12a. Provisions and Clauses.pdf

Request for Quotation (RFQ): 63100PR260007463

TERMS AND CONDITIONS

(CLAUSES AND PROVISIONS)

FEDERAL ACQUISITION REGULATION (FAR) AND

HOMELAND SECURITY ACQUISITION REGULATION (HSAR) CLAUSES IN ACCORDANCE WITH

FEDERAL ACQUISITION CIRCULAR 2025-06 EFFECTIVE DATE 10/01/2025

System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in agency solicitations. Examples include 52.222-25, Affirmative Action Compliance, and paragraph (d) of 52.212-3, Offeror Representations and Certifications—Commercial Products and Commercial Services. Additional examples include 52.212-5, Contract Terms and Conditions Required To Implement Statutes or Executive Orders—Commercial Products and Commercial Services, and 52.213-4, Terms and Conditions—Simplified Acquisitions (Other Than Commercial Products and Commercial Services).

System updates may lag policy updates. The System for Award Management (SAM) may continue to require entities to complete representations based on provisions that are not included in agency solicitations, including 52.223-22, Public Disclosure of Greenhouse Gas Emissions and Reduction Goals—Representation, and paragraph

(t) of 52.212-3, Offeror Representations and Certifications—Commercial Products and Commercial Services. Components shall not consider or use these representations.

FAR CLAUSES

The following FAR clauses are hereby incorporated by reference:

52.203-19 Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements 52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011) require only intermittent access to Federally-controlled facilities.

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards 52.204-13 System for Award Management Maintenance (Oct 2018) 52.204-19 Incorporation by Reference of Representations and Certifications 52.207-5 Option to Purchase Equipment 52.208-9 Contractor Use of Mandatory Sources of Supply or Services 52.209-3 First Article Approval-Contractor Testing 52.209-4 First Article Approval-Government Testing 52.209-9 Updates of Publicly Available Information Regarding Responsibility Matters 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations 52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law 52.211-5 Material Requirements.

52.211-11 Liquidated Damages-Supplies, Services, or Research and Development 52.212-4 Contract Terms and Conditions -- Commercial Items (Nov 2023) 52.213-4 Terms and Conditions—Simplified Acquisitions (Other Than Commercial Products and Commercial Services) 52.219-3 Notice of HUBZone Set-Aside or Sole-Source Award 52.219-4 Notice of Price Evaluation Preference for HUBZone Small Business Concerns 52.219-6 Notice of Total Small Business Set-Aside 52.219-27 Notice of Set-Aside for, or Sole-Source Award to, Service-Disabled Veteran-Owned Small Business (SDVOSB) Concerns Eligible Under the SDVOSB Program 52.219-28 Post award Small Business Program Representation (Jan 2025) 52.219-29 Notice of Set-Aside for, or Sole-Source Award to, Economically Disadvantaged Women-Owned Small Business Concerns 52.219-30 Notice of Set-Aside for, or Sole-Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program 52.222-1 Notice to the Government of Labor Disputes

North, Sarah E CIV (USA) Yellow = supply & service Blue = supply Green = service No Highlight = always use

Follman, Roy J PO1 USCG TRACEN YORKTOWN (USA) (GRAY)= Must be Deleted

52.222-3 Convict Labor 52.222-20 Contracts for Materials, Supplies, Articles, and Equipment.

52.222-35 Equal Opportunity for Veterans 52.222-36 Equal Opportunity for Workers with Disabilities 52.222-37 Employment Reports on Veterans 52.222-50 Combating Trafficking in Persons 52.222-54 Employment Eligibility Verification 52.223-3 Hazardous Material Identification and Material Safety Data 52.223-5 Pollution Prevention and Right-to Know Information 52.223-11 Ozone-Depleting Substances and High Global Warming Potential Hydrofluorocarbons 52.223-23 Sustainable Products 52.224-1 Privacy Act Notification 52.224-2 Privacy Act 52.224-3 Privacy Training (Jan 2017) 52.225-1 Buy American-Supplies 52.225-3 Buy American-Free Trade Agreements-Israeli Trade Act (Nov 2023) 52.225-5 Trade Agreements.

52.225-8 Duty-Free Entry.

52.225-14 Inconsistency between English Version and Translation of Contract 52.226-4, Notice of Disaster or Emergency Area Set-Aside 52.226-5, Restrictions on Subcontracting Outside Disaster or Emergency Area 52.226-6 Promoting Excess Food Donation to Nonprofit Organizations.

52.226-7 Drug-Free Workplace.

52.226-8 Encouraging Contractor Policies to Ban Text Messaging While Driving.

52.227-1 Authorization and Consent (Jun 2020) 52.227-14 Rights in Data-General.

52.227-17 Rights in Data-Special Works.

52.227-19 Commercial Computer Software License 52.229-12 Tax on Certain Foreign Procurements.

52.232-1 Payments.

52.232-8 Discounts for Prompt Payment.

52.232-11 Extras.

52.232-24 Prohibition of Assignment of Claims.

52.232-25 Prompt Payment.

52.232-33 Payment by Electronic Funds Transfer-System for Award Management.

52.232-34 Payment by Electronic Funds Transfer-Other than System for Award Management.

52.232-35 Designation of Office for Government Receipt of Electronic Funds Transfer Information.

52.232-36 Payment by Third Party.

52.232-37 Multiple Payment Arrangements.

52.232-39 Unenforceability of Unauthorized Obligations 52.232-40 Providing Accelerated Payments To Small Business Subcontractors 52.233-1 Disputes.

52.233-3 Protest after Award.

52.233-4 Applicable Law for Breach of Contract Claim.

52.240-91 Security Prohibitions and Exclusions 52.240-92 Security Requirements 52.240-93 Basic Safeguarding of Covered Contractor Information Systems 52.242-13 Bankruptcy.

52.242-15 Stop-Work Order 52.242-17 Government Delay of Work.

52.243-1 Changes-Fixed-Price 52.243-7 Notification of Changes.

52.244-6 Subcontracts for Commercial Products and Commercial Services. ( To the maximum extent practicable, the Contractor shall incorporate, and require its subcontractors at all tiers to incorporate, commercial products, commercial services, or non-developmental items as components of items to be supplied under this contract.)

52.245-1 Government Property.

52.245-9 Use and Charges.

52.246-1 Contractor Inspection Requirements 52.246-11 Higher-Level Contract Quality Requirement.

52.246-16 Responsibility for Supplies 52.246-23 Limitation of Liability.

52.247-1 Commercial Bill of Lading Notations.

52.247-34 F.o.b. Destination.

52.249-1 Termination for Convenience of the Government (Fixed-Price) (Short Form).

52.249-8 Default (Fixed-Price Supply and Service) 52.253-1 Computer Generated Forms

(End of Clause)

52.252-2 Clauses Incorporated by Reference (Feb 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address: http://www.acquisition.gov/far/

52.252-6 Authorized Deviations in Clauses (Nov 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Department of Homeland Security Regulation 48 CFR 3001.404 clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

FAR PROVISIONS

The following FAR Provisions are hereby incorporated by reference:

52.203-18 Prohibition on Contracting with Entities that Require Certain Internal Confidentiality Agreements or Statements-Representation 52.207-4 Economic Purchase Quantity-Supplies.

52.204-7 System for Award Management (Nov 2024) 52.207-6 Solicitation of Offers from Small Business Concerns and Small Business Teaming Arrangements or Joint Ventures (Multiple-Award Contracts) 52.209-2 Prohibition on Contracting with Inverted Domestic Corporations-Representation 52.212-1 Instructions to Offerors—Commercial Products and Commercial Services 52.214-34 Submission of Offers in the English Language 52.214-35 Submission of Offers in U.S. Currency 52.217-10 Reverse Auction 52.219-31 Notice of Small Business Reserve 52.222-18 Certification Regarding Knowledge of Child Labor for Listed End Products.

52.222-56 Certification Regarding Trafficking in Persons Compliance Plan 52.223-1 Biobased Product Certification 52.223-4 Recovered Material Certification 52.225-2 Buy American Certificate 52.225-4 Buy American-Free Trade Agreements-Israeli Trade Act Certificate 52.225-6 Trade Agreements Certificate.

52.225-7 Waiver of Buy American Statute for Civil Aircraft and Related Articles.

52.225-17 Evaluation of Foreign Currency Offers 52.225-18 Place of Manufacture.

52.228-1 Bid Guarantee.

http://www.acquisition.gov/far/

52.229-11 Tax on Certain Foreign Procurements—Notice and Representation 52.232-38 Submission of Electronic Funds Transfer Information with Offer.

52.250-2 SAFETY Act Coverage Not Applicable

(End of Provision)

52.252-1 Solicitation Provisions Incorporated by Reference (Feb 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es): http://www.acquisition.gov/far/

(End of provision)

52.203-17 Contractor Employee Whistleblower Rights (April 2024) (DHS-USCG DEVIATION 14-01, Revision 1)

(a) This contract and employees working on this contract will be subject to the whistleblower rights and remedies established at 10 U.S.C. 4701 and Homeland Security Acquisition Regulation (HSAR) 3.900 (DEVIATION) through 3.905 (DEVIATION).

(b) The Contractor shall inform its employees in writing, in the predominant language of the workforce, of employee whistleblower rights and protections under 10 U.S.C. 4701, as described in HSAR 3.900 (DEVIATION) through 3.905 (DEVIATION).

(c) The Contractor shall insert the substance of this clause, including this paragraph (c), in all subcontracts.

(End of clause)

52.212-2 Evaluation—Commercial Products and Commercial Services (Nov 2021)

(a) The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors shall be used to evaluate offers:

The Government will award a contract resulting from this solicitation to the offeror responsible whose offer conforming to the solicitation is the Lowest Priced Technically Acceptable (LPTA) in accordance with FAR Part

12.203. Technically acceptable is defined as the offeror's ability to meet ALL the requirements/salient characteristics identified in the Statement of Work and the offeror's demonstrated ability to perform the contract successfully through Past Performance. Only the lowest priced offer will be evaluated for technical acceptability. If the lowest priced offer is found NOT to be technically acceptable, then the next lowest priced offer will be evaluated.

(b) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(c) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

52.216-18 Ordering http://www.acquisition.gov/far/ https://www.law.cornell.edu/uscode/text/10/4701 https://www.acquisition.gov/far/subpart-3.9#FAR_3_900 https://www.acquisition.gov/far/subpart-3.9#FAR_3_905 https://www.law.cornell.edu/uscode/text/10/4701 https://www.acquisition.gov/far/subpart-3.9#FAR_3_900 https://www.acquisition.gov/far/subpart-3.9#FAR_3_905

Any supplies and services to be furnished under this contract shall be ordered by issuance of delivery orders or task orders by the individuals or activities designated in the Schedule. Such orders may be issued from __________ through ____________ [insert dates].

(b) All delivery orders or task orders are subject to the terms and conditions of this contract. In the event of conflict between a delivery order or task order and this contract, the contract shall control.

(c) A delivery order or task order is considered "issued" when—

(1) If sent by mail (includes transmittal by U.S. mail or private delivery service), the Government deposits the order in the mail;

(2) If sent by fax, the Government transmits the order to the Contractor's fax number; or

(3) If sent electronically, the Government either—

(i) Posts a copy of the delivery order or task order to a Government document access system, and notice is sent to the Contractor; or

(ii) Distributes the delivery order or task order via email to the Contractor's email address.

(d) Orders may be issued by methods other than those enumerated in this clause only if authorized in the contract.

52.216-19 Order Limitations (Oct 1995)

(a) Minimum order. When the Government requires supplies or services covered by this contract in an amount of less than ____33_________ [insert dollar figure or quantity], the Government is not obligated to purchase, nor is the Contractor obligated to furnish, those supplies or services under the contract.

(b) Maximum order. The Contractor is not obligated to honor-

(1) Any order for a single item in excess of _____ $1,205.44 ________ [insert dollar figure or quantity];

(2) Any order for a combination of items in excess of _____ 33 total_________ [insert dollar figure or quantity]; or

(3) A series of orders from the same ordering office within _____________ days that together call for quantities exceeding the limitation in paragraph (b)(1) or (2) of this section.

(c) If this is a requirements contract (i.e., includes the Requirements clause at subsection 52.216-21 of the Federal Acquisition Regulation (FAR)), the Government is not required to order a part of any one requirement from the Contractor if that requirement exceeds the maximum-order limitations in paragraph

(b) of this section.

(d) Notwithstanding paragraphs (b) and (c) of this section, the Contractor shall honor any order exceeding the maximum order limitations in paragraph (b), unless that order (or orders) is returned to the ordering office within __100___ days after issuance, with written notice stating the Contractor’s intent not to ship the item (or items) called for and the reasons. Upon receiving this notice, the Government may acquire the supplies or services from another source.

52.217-8 Option to Extend Services (Nov 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 60 days.

52.217-9 Option to Extend the Term of the Contract (Mar 2000) https://www.acquisition.gov/far/part-52#FAR_52_216_21

(a) The Government may extend the term of this contract by written notice to the Contractor within 1 day; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed five

(05) (years).

(End of Clause)

52.222-18 Certification Regarding Knowledge of Child Labor for Listed End Products (Feb 2021)

(a) Definition.

Forced or indentured child labor means all work or service-

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

(b) Listed end products. The following end product(s) being acquired under this solicitation is (are) included in the List of Products Requiring Contractor Certification as to Forced or Indentured Child Labor, identified by their country of origin. There is a reasonable basis to believe that listed end products from the listed countries of origin may have been mined, produced, or manufactured by forced or indentured child labor.

Listed End Product Listed Countries of Origin

(c) Certification. The Government will not make award to an offeror unless the offeror, by checking the appropriate block, certifies to either paragraph (c)(1) or paragraph (c)(2) of this provision.

(1) □ The offeror will not supply any end product listed in paragraph (b) of this provision that was mined, produced, or manufactured in a corresponding country as listed for that end product.

(2) □ The offeror may supply an end product listed in paragraph (b) of this provision that was mined, produced, or manufactured in the corresponding country as listed for that product. The offeror certifies that it has made a good faith effort to determine whether forced or indentured child labor was used to mine, produce, or manufacture such end product. On the basis of those efforts, the offeror certifies that it is not aware of any such use of child labor.

52.252-5 Authorized Deviations in Provisions (Nov 2020)

(a) The use in this solicitation of any Federal Acquisition Regulation (48 CFR Chapter 1) provision with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the provision.

(b) The use in this solicitation of any Department of Homeland Security Regulation 48 CFR 3001.404 provision with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

HSAR AND HSAM CLAUSES

3012.301 Solicitation provisions and contract clauses for the acquisition of commercial items.

(f) Solicitation provisions and contract clauses. Insert (HSAR) 48 CFR 3052.212-70, Contract Terms and Conditions Applicable to DHS Acquisition of Commercial Items, in any solicitation or contract for commercial items when any of the provisions or clauses listed therein applies and where incorporation by reference of each selected provision or clause is, to the maximum extent practicable, consistent with customary commercial practice. If necessary, tailor this clause.

___ 3052.223-90 Accident and fire reporting (USCG) (Dec 2003) (where all or part of a contract will be performed on Government-owned or leased property.)

3052.212-70 Contract Terms and Conditions Applicable to DHS Acquisition of Commercial Items.

As prescribed in (HSAR) 48 CFR 3012.301 Contract Terms and Conditions Applicable to DHS Acquisition of Commercial Items (SEP 2012) The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components. The provision or clause in effect based on the applicable regulation cited on the date the solicitation is issued applies unless otherwise stated herein. The following provisions and clauses are incorporated by reference:

(a) Provisions.

__3052.216-70 Evaluation of Offers Subject to An Economic Price Adjustment Clause.

__3052.219-72 Evaluation of Prime Contractor Participation in the DHS Mentor Protégé Program

(b) Clauses.

__3052.203-70 Instructions for Contractor Disclosure of Violations.

__3052.204-70 Security Requirements for Unclassified Information Technology Resources.

__3052.204-71 Contractor Employee Access.

__Alternate I -Insert the basic clause with its Alternate I for acquisitions requiring contractor access to IT resources.

___Alternate II For acquisitions in which the contractor will not have access to IT resources, but the Department has determined contractor employee access to sensitive information or Government facilities must be limited to U.S. citizens and lawful permanent residents, insert the clause with its Alternate II. Notes: Neither the basic clause nor its alternates shall be used unless contractor employees will require recurring access to Government facilities or access to sensitive information. Neither the basic clause nor its alternates should ordinarily be used in contracts with educational institutions.

__3052.205-70 Advertisement, Publicizing Awards, and Releases.

__3052.209-73 Limitation on Future Contracting.

__3052.215-70 Key Personnel or Facilities.

__3052.216-71 Determination of Award Fee.

__3052.216-72 Performance Evaluation Plan.

__3052.216-73 Distribution of Award Fee.

__3052.217-91 Performance. (USCG) __3052.217-92 Inspection and Manner of Doing Work. (USCG) __3052.217-93 Subcontracts. (USCG) __3052.217-94 Lay Days. (USCG) __3052.217-95 Liability and Insurance. (USCG) __3052.217-96 Title. (USCG) __3052.217-97 Discharge of Liens. (USCG) __3052.217-98 Delays. (USCG) __3052.217-99 Department of Labor Safety and Health Regulations for Ship Repair. (USCG) __3052.217-100 Guarantee. (USCG) __3052.219-70 Small Business Subcontracting Plan Reporting.

__3052.219-71 DHS Mentor Protégé Program.

__3052.219-72 Evaluation of Prime Contractor Participation in the DHS Mentor Protégé Program __3052.222-70 Strikes or Picketing Affecting Timely Completion of the Contract Work __3052.222-90 Local Hire Coast Guard shall include a provision for local hire in each contract for construction or services to be performed in whole or in part in a State that has an unemployment rate in excess of the national average rate of unemployment as determined by the Secretary of Lab

__3052.228-70 Insurance.

__3052.228-90 Notification of Miller Act Payment Bond Protection. (USCG) __3052.228-91 Loss of or Damage to Leased Aircraft. (USCG) __3052.228-92 Fair Market Value of Aircraft. (USCG) __3052.228-93 Risk and Indemnities. (USCG) __3052.236-70 Special Provisions for Work at Operating Airports.

__3052.242-72 Contracting Officer's Technical Representative.

__3052.247-70 F.o.B. Origin Information.

__Alternate I __Alternate II XX 3052.247-72 F.o.B. Destination Only.

(End Of Clause)

HSAR 3052.204-71 Contractor Employee Access (July 2023)

(1) contractor employees require recurring access to Government facilities;

(2) contractor employees require access to sensitive information; or

(3) contractor IT systems are used

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility AntiTerrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008).

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system; (8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government's activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the

Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(End of clause)

HSAR 3052.204-72 Safeguarding of controlled unclassified information.

Safeguarding of Controlled Unclassified Information (JUL 2023)

(a) Definitions. As used in this clause— Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Public Law 116-283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer's Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projectscryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800-88, Guidelines for Media Sanitization.