2.2.1-Attachment 1 -SOW.pdf

STATEMENT OF WORK (SOW)

FOR

THE U.S. IMMIGRATION AND CUSTOMS ENFORCEMENT (ICE)

ICE HEALTH SERVICE CORPS (IHSC)

UTILIZATION MANAGEMENT (UM) CARE GUIDELINE SOLUTIONS

1.0 General

The U.S. Immigration and Customs Enforcement (ICE), ICE Health Service Corps (IHSC) is the health care authority and managing arm for health care provision for illegal aliens in ICE custody. As a central function of care provision, IHSC authorizes and pays for off-site ambulatory and hospital specialty care services.

1.1 Scope

The vendor shall provide IHSC with web-based access to a UM guidelines solution which must include, but not limited to, all of the following requirements:

• Accessible via the ICE network

• Compatibility with ICE-approved versions of web browsers

• Standalone application that retains functionality in the absence of interoperability with IHSC health information platforms (e.g., electronic health record)

• Standalone application that retains functionality without Personally Identifiable

Information (PII) exchanges

• Ability to support up to 30 users. However, the government may also increase the number of users at their sole discretion, and the contractor is required to support the increased number of users.

• Ability to set role-based access and permissions

• Ability to track the number of current and completed utilization reviews by user

• Ability to track pending and completed tasks associated with a utilization review by user

• Help/service desk support during IHSC’s core business hours via telephone, email, or a virtual platform

• Interactive platform to support documentation of prospective, concurrent, and retrospective utilization reviews of care in ambulatory and hospital settings

• Ability to track and document progression of hospital admission

• Non-interactive read-only access that would give users a quick review of guideline content

• Evidence-based clinical care guideline content (e.g., expected progression of care, anticipated length, etc.)

• Unlimited number of searches within the guideline database and utilization review entries

• Customized reports that track utilization review (UR) outcomes and deviations in the expected progression of care

• User training and support to include:

• Live and on-demand modules for initial and ongoing user training

• In-person (live or virtual) for workflow development and guideline integration

• Free continuing education opportunities to ensure ongoing user competence in guideline application

• Ability to test utilization review workflows prior to full implementation

• Utilization Review Accreditation Committee (URAC) certification which recognizes an organization’s commitment to quality and patient safety

• Must have policies to avoid any influence from device manufacturers or drug companies

• Annually screen editors and external reviewers for potential conflicts of interest (financial, intellectual, or institutional)

• A utilization management solution that is not influenced by payer or provider financial motives

• Commercial Off-the-Shelf (COTS) product to meet our needs, easy to implement and into our existing operations, while also providing reliable performance and support.

1.2 Applicable Documents

The following documents provide specifications, standards, or guidelines that must be complied with to meet the requirements of this contract:

Federal Information Security Modernization Act of 2014 (FISMA 2014), Pub. L. 113- 283, 123 Stat. 3073.

2.0 Additional Specific Requirements

2.1 General

2.1.1 The vendor shall provide an enterprise license to a set of nationally recognized, evidence-based guidelines that inform the evaluation of medical necessity and appropriateness of healthcare services of care determinations. Guideline content shall support UR of healthcare services in both inpatient and ambulatory care settings.

The vendor’s platform shall support the interactive UR documentation to include the day-to-day progression of inpatient care.

2.1.2 The vendor shall provide workflow design/integration support.

2.1.3 The vendor shall provide a web-based system via ICE network that meets the following credentials:

2.1.3.1 FISMA compliance

2.1.3.2 508 compliance

2.1.3.3 Support eGov initiative

2.1.4 The vendor shall provide access to an IT Help/Service desk during the core business hours of Monday through Friday from 8:00 AM – 8:00 PM Eastern Time (ET) except for Federal Holidays. Recognized Holidays: Unless required under the terms of the contract or authorized by the Contracting Officer (CO), the vendor shall not work on any of the following holidays and the Government observed legal holidays: New Year’s Day; Birthday of Martin Luther King, Jr.;

Inauguration Day (Fiscal Year 2030 only); Washington’s Birthday; Memorial Day; Juneteenth, Independence Day; Labor Day; Columbus Day; Veterans Day;

Thanksgiving Day; and Christmas Day.

2.2 e -Training

2.2.1 The vendor shall provide access to online, self-paced training, and user guides.

2.2.2 The vendor shall provide remote, instructor-led training for system users as part of the onboarding process of the national care guideline solution agreement.

2.2.3 The Government may require the vendor to conduct additional training as a result of substantial upgrade to existing software modules, with significant functionality changes.

2.3 Documentation and Record Management

2.3.1 The system shall possess a robust search engine capable of searching by various data points such as review/case number, date completed, review date, primary reviewer, and free text search capability.

