA’s inspection of the unit.

i. Pictures of the unit, including all rooms and furnishings, shall be included in the inspection record.

ii. The HUD Inspection is considered complete when all functional areas of the unit are properly furnished and meet required standards, and each area is equipped with the necessary items and fixtures to function as intended.

d. Following the completion of the HUD Inspection form, FEMA will conduct an inspection to ensure that the unit including utilities, appliances, and furnishings provided are safe, sanitary, functional, and secure and meet the household’s needs.

i. If the inspection fails, FEMA shall share the findings of the inspection with the Contractor.

ii. The Contractor will have 3 (three) business days to remediate the issues from the failed inspection.

iii. If a unit fails FEMA inspections twice, the unit will be terminated due to failure to meet inspection requirements (provide a Turnkey property).

e. FEMA shall notify the Contractor within 3 (three) days if the applicant schedules a unit move-out.

i. Contractor and FEMA shall conduct a walkthrough of the temporary housing unit with the applicant (if feasible) and complete a MOI using either the Attachment 12: Ready for Occupancy Status Form or Attachment 13: Direct Lease Inspection Report.

3. Contacting Applicants. FEMA shall identify eligible applicants for the Direct Lease program and provide the following applicant information to the Contractor:

applicant name, co- applicant names (if applicable), damage dwelling address, mailing address, phone number(s), and email address(es).

4. Matching Applicants. FEMA contacts applicants to match them with a Direct Lease unit that best fits their needs. FEMA will inform each applicant of the next steps towards their placement in a Direct Lease unit, such as completing background checks for properties that require it.

a. Contractors shall process background checks within one (1) business day after the applicant submits all pertinent information.

b. Contractors shall submit to FEMA a daily status update on background checks (BGC) for each unit submitted by 9 a.m.

c. Contractor shall notify FEMA within one (1) day if an applicant is being denied due to adverse information in their background check.

5. Execute Lease Agreements. The Contractor shall execute lease agreements with FEMA by submitting the following completed documentation to the COR:

a. Copy of the lease agreement between the Contractor and the PMC/PO (if applicable)

b. Attachment 3: Direct Lease Contract Terms and Conditions

c. Direct Lease Occupant Lease Agreement (DLOLA) Package

i. Attachment 4: Direct Lease Occupant Lease Agreement Template

ii. Attachment 5: Direct Lease – Lease Addendum

iii. Copy of specific property rules, terms, or conditions (if applicable)

6. Move-in of Applicants. Contractor and FEMA will share responsibility for the move-in process of applicants into Direct Lease units. Contractor and FEMA shall conduct a walkthrough of the temporary housing unit with the applicant and ensure all necessary paperwork is completed prior to completing a move-in.

a. Contractor shall prepare and provide the COR with the following documentation within three (3) business days of completion:

i. Direct Lease Occupant Lease Agreement (DLOLA) Package

1. Signed copy of Attachment 4: Direct Lease Occupant Lease

Agreement Template

2. Signed copy of specific property rules, terms, or conditions (if applicable)

b. FEMA shall prepare and provide the Contractor with the following documentation within three (3) business days of completion:

i. Signed copy of Attachment 4: Temporary Housing Agreement

ii. Signed copy of Attachment 5: Direct Lease-Lease Addendum

7. Lease Agreement Payments. FEMA shall make rental payments to Contractor in accordance with the terms and conditions of the fully executed FEMA Contract (contract between FEMA and Contractor) for each property that is awarded under the contract.

8. Lease Agreement Terminations. FEMA shall be responsible for any terminations of Direct Temporary Housing Assistance to applicants.

Contractor shall be responsible for evictions of applicants whose assistance has been terminated by FEMA.

a. FEMA may terminate the lease for the housing unit by providing the Contractor with a written thirty (30) calendar day Termination Notice.

b. The property owner shall be solely responsible for initiating and completing all eviction proceedings, including bearing all associated costs, in the event FEMA determines the occupant to be ineligible for assistance or upon the conclusion of the designated period of assistance.

9. Early Termination Fees. To be eligible for an Early Termination Fee, the Contractor must submit a copy of the lease between the Contractor and PMC/PO, to include the actual charges associated with the termination from the date of the cancellation. Early termination fees take effect when FEMA has provided the Contractor with a thirty (30) calendar day Termination Notice. The early termination fee will be two (2) months’ rent excluding fees (maintenance, property management, utilities, set-up, etc.).

a. When an applicant is no longer eligible for Direct Housing Assistance and cannot remain in the leased unit, FEMA will notify the Contractor in writing, confirming that applicant has been notified of the termination and the effective date that the applicant must vacate the unit, remove all personal items, and return all keys to the Contractor.

10. Moving the Applicant Out. The process is outlined below:

FEMA Program notifies the CO/COR when the unit is no longer needed, schedules a MOI with the applicant, and requests to either terminate the contract of the unit or rehouse a new applicant in the unit.

FEMA COR notifies the Contractor of the scheduled MOI.

Applicant/FEMA/ Contractor

Applicant, Program, and Contractor complete the MOI.

Contractor Contractor reports any damages to the CO/COR within fourteen

(14) days of the MOI. An additional fourteen (14) days is allowed to submit the total costs to the CO or COR.

FEMA COR will notify the Contractor if the unit will be terminated or will be used to rehouse a new applicant. If terminated, COR sends notice to the Contractor to return unit to their control as specified in the contract. If unit is no longer needed, Contractor will remove the unit from existing inventory.

11. Utilities. FEMA is not responsible for utilities unless utilities are included in the monthly rental fee and do not exceed the established monthly rental rates.

12. Access and Functional Needs. A Contractor is allowed, at FEMA 's expense, to make reasonable modifications or improvements to the property to provide a reasonable accommodation for an eligible applicant with a disability or other access or functional needs. All modifications or improvements will be coordinated with the COR for FEMA approval prior to execution or incurring costs. All costs above $3,000 must be approved by the CO.

13.Maintenance and Other Services. All maintenance and services such as trash pickup, parking, lawn care, pest control, building maintenance, and storm preparations shall be the responsibility of the Contractor.

a. Emergency Repairs are repairs that resolve or mitigate the immediate threat or imminent danger to the health, safety, or security of the unit occupant and the unit/property, such as heating, ventilation, and air conditioning (HVAC), water, electricity, and elevators not working properly. The Contractor shall contact the COR within two (2) hours of the emergency repair and work shall be initiated and completed within six (6) hours of work order receipt. Contractor shall place applicant(s) in alternative housing, if necessary, if repairs are not completed within six (6) hours.

b. A complete emergency maintenance repair is defined as the imminent threat to life or property and is either completely repaired or temporarily repaired so that a permanent repair can be completed as regular maintenance.

c. In the event of a death in the unit, the Contractor shall properly clean the unit prior to another applicant being placed in the unit, such as the proper biohazard clean up. The Contractor is responsible for securing the applicant’s personal belongings prior to the cleaning.

d. All Non-Emergency Repairs are repairs that are not an immediate threat or imminent danger to the health, safety, or security of the unit occupant and the unit/property. The Contractor shall notify the COR within one (1) day of the Non- Emergency Repair and work shall be initiated and completed within three (3) days of work order receipt.

e. The Contractor shall submit a status report monthly which includes all maintenance issues with pictures included.

14. Access and Functional Needs. A provision allowing Contractor to make, at FEMA’s expense, reasonable modifications, or improvements to the property to provide a reasonable accommodation for an eligible applicant with a disability or other access or functional needs. All modifications or improvements will be coordinated with the COR and CO for FEMA approval prior to execution or incurrence of costs. All costs must be approved by the CO.

15. Damage to the Property. If there is damage to the property or furnishing beyond normal wear and tear, FEMA's security deposit may be used to cover the cost of any damages beyond normal wear and tear.

a. If property has been damaged, the Contractor reports damage to the CO or COR within 14 days of the move-out inspection. An additional 14 days is allowed to submit the total cost to the CO or COR.

16. Quality Assurance Surveillance Plan/Quality Control Provisions. Contractor shall adhere to all quality assurance/quality control provisions outlined in Attachment 11: Direct Lease QASP.

FURNISHED PROPERTY / TURNKEY IS DEFINED.

Unit Item Inventory Requirements. Contractor shall furnish each unit using the Attachment 10: Direct Lease Furniture Validation Checklist Disaster-4860-KY.

Contractor shall log an inventory of each item they may want to file a replacement or damage claim for and should include the estimated replacement cost for each item. Items not listed on the Vendor Required Unit Furnishing Checklist or are considered a part of the Living Kit are not eligible for reimbursement. No later than thirty (30) calendar days after the scheduled FEMA move out inspection date, the Contractor shall submit any claims for damages and/or replacement of items above normal wear and tear. For Direct Lease units, the normal wear and tear period is for the one-year base period.

Additional option periods beyond the one-year base period, shall only be accepted for destroyed items and shall not cover items listed in the living kit (one time purchase items). Any claims made for damages shall be submitted with pictures of damages and receipts of payment to a third party.

Prior to the FEMA inspection of the unit, the Contractor shall submit a completed Attachment 10: Direct Lease Furniture Validation Checklist Disaster-4860-KY. At a minimum, the following items are required in each Direct Lease unit, but the quantity may vary dependent on the number of bedrooms per unit/household composition.

PLACE OF PERFORMANCE

Up to sixty (60) minutes commuting distance from the damaged dwelling, and that do not place an undue hardship on qualified disaster applicants. The Government may adjust this requirement as needed, but not outside the State of Kentucky.

PERIOD OF PERFORMANCE

This is a month Blanket Purchase Agreement (BPA) one (1) six (6) month option period

APPLICABLE ATTACHMENTS:

1. Direct Lease Property Tracking Sheet

2. Direct Lease Property Inspection Checklist HUD Form

3. Direct Lease Contract Terms and Conditions

4. Direct Lease Occupant Lease Agreement Template

5. Direct Lease - Lease Addendum

6. Temporary Housing Agreement

7. Termination Notice to Property Owner or Manager

8. Rental Resource FMR R D 4860-KY

9. Pricing CLIN Structure Spreadsheet

10. Direct Lease Furniture Validation Checklist D 4860-KY

11. Direct Lease QASP

12. Ready for Occupancy Status Form

13. Direct Lease Inspection Report

Information Sharing

To accomplish the task personally identifiable information (PII) will be disclosed for placement of the survivors. PII data elements: Disaster survivor’s name and phone number.

The information sharing outlined in this contract is authorized by the following System of Records Notice(s) and Routine Use(s):

DHS/FEMA-008 - Disaster Recovery Assistance Files April 30, 2013, 78 FR 25282, Routine Use F.

The information sharing outlined in this contract is authorized by the following Privacy Impact Assessments:

DHS/FEMA/PIA-049 Individual Assistance (IA) Program.

Need to Know The Contractor will limit access to the PII provided by FEMA under this contract only to the Contractor’s authorized personnel having a need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching The Contractor shall ensure no computer matching, as that term is defined in 5 U.S.C.

§ 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

Return or Destruction of Data when no longer needed If at any time during the term of this contract any part of FEMA PII, in any form, that the Contractor obtains from FEMA ceases to be required by the Contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the Contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at

FEMA’s written request to destroy, uninstall and/or remove all copies of such PII in the Contractor’s possession or control and certify in writing to FEMA that such tasks have been completed.

SECURITY LANGUAGE

Personnel may require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure Contractor employees receive a favorably adjudicated suitability prior to entry on duty (EOD). All individuals will be U.S. citizens.

The Contractor shall follow the standards established within DHS and FEMA policy.

Unauthorized Disclosure of Classified or Unclassified Information:

Contractors and Subcontractors who are working on this contract shall receive Unauthorized Disclosure of Classified or Unclassified Information training.

