B09_SA_-_Amend_0002_-_Att_1_SOW_(Final)(20230311)_0002.pdf

140D0424R0004 Amendment 0002 i

Attachment 1:

United States Department of the Interior Office of Law Enforcement & Security

Technology Division

Law Enforcement Records Management System Statement of Work Ver 2.0

March 11, 2024 i

CONTENTS

1. GENERAL INFORMATION

1.1 Purpose

1.2 DOI’s Current Solution

2. DEFINITIONS

2.1 Contracting Officer (CO)

2.2 Contracting Officer’s Representative (COR)

2.3 Defective Service

2.4 Performance Requirements Summary (PRS)

2.5 Quality Assurance

2.6 Quality Control

3. GENERAL CONTRACT REQUIREMENTS

3.1 Program Manager

3.2 Contractor Personnel Identification

3.3 Contractor Work Force Responsibility

3.4 Transfer and Exchange of Contractor Personnel

3.5 Quality Control Plan

3.6 Quality Assurance

3.7 Performance Evaluation Meetings

3.8 Other Meetings

3.9 Monthly Progress Reports

3.10 Invoices

3.11 Government Point of Contact for Quality Assurance

3.12 Hours of Operation, Holidays, and Closures

3.13 Weapons, Firearms, and Ammunition

3.14 Government Furnished Equipment

3.15 Security

3.16 Privacy Act

3.17 Section 508 Compliance Requirements

3.18 Government-Contractor Relations (Non-Personal Services)

3.19 Inherently Governmental Functions

3.20 Confidential Information

3.21 Travel

4. TASK AREAS

4.1 Task Area 1: Implementation, Installation, Transition of Old Database Records

4.2 Task Area 2: Hosting with Application and Data Management Services

4.3 Task Area 3: Helpdesk Support Services

4.4 Task Area 4: Training

ii

4.5 Task Area 5: Additional Functionality and Customizations

4.6 Task Area 5: Phase Out Transition for LE-RMS

5. SYSTEM REQUIREMENTS

5.1 Case Management

5.2 Jail Management

5.3 Disconnected Mode

5.4 Electronic Ticketing (eTicketing)

5.5 Master Indices

5.6 Calls for Service (Computer Aided Dispatch)

5.7 Incident Reporting:

5.8 Activity Tracking

5.9 Property and Evidence Management

5.10 Warrant

5.11 Arrest

5.12 Booking

5.13 Juvenile Contact

5.14 Serious Incident Reporting (SIR)

5.15 Crash Reporting

5.15 Citation

5.16 Field Contact

5.17 Civil Process

5.18 Permits and Licenses

5.19 USFWS Specific Requirements

5.20 Internal Affairs

5.21 Analytical Support

5.22 Connection to Body Worn Camera

5.23 LE RMS Reports

5.24 LE RMS System Administration

5.25 Geographic Location File (Geofile)

5.26Personal Identity Verification (PIV) credentials

5.27 LE RMS Interfaces

5.28 Suspicious Activity Report (SAR) Exchange

5.29 Use of Force

5.30 Importing\Exporting information

5.31 Criminal Justice Information Services (CJIS) Compliant

6. DELIVERABLES

7. TASK ORDER ORDERING & AWARD

APPENDIX A: SAMPLE LAW ENFORCEMENT WORKLOW

APPENDIX B: GLOSSARY OF ABBREVIATIONS AND ACRONYMS

APPENDIX C: E-TICKETING MOBILE SOLUTION DESIGN

iii

APPENDIX D: LABOR CATEGORIES

APPENDIX E: SECTION 508 REQUIREMENTS

LE RMS

Statement of Work

1. GENERAL INFORMATION

1.1 Purpose

The Department of the Interior’s (DOI) Office of Law Enforcement Services (OLES) requires the implementation, installation, transition of old database records to the new system, hosting with application and data management services, helpdesk support services, training, and other as needed support services such as added functionality and customizations for a new Law Enforcement Records Management System (LE RMS). The maximum value for all orders issued against the single-award Indefinite-Delivery Indefinite-Quantity (IDIQ) will not exceed $60 Million, and it will have an ordering period of ten years. There is no limit on the number of orders that may be issued against the IDIQ. Task Orders will be issued as firm-fixed price.

This Commercially Available Off-The-Shelf (COTS) system will need to automate the functions performed by law enforcement officers and investigators and address the following high-profile concerns which are not currently being met by the Government’s current systems for DOI for all seven law enforcement Programs:

A comprehensive Office of Inspector General (OIG) report stated that individual bureaus were developing and managing their own records systems and that, “inconsistent and independent collection of data and reporting guidelines make any statistical analysis of DOI law enforcement programs extremely difficult in the best case, and impossible in the worst.”

An International Association of Chiefs of Police report on National Park Services’ (NPS) law enforcement, as well as several reports completed at the bureau level, identified the inability to collect good data as a major weakness.

Public Law 100-690 (Unified Crime Reporting Act of 1988) mandates that all government agencies with a law enforcement program participate in the National Incident-Based Reporting System (NIBRS) which provides the information to the Federal Bureau of Investigation. Neither system has the functionality to seamlessly gather and report the information. For example, assaults occurring on federal lands are not being reported to NIBRS. This involves 55 million acres of Tribal Lands. Additionally, the Department of Justice reports that Native American and Alaska Native women are 2.5 times as likely to experience violent crimes and at least 2 time more likely to experience rape or sexual assault crimes compared to other races.

DOI Strategic Plan calls for a more integrated and coordinated approach to collecting data, support by common programs and modernization blueprints. The current systems are unable to share information making it difficult to do joint bureau investigations and the duplicative systems resulted in both systems receiving a combined investment rating of RED from the Office of Chief Information Officer.

Incorporate modern Cybersecurity Requirements under Executive Order (E.O.) 14028 such as multi-factor authentication.

Store digital evidence (images, video, etc.) per E.O. 14074.

The current systems are not accessible in rural areas that do not have cellular or internet services.

Neither of these systems could easily be remedied to be in compliance with the above concerns.

Additionally, DOI OLES does not have the in-house resources to develop the to address these concerns. The new system will need to be flexible enough to adhere and implement solutions to be in compliance with current and future Federal Laws, Regulations, and Executive Orders that will impact the system.

The solution will be an automated system that will allow personnel within DOI to identify, collect, store, retrieve, analyze, manage, and report information related to incidents. As a result, the system will allow DOI and bureau personnel to create reports in various formats, sort data, conduct data analysis, and interface with other systems, both within DOI and outside of it. The system will give DOI an enhanced ability to:

Protect people Protect natural and cultural resources Protect wildlife Detect, deter, deny, respond, and investigate criminal activity Capture, integrate, and share law enforcement, suspicious activity reporting, and related information from other sources Identify needs (training, resources, etc.)

Measure performance of law enforcement programs and management of emergency incidents Meet reporting requirements Analyze and prioritize protection efforts Manage visitor use and protection programs

As the Government anticipates a COTS system, it is anticipated that the entire solution will require twelve months or less for installation, implementation, transition of and cleanup of old database records to the new system, testing of the new system, and training for law enforcement personnel. It must support industry standard Application Programing Interfaces (API), such that additional application features can be phased-in, as required. The solution can be integrated with other COTS products to meet the specific LE RMS requirements.

DOI is the nation’s largest landowner responsible for the day-to-day law enforcement and security of lands that it manages. The various bureaus that make up DOI have a responsibility to prevent, detect, and investigate criminal activity that occurs on DOI-managed lands. Bureaus must manage safety and protection for tribal communities, the millions of visitors each year that use these lands, as well as for the thousands of DOI employees that manage the resources. They must monitor visitor use, manage crowds, and traffic, and protect the natural and cultural resources. These wide-ranging responsibilities require the collection, analysis, management, and reporting of information related to law enforcement incidents.

DOI has a responsibility for managing various types of natural disasters and emergency incidents that occur on federal land, such as wildfires, floods, oil spills, and hurricanes. A complex system of people, equipment, logistics, and legal authorities may be required to respond to major events.

Homeland Security Presidential Directive 5 (HSPD-5) requires all Federal agencies to adopt the National Response Framework and use the National Incident Management System (NIMS) for incident management and emergency operations in support of prevention, preparedness, response, recovery, and mitigation programs (including assistance to states, tribal, and/or local entities). Compliance with certain aspects of NIMS includes adopting the basic tenets of the Incident Command System (ICS). The term “emergency management” in LE RMS refers to the larger scale activities and incidents that DOI undertakes utilizing the ICS process.

DOI also has a role in national security. Because DOI has many law enforcement and security roles at sites across the country, it is continually collecting information, in compliance with legislation, policy, and directives, on people and events. Both actions and observations, criminal and non-criminal, may have security implications, and these need to be recorded.

These nation-wide responsibilities mean that law enforcement, security, and emergency management information, are continually captured and used within DOI as part of their on-going business. Through the analysis of the information, valuable management lessons can be learned, patterns identified, and procedures and policies improved. The LE RMS will address these analytical needs. Finally, information collected by DOI needs to be shared among the bureaus, and with other federal agencies such as the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS).

DOI has law enforcement officers, corrections officers, and security response force personnel in seven separate and distinct organizational units within five DOI bureaus: the Bureau of Land Management (BLM), the Bureau of Indian Affairs (BIA), the Bureau of Reclamation (BOR), the U.S. Fish and Wildlife Service’s (FWS) Office of Law Enforcement (FWS-OLE), the FWS’s National Wildlife Refuge System (FWS-NWRS), and within the NPS the Law Enforcement, Security, and Emergency Services (LESES) and the U.S. Park Police (USPP). All of these units require a system of records to manage their mission and programs.

DOI recognizes that modern policing relies on and utilizes data and crime statistics for a variety of purposes. The ability to access and share information regarding incidents occurring on DOI public lands is vital to law enforcement officer safety and the security of areas enjoyed by the public.

The new system is required to support users throughout the contiguous continental US, including Alaska and Hawaii, as well as various territories such as Puerto Rico, the Virgin Islands, American Samoa, and Guam. Its primary function is to manage information related to law enforcement, protection, and security incidents that occur across 424 NPS sites. These sites encompass a vast infrastructure comprising 13,351 buildings, 4,389 housing units, 8,000 miles of roads, 13,013 trails, and 1,804 bridges/tunnels. Annually, these sites attract a staggering 297 million visitors.

Additionally, the system must cater to the law enforcement needs of over 200 offices and jail units within the Bureau of Indian Affairs (BIA). The National Wildlife Refuge System (NWRS), with its 567 units spanning 95 million acres of land and 755 million acres of marine territory, also relies on this system. These units receive an estimated 65 million visitors each year.

Furthermore, the system should accommodate the needs of the Bureau of Land Management (BLM), which oversees over 262 million acres of land and welcomes approximately 60 million visitors annually. It must also account for the Bureau of Reclamation’s infrastructure inventory, which includes five National Critical Infrastructure (NCI) facilities, 471 dams and associated structures, and 58 hydroelectric power plants distributed across 17 Western states. The Reclamation projects collectively attract more than 90 million visitors every year.

1.2 DOI’s Current Solution

In 2010, the Incident Management, Analysis and Reporting System (IMARS) was selected as the DOI-wide central records system for bureau law enforcement personnel. IMARS is similar to systems utilized by police organizations across the United States. Additionally, it was meant to ensure that each bureau Law Enforcement (LE) program has the ability to share law enforcement information across DOI and allow the DOI to share LE data with external LE programs, systems (i.e., the FBI’s National Incident Based Reporting System), and partners that belong to the Federal Information Sharing Environment.

IMARS is now operational and allows the bureaus to readily share law enforcement information across DOI. IMARS also allows for better and more efficient reporting of crime statistics to the Federal Bureau of Investigation. To date, five of the seven DOI programs, including BLM, BIA, BOR, LESES, and USPP have retired their legacy systems and fully deployed and integrated IMARS into their law enforcement operations. In total, 3,700 of DOI’s 4,200 law enforcement officers and operations/support personnel currently use IMARS.

The FWS’s Office of Law Enforcement and the Division of Refuge Law Enforcement are the two programs still operating on a legacy system – the Law Enforcement Management Information System (LEMIS). Currently, the FWS does not have the same ability to share information with other DOI law enforcement programs on a real-time basis. In addition, FWS raised concerns about whether IMARS can fully meet its unique law enforcement needs. A specific issue, as it relates to combating wildlife trafficking, is that LEMIS is currently the operational platform to implement FWS’s interface with the U.S. Customs and Border Protection as part of the International Trade Data System.

2. DEFINITIONS

2.1 Contracting Officer (CO)

A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The term includes certain authorized representatives of the contracting officer acting within the limits of their authority as delegated by the contracting officer.

Only a warranted CO has the authority to issue modifications or otherwise change the terms and conditions of this IDIQ and its orders. If an individual other than the CO attempts to make changes to the terms and conditions of this IDIQ or its orders, you will not proceed with the change and will immediately notify the CO.

2.2 Contracting Officer’s Representative (COR)

A Federal employee delegated limited authority by a Contracting Officer to monitor and perform specific, enumerated contract management duties related to contract planning, contract administration, technical oversight, and closeout to ensure that the Contractor’s performance meets the standards set forth in the contract.

Upon award of an order, the CO for the Government will designate an authorized COR to supply the contractor with any appropriate Government furnished data and other necessary documents or equipment. Contract interpretation and associated guidance and direction from the Government will not be official unless specifically provided by the COR or the CO. The COR will seek timely progress of the work and its satisfactory completion.

2.3 Defective Service

A Service output that does not meet the standard of performance requirement specified in the contract for that service.

2.4 Performance Requirements Summary (PRS)

A listing of the service outputs under the contract that are to be evaluated by the COR on a regular basis, the surveillance methods to be used for these outputs, and the performance requirements of the listed outputs.

2.5 Quality Assurance

A planned and systemic pattern of all government actions necessary to provide confidence that adequate technical requirements are established; products and services conform to established technical requirements; and satisfactory performance is achieved. Quality assurance refers to actions by the government assurance functions for a contracted service.

2.6 Quality Control

Those actions taken by a Contractor to control the production of outputs to ensure that they conform to the contract requirements.

3. GENERAL CONTRACT REQUIREMENTS

3.1 Program Manager

3.1.1 The Contractor will provide a program manager who will be responsible for the performance of all work. The name of this person, and an alternate or alternates, who will act for the Contractor when the manager is absent, will be designated in writing to the contracting officer (CO).

3.1.2 The program manager or alternate will have full authority to act for the Contractor on all contract matters relating to daily operation of this contract.

3.1.3 The program manager or alternate will be available during normal duty hours within thirty

(30) minutes to meet by phone or at the facility with government personnel (designated by the CO) to discuss problem areas. After normal duty hours, the manager or alternate will be available within two (2) hours.

3.1.4 The program manager will provide an emergency phone/cell phone to the COR and CO.

3.1.5 The program manager and alternate or alternates will be able to read, write, speak, and understand English.

3.1.6 The program manager will be responsible for ensuring that all quality control objectives for the project are met; as well as being responsible for project management methodology;

facilitating meetings and providing meeting minutes; developing of deployment schedule;

coordination of resources (federal and contractor); development of risk mitigation plans.

3.2 Contractor Personnel Identification

3.2.1 The Contractor will, when communicating with outside parties, DOI personnel, and other DOI contractors, advise that they are Agency Contractors to ensure they are not mistaken as Government employees.

3.2.2 Contractor employees will identify themselves as an Agency Contractor in all documents (e.g., reports, correspondence, etc.) which the employees are listed as the Point of Contact.

Email messages from contractor employees will contain a signature block identifying the individual as a contractor employee with the firm’s name with a reference to being a DOI Agency Contractor.

3.2.3 The Contractor will display on their person an identification badge that clearly indicates that he/she is a DOI Contractor when on-site and when off-site if their “attendance” is related to providing services under this contract.

3.3 Contractor Work Force Responsibility

It will be the full responsibility of the Contractor to organize, furnish, maintain, supervise, and direct a workforce, which, within the limitations of the provisions of this IDIQ, is thoroughly capable of effectively performing the work set forth in this contract.

3.4 Transfer and Exchange of Contractor Personnel

Replacement of any of the proposed workforce will be with individuals with comparable experience and skills. Resumes of replacement personnel will be provided to the COR and CO for review in sufficient time to satisfactorily submit to and clear the pre-employment high risk background investigation process, which typically requires at least six (6) weeks from when the required information is supplied by the Contractor to the DOI Office of Security. Shorter periods of time may be permitted for positions that are not deemed “High Risk” or for which the CO sends approval in writing to the Contractor. From date of initial background check through receipt of a PIV Card, it typically takes an average of sixty (60) calendar days for the onboarding process.

3.5 Quality Control Plan

3.5.1 The contractor will develop and maintain an effective quality control program (QCP) to ensure all services are performed in accordance with this SOW and its orders along with an approved Program Management Plan (PMP). The contractor will develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s quality control program is how compliance with the requirement of the contract will be managed.

3.5.2 A quality control plan and PMP will be submitted to the CO and the COR for review and approval within thirty calendar (30) days of notice of award of the IDIQ. The CO will notify the Contractor of acceptance or required modifications to the plan within fourteen (14) days. The Contractor will make appropriate modifications and obtain acceptance of the plan within ten (10) days of receipt of comments. The QCP plan will include:

3.5.1.1 A description of the inspection system to cover all proposed services. The description will include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of the inspectors.

3.5.1.2 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

3.5.1.3 A description of the records to be kept to document inspections and corrective or preventive actions taken.

3.5.1.4 The records of inspections will be kept by the Contractor and made available to the CO, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims under this contract.

3.6 Quality Assurance

According to the FAR 52.212-4(a), the Government will evaluate the Contractor’s performance under this IDIQ. A Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP) will be provided with each Task Order. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the contract manager or representative at the site to initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgement that he or she has been made aware of the defective performance. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the CO as a result of surveillance will be in accordance with the terms of this IDIQ.

3.7 Performance Evaluation Meetings.

The CO may require the program manager to meet with the CO, COR, and other government personnel as deemed necessary. The contractor may request a meeting with the CO when he or she believes such a meeting is necessary. Written minutes of any such meeting will be prepared by the Contractor within two (2) calendar days of the meeting. The meeting minutes will provide a summarized transcripts from the meeting, participate list, discussion points, decisions, and any pertinent action items as a result of the meeting. The program manager, COR, and CO will sign those minutes. If either party does not concur with any portion of the minutes, such non-concurrence will be provided to the CO within seven (7) calendar days following receipt of the minutes.

3.8 Other Meetings

For all other meetings, the contractor will be responsible for providing, as needed, meeting materials and other administrative support. If meetings are necessary, they will be conducted primarily virtually or through teleconference or as agreed to by both the parties. If needed, some examples of potential meetings that could be required on a Task Order are as follows:

Kickoff Meeting When requested, the order will specify when this will occur. Typically, this is needed within thirty (30) days of award of the order. Details regarding preparation of the meeting will be provided on, as needed basis.

Monthly Project Status Reviews Meetings will discuss their monthly progress report and will occur approximately every thirty

(30) days after award of the order, or as agreed to by the parties. The Contractor is responsible for reporting the previous month’s activities (including any risks, issues, or concerns, and actual or recommended actions for their mitigation), and projected activities for the following month.

The Government will provide feedback regarding this progress and performance.

3.9 Monthly Progress Reports

With the monthly progress reports, the report will capture items such as, but not limited to, description of the issues, performance issues, usage metrics, system updates, system downtimes and associated causes, status of potential replacements of key personnel (if any), outstanding government issues/concerns/data requests, helpdesk reports with metrics, and document any outstanding issues from the Contractor.

The first report will include a detailed work outline of the project by reporting period to include updates on all outstanding tasks. This report will be submitted electronically in MS Word compatible to the COR via email. A separate Monthly Progress Report will be provided for each Task Order.

3.10 Invoices

3.10.1 The Contractor will prepare and submit to the COR with a copy to the CO all invoices with the accompanying monthly progress report. See Clauses on Submittal of Invoices for additional details.

3.10.2 One invoice may not be submitted for multiple Task Orders. A separate invoice(s) will be submitted for each Task Order.

3.10.3 Invoices will be submitted monthly, as agreed to with the COR, or as stated in a task order.

3.11 Government Point of Contact for Quality Assurance.

The COR is the Government’s Point of Contact. If a separate COR is designated on a Task Order, a separate letter will be provided to the Contractor indicating that individual’s authority.

3.12 Hours of Operation, Holidays, and Closures

3.12.1 The Government’s hours of operation are typically from 8:00 AM to 4:30 PM Eastern, Monday through Friday, except for legal holidays in regards to meeting with the COR. The Contractor’s system and helpdesk support must be available 24 hours a day, 7 days a week, 365 days a year once the system is deployed.

3.12.2 Official Federal Holidays

A list of official Federal Holidays are listed below:

New Year’s Day Martin Luther King, Jr.’s Birthday Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

Visit the official website for specific dates of these holidays at: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/ Additional days may be designated by Federal law, Executive Order, or Presidential Proclamation.

3.12.3 If the Government is shut down, information will be provided to the Contractor with appropriate instructions related to their performance during this time period. If necessary, a change order modification may be issued related to potential decreases in the effort from the Contractor.

3.13 Weapons, Firearms, and Ammunition

Contractor employees are prohibited from possessing weapons, firearms or ammunition, on themselves or within their contractor-owned vehicle or privately owned vehicle while on Government property.

3.14 Government Furnished Equipment

3.14.1 Equipment Inventory. An inventory of government-furnished equipment will be completed no later than ten (10) calendar days after the start of the period of performance of the Task Order if applicable. The Contractor and the COR or other government representative will jointly determine the working order and condition of all equipment and document their findings on the inventory. In the event of a disagreement between the Contractor and the government representative on the working order and condition of equipment, the disagreement will be treated as a dispute under 52.212-4(d) “Disputes.” These devices will be for official use only. The Contractor may be responsible to reimburse the Government for any unnecessary expenses for the abuse of this equipment.

3.14.2 Obtaining Replacement of Government-Furnished Equipment. The Contractor will submit requests for replacement of government-furnished equipment to the COR for processing. Such requests will specify the reason for the replacement request.

3.14.3 A list of the government-furnished equipment will be provided in each Task Order.

3.14.4 If the Government provides contractor space, it will be provided as non-dedicated temporary “hoteling” space as needed.

3.15 Security

3.15.1 Computers and Information Technology Systems.

3.15.1.1 For contractor employees which receive a PIV card, the investigative requirements are typically public trust or moderate in order to have access to DOI IT Systems and Network. The COR on the order will coordinate with the contractor regarding whether the work will necessitate public trust or moderate investigation.

3.15.1.2 Contractor personnel will have access to sensitive information and federal information technology systems. Contractor personnel must take due care in safeguarding information and the integrity of IT systems. Contractor personnel working on the DOI network must take and pass an online IT security awareness course. Access information to this website will be provided by the COR after award of the Task Order. Evidence of completion of the course will be provided to the COR within one (1) week after starting work.

3.15.2 Safeguarding the Network

3.15.2.1 The contractor and its subcontractors which are providing Information Technology (IT) services to the DOI agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the DOI network or operated by the Contractor and other external organizations for the DOI, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to DOI sensitive information that directly support the mission of the DOI. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by Office of Management and Budget (OMB) Circular A-130.

3.15.2.2 The contractor and its subcontractors will be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor will also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

3.15.2.3 The contractor and its subcontractors will not publish or disclose in any manner, without the DOI Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the DOI and any contractors and other external organizations will be entered into before DOI data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The contractor and other external organizations will agree to establish and follow security precautions considered by the DOI to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

The draft and final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of DOI information. Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

3.15.2.4 If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will Immediately report any suspected or confirmed loss of privacy data or other sensitive information, or any suspected computer security incidents to DOI Computer Incidents Response Center (CIRC) (doicirc@ios.doi.gov) and your Contract Office Representative (COR).

3.15.2.5 The Contractor will insert these clauses in all subcontracts when the subcontractor is required to have routine physical access to a Federally controlled facility and/or routine access to a Federally controlled information system. Failure to comply with said requirements will constitute cause for termination.

3.15.3 Acquiring External IT Services (Processing, Storing, or Transmitting DOI Data on Non-DOI Systems

3.15.3.1 The Contractor or other external organizations will develop, provide, implement, and maintain an IT System Security Plan for any system that includes acquisition, transmission or analysis of data owned by DOI with significant replacement cost will the Contractor’s and other external organization’s copy be corrupted. This plan will describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The plan will describe those parts of the contract to which this clause applies. The Contractor or other external organization’s IT System Security Plan will be compliant with applicable Federal laws that include, but are not limited to: (e.g., the Clinger- Cohen Act of 1996 and the Federal Information Security Management Act of 2002). The IT System Security Plan will meet IT security requirements in accordance with Federal and FS policies and procedures that include but are not limited to: National Institute of Standards and Technology (NIST) SP 800-53 Guidelines.

3.16.3.2 Security Banners.

The Contractor and other external organizations will ensure that the appropriate security banners are displayed on all DOI systems (both public and private) operated by the contractors and other external organizations prior to allowing anyone access to the system.

3.15.4 Non-US Citizens: Additionally, there are security concerns with access to the DOI network, DOI systems, and DOI facilities for any individual that does not possess a I-551 Permanent Resident Card (Green Card). Though an individual may have a right to work in the country, they may not meet this contract’s security requirements if they do not possess an I-551.

In order to avoid potential concerns, the contractor will consult the government regarding any non-us citizen that does not possess an I-551 before working on this contract in any capacity.

3.15.5 Acquiring and/or implementing Software Applications, when applicable At least one week prior to delivery of any code due under this contract, Contractor will deliver to the COR the following reports covering all code that will be delivered:

3.15.5.1. Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of DOI. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

3.15.5.2 For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of DOI. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

3.15.5.3 . For all applications: Release notes and updated user documentation.

3.16 Privacy Act

3.16.1 The contractor is responsible for complying with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

3.16.1.1 The systems of records; and

3.16.1.2 The design, development, or operation work that the contractor is to perform.

3.16.2 The contractor will include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

3.16.3 Include this requirement, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

3.16.4 Definitions of the clause:

3.16.4.1 “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

3.16.4.2 “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

3.16.4.3 “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

3.16.5 Security Banner.

The contractors and other external organizations will ensure that the following banner is displayed on all DOI systems that contain Privacy Act information operated by the contractors and other external organizations prior to allowing anyone access to the system:

“This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

3.17 Section 508 Compliance Requirements

See Appendix E for details.

3.18 Government-Contractor Relations (Non-Personal Services)

3.18.1 The Government and Contractor understand and agree that the services to be delivered under this IDIQ are non-personal services as defined in the Federal Acquisition Regulations Part

37.101. No employer-employee relationship exists or will exist under this IDIQ between the Government and the Contractor’s personnel.

3.18.2 Contractor personnel under this IDIQ must not be placed in a position where they are under relatively continuous supervision and control of a government employee.

3.18.3 Employee relationship. The rules, regulations, directives, and requirements that are issued by DOI under its responsibility for good order, administration, and security are applicable to all personal who enter the Government installation or who travel using Government transportation.

This is not to be construed or interpreted to establish any degree or Government control that is inconsistent with a non-personal services contract.

3.18.4 Inapplicability of employee benefits. This IDIQ does not create an employer-employee relationship. Accordingly, entitlements and benefits applicable to such relationships do not apply.

3.18.5 Notice. The Contractor must notify the CO in writing promptly, within three (3) calendar days from the date of any incident that the Contractor considers to constitute a violation of this requirement. The notice should include the date, nature and circumstance of the conduct; the name function and activity of each Government employee, or Contractor official or employee, involved or knowledgeable about such conduct; identify any documents or substance of any oral communication involved in the conduct; and the estimate in time by which the Government will respond to the notice to minimize cost, delay, or disruption of performance.

3.19 Inherently Governmental Functions

The contractor must not perform any functions that are considered Inherently Governmental Functions (see FAR 7.503). If at any time the services being provided appear to be inherently governmental in nature, the contractor will contact the CO and COR regarding the work so that appropriate decisions can be made in how to resolve the problem. Within 21 calendar days of award of the task order, the contractor will ensure the staff has been informed about inherently governmental functions. Some examples on inherently functions are the following:

3.19.1 The direct conduct of criminal investigations.

3.19.2 The determination of agency policy, such as determining the content and application of regulations, among other things.

3.19.2 The determination of Federal program priorities for budget requests

3.19.3 The direction and control of Federal employees

3.19.4 The selection or non-selection of individual Federal Government employment, including the interviewing of individual for employment.

3.19.5 The approval of position description and performance standards for Federal employees.

3.19.6 The determination of what Government property is to be disposed of and on what terms.

3.19.7 In Federal Procurement activities with respect to prime contractor (1) Determining what supplies or services are to be acquired by government; (2) Participating as a voting member on any source selection board; (3) Approving any contractual documents defining requirements, incentive plans, and evaluation criteria; awarding contracts; administrating contracts (including change ordering changes in contract performance or contract quantities; taking action based on the evaluation of contractor performance, and accepting or rejecting contractor productions or services); (4) Terminating contracts; (5) Determining whether contract cost are reasonable, allocable, and allowable; and (6) Participating as a voting member on performance evaluation boards.

3.19.8 The approval of agency responses to Freedom of Information Act (FOIA) requests and the approval of agency responses to administrative appeals of denials of FOIA request.

3.19.9 The determination of budget policy, guidance, strategy.

3.19.10 The drafting of Congressional testimony, responses to Congressional correspondence, or agency responses to audit reports from the Inspector General, the Government Accountability Office, or other Federal Audit entity.

3.20 Confidential Information

3.20.1 The term “information”, as defined herein, includes, but is not limited to, oral or written communication, planning documents, strategy, research documents, data, conclusions, field notes, computer files, designs, equipment, photographic or video media, or conversations related to any work performed for DOI. The term “information” also includes internal Government memoranda, draft and final documents, procurement sensitive information including information on other contractors, cost or pricing information, financial information, as well as information marked “Confidential Business Information” or information not specifically marked, but falling within the meaning of “Confidential Business Information,” and “Attorney-Client Work Products.”

3.20.2 Any information viewed, received, obtained, developed or generated pursuant to the work assigned or work performed with DOI is sensitive and may be used as a basis for identifying and evaluating policy options, planning future budget and work priorities, or ongoing or future litigation. Some information may carry additional sensitivities and restrictions relative to use or disclosure including “Confidential Business Information” and “Proprietary Information.”

3.20.3 The Contractor must keep any such information confidential and to otherwise use discretion and exercise reasonable care and caution to prevent the potential compromise of any restrictive markings or ongoing or future plans or litigation. The Contractor must not use, make reference to or reveal to any person or entity not working under the direction of DOI, any information, whether that information is provided to the Contractor by DOI, provided to the Contractor by another party at DOI direction, or developed or generated by the Contractor pursuant to a work assignment, without the prior written approval of the CO or COR.

3.20.4 After 90 calendar days of completion the Task Order, the Contractor must deliver to DOI any original or copied information furnished by DOI or from another party, (at DOI’s direction) and any information developed or generated under this Task Order.

3.21 Travel

3.21.1 For firm-fixed price orders where travel has been negotiated and agreed to by the parties, no travel estimates are required for submission before travel to the COR.

3.21.2 For those orders where travel cannot be negotiated as part of the award, the Government will establish a reimbursable line item for travel. In order to receive payment, all travel estimates will be approved by the COR at least fourteen (14) calendar days prior to anticipated travel.

3.21.3 The Contractor will provide actual incurred travel expenses for reimbursement. At a minimum, any bill over $75.00 will accompany the invoice for trips under section 3.21.2 above.

3.21.4 The travel expenses will be computed at the per diem rate(s) provided in the Federal Travel Regulations (FTR) in effect at the time of the Award of that requirement (e.g. Task Order, Change Order Modification). When evaluating proposed costs of travel, the Government will make the following assumptions:

3.21.4.1 Travel with a privately owned vehicle will in accordance with the FTR.

3.21.4.2 No per diem (including meals) will be paid when the official travel is 12 hours or less, within the continental United States.

3.21.4.3 Commercial Airline tickets purchased will be:

3.21.4.3.1 Lowest non-penalty coach fare available which satisfies the schedule (except for immediate departure) or

3.21.4.3.2 Reserved/purchases as far in advance as possible to make maximum use of discounts.

3.21.4.3.3 Airport parking for one (1) night or more will be paid for at the long-term parking rate.

3.21.4.4 Rental vehicles are authorized as follows:

3.21.4.4.1 For 3 or less people – not to exceed the cost of the least expensive compact size; or

3.21.4.4.2 For 4 or 5 people – not to exceed the cost of the least expensive mid-size car/station wagon; and van.

3.21.4.4.3 For 6 or more people, or for carrying equipment, samples, or other materials – the least expensive of a van, or combination of station wagon, compact and van.

3.21.4.5 Per Diem expenses for the day of departure and last day of travel are at 75% of the applicable Meal and Incidental Expense rate.

3.21.5 The Federal Travel Regulations are located at: http://www.gsa.gov/portal/content/104790 (See Chapter 301)

3.21.6 When submitting a proposal for a call order that involves travel or submitting a travel estimate, the Contractor will provide the information below:

3.21.6.1 Purpose of the Travel;

3.21.6.2 Tentative Travel Dates;

3.21.6.3 Method of Travel (e.g. Private vehicle, airplane, etc.), cost for that method, and baggage expense, if applicable;

3.21.6.4 Duration of Travel;

3.21.6.5 Departure Location and Arrival Location;

3.21.6.6 Number of people on Travel:

3.21.6.7 Per diem expenses per day;

3.21.6.8 Lodging Expenses per day, if applicable;

3.21.6.9 Lodging Taxes per day, if applicable;

3.21.6.10 Distance from Office or Home to Airport or Other Transportation Facility, if applicable;

3.21.6.11 Parking costs per day at…