P03_ PWS EWS.pdf

Electronic Warehouse Receipts Performance Work Statement

General Information

1.0 Background and Purpose

The U.S. Department of Agriculture (USDA) is made up of 29 agencies and mission area offices with nearly 100,000 employees who serve the American people at more than 4,500 locations across the country and abroad. The United States Department of Agriculture (“Department”) was founded by President Abraham Lincoln in 1862 and was quickly coined “The People’s Department.” At the time, more than half of all Americans either lived or worked on farms, compared with the two percent today. Despite this decrease, the Department is still fulfilling Lincoln’s vision of touching the lives of every American through its mission to provide leadership on food, agriculture, natural resources and related issues based on sound public policy, the best available science and efficient management.

The Farm Production and Conservation (FPAC) is comprised of three FPAC agencies:

the Farm Service Agency (FSA), the Natural Resource Conservation Service (NRCS) and the Risk Management Agency (RMA). The FPAC Business Center is a first-of-its-kind organization at USDA, combining the talent of employees from all three FPAC agencies into specialized teams that serve employees and customers across FSA, NRCS RMA. This centralized business approach helps agencies improve operations and efficiency at USDA and boosts support for America’s farmers, ranchers and foresters.

The Farm Service Agency administers and manages farm commodity, credit, conservation, disaster and loan programs as laid out by Congress. FSA is structured with a National Office, located in Washington, D.C., State offices in all 50 States and Puerto Rico, and over 2,220 County Offices. The FSA implements commodity loans and requires a third-party provider to relay Electronic Warehouse Receipt (EWR) data for grains, including rice, and peanuts to FSA systems and personnel to issue loans or payments under commodity loan programs through the Commodity Credit Corporation (CCC).

The Farm Service Agency offers commodity loans to producers of eligible commodities. These loans provide customers/producers with interim financing at harvest time to meet cash flow needs without having to sell their commodities when market prices are typically at harvest-time lows. Allowing producers to store production at harvest facilitates more orderly marketing of commodities throughout the year.

There are various programs offered under the commodity loan umbrella including Marketing Assistance Loans (MAL), Sugar Loans, and Loan Deficiency Payments (LDP). Many loans issued directly to producers through local county offices are MALs. Commodity loans for sugar are issued to sugar processors. Producers may receive an LDP in lieu of a loan.

Trusted alternative delivery partners also issue loans on behalf of FSA.

Loans may be farm or warehouse stored. Warehouse stored loans are secured by a warehouse receipt. Warehouse receipts for cotton must be electronically transmitted. For all other commodities, paper or electronic warehouse receipts (EWR) are created to identify collateral. Paper warehouse receipts are given to a local county office employee and secured in the office until the loan is repaid. The data in EWRs is digitally transmitted. CCC is listed as the holder of the receipt until the loan is repaid.

The activity will last throughout a complete crop year plus 30 days to ensure loan activity has been recorded.

For FSA purposes, the crop year for a commodity is defined as, the 12-month period that:

• begins on the first day of the eleventh calendar month before the month in which the final availability date for the applicable commodity falls

• ends on the final availability date for the applicable commodity.

The final availability date is the last date within a specific crop year in which a producer can apply for a loan or LDP.

A producer may apply for a loan or LDP for a specific crop year until the last day of final loan availability. The start of the crop year varies by commodity and growing region.

The following table shows the final date of the crop year loan/LDP availability period is for commodities:

Commodity Date of Final Loan/LDP Availability Period for Crop Year 2024

Barley Canola Crambe Flaxseed Oats Rapeseed Sesame Seed Wheat

March 31, 2025

Corn Dry Peas Grain Sorghum Lentils Mustard Seed Rice Safflower Seed Chickpeas Soybeans Sunflower Seed

May 31, 2025

Peanuts January 31, 2026

Period of Performance The estimated POP is five (5) years; One (1) base period of twelve (12) months plus four (4) option periods of twelve (12) months each:

Base year April 18, 2025 – April 17, 2026 Option year 1 – April 18, 2026 – April 17, 2027 Option year 2 – April 18, 2027 – April 17, 2028 Option year 3 – April 18, 2028 – April 17, 2029 Option year 4 – April 18, 2029 - April 17, 2030

Place of Performance Government stakeholders primarily work remotely. Some stakeholders may work at USDA facilities in Kansas City, Missouri, or the USDA headquarters in Washington, DC. The Government's normal duty hours are 6 a.m. – 6 p.m. local time and core work hours are 9:30 a.m. – 2:30 p.m. local time. Contractor personnel will work primarily offsite and within the United States. Contractor personnel providing project management and supporting key capabilities will be available during Government core work hours. The Government will provide hoteling workspaces at USDA facilities in Kansas City, Missouri to supported limited onsite work and meetings when necessary.

Travel Travel is not authorized, however if it is required with a bilateral modification the costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR 31.205-46 Travel Costs

Federal Holidays The Contractor is hereby advised that Government personnel observe the following eleven (11) holidays:

New Year's Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veteran's Day Thanksgiving Day

Christmas Day

In addition to the days designated as holidays, the Government may observe the following days: any other days designated by Federal Statute; any other days designated by Executive Order; and any other days designated by the President's Proclamation. This includes Inauguration Day (Washington, D.C. metropolitan area only). Observance of such days by Government personnel shall not be a reason for an additional period of performance or entitlement of compensation.

Government Administrative Leave Situations When the agency grants administrative leave to its employees, on-site assigned Contractor personnel may be dismissed by the Contractor. The Contractor agrees to continue to provide sufficient personnel to perform tasks already in operation or scheduled, and must be guided by the instructions issued by the COR. The Government will not pay for the labor hours during the leave granted to non-working contract personnel because of inclement weather, potentially hazardous conditions, explosions, and other special circumstances.

2.0 Definitions

Commodity/Commodities- a raw agricultural product

• Commodities eligible for the MAL or LDP program and in scope for this project include the following:

o Barley o Corn o Grain sorghum, including dual purpose sorghum varieties as determined by CCC.

o Honey o Mohair o Peanuts o Oats o Oilseeds, including canola, crambe, flaxseed, mustard seed, rapeseed, safflower seed, sesame o Seed, soybeans, and sunflower seed o Pulse crops, including large and small chickpeas, dry peas, and lentils o Rice, long and medium grain o Wheat o Wool, graded and nongraded

Commodity Loan- a loan that can be nonrecourse or recourse.

Crop Year- for a commodity, the 12-month period that:

• Begins on the first day of the eleventh calendar month before the month in which the final availability date for the applicable commodity falls

• Ends on the final availability date for the applicable commodity.

• Crop with respect to a year, means commodities harvested in that year. Crop year of a commodity means commodities that when planted were intended for harvest in that calendar year.

Deputy Administrator- The Deputy Administrator for Farm Programs (DAFP), Farm Service Agency (FSA) or a designee of that person.

Electronic Warehouse Receipt (EWR)- Receipts authorized by AMS to be issued or transmitted under USWA as electronic documents.

• EWR’s are electronically filed in a central filing system by an approved provider as provided in an executed “Farm Service Agency Provider Agreement to Electronically File and Maintain Warehouse Receipts.”

Final Loan/LDP availability- The date in which requests and all supporting documentation for a loan or LDP must be received in the FSA service center.

Producer- a person or legal entity that:

• Has complied with annual program requirements including specific eligibility requirements

• Has a beneficial interest in the eligible commodity for which a loan or LDP is requested

• Shares in the risk of producing the applicable commodity.

o The person or legal entity may be any of the following:

• Landowner

• Landlord or waterlord

• Tenant

• Sharecropper

LDP- payment made to a producer who, although eligible to obtain a CCC commodity loan, agrees to forgo the loan in return for a payment on the eligible commodity.

Public Warehouse- any elevator, seed house, feed store, or other structure for which any of the following apply:

• Under a storage agreement with CCC, such as UGRSA

• State or federally licensed to warehouse agricultural commodities

• Insures the commodity stored regardless of the commodity ownership

• Receives compensation for storage based on the quantity stored, such as per bu., cwt, etc.

Quality/Grading factors- the observed or tested items of grain or oilseeds that substantiate the quality of the commodity and grade assigned by the warehouse operator.

Unapproved/unlicensed warehouses- warehouses that are not CCC-approved, Federally or State licensed to store and issue negotiable warehouse receipts for commodities physically delivered or stored in the warehouses, such as but not limited to dairy, feedlot, pit, ethanol plant, feed mill, or wool pool.

Warehouse receipt- a receipt containing the required information prescribed in 7 CFR Part

1421.3 and is:

• A pre-numbered, negotiable warehouse receipt issued under the authority of the U. S. Warehouse Act, a state licensing authority, or by an approved CCC warehouse in such format authorized and approved, in advance by CCC

• An electronic warehouse receipt (EWR) issued by such warehouse recorded in a central filing system or system maintained in one or more locations which are approved by FSA to operate such system; or

• other such acceptable evidence of title, as determined by CCC.

Automation abbreviations

• ACRS- Automated Cotton Reporting System

• CLPS- Commodity Loan Processing System

• COPS- Cotton Online Processing System

• DCR- Data change request

3.0 Contractor Requirements

Deliverables/Tasks The services described herein are non-personal services in accordance with FAR Part 37 – Service Contracting and are not inherently governmental. The following table summarizes the deliverables discussed in Section 3.0. All days are listed as business days. If a conflict exists between Section 3.0 and this table, Section 3.0 prevails. If a due date falls on a Federal holiday, Saturday, or Sunday, the deliverable due date shall be the next scheduled federal workday.

**Acceptance of this contract requires the awardee to maintain AMS licensing during the entire period of performance.

The Contractor must provide a secure system based on USDA Agricultural Marketing Service (AMS) licensing requirements to access and transmit EWR data as indicated through AMS Provider Agreement guidelines. The Contractor will be granted access to transmit data to FSA EWR system through Firewall access and security certificates.

The Contractor must obtain a license from AMS as https://www.ams.usda.gov/rules-regulations/uswa/agreements. A prerequisite to obtain this license is to have a working system that can transmit EWR data. The Contractor must demonstrate a working concept of their EWR system to AMS by following the guidance provided in the referenced AMS Agreements.

Provider agreement guidelines are covered through USDA AMS under https://www.ams.usda.gov/rules-regulations/usda/agreements. Agreements for this project include:

• WA-460, https://www.ams.usda.gov/sites/default/files/media/WA460Addendum.pdf

• WA-460-2, https://www.ams.usda.gov/sites/default/files/media/WA460_2FormandInstructions.pdf

• WA-460-2 Appendix 1, https://www.ams.usda.gov/sites/default/files/media/WA460_2AppendixI.pdf

• WA-460-9, https://www.ams.usda.gov/sites/default/files/media/WA460_9FormandInstructions.pdf

Key Deliverables

Item No. Deliverable Due

1. Kickoff Meeting Five (5) business days after award

2. Monthly Invoice NLT the 10th business day of each month https://www.ams.usda.gov/rules-regulations/uswa/agreements https://www.ams.usda.gov/rules-%20%20%20regulations/usda/agreements https://www.ams.usda.gov/rules-%20%20%20regulations/usda/agreements https://www.ams.usda.gov/sites/default/files/media/WA460Addendum.pdf https://www.ams.usda.gov/sites/default/files/media/WA460_2FormandInstructions.pdf https://www.ams.usda.gov/sites/default/files/media/WA460_2AppendixI.pdf https://www.ams.usda.gov/sites/default/files/media/WA460_9FormandInstructions.pdf

3. Task 1: Subscription Access

Timeframe for completion will be 3 months after initial start date

4. Task 2: Develop Implementation Plan

• Discussion for Phase 1

Implementation/Release

• Discussion for Phase 2

Implementation/Release

Full plan will be established within 30 calendar days after contract award

5. Task 3: Automation Implementation Plan

• EWRs for MAL commodities that are approved for Price Support benefit

• Phase 2 development and deployment will prioritize rice EWRs, followed by additional commodities

Conducted in phases associated with deliverables associated with phase 2. These reviews will occur once the review of the specific benchmark has been completed

6. Task 4: Deployment of Software and Data Service

Conducted in phases associated with deliverables associated with phase 2. These reviews will occur once the review of the specific benchmark has been completed

7. Monthly Reviews The Contractor will coordinate with Government personnel to conduct monthly reviews and prepare data for invoice generation.

8. Quality Control Updates As needed

9. Project Closeout and Lessons Learned Briefing 30 days prior to contract period of performance end date

Kickoff Meeting The Contractor shall participate and collaborate with the COR on an agenda for the Kickoff meeting. The Kick-Off meeting/Post-Award Conference will take place within 5 business days from award. The meeting can be in person, telephone or video by mutual agreement. The Contractor shall provide a draft agenda for the meeting to the COR/designee no later than two (2) business days before the scheduled meeting. The agenda shall provide for discussions of:

a. Contractor team overview

b. Meeting schedule

c. Project overview

d. Introduction of the government support team and government staff

e. Understanding of deliverables, specific tasks and subtasks

f. Project risks and expectations

g. Contract management, status report submission, communications, and invoicing

h. Onboarding

Scope The Contractor will develop a system in which warehouses can submit EWR data for a specified quantity for an approved MAL commodity. That EWR data will subsequently be digitally transferred to FSA/CCC upon request of the producer to take out a loan or receive another program benefit such as an LDP. EWR data will be available for commodities within scope of this project, with the capability to expand as industry demands.

The system will perform in one of two ways:

• Phase 1: Serve as a database in which an FSA employee can access/view EWR data:

o FSA employee will be able to:

Select receipt data and create a pdf, or other appropriate Excel type-file, that can be printed or downloaded for further processing

Mark CCC as the holder of the receipt

Manually release the receipt upon repayment or for correction processing

• Phase 2: Digitally submit data to the current FSA EWR system:

o FSA EWR system will provide receipt information to loan application and mark CCC as the holder o Once loan has been repaid, or in the need of a correction, FSA EWR system will release holdership and return receipt to appropriate warehouse for further processing

The Contractor’s system will allow a government user to create reports for all receipt information (see Exhibits of receipt details) and transactions and allow the FSA National Office to designate who has access to the system to view data. User access will be defined as follows:

• National Office Master Access – assign access to additional users, generate reports for data, generate reports for invoice review and processing

• National Office User- view all data, generate data reports

• State User- view and generate State/county specific reports

The system will be available for nationwide access during normal working hours. Help desk assistance must be available 8:30 AM to 5:00 PM ET time. Help desk assistance will be coordinated through the National Office.

Tasks Deliverables will include, but are not limited to:

Task 1: Subscription Access

After meeting the guidelines of the Provider Agreement from the USDA Agricultural Marketing Service (AMS), the Contractor shall do the following:

• Provide a subscription access to a secure repository or database where authorized National, county or State FSA Office employees can log in and:

o View EWR data assigned to their office:

Commodity specific information (standards as determined by commodity industry handbooks, receipt examples) Current EWR holder (e.g. producer of commodity) Loan status as applicable o Change holdership of the EWR once loan has been repaid

• Transmit EWR data to the applicable FSA system

• Provide a process to correct receipt data, as appropriate

• Provide activity reports on demand

• Update EWR fields as industry standards change (not limited to the following legislative changes, farm bill, etc. provider agreements)

• Allow National Office staff to approve or authorize system users provide more detail (and process to update) number of maximum users.

Projection of Transactions EWRs transactions may vary each crop year based on crop conditions.

Table of Charges/Transactions

Transaction name

Function/Explanation Action Charge to FSA

DPS Download EWR for Price Support

Change current holder to CCC and lock for Price Support activity

Yes

RPS Release EWR to new holder

Release receipt for repayment

No

UPS Reset EWR to pre-download status

Return receipt to previous holder and unlock from Price Support activity

Yes

ULD Reset EWR downloaded in error for LDP

Unlock from Price Support activity

No

RRI View EWR information View EWR data fields

No

IPS Transmit Price Support information

Transmit Price Support loan or LDP information to Provider

Yes

Invoicing Payment amounts for invoices will be calculated per transaction. A transaction consists of the transmittal of EWR data when transferred to FSA/CCC to issue a loan or LDP or transferred back to the warehouse from FSA/CCC in the case of a repayment. EWRs transmitted to FSA in error will not be included. Quarterly, the payment amount will be submitted to the provider from FSA for an invoice to be generated.

Invoices must be submitted electronically through the Invoice Processing Platform (IPP) system and in accordance with the payment clause(s) in the contract.

Invoice should include the following information per receipt:

• Receipt number

• Commodity and class/variety as applicable

• Crop year

• Assigned warehouse

• Current holder

• Quantity/weight

• Transaction/status

Task 2: Develop Implementation Plan

The Contractor will work with FSA to develop an implementation plan for the service. This plan will address how the Contractor will work with the Government personnel to ensure that software is in line with FPAC IT security standards. Additional meetings will be held to discuss technical management, training, and field rollout. The Contractor is responsible for obtaining warehouse customers. The high-level schedule for the implementation plan is as follows:

Discussion for Phase 1 Implementation/Release

• Training for National Office

• Development of guidance for field staff

• Granting access for field staff

• Issue resolution and Help Desk availability

Discussion for Phase 2 Implementation/Release

• Firewall Access

• Web-service and testing environments

• Commodity Schema 1, development, testing, and deployment

• Commodity Schema 2, development, testing, and deployment

• Commodity Schema 3, development, testing, and deployment

Review Benchmarks of Implementation Plan The Contractor will work with Government personnel to determine if benchmarks deliverables have been achieved.

This will be completed in phases. Benchmarks will be in line with the deliverable schedule listed in Section 3.2.

Successful achievement of benchmark will be determined by Government personnel by the accomplishment of associated task within the specified time frame.

Task 3: Automation Implementation Plan The Contractor will provide the following:

• a web-service for receipt transactions from authorized FSA applications including, but not limited to, CLPS, EWR, LDP, and COPS/ACRS,

• ability to manually edit receipt status and holder ID,

• testing environment(s) or a process to generate test warehouses and receipts,

• support receipt transmissions utilizing status codes and error messages,

• technical support staff to coordinate with FSA development for troubleshooting and enhancements, as needed.

Phase 2 Implementation/ Release Phase 2 will consist of automating EWRs for MAL commodities that are approved for Price Support benefit. Phase development and deployment will prioritize rice EWRs, followed by additional commodities. All EWR commodity development must not impact current peanut EWR functionality.

Estimated Costs

Project Size Range (hours) Definition

XS ≤ 100 Non-software changes S 101-450 Minor bugs, minor features, minor functionality

M 451-1500 Self-contained changes, minor workflow or algorithm changes L 1501-5000 Complex changes that include interactions with external systems

XL ≥ 5001

New functionality, new application, shared service which include multiple dependencies

Phase 2 will consist of multiple dependencies contingent on the Provider. If the selected Provider was previously authorized, development will be re-establishing Firewall permissions, assigning security certificates, and enabling rice EWRs (S). If the selected Provider is already active, development will focus on establishing rice and additional commodity EWRs, as prioritized (M). If the selected provider has never been authorized, development will require establishing Firewall permissions, assigning security certificates, and coordinating commodity schemas and receipt transactions as outlined below (L).

Task 4: Deployment of Software and Data Service The Contractor will coordinate with Government personnel to deploy EWR software and data service.

Timeframe to deploy will start within 3 months after contract is awarded and will occur in phases. Phase 1, the initial ability to access the Contractor system and view and generate EWR files, will be expected immediately.

The ability to transmit data to FSA EWR system will be deployed per the deliverable schedule.

Quality The Contractor shall develop a quality control plan (QCP) and maintain an effective quality control program to ensure services are performed in accordance with the performance standards contained in this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor's QCP is the means by which the Contractor assures work complies with the requirement of the contract. The finalized QCP will be accepted by the Government at the time of the award. The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the QCP during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the Government's review and approval. The Government may find the QCP "unacceptable" whenever the Contractor's procedures do not accomplish quality control objective(s). The Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found "unacceptable." The Government shall monitor the Contractor's performance under this contract in accordance with the Government's Quality Assurance Surveillance Plan (QASP).

Collaboration Environment The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

Knowledge Capture and Transition-Out Planning Support During the transition to the Government and/or a new contractor, the Contractor shall perform all necessary transition activities, including, but not limited to:

• Develop transition plan including transition approach, communication, and performance criteria

• Continue to provide full services to the Government,

• Participate, at the discretion of the COR, in meetings with the Government or new contractor to support a smooth transition and provide detailed information on services, deliverables, and supporting materials,

• Perform knowledge transfer to new personnel (contractor or Government) during the transition period,

• Complete any necessary documentation as requested by the program manager, COR, or other Government employee,

• Provide availability to answer any questions that arise, and,

• Provide information such as source materials, collaborative work products, Government feedback, and contract deliverables that should be available to the Government in the collaborative workspace established from contract's initiation. Should the contract be terminated prior to the completion of all deliverables, the Contractor shall work with the Government to ensure the Government retains access to this information within two weeks from the termination date.

Invoicing The Contractor shall submit monthly invoices electronically to the Invoice Processing Platform (IPP) system. The government will review the submitted invoices for accuracy and compliance before processing for payment.

Onboarding and Hosting FPAC provides centralized management of the personnel onboarding process for IT service requirements. The Government will provide a centralized point of contact to the Contractor for onboarding communication. The Contractor shall identify a vendor point of contact to serve as the Contractor's primary contact for all onboarding-related communication, submit onboarding requests, and track onboarding status and open tasks. The Contractor shall submit onboarding requests via the secure FPAC-designated tool, ensuring that all onboarding request submissions are complete, accurate, and comply with direction from the Government's onboarding point of contact. The Contractor shall complete all assigned onboarding tasks within three (3) business days. Failure to complete an onboarding task within the established timeline or to communicate a reason for the delay may result in cancellation of the onboarding request. The Contractor shall communicate withdrawal of an onboarding request within two (2) days of becoming aware of a staffing change.

Government Furnished Equipment The Government will provide the facilities, equipment, materials and services listed below without cost. The Government furnished property and services provided as part of this contract must be used only by the Contractor only to perform under the terms of this contract. No expectation of personal privacy or ownership using any USDA electronic information or communication equipment must be expected. All property at Government work sites, except for Contractor personal items will be assumed to be Government property unless an inventory of Contractor property is submitted and approved by the CO/COR. Contractor personal items do not include computers, external drives, software, printers, and/or other office equipment (e.g., chairs, desks, file cabinets). The Contractor must maintain an accurate inventory of Government furnished property.

International Travel & Government Furnished Equipment Government Furnished Equipment (GFE) may only be taken on international travel if the travel is contractually authorized and has prior approval by all required federal parties (e.g., contracting office, contracting officer's representative (COR), Federal project manager (PM), etc.). On the rare occasion GFE is approved for use during international travel, the Contractor(s) must follow all FPAC Policies and Standard Operating Procedures (SOP).

• GFE is property in the possession of, or directly acquired by, the Government and subsequently furnished to the contractor for performance of a contract. (FAR Part 45)

• In the context of GFE use, international travel is defined as travel outside the fifty (50) United States (U.S.)

and District of Columbia (DC).

• Travel to U.S. territories (e.g., Puerto Rico, U.S. Virgin Islands, Guam, etc.) is considered international travel.

• FPAC does not authorize GFE for personal international travel (e.g., vacation, family emergency, etc.)

• FPAC does not authorize GFE for non-governmental business international travel (e.g., business not in direct performance of the contract for which the GFE is provided).

4.0 Deliverable Schedule

Inspection and Delivery The progress of tasks 1-5, to include the implementation and automation of the EWR service, will be inspected by the Government Program Manager, Technical Point of Contact, Contracting Officer’s Representative (COR) or another Government employee throughout the contract’s performance period. Documents, and receipts that are developed and updated will not be deemed final until agreed upon based on the planned objectives determined by the government team and the vendor.

Delivery and Timing The Government team will work with the vendor to determine a deliverable schedule once the contract has been issued and a consensus is made between the two parties.

Late Delivery The Contractor shall notify the COR, or other authorized government representative as soon as it becomes apparent to the team that a scheduled deliverable will be late. The Contractor shall include in the notification the rationale for late delivery, the expected date for the delivery, and the project impact of the late delivery. Such notification in no way limits any Government contractual rights or remedies, including, but not limited to, termination.

5.0 Contractor’s Key Personnel

The Government has identified the following capabilities as critical to program delivery success. The Contractor shall provide these capabilities throughout the full period of performance of this contract.

The Contractor shall provide the necessary resources and infrastructure along with knowledge, skills, certifications and experience to manage, perform and administer the contract requirements.

The following positions and skill sets are considered key to the success of the engagement:

Role Purpose Contractor Point of Contact

The Contractor shall provide a liaison for contract administration

Hiring of Foreign Nationals The Contractor acknowledges that personnel must be either U.S. citizens or Lawful Permanent Residents, also known as “green card” holders, to access:

• USDA Mission Areas, Agencies and Staff Offices or controlled facilities; or

• Information Technology (IT) systems or security items or products.

• This includes Contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the

United States or its territories.

• The Contractor must identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award must be reported to the Contracting Officer (CO) or Contracting Officer's Representative (COR).

Personnel Retention and Recruitment If it should become necessary to substitute or replace personnel, the Contractor shall immediately notify the COR. The Contractor shall ensure continuity of operations during periods of personnel turnover and long-term absences. Long-term absences are considered those longer than one week in duration. The Contractor is responsible for providing a complete staffing list to the COR on a regular basis, at least monthly, as a contract deliverable.

6.0 Security Requirements

Information Security Incidents An Information Security Incident is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access of any Contractor or Government systems or information, including, but not limited to, Sensitive Information.

Information Security Incident Reporting Requirements All Information Security Incidents must be reported in accordance with the requirements below, even if it is believed the Incident may be limited, small, or insignificant.

• The Contractor must report all Information Security Incidents immediately, but not later than 30 minutes after becoming aware of the Incident.

• Copy the Contracting Officer Representative (COR) if possible, or if Contracting Officer Representative (COR) email is not immediately available; contact the Contracting Officer Representative (COR) immediately after reporting the incident.

• Do NOT include any Sensitive Information in the subject or body of any e-mail. To transmit Sensitive Information, use FIPS 140-2 compliant encryption methods to protect Sensitive Information in attachments to email. Passwords must not be communicated in the same email as the attachment.

Information Security Incident Response Requirements All determinations related to Information Security Incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) must be made by authorized USDA officials.

The Contractor must provide full access and cooperation for all activities (determined by the authorized Government official to be required) to ensure an effective Incident Response, including providing all requested images, log files, and event information to facilitate rapid resolution of Information Security Incidents.

Incident Response activities determined to be required may include but are not limited to: inspections, investigations, forensic reviews, data analyses & processing, and final determinations of responsibility for the Incident and/or liability for any additional Response activities.

USDA, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in Incident Response activities.

Information Types The term Information is synonymous with Data, regardless of format or medium. Personally Identifiable Information (PII) is a subset of Sensitive Information. Sensitive PII is a subset of PII, and therefore a subset of Sensitive Information. All requirements for Sensitive Information apply to PII and Sensitive PII. All requirements for PII apply to Sensitive PII.

Sensitive Information Sensitive Information is any information, which if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual, the Government, or the Government’s interests.

Sensitive Information is subject to stricter handling requirements because of the increased risk if the data is compromised. Some categories of Sensitive Information include Financial, Medical/Health, Legal, Strategic, Security, Intellectual Property & Business, Human Resources, Personally Identifiable Information (PII), and Sensitive PII. These categories of information require appropriate protection as stand-alone information and may require additional.

protection in aggregate.

Personally Identifiable Information (PII) PII, as defined in OMB Memorandum M-07-16, refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology.

Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important to recognize that non-PII can become PII whenever additional information [that is publicly available] — in any medium and from any source — is or can be combined to identify an individual. As an example, PII includes a name and an address because it uniquely identifies an individual but alone may not constitute Sensitive PII.

Sensitive PII Sensitive PII refers to information that can be used to target, harm, or coerce an individual or entity, assume or alter an individual’s or entity’s identity, or alter the outcome of an individual’s or entity’s activities. Sensitive PII requires stricter handling because of the increased risk to an individual or associates if the information is compromised. Some categories of Sensitive PII include stand-alone information, such as Social Security numbers (SSN) or biometric identifiers. Other information such as a financial account, date of birth, maiden names, citizenship status, or medical information, in conjunction with the identity of an individual (directly or indirectly inferred), is also considered Sensitive PII. In addition, the context of the information may determine whether it is sensitive, such as a list of employees with poor performance ratings or a list of employees who have filed a grievance or complaint.

Compliance with Security IT Policies Information systems and system services provided by the Contractor must comply with the current USDA IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories.

The Contractor is required to comply with current Federal regulations and guidance found in the Federal Information Security Modernization act of 2014 (FISMA); Privacy Act of 1974; E-Government Act of 2002, Section 208; National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and the 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch Management Technologies; Office of Management and Budget (OMB) memoranda; USDA Information Security Program policies and other relevant Federal laws and regulations with which USDA must comply.

House Resolution 83-15 “Consolidated and Further Continuing Appropriations Act, 2015” requires that USDA demonstrate each project/investment is “being managed in accordance with applicable lifecycle management policies and guidance.” This mandates that USDA development projects are required to follow the Agency’s System Development Lifecycle (SDLC). All projects listed in Farm Service Agency Farm Programs IT plan for expenditure can expect to be audited for compliance. Audits may occur at any time after the plan for expenditure is submitted to Congress.

The Contractor must protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational client software are exposed. If new vulnerabilities are identified after the acceptance of COTS software, the vendor shall review and remediate the vulnerabilities and present the results for Government approval within the timeframes documented in USDA IT security policies.

Security Assessment and Authorization This contract requires the Contractor to develop, deploy, and/or use information systems to access and/or store Government information, including Sensitive Information. The Contractor must cooperate and support the Government in the development of required documentation and artifacts.

All information systems that input, store, process, and/or output Government information must be provided an Authority to Operate (ATO) signed by the authorizing official as identified by the CIO. The Contractor must adhere to current policies, procedures, and guidance for security Assessment and Authorization (A&A) activities.

Federal Reporting Requirements

Contractors operating information systems must comply with Federal Information Security Modernization Act (FISMA) reporting requirements. Annual and quarterly data collection will be coordinated by the Government.

Contractors must provide the Government with the requested information based on the timeframes provided with each request. Reporting requirements are determined by the Office of Management and Budget (OMB) and may change each reporting period. The Contractor must provide the Government with all information to fully satisfy FISMA reporting requirements for Contractor systems.

Acquiring And/or Implementing Software Applications Secure Coding Skills: Contractor must certify that at least one member of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic) to be delivered to the Govt. has earned the Global Information Assurance Certification for Secured Software Programming or equivalent.

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

Source code testing, binary code testing, application scanning, and penetration testing: At least one (1) week prior to delivery of any code due under this contract, Contractor must deliver to the COR the following reports covering all code that will be delivered:

• Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor must highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

• For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor must highlight all vulnerabilities rated “critical” and “high.”

• For all applications: application penetration results.

Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered.

Processing, Storing, Transmitting Government Data to Non-Government System The Contractor or other external organizations must develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by the Government with significant replacement cost should the Contractor’s and other external organization’s copy be corrupted. This plan must describe the processes and procedures that must be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan must describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan must be compliant with applicable Federal laws that include, but are not limited to: (e.g., the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan must meet IT security requirements in accordance with Government policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

The Contractor and other external organizations must ensure that the appropriate security banners are displayed on all Government systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

Personnel Security Background Investigation Requirements: Contractor personnel must be able to obtain a favorable suitability decision in accordance with 5 CFR part 731.

The duties of this contract range from low risk to high-risk positions and, as such, Contractor personnel will be required to submit all required documentation necessary for the agency to provide a favorable preliminary decision on suitability.

This decision is required prior to commencing work on the contract.

Contractor personnel who receive an unfavorable suitability decision must be immediately removed from consideration for work on the contract.

The company is accountable for selecting personnel capable of receiving favorable suitability determinations;

consequences for advancing personnel not able to pass government background checks may include providing invoice credits effectively reimbursing the government for background check expenses. Performance delays or detrimental project outcomes due to not onboarding or removal of staff will be directly attributable to the vendor and documented.

HSPD-12 -Credentials Contractor personnel must complete necessary requirements to obtain HSPD-12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD-12 credentials is grounds for removal/suspension of Contractor personnel from the contract.

Mandatory Government Training The Contractor must ensure their employees (including subcontractor personnel) complete the training course(s) listed below in the frequency identified. The Contractor must maintain records of course completion and provide them to the

Contracting Officer or Contracting Officer Representative upon request. Additional training courses may be added as determined by Department policies and program offices.

Course Name Frequency: (Once, Quarterly, Annually, etc.

Method of Training Length of Training Completion Date

Information Security Awareness

Annually AgLearn 60 minutes 1 year since last completion date

USDA Records Management

Annually AgLearn Or Paper-based

60 minutes 60 days after assignment

Section 508 Annually AgLearn 60 minutes 45 days after assignment

7.0 Data Rights

Data Collected, Generated or Managed The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

8.0 Standard USDA IT Contract Requirements for Internet Protocol Version 6 (IPv6) Compliance with Internet Protocol Version 6 (IPV6) in Acquiring Information Technology Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products. Specifically, any new IP product or system developed, acquired or produced must:

• Interoperate with both IPv6 and IPv4 systems and products.

• Have available Contractor/vendor IPv6 technical support for development and implementation and fielded product management.

• As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

• The Contractor shall provide technical support for both IPv4 and IPv6.

• Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

• Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or…