Attachment B SOW - Electronic Fingerprint Services RFQ 20156753.docx

U.S. Department of Homeland Security U.S. Customs and Border Protection

STATEMENT OF WORK

FOR

Office of Human Resource Management Electronic Fingerprint Collection Services

Table of Contents

1. BACKGROUND 2

2. SCOPE 2

3. APPLICABLE DOCUMENTS 3

f. SECTION 508 REQUIREMENTS.……….………………………………………………………………………………………………………………………….……………….………………14

g. ENTERPRISE ARCHITECTURE COMPLIANCE……………………………………………………………………………………………………………………….………………………….15

h. INFORMATION TECHNOLOGY SECURITY AARENESS TRANING (JULY 2023) ……………………………………….………………………………………………………...19

1. BACKGROUND

a. As a component of the Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP) is responsible for protecting our Nation’s borders in order to prevent terrorists and terrorist weapons from entering the United States, while facilitating the flow of legitimate trade and travel. CBP is also responsible for apprehending individuals attempting to enter the U.S. illegally; stemming the flow of drugs and other contraband; protecting our agricultural and economic interests from harmful pests and diseases; protecting American business from theft of their intellectual property; and regulating and facilitating international trade, collecting import duties, and enforcing U.S. trade laws. The Office of Human Resources Management (HRM) CBP Hiring Center (HC) supports the recruitment, hiring, and retention of qualified employees for various positions within CBP.

b. All CBP employees, many contractors, consultants, and applicants, are required to undergo a background investigation to include fingerprints that are required for a National Agency Check (NAC).

2. SCOPE

a. The purpose of this document is to set forth the necessary requirements that the Contractor shall meet to provide CBP automated electronic fingerprint services for CBP employees, contractors, consultants, and applicants (hereafter collectively referred to as “candidates”).

b. The Contractor shall provide all fingerprinting facilities, all fingerprinting personnel, electronic communications of all fingerprint data, and all equipment necessary for completing an automated electronic fingerprint process.

c. The Contractor shall provide the following services in compliance with this Statement of Work (SOW):

i. Provide a means to schedule all participants for fingerprinting in coordination with the Hiring Center (HC), the Office of Professional Responsibility (OPR) / Personnel Security Division (PSD), and the Office of Information and Technology (OIT) / Workforce Management Division (WMD) as requested by the Contracting Officer’s Representative (COR).

ii. Provide an automated self-scheduling capability to allow candidates to elect date, time and location for the electronic collection of their fingerprints.

iii. Capture the electronic fingerprints for all CBP candidates requiring fingerprints as part of their background investigation NAC requirements.

iv. Maintain a web-based data system, accessible remotely by CBP employees and contractor personnel per the Web Services and reporting requirements in this SOW.

v. Ensure that any and all data that is collected, generated, and/or tracked in the vendor system is exposed for integration via web service(s) and includes relationship and unique identifiers.

vi. Provide all trained personnel to administer fingerprint functions at facilities nationwide as specified in this SOW. The Contractor shall provide the fingerprinting sites in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

vii. The services under this Blanket Purchase Agreement (BPA)/Task Order are subject to the needs of the Government and to the availability of funds; the volume of electronic fingerprints to be ordered is contingent upon the quantities of new hires approved by Congress, current CBP employees (i.e., periodic investigations), contractors requiring reinvestigations, and specific hiring requirements. CBP shall make a good faith effort to keep the Contractor informed of anticipated or impending needs for services. The volume of requests sent by CBP to the Contractor shall vary widely by day – CBP may send up to several thousand requests in one day which shall be completed within the timelines specified in this SOW.

d. The Contractor shall provide a testing environment that mimics the current production environment. CBP will be going through multiple systems changes and expects additional changes in the near future. These changes must allow CBP to have a testing environment in order to ensure any updates made are functioning correctly with the interfaces prior to deployment.

3. APPLICABLE DOCUMENTS

1. Electronic fingerprints collected under this BPA shall be consistent with the requirements in this Statement of Work

a. Compliance with DHS Security Policy. All hardware, software, and services provided under this BPA must be compliant with:

a. 4300A Information Technology System Security Program, Sensitive Systems – Version 13.4

b. U.S. Customs and Border Protection (CBP) Information Systems Security Policies and Procedures Handbook, CIS HB 1400-05D (Attachment A.1)

1.1.1.1. DHS Handbook for Safeguarding Sensitive Personally Identifiable Information c.

1.1.1.2. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017 https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2017/m-17-12_0.pdf 1.1.1.3.

d.

