Attachment A - HMTAP Recompete PWS_final 07222024.docx

Federal Emergency Management Agency

PERFORMANCE WORK STATEMENT (PWS) FOR:

DEPARTMENT OF HOMELAND SECURITY (DHS)

FEDERAL EMERGENCY MANAGEMENT AGENCY (FEMA) RESILENCE

HAZARD MITIGATION TECHNICAL ASSISTANCE PROGRAM (HMTAP)

NON-ARCHITECTURAL AND ENGINEERING (NON-A&E) SERVICES

May 22, 2024 Glen Seipp, Contracting Officer

PROCUREMENT SENSITIVE INFORMATION

Please protect this document as procurement sensitive and handle accordingly.

Performance Work Statement (PWS) For HMTAP

1.1 Background

FEMA’s mission is helping people before, during, and after disasters. Resilience’s mission is to reduce disaster suffering. Resilience created Hazard Mitigation Technical Assistance Program (HMTAP) to aid in reaching this mission.

Program areas utilizing the services of the HMTAP include the Office of Environmental Planning and Historic Preservation (OEHP), Floodplain Management (FPM) including the Office of the Flood Insurance Advocate (OFIA), Policy Tools and Training (PTT), Data Analytics and Systems Branch (DAS), the Division Management Office (DMO), and the Mitigation Directorate’s Insurance and Mitigation Readiness Division (IMRD) and the Risk Management Directorate (RMD).

OEHP provides FEMA programs with policy and technical guidance concerning compliance with Environmental and Historic Preservation (EHP) laws, Executive Orders (EO), and regulations, including but not limited to; the National Environmental Policy Act (NEPA); National Historic Preservation Act (NHPA); Endangered Species Act (ESA): Executive Order 11988, Floodplain Management; and Executive Order 12898, Environmental Justice.

The Floodplain Management Branch (FPM) provides technical assistance to other federal agencies, FEMA regional offices, states, tribes, and communities in implementing the federal floodplain management requirements and initiatives.

Section 24 of the Homeowner Flood Insurance Affordability Act of 2014 directed FEMA’s Administrator to establish a Flood Insurance Advocate (OFIA) to advocate for the fair treatment of policyholders under the National Flood Insurance Program (NFIP) and for property owners in the mapping of flood hazards, the identification of risks from flood, and the implementation of measures to minimize the risk of flood. Technical support provided may be related to flood insurance, flood hazard mapping, floodplain management, or Hazard Mitigation Assistance (HMA) grants.

The Hazard Mitigation (HM) Policy Tools and Training (PTT) Branch provides policy information for HMA grant programs including current HMA policies, as well as policies of other Resilience divisions that affect HMA funding. In addition, as a result of the Safeguarding Tomorrow through Ongoing Risk Mitigation (STORM) Act which became law on January 1, 2021; HMA is responsible for oversight of a program that provides capitalization grants to states, eligible federally recognized tribes, Puerto Rico (PR) and the District of Columbia (DC) to establish revolving loan funds that provide hazard mitigation assistance for local governments to reduce risks from natural hazards and disasters.

The Hazard Mitigation Assistance (HMA) Division manages and delivers several pre and post disaster mitigation grant programs. The Hazard Mitigation Grant Program (HMGP) provides funding to state, local, tribal, and territorial governments; so, they can rebuild in a way that reduces or mitigates future disaster losses in their communities after a presidentially declared disaster. HMGP also has Post Fire assistance available to help communities implement hazard mitigation measures after wildfire disasters. Building Resilient Infrastructure and Communities (BRIC) will support states, local communities, tribes, and territories as they undertake hazard mitigation projects, reducing the risks they face from disasters and natural hazards. Flood Mitigation Assistance (FMA) is a competitive grant program that provides funding to states, local communities, federally recognized tribes, and territories. Funds can be used for projects that reduce or eliminate the risk of repetitive flood damage to buildings insured by the National Flood Insurance Program.

The Mitigation Directorate’s Insurance and Mitigation Readiness Division (IMRD) works to strengthen the capability and capacity of FEMA’s workforce to ensure the successful delivery of effective mitigation strategies in disaster operations. IMRD achieves these goals through mitigation training, information transfer, coordination of Insurance and Mitigation Disaster Operations, and product development by engaging our stakeholders in a holistic, consensus-based approach.

