SOW_Public_Records_Search_7_Aug_19.doc

U.S. Department of Homeland Security/Federal Emergency Management Agency

Department of Homeland Security

Federal Emergency Management Agency (FEMA)

Statement of Work (SOW) (Public Records Search Services) August 7, 2019

Table of Contents

31.0 OVERVIEW

32.0 BACKGROUND

43.0 DELIVERABLES

84.0 DELIVERABLE ACCEPTANCE AND INSPECTION

85.0 PERFORMANCE PERIOD

86.0 ADMINISTRATION

97.0 INVOICES

98.0 SECURITY REQUIREMENTS

109.0 ACCESSABILITY REQUIREMENTS

1010.0 BACKGROUND INVESTIGATIONS

1311.0 FACILITY ACCESS

1312.0 EMPLOYMENT ELIGIBILITY VERIFICATION (E-Verify)

1413.0 INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

1614.0 SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

2515.0 INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 2015)

1.0 OVERVIEW

The Federal Emergency Management Agency (FEMA) of the Department of Homeland Security (DHS), under the authority of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. 5121-5206 (the Stafford Act) as amended, is authorized to provide assistance for federal support following presidentially declared disasters and emergencies. After a presidentially declared crisis or emergency event individuals are instructed to apply for assistance on-line or by dialing FEMA’s toll-free number. The National Processing Service Center (NPSC) accepts registrations for assistance from applicants in the designated geographical area. The scope of a Presidentially declared emergency can range from a crisis or emergency events such as nuclear, biological, chemical, or radiological attack, natural disaster, health emergency, humanitarian and/or any other assistance that may be provided under the Robert T. Stafford Disaster Relief and Emergency Assistance Act.

On occasion, assistance may incorrectly be dispersed to applicants and businesses. In these cases, it may be appropriate and necessary for FEMA to recoup the funding that is incorrectly dispersed.

2.0 BACKGROUND

The NPSC is requesting a public records search contract to facilitate the recoupment process developed as a result of litigation, in obtaining information to eliminate or minimize the number of recoupments and getting the most accurate information necessary to send the Notice of Debt (NOD) or Notice of Potential Debt Letter (NPDL). Due process would not be served if the NOD or NPDL is not received by the debtor. The NOD notifies the debtor of the existence of the debt. The NPDL notifies the survivor of a potential debt. Currently, the NPSCs are in the process of performing case reviews for applicants who face potential recoupment actions. Having this contract in place and performing appropriate searches will ensure FEMA is prepared to continue to process recoupments immediately.

Once the NOD or NPDL letter is sent to the debtor, and the debtor does not take the necessary steps to resolve the debt, the debt is certified to the FEMA Finance Center (FFC) for collection purposes. The FFC is required to certify and transfer delinquent debt to the Department of Treasury and to provide the debtor with the required notification via the Letter of Intent (LOI) or Notice of Demand Letter (NDL). Therefore, the following information from public records searches is necessary to fulfill Treasury requirements:

· Name and Address. The addresses provided during the initial period after a disaster may not be the correct address when a recoup is finally determined. If the debtor does not receive the NOD or NPDL, and LOI or NDL, and the debt is sent to Treasury, the debtor can claim that he was not aware of the debt or did not receive required notification. The file is then returned to the FFC by Treasury for investigation.

· SSN. FFC may send a debt to Treasury for cross-servicing without a SSN, but it must be labeled as such. However, the debt cannot be put in the Treasury Offset Program (TOP) without a SSN or with an inaccurate SSN. TOP is the most effective and efficient means for collecting delinquent debts. However, an inaccurate SSN could result in wages being garnished, tax refunds being withheld, etc. from the wrong person. In this case, one error can have significant ramifications. Additionally, the correct SSN will assist the NPSC in preventing duplicate case inquiries.

· Deceased and Bankruptcy Information. Debts from deceased or bankrupt debtors are processed differently from other debts. The NPSC must establish the correct contact information in a timely manner. FFC also has to determine if the appropriate steps can still be taken to collect the money within specified timeframes such as filing claims against an estate for deceased debtors.

3.0 DELIVERABLES

FEMA must have access to a large volume of public records to verify applicant information, including addresses. The Contractor shall meet all FEMA requirements, which are heavily dependent upon disaster and emergency activity and, as well as any other special campaign requirements. It is impossible to know exactly how many person and batch searches FEMA may have, or the number of searches that a disaster or emergency may require. Therefore, FEMA does not guarantee a minimum number of unique searches the Contractor will incur, nor can it be predicted which months will be the busiest. In 2014, FEMA requested 22,952 searches.