e. U.S. Customs and Border Protection (CBP) Information Security Handbook, Office of Professional Responsibility (OPR), HB 1400-04A (Attachment A.2)

f. Privacy Act of 1974, as amended, 5 U.S.C. § 552a

i. https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a

g. Occupational Safety and Health Act of 1970, as amended

i. https://www.osha.gov/laws-regs/oshact/completeoshact

4. GENERAL REQUIREMENTS

a. Contractor Furnished Equipment

i. Hardware: Console or desktop computer;

ii. Camera

iii. Flatbed scanner

iv. Driver license reader; and

v. Signature pad

b. Fingerprint Facilities

i. The Contractor shall provide fingerprinting service in each of the forty-eight (48) Continental United States and in Alaska, Hawaii, Washington DC, Puerto Rico, the U.S. Virgin Islands, Guam, Norther Marian Islands and Saipan. The Contractor shall provide fingerprint services within a sixty (60) highway-mile radius of the candidate’s zip code to meet CBP’s background investigation timeline and other requirements addressed in this SOW.

ii. If, in the course of performance, the Contractor becomes unable to schedule an appointment within the required timelines because a facility is not available within a 60 (sixty) highway-mile commuting radius, the Contractor shall notify the COR within one (1) business day of the initial request for services from CBP. The Contractor shall then be provided two (2) additional business days to locate an acceptable facility.

i. If the Contractor is unable to locate an acceptable facility within the sixty (60) highway-mile radius, the Contractor shall obtain approval from the COR to arrange an alternative solution and shall bear all expenses that the Contractor may incur in executing that alternate solution.

ii. The Contractor shall ensure that all the fingerprint locations meet the requirements of the Occupational Safety and Health Act (see Applicable Documents in this SOW).

c. Fingerprint Facility Requirements

i. Any firm or business under contract with CBP that requires access to sensitive information must possess a facility security clearance commensurate with the level of access required. This includes any firm or business entity that requires access to sensitive information to prepare a response to a request for proposal (RFP) or a request for bid and/or in performance of a sensitive contract.

ii. Firms that do not possess a facility security clearance, or the requisite level of facility security clearance, must be sponsored for a DHS facility security clearance when a determination has been made by the CBP program office that the contract effort will require access to sensitive information. CBP offices must submit relevant sponsorship requests for facility security clearances to OPR for processing.

5. TASKS

Task 1 – Requests for Services

1.2. Daily, or more frequently when available, CBP shall send via Excel file or via web services information regarding requests for services to be completed. Specific data items included, and the format of this file shall be determined by CBP upon award of this BPA. The file shall contain the following types of requests:

1.2.1. Fingerprint requirements;

1.2.2. Candidates contact information changes; and

i. Cancellation of requests for candidates who are removed from the process.

b. Requests shall be rejected by the Contractor and not processed for the following reasons including but not limited to

i. Duplicate requirement requests for CBP candidates; and

ii. Incorrect data formatting 1.3.

The Contractor shall provide a summary of requests processed and rejected within two (2) hours of receipt of the report request from CBP. This summary shall include, at a minimum:

iii. Number of fingerprint requests, listed by types of requests (i.e., new fingerprints, contact information change, and cancellation/discontinuation of scheduling);

iv. Number of fingerprint requests processed at each location.

v. Number of requests not scheduled or completed; and or rejected requests only:

a. Candidate’s name and CBP identification number.

b. Fingerprint date and;

c. If applicable, reason for rejection.

Task 2 – Scheduling Fingerprints

a. The Contractor shall provide a standard script of language for use in the scheduling process to the COR within fifteen (15) days of contract award. The script shall be approved by the COR prior to use.

b. The Contractor shall provide scheduling access to a web-based system on a 24 hour 7 days per week, 365 days per year basis.

d. The Contractor shall have the ability to provide an automated self-scheduling capability to allow candidates to elect date, time, and location for fingerprint collection and the ability for the candidate to cancel up to 24 hours prior to their appointment.

c. The system shall provide a way to communicate whether an appointment was cancelled by the candidate or by the Contractor.

1.3.1. In addition to the requirements above, standard script language shall include: Instructions to the candidate as to the necessary items required for the fingerprint process.

d. The Contractor shall be notified by CBP on a daily basis via vendor provided web-based portal or electronic exchange/web services regarding the fingerprint requests to be scheduled or cancelled. The following data will be provided:

i. Candidate name, contact information (including up to three (3) phone numbers and one (1) email address), and current address for scheduling location purposes;

ii. CBP’s fingerprint identification numbers, and candidate identification numbers (including CBP-specific candidate ID number and/or social security number);

iii. Position; and

iv. Candidate address changes, and candidates that need to be removed from the scheduling process as they are no longer being considered for positions.

e. Candidates who are no longer being considered by CBP, no longer on a contract with, or no longer current employees of CBP shall not be fingerprinted.

e. Within one (1) business day of receiving the fingerprint request, the Contractor shall identify the potential facility for the candidate to have their fingerprints captured and make the first contact attempt to schedule the process.

i. The Contractor shall provide the candidate with a unique barcode or ID number that they are expected to provide at their appointment along with two forms of government issued identification.

ii. The Contractor shall use telephone/voicemail, email communication, and SMS text messaging when attempting to contact the candidate to schedule the fingerprint requirement.

iii. Within three (3) business days of the initial request, the Contractor shall coordinate the scheduling of the fingerprints with the candidate and the facility to be administered as follows:

a. The Contractor shall offer fingerprint appointments at least five (5) days per week.

b. Fingerprinting shall be administered within ten (10) business days of the request from CBP.

iv. If the Contractor is unable to schedule an appointment within the required timeline, the Contractor shall notify the COR within twenty-four (24) hours of making the determination via the Contractor’s web-based portal.

a. “Hard to reach” candidates are individuals whom the Contractor has been unable to reach after a minimum of three (3) documented attempts, on three (3) separate days, using all telephone numbers and email addresses available. The Contractor shall not close requests for at least two (2) business days following the third attempt to contact the candidate.

i. The Contractor shall make a minimum total of three (3) contact attempts on three (3) separate days using all provided telephone numbers and email addresses. These contact attempts shall be made at different times of the day before identifying a candidate as “Hard to Reach.”

ii. The Contractor shall make, at a minimum, one (1) contact attempt using each method of communication provided by CBP before identifying a candidate as “Hard to Reach.”

b. The Contractor shall inform the COR via web services when a requested service is unable to be scheduled. Notification shall be sent within twenty-four (24) hours of making the determination that the service cannot be scheduled. The reasons for failure to schedule a service shall be clearly documented. Examples include: refusal to schedule; candidate is unable to complete fingerprinting within the specified time frame; candidate is “Hard to Reach”; candidate is no longer interested in the position, is on leave, or is on Temporary Duty Assignment (TDY).

v. Within twenty-four (24) hours of scheduling the appointment, the Contractor shall send the candidate an email providing the appointment information, facility location, and any items the candidate is required to complete and bring to the appointment. The Contractor’s standardized email language shall be provided to the COR within fifteen (15) business days of award and shall be approved by the COR prior to use.

One (1) business day prior to the appointment date, the Contractor shall send the candidate a reminder email and SMS text message providing, at a minimum, the scheduled appointment information, facility location, and a reminder to bring the unique barcode or ID number that was provided by the Contractor to their appointment along with two forms of government issued identification. The email language/text message shall be provided to the COR during transition in and shall be approved by the COR prior to use.

If the candidate does not attend the scheduled appointment without prior notification to the Contractor, the candidate is deemed a “No Show.” At the time, the Contractor documents the No Show in the Contractor’s automated system, an email shall be sent to the candidate providing instructions to contact CBP for applicants and OPR for candidates due to the No Show. The email language shall be provided to the COR during transition in and shall be approved by the COR prior to use.

Task 3 – Processing and Submitting Fingerprint Results

a. The Contractor shall provide a mechanism whereby CBP can retrieve the electronic fingerprint file in CBP’s prescribed file format for processing and forwarding to the Office of Personnel Management (OPM) or the Defense Counterintelligence and Security Agency (DCSA):

i. The Contractor shall provide a web service delivered document indicating the number of fingerprints transmitted to the information system on a daily basis.

b. All documentation shall be forwarded, without error, electronically to CBP via web services as soon as submitted to the delegated system and as soon as confirmation of receipt has been received.

c. Electronic Fingerprint files, along with all associated candidate data, shall be available via the Contractor’s automated system within one (1) business day of the capture date.

d. The Contractor shall retain electronic copies of all fingerprint files to the extent required to comply with this SOW’s document retention requirement.

Task 4 - Web Services and Data Reporting Requirements

a. The Contractor shall maintain a web-based data system, accessible remotely by CBP employees and contractor personnel that enables the user to chronicle all attempted and actual communication between the Contractor and the candidate, as well as fingerprint status. The data system shall have the capability to allow the Contractor to input candidate information and date of fingerprint capture, and for CBP to retrieve those results. Additionally, the system shall have the capability to produce ad hoc, weekly, and monthly reports for capturing the status of fingerprint capture and scheduling status.

b. The Contractor shall electronically exchange fingerprint status with CBP. Data sent via web services and in the web portal shall be in real-time. This electronic exchange of fingerprint information includes:

i. All scheduling data;

ii. Appointment attendance data;

iii. Fingerprint capture data;

iv. CBP ability to request an additional scheduling attempt;

v. CBP ability to authorize the release of fingerprints to DCSA/OPM; and

vi. Billing information.

c. The Contractor shall encrypt all Personally Identifiable Information (PII) information prior to sending to CBP via email. CBP shall approve the encryption prior to use according to encryption guidelines.

d. The Contractor shall maintain an automated database system accessible remotely by the COR and authorized CBP employees and contractor personnel which permits access to specific information about each fingerprint request received by the Contractor from CBP. The information available shall include:

i. The current status of a fingerprint requirement at any time and the dates that key events occurred in the process to include but limited to;

a. The date the fingerprint appointment was requested

b. The date the fingerprint appointment was completed

ii. Date fingerprinting was requested;

iii. Candidate contact information used by the Contractor (including phone numbers, email address, zip code, and any other contact information used in the scheduling process);

iv. All correspondence with the candidate (including but not limited to: contact attempts by the Contractor to the candidate, date calls were returned by the candidate, date materials/forms were sent to candidate, etc.);

a. Appointment date and time;

b. Verification of appointment attendance;

c. “Hard to Reach” or “No Show” designations as applicable;

d. CBP identification numbers associated with the fingerprint requirement; and

e. Any other data items that provide information on the status of the request.

e. The Contractor’s database system shall have the capability of transmitting all fingerprinting information via Web Services and allow all information to be uploaded into CBP’s automated systems daily.

f. The Contractor's database shall be accessible to the COR or other designated authorized CBP employees and contractor personnel to query as needed.

g. The technical and security requirements of Web Services are discussed in the Security section of this SOW.

6. DELIVERABLES

a. Security Deliverables

i. See Security section of this SOW for more detail on these documents. The following shall be submitted to the COR within 30 days of BPA award (initial report), and throughout the life of the BPA/Task Order as stated in the table below:

b. Quality Control Plan (QCP)

i. Performance measures are based on the services required by this SOW and all attached documents. See below chart that includes but is not limited to the performance measures for this BPA/Task Order:

Performance Measures Chart

1. Provide facilities equipped for capturing electronic fingerprints in the forty-eight (48) continental United States as well as Washington, DC; Alaska; Hawaii; Puerto Rico; U.S. Virgin Islands; Guam; and, Saipan

2. Complete fingerprinting requirement within sixty (60) highway-mile radius of a candidate’s address.

3. Each facility meets minimum specification requirements set forth in the SOW.

4. Process electronic scheduling requests in accordance with the SOW.

5. Schedule a varying volume of requirements within the timeframes required in the SOW.

6. Provide, maintain, and protect from disclosure a data system accessible remotely by CBP to request, track, manage, and deliver electronic fingerprint data in accordance with the SOW.

7. Provide web services according to the data and reporting requirements of the SOW.

8. Ensure appropriate security of IT resources that are developed, processed, or used under this Contract in accordance with the SOW.

9. Adhere to the Contractor’s Transition Plan.

10. Perform all services at the acceptable quality level by the end of the transition period as described in this SOW.

11. Assign key personnel that meet the required qualifications of the SOW.

12. Provide sufficient non-key personnel as required.

13. All personnel perform duties and complete tasks as required in this SOW.

14. Adhere to the Contractor’s Quality Control Plan, meet performance measures and acceptable quality levels as required, and meet or exceed the minimum QCP requirements of the SOW.

15. If applicable, adhere to the plan that has been agreed upon by CBP for subcontracting with small and small disadvantaged businesses, in accordance with the Subcontracting Plan Outline and established procedures to monitor and control the subcontracting effort.

a. The acceptable quality level for this BPA and Task Orders is 95% - all information and fingerprint administration services from the Contractor shall be at least 95% accurate. The Quality Control Plan shall include measures (see chart above) for the Contractor to achieve all performance goals. The Contractor shall be responsible for the quality and timely completion of all services.

i. The Contractor’s Quality Control Plan shall include, at a minimum:

a. All items addressed in the Performance Measures Chart in this SOW;

b. Monitoring the performance of all subcontractors, including:

i. Process for identifying and correcting errors/deficiencies and an error rate not to exceed five (5) percent for work completed by subcontractor(s);

ii. Verifying the qualifications and training of all staff;

iii. Monitoring pending fingerprint requirements and follow-up to ensure the completion of services within required timeframes; and

iv. Verifying candidate attendance at scheduled appointments and ensuring that what is reported back to the Contractor from the subcontractors is accurate.

c. Monitoring the primary Contractor’s performance (including Key Personnel);

d. Contingency plan(s) for emergency operations when the Contractor's and/or subcontractor's services are impacted by natural disasters, severe weather, pandemics, etc.;

i. Contingency plan(s) for loss of information and security breach;

ii. Detailed Plan for adhering to required deadlines;

iii. The Contractor’s security procedures;

iv. Detailed procedures to review and correct data entry errors in automated systems; and

v. Systems to review all information for completeness and accuracy prior to submission to CBP.

ii. Monthly teleconference meetings with the Contractor shall be scheduled to discuss quality control and performance issues. Contractor’s attendance shall be at the Contractor’s expense.

a. The Contractor shall resolve any issues in accordance with this SOW.

b. The Contractor’s quality control effectiveness shall be noted in the annual performance evaluations.

b.

c. Reports

i. The Contractor shall submit all reports to the COR within three (3) business days of the request unless otherwise specified in this SOW.

ii. All reports shall be written to CBP's specifications and shall be provided electronically via the Contractor’s automated database system and a format prescribed by CBP. The Contractor shall retain electronic copies of all data to the extent required to comply with this SOW’s document retention requirement.

iii. The Project Status Report shall be provided no later than the tenth (10) day of each month containing data from the previous month. This report shall also be provided ad hoc with updated data for a given date range as requested by the COR. The report shall include, at a minimum, the following information separated by position for the given reporting period:

a. Status of all fingerprints for all candidates;

b. A total number of fingerprints captured per date, and the cumulative number of requests ordered for the given reporting period;

c. Total number of fingerprints captured per date, and the cumulative number of requests completed for the given reporting period;

d. Number of fingerprints invoiced;

e. Number of fingerprints closed without invoicing due to inability to contact the candidate(s) (“Hard to Reach”);

f. Number of fingerprints closed without invoicing due to the candidate(s) failure to attend their appointment (“No Show”);

g. Number of fingerprints closed without invoicing for other reasons;

h. Complaints received from candidates (including type of complaint and facility) and final resolutions; and

i. Number of fingerprints that have been ordered but not billed (i.e., “open” requests).

iv. The Contractor shall provide additional ad hoc reports as requested by the COR. If the need for a particular report becomes frequent, the report shall be available on an ongoing basis

a. The COR may request on occasion that the Contractor query its database for other statistical reporting. If the need for a particular report becomes more frequent, the COR may request that the report be made available on an ongoing basis to either be sent directly from the Contractor’s personnel to the COR or to be accessible on the Contractor’s data system that can be accessed remotely at any time.

d. Other Deliverables

i. Scheduling scripts; and

ii. Standardized email language. (See Section 5, Task 2, letter e numeral v.)

16. GOVERNMENT-FURNISHED INFORMATION AND EQUIPMENT (GFE/GFI)

a. There is no Government Furnished Equipment for this BPA. All Contractor equipment is subject to the requirements outlined in Section 10, Security.

b. The Government shall provide contact information of candidates and location of candidates for scheduling purposes.

17. PLACE OF PERFORMANCE

a. The Government shall not provide the Contractor with a work site(s). The Contractor’s administrative/business office shall be at any location(s) in the United States; as for the radius requirement noted herein, only the facilities where the Contractor will perform the services shall be located within the required proximity to the candidates’ work/home address.

b. The Contractor shall provide the fingerprinting facilities in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

18. SECURITY

a. The Contractor is fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance).

b. The Contractor has a responsibility to protect the information it possesses and processes; and to ensure that the security of the information in its charge, the Contractor shall adhere to the same rules and regulations as Government employees.

c. All services provided under this BPA must be compliant with DHS Information Security Policy, identified in DHS Directive140-01, Information Technology Security Program and 4300A Sensitive Systems Handbook.

d. Security Clearances: Personnel Security Background Data

i. Performance under this BPA is considered sensitive but unclassified and a security clearance is not required.

e. Security Requirements for Unclassified Information

i. The Contractor shall ensure that all information obtained in this Contract remains confidential and is not disseminated outside of CBP. All contract documents, records, and Personally Identifiable Information shall be stored in CBP approved secured locked, fireproof filing cabinets and in a secured room that is not accessible to the public or visitors. The Contractor shall take necessary precautions to ensure that all additional information is properly secured to prevent unauthorized access at all times. The Contractor shall comply with the DHS Handbook for Safeguarding Personally Identifiable Information as amended.

f. Sensitive Personally Identifiable Information (PII)

i. Sensitive PII information shall be provided to Contractor by the Government during this BPA/Task Order. When a Contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor shall Accredit (ATO) this information system to the (HHM) FIPS level. The Contractor and subcontractors shall have access to PII such as subject’s names, addresses, telephone numbers, e-mail addresses, date of birth, etc. Only the Contractor and its subcontractors with authorization and only on a need-to-know basis shall access this information. All Sensitive PII Information shall be stored in accordance with requirements by Office of Professional Responsibility (refer to HB 1400-05D attachment). The Sensitive PII information shall be transmitted electronically and encrypted as required in this SOW.

Contingency and Incident Response Plans

ii. The following plans shall be created in accordance with the requirements identified in the DHS/CBP Security documentation, and the guidelines from the National Institute of Standards and Technology (NIST). NIST documentation can be found at: http://csrc.nist.gov/publications

a. Contingency Plan

i. Contingency plans provide guidance on the interim measures to recover information system services after a disruption and may include the relocation of information systems and operations to an alternate site, recovery of information system functions using alternate equipment or the performance of information system functions using manual methods. The Contractor shall provide a plan that contains the detailed guidance and procedures for restoring a damaged system based on the impact levels and recovery requirements.

iii. Incident Response Plan

a. Incident Response plans provide guidance on the appropriate procedures and responses to an incident and the capabilities required to successfully, efficiently, and effectively handle an incident. It encompasses all actions taken to quickly restore normal IT service and to minimize impacts on business operations.

b. The Contractor shall ensure that all privacy and computer security incidents are identified, reported, and appropriately responded to, in order to mitigate harm to DHS/CBP assets, information, and personnel. Privacy incidents must be reported to the CO and COR as soon as possible, but no later than within one (1) hour of recognition that a privacy incident occurred. All privacy incidents must be reported whether or not they involve information resources.

g. Security Breach

i. If a security breach occurs, in accordance with the Contractor’s Incident Response Plan, the Contractor shall notify the CO and COR within one (1) business day of recognition that a security breach occurred. Within five (5) additional business days the Contractor shall issue and provide a report to the COR and CO detailing the research conducted by the Contractor, conclusions, and preventive measures that will be taken going forward. The Contractor shall also notify the affected candidates and provide the list of those affected to the COR along with copies of the notification from the Contractor to the affected candidates. The Contractor shall provide, at the Contractor’s expense, identity and credit monitoring services to the affected candidates for no less than 18 months.

h. Document Retention

i. The Contractor shall maintain electronic copies of the associated documentation until OPR confirms receipt and completeness of the transmitted records, at which time the Contractor shall then have 90 days to delete the Contractor’s copies. This is in compliance with General Records Schedule 4.2, item 130. Formal Task Order closeout shall include the CBP Office of Information Technology overseeing the Contractor destroying all data, as required by CBP regulation, which was obtained and retained per this contract.

i. Contractor Representation

i. In correspondence, all Contractor and subcontractor employees must identify themselves as contractors and subcontractors operating on behalf of CBP. E-mail signatures must adhere to the format set out in the CBP Clause Additional Contractor Personnel Requirements.

j. Security Assessments, Reviews and Reporting

i. Security is an integral element in the management of this BPA/Task Order. The Contractor shall conduct assessments, reviews and report the status of the implementation and enforcement of the security requirements contained in this BPA/Task Order.

ii. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this BPA/Task Order are being implemented and enforced. The Contractor shall afford the Office of the CBP Chief Information Security Officer (CISO) and/or representatives of the CISO, access to the Contractor’s (and subcontractor’s) facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

k. Web Services

i. The system or application delivered by the Contractor shall provide Web Services functionality (in accordance with Federal security and privacy guidelines) that shall allow for the exchange or sharing of functions and data within its system to and from DHS and CBP owned or contracted systems.

ii. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

iii. Authorization from CBP shall be granted before sending any miscellaneous documentation that needs to be submitted to CBP outside of a web service interface (i.e., via e-mail).

iv. Data input into Contractor systems are owned by DHS and CBP and must be delivered upon demand or at the termination of the contract, in an electronic file format specified by CBP. Upon the completion or termination of a contract and delivery of DHS’/CBP’s data as described, Contractors are required to destroy their local copies of the data upon approval by CBP.

v. Web Services Requirements

a. The Contractor shall complete all electronic data transfers using web services. This requirement applies to both data provided to and from CBP.

b. Any and all data that is collected, generated, and/or tracked in the vendor system, must be exposed for integration via web service(s) and are to include relationship and unique identifiers.

vi. Technical Requirements of Web Services

a. All Contractor supplied data shall be made available via secure web services, including invoices. This data shall be accessible via a single web service that returns data in an agreed upon XML format. The web service shall accept filter criteria such as an effective date.

b. CBP and the Contractor will define the data needed to be exchanged or shared, the data file formats, the web services exchange mechanism and Application Program Interfaces (APIs) and architecture, as well as the periodicity (up to and including instantaneous, bi-directional data feeds between the Contractor system and CBP systems or databases).

c. Data requirements will change over time, but changes will not exceed four (4) times in a calendar year. The Contractor shall be required to modify their systems to be compliant with CBP changes, within thirty (30) calendar days of being notified of the change(s).

d. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

e. The Contractor’s web service shall conform to the following technical requirements:

i. The web service shall be WS-I Basic Profile 1.1 compliant;

ii. The web service shall be secured via TLS and AES-256 bit encryption;

iii. The web service shall provide an authentication mechanism that ensures only authorized requests are processed;

iv. The web service shall execute requests within one second;

v. The web service shall execute against and return current, up to date data;

vi. The web service shall be available for use at all times, 24 hours per day, seven days per week;

vii. The Contractor shall submit a detailed description of its web service using a standard WSDL x document;

viii. The Contractor shall provide an XML schema to describe the result set returned by the web service;

ix. The Contractor shall provide detailed explanation for any error condition that may be raised as a result of web service operation;

x. The Contractor shall provide a list containing all possible error codes and a detailed description of each error; and

xi. The Contractor shall provide end use documentation for its web service.

vii. Web Services Expectations

a. The Contractor shall obtain and adhere to detailed requirements that define:

i. Web Service method signatures;

ii. Input Parameters (filter criteria);

iii. Output fields;

iv. XML Schema of the results set returned by web service; and

v. Any additional business rules.

b. CBP shall be given the opportunity for acceptance testing of the Contractor provided web service.

c. The COR shall be notified a minimum of two (2) weeks prior to any modifications made to the web service; final approval by the COR shall be required before implementation.

d. All production versions of the deployed web service shall be available in production and removed only upon request from CO or with CBP’s explicit permission.

e. The COR shall be notified at least 24 hours in advance of any web service maintenance that shall require web service down time. During downtime, fingerprint results shall still be made available to the COR in an agreed method. The method shall be agreed upon after award, during initial transition meetings.

f. The Contractor’s web service support shall have a response time of 24 hours or less; however, the Contractor’s web service support personnel do not need to be available 24 hours per day, seven (7) days per week.

g. Safeguards shall also be put in place to protect the PII.

19. OTHER CONSIDERATIONS

a. Transition Process

i. The transition period shall begin once the BPA is awarded and shall be completed no later than 60 days after the BPA is established. After the transition period, the Contractor shall be fully capable of executing all services required in this SOW. Once ordering starts, CBP may continually request fingerprints without breaks in ordering, subject to hiring requirements and the availability of funds.

ii. The Contractor shall complete the following during the transition period:

a. Performing personnel security clearances/checks to the extent required by the BPA;

b. Training all facilities and administrators performing the fingerprint process;

c. Testing and modification as necessary of automated database system;

d. Testing and modification as necessary of files for web services data transfers;

e. Testing and modification as necessary of files for electronic invoices;

f. Review and acceptance of all standardized materials received from authorized CBP staff;

g. Provide an overview of all reports the Contractor has available for the Government; and

h. Access for all authorized CBP and Contract personnel to the Contractor’s remotely-accessible automated database system and any secure e-mail systems, etc. The COR shall provide information on CBP and Contract personnel that shall be granted this access.

b. Hours of Operation

i. The Contractor’s customer service representatives, key personnel and other contractor personnel involved in scheduling fingerprints, shall be available from at least 9:00 am to 5:00 pm Eastern Time, Monday through Friday, except on Federal holidays.

ii. Fingerprinting shall be conducted at least five (5) days per week at a minimum of 8:00 AM to 5:00 PM local time for all time zones. The Contractor shall provide the COR with contact information, including the telephone numbers of the Program Manager and relevant corporate personnel, to enable CBP to reach them before, during, and after business hours.

c. Meetings and Travel

i. The Contractor shall be responsible for all travel costs required in completing this BPA/Task Order. This includes travel costs associated with establishing facilities, training and attending meetings.

ii. Quarterly meetings with the Contractor shall be scheduled to discuss overall BPA/Task Order quality control and performance issues as well as other items deemed appropriate to the Government.

iii. More frequent meetings may be required to address general contract issues, modifications, or other items deemed appropriate by the Government and/or Contractor.

iv. Meetings may occur either by telephone or teleconference

d. Contractor Personnel

i. Key Personnel - Program Manager

a. The Contractor shall designate a Program Manager to serve as the main point of contact for this BPA and shall designate individuals to serve as back-up to cover absences.

b. The Program Manager shall possess a minimum of three (3) years of experience supervising and managing staff. The Program Manager shall also have a minimum of two (2) years of experience working in a fingerprinting or background Investigation related program.

c. The Program Manager shall be responsible for the following items:

i. Ensure the Contractor has a sufficient number of Government approved fingerprint facilities and trained administrators;

ii. Conduct training and quality assurance facility visits at all approved sites; and

iii. Ensure all candidate complaints are fully addressed and resolved in coordination with the COR.

e. Pre-employment Services Invoicing Requirements

i. General Invoicing Requirements: Electronic Invoicing – Invoice Processing Platform (IPP)

a. The Contractor shall submit electronically through the U.S. Department of Treasury’s IPP an invoice for the services rendered the previous month. The Contractor shall document on each invoice, the specific month and the year for which payment is being requested.

b. In order to avoid invoice rejections, the Contractor’s finance department shall send an advance copy, in an agency compatible format and software (e.g. Microsoft Word, Excel, PDF) as prescribed by CBP, to the COR for reconciliation prior to submission.

c. All corrected invoice cover sheets shall have the invoice date corrected to show the date the correction is submitted.

d. The Contractor shall invoice only for fingerprints completed and received by CBP and shall certify that the costs in the invoice are accurate and complete.

e. The Contractor is required to provide a report within each invoice that separates the quantity and price of services being billed for each applicant/candidate/employee category. Each category on the report shall list all service types and the respective quantity. If the Contractor has questions regarding which candidates should be included in a billing category, the COR shall provide the information. The category report shall include the following distinctions:

i. Employee

ii. Contractor

iii. Applicant

f. The Contractor shall retain electronic copies of all invoices through the end of the contract.

g. The Contractor shall invoice services based on the date which the services were requested. CBP shall not be invoiced for services that are performed incorrectly, or have other Contractor uncorrectable error scenarios as previously outlined in this SOW.

i. Deliverables completed no later than 30 days after the SOW requirement will be invoiced at 100% of the full amount.

ii. Deliverables completed later than 30 days after the SOW requirement, but within 45 days of SOW requirement will be invoiced at 75% of the full amount.

iii. Deliverables completed later than 45 days after the SOW requirement, but within 60 days of SOW requirement will be invoiced at 50% of the full amount.

iv. Deliverables completed later than 60 days after the SOW requirement will not be invoiced.

h. Initial acceptance shall occur when the COR certifies the invoice.

i. If defects in the products provided by the Contractor are found after certification of the invoice, the Contractor shall be required to re-perform the service or complete the service as originally required at no additional cost to the Government.

ii. Defects may include, but are not limited to, failure to transmit to CBP or missing information.

i. In the event defects are discovered, the Contractor is required to complete unfinished items or re-work by scheduling any necessary appointments related to the deficiency and take any other actions necessary to complete the collection per the contract requirements.

j. If it is discovered that staff was not correctly performing the requirements, the Contractor shall complete re-work unless otherwise notified by the COR, at no cost to the Government.

k. Re-work of services is required to be completed as soon as possible. Unless otherwise stated in this SOW, any appointments needed for re-work must be scheduled within five (5) business days of notification to the Contractor of the deficiency or later if the candidate is not available for appointments until a later date.

l. The COR shall be notified of the rescheduled appointment(s) information. The final product of the re-work must be completed and returned to CBP within two (2) business days of the appointment.

ii. Technical Invoicing Requirements

a. The Contractor shall submit monthly invoice statements. Each invoice cover sheet shall include, but not be limited to, the following:

i. Unique Invoice number

ii. Invoice Date

iii. Type of service performed: Fingerprinting

iv. Number of fingerprints captured for each line item and the dollar amount for each fingerprint capture

v. Cumulative dollar amounts for each line item

vi. Name of the candidate

vii. CBP Candidate ID number

viii. Location of facility/facility number

ix. Price of services performed

x. Date the service was requested

xi. Date the results were sent to CBP

xii. BPA number and Task Order number

xiii. Name and address of the contracting official to whom payment is to be sent (must be the same as stated in the contract or in a proper notice of assignment).

xiv. Contractor's Name

xv. Contractor's Mailing Address Name

xvi. Taxpayer identification number (TIN)

xvii. Electronic funds transfer (EFT) banking information

xviii. Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice

b. Invoices that fail to provide the information required by the Prompt Payment Act (FAR 52.212-4 (Deviation 25-21)) may be rejected by the Government and returned to the Contractor.

f. Section 508 Requirements

a. Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

b. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and…