The Risk Management Directorate (RMD) through collaboration with State, Local, and Tribal entities; delivers quality data that increases public awareness and leads to actions that reduce risk to life and property. It is designed to integrate risk assessment, analysis, and communications by utilizing multi-disciplinary expertise to improve our understanding of the consequences of natural hazard events (including catastrophic) and reduce fatalities, injuries, and losses from these events.

Non-A&E technical service provides a range of services which include studies, analyses, supporting technical review of HMA grants, environmental technical assistance, and providing technical assistance to reduce future losses to; homes, businesses, schools, public buildings, and critical facilities from disasters.

The Government intends to award three (3) single award Indefinite-Delivery/Indefinite-Quantity (IDIQ) contracts for the Non-A&E HMTAP support services. All Contractors shall have the capability and capacity to support the requirements as stated within the PWS. Each contract will cover a distinct geographic sector to facilitate rapid response to declared disasters anywhere within the Unites States and its territories. One (1) contract will be awarded for each Sector.

The geographical sectors are defined as follows:

Sector A:

· Region IV: Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee

· Region VII: Iowa, Kansas, Missouri, Nebraska

· Region IX: Arizona, California, Hawaii, Nevada, Pacific Islands

· FEMA Headquarters –Office of Environmental and Historic Preservation (OEHP), and Risk Management Directorate (RMD)

Sector B:

· Region II: New Jersey, New York, Puerto Rico, Virgin Islands

· Region III: District of Columbia, Delaware, Maryland, Pennsylvania, Virginia, West Virginia

· Region VIII: Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming

· Region X: Alaska, Idaho, Oregon, Washington FEMA Headquarters – NFIP, Office of the Flood Insurance Advocate (OFIA), Insurance and Mitigation Readiness Division (IMRD), and HMA to include DMO, DAS, and Grants Policy

Sector C:

· Region I: Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont

· Region V: Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin

· Region VI: Arkansas, Louisiana, New Mexico, Oklahoma, Texas

· FEMA Headquarters – HMA Grants implementation

1.2 Scope

The Scope of this effort includes non-architectural and non-engineering (non-A&E) technical assistance, including but not limited to; program application review/feasibility, research, analysis, and document development services in support of FEMA’s pre-disaster, disaster, and post-disaster mitigation and environmental compliance requirements.

1.3 Objective

The purpose of this effort is to procure services that provide the Federal Emergency Management Agency (FEMA) and Resilience enhanced capability and capacity in meeting pre-disaster, disaster, and post-disaster mitigation and environmental responsibilities as set forth in the task order.

The following documents provide specifications, standards, or guidelines that must be complied with, in order to meet the requirements of this contract:

The following documents shall be complied with the to the extent and manner specified in the task statements of this PWS. Unless otherwise specified in the task statements, or required by law, the Contractor shall comply with the edition in effect on the date of contract award.

· Robert T. Stafford Disaster Relief and Emergency Assistance Act, Public Law (PL) 93-288, as amended Disaster Relief Act of 1974

· 36 Code of Federal Regulations (CFR), Part 800 - Protection of Historic Properties

· 40 CFR, Parts 1500-1508

· 44 CFR, Parts 8,9,10,13,14,60 and 206

· 50 CFR, Part 402 – Interagency Cooperation — Endangered Species Act of 1973, as amended

· Earthquake Hazards Reduction Act, as amended, PL 95-124 National Flood Insurance Act of 1968

· National Flood Insurance Act of 1968

· Flood Disaster Protection Act of 1973.

· The Biggert-Waters Flood Insurance Reform Act of 2012 and 2016

· Riegle Community Development and Regulatory Improvement Act of 1994

· 44 CFR Part 78, Part 79, Part 80, and Part 201

· Endangered Species Act

· National Historic Preservation Act

· National Coastal Zone Management Program (CZMA)

· Coastal Barrier Resources Act (CBAR) of 1982

· EO 12898 – Federal Actions to Address Environmental Justice in Minority Populations and Low-Income Populations

· EO 11988 Floodplain and 11990 Wetlands 8-step reviews

1.5 Performance Requirements Summary

This contract includes a Performance Requirements Summary (PRS) at PWS 10.0. The PRS plays an integral role in the administration of the contract. In addition to any applicable inspection clauses or other related terms and conditions contained in the contract, the PRS shall serve as a primary tool for inspection and acceptance of services as facilitated by the Contracting Officer’s Representative (COR). Evaluation of the Contractor’s overall performance shall be in accordance with the performance standards set forth in the PRS and will be conducted by the COR. The PRS constitutes a material aspect of the contract and will not be changed or otherwise modified without prior to modification to the contract signed by the Contracting Officer (CO).

2.0 Specific Requirements/Tasks

2.1 Task One. Resilience grant programs assistance

The contractor shall provide assistance to Resilience grant programs, including but not limited to; the National Dam Safety Program (NDSP) and Hazard Mitigation Assistance (HMA) grant programs – excluding Non-Disaster HMA, Building Resilient Infrastructure and Communities (BRIC), and BRIC Direct Technical Assistance (DTA) programs. Examples of activities performed may include technical assistance to FEMA, States, Tribes, territories, and local communities to develop or update mitigation plans; research and data collection for guidance consideration; develop and/or review HMA grant applications to include but not limited to; feasibility, completeness, and eligibility reviews, reviews of benefit cost analysis (BCA), floodplain management, review environmental and historic preservation compliance, applicable helpline assistance, and general program support.

2.2 Task Two. Environmental and biological assessments

The contract shall prepare all necessary components of environmental assessments, biological assessments, or environmental impact statements including, but not limited to; historic preservation reviews and assessments of historical structures, conducting social science assessments in accordance with the National Environmental Policy Act (NEPA), and conducting surveys and assessments to determine existence of and potential impact to threatened or endangered species, water quality, wetlands delineation, sole or principal drinking aquifers, prime farmlands, and other ecologically significant/geographically unique areas.

2.3 Task Three. Non-A&E post-event assessments

The contract shall conduct non-Architectural and Engineering (Non-A&E) post-event assessments to identify mitigation opportunities, collect event data, and assess non-engineered structures. For example, non-A&E post-event analysis of damages and damage trends, identify best practices, and perform loss-avoidance studies.

2.4 Task Four. Non-A&E technical assistance

The contract shall provide non-A&E technical assistance to the Floodplain Management Division within the Mitigation Directorate to provide services to assist with implementation of the NFIP. Tasks may include support of community enrollment, eligibility, and compliance, promoting higher regulatory standards, support of Community Assistance Program - State Support Services Element (CAP-SSSE) grant program, general NFIP floodplain management programmatic support, etc.

2.5 Task Five. Technical assistance to policies

The contract shall provide technical assistance and interagency coordination in support of analyses of FEMA’s proposed policies and regulations that will assist in identifying impact(s) to FEMA programs’ stakeholders and applicants. This could include drafting federal register notices for public comment, support, and coordination in organizing and summarizing public comments to federal register notices for adjudication, support in meeting compliance requirements, including Paperwork Reduction Act, Privacy Act, and National Environmental Policy Act (NEPA), and support in policy rulemaking. Additionally, this may include presentations, graphics support, fact sheets, research-based reports, white papers, guidance, standard operating procedures, streamlining initiatives, strategic planning, performance metrics, technical opinions, public notices, informational flyers, policy analyses, and bulletins.

Assist in implementing approved solutions, including assistance in the preparation of procedural documents that support formulation, submission, and defense of HMA policies and budget.

2.6 Task Six. BCA helpline assistance

The contractor shall maintain and enhance the Benefit-Cost Analysis (BCA) helpline. Provide responses to programmatic questions related to BCA. The BCA helpline assistance is a scope element across all sectors.

2.7 Task Seven. Technical support

Technical Advisement/Support

· Provide expert advice, guidance, and recommendations to modernize and streamline grants program business processes and services.

· Provide expert advice on losses avoided, benefit-cost analysis, and other mitigation projects on an as needed basis.

· Provide expert support on programmatic information analysis. This analysis will include quantitative and qualitative analyses and will utilize Geographic Information System (GIS) and spatial analysis related tools.

Post Award Reports and Deliverables

· Written reports as required by the Task Order and approved by the Contracting Officer’s Representative (COR).

· Project Task Schedule five (5) days after Task Initiation/Award.

Weekly Status Activities Report showing progress and accomplishments of past week (Thursday through Wednesday) and planned activities for next week, each Thursday at close of business, no later than 5:30pm Eastern Standard Time (Washington, DC). This will be set at the Task Order Level where needed.

3.0 Contractor Personnel

3.1 Qualified Personnel

The Contractor shall provide qualified personnel and the skill mix to perform all objectives in this PWS. Qualified personnel shall have the following expertise:

· Expert knowledge and understanding of applicable statutes, regulations, requirements, grants, policies, guidance, and specifications that impact Resilience’s grant programs including but not limited to; the Hazard Mitigation Assistance (HMA) grant programs, the National Dam Safety Program (NDSP) grants, Environmental Planning and Historic Preservation (EHP), and National Flood Insurance Programs (NFIP).

· Expert knowledge of FEMA’s HMA and NDSP grant programs, EHP, and NFIP programs that are of similar type, size, and scope.

· Expert ability to complete multiple projects across the nation concurrently, while accomplishing the work within the required time limits without compromising quality, service, or the deliverable/product.

Expert knowledge of Executive Order 12898 – Federal Actions to Address Environmental Justice in Minority Populations and Low-Income Populations and Executive Order 11988 – Floodplain Management

3.2 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of award.

Prior to working on the task order, Contractor personnel will be required to pass a public trust background investigation and obtain a DHS security clearance to enable badging and systems account creation. Contractor personnel will be required to sign a DHS FEMA Non-Disclosure Agreement (NDA) prior to commencing work.

The Contractor shall provide a Program Manager who shall be responsible for all Contractor work performed under this contract. The Program Manager is further designated as key personnel by the Government. The Program Manager shall ensure all aspects of the contract and associated task orders are being adhered to and serve as the single point of contact for the CO and COR for all issues, including supervisory/management of contractor personnel, human resource management, performance management, and quality assurance/quality improvement management.

The name of the Program Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Program Manager, shall be provided to the Government as part of the Contractor's quote. During any absence of the Program Manager, only one (1) Alternate Program Manager shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Program Manager and all designated alternate(s) shall be able to: read, write, speak, and understand English. Additionally, the Contractor shall not replace the Program Manager without prior approval from the CO. Any replacements to key personnel must be approved by the CO in writing thirty (30) days in advance of any replacement. Any replacement must have equivalent or superior qualifications.

The Program Manager shall be available to the CO and COR via telephone between the hours of 8:30 AM and 5:30 PM EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within eight (8) hours of notification during business hours.

The Program Manager must be capable of leading projects that involve the successful management of multi-functional teams. Specialized experience includes expert knowledge of Resilience’s grant programs, not limited to Hazard Mitigation Assistance (HMA), National Dam Safety Program (NDSP), Environmental Planning and Historic Preservation (EHP), and the National Flood Insurance Program (NFIP), project management, expertise in management and control of funds and resources, demonstrated capability in managing multiple tasks and interfacing with senior executive leaders and middle management.

The Program Manager must be a current or contingent hire employee of the Prime Contractor and requires:

· A minimum of twenty (20) years of experience in:

· Expert knowledge and understanding of applicable statutes, regulations, requirements, grants, policies, guidance, and specifications that impact Resilience’s grant programs including but not limited to; the Hazard Mitigation Assistance (HMA) grant programs, the National Dam Safety Program (NDSP) grants, Environmental Planning and Historic Preservation (EHP), and National Flood Insurance Programs (NFIP).

· Expert knowledge of FEMA’s HMA, NDSP grant programs, EHP, and NFIP programs that are of similar type, size, and scope.

· Initiating, planning, developing, executing/managing, monitoring, controlling, and closing large-scale programs with similar business markets, including service delivery contracts and mission critical programs.

· Program Manager shall have Project management certification such as Project Management Institute (PMI), Project Management Professional (PMP), or Federal Acquisition Certification for Program and Project Managers (FAC- P/PM) certification Level III. This certification is required and is non-negotiable.

Additional key personnel may be specified in task orders.

The Offeror shall provide key personnel resumes as part of the proposal.

Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and always display all identification and visitor badges in plain view above the waist.

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees always present a professional appearance and that their conduct shall not reflect discredit on the United States (US) or the Department of Homeland Security (DHS). The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations, and policies concerning safety and security.

3.6 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4.0 Other Applicable Conditions

4.1 Security

Contractor access to unclassified, but Security Sensitive Information may be required under this PWS. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

4.2 Period of Performance (POP)

The period of performance for this contract is a one (1)-year base period with four (4) one (1)-year option periods as follows:

The primary place of performance will be a combination of the Contractor’s facilities, the Department of Homeland Security FEMA HQ, and places where services are needed.

4.4 Hours of Operation

Contractor employees shall generally perform all work between the hours of 8:00AM and 5:00PM EST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this PWS.

4.5 Travel

Contractor travel may be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

4.6 Post Award Conference

The Contractor shall attend a Post Award Conference with the CO and the COR no later than five (5) business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at Washington D.C. FEMA HQ (400 C Street SW, Washington, DC 20024), or via teleconference.

4.7 Project Plan

The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than ten (10) business days after the Post Award Conference.

4.8 Business Continuity Plan

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government. The BCP Plan shall be due twenty (20) business days after the date of award and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

· A description of the Contractor’s emergency management procedures and policy

· A description of how the Contractor will account for their employees during an emergency

· How the Contractor will communicate with the Government during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

4.8.1 Individual BCP shall be activated immediately after determining that an emergency has occurred, shall be operational within 12 hours of activation or as directed by the Government, and shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first.

In case of a life-threatening emergency, the COR shall immediately contact the Contractor Project Manager to ascertain the status of any Contractor personnel who were located in a Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor Project Manager and the COR shall promptly open an effective means of communication and verify:

· Key points of contact (Government and contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.)

· Essential Contractor work products expected to be continued by priority

4.8.2 The Government and Contractor Project Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances.

Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

4.9 Progress Reports

The Project Manager shall provide a monthly progress report to the Contracting Officer and COR via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

4.10 Progress Meetings

The Project Manager shall be responsible for keeping the COR informed about Contractor progress throughout the performance period of this contract and ensure Contractor activities are aligned with DHS objectives. At a minimum, the Project Manager shall review the status and results of Contractor performance with the COR on a quarterly basis by telephone.

The Project Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information, and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

4.11 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows XP and Microsoft Office Applications).

4.12 Protection of Information

Contractor access to proprietary information is required under this PWS. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with DHS Management Directive System (MD) 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information. The Contractor shall ensure that all Contractor personnel having access to business or procurement sensitive information sign a DHS Form 11000-6 - Non-Disclosure Agreement, Updated October 2018.

4.13 Section 508 Compliance

Any PWS that includes requirements for Electronic and Information Technology (EIT) must include a Section 508 compliance section to clearly identify applicable EIT accessibility standards or exceptions from Section 508. To develop appropriate Section 508 compliance language, use the Office of Accessible Systems & Technology’s DHS Accessibility Requirements Tool (DART). Based upon your specific requirements and answers to basic questions, the DART tool will generate Section 508 related language specific to your PWS that can easily be cut and pasted into your document.

Additional guidance can be found by contacting the DHS Accessibility Help Desk at 202-447-0440 or by email at accessibility@hq.dhs.gov.

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained, and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194—Information and Communication Technology Standards and Guidelines. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

5.0 Government Furnished Resources

The Government will provide the following property to the Contractor for work required under this contract:

1. FEMA laptops

1. FEMA PIV cards

The Contractor shall use Government furnished facilities, property, equipment, and supplies only for the performance of work under this contract and shall be responsible for returning all Government furnished facilities, property, and equipment in good working condition, subject to normal wear and tear.

The Government will provide all necessary information, data, and documents to the Contractor for work required under this contract.

The Contractor shall use Government furnished information, data, and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data, and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data, and documents to outside parties without the prior and explicit consent of the Contracting Officer.

6.0 Contractor Furnished Property

The Contractor shall furnish all facilities, materials, equipment, and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in PWS 2.0 and PWS 5.0.

7.0 Government Acceptance Period

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying them the deliverable has been accepted.

7.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal.

In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

8.0 Deliverables

N/A

COR, Contracting Officer

*FEMA/HQ, Washington, DC: HMTAP services in support of Floodplain Management (FPM) for Resilience’s Office of Flood Insurance Advocate (OFIA) and the Insurance and Mitigation Readiness Division IMRD in which work products and deliverables will be provided to Resilience/HQ located at 400 C Street, SW, Washington DC under Section C

9.0 Performance Requirements Summary (PRS)

Administrative Performance Requirements

Contract Objectives Performance Requirements

Contract Management Performance Requirements

SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules.