PWS_FY24 EMI ISP Support Contract.pdf

December 7, 2023 Performance Work Statement

Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA)

Emergency Management Institute (EMI) Curriculum Standards and Instructional Technology Branch

Independent Study Program Support Services

1.0 GENERAL

1.1 Background

FEMA, which was incorporated into the Department of Homeland Security on March 1, 2003, is the coordinator within the Federal government for a wide range of emergency management activities. FEMA is dedicated to working closely with all levels and branches of government, as well as related organizations of the emergency management community to achieve a realistic state of preparedness and an increased capacity to mitigate against, respond to and recover from emergencies of all types.

The agency has numerous roles, including coordinating government activities; providing planning, grants and technical assistance; guiding and advising various agencies; and delivering training.

The FEMA’s Emergency Management Institute (EMI) provides both training and technical assistance to State, tribal and local jurisdictions as well as our federal partners, other government agencies, and associated organizations such as the American Red Cross on a wide variety of topics related to emergency management.

The EMI’s Independent Study (IS) Program uses alternate delivery formats to provide emergency management training to State, tribal and local officials, Federal partners, and associated organizations in emergency management communities. This program provides free on-demand training that is available through downloadable format from the Web, or Web interactive materials.

The IS curriculum is increasing and expanding to include additional independent study/self-study courses from EMI. The total enrollments fluctuate between two-three million annually.

1.2 Scope

In support of FEMA’s IS Program, the Contractor shall provide all necessary support to meet the tasking and deliverables defined in Section 2.0, including:

• The Contractor shall provide the necessary educational/training/management support to effectively and efficiently manage and administer selected portions of FEMA's IS Program.

• The Contractor shall communicate with representatives from States (State Training Officers), local government, higher education programs, other Federal programs, related associations and organizations, and private citizens requesting access to training records or other information on the IS program and courses.

• The Contractor shall communicate with students on student services, such as applications and student profiles, student records, and official transcripts.

There are currently approximately 203 accredited courses available through the current contract.

These courses result in a combined average annual number of course completions of approximately two million.

1.3 Independent Study Formats

The IS Program uses various methods to deliver web-based training, including interactive online courses, video-based online courses, and text-based courses offered via downloadable PDF files.

The IS Program is an appropriated program with no charge to either individuals or organizations.

Requests for course enrollment are submitted online.

Each applicant is requested to supply basic information (i.e., name, address, identification number, organizational information, etc.). This information is either key-entered or delivered electronically into a secure automated OPM Independent Study Database. This system is used to:

• Manage student files

• Generate mailing labels

• Generate official transcripts

• Generate statistical reports

2.0 Requirements

The database is used to manage independent study courses offered by the Emergency Management Institute (EMI). The EMI Independent Study Database System enables EMI to manage courses, process student applications, and deliver and process student exams, certificates and transcripts.

The contractor shall become familiar with the system functions and be able to successfully use ISDBS by the end of the phase-in period.

Selected portions of FEMA’s IS Program include:

• Reconciling duplicate accounts

• Processing Group Verification Requests

• Processing requests for Official Transcripts

• Reporting

1. The Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C.

552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for

Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

8. The Contractor shall not create or maintain any records containing any non-public FEMA information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. FEMA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

2.1 Management and Administration of the IS Program

The contractor shall provide personnel with expertise to deliver effective customer service in an educational/training environment for the IS Program. Suitable standards for customer service in an educational/training environment shall be applied at all times when addressing IS students, potential students, EMI and FEMA staff and State, local, and tribal officials as customers, or others in contact with the IS program. The contractor shall provide general administrative support in selected areas of the Independent Study Program. The contractor shall, at a minimum, perform the following:

2.1.1 Reconcile Duplicate Accounts. Provide user support in the form of synchronous coaching on access reconciling duplicate accounts, refer program and policy issues to appropriate government sources, and identifying issues for referral for IT support. Reconcile accounts with duplicate or multiple Student Identification Numbers (SID). Contractor will have access to OPM database in order to rectify student access or duplicate account issues. Update, as necessary, the student course records in OPM database to reflect changes to general student information and profiles.

2.1.2 Process Mail (Electronic mail). Correspondence delivered via electronic mail and Internet shall be processed as soon as practical. Standard letter and email templates may be used, as appropriate. Approximately 20,000 email messages are answered annually. EMI Management has the prerogative to provide extensions, as necessary, due to system failures or significant surges in workload.

2.1.3 Routine Requests Response. Written requests/inquiries from students and local, State, tribal and regional offices regarding student status shall be responded to within five working days of receipt. This could include reviewing and processing requests from non-FEMA organizations. All telephone calls on the customer service call line shall be answered. Call center core hours of operations will be 8:00 a.m. – 4:30 p.m. Eastern Standard Time.

2.1.4 Group Verification Requests. The contractor will verify Group Verification Requests are accurate and meet all personally identifiable information (PII) safeguards. Once Group Verifications Request has been verified, the contractor will provide course completion data to the requestor.

2.1.5 Requests for Official Transcripts. Official transcripts are for educational institutions only.

The contractor shall prepare and send official transcript requests to various educational institutions, as requested by the student. Routine requests for official transcripts will typically be addressed to the contractor via the Student Portal. The contractor will use FEMA provide transcript paper to print and send transcripts via postal mail.

2.1.6 Management Meetings. Meet with the COR and/or other FEMA representatives or other participating agencies upon request but no more than once a month to discuss the status and accomplishments of the IS program.

2.1.7 New Technologies. The contractor shall provide support in the evaluation of any technologies used to support the Independent Study program. This will include testing of the software capabilities and functionality and recommending changes, updates or new features within the system to best support the program. This will ensure a smooth transition from the current system to the new system. Once the new system is implemented, the contractor will continue to provide recommendations for future enhancements, based on customer feedback and additional required functionality. As the new system is implemented, and for older courses, the contractor may also be required to review and update general course information, such as how to access the courses.

2.1.8 Implement and Maintain a Standard Operating Procedure (SOP). An SOP shall be maintained to address management procedures that shall be applied to the administration of the IS program. The SOPs shall contain both business rules and workflow processes. The SOP shall outline the procedures for daily operations to include reconciling duplicate accounts, group verification requests, student requests for official transcripts, handling calls (job aids), and other areas that may be included to clearly define administrative processes to support the effective management of the IS program. Revisions to the current SOP shall be delivered to the COR for review within two months of contract award and shall be updated annually. Annual updates shall be delivered to the COR for review within two months of start of the next annual period. If a contract modification results in any changes to this Performance Work Statement, an updated or amended SOP will be delivered within two months of the effective date of that contract modification.

2.1.9 Reporting. The contractor shall provide a monthly status report in writing to the COR. The contractor shall maintain and provide statistical data and metrics across all program areas. The monthly report shall include general statistical data which addresses the performance work statements in this document. As a minimum, the report shall include data on: number of email, telephone, mail (postal) contacts; number of processed group verifications requests, number of official transcripts generated and mailed; and the total number of merged student records.

Additional reports or statistical data may be requested by the COR for special reporting requirements or to maintain the effectiveness of daily operations.

2.2 Phase-out

The contractor shall establish and implement plans for an orderly phase-out of the contracted operations at the termination of this contract, to include transfer of Government Furnished Property/Equipment back to the Government. The contractor shall submit a Phase-out Plan to the Contracting Officer and COR for evaluation 60 days prior to the last day of the contract. The contractor's phase-out procedures shall not disrupt or adversely impact the day-to-day conduct of Government business.

3.0 Contractor Personnel

3.1 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of award.

3.1.1 Program Manager

The Contractor shall provide a Program Manager who shall be responsible for all Contractor work performed under this PWS. The Program Manager shall be a single point of contact for the Contracting Officer and the COR. The Program Manager is further designated as Key by the Government. During any absence of the Program Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract.

The Program Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Program Manager without coordination with the COR and approval from the Contracting Officer via contract modification.

3.1.2 Assistant Program Manager

The Contractor shall provide an Assistant Program Manager who shall be responsible for all Contractor work performed under this PWS in the absence of the Program Manager. The Assistant Program Manager shall be able to read, write, speak and understand English.

3.2 Non-Key Personnel

3.2.1 Customer Service Representatives

The Government expects that five Customer Service Representatives (CSR) to perform under this contract to meet the tasking identified under Section 2 of this PWS, as well as the minimum qualifications provided below:

• Read, write, speak, and understand English

• Be computer-literate with Microsoft software such as Word, Excel, and Outlook

• Experienced in providing courteous customer support at a distance via telephone, email and the internet.

