Solicitation_Sections_D-M_Final.docx

Section M

SECTION D:

PACKAGING & MARKING

[THIS SECTION IS INTENTIONALLY LEFT BLANK]

[END OF SECTION D]

CALIFORNIA WIDE DETENTION SERVICES SOLICITATION 70CDCR20R00000002

SECTION E:

INSPECTION AND ACCEPTANCE

*Note: All information in this section of the solicitation is applicable to all awards for all Requirements

E.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text can be accessed electronically at this internet address:

https://www.acquisition.gov/browse/index/far

E.2 INSPECTION REQUIREMENTS

Review of Deliverables ---

a. The COR will provide written acceptance, comments and/or change requests, if any, within thirty (30) business days from receipt by the Government of the initial deliverable.

b. Upon receipt of the Government comments, the Contractor shall have fifteen (15) business days to incorporate the Government's comments and/or change requests and to resubmit the deliverable in its final form.

c. If written acceptance, comments and/or change requests are not issued by the Government within thirty (30) calendar days of submission, the draft deliverable shall be deemed acceptable as written and the Contractor may proceed with the submission of the final deliverable product. The Contractor shall provide all deliverables to the COR in Microsoft Excel, PowerPoint or Word format.

E.3 DELIVERABLES CHART (Note that some of these deliverables are due upon submission of Proposal):

Submitted within 5 days after award. For all new candidates, prior to Entry on Duty (EOD)

Notification immediately to COR (immediate verbal report, with written follow-up)

Within 30 calendar days of contract award

Plan Within 30 calendar days after award of contract, then annually or as requested by COR

Within 30 calendar days of award of contract

including TB test For all new employees and after diagnosed with illness or communicable disease. Employees must be re-examined and medically cleared before returning to work. TB test certification annually.

Records related to performance by contractor As requested by CO or COR at any time during the term of the contract or at termination/expiration.

To FOD, DFOD & COR prior to release

Immediately to COR

As requested by COR

To COR within four (4) hours of incident

*The word “immediately” or “immediate,” as used above in the Deliverables Chart is defined as “as soon as reasonably possible”. The Contractor should use prudent and reasonable judgement to determine the timeframe necessary to notify the Government as defined above based on the situation, but it should not exceed a reasonable timeframe to notify the Government. For example, a reasonable timeframe for reporting a physical force incident to the Government is as soon as the incident that required a physical force response has been contained. A reasonable timeframe to notify the Government of an attempted escape is after the detainee is back, safely within the confines of the building. A reasonable timeframe to report an actual escape in which the Contractor does not locate the detainee is as soon as the Contractor realizes there has been an escape. In the case of a conflict between the Program Office and the Contractor on a reasonable timeframe, the Contracting Officer will determine the appropriate reasonable timeframe.

E.4 ACCEPTANCE CRITERIA

The Government will provide written notification of acceptance or rejection of all final deliverables within thirty (30) calendar days. Absent written notification, final deliverables may be construed as accepted. All notifications of rejection will be accompanied with an explanation of the specific deficiencies causing the rejection.

[THE BALANCE OF THIS PAGE IS INTENTIONALLY LEFT BLANK]

[END OF SECTION E]

Section E

SECTION F:

DELIVERIES OR PERFORMANCE

F.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text can be accessed electronically at this internet address: https://www.acquisition.gov/browse/index/far

Clause Number Clause Title Date

52.242-15 Stop Work Order Aug 1989

52.242-17 Government Delay of Work Apr 1984

F.2 PERIOD OF PERFORMANCE

Each contract, when awarded, will have an anticipated period of performance which will include a base period of five (5) years and two additional five (5) year options. Included in the base period will be a sixty (60) day transition period (if necessary).

The anticipated period of performance for all requirements will be as follows:

F.3 PLACE OF PERFORMANCE:

Address of the place of performance will be filled in after award.

See PWS Addendums for additional details.

