DRAFT - Attachment 10 - Information Technology Clauses and Terms and Conditions.pdf

U.S. Department of Homeland Security U.S. Customs and Border Protection

Information Technology Terms & Conditions

Security Clauses

For:

U.S. CUSTOMS AND BORDER

PROTECTION

NON-INTRUSIVE INSPECTION SYSTEMS

PREPARED BY:

Office of Field Operations

Innovation and Strategy Directorate Non-Intrusive Inspection Program Office

Table of Contents 1 Basic Requirements

2 Product Assurance

3 Access to Unclassified Facilities, Information Technology (IT) Resources, and Sensitive Information

4 Personal Identity Verification (PIV) of Contractor Personnel

4.1 PIV Credential Compliance

5 CBP Contractor Handling PII Level

6 Security Requirements for Unclassified Information Technology Resources ... 6

7 Contractor Employee Access (JULY 2023)

8 Information Technology Security Awareness Training (JULY 2023)

9 Supply Chain Risk Management Terms and Conditions:

10 DHS Information Technology Portfolio Alignment

11 1Pv6

12 Section 508 Requirements

13 Interconnection Security Agreement Requirements

14 Appendix A: NII Large-Scale Fixed Systems IDIQ Terms and Conditions

Version Date Comments

V1 7/15/2025 First draft, Kaitlin Merli and Cindy Savage

Information Technology Security

The Contractor shall adhere to all DHS and CBP IT security policies and the basic requirements, security authorization, encryption compliance, and pass security review.

1 Basic Requirements

The Contractor shall adhere to all DHS and CBP IT security policies listed in the applicable documents section, including the guidelines and policies stated in the DHS Sensitive Systems Policy Directive 4300A, chapters 4 and 5, or any subsequent, replacement or revised publication. This policy mandates DHS organizational elements, including Contractors, follow guidelines outlined in the DHS 4300A Policy Directive (Version 13.3, February 13, 2023), Information Technology Security Program, Version 13, with attachments or any subsequent, replacement or revised publication.

DHS Directive 4300A, Section 3.2., Basic Requirements outlines the management, operational and technical baseline security requirements (BLSR) for DHS Components to ensure confidentiality, integrity, availability, authenticity, and non- repudiation of sensitive information systems. The 4300A policy directive provides greater detail of the BLSRs, including the roles and responsibilities associated with each.

CBP will provide personnel with the appropriate clearance levels to support the security certification/accreditation processes under this Agreement in accordance with DHS 4300A Policy Directive (Version 13.3, February 13, 2023), paragraph 4.1.1.d. During all systems development life cycle (SDLC) phases of CBP systems, CBP personnel will develop documentation and provide any required information for all levels of classification in support of the certification/accreditation process. In addition, all security certification/accreditation will be performed using the DHS certification/accreditation process, methodology and tools.

The contractor shall provide systems that conform to the following requirements:

Integrated networked systems shall adhere to the following:

• The operating system software shall be upgradeable, as only approved applications may be used on CBP workstations

• All operating systems must use the requisite DHS Security Technical Implementation Guides (STIGs) for hardening configurations

• All systems shall use required encryption for data at rest

• All vendor contractors shall not remove image data from systems nor store said data on contractor networks

• Ground-truthing or tuning of systems will be performed only on CBP systems and not on contractor networks unless specifically authorized.

• If systems are using WIFI the design must be explicitly reviewed and approved by the CBP EIOD organization

• Other wireless connectivity may be approved by EIOD

• Systems must be patched and maintained according to DHS patching standards (within 30 days usually)

• Username/Password authentication is not allowed

• PIV authentication is required for the systems

• Must integrate with CBP identify management lifecycle systems

• Account Level operator 2 should not be able to create or delete accounts

• Administrator accounts should not be able to perform user level functions or have direct access to perform actions within user accounts

• Auditing should integrate with enterprise audit log repository (SPLUNK)

2 Product Assurance

Information Assurance (IA) is considered a requirement for all systems used to input, process, store, display, or transmit sensitive or national security information. IA is achieved through the acquisition and appropriate implementation of evaluated or validated commercial-off-the-shelf (COTS) IA and IA-enabled Information Technology (IT) products. These products provide for the availability of systems.

The products also ensure the integrity and confidentiality of information and the authentication and nonrepudiation of parties in electronic transactions.