2.3.2 The system shall provide an automated means for browsing, searching, and retrieving from a repository of completed reviews.

2.3.3 The system shall provide access to an online content management system that can be customized to send reviews for further review or approval (role based) throughout the term of the agreement.

3.0 Other Applicable Conditions

3.1 Security

Vendor access to unclassified information may be required under this SOW.

Vendor employees shall safeguard this information against unauthorized disclosure or dissemination.

3.2 Period of Performance

The period of performance for this contract is a one 12-month base period with four 12-month option periods.

3.3 Place of Performance

The primary place of performance will be the vendor’s facilities with visits to the IHSC Offices located at the Texas and/or IHSC Headquarters in the Washington Metro Area, if required.

3.4 Travel

Contractor travel may be required for this requirement for training at the contractor’s sole expense. However, the government will not reimburse for any contractor travel in relation to this effort. Any travel that the contractor believes is necessary to meet the requirements of this SOW shall be included in the overall FFP rate which shall be priced and carried out in accordance with the Federal Travel

Regulations.

3.5 Employee Identification and Conduct

Contractor employees visiting government facilities shall wear an identification badge that, at a minimum, displays the contractor name, the employee’s photo, name, clearance-level, and badge expiration date. Visiting contractor employees shall comply with all government escort rules and requirements. All contractor employees shall identify themselves as contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor’s employees shall comply with all applicable government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at government facilities. The contractor shall ensure contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the DHS.

3.6 Artificial Intelligence

1. Compliance with Federal Laws and Policies; AI Use Limitations. The Contractor shall ensure any AI system or service provided complies with all applicable federal, Department of Homeland Security (DHS), and U.S.

Immigration and Customs Enforcement (ICE) AI Policies, Directives, and Memos, as well as ICE AI governance requirements. The AI solution must align with the U.S. Constitution and all relevant laws and regulations, including privacy, civil rights, and civil liberties. Specifically:

a. The Contractor must stay current and comply with any updates or new AI policy and AI governance requirements issued during the contract term.

b. AI used to support law enforcement decisions or civil actions must include technical and operational safeguards to:

i. Establish human-in-the loop oversight.

ii. Document or label AI-generated content.

c. For AI used in determinations impacting individuals (e.g., risk assessments, identity verification), the Contractor must cooperate with federal, DHS, and ICE procedures for notice and appeal, providing explanations or adjusting outputs upon error findings.

d. The contract prohibits use of AI that violates DHS policy, including:

i. Using AI outputs as sole evidence for punitive or enforcement actions.

ii. Utilizing AI to make or support decisions on improper bases (e.g., predicting future behavior or emotional state leading to discriminatory or unlawful actions).

e. The Contractor must follow AI Use Case approval, Security Authorization, and ICE AI governance and AI risk management processes and requirements before developing, piloting, testing, or deploying AI in ICE environments or using ICE data.

f. The Contractor is responsible for complying with AI Security Control Baseline requirements.

2. Traceability, Auditability, and Transparency. The Contractor shall design, build, document, and operate the AI system or service to be explainable, auditable, and transparent. At a minimum, the Contractor shall:

a. Document the provenance of data used for AI training, fine-tuning, or operation.

b. Ensure data used for AI training, fine tuning, or operation was lawfully obtained and processed.

c. Document the provenance of any third-party AI models used (source, version, etc.).

d. Provide comprehensive system diagrams and inventories that map the AI systems’ API and system connections, data flows, and technical components.

e. Provide comprehensive documentation explaining how the AI system works, including any models and algorithms.

f. Ensure the AI system, where applicable, provides clear explanations or reasoning for its decisions or predictions.

g. Ensure AI outputs are traceable, auditable, meet evidentiary standards, and are explainable to non-technical users. Additionally:

i. Ensure GenAI inputs and their outputs are logged and preserved in line with federal, DHS, and ICE retention policies.

3. Data Rights and Solution Ownership. The contract shall clearly delineate data and intellectual property rights to protect ICE’s interests in the AI solution and associated data. Specifically:

a. All data provided by the Government or generated through the AI system belongs to the Government. The Contractor is prohibited from:

i. Using nonpublic agency data and outputted results to train publicly or commercially available AI algorithms, or any non-ICE systems outside the contract’s scope without ICE’s authorization.

ii. Using Government-furnished data or AI-generated data for purposes outside the contract without ICE authorization.

iii. Sharing, disclosing, or transferring Government data, AI models, or AI-outputs with third parties without ICE’s authorization.

b. The Contractor must grant the Government appropriate license rights in any custom-developed AI models, software, or deliverables. Intellectual Property (IP) rights will be negotiated consistent with federal law and the agency’s mission needs, aiming to avoid vendor lock-in. The Government may require broad or unlimited rights to certain deliverables (including source code or trained model files) for long-term use, maintenance, or integration of the AI solution.

c. ICE maintains ownership over and the Contractor must provide ICE access to:

i. Any derivative outputs of AI developed under the Contract, including data processed using AI.

ii. Any models trained, fine-tuned, or otherwise developed using ICE data.

4. Prevention Against Vendor Lock-In: To promote a competitive marketplace and long-term sustainability of ICE’s AI capabilities, the Contractor shall:

a. Utilize industry-standards, Application Programming Interfaces (APIs), and protocols wherever possible to ensure interoperability and combability within and between ICE and DHS systems.

b. Ensure inputs and outputs of the AI system are exportable in a non-proprietary, machine-readable format to facilitate integration or transfer of functions to other systems.

c. Where custom components are developed, deliver sufficient technical documentation and access to components (including source code, model weights, or other foundational code) to enable ICE’s long-term use of the AI system.

d. In the case of transitioning the AI system to another contractor or in-house provider, the Contractor must support knowledge transfer and provide all necessary documentation, models, data, derivative outputs, and software to enable sustained system use.

i. The Contract must also document estimated costs and related steps that will be required to exit the Contract.

5. Security, Testing & Evaluation, and Continuous Monitoring: The Contractor shall implement rigorous security and risk management measures for the AI solution, per federal standards, ICE procedures, and Office of Management and Budget (OMB) guidance on AI risks. Key requirements include:

a. If designated as a High Impact AI system, complying with all required AI Risk Management practices (per OMB, DHS, and ICE policy), unless officially granted a waiver.

b. Before deploying the AI system: The Contractor must provide testing and evaluation artifacts and support (including providing requisite access) to enable ICE independent test and evaluation processes to evaluate factors such as, but not limited to:

i. AI system performance, including accuracy and reliability.

ii. Compliance with DHS AI Security Controls.

iii. Resiliency against AI cybersecurity and operational threats, including system misuse/abuse.

iv. Completion of an AI impact assessment and/or other risk assessment procedures, in line with federal, DHS, and ICE policy and practices.

v. Fulfillment of functional, business, and technical requirements.

c. While operating the AI system: The Contractor must re-test system performance, security, resiliency, and abuse/mis-use vulnerabilities before deploying new AI models, fine-tuned models, or other changes to AI systems that require Change Requests.

d. Audit and Logging: Ensure compliance with DHS and ICE AI auditing and logging requirements, including, but not limited to audit and logging the access, usage, and modification of:

i. AI Guardrails deployed in GenAI systems.

ii. Models, including parameters and weights.

iii. AI system inputs and outputs (including prompts).

iv. Additional requirements as determined by federal, DHS, and ICE policy.

e. Continuous Monitoring: The Contractor shall implement continuous monitoring mechanisms to detect and respond to anomalies, biases, or performance degradation in AI systems. Additionally:

i. The Contractor shall establish protocols for the timely remediation of identified issues, including the potential suspension of AI system operations if necessary.

ii. The Contractor shall comply with all continuous monitoring requirements, per federal, DHS, and ICE policy.

3.7 Office of the Chief Information Officer (OCIO)/ Data Management Unit

(DMU) - Data Ownership Contract Requirements

1. Accessibility of Government-owned Data All stored program data associated with this acquisition shall be owned by the

Government. As such, it shall be made accessible to the Government in accordance with the Minimum Data Access Capability described below. This accessibility is required to allow full data transparency, flexibility in performing data analytics, and integration with data from other government programs.

In addition to the Minimum Data Access Capability, the Government prefers, but does not require, that program data be accessible via Enhanced Access Capabilities as described below.

Definition of “program data”: Program Data refers to any data resulting from ICE and DHS organizational activity. Examples of such data include but are not limited to administrative data resulting from human resource, management, and financial actions, as well as operational data resulting from performance of the ICE mission.

Definition of “associated with this acquisition”: Program Data is associated with an acquisition if it is created by DHS organizational activity that is facilitated by the contractor. Examples of how a contractor might facilitate organizational activity follow:

o Program data is stored by contractor personnel o Program data is stored by software that is managed, developed, or used by the contractor o Program data is stored in a repository that is managed, developed, or used by the contractor

2. Minimum Data Access Capability

• The current version of all Program Data is accessible to the Government within 24 hours of request, as well as on any pre-defined schedule as required by the Government.

Data access can occur by various means, provided that Government security requirements are met, and data is accessible in a format that is acceptable to the Government. Examples include but are not limited to APIs that are consumable by the Government, files made available for Government download (e.g., Excel Spreadsheets), or direct database query by federal or contractor personnel.

• The contractor shall format program data accessed by the Government to anticipate the maximum file size of any data to be accessed. File size shall be small enough to assure rapid processing by government applications.

• The contractor shall provide the means for the Government to interpret accessible Program Data as follows:

o Data elements and groupings of data elements shall be clearly identifiable by labels embedded in the data itself, or by a separate schema or file layout which allows such elements and groupings to be identified.

In the case of a relational database schema defined through Data Definition

Language (DDL), data elements would be represented as columns, and groupings of data would be represented as tables. In addition, relationships between tables would be described as foreign key relations.

o Labels or names used to identify data elements and groupings of data elements shall be approved by the Government. In addition, each label or name shall be associated with a government approved definition which describes the content of data held therein.

o Program data delivered to the Government shall conform to the Government approved definition for each data element and grouping of data elements.

o All data accessible by the Government shall be both machine readable and human-readable in plain text.

o All reference data associated with Program Data also needs to be accessible to the Government. Such reference data is required to provide complete understanding of a record.

Reference Data Example: Program data may include a city code which uniquely identifies a city. Reference data associated with a city code may include its name, geographic boundaries, population, median income, etc. This example is provided for clarification of the meaning of reference data and may or may not apply to this specific acquisition. Examples of other reference data codes would include codes representing eye color, gender, country of origin, etc.

3. Enhanced Access Capabilities The Government prefers that sharing of program data take place via an Application

Programming Interface (API) or multiple APIs. APIs allow the Government to efficiently consume data via a widely recognized standard where the data has been completely abstracted from the technology platform that produces it.

In addition, the Government prefers that sharing of program data take place using techniques that enhance efficiency, such as Change Data Capture (CDC). CDC enhances efficiency of data transfer by providing only incremental updates to program data as opposed to providing all program data each time data is shared.

3.8 Government Furnished Resources and Information

The government is not providing any equipment, resources, or information to the contractor for this effort.

3.9 Contractor Furnished Property

The contractor shall furnish all facilities, materials, equipment, and services necessary to fulfill the requirements of this contract.

3.10 Section 508 Compliance

1. Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true communications technology (ICT), it shall be accessible to people with disabilities.

Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rg n=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

1.1 Section 508 Requirements for Technology Products

Section 508 applicability to Information and Communications Technology

(ICT): UTILIZATION MANAGEMENT CARE GUIDELINE SOLUTIONS

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including but not limited to Internet or Intranet website; Other):

Does not apply

Applicable 508 requirements for software features and components (including but not limited to Web, desktop, server, mobile client applications)

Applicable 508 requirements for hardware features and components:

Does not apply

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

1.3 Section 508 Deliverables

1. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

3.11 Advertisements, Publicizing Awards, News Releases

All press releases or announcements about agency programs, projects and contract award need to be reviewed and approved by the Contracting Officer’s Representative (COR) and CO prior to release. Under no circumstances shall the contractor, or anyone acting on behalf of the contractor, refer to the supplies, services, or equipment furnished pursuant to the provisions of this contract in any publicity news release or commercial advertising without first obtaining explicit written consent to do so from the COR and CO.

4.0 General Cybersecurity Contract Requirements

4.1 In accordance with ITAR 4.5.3.1 – Compliance with DHS Security Policy

Terms and Conditions.

Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Program 4300A version 13.3 Feb. 13, 2023 and attachments.

4.2 In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review

Security Review Terms and Conditions

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

https://www.itic.org/policy/accessibility/vpat

4.3 In accordance with ITAR 4.5.3.7 – Supply Chain Risk Management

Supply Chain Risk Management Terms and Conditions

The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

i. How risks from the supply chain will be identified;

ii. What processes and security measures will be adopted to manage these risks to the system or system components; and

i. How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR/CO) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents a risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standard certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the CO. Contractors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. "grey market, "previously used) components only with formal Government approval. Such components shall be procured from their original source and have them shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “end of life"). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government's request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipping and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being ship (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

4.4 In accordance with HSAR Class Deviation 15-01, REV 1, SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION

(JULY 2023) and determine if Alternate is required – ALTERNATE 1 (JULY 2023) use for ATO requirement.

*For Commercial Products or Services using FAR 12 – Insert clause

3052.212.70 Contract Terms and Conditions Applicable to DHS Acquisition of Commercial Items (JULY 2023) *Alternate I of 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023) used for the Authority to Operate (ATO) requirement The following clause should be incorporated into the clause section of the acquisition document (not the SOW/PWS) for High Risk Contracts, defined as contracts that consist of contractors or sub-contractors viewing ICE sensitive data, contracts that are performed off-site, and/or contracts that are performed out of the continental United States:

3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION (JULY 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks;

applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual.

Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email.

The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email.

Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related

Files and Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information.