The Contractor shall propose a method for effectively and simultaneously managing unique searches of unknown size. Disaster or emergency size and scope cannot be predicted. Therefore, the Contractor must be prepared to handle a disaster or emergency of any size or magnitude. In addition, the Contractor must be able to ensure adequate readiness, timely search preparation and execution, and to allow for doing so with appropriate cost efficiencies.

To accomplish this, the Contractor shall provide the following deliverables to FEMA:

Deliverable #1 (Batch Searches): The Contractor shall have Batch search capabilities, where the Contractor can quickly search through millions of public records for information on multiple names at one time. FEMA will provide to the Contractor a list of records for the batch search (up to 10,000 records), and the type of information to be obtained by the data records search. A report containing the results of the requested batch search shall be provided by the Contractor, to FEMA, within 24 hours of the request. This information may contain Sensitive But Unclassified (SBU) information which must be encrypted in transit. Contractor personnel handling the encrypted files shall be adjudicated.

Deliverable #2 (Individual Searches): In addition, FEMA users must be able to conduct individual person searches as needed. The Contractor shall provide User IDs/Passwords allowing 100 FEMA employees access to their database system, so that individual searches can be completed, through a web-based interface. Data retrieval shall be real-time.

Deliverable #3 (Accessibility): The Contractor shall provide service on an as-needed basis 24 hours per day, 7 days per week, 365 days per year.

Deliverable #4 (Databases): FEMA may request a variety of different data. Therefore, the Contractor shall have the ability to retrieve public records data from the following sources:

· Current & Historical Consumer and Credit Bureau data

· Utility Listings

· Driver Licenses

· Motor vehicle registration data

· Real property data, including ownership information, deeds, tax rolls, foreclosures, sales, transfers, mortgages, refinancing, and historical records

· Addresses, professional licenses, death records, new movers, and household records

· Phone data, including reverse lookup, caller ID names and carrier contact information

· Criminal and court records

· Business data, including company names, doing business as (DBA) listings, contact information, industry directories, affiliations, and assets Deliverable #5 (FEMA Activity Reports): The Contractor shall provide a Web-based real-time reporting mechanism that FEMA personnel can use 24 x 7 x 365 to download a variety of real-time reports into an Excel format through the Contractor’s online secure portal. The variety of real-time reports shall include, but is not limited to:

· Daily activity, monthly activity, quarterly activity, yearly activity, and cumulative year-to-date activity.

· Detailed itemization of each search for which FEMA is billed showing the following: Customer ID number or name, Customer Address, City, State, Zip, FEMA User ID, FEMA User Name (Last, First), Transaction Date, Transaction Type, Transaction Amount.

· The Contractor shall provide ad-hoc reports within 24 hours of the request at no additional cost unless the 24 hour requirement is otherwise waived by the Contracting Officer (CO) or Contracting Officer Representative (COR).

***Note: Web-based real-time reports may have up to a 1 hour lag time. In addition, FEMA may request real-time reports delivered via e-mail or hard copy. E-mail and hard copy reports shall be delivered within 24 hours of request.

Deliverable #6 (Contingency Plan): The Contractor shall have a contingency plan in place to address any malfunction of its web-based interface used to support Batch search or Individual search capabilities. The Contractor shall notify the COR within 1-hour of the web-based interface malfunction with instructions for alternative access to databases. A copy of the contingency plan shall be delivered to FEMA within 7 calendar days.

Deliverable #7 (Knowledge Transfer): The Contractor shall provide a formal knowledge transfer approach to end users located in Denton, TX; Winchester, VA; and Hyattsville, MD. The knowledge transfer sessions shall be in a classroom or virtual environment.

The Knowledge Transfer shall address, as a minimum, the following topics:

· Training goals/standards and the specific plan for training end users.

· Strategy for providing training early in the project to allow the training goals to be implemented throughout the contract life cycle.

· Tasks, deliverables and resources necessary to complete the training effort and identify tools and documentation that shall be necessary to support proposed effort.

· The different types of training, the specific courses and course materials, the training approach for both technical personnel and end users, and how training effectiveness shall be measured and addressed.

· A description of deliverables to support initial and ongoing training including user manuals, phone support, on-line help, email support, and training materials for technical/non-technical personnel.

· Metrics for tracking progress in achieving training and knowledge transfer objectives.

· Reporting progress of training and knowledge transfer activities.

Training and support shall be provided to end users on the use of the locater service and batch solution software that is sufficient to operate independently, along with training resources that include step-by-step manuals that demonstrates user roles.

Deliverable #8 (Search types): The Contractor shall provide the following search types upon FEMA request:

8.1 Person Search

Identifies individuals and associated information. Allow searches with full or partial personal information such as no SSN, partial SSN, different/phonetic name spelling, location radius, age range, address, relative, neighbor, associate, asset, license, email address, and social network user name.

8.2 Phone Search – Public Records

Search hundreds of millions of records, including real-time phone source information on wireless numbers and detailed carrier data that can be used for investigative purposes. Allow searches using a name or phone number.

8.3 Phone Search – Real Time Reverse Lookup

Search real‐time phone source information to provide detailed information from carriers including phone type, phone status, carrier details, and porting indicators. Allow searches using a name or phone number.

8.4 Basic Report: Bankruptcies, incarcerations, arrests, criminal record, etc.

Allow users to create customizable reports.

8.5 Business Comprehensive Report

Search public records to identify data on company property, bankruptcies, executives, judgments & liens, UCC filings, Internet domains, industry and company codes, business associates. Allow searches using a person’s name, company name, business phone, or Federal Employee Identification Numbers.

8.6 Business Search

Search for records of people connected with businesses, including current and previous employees, officers, directors, assets, bankruptcies, liens, judgments, branches, subsidiaries, parent companies, and headquarters. Allow searches using a person’s name, company name, business phone, or Federal Employee Identification Numbers.

8.7 Court Records Search

Search court records, including search options for bankruptcy, criminal records, civil records, OFAC records, sexual offender information, foreclosures, filed POAs, name changes, marriages, divorces, judgments, law suits, wills probates, etc.

8.8 License Search

Search for available information regarding licenses such as those required for entertainment, trademark/brand, fashion, sports/fish and game, art, non-profit, publishing, driver, business/professional. Identify effective dates, facility/address where licensed, associated phone numbers, and type of license.

8.9 Asset Search

Search real estate records associated with land, residences, including both commercial and non-commercial properties.

8.10 Asset Search – Vehicle

Search current and historical vehicle records including all types of vehicles including automobiles, motorcycles, trailers, boats, recreational vehicles, etc.

8.11 Web Information Analysis Search

Search email addresses and social network account information.

8.12 National Comprehensive Report

Provide a data repository and linking algorithm to produce a large search result.

8.13 Person Batch Search

Provide person search data for up to 10,000 records in a single batch to return matched information in an easy to export file. This information may contain Sensitive But Unclassified (SBU) information which must be encrypted in transit. Contractor personnel handling the encrypted files shall be adjudicated.

8.14 Phone Batch Search

Provide phone search data for up to 10,000 records in a single batch to return matched information in an easy to export file. This information may contain Sensitive But Unclassified (SBU) information which must be encrypted in transit. Contractor personnel handling the encrypted files shall be adjudicated.

8.15 Mobile Search

Includes the ability to complete searches on mobile devices such as mobile phones, PDAs, and other mobile devices.

8.16 Utility Search

Locate current address for subject including either the address of current utility service or the address where final bills of previously known addresses have been forwarded, including utility services for water, telephone, gas, cable, and electricity.

4.0 DELIVERABLE ACCEPTANCE AND INSPECTION

4.1 Acceptance is contingent on deliverables being reviewed for conformance with SOW requirements.

4.2 FEMA will reject deliverables that do not meet the SOW requirements.

4.3 Each deliverable provided by the Contractor shall be delivered to the COR and/or designated FEMA Program Office representative(s) subject matter expert with a deliverable receipt.

4.4 Deficiencies shall be corrected by the Contractor before FEMA can accept final delivery.

5.0 PERFORMANCE PERIOD

FEMA anticipates awarding a Not to Exceed Firm Fixed Price Task Order to perform the required services for a Base Year (12 months) plus 3 Option Years (each Option Year is 12 months). Contract line items (CLINs) and associated Statement of Work (SOW) will include all requirements for the entire performance period.

6.0 ADMINISTRATION

COR Responsibility

The Contracting Officer’s Representative (COR) will have overall responsibility to ensure the goals and requirements of this contract are met. The COR will oversee the Contractor’s performance of services and provide coordination on major issues affecting all involved entities and the Contractor. The COR will be responsible to ensure proper resources are available to perform the services and to interface with the Contractor, exchange information, provide direction, make decisions, and document issues affecting this contract. All issues uncovered during the execution of the contract shall be reported to the COR.

CO Authority

The Contracting Officer (CO) has overall authority of the contract. It will be the responsibility of the COR to ensure the CO has full knowledge of all associated issues. Any changes or modifications to scope, pricing or cost must be approved by the CO prior to any services being provided as a result of the change.

7.0 INVOICES

The Contractor shall e-mail an electronic copy of the invoice for the previous month’s activity to the FEMA Finance Vendor Payments email address below, and the COR and Alternate COR shall be copied on all invoice submissions. If email is unavailable, the Contractor shall notify the COR and Alternate COR and mail the invoice to the FEMA Finance Center. Invoices shall be presented to:

Federal Emergency Management Agency

FEMA Finance Center

PO Box 9001

Winchester, VA 22604

(540) 540-1900

FEMA-Finance-Vendor-Payments@fema.dhs.gov Invoices will be paid net 30 days after receipt from the Contractor of a proper invoice. The invoice shall be supported by data for all work accomplished during the previous month of performance. Supporting documentation for the invoice shall include, but is not limited to:

a. Contractor name and address

b. Invoice date and number

c. Contract number, contract line item number and order number, if applicable

d. Description, quantity, unit of measure, unit price and extended price

e. Taxpayer ID Number

f. Payment terms including discounts for prompt payment

a. Name and address of Contractor official to whom payment is being sent (must be the same as that in the contract or in a proper notice of assignment)

b. Name (where practicable), title, phone number, and mailing address of person to notify in the event of a defective invoice

g. Electronic funds transfer (EFT) banking information

h. Any other information or documentation required by the contract

i. See contract clauses for further invoicing instruction

8.0 SECURITY REQUIREMENTS

FEMA has determined that performance of this contract does require the Contractor, Subcontractor(s), and Vendor(s) (herein known as Contractor) to have access to Sensitive But Unclassified (SBU) information. Access to classified information is not required nor permitted. Contractors that have access to SBU provided by FEMA, shall be favorably adjudicated prior to performing work under this contract. All contractor personnel working on this contract shall be US Citizens.

Continued Eligibility

FEMA reserves the right and prerogative to deny and/or restrict the facility and information access of any Contractor employee whom FEMA determines to present a risk of compromising Sensitive But Unclassified (SBU) information.

The Contractor shall report to the COR and FEMA security office any adverse information coming to its attention concerning employees working under this contract. Reports based on rumor or innuendo shall not be made. The subsequent termination of an employee does not obviate the requirement of the Contractor to submit this report. The report shall include employees’ name, social security number, and the adverse information.

9.0 ACCESSABILITY REQUIREMENTS

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use electronic and information technology, they must ensure that it is accessible to people with disabilities. Federal employees and members of the public who have disabilities must have equal access to and use of information and data that is comparable to that enjoyed by non-disabled Federal employees and members of the public.

All Electronic and Information Technology (EIT) deliverables within this work statement shall comply with the applicable technical and functional performance criteria of Section 508 unless exempt.

10.0 BACKGROUND INVESTIGATIONS

All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a Low Risk designation and who do not require access to DHS or FEMA information systems shall undergo a National Agency Check with Inquiries (NACI) and a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a Low Risk designation and who require access to DHS or FEMA information systems shall undergo a Moderate-Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Moderate Risk

Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Moderate-Risk Background Investigation (MBI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

High Risk

Contractor personnel occupying positions or performing functions with a High Risk designation shall undergo a Background Investigation (BI) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Background Investigation Process

To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if

· the investigation was completed within the last five years,

· it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract,

· the contractor personnel have not had a break in employment since the prior favorable adjudication, and

· FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email to the contractor personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

· Standard Form 85P, “Questionnaire for Public Trust Positions Optional Form 306, “Declaration for Federal Employment”

· SF 87, “Fingerprint Card” (2 copies)

· DHS Form 11000-6, “Non-Disclosure Agreement”

· DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel has any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation

Eligibility determinations based on a NACI, MBI or BI are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation (NACI, MBI, or BI, as required) to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor to exclude from working on this contract any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency.

11.0 FACILITY ACCESS

The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for Contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for Contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all Contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days. Contractor personnel shall not receive a FAC until they have submitted a FD 258, “Fingerprint Card,” and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any Contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to Contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

· When no longer needed for contract performance.

· Upon completion of a Contractor employee’s employment.

· Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or Contractor personnel’s failure to return all DHS or FEMA-issued identification cards and building passes upon expiration, upon the Contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the Contractor personnel and the Contractor to civil and criminal liability.

12.0 EMPLOYMENT ELIGIBILITY VERIFICATION (E-Verify)

Executive Order 12989 mandates the electronic verification of all employees working on any federal contract. The Contractor shall agree that each employee working on this contract will successfully pass the DHS Employment Eligibility Verification (E-Verify) program, which is operated by the Department of Homeland Security in partnership with the Social Security Administration to establish work authorization.

The Contractor shall ensure that each employee working on this contract has a Social Security Card issued and approved by the Social Security Administration. The Contractor shall be responsible to the Government for acts and omissions of its own employees and for any subcontractor(s) and their employees.

Subject to existing law, regulations, and/or other provisions of this contract, illegal or undocumented aliens will not be employed by the Contractor or with this contract. The Contractor shall ensure that this provision is expressly incorporated into any and all subcontracts or subordinate agreements issued in support of this contract.

13.0 INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

Security Management

Upon award the Contractor shall appoint a senior official to act as the Corporate Security Officer. The corporate security officer will interface with FEMA’s Security Office through the COR on all security matters to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and the FEMA Security Office shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract; the Contractor shall be informed in writing by the Contracting Officer of the proper action to be taken in order to effect compliance with such requirements.

Information Technology Security Clearance

When sensitive government information is processed on Agency telecommunications and automated information systems, the Contractor agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in the DHS Sensitive Systems Policy Directive 4300A and DHS National Security Systems Policy Directive 4300B. Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractors who fail to comply with DHS/FEMA security policy are subject to having their access to DHS/FEMA IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

Information Technology Security Training and Oversight

All Contractor employees using DHS/FEMA automated systems or processing DHS/FEMA sensitive data will be required to receive Security Education and Awareness Training (SEAT). This training will be provided by FEMA.

Security Considerations (Data)

The Contractor shall maintain, transmit, retain in the strictest confidence, and prevent the unauthorized duplication, use, and disclosure of information. The Contractor shall provide information only to employees, Contractors, and subcontractor having a need to know such information in the performance of their duties for this project.

Information made available to the Contractor by the Government for the performance or administration of this effort shall be used only for those purposes and shall not be used in any other way without the written agreement of the Contracting Officer.

If public information is provided to the Contractor for use in performance or administration of this effort, the Contractor, except with the written permission of the Contracting Officer, may not use such information for any other purpose. If the Contractor is uncertain about the availability or proposed use of information provided or the performance or administration, the Contractor shall first consult with the CO regarding use of that information for other purposes.

The Contractor agrees to assume responsibility for protecting the confidentiality of Government records, which are not public information. Each employee or subcontractor of the Contractor to whom information may be made available or disclosed, may use the information only for a purpose and to the extent authorized herein. Penalties may ensue upon non-approved release of privacy data.

Performance of this effort may require the Contractor to access and use data and information proprietary to a Government agency or Government Contractor, which is of such a nature that its dissemination or use, other than in performance of this effort, would be adverse to the interests of the Government and/or others. Therefore, Contractor and/or Contractor personnel shall not divulge or release data or information developed or obtained in performance of this effort, until made public by the Government, except to authorize Government personnel or upon written approval of the Contracting Officer. The Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort. Nothing herein shall preclude the use of any data independently acquired by the Contractor without such limitations or prohibit an agreement at no cost to the Government between the Contractor and the data owner that provides for greater rights to the Contractor.

All deliverables, source code, and data received, processed, evaluated, loaded, and/or created as a result of this contract shall remain the sole property of the Government unless specific exception is granted by the Contracting Officer.

Dial Up/Remote Connectivity

Remote access of the DHS/FEMA network will be pre-approved by FEMA prior to access by the Contractor. Strong authentication via virtual private network (VPN) or equivalent encryption (e.g., https) and two-factor authentication is required. DHS has an immediate goal that remote access should only be allowed with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access. Restrictions are placed on the downloading and remote storage of PII accessed remotely.

14.0 SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause— “Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(2) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(3) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN) Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years.