Access to the training can be obtained at: Unauthorized Disclosure of Classified Information and Controlled Unclassified Information USA Learning (USAlearning.gov).

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

OPSEC Training:

Contractors and Subcontractors who are working on this contract shall receive the Operations Security (OPSEC) Awareness Brief.

Access to the briefing can be obtained at OPSEC Awareness for Military Members, DOD Employees and Contractors USA Learning (USAlearning.gov).

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

Insider Threat Training:

Insider Threat training for Contractors can be found at: Insider Threat Awareness USA Learning (USAlearning.gov).

Certificate of training is required for all cleared Contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared Contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten

(10) business days of joining the contract.

For Official Use Only (FOUO) Information:

In accordance with DHS Management Directive 11042.1 Contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities.

The Contractor will:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified Information Non-Disclosure Agreement (NDA), as a condition of access to such information.

Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager. Execution of the NDA shall be effective upon date of the DHS Policy and not applied retroactively.

Foreign Travel and Government-Issued Equipment

Per DHS and FEMA IT policy, FEMA employees and contractors are not authorized to take government-issued equipment, including cell phones, computers, or tablets such as iPads, outside of the United States regardless of the reason for travel. If government-issued equipment is required for official foreign travel, FEMA government employees may request a temporary loaner device through the Mobility Service Center.Office of the Chief Information Officer, Service Center for the duration of their trip. FEMA contractors must contact their contracting officer’s representative (COR) for further guidance. If your device is detected as operating outside of the United States and its territories it will be disabled, and your information will be forwarded to the Office of Professional Responsibility for review.

Background Investigations:

All Contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each Contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access:

Contractor personnel occupying positions or performing functions with a Low-Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1 investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract. (also reference Facility Access).

Low Risk with Information System Access:

Contractor personnel occupying positions or performing functions with a Low-Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Moderate Risk:

Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

High Risk:

Contractor personnel occupying positions or performing functions with a High-Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Background Investigation Process:

To initiate the request to process Contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 11000-25, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 11000-25 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all Contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

the investigation was completed within the last five years, it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract, the Contractor personnel have not had a break in employment since the prior favorable adjudication, and, FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the Contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated Contractor personnel, at which time the favorably adjudicated Contractor personnel will be eligible to begin work under this contract.

For those Contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the Contractor applicant/personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the National Background Investigation Services (NBIS) e-Application (eAPP) online system and instructions for submitting the necessary information:

Standard Form 85P, “Questionnaire for Public Trust Positions”

Optional Form 306, “Declaration for Federal Employment” SF 87, “Fingerprint Card” (2 copies) DHS Form 11000-6, “Non-Disclosure Agreement” DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports

Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and

Standard Form 85P, which must be completed electronically through the National Background Investigation Services (NBIS) e-Application (eAPP) online system. The Contractor is responsible for ensuring that all Contractor personnel timely and properly submit all required background information.

Once Contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant Contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the Contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified Contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the Contractor personnel have any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

After favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the Contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the Contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the Contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor.

Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation:

Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration of the background investigation unless and until the Contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Neither the Prime Contractor nor the Contractor personnel have any right to such a

Exclusion by Contracting Officer:

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any Contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

Facility Access:

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121- 3-1 “FEMA Credentialing Access Manual,” to arrange for Contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for Contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all Contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any Contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

Separation of Contract:

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to Contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a Contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or Contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the Contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the Contractor personnel and the Contractor to civil and criminal liability.

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create work with, or otherwise handle federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law, or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their FEMA contract; and

• may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created, while performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its Contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting

Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records, and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-Contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any Subcontractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

8. The Contractor shall not create or maintain any records containing any nonpublic FEMA information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. FEMA owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(a) Definitions. As used in this clause— Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information.

This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls. Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.

This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical- Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement.

The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non- governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods;

and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

i. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number.