FPAC IT Standards and Requirements.pdf

RFQ# 12FCP224Q0021

ATTACHMENT - FPAC IT Standards and Requirements

Section 508 Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

E207.1 General Where components of ICT are software and transmit information or have a user interface, such components shall conform to E207 and the requirements in Chapter 5

Exception from E207.1 General: Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to the requirements in Chapter 5.

E207.2 WCAG Conformance User interface components, as well as the content of platforms and applications, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

Exceptions from E207.2 WCAG Conformance:

• Software that is assistive technology and that supports the accessibility services of the platform shall not be required to conform to E207.2.

• Non-web software shall not be required to conform to the following four Success Criteria in WCAG 2.0: 2.4.1 Bypass Blocks; 2.4.5 Multiple Ways; 3.2.3 Consistent Navigation;

and 3.2.4 Consistent Identification.

• Non-Web software shall not be required to conform to Conformance Requirement 3 Complete Processes in WCAG 2.0.

E207.3 Complete Process for Non-Web Software Where non-Web software requires multiple steps to accomplish an activity, all software related to the activity to be accomplished shall conform to WCAG 2.0 as specified in E207.2.

E208.1 General Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

502.4 Platform Accessibility Features. Platforms and platform software shall conform to the requirements in ANSI/HFES 200.2, Human Factors Engineering of Software User Interfaces — Part 2: Accessibility (2008) (incorporated by reference, see 702.4.1) listed below:

• A. Section 9.3.3 Enable sequential entry of multiple (chorded) keystrokes;

• B. Section 9.3.4 Provide adjustment of delay before key acceptance;

• C. Section 9.3.5 Provide adjustment of same-key double-strike acceptance;

• D. Section 10.6.7 Allow users to choose visual alternative for audio output;

• E. Section 10.6.8 Synchronize audio equivalents for visual events;

• F. Section 10.6.9 Provide speech output services; and

• G. Section 10.7.1 Display any captions provided.

503.1 General Applications shall conform to 503.

503.2 User Preferences Applications shall permit user preferences from platform settings for color, contrast, font type, font size, and focus cursor.

Exception from E503.2 User Preferences: Applications that are designed to be isolated from their underlying platform software, including Web applications, shall not be required to conform to 503.2.

503.3 Alternative User Interfaces. Where an application provides an alternative user interface that functions as assistive technology, the application shall use platform and other industry standard accessibility services.

503.4 User Controls for Captions and Audio Description Where ICT displays video with synchronized audio, ICT shall provide user controls for closed captions and audio descriptions conforming to 503.4.

503.4.1 Caption Controls Where user controls are provided for volume adjustment, ICT shall provide user controls for the selection of captions at the same menu level as the user controls for volume or program selection.

503.4.2 Audio Description Controls. Where user controls are provided for program selection, ICT shall provide user controls for the selection of audio descriptions at the same menu level as the user controls for volume or program selection.

504.2 Content Creation or Editing Authoring tools shall provide a mode of operation to create or edit content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for all supported features and, as applicable, to file formats supported by the authoring tool. Authoring tools shall permit authors the option of overriding information required for accessibility.

504.2.1 Preservation of Information Provided for Accessibility in Format Conversion. Authoring tools shall, when converting content from one format to another or saving content in multiple formats, preserve the information required for accessibility to the extent that the information is supported by the destination format.

504.2.2 PDF Export. Authoring tools capable of exporting PDF files that conform to ISO 32000- 1:2008 (PDF 1.7) shall also be capable of exporting PDF files that conform to ANSI/AIIM/ISO 14289-1:2016 (PDF/UA-1) (incorporated by reference, see 702.3.1).

504.3 Prompts. Authoring tools shall provide a mode of operation that prompts authors to create content that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1) for supported features and, as applicable, to file formats supported by the authoring tool.

504.4 Templates. Where templates are provided, templates allowing content creation that conforms to Level A and Level AA Success Criteria and Conformance Requirements in WCAG

2.0 (incorporated by reference, see 702.10.1) shall be provided for a range of template uses for supported features and, as applicable, to file formats supported by the authoring tool.

602.1 General. Documentation that supports the use of ICT shall conform to 602.

602.2 Accessibility and Compatibility Features. Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5. Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

602.3 Electronic Support Documentation. Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

602.4 Alternate Formats for Non-Electronic Support Documentation. Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

603.1 General. ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

Data Rights

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements, and rendering other assistance as deemed necessary.

Privacy Act

The Contractor Agrees To –

• Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies— o The systems of records; and o The design, development, or operation work that the contractor is to perform;

• Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

• Definitions of the clause:

o “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

o “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

Confidentiality and Non-Disclosure (Create sub-section in "Special IT Requirements" or "IT Standards and Requirements)

Any USDA proprietary information, data, and/or equipment that the Contractor has been granted access by USDA to perform work under this order, will be returned to the USDA when no longer required to perform work under this order. The public release of USDA proprietary information must be authorized in writing by the Contracting Officer.

The component parts of this effort and reports are expected to contain highly sensitive information that may act as a guide for hostile entities to cause harm to the Department’s critical infrastructure. Any such information made available in any format shall be used only for the purpose of carrying out the provisions of this agreement. Such information shall not be divulged or made known in any manner to any person.

The Contractor shall immediately notify the Contractor Program Manager, the Contractor on-site Manager, the COR, the Government TPM and the Contracting Officer upon discovery of any inadvertent disclosures of information. The Contractor shall not retain any information regarding vulnerabilities, to include summaries, the actual vulnerability report, etc., at the end of the task order. All information arising from this task, both hard copy and electronic, shall be returned to the COR and Government TPM at task completion.

The Contractor must agree that:

• The draft and final deliverables and all associated working papers and other materials deemed relevant by the USDA TPMs that have been generated by the Contractor in the performance of this task order are the property of the U.S. Government and must be submitted to the USDA TPMs at the conclusion of the tasks.

• All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor. All appropriate project documentation will be given to the Government TPM during and at the end of this contract. The Contractor will release no information. Any request for information relating to this Statement of Work presented to the Contractor must be submitted in writing to the USDA TPMs and the CO, who in turn will

12.3 under assignment of this contract.

Sensitive Information Storage and Disclosure

Sensitive information, data, and/or equipment will be disclosed only to authorize personnel on a Need-To-Know basis. The holder shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment will be returned to Government control; destroyed; or held until otherwise directed. Destruction of items shall be accomplished by tearing into small parts;

burning; shredding or other method that precludes the reconstruction of the material.

Work on this contract may require that personnel have access to Privacy Information. Personnel shall adhere to the Privacy Act, Title 5 of the U. S. Code, Section 552a and applicable agency rules and regulations.

The Contractor Program Manager shall ensure that all contract personnel take the required USDA Security Awareness and Rules of Behavior Training.

Release of Information

No USDA data shall be divulged to any unauthorized person, for any purpose. Therefore, the Contractor shall clear with the Contracting Officer any public release of any information.

Information includes news stories, articles, sales and marketing information, advertisements, etc. All requests for public release of information shall be submitted via email to the COR and Government Technical Program Manager (TPM) and the Contracting Officer and addressed to:

United States Department of Agriculture

Office of Communications (OC)

1400 Independence Avenue, SW

Washington, DC 20250

The Contracting Officer shall submit the Contractor’s Request for Press Release to the Office of Communications for approval. The Contractor shall not release any information to the public without official OC approval from the Contracting Officer.

Return of Data

Data and information developed, entered, and processed under this contract shall be considered Government property. All data and/or materials provided to the contractor to accomplish individual deliverables, or data generated as a result of accomplishing individual deliverables, shall be returned to the Government or destroyed at the end of each applicable deliverable, unless the contractor specifically requests and receives approval from the COR to maintain copies of this data. The Contractor is responsible for distributing data and/or materials given to members of the contractor’s team. None of this data will be released to any other Government organization or other organizations of individuals without the express written approval of USDA unless otherwise specified.

COMPLIANCE WITH INTERNET PROTOCOL VERSION 6 (IPV6)

Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

· Specifically, any new IP product or system developed, acquired, or produced must:

o Interoperate with both IPv6 and IPv4 systems and products, and o Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

· As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

· The Contractor shall provide technical support for both IPv4 and IPv6.

· Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

· Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

Information Security

Information Security Incidents

An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

Information Security Incident Reporting Requirements

All Information Security Incidents must be reported in accordance with the requirements below, even if it is believed the Incident may be limited, small, or insignificant.

The Contractor must report all Information Security Incidents immediately, but not later than 30 minutes after becoming aware of the Incident.

Copy the Contracting Officer Representative (COR) if possible, or if Contracting Officer Representative (COR) email is not immediately available; contact the Contracting Officer Representative (COR) immediately after reporting the incident.

Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

Information Security Incident Response Requirements

All determinations related to Information Security Incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) must be made by authorized USDA officials.

The Contractor must provide full access and cooperation for all activities (determined by the authorized Government official to be required) to ensure an effective Incident Response, including providing all requested images, log files, and event information to facilitate rapid resolution of Information Security Incidents.

Incident Response activities determined to be required may include but are not limited to:

inspections, investigations, forensic reviews, data analyses & processing, and final determinations of responsibility for the Incident and/or liability for any additional Response activities.

USDA, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in Incident Response activities.

Information Types

The term Information is synonymous with Data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

Sensitive Information

Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government's interests. Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical/Health, Legal, Strategic, Security, Intellectual Property & Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional protection in aggregate.

Personally Identifiable Information (PII)

PII, as defined in OMB Memorandum M-07-16, refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information [that is publicly available] — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual, but alone may not constitute Sensitive PII.

Sensitive PII

Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual's or entity's identity, or alter the outcome of an individual's or entity's activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers.

Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), is also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

Compliance with Security IT Policies

Information systems and system services provided by the Contractor must comply with the current USDA IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

The Contractor is required to comply with current Federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E- Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies; Office of https://gcc02.safelinks.protection.outlook.com/?url=https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories&data=02%7c01%7c%7c895fc4c32ce54dde441e08d810b0624d%7ced5b36e701ee4ebc867ee03cfa0d4697%7c0%7c0%7c637277697057980469&sdata=GA6krETPfos3vSTuVxHKQQlc5CpRvFDEMRegjxlbpfI%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories&data=02%7c01%7c%7c895fc4c32ce54dde441e08d810b0624d%7ced5b36e701ee4ebc867ee03cfa0d4697%7c0%7c0%7c637277697057980469&sdata=GA6krETPfos3vSTuVxHKQQlc5CpRvFDEMRegjxlbpfI%3D&reserved=0

Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA must comply.

House Resolution 83-15 "Consolidated and Further Continuing Appropriations Act, 2015" requires that USDA demonstrate each project/investment is "being managed in accordance with applicable lifecycle management policies and guidance." This mandates that USDA development projects are required to follow the Agency's System Development Lifecycle (SDLC). All projects listed in Farm Service Agency Farm Programs IT plan for expenditure can expect to be audited for compliance. Audits may occur at any time after the plan for expenditure is submitted to Congress.

The Contractor must protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor must review and remediate the vulnerabilities and present the results for Government approval within the timeframes documented in USDA IT security policies.

Security Assessment and Authorization

This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor must cooperate and support the Government in the development of required documentation and artifacts.

All information systems that input, store, process, and/or output Government information must be provided an Authority to Operate (ATO) signed by the authorizing official as identified by the CIO. The Contractor must adhere to current policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.

Federal Reporting Requirements

Contractors operating information systems must comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors must provide the Government with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB), and may change each reporting period. The Contractor must provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

Acquiring and/or Implementing Software Applications

Secure Coding Skills: FPAC-Information Assurance Branch does not require the Contractor provide any specific certification for members of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic). That requirement is under the purview of the federal points of contact (POC) responsible for the work being contracted.

Source code testing, binary code testing, application scanning, and penetration testing: At least one (1) week prior to delivery of any code due under this contract, Contractor must deliver to the COR the following reports covering all code that will be delivered:

• Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief

Information Officer of USDA. On the report, the Contractor must highlight all vulnerabilities rated "critical" and "high." The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

• For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor must highlight all vulnerabilities rated "critical" and "high."

• For all applications: application penetration results.

Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered.

Processing, Storing, Transmitting Government Data to Non-Government System

The Contractor or other external organizations must develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by the Government with significant replacement cost should the Contractor's and other external organization's copy be corrupted. This plan must describe the processes and procedures that must be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan must describe those parts of the contract to which this clause applies. The Contractor or other external organization's IT System Security Plan must be compliant with applicable Federal laws that include, but are not limited to:

(e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan must meet IT security requirements in accordance with Government policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

The Contractor and other external organizations must ensure that the appropriate security banners are displayed on all Government systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

Note related to deliverable planning and contract monitoring:

For software development contracts, the COR should include security compliance in the QASP and not accept deliverable until all vulnerabilities are cleared. This effort can be measured by requesting a vulnerability remediation plan. This part needs to be included because an Agency may work with a specific vendor to assist in the remediation of specific vulnerabilities. If the information about the Agency and vulnerability are not protected properly, exposure of an Agency security vulnerability in an operational software will increase the risk and likelihood of compromise. This will put the Agency and customers at an increased risk of harm due to the exposure. Harm can be defined as vulnerability exploitation to comprise the software and data or risk of damage to the reputation of the Agency.

Personnel Security

Acquired services shall comply with the following regulations and requirements:

Background Investigation Requirements o Contractor personnel must be able to obtain a favorable suitability decision in accordance with 5 CFR part 731.

o The duties of this contract range from low risk to high risk positions and, as such, Contractor personnel will be required to submit all required documentation necessary for the agency to provide a favorable preliminary decision on suitability. This decision is required prior to commencing work on the contract.

o Contractor personnel who receive an unfavorable suitability decision must be immediately removed from consideration for work on the contract.

o The company is accountable for selecting personnel capable of receiving favorable suitability determinations; consequences for advancing personnel not able to pass government background checks may include providing invoice credits effectively reimbursing the government for background check expenses.

Performance delays or detrimental project outcomes due to not onboarding or removal of staff will be directly attributable to the vendor and documented.

Non-U.S. Citizens

In compliance with 48 CFR 3052.204-71, each individual employed under a Federal contract shall be a citizen of the United States of America, or a non-U.S. citizen who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I- 551). The Contractor shall provide a list of all non-U.S. citizens at the Contract Kickoff Meeting. The Contractor shall report any additions or deletions of non-U.S. citizens to the CO and COR within ten (10) business days of the change.

Contractors and subcontractors hired for work within the United States or its territories who require access to USDA Mission Areas, Agencies and Staff Offices or controlled facilities, Information Technology (IT) systems or security items or products, must be either U.S. citizens or Lawful Permanent Residents, also known as "green card" holders.

1. Low Risk duties may be performed by a U.S. Citizen or lawful Permanent Resident Alien.

2. Moderate Risk duties may be performed by U.S. Citizen or lawful Permanent Resident Alien with at least three or more years of U.S. residency from the date of legal entry to the U.S.

3. High Risk duties may be performed only by U.S. Citizens.

4. National Security Positions may be performed only by U.S. Citizens.

Under exceptional circumstances, the Government may request a waiver when a prospective contractor or subcontractor does not meet the citizenship or lawful permanent resident alien status requirement. Requests for waivers to the citizenship requirement must be submitted in writing. Non-U.S. citizens employed as contractors or subcontractors shall not be allowed access to USDA Mission Areas, Agencies and Staff Offices or controlled facilities, IT systems, or security items or products prior to the issuance of a waiver.

HSPD-12 - Credentials

Contractor personnel must complete necessary requirements to obtain HSPD-12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD-12 credentials is grounds for removal/suspension of Contractor personnel from the contract.

Non-Disclosure Agreements

Standard non-disclosure statements shall be provided as required for system administration personnel who may have access to Government data during their duties.

Foreign Nationals

In July 2023 Home Land Security (HLS) expanded the requirements for eligibility to work on USDA government contracts. HLS increased the requirements for background investigations during contractor onboarding as follows:

• Must be a US citizen, or

• Must be a foreign national with a minimum of 3-years residency.

Noncompliance has the potential for the denial of a positive security initial determination (SID) during contractor’s background investigation, which results in immediate withdraw from the contractor being able to work on a government contract. If the contractor onboarding doesn’t meet the new requirements, it won’t matter that the contractor may have obtained a positive SID in the past or that they may currently be assigned to an active contract. This guidance is subject to change and vendor will comply with all future guidance.

Technical Guidance

The following documents (versions current at time of award) are incorporated with the same force and effect as if provided in full text. Succeeding revisions may be substituted or incorporated as required with full notice and disclosure to the Contractor. The Government will provide access to available documents and technical information as required and upon Contractor request for the performance of this PWS.

a. FBC (FSA) Information Bulletins (IB) documents and Technical Information Advisory (TIA) documents as applicable to SAP.

b. Departmental Information Processing Standards (DIPS), manuals, circulars, and user requirements as applicable.

c. FBC (FSA) Standards Guide as applicable.

d. FBC (FSA) Security Standards.

e. United States Department of Agriculture Office of Procurement and Property Management AGAR Advisory No. 81, Revision.

f. FSA Enterprise Architecture principles, standards, and guidelines as applicable to SAP.

g. System specifications (or SAP equivalent Business Process Document (BPD), Functional Specification Document (FSD) and Technical Design Specification (TDS)) will be updated based on approved changes made during SAP O&M production support as well as DME activities, as required.

h. Other policy, procedural, or technical documentation as the Government may deem necessary in order to conduct work under this contract.

i. USDA OCIO Information Technology Governance Framework (IITGF) and Guidebook

j. FPAC-BC Information Technology Manufacturing Process Framework including the Minimum Required Deliverables (MRD) matrix

k. FPAC-BC System Development Lifecycle (SDLC)

l. USDA FPAC-BC Governance Guidebook

m. FPAC-BC Release Management SDLC Checklist

Artifacts and documents available at the main FPAC SDLC Confluence page (https://confluence.fpac.usda.gov/pages/viewpage.action?pageId=139726547).

Software License Line-Item Data

The contractor shall provide line item pricing data on all software licenses provided to USDA at award and/or during performance of the contract/order by completing the Software License Line Item Data form found at https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u. The form shall be completed within 10 days of award or 10 days of activation for licenses provided after the award date.

Software License Line-Item Data

If a Cloud solution is considered:

A cloud-hosted application for the Federal Government should be managed at the FedRAMP Moderate Baseline or higher, and it should include details on:

• Number of users of the application.

• Handling and implementing change requests.

• Patching and completing security updates.

• Meeting service level agreements. Offeror should include what service levels (such as availability) they were required to meet and if they were unable to meet them.

• Handling and correcting trouble tickets, incidents, and problem.

Transitioning data and services to a cloud-hosted Software-as-a Service for a Federal Government at FedRAMP Moderate Baseline or higher.

https://confluence.fpac.usda.gov/pages/viewpage.action?pageId=139726547 https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u https://forms.office.com/Pages/ResponsePage.aspx?id=5zZb7e4BvE6GfuA8-g1Gl2SXbFM93shIsb61_oKTJ09UMFhHRU5UWllPS0o4RE9ZTTVDVFRUWEM0NS4u

• Meeting and maintaining cybersecurity authorizations and accreditations at FedRAMP Moderate baseline or higher.

General Requirements

Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (CO) immediately.

Business Relations

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor must maintain continuity between the support operations and the contractor's corporate offices.

The Contractor shall provide overall Project / Program Management support apart from implementation teams to deliver periodic reporting on project/product status, resource utilization, planning, value delivery metrics, overall program level documentation required for the agency and department, and issue resolution.

Contract Management may be tailored to include a list of program management-specific deliverables. The program team should discuss which program management deliverables truly add value and seek to minimize administrative overhead.

Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support contract and/or task order actions. The contractor shall assign work effort and maintain accurate time keeping records of personnel assigned to work on under Labor Hour tasks.

Personnel Administration

The contractor shall provide the following management and support as required. The contractor shall provide for employees during designated Government non-workdays or other periods where Government offices are closed due to weather or security conditions. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the PWS requirements. The contractor shall make necessary travel arrangements for employees. The contractor shall provide necessary infrastructure to support contract tasks.

The contractor shall provide administrative support to employees in a timely fashion (time keeping, leave processing, pay, emergency needs).

Contractor Training

The Contractor shall provide fully trained and experienced support staff for performance of the PWS. Training of contractor personnel shall be performed at the Contractor's expense, except when the Government changes the requirements during performance of an on-going task and it is determined to be in the best interest of the Government. This will be negotiated on a case-by-case basis. Training at Government expense will not be authorized for replacement personnel nor for keeping Contractor personnel abreast of advances in the state-of-the-art, or for training Contractor employees on equipment, computer languages, and computer operating systems that are available in the commercial market.

Mandatory Government training shall be tracked and monitored through USDA's AgLearn system. All required courses must be completed by the required dates by all contract employees. Mandatory government training classes may be completed during work hours. It is the intent of USDA to provide 30 calendar days written notice of annual training requirements to the Contractor's PWS Manager. The PWS Manager will be responsible for notifying subordinate contractor employees. In the event the contractor does not receive 30 calendar day notice, the contractor is still required to complete the training by the specified required date(s).

These mandatory courses are typically provided through the AgLearn and are free-of-charge. AgLearn will typically load mandatory training to the individuals to do list. The COR will notify the contractor of new training requirements. Training can typically be completed within 30-60 minutes. This training includes, but not limited to:

• All contractor personnel working on this PWS shall be required to complete USDA provided Information Security Awareness Training (ISAT) both before beginning work and annually thereafter. Failure to take this training within the prescribed window will result in removal of the contractor employee from the PWS.

• Records Management training is a one-time training that is required for everyone within 90 days of their start date.

• Other training that is federally mandated or required by the agency.

Subcontract Management

The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the Contracting Officer (CO) or Contracting Officer Representative (COR).

Working with Technical Points of Contact (TPOCs) The COR may work with other Government personnel to monitor technical progress. The Contractor must work with other Government personnel, as designated by the COR, in review of specified requests and implementation of the specified task assignment request. Any actions resulting from such interactions that affect the contract or scope of work, or administrative issues, including work schedules and resources, must be documented, and reported to the COR and the CO, as appropriate, for approval before being implemented by the Contractor. The Contractor must bring problems or potential problems affecting performance to the attention of the COR as soon as possible. Verbal reports must be followed up with written reports, when directed by the COR, within twenty-four (24) hours. Only the CO may take action affecting the contractual relationship between the Government and the Contractor, including interpreting or changing the terms and conditions of the contract. The Contractor must not contact nor take direction from unauthorized FPAC employees, under any circumstances. The Contractor must direct all written and/or oral communications, throughout the project life cycle, to the CO and the

COR.

Key Capabilities

The Government has identified the following capabilities as critical to program delivery success.

The contractor shall provide these capabilities throughout the full period of performance of this Task Order.

The program team may insert language tailored to the specific requirements. A sample key capability is shown here. The program may list multiple key capabilities, usually no more than 2- 3.

Customer Relationship Management (CRM) Design, Development, and Delivery

The following proficiency and experience are indicative of ability to provide this capability successfully:

• Proficiency in IT business/system analysis.

• Competency implementing ITIL V4 best practices.

• Overall technical knowledge of SAP software with ability to review and provide feedback on support documents.

• Knowledge of Agile Scrum development methodology.

• Ability to understand business models and operational risk.

• Analytical ability, pragmatic problem-solving skills, and strong sense of task ownership.

• Ownership over regular, consistent, and proactive communications with various levels of government stakeholders.

• Ability to communicate amongst multiple different team types, and own responsibility for coordinating and communicating multiple tasks across multiple teams supporting 58 different applications.

The Contractor shall provide the necessary resources and infrastructure along with knowledge, skills and experience sufficient to manage, perform, and administer the contract requirements.

Personnel Retention and Recruitment

If it should become necessary to substitute or replace personnel, the Contractor shall immediately notify the COR. The Contractor shall ensure continuity of operations during periods of personnel turnover and long-term absences. Long-term absences are considered those longer than one week in duration. The Contractor is responsible for providing a complete staffing list to the COR on a regular basis, at least monthly, as a contract deliverable.

Travel

No Travel: Travel is not authorized on this contract, however if it is required with a bilateral modification the costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs.

Place and Time of Performance

Government stakeholders primarily work remotely. Some stakeholders may work at USDA facilities in Kansas City, Missouri, or the USDA headquarters in Washington, DC. The Government's normal duty hours are 6 a.m. – 6 p.m. local time and core work hours are 9:30 a.m. – 2:30 p.m. local time.

Contractor personnel will work primarily offsite and within the United States. Contractor personnel providing project management and supporting key capabilities will be available during Government core work hours. The Government will provide hoteling workspaces at USDA facilities in Kansas City, Missouri to supported limited onsite work and meetings when necessary.

Holidays and Administrative Leave

Federal Holidays:

The Contractor is hereby advised that Government personnel observe the following holidays:

• New Year's Day, Martin Luther King's Birthday, President's Day, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veteran's Day, Thanksgiving Day, and Christmas Day.

• In addition to the days designated as holidays, the Government may observe the following days: any other days designated by Federal Statute; any other days designated by Executive Order; and any other days designated by the President's Proclamation. This includes Inauguration Day (Washington, D.C. metropolitan area only). Observance of such days by Government personnel must not be a reason for an additional period of performance, or entitlement of compensation.

Government Administrative Leave Situations:

• When the agency grants administrative leave to its employees, on-site assigned Contractor personnel may be dismissed by the Contractor. The Contractor agrees to continue to provide sufficient personnel to perform tasks already in operation or scheduled, and must be guided by the instructions issued by the COR. The Government will not pay for the labor hours during the leave granted to non-working contract personnel as a result of inclement weather, potentially hazardous conditions, explosions, and other special circumstances.

USDA CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

Cyber Supply Chain Risk Management (C-SCRM) is the process of taking strategic steps to identify, assess and mitigate supply chain risk to departmental and agency information systems, system components and associated services based on analysis of the criticality of system components, services and functions. It covers the entire life cycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction) as supply chain threats and vulnerabilities may intentionally or unintentionally compromise information technology (IT) systems with operational technology (OT) systems (IT/OT) product or service at any stage.

COUNTRY OF ORIGIN (COO)

Country of Origin (COO) represents the country or countries of manufacture, production, design, or brand…