In general, the facility requirements are as follows:

· One facility or several facilities shall house a minimum of approximately 700 adult males and female detainees within the San Diego AOR (hereby referred to as “Requirement A”). This facility(ies) shall be located within 50 miles from 1150 E Birch St., Calexico, California, 92231 to maximize transportation and manpower efficiencies. The facility(ies) shall be located within appropriate proximity and access to emergency services (medical, fire protection, law enforcement, etc.). The Contractor shall also provide armed transportation services and at a minimum, have the ability to securely transport 300 or more detainees within any given 24-hour period. The Contractor shall also be able to provide the following supportive services: Armed transportation services; On-call guard services; Medical (health) services; and food service.

· One facility or several facilities shall house a minimum of approximately 2,100 adult males and female detainees within the San Diego AOR (hereby referred to as “Requirement B”). This facility(ies) must be located within 50 miles of 880 Front Street, San Diego, CA 92101 to maximize transportation and manpower efficiencies. The facility shall be located within appropriate proximity and access to emergency services (medical, fire protection, law enforcement, etc.).

· One or several facilities shall house a minimum of approximately 1,150 adult male and female detainees within the San Francisco AOR (hereby referred to as “Requirement C”). The facility(ies) must be within 75 miles from Bakersfield, Fresno, Sacramento, San Francisco, Stockton, Morgan Hill, or Redding cities to maximize transportation and manpower efficiencies. The facility must also have the following: a medical unit that meets the Franco statue dealing with mental health intake screening; at least 15 VTC capable rooms to be utilized for asylum officer visits and consulate interviews; courtroom, offices and workstations. The Contractor shall also be able to provide the following supportive services: Armed transportation services; On-call guard services; Medical (health) services; and food service.

· One or several facilities shall house a minimum of approximately 2,800 adult male and female detainees within the Los Angeles AOR (hereby referred to as “Requirement D”). The facility(ies) must be a maximum of 100 miles from the Los Angles Field office located at 300 North Los Angeles Street, Los Angeles, CA 90012. The facility shall be located within appropriate proximity and access to emergency services (medical, fire protection, law enforcement, etc.). The Contractor shall also be able to provide the following supportive services: Armed transportation services; On-call guard services; Medical (health) services; and food service.

At a minimum each of the proposed facility(ies) must be able to house a minimum of 250 detainees and will require:

· Each facility may have the ability to house transgender detainees (see U.S. ICE Guidance Regarding the Care of Transgender Detainees, Policy 11065)

· Administrative segregation for male and female detainees

· A transportation hub for picking up and dropping off ICE detainees.

· Required medical administrative facilities (see PWS addendum for specific requirements)

· Adequate amount of court rooms (see PWS addendum for specific requirements)

· Adequate Office and Administrative Space for ICE staff (see PWS addendum for specific requirements)

· Secured Parking Spaces as required (see PWS addendum for specific requirements) (including bus parking)

· Contractor will be required to house an exterior, temporary, 2,000-gallon (all exclusive) fuel tank on skids. ICE may utilize a portion of the contractors concrete parking area for short term storage of the fuel tank in emergency situations.

Each facility shall be managed and operable 24 hours a day, 7 days a week for 365 days a year, and 366 days a year for any leap years. The services at all facilities shall be conducted in accordance with industry standards and ICE’s Performance Based National Detention Standards (PBNDS) 2011, as revised in 2016, as well as applicable federal, state, and local laws, regulations, codes, guidelines, policies and standards. The facilities must meet the requirements of the DHS Final Rule, 6 CFR Part 115, Standards to Prevent, Detect, and Respond to Sexual Abuse and Assault in Confinement Facilities, also known as the DHS Prison Rape Elimination Act (PREA) Standards applicable to immigration detention facilities.

F.4 CONTRACTOR EVALUATING PROCEDURES:

The Government will issue Contractor performance ratings for each awarded requirement from this solicitation via the Contractor Performance Assessment Reporting System (CPARS) in accordance with FAR 42.1502. The CPARS website is located: http://www.cpars.gov.

[THE BALANCE OF THIS PAGE IS INTENTIONALLY LEFT BLANK]

[END OF SECTION F]

Section F

SECTION G:

CONTRACT ADMINISTRATION DATA

*Note: All information in this section of the solicitation is applicable to all awards for all Requirements

G.1 CONTRACT ADMINISTRATION

Notwithstanding the Contractors’ responsibility for total management responsibility during the performance of this contract(s), the administration of the contract(s) will require maximum coordination between ICE and the Contractor.

The Government points of contact for any resulting contract(s) shall be identified at time of award.

G.2 CONTRACTING OFFICER’S REPRESENTATIVE

The following individual is designated and authorized by the CO to perform contract administration functions related to the technical performance of this contract(s).

To Be Designated at Time of Award

(a) The Contracting Officer (CO) may designate Government personnel to act as the Contracting Officer's Representative(s) (COR) to perform functions under the contract such as review or inspection and acceptance of supplies, services, including construction, and other functions of a technical nature. The CO will provide a written notice of such designation to the Contractor within five (5) working days after contract award. The designation letter will set forth the authorities and limitations of the COR under the contract.

(b) The CO cannot authorize the COR or any other representative to sign documents, such as contracts, contract modifications, etc., that require the signature of the CO.

G.3 INVOICE REQUIREMENTS

In accordance with Section G, Contract Administration Data, invoices shall be submitted as follows:

Service Providers/Contractors shall use these procedures when submitting an invoice.

1. Invoice Submission: Invoices shall be submitted in a “.pdf” format in accordance with the contract terms and conditions [Contract Specialist and Contracting Officer to disclose if on a monthly basis or other agreed to terms"] via email, United States Postal Service (USPS) or facsimile as follows:

a) Email:

• Invoice.Consolidation@ice.dhs.gov

• Contracting Officer Representative (COR) or Government Point of Contact (GPOC)

• Contract Specialist/Contracting Officer

Each email shall contain only (1) invoice and the invoice number shall be indicated on the subject line of the email.

b) USPS:

DHS, ICE

Financial Operations - Burlington P.O. Box 1620 Williston, VT 05495-1620

ATTN: (utilize code below based on which requirement)

Codes:

Requirements A&B: ICE-ERO-FOD-SND Requirement C: ICE-ERO-FOD-SFR Requirement D: ICE-ERO/FOD-LA

The Contractors Data Universal Numbering System (DUNS) Number must be registered and active in the System for Award Management (SAM) at https://www.sam.gov prior to award and shall be notated on every invoice submitted to ensure prompt payment provisions are met. The ICE program office identified in the task order/contract shall also be notated on every invoice.

c) Facsimile:

Alternative Invoices shall be submitted to: (802)-288-7658

Submissions by facsimile shall include a cover sheet, point of contact and the number of total pages. The Service Provider’s or Contractor’s Dunn and Bradstreet (D&B) DUNS Number must be registered in the System for Award Management (SAM) at https://www.sam.gov prior to award and shall be notated on every invoice submitted to ensure prompt payment provisions are met. The ICE program office identified in the task order/contract shall also be notated on every invoice.

2. Content of Invoices: Each invoice shall contain the following information in accordance with 52.212-4 (g), as applicable:

(i). Name and address of the Service Provider/Contractor. Note: the name, address and DUNS number on the invoice MUST match the information in both the Contract/Agreement and the information in the SAM. If payment is remitted to another entity, the name, address and DUNS information of that entity must also be provided which will require Government verification before payment can be processed;

(ii). Dunn and Bradstreet (D&B) DUNS Number;

(iii). Invoice date and invoice number;

(iv). Agreement/Contract number, contract line item number and, if applicable, the order number;

(v). Description, quantity, unit of measure, unit price, extended price and period of performance of the items or services delivered;

(vi). If applicable, shipping number and date of shipment, including the bill of lading number and weight of shipment if shipped on Government bill of lading;

(vii). Terms of any discount for prompt payment offered;

(viii). Remit to Address;

(ix). Name, title, and phone number of person to resolve invoicing issues;

(x). ICE program office designated on order/contract/agreement and

(xi). Mark invoice as “Interim” (Ongoing performance and additional billing expected) and “Final” (performance complete and no additional billing)

(xii). Electronic Funds Transfer (EFT) banking information in accordance with 52.232-33 Payment by Electronic Funds Transfer – System for Award Management or 52.232-34, Payment by Electronic Funds Transfer – Other than System for Award Management.

3. Invoice Supporting Documentation. To ensure payment, the vendor must submit supporting documentation which provides substantiation for the invoiced costs to the Contracting Officer Representative (COR) or Point of Contact (POC) identified in the contract. Invoice charges must align with the contract CLINs. Supporting documentation is required when guaranteed minimums are exceeded and when allowable costs are incurred.

Details are as follows:

(i). Guaranteed Minimums. If a guaranteed minimum is not exceeded on a CLIN(s) for the invoice period, no supporting documentation is required. When a guaranteed minimum is exceeded on a CLIN (s) for the invoice period, the Contractor is required to submit, along with the invoice, supporting documentation for all detention services provided during the invoice period which provides the information described below:

• Bed day rate;

• Detainees check-in and check-out dates;

• Number of bed days multiplied by the bed day rate;

• Name of each detainee;

• Detainees identification information

(ii). Allowable Incurred Cost. Fixed Price Items (items for allowable incurred costs, such as transportation services, stationary guard or escort services, transportation mileage or other Minor Charges such as sack lunches and detainee wages): shall be fully supported with documentation substantiating the costs and/or reflecting the established price in the contract and shall be submitted in .pdf format:

a. Detention Bed Space Services. For detention bed space CLINs without a GM, the supporting documentation must include:

• Bed day rate;

• Detainees check-in and check-out dates;

• Number of bed days multiplied by the bed day rate;

• Name of each detainee;

• Detainees identification information

b. Transportation Services: For transportation CLINs without a GM, the supporting documentation must include:

• Mileage rate being applied for that invoice;

• Number of miles;

• Transportation routes provided;

• Locations serviced;

• Names of detainees transported;

• Itemized listing of all other charges; and,

• For reimbursable expenses (e.g. travel expenses, special meals, etc.) copies of all receipts.

c. Stationary Guard Services: The itemized monthly invoice shall state:

• The location where the guard services were provided,

• The employee guard names and number of hours being billed,

• The employee guard names and duration of the billing (times and dates), and

• for individual or detainee group escort services only, the name of the detainee(s) that was/were escorted.

d. Other Direct Charges (e.g. VTC support, transportation meals/sack lunches, volunteer detainee wages, etc.):

1) The invoice shall include appropriate supporting documentation for any direct charge billed for reimbursement. For charges for detainee support items (e.g. meals, wages, etc.), the supporting documentation should include the name of the detainee(s) supported and the date(s) and amount(s) of support.

(iii) Firm Fixed-Price CLINs. Supporting documentation is not required for charges for FFP CLINs.

4. Safeguarding Information: As a contractor or vendor conducting business with Immigration and Customs Enforcement (ICE), you are required to comply with DHS Policy regarding the safeguarding of Sensitive Personally Identifiable Information (PII). Sensitive PII is information that identifies an individual, including an alien, and could result in harm, embarrassment, inconvenience or unfairness. Examples of Sensitive PII include information such as: Social Security Numbers, Alien Registration Numbers (A-Numbers), or combinations of information such as the individuals name or other unique identifier and full date of birth, citizenship, or immigration status.

As part of your obligation to safeguard information, the follow precautions are required:

(i) Email supporting documents containing Sensitive PII in an encrypted attachment with password sent separately to the Contracting Officer Representative assigned to the contract.

(ii) Never leave paper documents containing Sensitive PII unattended and unsecure. When not in use, these documents will be locked in drawers, cabinets, desks, etc. so the information is not accessible to those without a need to know.

(iii) Use shredders when discarding paper documents containing Sensitive PII.

(iv) Refer to the DHS Handbook for Safeguarding Sensitive Personally Identifiable Information (March 2012) found at http://www.dhs.gov/xlibrary/assets/privacy/dhs-privacy-safeguardingsensitivepiihandbook-march2012.pdf for more information on and/or examples of Sensitive PII.

5. Invoice Inquiries. If you have questions regarding payment, please contact ICE Financial Operations at 1-877-491-6521 or by e-mail at OCFO.CustomerService@ice.dhs.gov.

Invoices without the above information may be returned for resubmission.

The preferred method of submittal is email.

[THE BALANCE OF THIS PAGE IS INTENTIONALLY LEFT BLANK]

[END OF SECTION G]

Section G

SECTION H:

SPECIAL CONTRACT REQUIREMENTS

*Note: All information in this section of the solicitation is applicable to all awards for all Requirements

1.1 CONTRACTOR’S INSURANCE

The Contractor shall maintain insurance in an amount not less than $3,000,000 to protect the Contractor from claims under workman’s compensation acts and from any other claims for damages for personal injury, including death which may arise from operations under this contract whether such operations by the Contractor itself or by any subcontractor or anyone directly or indirectly employed by either business entity. The Contractor shall maintain General Liability insurance: bodily injury liability coverage written on a comprehensive form of policy of at least $500,000 per occurrence is required.

Additionally, an automobile liability insurance policy providing for bodily injury and property damage liability covering automobiles operated in the United States shall provide coverage of at least $200,000 per person and $500,000 per occurrence for bodily injury and $20,000 per occurrence for property coverage. Certificates of such insurance shall be subject to the approval of the CO for adequacy of protection. All insurance certificates required under this contract shall provide 30 days’ notice to the Government of any contemplated cancellation.

The Contractor shall provide that all staff having access to detainee monies and valuables are bonded in an amount sufficient to ensure reimbursement to the detainee by the Contractor in case of loss.

1.2 ICE Information Governance and Privacy Requirements Clause (JUL 2017)

Guidance: In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), FAR 52.224-3 Privacy Training (JAN 2017), and HSAR Clauses, the following IGP clause must be included in its entirety in all contracts. No section of this clause may be read as self-deleting unless the terms of the contract meet the requirements for self-deletion as specified in this clause.

A. Limiting Access to Privacy Act and Other Sensitive Information

(1) Privacy Act Information In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires contractor personnel to have access to information protected by the Privacy Act of 1974 the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at www.dhs.gov/privacy. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching FDsys, the Federal Digital System, available at http://www.gpo.gov/fdsys/. SORNs may be updated at any time.

(2) Prohibition on Performing Work Outside a Government Facility/Network/Equipment The Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

(3) Prior Approval Required to Hire Subcontractors The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

(4) Separation Checklist for Contractor Employees Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII. In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

B. Privacy Training, Safeguarding, and Remediation

If the Safeguarding of Sensitive Information (MAR 2015) and Information Technology Security and Privacy Training (MAR 2015) clauses are included in this contract, section B of this clause is deemed self- deleting.

(1) Required Security and Privacy Training for Contractors

Contractor shall provide training for all employees, including Subcontractors and independent contractors who have access to sensitive personally identifiable information (PII) as well as the creation, use, dissemination and/or destruction of sensitive PII at the outset of the employee’s work on the contract and every year thereafter. Training must include procedures on how to properly handle sensitive PII, including security requirements for the transporting or transmission of sensitive PII, and reporting requirements for a suspected breach or loss of sensitive PII. All Contractor employees are required to take the Privacy at DHS: Protecting Personal Information training course. This course, along with more information about DHS security and training requirements for Contractors, is available at www.dhs.gov/dhs-security-and-training-requirements-contractors. The Federal Information Security Management Act (FISMA) requires all individuals accessing ICE information to take the annual Information Assurance Awareness Training course. These courses are available through the ICE intranet site or the Agency may also make the training available through hypertext links or CD. The Contractor shall maintain copies of employees’ certificates of completion as a record of compliance and must submit an annual e-mail notification to the ICE Contracting Officer’s Representative that the required training has been completed for all the Contractor’s employees.

(2) Safeguarding Sensitive PII Requirement Contractor employees shall comply with the Handbook for Safeguarding sensitive PII at DHS at all times when handling sensitive PII, including the encryption of sensitive PII as required in the Handbook. This requirement will be flowed down to all subcontracts and lower tiered subcontracts as well.

(3) Non-Disclosure Agreement Requirement All Contractor personnel that may have access to PII or other sensitive information shall be required to sign a Non-Disclosure Agreement (DHS Form 11000-6) prior to commencing work. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) Prohibition on Use of PII in Vendor Billing and Administrative Records The Contractor’s invoicing, billing, and other financial/administrative records/databases may not store or include any sensitive Government information, such as PII that is created, obtained, or provided during the performance of the contract. It is acceptable to list the names, titles and contact information for the Contracting Officer, Contracting Officer’s Representative, or other ICE personnel associated with the administration of the contract in the invoices as needed.

(5) Reporting Suspected Loss of Sensitive PII Contractors must report the suspected loss or compromise of sensitive PII to ICE in a timely manner and cooperate with ICE’s inquiry into the incident and efforts to remediate any harm to potential victims.

1. The Contractor must develop and include in its security plan (which is submitted to ICE) an internal system by which its employees and Subcontractors are trained to identify and report the potential loss or compromise of sensitive PII.

2. The Contractor must report the suspected loss or compromise of sensitive PII by its employees or Subcontractors to the ICE Security Operations Center (480-496-6627), the Contracting Officer’s Representative (COR), and the Contracting Officer within one (1) hour of the initial discovery.

3. The Contractor must provide a written report to ICE within 24 hours of the suspected loss or compromise of sensitive PII by its employees or Subcontractors. The report must contain the following information:

a. Narrative or detailed description of the events surrounding the suspected loss or compromise of information.

b. Date, time, and location of the incident.

c. Type of information lost or compromised.

d. Contractor’s assessment of the likelihood that the information was compromised or lost and the reasons behind the assessment.

e. Names of person(s) involved, including victim, Contractor employee/Subcontractor and any witnesses.

f. Cause of the incident and whether the company’s security plan was followed and, if not, which specific provisions were not followed.

g. Actions that have been or will be taken to minimize damage and/or mitigate further compromise.

h. Recommendations to prevent similar situations in the future, including whether the security plan needs to be modified in any way and whether additional training may be required.

4. The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

5. At the Government’s discretion, Contractor employees or Subcontractor employees may be identified as no longer eligible to access sensitive PII or to work on that contract based on their actions related to the loss or compromise of sensitive PII.

6. Victim Remediation The Contractor is responsible for notifying victims and providing victim remediation services in the event of a loss or compromise of sensitive PII held by the Contractor, its agents, or its Subcontractors, under this contract. Victim remediation services shall include at least 18 months of credit monitoring and, for serious or large incidents as determined by the Government, call center help desk services for the individuals whose sensitive PII was lost or compromised. The Contractor and ICE will collaborate and agree on the method and content of any notification that may be required to be sent to individuals whose sensitive PII was lost or compromised.

C. Government Records Training, Ownership, and Management

(1) Records Management Training and Compliance

(a) The Contractor shall provide DHS basic records management training for all employees and Subcontractors that have access to sensitive PII as well as to those involved in the creation, use, dissemination and/or destruction of sensitive PII. This training will be provided at the outset of the Subcontractor’s/employee’s work on the contract and every year thereafter. This training can be obtained via links on the ICE intranet site or it may be made available through other means (e.g., CD or online). The Contractor shall maintain copies of certificates as a record of compliance and must submit an e-mail notification annually to the Contracting Officer’s Representative verifying that all employees working under this contract have completed the required records management training.

(b) The Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format, mode of transmission, or state of completion.

(2) Records Creation, Ownership, and Disposition

(a) The Contractor shall not create or maintain any records not specifically tied to or authorized by the contract using Government IT equipment and/or Government records or that contain Government Agency data. The Contractor shall certify in writing the destruction or return of all Government data at the conclusion of the contract or at a time otherwise specified in the contract.

(b) Except as stated in the Performance Work Statement and, where applicable, the Contractor’s Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

(c) The Contractor shall not retain, use, sell, disseminate, or dispose of any government data/records or deliverables without the express written permission of the Contracting Officer or Contracting Officer’s Representative. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. § 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the Agency records schedules.

D. Data Privacy and Oversight

Section D applies to information technology (IT) contracts. If this is not an IT contract, section D may read as self-deleting.

(1) Restrictions on Testing or Training Using Real Data Containing PII The use of real data containing sensitive PII from any source for testing or training purposes is generally prohibited. The Contractor shall use synthetic or de-identified real data for testing or training whenever feasible. ICE policy requires that any proposal to use of real data or de-identified data for IT system testing or training be approved by the ICE Privacy Officer and Chief Information Security Officer (CISO) in advance. In the event performance of the contract requires or necessitates the use of real data for system-testing or training purposes, the Contractor in coordination with the Contracting Officer or Contracting Officer’s Representative and Government program manager shall obtain approval from the ICE Privacy Office and CISO and complete any required documentation.

If this IT contract contains the Safeguarding of Sensitive Information (MAR 2015) and Information Technology Security and Privacy Training (MAR 2015) clauses, section D(2) of this clause is deemed self-deleting.

(2) Requirements for Contractor IT Systems Hosting Government Data The Contractor is required to obtain a Certification and Accreditation for any IT environment owned or controlled by the Contractor or any Subcontractor on which Government data shall reside for the purposes of IT system development, design, data migration, testing, training, maintenance, use, or disposal.

(3) Requirement to Support Privacy Compliance

(a) The Contractor shall support the completion of the Privacy Threshold Analysis (PTA) document when it is required. PTAs are triggered by the creation, modification, upgrade, or disposition of an IT system, and must be renewed at least every three years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required.

The Contractor shall provide adequate support to complete the PIA in a timely manner, and shall ensure that project management plans and schedules include the PTA, PIA, and SORN (to the extent required) as milestones. Additional information on the privacy compliance process at DHS, including PTAs, PIAs, and SORNs, is located on the DHS Privacy Office website (www.dhs.gov/privacy) under “Compliance.” DHS Privacy Policy Guidance Memorandum 2008-02 sets forth when a PIA will be required at DHS, and the Privacy Impact Assessment Guidance and Template outline the requirements and format for the PIA.

(b)If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under “Key Personnel.” The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Office, the Office of the Chief Information Officer, and the Records Management Branch to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy Office and other offices are answered in a timely fashion. The Privacy Lead:

•Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

•Must have excellent verbal communication and organizational skills.

•Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

•Must be knowledgeable about the Privacy Act of1974 and the E-Government Act of 2002.

•Must be able to work well with others.

(c)If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement fora separate Private Lead specifically assigned under this contract may be waived provided the Contractor agrees to have the existing Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA,SORN, or other supporting documentation to support privacy compliance if required. The Contractor shall work with personnel from the program office, the ICE Office of Information Governance and Privacy, and the Office of the Chief Information Officer to ensure that the privacy documentation is kept on schedule, that the answers to questions in any privacy documents are thorough and complete, that all records management requirements are met, and that questions asked by the ICE Privacy Office and other offices are answered in a timely fashion.

(End of Provision)

[THE BALANCE OF THIS PAGE IS INTENTIONALLY LEFT BLANK]

Section H

[END OF SECTION H]

SECTION I:

SOLICITATION PROVISONS

*Note: All information in this section of the solicitation is applicable to all awards for Requirements A, B, and C*

I.1 CLAUSES INCORPORATED BY REFERENCE (FAR 52.252-2) (FEB 1998)

This contract incorporates the following clauses by reference with the same force and effect as if they were given in full text. Upon request, the CO will make their full text available. Also, the full text can be accessed electronically at this internet address: https://www.acquisition.gov/browse/index/far

Number Titles DATE

52.202-1 Definitions Nov 2013

52.203-6 Restrictions on Subcontractor Sales to the Government Sep 2006

52.203-12 Limitations on Payments to Influence Certain Federal Oct 2010 Transactions

52.203-13 Contractor Code of Business Ethics and Conduct Oct 2015

52.203-17 Contractor Employee Whistleblower Rights and Requirement Apr 2014 to Inform Employees of Whistleblower Rights

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber May 2011 Content Paper

52.204-9 Personal Identity Verification of Contractor Personnel Jan 2011

52.204-10 Reporting Executive Compensation and First-Tier Oct 2018 Subcontract Awards

52.204-13 System for Award Management Maintenance Oct 2018

52.204-15 Service Contract Reporting Requirements for Indefinite - Oct 2016 Delivery Contracts

52.204-18 Commercial and Government Entity Code Maintenance Jul 2016

52.204-19 Incorporation by Reference of Representations and Dec 2014 Certifications

52.209-6 Protecting the Government’s Interest When…