12SAD123R0003 CyberSecurity_CombineSynopsisSolicitation_Final_7.31.23.pdf

INTRO PAGE(S) FOR COMBINED SYNOPSIS/SOLICITATION

Document Type: Combined Synopsis/Solicitation Solicitation Number: 12SAD123R0001 Title: Professional Services Supporting Cybersecurity, Compliance, Quality

Assurance and Surge Support for Modernization Efforts Classification Code: D310, IT and Telecom – D310 - Information Technology and Telecom –

Cybersecurity and Data Backup

Contrac�ng Office Address

USDA – Rural Development Business Center 1400 Independence Ave, SW

DC 20250

i. This is a combined synopsis/solicita�on for commercial products or commercial services prepared in accordance with the format in subpart 12.6, as supplemented with addi�onal informa�on included in this no�ce. This announcement cons�tutes the only solicita�on; proposals are being requested and a writen solicita�on will not be issued.

ii. The solicita�on number is 12SAD123R0001 and solicita�on is being issued as a request for proposal (RFP).

iii. This solicita�on document incorporates those provisions and clauses in effect through

Federal Acquisi�on Circular (FAC) 2023-04.

iv. The associated North American Industry Classifica�on System (NAICS) code for this acquisi�on is 541511 – Custom Computer Programming Services; the applicable Small Business Size Standard is $30 million. This requirement is solicited as full and open a�er exclusion of sources; this is 100% set-aside for SBA Cer�fied 8(a).

v. Requirement and Background: The United States Department of Agriculture (USDA) Rural

Development (RD), Technology Office (TO) has a requirement for Professional Technology Services in On-Prem and Salesforce environment suppor�ng Cybersecurity, Compliance, Quality Assurance and Surge Support Services. Please review the Performance work Statement for a detailed descrip�on of requirements for the services to be acquired.

Contract Type: The Government an�cipates this solicita�on will result in a single award Firm Fixed Price (FFP) Indefinite Delivery Indefinite Quan�ty (IDIQ) contract to issue Task Orders as defined in the Performance Work Statement (PWS) Scope and iden�fied by Contract Line Item Number(s) (CLINS). A FFP Task Order (TO)1 will be awarded to the successful Offeror at the �me of award of the IDIQ contract. An�cipated Award date is TBD.

vi. Period(s) of Performance https://www.acquisition.gov/far/subpart-12.6#FAR_Subpart_12_6

The Period(s) of Performance for the IDIQ will be one base period of 12 months and three op�on periods of 12 months each.

Anticipated Period of Performance is as follows:

Base Period: 12 months Op�on Period 1: 12 months Op�on Period 2: 12 months Op�on Period 3: 12 months Op�onal CLIN -Transi�on Out Period - Es�mated to begin within 30 days prior to last exercised period of performance.

Place of delivery: Please see PWS.

vii. 52.212-1, Instruc�ons to Offerors-Commercial (March 2023), applies to this acquisi�on. The evalua�on procedures to be used are described in the PROPOSAL PREPARATION AND EVALUATION INFORMATION sec�on.

viii. Offerors are to include a completed copy of the provision at 52.212-3 (DEC 2022), Offeror Representa�ons and Cer�fica�ons-Commercial Items, with its offer.

ix. 52.212-4, Contract Terms and Condi�ons-Commercial Items (DEC 2022), applies to this acquisi�on.

x. 52.212-5, Contract Terms and Condi�ons Required To Implement Statutes or Execu�ve Orders-Commercial Items (DEC 2022), applies to this acquisi�on. Please see complete clause in clause sec�on within this pos�ng.

xi. Proposal’s are due: 08/30/2023, no later than 3:00pm, EST. Proposals are to be electronically submited to: Robert.cortez@usda.gov and aaron.street@usda.gov

xii. Contrac�ng Officer is Robert Cortez and can be reached at Robert.cortez@usda.gov mailto:Robert.cortez@usda.gov mailto:Robert.cortez@usda.gov

Performance Work Statement (PWS) Indefinite Delivery Indefinite Quantity(IDIQ)

Cybersecurity, Compliance, Quality Assurance Services and Surge Support Services for Modernization Efforts

As of 01/09/2023

I. DEFINITIONS/ACRONYMS:

• Assistant Chief Data Officer (ACDO) - The ACDO leads the RD Mission Area data strategy and governance activities, and provides leadership by establishing consistency and governance in managing data across RD so that data can be more easily used and shared within proper security parameters; oversees centralized analytics teams and provides analytics capacity to address cross-cutting questions or issues within RD; enables program areas to conduct program-specific analytics with common tools; and ensures RDs alignment with USDA data strategy.

• Assistant Chief Information Officer (ACIO) - RD’s ACIO coordinates with RD’s ACDO as counterparts in ensuring that the departmental vision is carried out at the Mission Area level and that business and technology requirements are met to support this vision.

• Assistant Chief Information Security Officer (ACISO) – RD’s ACISO oversees the implementation of computer system security plans with agency personnel and outside vendors.

Develops and implements agency policies for encryption of data transmissions and the erection of firewalls to conceal information as it is being transmitted and to eliminate tainted digital transfers.

• Indefinite Delivery Indefinite Quantity Contracting Officer (IDIQ CO) - The IDIQ CO is the final authority in all contractual matters relating to the IDIQ. The CO has overall responsibility for administration of the IDIQ and is authorized to act on behalf of the Government.

• Indefinite Delivery Indefinite Quantity Contracting Officer Contracting Officer's Authorized Representative (IDIQ COR) - The establishment letter of the IDIQ will indicate who has been designated as the IDIQ COR to assist the IDIQ CO in the discharge of contract administration responsibilities. Under this IDIQ, the basic responsibilities of the COR include acting as the Government representative for receiving and compiling monthly reports; and advising the IDIQ CO on utilization of the IDIQ. The IDIQ COR is not a Contracting Officer and is not authorized to modify the terms and conditions of a IDIQ.

• Task Order Contracting Officer (Task Order CO) - A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. A CO is the only individual who can legally bind the government. The Task Order CO will have final authority for individual awarded Task Orders. The Task Order CO may delegate certain responsibilities to the Task Order Contracting Officer Representative (Task Order COR) associated with the performance of individual Task Orders. The Task Order CORs name and contact information as well as delegated responsibilities will be provided to the contractor by the Task Order

CO.

• Task Order Contracting Officer's Representative (Task Order COR) - A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the Task Order, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract. The Task Order CO will provide the Vendor with information as to who has been designated as the Task Order COR to assist the Task Order CO in the discharge of contract administration responsibilities.

• Contracting Officer (CO) - A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. A CO is the only individual who can legally bind the government. The CO may delegate certain responsibilities to the Contracting Officer Representative (COR) associated with the performance of individual Task Orders. The CORs name and contact information as well as delegated responsibilities will be provided to the contractor by the CO.

• Contracting Officer's Representative (COR) - A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract. The CO will provide the contractor with information as to who has been designated as the COR to assist the CO in the discharge of contract administration responsibilities.

• Federal Data Strategy (FDS) -The mission of the Federal Data Strategy is to fully leverage the value of federal data for mission, service, and the public good by guiding the Federal Government in practicing ethical governance, conscious design, and a learning culture.

• Federal Enterprise Architecture Framework (FEAF) - A business-based framework that the Office of Management and Budget (OMB) developed for government-wide improvement in developing enterprise architectures (EAs) by providing a common framework to identify opportunities for simplifying processes and unifying work across the Federal Government.

• Federal information - As defined in OMB Circular A-130, “federal information” means information created, collected, processed, disseminated, or disposed of, by or for the Federal Government.

• FedRAMP - The Federal Risk and Authorization Management Program (FedRAMP) is a United States federal government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

• Federal Information Security Modernization Act (FISMA)- Amends FISMA 2002, by providing several modifications that modernize federal security practices to address evolving security concerns.

• IEEE 829-2008 – Institute of Electrical and Electronic Engineers 829 Standard for Software and System Test Documentation is a standard that specified the documents for use in software testing and system testing.

• Indefinite Delivery Indefinite Quantity (IDIQ) - defines an indefinite-quantity contract as a contract that provides for an indefinite quantity, within stated limits, of supplies or services to be furnished during a fixed period, with deliveries or performance to be scheduled by placing orders with the contractor (FAR 16.504).

• Information - As defined in OMB Circular A-130, the term “information” means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms.

• Information System Security Officer (ISSO) - Individual assigned responsibility for maintaining the appropriate operational security posture for an information system or program.

• Information System Security Program Manager (ISSPM) - Individual assigned responsibility for the cybersecurity of a program, organization, system, or enclave.

• Innovation Center (IC)- RD’s IC works to improve prosperity for rural communities through its three divisions: Strategic Engagement, Data Analytics, and Regulations Management.

• National Institute of Standards and Technology (NIST) - promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

• NIST 800-53 Revision 4-5 - NIST has released Special Publication (SP) 800-53 Assessing Security and Privacy Controls in Information Systems and Organizations.

• Open Data - For the purposes of this PWS, the term “open data” refers to publicly available data https://en.wikipedia.org/wiki/USFG https://en.wikipedia.org/wiki/USFG https://en.wikipedia.org/wiki/IT_security_assessment https://en.wikipedia.org/wiki/IT_security_assessment https://en.wikipedia.org/wiki/Cloud_computing structured in a way that enables the data to be fully discoverable and usable by end users.

• Operations & Maintenance (O&M) - O&M costs refers to the expenses required to operate and maintain an IT asset that is operating in a production environment. O&M costs include costs associated with operations, maintenance activities, and maintenance projects needed to sustain the IT asset at the current capability and performance levels.

• Personally Identifiable Information (PII) - As defined in OMB Memorandum M-07-1616, PII refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology.

Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified.

In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available (in any medium and from any source) that, when combined with other available information, could be used to identify an individual.

• Personal Identity Verification (PIV) card - A PIV card is known as a LINCPass at USDA. HSPD- 12 directs the implementation of a standardized badging process, which is designed to enhance security, reduce identity fraud, and protect the personal privacy of those (federal employees and contractors) issued Government identification.

• Plan of Action and Milestones (POA&M) Management - also referred to as a corrective action plan, is a tool that identifies tasks that need to be accomplished to remediate security vulnerabilities.

• Privacy Impact Analysis (PIA) - an analysis of how personally identifiable information (PII) is handled to ensure compliance with appropriate regulations, determine the privacy risks associated with information systems or activities, and evaluate ways to reduce the privacy risks. A PIA is both an analysis and a formal document detailing the process and the outcome of the analysis.

• Privacy Threshold Analysis (PTA) - a questionnaire used to determine if an information technology system contains Personally Identifiable Information (PII), whether a Privacy Impact Assessment (PIA) is required, whether a System of Records Notice (SORN) is required, and if any other privacy requirements apply to the system.

• Product Manager (PdM) - The designated USDA RD federal representative who has responsibility to plan and coordinate all primary and support activities to ensure all goals and objectives are met, with emphasis on project schedule and budget. In general, the PdM’s role will not be directly involved with day-to-day project management but will fill a role that is much broader in nature. The PdM is a person that views the project on a long-term basis and assumes a perspective that is management oriented. The PdM will be involved from start to finish, will be responsible for adherence to schedule, and will be responsible for coordination. The PdM, typically, supervises the RD Project Manager(s). Note, however, that Technical Directions/Instructions are to come from the Task Order COR.

• Project Managers (PM) - PMs are RD employees assigned to a specific project or projects as representatives of RD. The Project Manager is the person assigned by RD to lead the team that is responsible for achieving the project objectives. Note, however, that Technical Directions/Instructions are to come from the Task Order COR.

• Quality Assurance - The government shall evaluate the contractor’s performance under each Task Order in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

• Quality Control - The contractor shall develop and maintain an effective quality control plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is how it is assured that work complies with the requirement of the contract.

• Risk Management Framework (RMF) – guidance used by USDA to identify, eliminate, and minimize risks.

• Role-Based Access Control (RBAC) - a security approach that authorizes and restricts system access to users based on their role(s) within an organization.

• Rules of Engagement (ROE) – document the approvals, authorizations, and critical implementation issues necessary to execute the engagement. The ROE should be developed where vulnerability scanning, or penetration testing procedures are included in the assessment.

• Rural Business and Cooperative Service (RBCS) - An RD sub-agency that offers programs to help businesses grow as well as job training for people living in rural areas. Programs in RBCS provide capital and skills development to rural residents seeking to start or grow businesses or find jobs in agricultural markets.

• Rural Development (RD) - A USDA Mission Area committed to helping improve the economy and quality of life in rural America by offering loans, grants, and loan guarantees to help create jobs and support economic development and essential services such as housing; health care; first responder services and equipment; and water, electric and communications infrastructure.

• Rural Development Technology Office (RDTO) - Led by the RD Assistant Chief Information Officer, RDTO is responsible for developing, maintaining, and operating a portfolio of automated systems, and for providing technology-related services, in support of RD’s core businesses and back-office operations.

• Rural Housing Service (RHS) - An RD sub-agency that offers a variety of programs to build or improve housing and essential community facilities in rural areas, by offering loans, grants, and loan guarantees for single- and multi-family housing, childcare centers, fire and police stations, hospitals, libraries, nursing homes, schools, first responder vehicles and equipment, housing for farm laborers and much more.

• Rural Utilities Service (RUS) - An RD sub-agency that provides much-needed infrastructure or infrastructure improvements to rural communities. These include water and waste treatment, electric power, and telecommunications services. All these services help to expand economic opportunities and improve the quality of life for rural residents.

• Shall - the word “shall” is denoted to mean a mandatory duty or obligation.

• Security Assessment Plan (SAP)- the security assessment plan documents the controls and control enhancements to be assessed, based on the purpose of the assessment and the implemented controls identified and described in the system security plan. The security assessment plan defines the scope of the assessment, in particular indicating whether a complete or partial assessment will be performed and if the assessment is intended to support initial pre-authorization activities associated with a new or significantly changed system or ongoing assessment used for operational systems. The security assessment plan also describes the procedures to be used for each control—typically drawn from Special Publication 800-53A or from available assessment cases and tailored as necessary to satisfy organizational or system-specific requirements—including the selection of assessment methods and objects and assigned depth and coverage attributes.

• Security Assessment Report (SAR)- Provides a disciplined and structured approach for documenting the findings of the assessor and the recommendations for correcting any identified vulnerabilities in the security controls.

• Security Impact Assessment (SIA) - information provided by the project that allows cybersecurity to evaluate and determine whether updates are needed documentation for RD applications and evaluate any associated risks.

• Standard Operating Procedure (SOP) - are formal, written guidelines or instructions for incident response that typically have both operational and technical components. The resources provided in https://www.sciencedirect.com/topics/computer-science/coverage-attribute this section will guide you through how to build SOPs to help coordinate incident response.

• System of Records Notice (SORN) - a group of any records under the control of an agency from which information is retrieved by the name of the individual or by some identifying number, symbol or other identifying particular assigned to the individual.

• US Department of Agriculture (USDA) - USDA provides leadership on food, agriculture, natural resources, rural development, nutrition, and related issues based on public policy, the best available science, and effective management. USDA’s vision is to provide economic opportunity through innovation, helping rural America to thrive; to promote agriculture production that better nourishes Americans while also helping feed others throughout the world; and to preserve our Nation's natural resources through conservation, restored forests, improved watersheds, and healthy private working lands.

• Web Application Firewall (WAF) - provides centralized protection of your web applications from common exploits and vulnerabilities.

II. GENERAL REQUIREMENTS:

1. Introduction: As a critical component of United States Department of Agriculture (USDA), the Rural Development (RD) Mission Area is driven by a mission to stimulate, grow, and protect the American rural economy by providing loans, grants, and loan guarantees to individuals and commercial entities engaged in the betterment of rural life.

The USDA RD Assistant Chief Information Officer (ACIO) is responsible for developing, maintaining, and operating enterprise-level solutions in support of all RD business users. These include: Business Center (BC), Innovation Center (IC), Office of External Affairs (OEA), Civil Rights Office, Chief Risk Office, Rural Business and Cooperative Service (RBCS), Rural Housing Service (RHS), and Rural Utilities Service (RUS). These business areas function to support the delivery of RD loan, grant, and technical assistance programs to rural communities.

2. Background:

The objective of this performance work statement is to obtain contractor services to provide support services on behalf of the agency staff. The contractor shall provide non-personal services in On-Prem and Salesforce environment to manage the full range of IT cybersecurity, compliance, quality assurance, program management and surge support services necessary to implement the mission area strategic and operational program direction.

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

• Clinger-Cohen Act (also known as the “Information Technology Management Reform Act of 1996”) (40 U.S.C. § 11101-11704);

• E-Government Act of 2002 (44 U.S.C. Chapters 35 and 36);

• Federal Information Security Modernization Act of 2014 (44 U.S.C. Chapter 35, Subchapter

II);

• Federal Information Technology Acquisition Reform Act (FITARA) (Pub. L. 113-291);

• Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork Reduction Act of

1995 (44 U.S.C. Chapter 35);

• Privacy Act of 1974, as amended (5 U.S.C. § 552a);

• Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101);

• Electronic Signatures in Global and National Commerce Act (E-Sign) (15 U.S.C. Chapter 96);

• Government Paperwork Elimination Act of 1998 (44 U.S.C. § 3504);

• Government Performance and Results Act (GPRA) of 1993, as amended by the Government Performance and Results Modernization Act (GPRA Modernization Act) of 2010 (5 U.S.C. § 306 and 31 U.S.C. §§ 1115 et seq.);

• Office of Federal Procurement Policy Act (41 U.S.C. Chapter 7);

• Budget and Accounting Procedures Act of 1950, as amended (31 U.S.C. Chapter 11);

• Chief Financial Officers Act (31 U.S.C. § 3512 et seq.)

• USDA RD Resources, Directives, and Regulations: https://www.rd.usda.gov/resources

• USDA Departmental Regulations, Notices, Manuals, and Secretary Memoranda:

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

• USDA Digital Strategy: https://www.usda.gov/digital-strategy

• CIO.gov Policies and Priorities: https://www.cio.gov/policies-and-priorities/

3. Type of Contract

USDA Rural Development intends to establish a single award Firm Fixed Price Indefinite Delivery Indefinite Quantity (IDIQ). This contract does not obligate funds. The Government is only obligated to the extent of authorized orders placed against this contract.

The Government will issue task orders for services as defined in the PWS Scope and identified by CLINS. Subsequent orders are subject to FAR 52.232-18 Availability of Funds; FAR 52.232-19 Availability of Funds for the Next Fiscal Year.

• This IDIQ will not obligate any funds.

• The Government is obligated only to the extent of an authorized IDIQ Task Order is placed against the IDIQ by a warranted Contracting Officer.

• The IDIQ maximum if all options are exercised is $40,000,000. The IDIQ minimum is $10,000.

• A Task Order could be issued for the time length up to one year. Therefore, it is possible that a

Task Order could go 364 days past the end date of the IDIQ PoP.

• Task orders shall encompass one or more of the Contract Line Item Numbers (CLINs) using defined Focus Areas (FA).

Task Order information

• Task Order types allowed under this IDIQ will be Firm Fixed Price.

• All Task Orders are subject to the terms and conditions of the IDIQ.

• Task Order (s) will be issued when requirements are defined by an USDA RD ordering activity.

• Only a USDA RD CO is authorized to place a Task Order under this agreement.

• A payment schedule will be specified in each Task Order.

• Each Task Order shall specify its period of performance and award amount.

• Contractor shall complete an IDIQ STATUS REPORT for each Task Order.

• Contractor shall be provided up to 30 days to begin work on a Task Order after its issuance.

4. Non-personal and Not Inherently Governmental Services All services requested under this acquisition, PWS, and subsequent Task Orders are, or will be non-personal and not inherently governmental in nature.

5. Place(s) of Performance The Contactor may perform the requirements of this contract at the authorized Government work locations unless otherwise specifically stated in this PWS. The current work locations are:

https://www.rd.usda.gov/resources https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.usda.gov/digital-strategy https://www.cio.gov/policies-and-priorities/

i) USDA Rural Development 1400 Independence Ave SW Washington DC, 20250

ii) USDA Rural Development, One Metropolitan Square (OMS), 211 North Broadway, St. Louis, MO 63102

iii) Customer Site Location (remote/virtual)

Changes in Authorized Work Locations:

Work locations are subject to change when it is advantageous to the Government to eliminate or add a work location or change work locations to remote. Should a change occur, the contractor will be notified in writing by the Task Order CO.

Should the Contractor decide to relocate existing employees due to a change, employee relocation will be done at no cost to the government.

The Contractor may propose contractor work locations in addition to those identified in Places of Performance when it is advantageous to the government. This includes contractor employee telework locations during specified periods when the government facilities are closed due to weather and other emergency situations or when government facilities are unavailable due to other events making a government facility uninhabitable. The alternate work locations will be coordinated with the Task Order COR in advance and shall be at no additional cost to the government.

The Contractor shall ensure all government furnished equipment (GFE) assigned to individual employees are safely and securely operated and maintained regardless of the location where the work is performed.

Note: Currently all requirement tasks are being supported remote/virtually in support of efforts to combat COVID 19. USDA expects to have a mixed (virtual/in person) workforce, but largely does not expect any contractors to perform work onsite at government locations unless requested to attend in-person meeting, which would be infrequent. The government has limited space available to house Vendor’s workforce, for this acquisition efforts, in its new DC or MO locations.

6. Days and Hours of Performance

The Contractor is required to be available on non-government holidays from 9:00 am EST until 5:00 pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the Contracting Office, Contracting Officer’s Representative, and the Program/Technical Office. The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

Federal Holiday Schedule New Year’s Day Martin Luther King, Jr. Birthday Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day

Federal Holiday Schedule Veterans Day Thanksgiving Day Christmas Day

7. Period of Performance

This IDIQ will be effective from the date of establishment for a base period of one-year, with three one-year option periods unless an option is not exercised. Work on issued Task Orders may extend beyond 364 days of the effective period of this IDIQ. However, no new Task Orders may be issued once the IDIQ performance period has expired.

8. Kickoff Meeting At the Government’s request, the Contractor shall participate in the kickoff meeting when the contract is established. This meeting will be virtual to allow all stakeholders to attend.

The contractor shall provide and collaborate with the COR on an agenda for this meeting. Discussion topics shall include, but not be limited to: introduction of government and contractor and staff, government expectations, discussion of contract requirements, contract management expectations, schedule of deliverables and addressing contractor questions.

The Kick-Off meeting will take place within five (5) days from award and will be scheduled by the

COR.

9. Travel:

Travel will not be authorized under this acquisition.

10. Government Furnished Property, Equipment, or Services

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide transition support as defined in this Performance Work Statement (PWS) except for those items specified below as government furnished property and services:

• Laptops – receipt of government issued laptops are contingent upon Contractor employees receiving an USDA’s personal identity verification (PIV) card, which contains the necessary

PERFORMANCE PERIODS

Based Period Starting the date of the Award Period of Performance (PoP) for a duration of one year (12 months).

Option Period 1 POP 12-months past the end of the base contract PoP.

Option Period 2 POP 12-months past the end of option one contract PoP.

Option Period 3 POP 12-months past the end of option two contract PoP.

Optional CLIN 30-day Transition Out. Estimated to begin within 30 days prior to the end of the Option Period 3 PoP.

data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications.

• PIV Card – The COR will work with Contractor to obtain PIV cards for Contractor’s employees.

• Workspace and utilities shall be provided at USDA’s locations if applicable.

a) Not Applicable – work is anticipated to be completed at approved vendor location.

11. Identification of Contractor Employees

All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. When performing work outlined in this PWS while in USDA facilities or RDs sites, contractor is required to wear Federal government-issued personal identification card.

12. Non-Disclosure and Confidentiality The work to be performed under this acquisition and the data released to the Contractor’s personnel shall be treated as sensitive and confidential in nature and is not to be discussed with or released to anyone except USDA employees assigned to work with the contractor and other contractor personnel working on this acquisition. The Contractor is responsible for requiring all its employees working under this acquisition, who have access to privileged information, to sign the USDA Non-Disclosure Agreement, provided as an attachment to the solicitation and contract. USDA, as it deems appropriate, may require additional certifications be completed by the contractor at any time during acquisition performance.

The Contractor is required to develop and utilize procedures for custody, use/handling, reproduction, preservation, storage, safeguarding, and disposition of all documents and information of this nature so that there is no unauthorized disclosure of such documents and information throughout the course of performance. The Contractor shall be responsible for the security of all project documents provided to them for work under this acquisition. It is essential that this information be properly handled, stored, and protected from the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction. The Contractor shall protect and not disclose any Personally Identifiable Information (PII).

Contractor-generated preliminary and final deliverables, all associated working papers, and other material RD deems relevant in the performance of this acquisition are the property of the U.S.

Government and must be submitted to the CO by the conclusion of this acquisition and shall not be reproduced or retained by the Contractor. The Contractor shall not release any information without the written consent of the Contracting Officer.

When no longer required, this information, data, or equipment shall be returned to Government control; destroyed; or held until otherwise directed by the CO. Items returned to the Government shall be hand carried or emailed to the CO or other designee. The Contractor shall destroy unneeded items by burning, shredding or any other method that precludes the reconstruction of the material.

The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment.

Training. All Contractor employees assigned to this acquisition who create, work with, or otherwise handle records are required to take USDA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training. To the extent an agency requires contractors to complete records management training, the agency must provide the training to the contractor.

Proprietary Information If performance of any work under the IDIQs causes the Contractor to gain access to proprietary or confidential information of other firms/contractors, the Contractor is required to immediately execute Technology Exchange Agreements/Non-Disclosure Agreements with those firms/contractors, in order to protect the information from unauthorized use. The Contractor is required to refrain from using any such information for any purposes other than for which it was furnished. The Contractor must immediately provide the Task Order CO with a copy of any such agreements with original signatures affixed.

13. HSPD-12 Credentials Contractor personnel must complete necessary requirements to obtain HSPD‐12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD‐12 credentials is grounds for removal/suspension of contractor personnel from the contract.

https://www.dhs.gov/homeland-security-presidential-directive-12

14. Contractor Personnel Security Requirements

• Information Technology Systems Requirements:

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Modernization Act of 2014

(FISMA).

Pursuant to USDA policy, the Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally controlled information system, including a Rural Development- issued computer, completes Information Security Awareness Training (ISAT) prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed Information Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten calendar days of an individual starting work on this contract.

• Access Requirements

Contractor Access to USDA’s Network/Systems. The Contractor shall require access to the USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

https://www.dhs.gov/homeland-security-presidential-directive-12

• Information Assurance

The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available - in any medium and from any source that, when combined with other available information, could be used to identify an individual.

15. Onboarding Process

At the Task Order level, the Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide, to the COR, an Onboarding Status Report for any staff with outstanding onboarding requests. Additional information regarding the Onboarding process is addressed in the attachment

“PWS BACKGROUND INVESTIGATION REQUIREMENTS”.

Deliverable:

A. Onboarding Status Report – due weekly.

This report is to include all relevant details of the onboarding process, including but not limited to:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

16. Contractor Personnel Staffing and Assignments

(a) In the event that any of the key personnel named in the Contractor’s quotation, as accepted by the Government at award, are unable to perform because of death, illness, resignation from the Contractor’s employ, dissolution of agreement, or other reasons, the Contractor shall submit within 24 hours to the CO/COR, detailed written explanations of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any other information that the CO/COR deems pertinent to approve the substitution. No substitution is to be made without the prior written approval of the CO/COR. No increases in Task Order pricing will be allowed when substitutions are authorized by the Government.

(b) Personnel possessing unique technical specialties may be required for certain services related to the acquisition tasks. Such personnel shall have qualifications as required by the applicable tasks and approved by the CO/COR, which are appropriate to the nature of the services that will be provided.

(c) The CO will have the right to effect removals of any Contractor employees working under any Task Order at any time during the life of the contract, if those employees are deemed not to possess the proper level of competence or abilities, or otherwise found to be unsuitable for work required. In such cases, the Contractor must promptly submit the names and any other information pertinent to approvals of substitutions if requested.

(d) Failure or delays by the Contractor in providing qualified personnel who meet the stated requirements of this acquisition, may be deemed sufficient reason by the COR to recommend termination for cause to the CO.

The Contractor shall provide the CO with a primary and alternate administrative point of contact (POC) after award. One of these points of contact must be a Contract Executive. The Contractor shall notify USDA RD of any changes in contact information as expeditiously as possible.

17. Compliance with IT Security Policies:

• Information systems and system services provided to USDA by the Contractor must comply with the current USDA/ IT security and privacy policies, specifically the 3500 – 3599 Cyber Security Department regulations - https://www.usda.gov/directives/directives-categories.

• Contractors are also required to comply with current Federal regulations and guidance found in the:

o Federal Information Security Modernization Act of 2014 (FISMA);

o Privacy Act of 1974; E-Government Act of 2002, Section 208;

o National Institute of Standards and Technology (NIST) Federal Information

Processing Standards (FIPS) o 800-Series Special Publications (SP), specifically 800-40, Guide to Enterprise Patch

Management Technologies;

o Office of Management and Budget (OMB) memoranda;

o USDA Information Security Program policies;

o USDA SOP on POA&M Management (Link available on USDA network) https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53B.pdf o Control Baselines for Information Systems and Organizations

Assessing Security and Privacy Controls in Information Systems and Organizations https://csrc.nist.gov/publications/detail/sp/800-53A/rev-5/final o NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf o NIST SP 800-30, Revision 1, Guide for Conducting Risk Assessments https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final

SP 800-30 Rev. 1, Guide for Conducting Risk Assessments | CSRC o NIST SP 800-115, Technical Guide to Information Security Testing and Assessment https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf https://www.usda.gov/directives/directives-categories https://usdagcc.sharepoint.com/:b:/r/sites/isc/Home/SMD/RMF/Shared%20Documents/POAM/POA%26M%20Management%20SOP%20v1.0%2020210917.pdf?csf=1&web=1&e=9CorkW https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53B.pdf https://csrc.nist.gov/publications/detail/sp/800-53A/rev-5/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf o NIST SP 800-137A, Assessing Information Security Continuous Monitoring Programs: Developing an ISCM Program Assessment https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-137A.pdf o Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource Policies & Priorities https://www.cio.gov/policies-and-priorities/circular-a-130/

Describes Circular A-130, a general policy for information governance, acquisitions, records management, open data, workforce, security, and privacy.

o FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf o And other relevant Federal laws and regulations with which USDA must comply.

• USDA departmental regulation DR 3575-002, System, and Information Integrity (08/16/18), mandates that information technology development projects follow the Agency’s accepted development process. All projects with congressional visibility can expect to be audited for compliance. Other projects may be audited at Agency discretion. Audits may occur at any time.

• Contractors are required to protect information regarding security issues and associated documentation to limit the likelihood that vulnerabilities in operational software are exposed.

If new vulnerabilities are identified after the acceptance of COTS software, the Contractor must review and remediate the vulnerabilities and then present the results for Government approval within the timeframes documented in USDA IT security policies.

18. Special Considerations

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors. In addition, the Contractor may be required to meet and work with said other vendors regularly. However, it is expected that vendor collaboration working meetings would not be more frequent than twice a week at a duration of not more than 3 hours per meeting.

These meetings may be obligatory to address project issues/concerns/improvements, etc.

Collaboration working meetings are in addition to the meetings listed in the deliverables table.

At the CO’s direction, the Contractor may be required to provide PMO ad hoc status reports in addition to any status reports in the deliverable table. This authority shall not be delegated to any

COR.

Meetings: Please be advised that most acquisition meetings are held in Microsoft TEAMS. Meetings may be recorded for the contract file. The COR or CO is to set up meetings in TEAMS to facilitate meeting transcripts.

19. Organizational Conflict of Interest (OCI) Contractor and subcontractor personnel performing work under this acquisition may receive, have access to proprietary or information (e.g., cost/pricing, specifications, work statements, etc.) or https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-137A.pdf https://www.cio.gov/policies-and-priorities/circular-a-130/ https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf perform services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent acquisition requirements which may be affected by the OCI.

An example of preclusion of participation/bidding on a subsequent acquisition requirement may be the following scenario: Contractor One, per Contract One developed the architectural structure, strategic plan, etc. (aka PWS Tasks/Plan) for Requirement Two which will be competed in order to award Contract Two. Because Contractor One created/wrote the PWS Tasks/Plan, Contractor One will be precluded from bidding on Requirement Two solicitation. Preclusion in this instance helps to ensure best value for the government while keeping a fair and unbiased acquisition competition environment.

20. DATA RIGHTS. The Government has unlimited rights to all documents/material produced under

IDIQ and subsequent IDIQ Task Orders. All documents and materials produced under this acquisition shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer.