22IT55-SOC-001.PWS.FY23CybersecurityEscapeRoom.rev1.pdf

PERFORMANCE WORK STATEMENT (PWS)

For

USDA’s Information Security Center (ISC) Cyber Security Expo, Licenses, Training, and Support

Table of Contents

1 INTRODUCTION

2 BACKGROUND

3 OBJECTIVES

4 TYPE OF AWARD

5 SCOPE OF WORK

6 PERFORMANCE REQUIREMENTS

6.1 Cyber Security Support Services

6.2 Document Deliverable Requirements Summary

6.3 Core working hours

6.4 Place of Performance

6.5 Cyber Security Support Services/Site Supervision

7 DEFINITION/ACRONYMS

7.1 General Definitions

7.2 Acronyms

8 PERIOD OF PERFORMANCE

8.1 Cancellation of Contract Due to Non-Satisfactory Performance

8.2 Government Furnished Equipment (GFE)

8.3 Contractor Furnished Items:

9 QUALIFICATIONS OF PERSONNEL

10 REQUIRED DELIVERABLE DOCUMENTATION

10.1 Section 508 Accessibility

10.2 Section 508 Compliance

10.3 WCAG 2.0 Compliance

10.4 Compliance with Internet Protocol Version 6 (IPV6) in Acquiring Information Technology 14

11 PERFORMANCE REQUIREMENTS

12 USDA ROLES AND RESPONSIBILITIES

12.1 Authorized Ordering Officials

12.2 Contractor Roles and Responsibilities

12.3 Security

1 INTRODUCTION

The intent of this Performance Work Statement (PWS) is to obtain cyber security training and support services for the United States Department of Agriculture (USDA), Office of the Chief Information Officer (OCIO) and Information Security Center (ISC) program by means of a performance-based contract. The Contractor will provide cyber security Escape Room online events and training content.

2 BACKGROUND

The Department and OCIO supervise and coordinate the design, acquisition, maintenance, use, and disposition of information and information technology (IT) by USDA agencies. Within the OCIO, ISC is designated as the Department’s authority for cyber security. ISC is responsible for enterprise-wide planning, implementation, management, and maintenance of USDA cyber security programs. In support of ISCs USDA-wide security focus, this requirement is to provide ISC with additional cyber security training and support USDA-wide.

3 OBJECTIVES

The Contractor will provide the staff necessary to perform the following:

• Provide one (1) year license for content and support of Living Security's Cyber

Escape Online Teams for up to 1000 users.

4 TYPE OF AWARD

The USDA intends to award a Firm Fixed Price contract.

5 SCOPE OF WORK

The Contractor shall provide Escape Room online content and support for up to 1,000 users as well as a one-day online hosted event for OCIO ISC. These services include providing the necessary technical and business specialties to augment and enhance the goals, performance and mission capabilities of OCIO ISC in the area of cyber security training.

6 PERFORMANCE REQUIREMENTS

The Contractor will provide all supervision, administration and technical support, labor supporting online event, tools, materials, supplies (except as otherwise provided), and shall plan, schedule, coordinate and assure effective completion of all services described herein services:

6.1 Cyber Security Support Services

The Contractor will provide licenses and cybersecurity exercises/activities to help train and educate the USDA employees and contractors.

Licenses

Living Security Cybersecurity Awareness Month License Renewal - The vendor will provide licenses (for up to 1000 users) highlighting new hire training, phishing remediation, and CSAM.

This renewal will include:

• All current and future storylines that come out during your license

• Leaderboard to track completion times

• Access to Living Security digital puzzles

• Access to Living Security's Teams App

• Retention Quiz and Feedback Survey

• Internal event marketing kit

• Option to run sessions with or without a moderator

• One key-note speaker session: live, 45-60 minute presentation (choose 1 of 3 options)

• One family-friendly event with a mentalist

• Standalone puzzles through LS Training

• CSAM Kick-off with a Living Security Immersive Training Series

• CSAM marketing material and contact plan

• Gamification Plan with Leaderboard and Bonus Codes *if using LS Platform

• Metric Recap Session: 30 minute session with Living Security to review metrics, insight, and risk reporting during CSAM.

*Also includes a bonus track on Protecting Your Digital Identity

Living Security Training: Year-Round Campaign in a Box License - Monthly “Campaign in a Box” focused on a central theme, to help promote your training, reinforce concepts, keep users engaged, and security top of mind.

Each monthly box contains:

• Access to up to 2 Living Security recommended video modules related to monthly theme- Video content can be hosted through Living Security's gamified platform or hosted on the client's LMS.

• Marketing support via “Campaign in a Box” focused on a central theme, to help promote your training, reinforce concepts, keep users engaged, and security top of mind. This support contains:

o Newsletter focused on a central theme o Email templates to drive weekly engagement o Chat messages with GIFs o Blogs for your intranet sites o Messaging that provides thought leadership and personal relevancy o Editable versions delivered so you can wrap your brand and messaging around the content

Training Exercises/Activities

The online cybersecurity activities will be customized to the security tenants and risks that the customer wishes to focus on. It will begin with an understanding of the cyber risks and threats that Customer’s cybersecurity personnel are most concerned about. This will include puzzles and challenge questions that relate to these threats and risks identified through the process.

The in-game training moments and challenge questions are customized to customers’ IT/Security policies and messaging to provide consistency with the security program. The customer will be introduced to security and policy related questions throughout the gameplay, these questions will correlate against Customer’s policies and security response messaging.

6.2 Document Deliverable Requirements Summary

The Contracting Officer Representative (COR) should receive copies of all deliverables in this contract and either the COR or IT Acquisitions Program Manager (PM) will be responsible for invoice certification. The Contractor will prepare and deliver all products and services cited in the PWS including but not limited to the following documents:

• Cybersecurity event completion report

6.3 Core working hours

Unless otherwise specified in each task order, the core working hours of operation will be 6:00 am until 6:00 pm local time of the respective location. A normal workweek is Monday through Friday, except Federal Holidays. The Contractor may perform work on Saturdays, Sundays, holidays, or outside regular working hours, if approved in writing by the COR. Any such work shall be performed at no additional cost to the Government.

6.4 Place of Performance

The work and activities to be performed under this contract will be virtual/online.

6.5 Cyber Security Support Services/Site Supervision

The Department, OCIO, and ISC employees are not required nor authorized to exercise either direct or indirect supervision over the Contractor’s employees.

7 DEFINITION/ACRONYMS

As used throughout this contract, the following terms shall have the meaning set forth below and specified as applicable to this contract.

7.1 General Definitions

Acceptable Quality Level (AQL): The standard at which service is considered satisfactory as agreed upon by the Contractor and Government.

Additional Services: Services intended to satisfy the Government’s short term, non-recurring need at a fixed hourly rate, and as required, material cost

Alternate Dispute Resolution (ADR): Process for the resolution of disputes regarding work determined to be unsatisfactory.

Basic Services: Those recurring services provided at the facility in addition to performance of support services as defined in this contract

Committee for Purchase from People who are Blind or Severely Disabled: Federal agency responsible for administering the AbilityOne program, a mandatory source program.

Contractor: Refers to both the prime Contractor and any subcontractors. The prime Contractor shall ensure that his subcontractors comply with provisions of this contract.

Contracting Officer (CO): One with the authority to enter into, administer, and/or terminate contracts and make related determinations.

Contracting Officer’s Representative (COR): One who is designated and authorized in writing by the CO to be responsible for surveillance/monitoring of the Contractor’s performance.

Contractor Owned Property: All property used on this contract that is owned or furnished by the Contractor.

Contract Representative/Project Manager: An onsite supervisor assigned by the Contractor to manage the project.

Customer Comments: A means for end users to provide comments pertaining to service provided by the contractor.

Defective Service: A service output that does not meet the standard of performance associated with it in the Performance Requirement Summary (PRS).

Department: United States Department of Agriculture

Government Owned Property / Government Furnished Equipment (GFE)/Government Furnished Information (GFI): All property/equipment/information owned by or leased to the Government or acquired by the Government under the terms of the contract. Government property/ equipment includes both Government-furnished property / equipment and Contractor acquired property / equipment as defined by FAR 45.101.In order to access USDA/OCIO email and office applications, a USDA/OCIO laptop computer is provided to contractor staff as GFE.

Performance Requirements: Tasks to be performed by the Contractor.

Performance Requirement Summary Table (PRST): An outline of contract requirements that identifies the key services outputs of the contract that will inspected or surveyed by the Government, and related performance standards, method(s) of performance assessment and surveillance, and portion of required service to total contract value.

Performance Standard: The desired results, expressed by the Government, expected from performance of contract services, to satisfy the requirement.

Quality Assurance (QA): Those actions taken by the Government to assure services meet the acceptable quality level established by the contract between the Contractor and Government.

Quality Assurance Surveillance Plan (QASP): An organized written, “living,” document outlining the Government’s methodology for monitoring contractor performance.

Quality Control: Those actions taken by the Contractor to ensure contractor performance meets the requirements of the contract.

Response Time: The time allowed the Contractor after initial notification of a work requirement to be physically on the premises at the worksite, with appropriate tools, equipment, and materials, ready to perform the work required.

Support Services: Performance of unscheduled services that are brief in scope.

7.2 Acronyms

CO Contracting Officer COOP Continuity of Operations COR Contracting Officer’s Representative COTR Contracting Officer’s Technical Representative COTS Commercial, Off-the-Shelf CPI Cost Performance Index CPIC Capital Planning and Investment Control DHS Department of Homeland Security EIT Electronic and Information Technology ET Eastern Time FAR Federal Acquisition Regulations FIPS Federal Information Processing Standard FISMA Federal Information Security Management Act of 2002 FMFIA Federal Managers Financial Integrity Act of 1982 FPS Federal Protective Service FY Fiscal Year GAO Government Accountability Office GFI Government Furnished Information GSA General Services Administration HSPD Homeland Security Presidential Directive ID Identification ISC Information Security Center IT Information Technology NIST National Institute of Standards and Technology OCIO Office of the Chief Information Officer OIG Office of the Inspector General OMB Office of Management and Budget OPPM Office of Procurement and Property Management PM Program Manager POD Procurement Operations Division PWS Performance Work Statement RFQ Request for Quotation SBU Sensitive but Unclassified SDLC System Development Lifecycle TS Top Secret US United States

USDA United States Department of Agriculture VAC Variance at Completion WAR Weekly Accomplishment Report WBS Work Breakdown Structure

8 PERIOD OF PERFORMANCE

The term of this PWS will be one year from date of award.

8.1 Cancellation of Contract Due to Non-Satisfactory Performance

USDA reserves the right to cancel the PWS if a contractor is not providing the best value due to performance problems with the Contractor. The PWS may be cancelled by the Government upon its determination that the Contractor cannot resolve such issues within a period of 5 business days.

If performance issues are not resolved within 7 business days, the Contractor shall be given notice of the Government’s intent to terminate the Contact within 10 business days, and a project management review meeting shall be held to discuss the Contractor’s plan of action. If the Contractor has not resolved the performance issues within the specified time period, the Contract may be terminated.

8.2 Government Furnished Equipment (GFE)

Access to any documentation on USDA security issues and systems necessary to perform work requested under this task is subject to USDA security policy and procedures.

8.3 Contractor Furnished Items:

The Contractor shall provide all licenses, equipment, materials, and services necessary to perform the requirements of this contract. The Contractor shall provide means of communication with the COR and project coordinator.

9 QUALIFICATIONS OF PERSONNEL

The Contractor shall be fully staffed on the first day of contract performance and prepared to maintain a fully trained staff throughout the life of the contract. The Contractor is required to provide necessary, on-going training in order to meet the performance standards in this PWS.

10 REQUIRED DELIVERABLE DOCUMENTATION

The Contractor will prepare and deliver all products and services cited in the PWS including but not limited to the following documents:

10.1 Section 508 Accessibility

All Electronic and Information Technology (EIT), as defined at FAR 2.101, supplied under task orders using this PWS must conform to the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology Accessibility Standards (36 CFR Part 1194). The applicable standards are available at: http://www.access-board.gov/sec508/508standards.htm.

This PWS is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Information and Communications Technology (ICT)1, the ICT must allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities.

(b) The ICT accessibility standards as 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board (also known as the Access Board) and apply to contracts, task orders, and indefinite quantity contracts on or after June 25, 2001.

(c) Each Information and Communications Technology (ICT) product or service furnished under this contract shall comply with the Information and Communications Technology Accessibility Standards (36 CFR 1194), as specified in the contract, at a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within a period specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

1) Cancellation of the contract, delivery, or task order, purchase or line item without termination liabilities; or

2) In the case of custom Information and Communications Technology (ICT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the non-compliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

(d) The contractor must ensure that all ICT products and services that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.

(e) For every ICT product or service accepted under this contract by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

10.2 Section 508 Compliance

1 Please note that the term Information and Communications Technology (ICT) is synonymous with Electronic and Information Technology (EIT), the previously used term. The term ICT will be used to meet international standards after the release of the Section 508 Refresh.

http://www.access-board.gov/sec508/508standards.htm

The Living Security shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this PWS, the PWS shall take precedence.

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

3) http://www.access-board.gov/sec508/508standards.htm (Section 508 standards)

4) FAR 39.2 (Section 508)

5) http://www.ocio.usda.gov/document/departmental-regulation-4030-001 (USDA standards, policies, and procedures for Section 508)

In addition, all contract deliverables are subject to these standards.

All web content or communications materials produced, regardless of format (text, audio, video, etc.), must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities. All contractors (including sub-contractors) and consultants responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the PWS shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the products and/or services identified in this

PWS:

• 36 CFR Part 1194.21 provisions a-l

• 36 CFR Part 1194.22 provisions a-p

• 36 CFR Part 1194.23 provisions a-k[4]

• 36 CFR Part 1194.24 provisions a-e

• 36 CFR Part 1194.25 provisions a-j[4]

• 36 CFR Part 1194.26 provisions a-d

• 36 CFR Part 1194.31 provisions a-f

• 36 CFR Part 1194.41 provisions a-c

The following Section 508 provisions apply for software development material identified in this

PWS:

For software development, software applications, and operating systems the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c http://www.ocio.usda.gov/document/departmental-regulation-4030-001

For web-based applications (intranet, internet information and applications, 16 rules), the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.22 provisions a-p

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For telecommunication products and services, the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.23 provisions a-k

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c

For video and multimedia applications (including training materials), the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.24 provisions a-e

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c

For self-contained and closed products, the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.25 provisions a-j

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For desktop and portable computers, the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.26 provisions a-d

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For help desk and other support services, the contractor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.31 provisions a-f

b. 36 CFR Part 1194.41 provisions a-c

If the help desk or other support services include training, contractor must also comply with the following standards, policies, and procedures in addition to 36 CFR Part 1194.31 provisions a-f and 36 CFR Part 1194.41 provisions a-c:

a. 36 CFR Part 1194.21 provisions a-l (installable and web-based training)

b. 36 CFR Part 1194.22 provisions a-p (web-based software)

All Information and Communications Technology (ICT) subject to the 36 CFR 1194 standards will have a Section 508 usability and acceptance test where Section 508 compliance will be validated. This test must be administered by a Federal Section 508 Testing Center.

All maintenance for Information and Communications Technology that requires upgrades, modifications, installations, and purchases will adhere to the Section 508 standards and 36 CFR 1194.

10.3 WCAG 2.0 Compliance

The Living Security shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this PWS, the PWS shall take precedence.

Custom ICT Development Services When contractor provides custom ICT development services pursuant to this contract, contractor shall ensure the ICT fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance.

Installation, Configuration, and Integration Services When contractor provides installation, configuration, or integration services for equipment and software pursuant to this contract, the offeror shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised 508 standards.

Maintenance, Upgrades, and Replacements Contractor shall ensure maintenance upgrades, substitutions, and replacements to equipment and software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 standards at the time of the contract award.

Service Personnel Contractor shall ensure the personnel providing the labor hours possess the knowledge, skills, and ability necessary to address the applicable Revised 508 standards defined in this contract and shall provide supporting documentation upon request.

Hosting Services When providing hosting services for electronic content provided by the agency, Contractor shall not implement the hosting services in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 standards. Throughout the life of the contract, the agency reserves the right to perform testing on a vendor or contractor’s hosted solution to verify conformance with this requirement.

Validation for ICT Items When purchasing ICT where 1) 508 validation is not possible prior to award, 2) when ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, contractor shall test and validate the ICT solution for conformance to the Revised 508 standards, in accordance with the requirement testing methods, as defined by the agency. Throughout the life of the contract, the agency reserves the right to perform testing to verify conformance with this requirement.

Documentation Contractor shall maintain and retain full documentation of the measures taken to ensure compliance with the applicable requirements, including records of any testing or demonstrations conducted.

Conformance Reporting Prior to acceptance, contractor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by ITI.

When the contractor is required to perform testing to validate conformance to the agency’s accessibility requirements, contractor shall provide a Supplemental Accessibility Conformance Report (SAR) that contains the following information:

• Accessibility test results based on the required test methods.

• Documentation of features provided to help achieve accessibility and usability for people with disabilities.

• Documentation of core functions that cannot be accessed by persons with disabilities.

• Documentation on how to configure and install the ICT item to support accessibility.

• When an ICT item is an authoring tool that generates content (including documents, reports, videos, multimedia productions, web content, etc.)., provide information on how the ICT item enables the creation of accessible electronic content that conforms to the Revised 508 Standards, including the range of accessible user interface elements the tool can create.

https://www.section508.gov/sell/vpat https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility http://www.itic.org/policy/accessibility

• Before final acceptance, the contractor shall provide a fully working demonstration of the completed ICT Item to demonstrate conformance to the agency's accessibility requirements.

The demonstration shall expose where such conformance is and is not achieved.

Before acceptance, the agency reserves the right to perform independent testing to validate that the ICT solution provided by the contractor conforms to the applicable Revised 508 standards.

Non-Compliance Before final acceptance of any ICT item, including updates and replacements, if contractor claims its products or services satisfy the applicable Revised 508 standards specified in the contract vehicle, and the contracting officer determines that any furnished ICT item is not in compliance with such requirements, the contracting officer will promptly inform contractor in writing of the non-compliance. Contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

10.4 Compliance with Internet Protocol Version 6 (IPV6) in Acquiring Information

Technology

(a) Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

(b) Specifically, any new IP product or system developed, acquired, or produced must:

(1) Interoperate with both IPv6 and IPv4 systems and products, and

(2) Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

(c) As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

(d) The Contractor shall provide technical support for both IPv4 and IPv6.

(e) Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

(f) Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

11 PERFORMANCE REQUIREMENTS

11.1 Performance Standards

Performance Standard Acceptable Quality Level

(AQL)

Method of Surveillance

Technical Expertise The Government shall receive no more than three customer complaints during the event.

Any validated complaint should be mitigated after that specific session.

Validated Customer Complaints

Documentation All deliverables shall be produced using prescribed formats, required content, software tools and software versions agreed to by the Government. All deliverables shall conform to the tools and templates in the Department and OCIO and standard business practices. All deliverables shall not have more than one inaccuracy.

All deliverables shall be in accordance with an agreed schedule or in accordance with the terms of the contract with no more than two deliverables per month not being delivered on time. Late deliverables shall be submitted not later than one working day beyond the agreed-to time period.

Periodic Inspection and Validated Customer Complaints

Management Services & Organizational Conflict of Interest

The contract objective is, within the normal work day, to respond to the Government’s request for contractor support. The Contractor shall ensure that all Organizational Conflict of Interest (OCI) and information access concerns are resolved promptly. The Contractor shall provide initial notice of all unresolved issues within 1 day from the time the Contractor management is aware of the

Periodic Inspection issue and provide update on status on the Contractor handling of OCI.

Quality Requirements – Responsiveness to Noted Deficiencies

The contractor shall establish a corrective action program that precludes the Government from having to follow-up with the contractor in order to ensure correction of a noted deficiency. All deficiencies shall be corrected not later that one work day beyond the agreed to time period.

Validated Customer Complaints

12 USDA ROLES AND RESPONSIBILITIES

The USDA Contracting Officer (CO) shall be responsible for the administration of this Contract.

No individual other than a CO within the USDA/Office of Procurement and Property Management (OPPM), Procurement Operations Division (POD) has authority to modify or terminate this Contract on behalf of the Government for any reason.

Upon Contract award, the USDA CO will designate the USDA COR. This individual is responsible for Contract technical and management direction and general coordination with other USDA staff, as needed. This individual plans and coordinates USDA activities, services, and staff needed to meet the Contract objectives. This individual is responsible for providing both tactical and strategic direction to other USDA offices.

The COR will meet with the Contractor at mutually agreeable intervals to review the performance against the performance metrics presented throughout the PWS.

12.1 Authorized Ordering Officials

The following individuals are authorized to place orders using their Government Purchase Cards only up to their individual limit:

• Any warranted Contractor Officer, USDA/OPPM/POD

• IT Acquisitions Program Manager, USDA/OCIO/CIO

Orders exceeding those individual Purchase Card limits will be executed by a warranted Contractor Officer, USDA/OPPM/POD.

12.2 Contractor Roles and Responsibilities

The Contractor shall designate one (1) individual to serve as Contractor Project Manager. This individual shall be the receiving point for deliverables described in the SOW. This individual shall also be responsible for the Contract technical and management direction, submission of reports, and general support and coordination to the USDA COR and USDA staff, as needed and authorized in writing by the USDA COR. The Program Manager shall be fully authorized to direct and supervise day-to-day activities of Contractor and third-party vendors needed to meet the Contract requirements.

The Contractor shall also identify any other personnel that it considers key personnel for performance and management of this Contract. The titles, duties, and responsibilities of such key personnel shall be identified in each individual task order.

12.3 Security

By accepting this contract/agreement, the Contractor providing Information Technology (IT) services to the USDA agrees to comply with the applicable IT security policy as outlined in this document. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to USDA sensitive information that directly support the mission of the USDA.

The term 'information technology', as used in this clause, means any equipment or interconnected system or subsystem of equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130.

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

The Contractor or other external organization will not publish or disclose in any manner, without the USDA Contracting Officer's written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the USDA and any contractors and other external organizations will be entered into before USDA data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The contractor and other external organizations will agree to establish and follow security precautions considered by the USDA to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

The final deliverables and all associated working papers and other materials deemed relevant by the COR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COR at the conclusion of the tasks.

All documents produced under task orders placed against this PWS are the property of the U.S.

Government and cannot be reproduced or retained by the Contractor.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor's or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of USDA information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements, and rendering other assistance as deemed necessary.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will report real or suspected incidents or violations to the 24hr ASOC Incident Hotline: 866-905- 6890 or cyber.incidents@usda.gov.

mailto:6890%20or%20cyber.incidents@usda.gov.