70B06C22R00000038 Attachment B- Performance Work Statement.pdf

ATTACHMENT B

PERFORMANCE WORK STATEMENT (PWS)

RFP 70B06C22R00000038

Customs Broker License Exam

Office of Trade

U.S. Customs and Border Protection (CBP)

Part 1

General Information

1. GENERAL: This is a non-personal services requirement to provide the Customs Broker

License Exam (CBLE) testing system and test administration services. The government will not exercise any supervision or control over service providers performing the services herein. Such service providers shall be accountable solely to the Contractor who, in turn is responsible to the government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to execute the CBLE as defined in this Performance Work

Statement (PWS) except for those items specified as government furnished information

(GFI). The Contractor shall perform to the standards in this PWS. The Contractor shall deliver an exam delivery system and administer the CBLE in an in-person environment, as well as an online, remotely proctored exam environment.

From herein, any reference to a “testing site” will apply to the in-person exam only, and any reference to a “time selection” will apply to the remotely proctored exam only. Both in-person and remotely proctored CBLE exams shall include, but are not limited to, the following services:

a) Developing the platforms for both the remotely proctored and in-person CBLE,

b) Selecting testing sites in pre-determined areas (in-person exam),

c) Hosting the internet based CBLE (remote proctored exam),

d) Facilitating examinee testing site selection (in-person), exam appointment selection

(remote), and registration,

e) Checking-in examinees on the day of the CBLE,

f) Providing proctors for the CBLE at each testing site and for remote proctoring over the internet,

g) Providing appropriate office and technology equipment (in-person exam),

h) Providing the appropriate validation of the remote testing area, and technology equipment (remote exam),

i) Providing technology and support for disability accommodations, and

j) Reporting out exam results and analysis, distinguishing between in-person and remote examinees.

1.2 Background: The CBLE is a semi-annual test, given for the last 50 years to license Customs

Brokers. Customs Brokers are knowledgeable in customs procedures and serve as agents for companies importing goods into the country. Customs Brokers preliminarily classify and appraise imported goods, file entries, post bonds, and pay duties on behalf of the actual importer.

The Office of Trade (OT) is the office responsible for administering the CBLE. The specific responsibility is with the Broker Management Branch. In compliance with 19 Code of Federal

Regulations (CFR) 111.13(a), the objective of the CBLE is to “determine the individual’s knowledge of customs and related laws, regulations and procedures, bookkeeping, accounting, and all other appropriate matters, necessary to render valuable service to importers and exporters.” Per 19 CFR 111.13, the exam is to be administered twice a year, on the fourth

Wednesday in April and October, unless the regularly scheduled date conflicts with a national holiday, religious observance, or other foreseeable event and the agency publishes an appropriate notice of a change in the examination date.

1.3 Objectives: To secure a Contractor to deliver an exam system and efficiently administer the

CBLE without technological errors or deficiencies.

1.4 Scope: The Contractor shall administer the CBLE, in at least 44 locations (in-person exam) and via remote proctoring, twice annually on the fourth Wednesday in April and October, subject to date changes made per 19 CFR 111.13(b). The Contractor shall provide all resources required to administer the CBLE in accordance with the specifications listed in this PWS.

1.5 General Information

1.5.1 Quality Assurance and Control: The Contractor shall develop and maintain an effective Quality Assurance (QA) and Control (QC) Program (QACP) to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QACP is the means by which the company assures that its work complies with the requirements of the contract. The Contractor shall document the QACP in a QACP Plan. The Contractor shall deliver the draft QACP fourteen (14) weeks prior to the first exam and the final QACP to the Contracting Officer Representative (COR) twelve (12) weeks prior to the first exam. The Contractor shall update the QACP as required, and all updates must be approved by the CBP COR. After acceptance of the QACP Plan, the Contractor shall seek the COR’s acceptance in writing of any proposed changes.

1.5.1.1 Quality Assurance Surveillance: The government will evaluate the Contractor’s performance under this requirement in accordance with Attachment E - Quality Assurance

Surveillance Plan (QASP). This plan is primarily focused on what the government must do to ensure that the Contractor has performed in accordance with the performance standards. The QASP describes how the performance standards included in the performance requirements summary are applied, the frequency of surveillance, and the minimum acceptable defect rate(s)/quality level(s).

