2.2.1(a) Attachment A-SOW-NWSE HVAC Replacement revised.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

June 2021 1

Federal Emergency Management Agency (FEMA)

STATEMENT OF WORK (SOW) FOR:

Naval Weapon Station, Earle, HVAC Removal and Replacement

Brenda Cruz, Contracting Officer (CO)

70FBR226R00000018 Page 48 of 78

DHS Statement of Work (SOW)

Learn more at fema.gov June 2021 2

Statement of Work (SOW) for HVAC Removal and Replacement

1. Background

FEMA has experienced recurring issues with existing Heating, Ventilation, and Air Conditioning (HVAC) systems at Building C-54 Naval Weapon Station Earle, that have affected system reliability and facility comfort. Replacement, repair, and installation of HVAC equipment are required to improve system reliability, maintain appropriate indoor environmental conditions, and support continued facility operations.

2. Purpose

The purpose of this Statement of Work is to define the requirements for the Contractor to inspect, remove, replace, repair, install, test, and commission heating, ventilation, and air conditioning systems at FEMA Building C-54 Naval Weapon Station Earle. The work includes replacement of four (4) rooftop HVAC units, removal and installation of two

(2) cooling units for the server room, and repair or replacement of two (2) warehouse heating and ventilation units.

The Contractor shall perform all work necessary to provide fully operational HVAC systems that support facility operations, occupant comfort, equipment protection, and long-term reliability.

3. Scope of Work

The scope of this effort is to secure professional services for:

3.1 The removal and replacement of four (4) rooftop HVAC systems at our facility. The contractor will be responsible for conducting a comprehensive assessment of the existing HVAC units and their integration with the roof structure, identifying any deficiencies or areas of concern, and recommending the most effective solutions: whether that involves targeted replacement, full system upgrades, or necessary modifications to ensure proper installation and operation.

This project will help maintain the safety, comfort, and functionality of the facility while protecting the building’s infrastructure for the long term.

3.2 The removal of the existing HVAC unit, and installation of two (2) additional air conditioning unit for the server room to enhance cooling capacity and protect critical IT infrastructure.

3.3 The Contractor shall inspect, diagnose, and repair or replace two (2) warehouse heating and ventilation units. The Contractor shall evaluate piping requirements, operational noise, and other deficiencies affecting performance. The Contractor shall provide a written recommendation to repair or replace the units, including required piping work, noise mitigation measures, schedule impact, and cost. Upon Government approval, the Contractor shall complete the approved repair or replacement work and verify that the units are fully operational.

3.4 The Contractor shall provide qualified personnel, supervision, labor, materials, tools, equipment, transportation, permits, coordination, testing, commissioning, documentation, and all other resources necessary to complete the work described in this SOW. All work shall be performed in accordance with applicable Federal, state, local, industry, manufacturer, safety, environmental, and site.

The table below details the current HVAC units installed at the facility. FEMA requires replacement units that are equivalent to or superior in performance and quality.

70FBR226R00000018 Page 49 of 78

Learn more at fema.gov June 2021 3

Location Item Weight Qty Make Model Serial/Ident Warehouse Heating and

Ventilation Unit

Unavailable 2 Unavailable Unavailable Unavailable

Server Room Air Handler 5 Ton 1 Liebert BU067ADEI N12K740240

Rooftop Air Handler

RTU#4

12.5 Ton 1 Carrier 50TCD14A3A5A2F0A0 4612G20157

Rooftop Air Handler

RTU#3

3 Ton 1 Carrier 50TM004A601 24050334

Rooftop Air Handler

RTU#2

30 Ton 1 Carrier 50A3030PQ62AHH 4712U51847

Rooftop Air Handler

RTU#1

40 Ton 1 Carrier 50P3040610J73Q74C 4712U52007

4. Performance Requirements:

4.1 The Contractor shall conduct a comprehensive inspection of the existing HVAC systems identified in this SOW, including rooftop units, server room cooling equipment, and warehouse heating and ventilation units. The inspection shall include condition, configuration, accessibility, integration with existing building systems, roof-related installation conditions, and any visible deficiencies affecting removal, replacement, repair, installation, testing, commissioning, or operation. The Contractor shall coordinate all site visits with the designated Contracting Officer’s Representative.

4.2 The contractor shall coordinate with the Contracting Officer Representative (COR) to schedule site visits and determine the full scope of required HVAC removal and replacement activities.

4.3 Following the site visit, the contractor shall provide recommended solutions, including an estimated timeline for completion, a detailed cost estimate, and a summary of all necessary work, no later than five days after the site visit.

5. General Submittals Timeline and Progress

5.1 Submittals

Government approval is required for all submittals.

5.2 Project Timeline

Prepare for approval a Project Schedule, as specified herein - Show in the schedule the proposed sequence to perform the work, for each Roof Top Units (RTU’s), dates contemplated for starting and completing all schedule activities. The scheduling of the entire project is required.

5.2.1 Project schedule detailed requirements - Level of Detail required. Develop the project schedule to the appropriate level of detail to address major milestones, work listed in the bid schedule, and to allow for satisfactory project planning and execution.

5.2.2 Mandatory tasks - Include the following activities/tasks in the initial project schedule and all updates.

a. Submission, review and acceptance of submittals. b. Contractor's pre-final inspection. c. Government's pre-final inspection. d. Final inspection.

70FBR226R00000018 Page 50 of 78

Learn more at fema.gov June 2021 4

5.2.3 Weekly Progress Meetings - Conduct a weekly meeting with the Government for the purpose of jointly reviewing the actual progress of the project as compared to the as planned progress and to review planned activities.

5.2.4 Failure to achieve progress - Should progress fall behind the approved project schedule, the Contracting Officer may require provision of a written recovery plan for approval. The plan must detail how progress will be made-up to include which activities will be accelerated by adding additional crews, longer work hours, extra workdays, etc.

5.2.5 Failure to Perform - Failure to perform work and maintain progress in accordance with the supplemental recovery plan may result in an interim and final unsatisfactory performance rating and may result in corrective actions directed by the Contracting Officer, which may include liquidated damages, and/or termination for default.

6. Environmental Requirements

6.1 Safety and Environmental Requirements

The Contractor shall comply with all Occupational Safety and Health Administration (OSHA) safety standards and Naval Weapons Station Earle safety protocols. All removed HVAC units and refrigerants must be disposed of in accordance with Environmental Protection Agency (EPA) regulations and local environmental guidelines.

6.1.1 Safety Protocols: Specify compliance with OSHA standards and any site-specific safety requirements.

6.1.2 Environmental Considerations: Address proper disposal of old HVAC units, refrigerants, and hazardous materials in accordance with EPA regulations.

6.2 Quality Assurance and Control

6.2.1 Quality Standards: Reference industry standards (e.g., ASHRAE, ANSI) for installation and performance.

6.2.2 Testing and Commissioning: Require post-installation testing, commissioning, and verification of proper operation.

6.2.3 Warranty: Specify minimum warranty periods for equipment and workmanship.

6.2.4 Quality Assurance: All equipment and installation must meet or exceed ASHRAE standards. Contractor shall provide commissioning and testing documentation to verify proper operation of all systems. Minimum warranty of one year on labor and three years on equipment is required.

6.3 Personnel Requirements Qualifications

6.3.1 Require that technicians hold relevant certifications (e.g., EPA 608, HVAC/R). All technicians must possess current EPA 608 certification and relevant HVAC/R licenses. Contractor shall provide a site supervisor for the duration of the project.

6.3.2 Supervision: Indicate who the site supervisor and/or project manager are.

70FBR226R00000018 Page 51 of 78

Learn more at fema.gov June 2021 5

6.4 Enhancements

6.4.1 Energy Efficiency: Proposals that improve energy efficiency or reduce lifecycle costs are encouraged.

6.4.2 Smart Controls: Integration with building existing automation systems.

7. Security and Access

7.1 Access Control: Expand on procedures for base access, badging, and escort requirements.

7.2 Sensitive Areas: Specify any restricted areas or special procedures for server rooms.

8. Risk Management and Contingency Planning

8.1 Risk Mitigation: Ask for identification of potential risks (e.g., weather delays, equipment lead times) and mitigation strategies.

8.2 Contingency Plans: Require a plan for minimizing disruption to facility operations during the project.

9. Deliverables and Reporting

9.1 Documentation: Contractor shall submit inspection reports, installation manuals, as-built drawings, and operations and maintenance (O&M) manuals upon project completion for all HVAC units.

9.2 Progress Reporting Requirements:

9.2.1 Frequency: Submit weekly written progress reports every Friday by 12:00 PM, in addition to verbal updates during the weekly meetings.

9.2.2 Format: Reports must be submitted in PDF or Microsoft Word format and include:

9.2.3 Summary of work completed during the reporting period

9.2.4 Current status of project milestones

9.2.5 Issues encountered and mitigation actions

9.2.6 Planned activities for the next reporting period

9.2.7 Updated project schedule

10. Operating Constraints

Contractor employees shall perform all work between the hours of 7:00 AM and 4:30 PM EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be

70FBR226R00000018 Page 52 of 78

Learn more at fema.gov June 2021 6 required to work other than normal business hours, including weekends and holidays, to fulfill requirements.

11. Period of Performance

The period of performance for this statement of objectives is 1 year from the date of award.

12. Place of Performance

Naval Weapons Station Earle – FEMA Building C-54 201 State Route 34 Colts Neck, NJ 07722

13. Point of Contacts

Omar Reveron, omar.reveron@fema.dhs.gov, at 202-924-7210 Anthony Bolognese, anthony.bolognese@fema.dhs.gov, at 202-702-3895.

Ellen Gallagher, ellen.gallagher@fema.dhs.gov, at 202-805-9088.

14. Applicable Documents or References

14.1 Naval Weapons Station Earle – FEMA Building C-54 floor plan (attached).

15. Security

15.1. Security Information for NWS Earle: Naval Weapons Station Earle’s security performs a background check utilizing the NAVSEC 5512, form will be provided to all contractors requiring access. Instructions will be provided with form. All personnel entering the Naval Base. Driver’s must be U.S. citizens and are required to present a valid Real ID, driver’s license, vehicle registration, and proof of insurance. All commercial vehicles, exterior and interior, will be thoroughly inspected by Naval base security.

15.2 Background Investigations:

15.2.1 All personnel require access to unclassified information only. The Contractor must ensure contractor employees receive a favorably background investigation prior to entry on duty (EOD). All individuals will be U.S.

citizens. The contractor shall follow the standards established within DHS and FEMA policy.

15.2.2 All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

70FBR226R00000018 Page 53 of 78 mailto:omar.reveron@fema.dhs.gov mailto:anthony.bolognese@fema.dhs.gov mailto:ellen.gallagher@fema.dhs.gov

Learn more at fema.gov June 2021 7

15.3 Low Risk without Information System Access:

15.3.1 Contractor personnel occupying positions or performing functions with a Low-Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1 investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract. (also reference Facility Access).

15.4 Low Risk with Information System Access:

15.4.1 Contractor personnel occupying positions or performing functions with a Low-Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

15.5 Moderate Risk:

15.5.1 Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

15.6 High Risk:

15.6.1 Contractor personnel occupying positions or performing functions with a High-Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

15.7 Background Investigation Process:

15.7.1 To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

15.7.2 Contractor personnel who already have a favorably adjudicated background investigation may be eligible to perform work under this contract without further processing by FEMA PSD if:

the investigation was completed within the last five years, it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract, the contractor personnel have not had a break in employment since the prior favorable adjudication, and, FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

70FBR226R00000018 Page 54 of 78

Learn more at fema.gov June 2021 8

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

15.7.3 For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the contractor applicant/personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the National Background Investigation Services (NBIS) e-Application (eAPP) online system and instructions for submitting the necessary information:

Standard Form 85P, “Questionnaire for Public Trust Positions”

Optional Form 306, “Declaration for Federal Employment”

SF 87, “Fingerprint Card” (2 copies)

DHS Form 11000-6, “Non-Disclosure Agreement”

DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

15.7.4 FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the National Background Investigation Services (NBIS) e- Application (eAPP) online system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

15.7.5 Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

15.7.6 Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination, FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

70FBR226R00000018 Page 55 of 78

Learn more at fema.gov June 2021 9

16. Continued Eligibility and Reinvestigation:

16.1 Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration of the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

17. Exclusion by Contracting Officer:

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to public interest or inconsistent with the best interest of the agency may be removed.

18. OPSEC Training:

18.1 Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief.

18.2 Access to the briefing can be obtained at OPSEC Awareness for Military Members, DOD Employees and Contractors (usalearning.gov)

18.3 Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering into the contract must receive the briefing within ten (10) business days of joining the contract.

19. Insider Threat Training:

19.1 Insider Threat training for Contractors can be found at: Insider Threat Awareness (usalearning.gov)

19.2 Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering into the contract must receive the briefing within ten (10) business days of joining the contract.

20. Facility Access:

20.1 The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

70FBR226R00000018 Page 56 of 78 https://securityawareness.usalearning.gov/opsec/index.htm https://securityawareness.usalearning.gov/opsec/index.htm https://securityawareness.usalearning.gov/itawareness/index.htm

Learn more at fema.gov June 2021 10

20.2 Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

20.3 Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted into Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) always.

20.4 FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

21. Separation of Contract:

21.1 The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence.

The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

21.2 If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

21.3 The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

22. HSAR 3052.240-71

22.1 “HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.

This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-

Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of

70FBR226R00000018 Page 57 of 78

Learn more at fema.gov June 2021 11 the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of

2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security

Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department.

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization.

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

70FBR226R00000018 Page 58 of 78

Learn more at fema.gov June 2021 12

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system.

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department.

(9) Personnel Security Information means information that could result in physical risk to Department of

Homeland Security personnel or other individuals whom the Department is responsible for protecting.

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation.

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally

Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

70FBR226R00000018 Page 59 of 78

Learn more at fema.gov June 2021 13

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these people receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(g) Everyone employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department's Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.”

23. Privacy FAR Applicable Clauses

23.1 FAR 52.204-9 Personal Identity Verification of Contractor Personnel (JAN 2011)

23.2 FAR 52.224-1 Privacy Act Notification (APR 1984)

23.3 FAR 52.224-2 Privacy Act (APR 1984)

70FBR226R00000018 Page 60 of 78