Strong preference is given to the acquisition of COTS IA and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting sensitive information) that have been evaluated and validated by authorized commercial laboratories or by National Institute of Standards and Technology (NIST), as appropriate, in accordance with the following:

• The NIST Federal Information Processing Standards (FIPS) validation program

• The National Security Area (NSA) /NIST National Information Assurance

Partnership (NIAP) Evaluation and Validation Program

• The International Common Criteria for Information Security Technology

Evaluation Mutual Recognition Agreement

3 Access to Unclassified Facilities, Information Technology (IT) Resources, and

Sensitive Information

IT resources and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD)

11042.1 Safeguarding Sensitive but Unclassified (For Official Use Only) Information paragraph 6, describes how Contractors must handle sensitive but unclassified information. DHS 4300A Policy Directive (Version 13.3, February 13, 2023) and MD 4300A Information Technology Security Program, Chapter 4, prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Contractors specifically for all Task Orders that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the task order.

Contractors who require access to the DHS network, such as when conducting remote maintenance, require a background investigation in accordance with DHS 4300A Policy Directive (Version 13.3, February 13, 2023), paragraph 4.1.1.d.

4 Personal Identity Verification (PIV) of Contractor Personnel

The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Policy for a Common Identification Standard for Federal Employees and Contractors, paragraph 3, Office of Management and Budget (OMB) guidance M-05-24, Appendix A, chapters 3 and 4, and Federal Information Processing Standards Publication (FIPS PUB) Number 201-2, Personnel Identity Verification of Federal Employees and Contractors, Section 2.

The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a Federally controlled facility or routine access to a Federally - controlled information system.

4.1 PIV Credential Compliance

Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting Homeland Security Presidential Directorate HSPD-12 PIV credentials as a method of identity verification and authentication.

Procurements for software products or software developments shall be compliant by PIV by accepting PIV credentials as the common means of authentication for access for federal employees and Contractors.

PIV-enabled information systems must demonstrate that they can correctly work with PIV credentials by responding to the cryptographic challenge in the authentication protocol before granting access.

If a system is identified to be non-compliant with HSPD-12 for PIV credential enablement, a remediation plan/or achieving HSPD-12 compliance shall be required/or review, evaluation, and approval by the CISO.

5 CBP Contractor Handling PII Level

“When a contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor will accredit Authorized to Operate (ATO) this information system to the (HHM) Confidentiality, Integrity and Availability FIPS level”.

6 Security Requirements for Unclassified Information Technology Resources

The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

Within 30 days after contract award, the Contractor shall submit for approval its IT Security Plan in the Contractor’s format, which shall be consistent with and further detail the approach contained in the officer’s proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 USC 1441 et seq.),sections 5 and 6; the Federal Information Security Management Act (44 USC 3554 (b)) of 2014; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130, Appendix III, A.3.b (2).

The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

Examples of tasks that require security provisions include—

Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the Contractor’s copy be corrupted; and

Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

At the expiration of the contract, the Contractor shall return all sensitive DHS information and IT resources provided to the Contractor during the contract, and certify that all non-public DHS information has been purged from any Contractor owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

Within 6 months after contract award, the Contractor shall submit written proof, in the Contractor’s format, of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A, Section 3.9, or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The Contractor shall comply with the approved accreditation documentation.

7 Contractor Employee Access (JULY 2023)

HSAR Clause 3052.204-71, Contractor Employee Access

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”.

Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement.

The Department receives this information in furtherance of the missions of the

Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015.

Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department.

International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization.

Information Systems Vulnerability Information (ISVI) means:

Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system.

Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department.

Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting.

Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation.

Privacy Information includes both Personally Identifiable Information (PII) and Sensitive

Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

• Truncated SSN (such as last 4 digits);

• Date of birth (month, day, and year);

• Citizenship or immigration status;

• Ethnic or religious affiliation;

• Sexual orientation;

• Criminal history;

• Medical information; and

• System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(End of Basic clause)

ALTERNATE I (JULY 2023)

Before receiving access to information resources under this contract, the individual must complete a security briefing; additional training for specific categories of CUI, if identified in the contract; and any nondisclosure agreement furnished by DHS. The Contracting Officer’s Representative (COR) will arrange the security briefing and any additional training required for specific categories of CUI.

The Contractor shall have access only to those areas of DHS information resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the COR, are strictly prohibited.

In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for DHS. It is not a right, a guarantee of access, a condition of the contract, or government-furnished equipment

(GFE).

Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management, or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

There must be a compelling reason for using this individual as opposed to a U.S.

citizen; and

The waiver must be in the best interest of the Government.

Contractors shall identify in their proposals the names and citizenship of all non-U.S.

citizens proposed to work under the contract. Any additions or deletions of non-U.S.

citizens after contract award shall also be reported to the Contracting Officer.

(End of Alternate I (July 2023) clause)

ALTERNATE II (JULY 2023)

Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department's Chief Security Officer or designee.

Contractors shall identify in their proposals, the names and citizenship of all non-U.S.

citizens proposed to work under the contract. Any additions or deletions of non-U.S.

citizens after contract award shall also be reported to the Contracting Officer.

(End of Alternate II (July 2023) clause)

8 Information Technology Security Awareness Training (JULY 2023)

Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

Security Training Requirements.

All users of Federal information systems are required by Title 5, Code of Federal

Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors.

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

(End of clause)

FAR 52.224-3 Privacy Training – ALTERNATE I (Deviation)

Definition. As used in this clause, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A–130, Managing Federal

Information as a Strategic Resource).

The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who—

Have access to a system of records;

Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or

Design, develop, maintain, or operate a system of records (see also FAR subpart 24.1 and 39.105).

The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract. Contractor employees shall satisfy this requirement by completing Privacy at DHS: Protecting Personal Information accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within 30 days of contract award and be completed on an annual basis thereafter not later than October 31st of each year.

The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will—

Have access to a system of records;

Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

Design, develop, maintain, or operate a system of records.

(End of clause)

9 Supply Chain Risk Management Terms and Conditions:

The Contractors supplying the Government hardware and software shall provide the manufacturer’s name, address, state or domain of registration, and the Data Universal

Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime Contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new Contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan in the Contractor’s format that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software. The Supply Chain Risk Management Plan shall include a list of custom or non-standard parts used by the Contractor.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

• How risks from the supply chain will be identified,

• What processes and security measures will be adopted to manage these risks to the system or system components, and

• How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR) 30 days post award.

The Contractor acknowledges the Government’s requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents an unacceptable risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standards certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the Contracting Officer (CO). Contractors shall only provide Original Equipment Manufacturers (OEM) parts to the Government. In the event that a shipped

OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e., non-OEM, “grey market,” previously used) components only with formal Government approval. Such components shall be procured from their original genuine source and have the components shipped only from manufacturers authorized shipment points.

For software products, the Contractor shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “end of life”). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lesser of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times in route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government’s request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipment and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The Contractor shall send a shipping notification to the intended government recipient or contracting officer.

This shipping notification shall be sent electronically to nii.cor@cbp.dhs.gov and will state the contract number, the order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

10 DHS Information Technology Portfolio Alignment

The system shall align with the DHS IT Portfolio below:

mailto:nii.cor@cbp.dhs.gov

Screening/Watchlist/Credentialing Includes all activities that support the tracking and monitoring of travelers, conveyances and cargo crossing U.S. borders, and traffic pattern analysis, database (Federal, State, and Local) linking and querying, and managing status verification and tracking systems. Different investments and systems may support distinct screening and watchlist activities for people, cargo, and tangible goods. Credentialing encompasses all activities that determine a person's eligibility for a particular license, privilege, or status, from application for the credential through issuance, use, and potential revocation of the issued credential.

11 1Pv6

In compliance with OMB mandates, all network hardware provided under the scope of this Statement of Work and associated Task Orders shall be 1Pv6 compatible without modification, upgrade, or replacement.

12 Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div

5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

• Section 508 Requirements for Technology Products (included in the SOW, PWS, or SOO).

• Section 508 applicability to Information and Communications Technology

(ICT): Non-Intrusive Inspection Equipment

Applicable Exception: Fundamental Alteration https://uscode.house.gov/view.xhtml?req=(title:29%20section:794d%20edition:prelim)%20OR%20(granuleid:USC-prelim-title29-section794d)&f=treesort&edition=prelim&num=0&jumpTo=true https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5 https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5

Authorization #: CBP20111116 001

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor document.

13 Interconnection Security Agreement Requirements

Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. Connections with other Federal agencies shall be documented based on interagency agreements;

memoranda of understanding, service level agreements or interconnect service agreements.

14 Appendix A: NII Large-Scale Fixed Systems IDIQ Terms and Conditions

10/18/2025

1.0 Terms and Conditions

1.1 ITAR SME Accessibility & Language Services

You must include Section 508 requirements in your Statement of Work (SOW), Statement of Objectives (SOO), Performance Work Statement (PWS), or the Description of Requirements (DOR) when your solicitation requires the purchase of information and communications technology (ICT) and include the following language generated by the DART 2.1 (required to obtain Section 508 Requirements for solicitations).

Common situations include:

• New Solicitations

• Task Orders under existing contracts (including contracts managed by other agencies)

• ICT that will be provided to the public & internally

• ICT COTS/GOTS licenses

• ICT approved on the TRM

• ICT proof of concepts, pilot efforts, and MVPs

• ICT provided as a service (example – SaaS, PaaS)

• ICT provided through open-source arrangements

• ICT that has an authorized 508 exception

• Services to develop, modify, configure, install, maintain, and host ICT

• Services that produce ICT in support of other deliverables (ex. Electronic forms)

15 1.2 ITAR SME Cybersecurity Policy

All hardware, software, and services provided must be compliant with DHS Security Policy. The 4300 handbook is no longer in use. Reference Information Security Systems Program 4300A version 13.3, Feb 13, 2023.

ISO Terms and Conditions for Sensitive but Unclassified Requests

DHS Security Policy Requirement The following terms and conditions should be included in all acquisition documents. All hardware, software, and services provided under this task order must be compliant with DHS Information Security System Program 4300A version 13.3 Feb, 13 2023 and attachments.

Encryption Compliance Requirement The following terms and conditions should be included in all IT procurement documents.

javascript:ICTSolicationsExample() javascript:ICTSolicationsExample() https://www.dhs.gov/xlibrary/oast/DART/

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2 and / or FIPS 140-3.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI), key cards, biometrics, or in the case of multi-factor authentication, some combination therein (See Attachment U) Information Security Sensitive Systems Program Directive 4300A version 13.3, Feb 2023.

Security Review Requirement The following requirements should be included in all acquisition documents.

Security Review The Government may elect to conduct periodic reviews to ensure that the security requirements contained in the contract are being implemented and enforced. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in security review activities. The Contractor shall afford DHS, the Office of the Inspector General, other government organizations, and Contractors working in support of the Government access to the Contractor’s facilities, installations, operations, documentation, databases, networks, systems, and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and Contracting Officer's Representative (COR), contact the Component or Headquarters CIO, or designee, to coordinate and participate in review and inspection activity by government organizations external to DHS. Access shall be provided, to the extent necessary as determined by the Government (including providing all requested images), for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

Interconnection Security Agreement (ISA) The following requirements should be included if the service being supplied requires a connection to a non-DHS, contractor system, or DHS system of different sensitivity.

Interconnection Security Agreement Requirements Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. Connections with other federal agencies shall be documented based on interagency agreements, memoranda of understanding, service level agreements or interconnect service agreements. The applicable network connectivity policy is located in the Access Control Section, for “Interconnection Security Agreements,” of the DHS 4300A, Attachment N.

Required Protections for DHS Systems Hosted in Non-DHS Data Centers The following requirements should be included when information systems are hosted, operated, maintained, and used on behalf of DHS at non-DHS facilities. Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act

(FISMA), National Institute of Standards and Technology (NIST), Special Publication SP-800- 47, DHS Management Directive 140-01, “Information Technology Security Program,” Revision 2, May 5, 2017, Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance). The contractor security procedures shall be the same or greater than those that are provided by DHS Enterprise Data Center(s). Please note that all the subsections from Security Authorization to Log Retention must be included in this requirement to comply with 4300A Information Security Systems Program version 13.3, Feb 13, 2023, Attachment N.

Security Authorization A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the FIPS 199 security categorization of the DHS information system.

At the beginning of the contract, and annually thereafter, the contractor shall provide the results of an independent assessment and verification of security controls. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process. The contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with contractor activities shall also be subject to such assessments.

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in security review activities. Within ten working days’ notice, the Contractor shall afford DHS, the Office of the Inspector General, other government organizations, and Contractors working in support of the Government access to the Contractor’s facilities, installations, operations, documentation, databases, networks, systems, and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and Contracting Officer’s Representative (COR), contact the Component or Headquarters Chief Information Officer, or designee, to coordinate and participate in the review and inspection activity of government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government (including providing all requested images), for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of government data or the function of computer systems used in performance of this contract to preserve evidence of computer crime.

16 1.3 ITAR SME Cybersecurity Supply Chain Risk Management (C-SCRM)

Cybersecurity C-SCRM language is applicable for requirements for the use of supplies and services to include the following:

a. Definitions:

i. Component: a unit defined by the supplier that connects to and functions as part of the product. For software products, a component is a unit of software defined by a supplier at the time the component is built, packaged, or delivered. For hardware, a component is one hardware unit designed to connect to and function as part of a larger product.

ii. End-of-Life (EOL): means that an ICT product has reached the final stage of the product life cycle in which that version of the ICT product will no longer be supported nor manufactured (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iii. End-of-Support (EOS): means that an ICT product will no longer be supported (e.g., no patches will be developed, no security improvements will be made, and, sometimes, no troubleshooting technical assistance will be offered).

iv. Information and Communications Technology (ICT): encompasses the capture, storage, retrieval, processing, display, representation, presentation, organization, management, security, transfer,…