1.5.1.2 Acceptance Testing:

a) The Contractor shall prepare and submit a draft Acceptance Test Plan (ATP) detailing the inspections and tests required to verify and validate the performance of the sample CBLE exam, exam site-selection and exam appointment selection website(s), and electronic exam delivery system (see sections 5.3, 5.4, 5.5 and 5.6) fourteen (14) weeks prior to the first exam.

b) The Contractor shall deliver the finalized ATP to the government for review and approval ten (10) weeks prior to the first exam.

c) The Contractor shall perform inspections and tests necessary to ensure that the system(s) conform to the latest approved configuration, including operational testing of the system(s) and simulated network performance based on peak user volumes and bandwidth degradation as part of the Contractor’s QACP.

d) Using the government-approved ATP, the Contractor shall conduct verification and validation tests to ensure the system meets all performance requirements and can be operated as specified in the PWS.

e) The government will conduct a System Acceptance Test (SAT) for each system to include, but not limited to, multiple internal CBP and government stakeholder verification and validation tests which may include demonstrations and mock testing of all exam systems until the government provides acceptance of each exam system.

f) The Contractor shall complete all internal testing prior to delivering the system to the government for the SAT.

1.5.2 Place of Performance and Site Registration Estimations: The Contractor shall conduct all government coordination meetings and project planning activities at the government site, when available. If government facilities are not available, other locations such as the

Contractor’s sites may be utilized at no additional cost to the government. It is the government’s intent to conduct coordination and project planning activities virtually to the greatest extent possible. All other work shall be performed at the Contractor site.

The address for the Office of Trade is:

U.S. Customs and Border Protection

Office of Trade

1331 Pennsylvania Ave, NW

Washington, DC 20004

The Contractor shall administer each exam in at least 44 locations within a 50-mile radius of the following zip codes provided in the Site Registration Estimation Table below. In-person exams shall be administered within the U.S. and its territory’s geographical borders. The

Contractor shall provide sufficient resources and facilities to administer the exam up to the site registration estimation for each location without additional cost to the government. The contractor shall facilitate examinee site registration on a first come-first served, space-available basis. In the event the number of exam registrants exceeds the site registration estimation for a given location, the Contractor shall advise the examinee to select an alternate location, including the remotely proctored option, to complete their registration for the exam.

The government may reduce site registration estimation based on user acceptance and availability of the remotely proctored solution. The Contractor shall change or modify testing facilities due to a failure to meet the requirements of the PWS based on the government’s review and acceptance of the Contractor-provided list of testing site locations and facility descriptions (see section 5.5.5).

Table: Site Registration Estimation

City Zip

Code

Maximum

Number of

Examinees

San Juan, PR 00907 15

Boston, MA 02143 30

New York, NY 10001 150

Plattsburgh, NY 12901 15

Buffalo, NY 14202 30

Pittsburgh, PA 15222 15

Philadelphia, PA 19134 30

Washington, DC 20006 30

Norfolk, VA 23510 15

Charlotte, NC 28202 30

Charleston, SC 29418 15

Atlanta, GA 30303 45

Miami, FL 33126 60

Tampa, FL 33607 30

Memphis, TN 38103 45

Louisville, KY 40202 30

Columbus, OH 43085 15

Cleveland, OH 44199 15

Indianapolis, IN 46204 15

Detroit, MI 48226 45

Milwaukee, WI 53207 15

Minneapolis, MN 55437 15

Pembina, ND 58271 <5

Helena, MT 59601 <5

Chicago, IL 60607 75

St. Louis, MO 63132 15

Wichita, KS 67202 <5

New Orleans, LA 70130 15

Fayetteville, AR 72701 15

Arlington, TX 75063 45

Houston, TX 77032 45

Laredo, TX 78040 45

Harlingen, TX 78550 30

El Paso, TX 79904 30

Denver, CO 80204 15

Salt Lake City, UT 84116 15

Phoenix, AZ 85043 30

Los Angeles, CA 90802 150

San Diego, CA 92101 30

San Francisco, CA 94109 30

Honolulu, HI 96850 <5

Portland, OR 97204 15

Seattle, WA 98134 30

Anchorage, AK 99513 <5

Total Site Registration Estimation 1360

1.5.3 Security Requirements: Contractor personnel will have access to sensitive but unclassified information. Contractor personnel are required to execute a DHS Non-Disclosure

Agreement (NDA) (Department of Homeland Security Form 11000-6) as a condition to access sensitive but unclassified information (including proctors who have access to PII or

SPII). The Contractor shall adhere to the Homeland Security Acquisition Regulations (HSAR) special clauses Safeguarding of Sensitive Information (MAR 2015), Information Technology

Security Awareness Training and Privacy Training (MAR 2015), and Contractor Employee

Access (HSAR 3052.204-71).

1.5.3.1 Physical Security: The Contractor shall safeguard all government information and property provided for Contractor use. The Contractor shall maintain confidentiality of the

CBLE contents and prevent unauthorized disclosure prior to administering the exam. The

Contractor shall secure all government materials at the close of each work period.

1.5.3.2 Personally Identifiable Information (PII): CBP provides the examinee’s name, email, phone number, city, state, zip code and a CBP provided unique identifier number to the Contractor in a password protected Excel spread sheet. All files containing examinee information are password protected. The Contractor requires examinee name, city, state, zip code, and email address to complete the registration process, for site selection (in-person) or appointment selection (remote), to check-in examinees on the day of the exam, and to send the examinees their answer records after completing the exam. The Contractor requires the phone number to contact examinees in case of last-minute exam notifications or disconnections (remote). The Contractor shall verify the identity and proof of citizenship of examinees based on the following documents prior to the start of the exam:

CBP Approved Forms of Identification: U.S. State Issued Driver’s License, U.S. State

Issued ID Card, U.S. Passport, U.S. Military ID, U.S. Territory ID (Puerto Rico, Guam, Etc.). In cases where the examinee has had a name change within the last six months, the government will allow for an original marriage certificate and an original divorce decree or other similar original court order to be presented as proof of name change for verifying identification.

CBP Approved Proof of Citizenship: U.S. Passport, U.S. Birth Certificate, Certificate of

Naturalization, Certificate of U.S. Citizenship, or Consular Report of Birth Abroad. In cases where the examinee has had a name change, the government will allow for an original marriage certificate and an original divorce decree or other similar original court order to be presented as proof of name change for verifying citizenship.

a) The Contractor shall not retain any sensitive PII beyond the minimal amount of time when it is no longer required during the performance of this contract. The

Contractor shall not retain PII, video and audio recordings, or images for more than 120 days after the date of the exam unless otherwise instructed by the CBP

COR.* (Also see section 5.4.1.6.2.) The Contractor shall not retain any images or data obtained during check-in procedures prior to the start of exam after the

Contractor has confirmed the identity and citizenship status of the examinee.

The Contractor shall display a Privacy Act Statement (provided by the government) notifying the examinee prior to the check-in process. The government will accept written reports from the Proctors notating any privacy incidents.

*The Contractor shall retain the video recordings, audio recordings, and images of specified examinees with an open appeal. The government will provide the list of examinee recordings that shall be retained longer than 120 days.

1.5.4 System Security: All data that is provided to the Contractor, as well as, collected by the

Contractor, shall be encrypted in transit and while at rest. The Contractor shall:

a) Ensure CBLE data is maintained on a separate database, segregated from any other data that is not related to the CBLE contract.

b) Submit the results of a third-party security assessment, or a System Security Plan

(SSP) and Requirements Traceability Matrix (RTM) due ten (10) weeks prior to the exam. See Attachments F and G for SSP and RTM templates.

c) Encrypt the database, system, files, and all data using an Advanced Encryption

Standard (AES) 256-Bit encryption.

d) Conduct monthly vulnerability scans on the systems housing the CBLE data in accordance with National Institute of Standards and Technology (NIST) Special

Publication 800-53 and provide CBP the results of these scans for government review, due to the COR on the first (1st) Tuesday of every month.

e) Ensure security patches are installed within 15 calendar days of the software developer making the security updates available.

f) Maintain records of all security updates for the duration of the contract.

g) Ensure all personnel with access to the CBLE data and registrant PII complete:

• the Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII training. The privacy training is accessible at http://www.dhs.gov/dhs-security-andtraining-requirements-contractors.

• The DHS Rules of Behavior: The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-andtraining-requirements-contractors.

• The Information Technology Security Awareness Training. The

Information Technology Security Awareness Training is accessible at http://www.dhs.gov/dhs-security-andtraining-requirements-contractors.

Unless otherwise specified per section 5.6.9, the two trainings and the DHS Rules of Behavior Form shall be taken, and signed certificates delivered to the COR 16 weeks prior to exam (see sections 1.5.5.1 and 1.5.5.2).

h) Delete all CBLE data including, but not limited to, examinee PII, exam recordings, and check-in verification data 120 calendar days after the day of the exam, unless otherwise directed by the CBP COR (e.g. certain recordings need to be retained for http://www.dhs.gov/dhs-security-andtraining-requirements-contractors http://www.dhs.gov/dhs-security-andtraining-requirements-contractors the duration of the appeals process and any court proceedings). Also see section

5.4.1.6.2.

i) Provide a Certificate of Destruction, signed by the Contractor’s Chief Technology

Officer or equivalent, to the COR within five (5) calendar days from purging the data or no later than 95 calendar days from administering the CBLE, whichever occurs first.