4.0 Place of Performance

Emergency Management Institute (EMI) 16825 S. Seton Avenue Emmitsburg, MD 21727

4.1 Office Space. EMI provides office space on campus for the contractor. The IS Program layout attachment shows the office space and accommodations provided. Alternate work locations, including telework, shall be approved by the CO/COR (see 4.3 for information).

4.2 Hours of Operation.

Contractor employees shall generally perform all work between the hours of 8:00 AM and 4:30 PM EST, Monday through Friday (except Federal holidays).

4.3 Episodic Telework.

The COR may authorize episodic telework in the event of severe weather, unplanned closure of the Government’s facility, or other episodic events that prevent or challenge contract personnel’s ability to work on site. During these periods of telework, contract employees will only be required to process/respond to ISP-related email using their government issued laptops. Processing telephone calls and postal mail will not be required when teleworking.

5.0 Period of Performance

The period of performance of this contract shall be 60 months, as follows:

Performance Period Performance Period Dates Phase-In (one month) 3/1/2025 – 3/31/2025 Base Period 4/1/2025 – 12/31/2025 Option Period 1 1/1/2026 – 12/31/2026 Option Period 2 1/1/2027 – 12/31/2027 Option Period 3 1/1/2028– 12/31/2028 Option Period 4 1/1/2029 – 12/31/2029 Option Period 5 1/1/2030 – 2/28/2030

6.0 Schedule of Deliverables

Deliverable Due to the COR Monthly Report 15 business days after end of month STO Monthly Report 10th Day Each Month Updated SOP Within 2 months of contract award or contract modification, annually thereafter.

In addition, if a contract modification results in any changes to this Performance Work Statement, an updated or amended SOP will be delivered within two months of the effective date of that contract modification.

Process Mail - Electronic 4 business days after received Process Mail - Fax, Postal and Express Mail 5 business days after received Routine Requests Response - Phone All calls answered and resolved, calls over

10 minutes documented in monthly report Process All Applications 10 business days after received Phase-Out Plan 60 days prior to end of contract

7.0 Security

Contractor employees working on any FEMA contract that requires unescorted access to FEMA owned or controlled facilities; access to FEMA information technology (IT) systems and systems’ data; access to sensitive information; or access to disaster victim information must meet HSPD-12 requirements. For some positions, FEMA will require a background investigation at the same level as the FEMA Federal employee in the same or similar position. Security clearance requirements for this task order are not expected to exceed Public Trust.

A. All new contractor employees must have a current background investigation conducted by FEMA or by another Federal agency where the employee previously worked. The Personnel Security Branch requires the contractor’s full name, DOB, and full SSN in order to confirm the current investigation submitted to Personnel Security on a Visit Authorization Request/Letter.

• Prior investigation must be current, available, and at the requisite level.

• There cannot be a break in Federal service or assignment on a federal contract in excess of two years.

• Reciprocity will be used whenever possible.

• If no prior investigation is available, the contract applicant requires an FBI fingerprint check conducted by FEMA Personnel Security, or approved location and determination of the appropriate type of background investigation (described in B.)

B. Type of Background Investigation Required for Public Trust level positions.

• Low Risk – Short term, less than 180 days requires a favorably adjudicated FBI fingerprint check and Credit Check by the FEMA Personnel Security Branch.

• Moderate Risk – For period of work on a FEMA contract for longer than 180 days requires a MBI and Credit or higher level of investigation. Employee may begin work after a favorable FBI fingerprint, Credit check and review of the SF 85P.

• High Risk – For work on a FEMA contract for any period of time in the following list of positions requires a BI or higher level of investigation.

List of Common High-Risk Positions Accountable Property Officer Accountant

• Accounting Officer Attorney

• Branch Chief Budget Analyst Budget Officer

• Certifying Technician/Officer Computer Specialist/Officer Contracting Officer Contracting Specialist

• Contracting Officer Representative (COR) Finance/Admin Branch Chief

• Financial Management Specialist Funds Control Technician

• Information Technology (IT) Specialist Logistics Management Specialist Logistics Specialist

• Logistics/IT Branch Chief

• Manager, Chief Financial Officer (CFO) Field Support Teams

Network Technician/Specialist

• Section Chief

• Security Specialist (Physical, Personnel)

Senior Computer Specialist

• Supervisory Logistics Management Specialist Traffic

Management Specialist

• Any Public Trust position with a government purchase card limit over $5,000.00

7.1 Standard Security Language

BACKGROUND INVESTIGATIONS

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed.

FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access Contractor personnel occupying positions or performing functions with a low risk designation and who do not require access to DHS or FEMA information systems shall undergo a Tier 1 (T1) background investigation which is equivalent to the previously identified National Agency Check with Inquiries (NACI). Either of these investigations must be supported by a separate credit check and must receive a favorable adjudication thereof from FEMA PSD prior to holder performing work under this contract. A favorably adjudicated NACI & C will remain acceptable for the purpose of reciprocity where a T1 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Low Risk with Information System Access Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Moderate Risk Contractor personnel occupying positions or performing functions with a moderate risk designation shall undergo a Tier 2 Suitability (T2S) background investigation which is equivalent to the previously identified Moderate Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated MBI will remain acceptable for the purpose of reciprocity where a T2S investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

High Risk Contractor personnel occupying positions or performing functions with a high-risk designation shall undergo a Tier 4 (T4) background investigation which is equivalent to the previously identified Background Investigation (BI) and must receive a favorable adjudication thereof from FEMA PSD prior to the holder performing work under this contract. A favorably adjudicated BI will remain acceptable for the purpose of reciprocity where a T4 investigation is required for a period of 5 years from the date of completion and favorable adjudication provided that all other requirements for the application of reciprocity are met.

Background Investigation Process Contractors performing on this contract must be United States Citizens. Contractor applicants must also be 18 years of age or older to allow for the conduct of certain security related queries.

To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete DHS Form 11000-25, “Contractor Fitness/Security Screening Request Form.” The FEMA COR shall ensure that all other applicable sections of the DHS Form 11000-25 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

• the investigation was completed within the last five years

• it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract

• the contractor personnel have not had a break in employment since the prior favorable adjudication; and,

• FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• Optional Form 306, “Declaration for Federal Employment”

• SF 87, “Fingerprint Card” (2 copies)

• DHS Form 11000-6, “Non-Disclosure Agreement”

• DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports

Pursuant to the Fair Credit Reporting Act”

Applicants born outside the United States will be required to provide proof of citizenship in the form of a Certificate of Naturalization (Form N550 or N570), an unexpired U.S. Passport, or State Department issued Consular Report of Birth Abroad (CRBA) (FS-240)

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Residency requirements apply to the background investigation process. Persons subject to investigation and final adjudication for fitness or suitability must have lived within the United States for no less than 3 of the last 5 years as defined in the DHS Instruction 121-01-007-01, The Department of Homeland Security, Personnel Security, Suitability and Fitness Program (June 14, 2016). DHS has determined this to be the amount of time required to be the sufficient minimum investigative period for the purpose of performing a suitability or fitness adjudication. Both, OPM and OMB require a final adjudicative decision to support the issuance of the HSPD-12 compliant PIV Card that contractors are issued by FEMA Physical Security.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable.

The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation Eligibility determinations based on a T1, T2S, or T4 (or the equivalent OPM investigation) are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

FACILITY ACCESS

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC).

FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and an OF306, Declaration for Federal Employment, and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

SEPARATION FROM CONTRACT

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

• When no longer needed for contract performance.

• Upon completion of a contractor employee’s employment.

• Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

SECURITY: All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S.

citizens. The contractor shall follow the standards established within DHS and FEMA policy.

OPSEC Training:

Contractors and Subcontractors who are working on this contract shall receive the OPSEC Awareness Brief. Access to the briefing can be obtained at Defense Technical Information Center (dtic.mil)

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

https://discover.dtic.mil/ https://discover.dtic.mil/

Insider Threat Training:

Insider Threat training for Contractors can be found at: Insider Threat Awareness (usalearning.gov)

Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

For Official Use Only (FOUO) Information:

In accordance with DHS Management Directive 11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities. The contractor will:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall:

Execute a DHS Form 11000-6, Sensitive but Unclassified Information Non-Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an NDA as determined by the applicable program manager. Execution of the NDA shall be effective upon publication of this directive and not applied retroactively.

Foreign Travel and Government-Issued Equipment

Per DHS and FEMA IT policy, FEMA employees and contractors are not authorized to take government-issued equipment, including cell phones, computers, or tablets such as iPads, outside of the United States regardless of the reason for travel. If government-issued equipment is required for official foreign travel, FEMA government employees may request a temporary loaner device through the Mobility Service Center.Office of the Chief Information Officer, Service Center, for the duration of their trip. FEMA contractors must contact their contracting officer’s representative (COR) for further guidance.

If your device is detected as operating outside of the United States and its territories it will be disabled, and your information will be forwarded to the Office of Professional Responsibility for review.Unauthorized Disclosure of Classified or Unclassified Information

All contractors and subcontractors are required to train on Unauthorized Disclosure of Classified or Unclassified Information to perform duties established by the Government during the performance period of and execution of this contract.

https://securityawareness.usalearning.gov/itawareness/index.htm https://usfema.sharepoint.com/teams/FEMAET/it_tools/tsc/Pages/default.aspx

Access to the training can be obtained at: Security Awareness Hub(usalearning.gov)

Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

8.0 Quality Assurance Surveillance Plan

The Government’s Quality Assurance Surveillance Plan (QASP) is based on the premise that the service provider, and not the Government, is responsible for the day-to-day performance of the work and all the management and quality control actions required to meet the terms of the contract.

The role of the Government in quality assurance is to ensure performance standards are achieved and maintained. The service provider is required to develop a comprehensive program of inspections and monitoring actions and to document its approach in a Quality Control Plan (QCP).

This QASP is designed to provide an effective surveillance method to monitor the service provider’s performance relative to the requirements listed in the agreement. The QASP illustrates the systematic method the Government will use to evaluate the services the service provider is required to furnish. Performance standards address all facets of operations, including quality;

accuracy; completeness; timeliness; safety and health; conformance with statutory, regulatory, and policy guidance; appropriate use and care of government furnished property, information, or facilities; data and records management; etc. Good management by the service provider and use of an approved QCP will ensure that the services are provided within acceptable quality levels.

9.0 Section 504 Requirements

The Contractor/Provider shall comply fully with Section 504 of the Rehabilitation Act of 1973, as amended, which prohibits discrimination against qualified individuals with disabilities. No otherwise qualified individual with a disability shall, solely by reason of his or her disability, be excluded from participation in, be denied the benefits of, or subjected to discrimination under any program or activity for which the Contractor/Provider is awarded a contract and/or receives federal financial assistance from the Federal Emergency Management Agency. This includes, but is not limited to, providing reasonable accommodations and modifications to ensure effective communication access, physical access, and program access to all participants, including persons with disabilities. The Contractor/Provider shall incorporate this language in any subcontracts related to the provision of the FEMA public-facing program or activity.

9.1 Section 508 Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L.

105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

9.1.1 All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are https://securityawareness.usalearning.gov/ located at 36 C.F.R. § 1194.1 & Apps. A, C & D. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

Item that contains Information and Communications Technology (ICT): Deliverables in electronic formats such as MS Word and Excel documents and perhaps posting of material to FEMAs website

Applicable Exception: N/A Authorization #: N/A

9.1.2 Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017.

10.0 Government Furnished Resources

The Government will provide the workspace, equipment and supplies necessary to perform the on-site portion of Contractor services required in this contract, including laptops, unless specifically stated otherwise in this work statement. The laptops will be available to the Contractor for off-site work as well.

The Government will provide all necessary information, data and documents to the Contractor for work required under this contract.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

11.0 Performance Requirements Summary (PRS)

The PRS establishes key elements of Contractor performance that represent “mission essential” service requirements, which are identified in the table below in the “Service Output” column. The “Performance Objective” column represents the standard against which Contractor performance will be measured in relation to accomplishment of the corresponding service output. The performance objective or “standard” describes the minimum acceptable level of service by the Contractor for satisfactory performance. The “Acceptable Quality Level (AQL)” column displays the maximum allowable deviation from the performance objective, which, if exceeded, evokes the negative incentive specified in the table below.

https://www.govinfo.gov/content/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf

APPENDIX A. INFORMATION TECHNOLOGY SECURITY AND PRIVACY

TRAINING

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

(b) Definitions.

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their

FEMA contract; and

• may include deliverables and documentation associated with deliverables.

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant…