Social_Media_RFP_15F06720R0000063_Q_and_As.xlsx

XLSX spreadsheet 35 KB Posted Feb 20, 2020

Attached to: Request for Proposal - FBI Social Media Alerting
Solicitation number: 15F06720R0000063
Issued by: Department of Justice Federal Bureau of Investigation Redstone Arsenal Field Office

About this file

Written by GovTribe AI · Dec 28, 2023

This document contains questions and answers related to a Request for Proposal issued by the Federal Bureau of Investigation for a social media alerting service. The RFP seeks a commercial off-the-shelf social media alerting tool to provide early alerts on national security and public safety-related events through lawfully collected social media data from multiple platforms. The tool would enhance the FBI's awareness and response capabilities for a diverse range of threats. The anticipated period of performance is a base year plus four one-year options from April 2020 to April 2025. The RFP does not specify a preferred social media platform, instead seeking the most comprehensive and timely data available. The estimated number of users is between 1,000-2,000. The questions and answers provide clarification on requirements but do not specify pricing terms or the award process.

View the file

Other files

File	Type	Posted
Social_Media_RFP_Revision 3 - 20FEB2020.pdf	PDF	Feb 20, 2020
Attachment_No.1_-_SF33_Updated 20FEB2020.pdf	PDF	Feb 20, 2020
Attachment_No.1_-_SF33_Updated 19FEB2020.pdf	PDF	Feb 19, 2020
Social_Media_RFP_Revision 2 - 19FEB2020.pdf	PDF	Feb 19, 2020
Attachment_No.1_-_SF33_Updated 13FEB2020.pdf	PDF	Feb 13, 2020
Social_Media_RFP_Revision 1 - 13FEB2020.pdf	PDF	Feb 13, 2020
Social_Media_RFP_.pdf	PDF	Jan 28, 2020
Attachment_No.1_-_SF33.pdf	PDF	Jan 28, 2020
Attachment_No.2_-_SOW.pdf	PDF	Jan 28, 2020

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Q&As

RFP15F06720R0000063 Social Media Solicitation
#	Question	Government Response
1	Regarding "3.1.1.1 “Real time” is defined as No Later Than ( NLT) one minute before incidents are reported via applicable global media sources."

What does the government consider "global media sources"? And based upon that, how does the government determine MOEs based on accuracy and relevancy?

The RFT is for an alert capability. From a definition stand point, real time means “in real time”. The purpose of this RFP is to provide the FBI with notification so that first responders and law enforcement can respond as quickly as possible to potential chances that an accurate and appropriate response can be initiated. The intent would be to cover the largest geographical regions possible. Language algorithms should ensure the information provided has been translated correctly. While a margin of error (MOE) is likely, the vendor should ensure a comprehensive vetting process is maintained. The MOE should remain less than one percent.
2	Regarding "3.2.1. The tool shall provide alerting notifications from multiple existing social media platforms. The content of such notifications shall be derived only from publicly available, open source information." In order to provide a more accurate pricing model, can the government please be more specific regarding which social media platforms they would anticipate contractor to monitor?	There is not a specific site or sites. The development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
3	Please confirm that this RFP is considered a full and open competition opportunity and that anyone may offer a bid. And that there is no preferred or recommended bidders list.	This requirement will be competed as full and open, there is no “preferred or recommended” bidders list.
4	In the above referenced RFP, the following Department of Justice Acquisition Regulations: DJAR-PGD-05-08: Implementation of Homeland Security Presidential Directive (HSPD) I2 – Policy for a Common Identification Standard for Federal Employees and Contractor

DJAR-PGD-07-10: Ensuring New Acquisitions Include Common Security Configurations DJAR-PGD-07-12: Maintaining Contractor Performance During a Pandemic or Other Emergncy DJAR-PGD-08-04: Security Systems and Data, Including Personally Identifiable Information DJAR-PGD-08-05: Contractor Certification of Compliance with Federal Tax Requirements Can you please provide their full text?

See second Tab of this spreadsheet titled "DJAR Local Clauses"
5	How are these services currently performed (in house, contractor)? If by a contractor, please provide:

a. Contractor Name:

b. Contract #:

c. Task Order # (if applicable):

Contractor Name: Dataminr, Inc.

Contract #: DJF-17-1200-P-0002894 Task Order # (if applicable): N/A

6	If there is not an incumbent, what is the estimated dollar value range for this requirement?	There is an incumbent, the government has an Independent Government Cost Estimate, but proposals shall be provided independent from that information.
7	B.4 – Anticipated Period of Performance- Please confirm the CLIN start and end dates should read May 1 through April 30th.	Period of performance for each CLIN will be – May 1 through April 30th., following the years indicated in section B.4.
8	Contract Clauses - Can the government please provide the full text for the DJAR-PGD clauses (numbered 05-08, 07-10, 07-12, 08-04, and 08-05)?	Answered in Question #2.
9	Statement of Work- 3.1.9 – “All information provided to the FBI by the tool shall be legally obtained, and in accordance with law, regulation, policy, and applicable social media platform terms of service and privacy policies.” As the government may know, certain social media companies require that an Offeror’s Social Media Alerting solution using the social media company’s data must include specific product modifications and safeguards prior to that solution being sold to the government.	The successful bidder is responsible for ensuring their product meets the requirements for privacy and civil liberties compliance protections.
10	SF 1449 Document- Please confirm the SF 1449, cover page, table of contents and any representations and certifications are exempt from page count.	The page numbers should start after the table of contents.
11	SF 1449 Document- Please confirm an Offeror’s representations and certifications should only be filled out in SAM as detailed in the RFP, Section K.	Correct, current and accurate data must be registered in Sam.gov.
12	Section L, Format and Font Size – Are offerors bound to a minimum font size, and if so, can graphics and tables use smaller or larger font sizes?	All font size should be 12-point font.
13	Section L, Page Count – Confirm page count is final. Does specified RFP page counts include table of content and cover pages?	The page count is final and specifics to page numbering is answered in Question #10.
14	General – Is there currently an incumbent? If so, please provide vendors name and contract award number.	This is answered in Question #5.
15	Social Media Platforms – Are there specific social media platforms and/or data feeds the FBI is requesting?	There is not a specific site or sites. The development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
16	General – In the vast areas of the world where social media is not a relevant or primary source of communication will the FBI accept the use of other forms of alerting data?	The FBI does not want to identify the sources from which the data is provided. The vendor should delineate those selections and provide the most accurate and timely data possible.
17	Attachment 2 SOW page 2: “3.1.1.1 “Real time” is defined as No Later Than (NLT) one minute before incidents are reported via applicable global media sources. Not all incidents are reported first by social media. How is this to be measured? https://www.forbes.com/sites/kalevleetaru/2019/02/26/is-twitter-really-faster-than-thenews/#2ac948cf1cf7	The RFP is for an alert capability. From a definition stand point, real time means “in real time”. The purpose of this RFP is to provide the FBI with notification so that first responders and law enforcement can respond as quickly as possible to potential chances that an accurate and appropriate response can be initiated.
18	Attachment 2 SOW page 2: “3.1.3 Alerts provided shall be vetted by the contractor for accuracy and relevancy before they are provided to the end user.” is machine vetting acceptable for this requirement? What error rate is acceptable?	It is the responsibility of the vendor to determine their own internal vetting processes. While a margin of error (MOE) is likely, the vendor should ensure a comprehensive vetting process is maintained. The MOE should remain less than one percent.
19	Attachment 2 SOW page 3: “3.1.4 The tool must allow for review of notifications before such information can be saved to FBI systems.” How would notifications be saved to FBI systems? If the system sends an email, it needs to be received by FBI email before the notification can be reviewed.	The FBI is not seeking to save information from the notifications but rather use it to ensure timely response to incidents around the globe, of importance to the FBI. This feature should be similar to an RSS feed or other news altering capability.
20	Attachment 2 SOW page 3: 3.1.7 Under what circumstances would a tool automatically download to an FBI system of record?	The intent of this product is for the vendor to provide the FBI with advanced notification of incidents around the globe that may be of interest to the FBI. In many cases, our employees are mobile. Notifications should be easy to obtain and relay.
21	Attachment 2 SOW page 3: “3.1.8 The tool should not retain information, or if it does retain information, it must self-purge such information every 7-10 days.” What constitutes information in this context? May the tool retain publicly available information for all customers to allow for historical searches of data as described in 3.3.3.2 “The tool shall also permit the end user to seek relevant historical publicly available data from social media platforms for further analysis.”? If users define queries for which they wish to be alerted, is the maximum time those queries are allowed to be stored 10 days? Are user accounts to be deleted within 10 days?	The vendor has the discretion to determine what they wish to store on their own platforms. The FBI is looking for instant notifications. The information decreases in value as it ages; therefore, we are not looking for long term repositories of information, but rather quick, immediate updates on situations that are occurring in real time. The intent is not to delete user accounts but to not compile old notifications.
22	Does this solicitation create a follow-on contract related to DJF171200P0002894, or is it a new effort or program? If it is a new effort or program, how will it function or relate to contract DJF171200P0002894?	Contract DJF171200P0002894 is the current contract that is expiring. This RFP is for the re-compete of that effort.
23	What is the relationship between this solicitation and solicitation #DJF194750PR0000369?	The scope of work has been re-evaluated and more defined since that time. 15F06720R0000063 now replaces DJF-19-4750-PR-0000369.
24	Is there an incumbent(s) that provide the required capabilities? If there is an incumbent, how many users were stated as a requirement in the incumbent contract/SOW? How many users are currently using the solution?	The FBI does not comment on current capabilities.
25	Does this solicitation represent a consolidation effort on behalf of the government to procure a single tool to replace many? If so, how many tools is the single selected solution replacing?	Please refer to Section B.1 on page 4 of the RFP.
26	Will the government further define events/activities within the ”National Security” and “Public Safety” categories, or is the vendor expected to provide these sub categories of events/activities?	This RFP is for an alerting capability. Keywords should be derived by the successful bidder and determine the appropriate algorithms to provide the FBI with mission and national security relevant information.
27	Using the definition of accuracy in 3.1.3.1, it seems likely that no tool will be compliant as 100% accuracy using publicly available information is not achievable. Therefore, for SOW Section 3.1.3, would the government be open to modifying the definition of accuracy based on the successful contractor’s technical approach to mitigate inaccurate information prevalent in publicly available data? Would the government be open to adding accuracy as an evaluation criteria or adding a commercially reasonable efforts standard?	It is the responsibility of the vendor to determine their own internal vetting processes. While a margin of error (MOE) is likely, the vendor should ensure a comprehensive vetting process is maintained. The MOE should remain less than one percent.
28	With respect to Section 3.1.8 for self-purging information, is there a scenario whereby a user has flagged a particular alert and may require future access to that alert beyond a 7-10 day period?	No. Information decreases in value as it ages. The intent of this tool is for immediate updates and can be deleted after they are provided.
29	Section 3.3.3.1 – Can the government define the requested feature called “photographic tagging”?	Many social media platforms provide the ability to tag a photograph with a name or other descriptor. The government is simply referring to that functionality.
30	Section 3.3.3.2 – is the requirement for permitting end users to create filters for alerts specific to the user’s mission, akin to the user only receiving a subset of alerts in specific events/activities?	This RFP is for an alerting capability. Keywords should be derived by the successful bidder and determine the appropriate algorithms to provide the FBI with mission and national security relevant information.
31	Regarding Section 3.4 of the RFP, for users accessing the selected solution on a desktop computer, will users access the solution via the standard unclassified government network, or via some other means?	The end user will access the solution via the unclassified network as delineated in the RFP.
32	Section 3.5.2: What are the steps to completion, and the anticipated timeframe, associated with the FBI Security Risk Assessment?	The contractor will be expected to meet all of the security requirements outlined in the RFP. Please see Section 2 Background for the parameters of who will have access to the data.
33	Is a facility clearance required?	No
34	Does the successful bidder need to be a US company?	No. However the successful bidder must have all proper clearances.
35	Within Technical Factors, are all sub-factors equal in weight? If not, would the government provide the relative weighting between the Technical sub-factors?	While each evaluation factor is important, the alerting capability is the most significant. The subsequent factors decrease in importance in the order they are listed in the RFP.
36	Will a vendor’s compliance practices around social media terms and conditions, be a consideration in the governments evaluation of tools?	While each evaluation factor is important, the alerting capability is the most significant. The subsequent factors decrease in importance in the order they are listed in the RFP.
37	Will the Government consider a vendor’s ability to implement granular security controls to limit use of tool features based on a user’s role or other attributes, as well as the ability to audit end-user use of the tool to ensure end-users abide by the Government’s acceptable use standards?	While each evaluation factor is important, the alerting capability is the most significant. The subsequent factors decrease in importance in the order they are listed in the RFP.
38	With respect to Part IV instructions, will the government accept a PDF submission?	Yes. Adobe PDF is acceptable however all documents sumbitted must be searchable.
39	In acknowledgment of the requirement that the apparent awardee will be required to provide an oral presentation and demonstration of its tool which will be evaluated for compliance with the listed laws and standards, including the Privacy Act, 5 U.S.C. 552a, will the government consider its employees’ user accounts on the selected platform to meet the definition of a “system of records” under the Privacy Act? If so, can the government confirm that the requirements of 552a(m) would then apply to the apparent awardee?	It is the successful bidder’s responsibility to ensure they comply with all legal requirements. The FBI expects that all vendors will comply with all privacy and civil liberties statutes including but not limited to the Privacy Act, Title 5 of the U.S. Code, Section 552A, as well as any applicable rules, policies, and regulations set by the agency, government, and/or owner of the social media platforms.
40	The solicitation incorporates FAR 52.227-19, a non-mandatory clause that grants the Government greater rights in commercial computer software than normally would be granted in a commercial license. Because the granting of these additional rights in offerors’ commercial software likely will result in increased prices to the Government, and because it is likely that the Government’s needs can be fulfilled through a standard commercial license, please confirm the incorporation of FAR 52.227-19 is necessary here, or whether the government would consider removing?	FAR 52.227-19 has been removed from this solicitation.
41	The solicitation and accompanying SOW frequently reference social media and social media platforms. However, national security and public safety interest related content is found in many other locations of the internet that may not be referred to as “social media.” Would the offeror receive additional credit for providing the ability to receive publicly available information regardless of origin on the internet?	The FBI does not want to identify the sources from which the data is provided. The vendor should delineate those selections and provide the most accurate and timely data possible. While each evaluation factor is important, the alerting capability is the most significant. The subsequent factors decrease in importance in the order they are listed in the RFP.
42	Is the governments intent with the definition of “real time” to exclude potentially valuable content related to national security or public safety incidents from publicly available data sources that do not support high volume or frequency API connections, aren’t referred to as social media or don’t themselves update in real time?	There is not a specific site’s, the development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
43	Is this RFP related to FBI’s RFI request for Media Analytic Capability in April 2019 which came out of the FBI Office of Public Affairs?	No.All proposal submissions for should pertain to the requirements of this SOW ONLY.
44	Which social networks will be analyzed? (E.g. Facebook, Twitter, etc.)	There is not a specific site’s, the development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
45	Will any other data sources other than social media networks need to be analyzed?	There is not a specific site’s, the development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
46	Is the expectation that the FBI will enter into the required social media or other data source agreements required for analytics?	There is not a specific site’s, the development and design of the tool is the onus of the vendor. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes. Vendor’s are encouraged to provide the most comprehensive data sets available in order to provide first responders and law enforcement officials with timely, relevant and accurate notifications.
47	What is the expectation surrounding the requirement for historical publicly available data from social media platform? Is the requirement that the service provider be able to access and provider data beyond a certain time frame?	As defined in Section 3.3.3.2 Alerting, the SOW is requesting advanced modifications of mission-relevant incidents. Data should be provided quickly but then does not have to be stored or maintained for future purposes, as this tools is only meant to provide notifications.
48	What is the geographical scope of the analyses to be conducted (e.g. will only US social media accounts be assessed, or is the scope broader than the US)?	The intent would be t cover the largest geographical regions possible. Language algorithms should ensure the information provided has been translated correctly.
49	What are the expectations surrounding geo-tracking / geo-fencing? Is there an expectation that geolocation data will be provided?	Yes. The location of an incident is critical to identifying that a situation is occurring. The most comprehensive notification system would ideally identify where a disturbance, incident or other event of interest may be occurring at any given moment.
50	Will monitoring of individuals and identification of social media users be required?	No. At no time will this tool be used to identify private citizens. This tool is solely meant to be used as an advanced notification of events occurring.
51	What are the expectations surrounding the requirement that the contractor “vet accuracy and relevancy” before providing results to the end user? What will this “vetting” entail and how should this be conducted?	It is the responsibility of the vendor to determine their own internal vetting processes. While a margin of error (MOE) is likely, the vendor should ensure a comprehensive vetting process is maintained. The MOE should remain less than one percent.
52	What is the expectation surrounding "photographic tagging"? Will there be a requirement to tag specific locations, objects, individuals, etc.? Is there any expectation to provide facial recognition data?	Is there any expectation to provide facial recognition data? The purpose of this tool is to provide the most informative information surrounding an event that is unfolding. Phototagging is useful when trying to identify an area where an event may occur; however, it is not the only criteria that will be considered. The government is interested in the most comprehensive, yet accurate notifications of worldwide events.
53	With respect to the 2-hour cyber security breach notification requirement, how will a “breach” be defined?	The requirement to notify the FBI of any potential or actual computer security incident would apply to any party responsible for providing the requested services to the FBI, contractor or sub-contractor alike.
54	The requirement is to provided notification within 2-hours of “discovery”: how will “discovery” be defined (for e.g. after a conclusion has been drawn, or where there is a mere suspicion of a breach that has yet to be confirmed)?	All input and output of capability to ensure laws, policies, and regulations concerning any private information are followed. In the event that a breach should occur, the vendor must have security measures and protocols in place to follow through with properly informing the FBI, containing and mitigating the situation.
55	What will the FBI security risk assessment entail?	This is answered in Question #32.
56	What is the anticipated interplay between the requirement to "vet" and the requirement to provide "real time" alerts? If the required vetting delays an alert beyond the “real time” standard, how will this be handled?	The intent would be to cover the largest geographical regions possible. Language algorithms should ensure the information provided has been translated correctly. While a margin of error (MOE) is likely, the vendor should ensure a comprehensive vetting process is maintained. The MOE should remain less than one percent.
57	What are the “applicable global media sources” for purposes of establishing the real time standard?	The RFT is for an alert capability. From a definition stand point, real time means “in real time”. The purpose of this RFP is to provide the FBI with notification so that first responders and law enforcement can respond as quickly as possible to potential chances that an accurate and appropriate response can be initiated.
58	Will additional guidance be provided to the contractor about events considered to be “national security incidents,” which is a potentially subjective term?	This RFP is for an alerting capability. Keywords should be derived by the successful bidder and determine the appropriate algorithms to provide the FBI with mission and national security relevant information.
59	Is this effort being coordinated with the National Threat Operations Center? Is the NTOC a receiver of this information?	No. It is not. This information is requested for the FBI’s use.
60	Is this is a re-compete or a consolidation of tools? I was wondering how it might pertain to our current contract.	This is answered in Question #22.
61	Does this cover all platforms or only certain ones?	This RFP requests real time notifications of events that could be of importance to the FBI. The platforms used by the vendors are solely at their discretion. The FBI does not have a preferred platform; instead, we are most interested in the accuracy and comprehensive nature of the data provided.
62	What is the total number of users the FBI expects to deploy the solution to?	No. Usage is based on the number of individuals with that mission focus. While a specific number is not available and would vary based on licensure types and requirements, an estimated user population would be between 1,000-2,000 individual users.
63	Can you clarify/define “content” vs. “category” in the types of segments?	The government does not understand the question. The request is for notifications of events in near to real-time. The type of event can be described in a manner the vendor feels is appropriate. The government does not wish to categorize the events in a specific manner; however, they should be organized and easy to quickly search.
64	Do all the parts of the solution need to be from an American company or can you partner with others?	All offerors must be registered on Sam.Gov prior to the close date of solicitation to be eligible for award. The company have the appropriate clearance levels to bid on contracts of this nature.
65	What are the list of preferred social media sites you want monitored? Will it expand over time?	No, there currently is not a list of sources, sites or digital locations that must be included in the solution’s capability. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes.
66	What is the number of physical assets/locations you want tracked?	No, there currently is not a list of sources, sites or digital locations that must be included in the solution’s capability. The FBI’s requirement is not for one specific social media platform versus another, but rather for the most comprehensive, accurate and relevant information available for immediate alerting purposes.
67	Is the solution meant to be hosted on-premise where FBI stores all the data, or is the solution meant to be SaaS-based where the provider hosts the data?	Existing systems are not of relevance to this request. This product should be a standalone product that provides alerts
68	If SaaS-based and hosted by the provider, what is the estimated query limit per day?	The development of sourcing, and the resulting capability, is the responsibility of the vendor. It is the responsibility of the vendor to utilize metrics that conform with all relevant laws and statutes while providing an alerting capability. The FBI cannot provide specific attributions or non-attributions that the vendor should include in its query metrics for the vendor’s platform.
69	How many end users will be using the solution?	No. Usage is based on the number of individuals with that mission focus. While a specific number is not available and would vary based on licensure types and requirements, an estimated user population would be between 1,000-2,000 individual users.
70	Should the offeror’s firm-fixed price also include custom software develop for the COTS solution?	Please see the response to question 69. This request is for an alerting capability. The specific system development and functionality are the responsibility of the vendor.

DJAR Local Clauses

DJAR-PGD-08-04: Security of Systems and Data, Including Personally Identifiable Data.

a. Systems Security

The work to be performed under this contract requires the handling of data that originated within the Department, data that the contractor manages or acquires for the Department, and/or data that is acquired in order to perform the contract and concerns Department programs or personnel.

For all systems handling such data, the contractor shall comply with all security requirements

applicable to Department of Justice systems, including but not limited to all Executive Branch system security requirements (e.g., requirements imposed by OMB and NIST), DOJ IT Security Standards, and DOJ Order 2640.2E. The contractor shall provide DOJ access to and information regarding the contractor's systems when requested by the Department in connection with its efforts to ensure compliance with all such security requirements, and shall otherwise cooperate with the Department in such efforts. DOJ access shall include independent validation testing of controls, system penetration testing by DOJ, FISMA data reviews, and access by the DOJ Office of the Inspector General for its reviews.

The use of contractor-owned laptops or other media storage devices to process or store data covered by this clause is prohibited until the contractor provides a letter to the contracting officer (CO) certifying the following requirements:

1. Laptops must employ encryption using a NIST Federal Information Processing Standard

(FIPS) 140-2 approved product;

2. The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism;

4. The contractor shall log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required. All DOJ information is sensitive information unless designated as non- sensitive by the Department;

5. Contractor-owned removable media, such as removable hard drives, flash drives, CDs, and floppy disks, containing DOJ data, shall not be removed from DOJ facilities unless encrypted using a NIST FEPS 140-2 approved product;

6. When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed, or destroyed) in accordance with security requirements applicable to DOJ;

7. Contracting firms shall keep an accurate inventory of devices used on DOJ contracts;

8. Rules of behavior must be signed by users. These rules shall address at a minimum: authorized and official use; prohibition against unauthorized users; and protection of sensitive data and personally identifiable information;

9. All DOJ data will be removed from contractor-owned laptops upon termination of contractor work. This removal must be accomplished in accordance with DOJ IT Security Standard requirements. Certification of data removal will be performed by the contractor's project manager and a letter confirming certification will be delivered to the CO within 15 days of termination of contractor work;

b. Data Security

By acceptance of, or performance on, this contract, the contractor agrees that with respect to the

data identified in paragraph a, in the event of any actual or suspected breach of such data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the contractor will immediately (and in no event later than within one hour of discovery) report the breach to the DOJ CO and the contracting officer's technical representative (COTR).

If the data breach occurs outside of regular business hours and/or neither the CO nor the COTR can be reached, the contractor shall call the DOJ Computer Emergency Readiness Team (DOJCERT) at 1-866-US4-CERT (1-866-874-2378) within one hour of discovery of the breach. The contractor shall also notify the CO as soon as possible during regular business hours.

c. Personally Identifiable Information Notification Requirement

The contractor further certifies that it has a security policy in place that contains procedures to

promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification shall be coordinated with the Department, and shall not proceed until the Department has made a determination that notification would not impede a law enforcement investigation or jeopardize national security.

The method and content of any notification by the contractor shall be coordinated with, and be subject to the approval of, the Department. The contractor assumes full responsibility for taking corrective action consistent with the Department's Data Breach Notification Procedures, which may include offering credit monitoring when appropriate.

d. Pass-through of Security Requirements to Subcontractors

The requirements set forth in Paragraphs a through c above, apply to all subcontractors who perform work in connection with this contract. For each subcontractor, the contractor must certify that it has required the subcontractor to adhere to all such requirements. Any breach by a subcontractor of any of the provisions set forth in this clause will be attributed to the contractor.

B. Information Resellers or Data Brokers

For contracts where the Department obtains PII from a contractor (such as an information

reseller or data broker) but the contractor does not handle the data described in Section A of this guidance document, the following clause must be used:

Information Resellers or Data Brokers

Under this contract, the Department obtains personally identifiable information about individuals

from the contractor. The contractor hereby certifies that it has a security policy in place which contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, lost or acquired by an unauthorized person while the data is under the control of the contractor. In any case in which the data that was lost or improperly acquired reflects or consists of data that originated with the Department, or reflects sensitive law enforcement or national security interest in the data, the contractor shall notify the Department contracting officer so that the Department may determine

whether notification would impede a law enforcement investigation or jeopardize national

security. In such cases, the contractor shall not notify the individuals until it receives further instruction from the Department.

(End of Clause)

DJAR-PGD-07-10: Ensuring New Acquisitions Include Common Security Configurations

The following language is to be used in all appropriate solicitations and contracts.

(a) The provider of information technology shall certify applications are fully functional and

operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC). This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista). For the Windows XP settings,

see: http://csrc.nist.gov/itsec/guidance_WinXP.html and for the Windows Vista settings, see: http://csrc.nist.gov/itsec/guidance_vista.html

(b) The standard installation, operation, maintenance, update, and/or patching of software shall

not alter the configuration settings from the approved FDCC configuration. The information technology should also use the Windows Installer Service for installation to the default "program files" directory and should be able to silently install and uninstall.

(End of Clause)

DJAR-PGD-07-12: Maintaining Contractor Performance During a Pandemic or Other

Emergency

Continuing Contract Performance During a Pandemic Influenza or other National Emergency

During a Pandemic or other emergency we understand that our contractor workforce will experience the same high levels of absenteeism as our federal employees. Although the Excusable Delays and Termination for Default clauses used in government contracts list epidemics and quarantine restrictions among the reasons to excuse delays in contract performance, we expect our contractors to make a reasonable effort to keep performance at an acceptable level during emergency periods.

The Office of Personnel Management (OPM) has provided guidance to federal managers and employees on the kinds of actions to be taken to ensure the continuity of operations during emergency periods. This guidance is also applicable to our contract workforce. Contractors are expected to have reasonable policies in place for continuing work performance, particularly those performing mission critical services, during a pandemic influenza or other emergency situation.

The types of actions a federal contractor should reasonably take to help ensure performance are: Encourage employees to get inoculations or follow other preventive measures as advised by the public health service.

Contractors should cross-train workers as backup for all positions performing critical services. This is particularly important for work such as guard services where telework is not an option.

• Implement telework to the greatest extent possible in the workgroup so systems are in

place to support successful remote work in an emergency.

• Communicate expectations to all employees regarding their roles and responsibilities in relation to remote work in the event of a pandemic health crisis or other emergency.

Establish communication processes to notify employees of activation of this plan.

• Integrate pandemic health crisis response expectations into telework agreements.

With the employee, assess requirements for working at home (supplies and equipment needed for an extended telework period). Security concerns should be considered in making equipment choices; agencies or contractors may wish to avoid use of employees' personal computers and provide them with PCs or laptops as appropriate.

• Determine how all employees who may telework will communicate with one another and with management to accomplish work.

Practice telework regularly to ensure effectiveness.

• Make it clear that in emergency situations, employees must perform all duties assigned by management, even if they are outside usual or customary duties.

• Identify how time and attendance will be maintained.

It is the contractor's responsibility to advise the government contracting officer if they anticipate

not being able to perform and to work with the Department to fill gaps as necessary. This means direct communication with the contracting officer or in his/her absence, another responsible person in the contracting office via telephone or email messages acknowledging the contractors notification.

The incumbent contractor is responsible for assisting the Department in estimating the adverse impacts of nonperformance and to work diligently with the Department to develop a strategy for maintaining the continuity of operations.

(End of Clause)

DJAR-PGD-08-04: Security of Systems and Data, Including Personally Identifiable

Information

Security of Systems and Data, Including Personally Identifiable Data.

a. Systems Security

For all systems handling such data, the contractor shall comply with all security requirements

controls, system penetration testing by DOJ, FISMA data reviews, and access by the DOJ Office

of the Inspector General for its reviews.

1. Laptops must employ encryption using a NIST Federal Information Processing Standard

(FIPS) 140-2 approved product;

2. The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date;

3. Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism;

6. When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed, or destroyed) in accordance with security requirements applicable to DOJ;

7. Contracting firms shall keep an accurate inventory of devices used on DOJ contracts;

b. Data Security

By acceptance of, or performance on, this contract, the contractor agrees that with respect to the

c. Personally Identifiable Information Notification Requirement

The contractor further certifies that it has a security policy in place that contains procedures to

d. Pass-through of Security Requirements to Subcontractors

B. Information Resellers or Data Brokers

For contracts where the Department obtains PII from a contractor (such as an information

reseller or data broker) but the contractor does not handle the data described in Section A of this guidance document, the following clause must be used:

Information Resellers or Data Brokers

Under this contract, the Department obtains personally identifiable information about individuals

(End of Clause)

DJAR-PGD-08-05: Contractor Certification of Compliance with Federal Tax

Requirements

Contractor Certification of Compliance with Federal Tax Requirements

By submitting a response to a solicitation or accepting a contract award, the contractor certifies

that, to the best of its knowledge and belief, the contractor has filed all Federal tax returns required during the three years preceding the certification, has not been convicted of a criminal

offense under the Internal Revenue Code of 1986, and has not, more than 90 days prior to

certification, been notified of any unpaid Federal tax assessment for which the liability re

mains unsatisfied, unless the assessment is the subject of an installment agreement or offer in compromise that has been approved by the Internal Revenue Service and is not in default, or the assessment is the judicial proceeding.

(End of Clause)

File details come from the government source that posted it. Updated Feb 20, 2020.