1.5.4.1 System Security Assessment

Per HSAR Class Deviation 15-01 Safeguarding of Sensitive Information, the government reserves the right to:

• Require a third-party security assessment;

• Require a CBP-conducted security assessment of the Contractor’s system; and

• Require an Authority to Operate (ATO).

o An ATO is not required to award this contract, though an ATO may be required at a future date at the discretion of CBP’s Cyber Security

Directorate.

1.5.5 Special Qualifications: The Contractor shall train and certify proctors for CBLE administration (see section 5.6.8 and 5.6.9). All Contract personnel who may encounter CBP protected data or PII must undergo a criminal background investigation and complete the following training (see also sections 1.5.3 and 1.5.4-g).

1.5.5.1 Information Technology Security

All users of Federal information systems are required by Title 5, Code of Federal

Regulations, Part 930.301, Subpart C. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security

Awareness Training course before accessing sensitive information under the contract.

Unless otherwise specified, the training shall be completed 16 weeks prior to the exam and shall be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at https://public.cyber.mil/training/cyber-awareness-challenge.

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than 16 weeks prior to the exam. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The email notification shall state the required training has been completed for all Contractor and subcontractor employees.

https://public.cyber.mil/training/cyber-awareness-challenge

The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of

Behavior shall be signed before accessing DHS systems and sensitive information. The

DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing

DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at https://www.dhs.gov/sites/default/files/publications/4300A-

Handbook-Attachmentt-G-Rules-of-Behavior.pdf . Unless otherwise specified, the DHS

Rules of Behavior shall be signed no later than 16 weeks prior to the exam. Any new

Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than 16 weeks prior to the exam for each employee. The DHS Rules of Behavior will be reviewed annually and the COR will provide notification when a review is required.

1.5.5.2 Privacy Training (Mar 2015)

All Contractor and subcontractor employees who will have access to Personally

Identifiable Information (PII) and/or Sensitive PII (SPII) are required to take Privacy at

DHS: Protecting Personal Information before accessing PII and/or SPII. The training is accessible at https://www.dhs.gov/course/privacy-dhs. Training shall be completed no later than 16 weeks prior to the exam and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall also complete the training before accessing PII and/or SPII. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than 16 weeks prior to the exam. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

1.5.6 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The

Contracting Officer (CO), COR, and other government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO or COR will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the government of problems, if any, being experienced. The Contractor shall take appropriate action to resolve outstanding issues. The

Contractor shall participate in these meetings at no additional cost to the government.

https://www.dhs.gov/sites/default/files/publications/4300A-Handbook-Attachmentt-G-Rules-of-Behavior.pdf https://www.dhs.gov/sites/default/files/publications/4300A-Handbook-Attachmentt-G-Rules-of-Behavior.pdf https://www.dhs.gov/course/privacy-dhs

1.5.7 Contracting Officer Representative (COR): The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the

Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the

Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including government drawings, designs, specifications; monitor

Contractor's performance and notifies both the CO and Contractor of any deficiencies;

coordinate availability of government furnished information, and provide site entry of

Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the order or contract.

1.5.8 Key Personnel: The government considers personnel performing any of the functions described below to be key personnel. Key personnel are personnel who are integral and indispensable in completing the required work. Key personnel shall be available at contract/project start, with the exception of the Contractor's lead resource (Program or Project

Manager), who shall be available immediately after award. The government does not intend to dictate the composition of the ideal team to perform this order and encourages the

Contractor to form its team with any additional key personnel it determines as necessary for successful performance. The Contractor shall provide the names and contact information for the Contractor’s lead resource and an alternate to the CO and COR. The Contractor’s lead resource or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The lead resource or alternate shall be available between 8:00am – 5:00pm eastern standard time, Monday through Friday except Federal holidays or when the government facility is closed for administrative reasons. The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. The government desires that Key Personnel be assigned for the duration of the contract. The functions performed by key personnel are listed below:

a) Performs oversight and management of overall contract operations including managing multiple projects, tasks, resources and personnel.

b) Assigns resources, provides risk management, ensures adherence to plans and schedules, monitors overall contract performance, and communicates at the senior level with the client on program status.

c) Performs project management responsibilities for project segments, works under pressure and tight deadlines, works independently, and works in a team environment.

d) Provides consulting support in the areas of strategic workforce planning, human capital consulting, decision support and analytics, and workforce development or a related functional business field.

e) Contributes to research and design activities.

f) Advises on methodology and team structure while coordinating analyses with other project personnel.

g) Applies technical and analytical approaches to address client issues related to process assessment, strategy and change management for process improvement, organizational transformation, and/or other related areas.

h) Provides facilitation and related decision support and in collaboration efforts, as well as lead and coordinate with individuals or diverse teams and groups with common interests.

i) Communicates effectively and efficiently both orally (in common English narration) and in writing, such as reports, memoranda, and electronic mail.

j) Helps customers efficiently, in a friendly and positive manner.

k) Provides business and/or technical analysis in support of program or project. This may include completing project estimates, designing and completing status reports, providing necessary research, planning, managing tasks, creating and reviewing deliverables, managing communication and development of communication, preparing and delivering presentations, and interacting with project management and client.

1.5.9 Ancillary Support: The Contractor shall provide any support necessary for the successful completion of the PWS requirements, to include any support item required.

1.5.10 Points of Contact:

CBP Contracting Officer’s Representative (COR)

TBD

Office of Trade

U.S. Customs and Border Protection

Office: TBD

Cell: TBD

CBP Contracting Officer (CO)

Jared Tritle

Mission Support Contracting Division – West

U.S. Customs and Border Protection

Office: 317-381-5447

1.6 Invoice Requirements

1.6.1 Period of Invoice. Monthly invoices shall be submitted for all costs associated with the monthly reporting period. The monthly reporting period may be a calendar month, or any other period used by the Contractor as a billing cycle, provided that this billing cycle contains no fewer than 28 and no more than 31 days.

1.6.2 Invoices shall separately identify costs for each task order or modification and identify the contract line item number (CLIN).

1.7 Close-out Procedures: The Contractor shall submit a final invoice within sixty (60) calendar days after the end of the Performance Period.

1.8 Organizational Conflict of Interest: The Contractor shall notify the CO immediately whenever it becomes aware that there may be an actual or potential Organizational Conflict of

Interest (OCI) based on the work it is performing and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1 DEFINITIONS:

2.1.1 ACCESS. The ability to obtain, examine, or retrieve data or a file.

2.1.2 ANSWER RECORD. A list of the question number and the corresponding answer selected for all 80 questions of the Customs Broker Licensing Exam.

2.1.3 ANSWER KEY. The list of 80 correct answers that corresponds to the 80 questions the government provides to the Contractor for each exam cycle.

2.1.4 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.5 CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.6 CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

government appointed by the CO to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does

NOT have authority to change the terms and conditions of the contract.

2.1.7 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.8 DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.9 FAILURE. Technological or customer service shortfall that does not perform intended function, including defective services.

2.1.10 KEY PERSONNEL. Key personnel are personnel who are integral and indispensable in completing the requirements of the resultant contract.

2.1.11 LEGAL PERMANENT RESIDENT. May also be referred to as a “Lawful Permanent

Resident” or “Green Card Holders.” Non-U.S. Citizens who are lawfully authorized to live permanently within the United States.

2.1.12 PERSONALLY IDENTIFIABLE INFORMATION (PII). Means any information that permits the identity of an individual to be directly or indirectly inferred, including other information that is linked or linkable to an individual. For example, when linked or linkable to an individual, such information includes a name, social security number, date and place of birth, mother’s maiden name, account number, license number, vehicle identifier number, license plate number, device identifier or serial number, internet protocol address, biometric identifier (e.g., photograph, fingerprint, iris scan, voice print), educational information, financial information, medical information, criminal or employment information, information created specifically to identify or authenticate an individual (e.g., a random generated number).

2.1.13 PHYSICAL SECURITY. Actions that prevent the loss or damage of government property or information.

2.1.14 QUALITY ASSURANCE (QA). Procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.15 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology used for surveillance of Contractor performance.

2.1.16 QUALITY CONTROL. All necessary measures taken by the Contractor to validate the quality of an end product or service meets the contract requirements.

2.1.17 SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION (SENSITIVE PII)

means PII which, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an Individual. Some types of PII, such as Social Security Number (SSNs), Alien Registration Number, and biometric identifiers, are always sensitive. Other types of PII, such as an individual’s driver’s license number, financial account number, citizenship or immigration status, or medical information are Sensitive PII if DHS maintains them in conjunction with other identifying information about the Individual. In some instances the context surrounding the PII may determine whether it is sensitive. For example, a list of employee names by itself may not be Sensitive

PII, but could be if it is a list of employees who received poor performance ratings.

2.2 ACRONYMS:

ADA Americans with Disabilities Act

AES Advance Encryption System

AQL Acceptable Quality Level

ATO Authority to Operate

ATP Acceptance Test Plan

CBLE Customs and Broker License Exam

CBP U.S. Customs and Border Protection

CFR Code of Federal Regulations

CLIN Contract Level Invoice Number

CO Contracting Officer

COR Contracting Officer’s Representative

CPARS Contractor Performance Assessment Reporting System

D.C. District of Columbia

DHS Department of Homeland Security

FAR Federal Acquisition Regulation

GFI Government Furnished Information

HSAR Homeland Security Acquisition Regulations (HSAR)

IPP Invoice Processing Platform

NDA Non-Disclosure Agreement

NFC National Finance Center

NIST National Institute of Standards and Technology

NLT No Later Than

NW North West

OCI Organizational Conflict of Interest

OT Office of Trade

PII Personally Identifiable Information

PIN Personal Identification Numbers

POC Point of Contact

PCII Protected Critical Infrastructure Information

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

QC Quality Control

QACP Quality Assurance and Control Program

RTM Requirements Traceability Matrix

SAT System Acceptance Test

SOC Security Operations Center

SPII Sensitive Personally Identifiable Information

SSI Sensitive Security Information

SSN Social Security Number

SSP System Security Plan

URL Uniform Resource Locator

PART 3

GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION

3. GOVERNMENT FURNISHED EQUIPMENT AND INFORMATION:

3.1 Materials. The government will provide:

3.1.1 The 80-question CBLE and answer key for each exam cycle. The Government will provide this not later than eight (8) weeks prior to the scheduled exam date.

3.1.2 The list of people registered to take the CBLE, including exam ID, exam type (remote or in-person), examinee’s name, zip code, and a CBP-provided examinee unique identifier number. The Government will provide this not later than 25 calendar days prior to the scheduled exam date.

3.1.3 The list of registrants that withdraw their registration for participating in the exam two days prior to the date of the exam. The Government will provide this not later than two (2) business days prior to the scheduled exam date.

3.1.4 Site Registration Estimation (see Section 1.6.3).

3.1.5 The exam reference documents to be loaded into the CBLE delivery system for the examinees to be able to access during the test. The Government will provide this not later than eight (8) weeks prior to the scheduled exam date.

3.1.6 Seven (7) Post-exam survey questions. The Government will provide this not later than eight (8) weeks prior to the scheduled exam date, at the same time as the CBLE questions and answer key.

3.1.7 A previous exam for the Contractor to develop the sample CBLE exam. The

Government will provide this not later than twelve (12) weeks prior to the scheduled exam date.

3.1.8 A “CBLE Proctor’s Guide” or the Proctors to review and reference during the administration of the CBLE. The Cheat Sheet will list the rules the Proctors shall follow that are specific to the CBLE. The Government will provide this not later than four (4) weeks prior to the scheduled exam date.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General. The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Part 3 of this PWS.

4.2 Materials. The Contractor shall provide:

• All items necessary to create the electronic exam delivery system for both the in person and remotely proctored exams.

• All items necessary to create the Answer Record and provide examinees with a copy of their Answer Record on day of exam. The Answer Record may be in paper or electronic format as long as the format is consistent within the exam delivery method (in-person or remote).

• Paper and ink for printers (in-person only).

4.3 Equipment. The Contractor shall provide (in-person only):

• A scanner, copier, and printer at each testing site to print paper exams (in case a paper exam is needed), to print hard copy Answer Record sheets and to scan in the exam answer sheets (to be emailed on the day of exam to CBP COR) as they are submitted by the examinees.

• A desk area for each examinee, measuring three (3) feet wide (threshold) to five (5) feet wide (objective), and eighteen (18) inches deep.

• A computer, keyboard, mouse, and one (1) monitor measuring at least fifteen (15) inches diagonally for each examinee to use.

• All items necessary to meet the technology requirement in the PWS.

• All items necessary to meet approved ADA requests.

PART 5

Program Delivery Tasks

5. Specific Tasks:

5.1 Management Plan

The purpose of this task is to develop a Management Plan. The Contractor shall develop a

Management Plan that describes the actions necessary to prepare, integrate, and coordinate the various planning activities and defines how the Contractor will execute, monitor, control, and deliver the project. The Contractor shall include the following items in the Management Plan:

• Project Execution – Describe the actions necessary to prepare, integrate, and coordinate the various planning activities and define how the Contractor will execute, monitor, control and deliver the project.

• Organization – An organizational chart of all positions supporting the contract.

• Roles and Responsibilities by Position – List each role and define the associated responsibilities in a bulleted format.

• Sub-contractor Management – Explain the method in which sub-contractor(s) are chosen, the acceptance criteria developed for quality assurance and mitigation process if sub-contractor fails to meet requirements.

• Risks and Issues Management – Identify potential risks and issues, the associated impacts, and the proposed management strategy, including risk monitoring and implementation of mitigation, avoidance, or acceptance plans.

• Schedule of Deliverables – Outlines the deliverables that are needed to meet the government’s specific requirements as defined in the PWS.

• System Delivery Process – Provide a concept overview of how the exam system will be developed, delivered and administered.

• Change Management – Explain how changes will be monitored, controlled and communicated to the government.

The Contractor shall provide a draft Management Plan fourteen (14) weeks prior to the exam.

The COR will provide feedback on the draft Management Plan to the Contractor for revisions.

The Contractor shall deliver the final Management Plan to the COR twelve (12) weeks prior to the first exam.

5.2 Program Delivery

The following table describes the program’s milestones.

Timing Milestone GFI/E

At time of Award Exam Event Planning begins

NLT 16 weeks prior to exam

The Contractor provides signed NDAs to COR (Proctor NDAs due at 1 week prior to exam)

NLT 16 weeks prior to exam

The Contractor provides certificates of completion for the DHS

Rules of Behavior, the Privacy training, and the IT Security training

NLT 16 weeks prior to exam

The Contractor provides Kick-off meeting, meeting agenda, and meeting minutes (1 business day prior to the kick-off meeting)

14 weeks prior to the first exam

The Contractor provides a draft QACP, draft ATP, and draft

Management Plan to COR

12 weeks prior to exam Draft list of testing site locations and facility descriptions for the in-person exam; draft list of testing time zone windows, including the times within the scheduling windows for the remotely proctored exam.

12 weeks prior to exam The government provides a previous exam for the Contractor to develop the sample exam.

Y

12 weeks prior to the first exam

The Contractor provides Final QACP and Management Plan to

COR

10 weeks prior to the

The Contractor provide Final ATP to the COR

10 weeks prior to exam The Contractor provides third-party security assessment, or a

System Security Plan and Requirements Traceability Matrix

10 weeks prior to exam The government notifies the Contractor of any required change in testing site locations

Y

10 weeks prior to exam The Contractor provides web address (i.e. URL link) for

Government acceptance of the Contractor-developed Practice

CBLE for public use

8 weeks prior to exam The government provides the five exam reference documents to the Contractor to be loaded into the testing system

Y

8 weeks prior to exam The government provides the CBLE questions, answer key, and post-exam survey questions

Y

8 weeks prior to exam The Contractor provides the finalized testing time slots (remote only) and testing sites (in person only)

NLT 6 weeks prior to

The Contractor delivers both CBLE Exam Systems after completion of internal testing for government acceptance

4 weeks prior to exam The Contractor delivers site selection website after completion of internal testing for government SAT and provides the link to examinees

4 weeks prior to exam The Government provides the CBLE Proctor’s Guide. Y

NLT 25 calendar days prior to exam

The government provides the Contractor with a list of registrants for the in person CBLE and remotely proctored CBLE.

Y

NLT 24 calendar days prior to exam

The Contractor contacts registrants via email with instructions on testing site selection (in person only), or with instructions on scheduling their remote exam.

NLT 21 calendar days prior to exam

The Contractor sends a reminder email to registrants who haven’t selected a testing site or testing time.

NLT 20 calendar days prior to exam

The registrants have selected their testing site or scheduled their remote exam.

19 calendar days prior to exam

Testing Site-Selection List for the in-person exam. Time-

Selection List for the remotely proctored exam.

3 weeks prior to exam The Contractor begins training Proctors

2 weeks prior to exam The Contractor finalizes reasonable accommodations for ADA registrants

2 weeks prior to exam The Contractor has completed Proctor training.

1 week prior to exam The Contractor provides executed Proctor NDAs to COR

7 business days prior to exam

The Contractor issues admission tickets to registrants with a confirmation of testing site selection (for in-person exam)/exam time selection (for remotely proctored exam) with check-in information and behavior requirements.

5 business days prior to

The Contractor finalizes registration changes: allows registrants to change their exam testing site and time selection if any spaces are open

4 business days prior to

The Contractor issues updated admission tickets (due to registration change)

72 hours prior to exam The Contractor issues a reminder of examination email with check-in information and behavior requirements.

2 business days prior The government provides the final report of withdrawals to the

Contractor

Y

Exam day The Contractor provides a War Room;

The Contractor administers the CBLE;

The Contractor provides Answer Records to examinees;

The Contractor provides a scanned copy of any paper exams to the COR.

1 business day after

The Contractor shall provide the After Exam Site Report and

Exam No-Show Report

3 business days after

The Contractor provides initial item analysis report

5 business days after exam

The Contractor provides uncompleted paper copies of exam

3 business days after

CBP Item

Determination

The Contractor provides the final item analysis

Within 3 business days following the submission of the finalized item analysis

The Contractor provides the site score report, survey data report, and raw data report

120 calendar days after exam (unless otherwise directed by CBP COR)

The Contractor deletes all CBLE data including but not limited to, examinee PII, exam recordings, and check-in verification data.

120 calendar days after

The government will provide a list of examinees whose records are to be maintained by the Contractor until the government instructs the Contractor to destroy the records.

Y

125 calendar days after exam or within 5 days of purging, whichever occurs first

The Contractor provides a Certificate of Destruction

Annually, No Later than

October 31st

Renew DHS Privacy, Rules of Behavior, and Information

Technology Training Certificates (Returning Proctors will also have to maintain this annual recertification, newly hired Proctors will have to submit training certificates, NDA, and Rules of

Behavior form per deliverables table)

60 calendar days after

The Contractor provides the Transition Out Plan

5.3 Exam System

5.3.1 The Contractor shall provide an electronic exam delivery system (NLT six (6) weeks prior to the exam) to administer the CBLE to include, but not to be limited to:

a) A responsive electronic exam delivery system without noticeable loading or time lag in displaying information after input from the system user;

b) Access to reference documents (COR will provide to the Contractor eight (8) weeks prior to the exam);

c) Monitor and display elapsed time after the examinee begins the CBLE and will end the test after 4 hours and 30 minutes.

d) The CBLE exam system shall provide a warning when there are ten (10)-minutes left and one (1)-minute left in the exam.

e) View an Answer Record page, which includes: a numbered list (1-80) with the corresponding selected answer (A through E) or in the case of an unanswered question, display “No Answer Provided;”

f) From the Answer Record page, the examinee shall be able to select and return to any question, as well as change previously answered questions;

g) The navigation buttons shall allow examinees to go to the next question, skip a question, go back to the previous question, and change previously answered questions;

h) Highlight words within the questions; and

i) Display the Answer Record Page prior to the examinee submitting the CBLE.

No answer is final until the examinee has pressed “submit” after reviewing the

“Answer Record” page. *Note* This is a different requirement than above.

This requirement is meant for the last page of the test. The previous requirement is for access at any point during the test.

5.3.2 The Contractor shall load the 80-question exam that is provided as GFI onto the

CBLE delivery system for each delivery of the exam.

5.3.3 The Contractor shall deliver an exam system that accommodates ADA requests

(e.g., extra time to complete the exam, display/font sizes, etc.).

5.4 Exam Administration Requirements

5.4.1 General

5.4.1.1 The Contractor shall issue admission tickets to all registrants via email no later than seven (7) business days prior to the exam. The admission ticket shall include the registrant’s name, unique identifier and the date, time, testing site, and other administrative information for the day of exam.

5.4.1.2 The Contractor shall, upon receipt of a report of withdrawals from the government (seven (7) business days before the exam), allow registrants to change their exam testing site and time selection if any spaces are open (up to five (5) business days prior to the exam). Testing site changes due to withdrawals will require an updated admission ticket issued no later than four (4) business days prior to the exam.

5.4.1.3 The Contractor shall facilitate ADA requests, to include, but to not be limited to, extra time to complete the exam, display/font sizes, separate room, or special facilities, an individual proctor, or other similar accommodations. The government typically receives about ten (10) ADA requests per exam. The

Contractor shall propose reasonable accommodations for government review. With government agreement, the Contractor shall notify ADA registrants no later than two (2) weeks prior to the exam if their ADA requests are approved or not.

5.4.1.4 The Contractor shall check-in each examinee by their admission ticket and verify the Contractor assigned unique identification number and U.S. citizenship or naturalization of each examinee prior to exam start time. The Contractor shall keep no record of the citizenship verification information.

5.4.1.5 The Contractor shall provide examinees with the “Answer Record” page upon exam completion, either via email to the examinee or via hard copy at the testing site on the day of the exam.

5.4.1.6 The Contractor shall provide a single location (War Room) for the

Contractor and government to maintain operational awareness of the administration of the exam and to resolve and track issues as they arise. Issues may include, but are not limited to:

a) Disconnections from the Proctor

b) Unauthorized Internet search

c) Inappropriate or hostile behavior

d) Use of unauthorized computer program

e) Any termination before the examinee is terminated, to include turning away an examinee during the check-in process.

5.4.1.6.1 Examinees shall not be terminated for suspected cheating unless circumstances pose a threat to the integrity of the exam for the other examinees. Examinees shall be allowed to complete the exam and the

Proctor shall flag any suspected cheating incidents to be reviewed by CBP at a later time. Prior to any termination of an exam, or turning away an examinee during check-in, the Contractor must contact CBP via the War

Room to receive prior approval.

5.4.1.6.2 If any data, including video, is retained for the in-person or remote proctoring exam administration and there is an appeal, including appeals related to a suspected event of cheating, then the Contractor must maintain all data and video…