2.2.1 Attachment 2 Performance Work Statement (PWS).pdf

Federal Emergency Management Agency

Response Directorate

Performance Work Statement (PWS)

For

Air Transportation Support Services

1. Title of Project

Federal Emergency Management Agency

Response Directorate

Air Transportation Support Services

2. Background

The Federal Emergency Management Agency’s (FEMA) mission is to help people before, during and after disasters. To execute this mission, FEMA executes programs and activities that supports the reduction of loss of life and property and protects the Nation from all hazards, including natural disasters, acts of terrorism, and other man-made disasters, by leading and supporting the Nation in a risk based, comprehensive emergency management system of preparedness, response, recovery, and mitigation.

The Response Directorate within FEMA coordinates and provides the core Federal disaster response capability needed to save lives, reduce suffering, and protect property in communities throughout the Nation that have been overwhelmed by the impact of a major disaster or emergency, regardless of cause. The Response Directorate must ensure that Federal emergency response systems and capabilities are properly poised to lean forward to support States and communities overwhelmed by disasters and emergencies.

To support declared or undeclared emergencies, disaster response operations and other national events and incidents, within the United States, its territories and possessions, FEMA may need to transport responders, personnel, survivors, equipment, and vehicles to and from affected areas.

To meet this need, FEMA requires a contracted source of air transportation services for various types of charter aircraft, corresponding but not limited to types described in this Performance

Work Statement (PWS). A charter flight is typically defined as a flight that is not part of an airline published schedule. A contract of this type will enable FEMA to proactively support the emergency response needs associated with natural, technological, man-made disasters and other national events and incidents in a timely manner.

3. Scope

The contractor shall provide all personnel, training, supervision, equipment, materials, facilities, supplies and services necessary to perform passenger and/or cargo airlift services in support of the tasks and deliverables described in this PWS, unless otherwise specified as government-furnished materials or services. The contractor shall provide aircraft certified by the Federal

Aviation Administration (FAA) and current commercial standards applicable to commercial aircraft charter. Aircrew will meet all applicable standards to include aircrew physical standards, FAA licensing, and appropriate training, currency/qualifications, and flying experience for the aircraft supplied and flown. The contractor shall provide all necessary material handling equipment for loading and unloading requirements with operators providing end to end for transportation and the preparation of cargo for movement to include hazardous material preparation/certification and Customs and FAA services, if required.

4. Period of Performance

The period of performance is for up to 12-month base period starting at contract award, with four

(4) optional 12-month periods. Work may be required to be performed 24 hours a day, seven days a week, including Federal Holidays.

5. Place of Performance

Location of performance will vary depending on operational needs and will be cited in each task order issued under the contract. The contractor shall be able to provide air transportation support services throughout the geographic United States inclusive of all U.S. Territories, compact of free associations and U.S. possessions.

6. Contractor Responsibilities/Specific Tasks

A. Applicable Documents

All applicable Federal Aviation Regulations and parts shall be adhered to and followed by the contractors, air carriers and supporting staff. Work to be accomplished under this PWS shall be performed using best commercial practices, inclusive of practices under the International Air

Transport Association (IATA) policy and guidelines. Current issues of all applicable documents that include but are not limited to those listed in this PWS, are to be used for reference purposes.

In addition, the contractor shall comply with all provisions of applicable statutes, tenders of service, and contract terms as such may affect flight safety, as well as with all applicable Federal

Aviation Administration Regulations, Airworthiness Directives, Orders, rules, and standards promulgated under the Federal Aviation Act of 1958, as amended. Compliance with published standards may not, standing alone, constitute compliance with generally accepted standards of airmanship, training, or maintenance.

B. Specific Tasks

6.1. Management Work Plan and Reporting

(a) Within two weeks following the establishment of the contract and each specific task order, the contractor shall meet with the Contracting Officer’s Representative (COR) and other

FEMA program and technical representatives to review the tasks of the PWS and requirements for developing a Program Management Plan (PMP).

(b) The contractor shall develop and submit to the COR for review not later than 30 days after the meeting described in paragraph (a), a PMP, identifying the organization and procedures used to fulfill the requirements of this PWS. The contractor’s PMP shall depict the organization structure, the assignment of functions, duties, and responsibilities, the procedures and policies, and the reporting requirements that are established for completing the activities assigned under this PWS. The PMP will be reviewed and approved by the COR before any work commences. The PMP shall be submitted to the COR and Contracting

Officer upon approval.

(c) The contractor shall employ a program management structure to ensure the efficient execution of the work and capability to report on the status of work performed.

(d) The contractor shall promptly notify the CO of any issues or problems requiring a

Government response.

(e) The contractor shall retain appropriate number of key personnel who have the necessary knowledge, skills, ability, and experience to effectively manage the contract and task order requirements.

(f) The contractor shall be proactive in identifying problem areas and providing corrective action.

(g) The contractor shall provide Status Reports after each tasking to the COR and Contracting

Officer which shall include, at a minimum: (1) a summary of the work accomplished; (2) cumulative flight hours and expenditures to include any billed aircraft positioning and depositioning costs where applicable; (3) any current and foreseeable problems and proposed corrective actions; and (4) the status of any task order incurred costs vs. planned costs. Flight hour costs shall include all direct flight expenses to include cost for flight repositioning;

crew/personnel; aviation ground support equipment; maintenance; and insurance costs.

Additional aviation support cost will be identified and paid as reimbursable expense items.

Status Reports are due no later than the 15th of the first month following task order award and by the 15th of each month thereafter until the end of each task order period of performance unless required sooner. The report shall be submitted electronically

(unprotected) to the COR and Contracting Officer. The format shall be developed by the contractor and agreed to by the Contracting Officer and COR.

(h) The contractor shall provide After Action Reports by the designated time identified for each task order. The report shall also include a report on the performance of equipment and teams to include lessons learned best practices, safety record, and recommendations for major plan maintenance and procedural revisions.

(i) Not later than five (5) calendar days after the IDIQ contract award, the contractor shall reaffirm and identify in writing to the CO, the name, address, and phone number of the CDR and alternate(s).

(j) Key FEMA contract program office staff shall include the COR and the Program Manager.

6.2. Air Transportation Support

(a) The contractor shall provide “turn-key” support services at all locations to support all types of passenger/cargo transport and airfield & ground transportation requirements --- with the ability to retain transport and drivers for extended periods to accomplish mission.

(b) The contractor shall provide all necessary material handling equipment (MHE) to load and unload aircraft and qualified personnel to operate equipment compatible with furnished aircraft. The contractor shall also provide all cargo preparation and manifesting of personnel, equipment, vehicles, and baggage for air movement, and all necessary services to prepare and certify hazardous material for air movement. Any Personally Identifiable Information (PII) or Sensitive Personally Identifiable Information (SPII) contained in the manifests will be handled according to the Security and Privacy sections below.

(c) Aircraft Types and Capabilities: The contractor shall provide access to all types of operational certified aircraft, including those types as described below, with the additional ability to provide other aircraft (fixed wing or rotary wing) if required. The following types of aircraft and associated capabilities that will be used to perform services under this contract includes, but not limited to:

1. Light Jet Class:

Description: Light jets with pressurized cabins

Capacity: Holds 5 - 8 passengers

Average speed and range: Average cruising speed of 400-560 mph with average nonstop range of 1,500 miles

Other Capabilities (as required): Ability to provide air to ground telephone service

2. Medium Cabin Jet Class:

Description: Aircraft used for longer-range flights with additional space and fuel capacity than Small Cabin Jets.

Capacity: Holds 7 - 10 passengers

Average speed and range: Average cruising speed of 490 - 590 mph with average nonstop range of 2,100 – 3,000 miles

Other Capabilities (as required): Ability to provide air to ground telephone and data service

3. Large Cabin/Heavy Jet Class:

Description: Aircraft that can cover long distances and do not require a major airport runway

Capacity: Holds 15 - 17 passengers

Average speed and range: Average cruising speed of 500 - 560 mph with average nonstop range of 3,000 – 7,000 miles

Other Capabilities (as required): Ability to provide air to ground telephone and data service

4. Intermediate Jet Class:

Description: Large aircraft that can cover long distances and require a major airport runway

Capacity: Holds 30 - 150 passengers with corresponding cargo capability

Average speed and range: Average cruising speed of 450 - 560 mph with average nonstop range of 1,000 – 3,000 miles

Other Capabilities (as required): Ability to provide air to ground telephone and data service

5. Large/Jumbo Passenger/Cargo:

Description: Aircraft that can cover long distances and require a major airport runway

Capacity: Holds in excess of 150 passengers and associated cargo and/or vehicles

Average speed and range: Average cruising speed of 480 - 570 mph with average nonstop range of 3,000 – 8,000 miles

Other Capabilities (as required): Ability to provide air to ground telephone and data service

6. Twin-Engine Turboprop Passenger/Cargo:

Description: Aircraft that can land on unimproved services or small, regional, or major airports with short to long range capability

Capacity: Holds 4 - 92 passengers and associated cargo and/or vehicles (in larger aircraft)

Average speed and range: Average cruising speed of 125 - 400 mph with average nonstop range of 400 – 4,500 miles

7. Helicopter:

Description: Aircraft that can land on unimproved services or small, regional, or major airports with short to long range capability

Capacity: Holds 2 - 25 passengers and associated cargo

Average speed and range: Average cruising speed of 70 - 200 mph with average nonstop range of 50 - 700 miles

(d) If cargo, including vehicles cannot be transported on aircraft, it may be necessary to provide commercial vehicle carriers to take vehicles from home station to the disaster/incident/event site and return them to home station at a future time.

(e) On-Loading and Off-Loading of Aircraft: The contractor shall be responsible for the safe on-loading and off-loading of the aircraft in accordance with applicable Federal Aviation

Regulations and individual aircraft specifications. A member of the contractor's crew shall be responsible for weight and balance of Government traffic and shall make a visual check of cabin load and, if required, indicate approval of loading by signing the station compartment breakdown. The contractor shall provide air terminal weight and balance forms and any other required technical data to assist in safely loading the aircraft. The contractor shall ensure all equipment at destination is positioned and ready to begin offloading no more than

2 hours prior to the established landing time. The contractor shall notify the COR and CO in advance if they are not able to meet this 2-hour timeline.

(f) The contractor shall support any of the FEMA emergency response team/task force or executive requirements, as described in this PWS, and comply with all applicable laws, regulations, standards, and commercial practices with the focus on safety and customer service.

The contractor shall comply with the responsibilities outlined in this PWS. When required, the contractor shall be able to demonstrate its (or its subcontractors) compliance with each task and/or responsibility listed in the PWS and in the contract.

6.2.1. Activation and Availability Requirements

(a) Upon issuance of a task order, the aircraft requested by FEMA must be activated and positioned where directed by the Government, with maximum fuel aboard consistent with aircraft performance limitations and mission requirements, as quickly as possible but in no event more than 24 hours after the contractor receives the task order. Also, upon task order activation the contractor shall immediately provide all required information including the tail number; flight schedule and airfield ramp departing/arriving locations (including Fixed Base

Operator, if applicable) to the COR. Each task order from the contract will specify the required positioning time for the requested aircraft.

(b) The contractor shall provide sufficient personnel, equipment and materials to enable at least

10 hours per day utilization of each aircraft required in the task order. The contractor must immediately provide documentation and justification of how the 10 hour per day utilization rate will be achieved to the Government, if requested. If the contractor for reasons beyond its control is unable to provide the personnel, equipment or material necessary to operate its aircraft 10 hours per day, it shall still be obligated to provide the aircraft required under the task order, and to secure the additional personnel, equipment or material through alternate sources capable of meeting FEMA operational requirements. Similarly, if the contractor for reasons beyond its control is unable to provide the aircraft required in the task order and operate 10 hours per day, it will be obligated to secure equivalent aircraft, personnel, material and equipment to operate as if it had the aircraft under its control. Alternate sources must be approved by the COR and CO prior to performance of any FEMA requirement.

(c) During an emergency activation (as specified in the task order), and when the contractor has been alerted that air transportation services shall be necessary, the contractor shall be required (if needed) to provide air transportation services on a 24 hour, 7 day per week basis, with a 5-hour response time with the responding aircraft and crew ready for onward flight. If chartered aircraft and/or crew are unable to provide the requested movement within the specified timeframe, the contractor shall be responsible for finding and delivering a suitable backup aircraft and crew to the pickup point within 2 hours of determination that the primary aircraft and crew cannot execute the mission. The task order will specify the commercial airfield(s) for team(s) or task force(s) for the point(s) of pickup and destination. The contractor must be able to be contacted and respond within the specified timeframe on a 24-hour/7 day per week basis. The contractor shall promptly notify the COR or CO of any change.

6.2.2. Air Crew and Personnel Requirements

(a) The contractor shall provide sufficient qualified cockpit crew members to finish each flight without delays and must furnish an aircraft for each flight capable of completing the flight without requiring regularly scheduled maintenance, except for in route and turnaround service unless permitted otherwise by the COR.

(b) The contractor shall have a Contractor Designated Representative (CDR) or alternate(s) available, 24 hours a day, and 7 days a week via phone and e-mail for the duration of response operations to resolve any issues that may arise.

1. The CDR (and alternates) shall have full authority to act for the contractor on all matters and shall be responsible for the overall management and coordination of air transportation operations and support services.

2. The CDR, alternate(s), and contractor employees who have contact with customers must be able to read, write, speak, and understand English fluently. English shall be the only language used for written correspondence, discussions, and other business transactions.

The CDR must be a U.S. citizen without a criminal felony record.

(c) Aircrew must be licensed and qualified for the type of aircraft they are assigned to fly.

(d) All contractor employees and their representatives are required to conduct themselves in a professional manner in servicing and performing the terms of the contract. If at any time during the performance of this contract the COR determines it to be in the best interest of the

Government, the COR may order the contractor to remove personnel from further performance under this contract for security reasons, misconduct, or violation of regulations.

In the event it becomes necessary to replace any contractor employee for any of the above reasons, the contractor shall bear all costs associated with such removal including the costs for replacement of any employee so removed.

6.2.3. Baggage and Equipment Liability Limitation

(a) The contractor shall be responsible for the loss and/or damage to passenger baggage and equipment while such items are in its custody or on board its aircraft.

(b) Liability for personal baggage shall be commensurate with standard commercial service.

(Claims for lost or damaged baggage will be submitted to the contractor on its standard commercial baggage claim form.)

(c) In the case of loss or damage beyond economical repair to equipment, the CO shall determine the amount of the contractor's liability. Compensation shall be affected either by reduced amounts owed to the contractor or by direct payment compensation. The CO will determine the method of payment/compensation. All equipment in need of repairs/maintenance shall be reported to the FEMA Representative within 30 days of discovery. In the case of damaged equipment, the amount of compensation due the Government by the contractor shall be the actual cost of repair, provided such amount does not exceed the economical repair value. In the case of loss or damage beyond economical repair to equipment, the amount of the contractor's liability shall be the depreciated replacement value of the item to be determined by the CO. Any failure of the contractor to agree with such determination shall be treated as a dispute pursuant to the clause of this contract entitled “Disputes”.

6.2.4. Delays/Diversion

(a) A delay at origin or other designated pick-up/drop-off points, caused by factors beyond the control and without the fault or negligence of the contractor, shall be considered as contractor-uncontrollable; a delay for any other reason shall be considered contractor-controllable.

(b) When a delay or deviation from task order schedule occurs at any point of a charter for any reason, the contractor shall immediately notify the COR of any flight delays that are in excess of one (1) hour from the scheduled departure time.

(c) Contractor Responsibility During Controllable Delays: If the delay is determined to be chargeable against the carrier, the contractor shall be responsible for any other added costs such as, but not limited to, provisions for security of aircraft, all passengers and cargo, and cancellation or rescheduling charges. Additional charges to the contractor do not include personal costs incurred by the passengers.

(d) In the event it should be necessary to offload passengers at any location or station, other than at the direction of the COR, the contractor shall be responsible for such offloading, passenger care, and safeguarding personal baggage from loss, theft and/or weather damage, reloading and all costs incident to such services until such time as the contractor moves or causes to be moved such passengers to their intended destination or to such other location as directed by the COR. The COR shall be notified immediately of any offloading.

6.2.5. Reimbursable Expense Items

The Government shall pay the contractor for other incurred costs including landing fees, ramp fees, freight handling fees, hold time, de-ice, international fees, and fuel costs as reimbursable expense items. Other reimbursable expenses will include position/depositing of planes; cost for ground support labor and vehicles; labor cost for cranes and forklifts; hazardous material handling and other direct cost (including insurance).

Should the Government cancel a scheduled flight after the contractor's aircraft has departed to position or has already positioned for a scheduled flight when notice of cancellation is given, the

Government shall reimburse the contractor the positioning/depositioning cost only. Certification showing positioning and depositioning distances and locations shall accompany the contractor's invoices.

6.3. Technical Assistance

(a) Upon receipt of a task order, the contractor shall furnish to the Government, technical advice and information designed to provide maximum coordination and expeditious, efficient and effective utilization of air transportation assets in support of FEMA disaster or non-disaster operations. Such technical advice shall consist of the furnishing of technical personnel to participate in meetings and exercises and preparing or assisting in the preparation of informational material, including but not limited to manuals, documents, listings, reports, specifications and other data, as required. It is expressly understood and agreed that all information, assistance and advice to be provided to the Government by the contractor hereunder shall be solely of an advisory or consulting nature and this agreement does not contemplate, require or authorize any agreement between the contractor and other air carriers which may have similar agreements with the Government.

(b) Task orders issued under the provisions of paragraph 6.3 (a) shall include Administrative and

Accounting Support. This will involve the preparation of informational material such as manuals, documents, listings, reports, specifications and other data, shall contain a date for completion of the assistance called for there under which represents a current estimate of the time reasonably required to provide the assistance. Additionally, it will involve routine accounting clerical operations, such as: examining, verifying, and correcting accounting transactions to insure completeness and accuracy of data and proper identification of accounts, and checking that expenditures will not exceed obligations in specified accounts;

totaling, balancing, and reconciling collection vouchers; posting data to transaction sheets where employee identifies proper accounts and items to be posted; and coding documents in accordance with a chart (listing) of accounts.

7. Performance Requirements Summary – See QASP

8. Contract Type

This contract shall be an Indefinite Delivery Indefinite Quantity (IDIQ) vehicle. Task orders issued off this contract can be either firm-fixed price (FFP) or time & materials (T&M).

9. Quality Assurance Surveillance Plan (QASP):

Attached to this PWS. Shall be completed by the Government and incorporated into the contract.

10. Deliverables

(a) The contractor shall provide status reports, progress reports, and other deliverables as required in a format proposed by the contractor and agreed to by the Government.

(b) The contractor shall provide support to FEMA, as required, in the writing and/or reviewing of Program documentation. All documents prepared by the contractor shall be on the behalf of FEMA and the contractor shall not independently publish or distribute any document without prior written permission from the Contracting Officer.

(c) The draft and final deliverables of all associated working papers and other material deemed relevant by FEMA which have been generated by the contractor in the performance of these tasks are the exclusive property of the U.S. Government and shall be submitted to FEMA at the conclusion of the tasks.

(d) FEMA will be the sole authorized source for releasing verbally or in writing any data, the draft deliverables, final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the selected contractor. Any request for information relating to these tasks presented to the selected contractor shall be submitted to

FEMA for response.

(e) Press releases, marketing material, or any other printed or electronic documentation related to this project shall not be publicized without the written approval of FEMA.

(f) The following deliverables shall be provided as required. Due dates may be dependent on specific milestones as documented in the PMP. All references to days are in calendar days.

Task Deliverables Due Date

Task 6.1:

Management

Work Plan and

Reporting

Written Status/Progress Reports

By the 15th day of the following month

6.1(b) Program Management Plan NLT 30 days after kick-off meeting

Task 6.3:

Technical

Assistance

• Meeting support and technical advice

• Informational material

• Manuals, documents, listings, reports, specifications and other data

As required by each task order

6.1 (g) • Operational Status Report Timeline for report receipt/regularity as defined between vendor and COR during a response

After Action 6.1

(h)

• After Action Report(s) As required for each task order

(g) Each task order may contain a separate deliverable schedule relative to only that task order.

11. Security Requirements

(a) Additional security requirements may be specified in each task order. However, at a minimum, the contractor shall ensure all personnel assigned to this contract do not have criminal records and have the proper clearances to enter Federal facilities, if required.

(b) As part of the performance of this contract, the contractor may be required to work with other contractors working for the government. The government shall establish an initial contact between the contractor and other contractors and shall participate in an initial meeting at which the conventions for the scheduling and conducting future meetings will be established.

(c) Information made available to the contractor by the government for the performance of this effort shall be used only for those purposes specified and shall not be used in any other way without the written authorization of the CO.

(d) The Contractor shall protect PII & SPII in accordance with the terms of the contract, and the clauses identified therein.

12. Safety

(a) Aircrew and contractor support personnel shall obey and follow all FAA, Federal, State, Local and FEMA rules, regulations and or laws regarding the safe operation of any aircraft transporting FEMA or other designated personnel.

(b) The contractor shall conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work to include, but not limited to the following:

1. Provide protection to government property to prevent damage during the period the property is under the control or in possession of the service provider.

2. Include a clause in all subcontracts to require sub-service providers to comply with the safety provisions of this contract.

3. Immediately notify the COR of any damage to government property or injury to personnel at the time of occurrence and in writing and within 24 hours.

13. Government Furnished Property/Information

(a) FEMA may provide Government-Furnished Property and Information depending on the services expressed in each task order and as mutually agreed by the parties.

(b) The contractor shall be responsible for and accountable for all Government Furnished

Property provided under the contract and shall comply with the provisions of Federal

Acquisition Regulation (FAR) Part 45 and FAR Clause 52.245-1, Government Property.

14. Hours of Operation

The contractor shall be responsible for providing aircraft and qualified personnel 24 hours a day, 7 days a week who are familiar with the contract's terms and conditions. The contractor shall accept orders for service and perform delivery 24 hours a day, 7 days a week. The CO will determine the hours of services when other than 24 hour/7-day service is required.

15. Travel

The contractor shall manage and provide funding for all aspects of travel for its aircrew and support personnel to include all travel costs, room and board, etc.

16. Personally Identifiable Information (PII)

INFORMATION SHARING

To accomplish the tasks outlined in this contract, the contractor may receive the following PII data elements:

Identification number/Account number

Name

Date of birth (DOB)

Gender

Mailing address

Email address

Occupation (Optional)

This PII information includes any direct flight safety requirements questions related to security, luggage type and weight related factors that could impact aircraft safety flight requirements. Other

Federal Aviation Administration requirements may also apply.

The information sharing outlined in this contract is authorized by the following System of Records

Notice(s) and Routine Use(s): DHS/ALL-047 Records Related to DHS Personnel, Long-Term

Trainees, Contractors, and Visitors During a Declared Public Health Emergency System of

Records, Routine use G.

The contractor will limit access to the PII provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

52.224-1 Privacy Act Notification Apr 1984

52.224-2 Privacy Act Apr 1984

52.227-14 Rights in Data -- General May 2014

C.7 PRIVICY AND SECURITY CLAUSES:

I. HSAR Deviation 15-01 SAFEGUARDING OF SENSITIVE INFORMATION (MAR

2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees

(hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United

States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal

Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of

Homeland Security (including the PCII Program Manager or his/her designee);

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part

1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the

Department of Homeland Security (including the Assistant Secretary for the Transportation

Security Administration or his/her designee);

(2) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(3) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive but Unclassified (for Official

Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53

Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and

Instructions. MD 11042.1, Safeguarding Sensitive but Unclassified (For Official Use Only)

Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy

Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for

Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard

SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of

Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form

11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or

Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency

Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or

Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the

Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for

Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance. Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years.

Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact

Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three

(3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods:

(1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The

90-day review process is independent of the system production date and therefore it is important that the Contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The

Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for

Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of Contractor systems from Government tools and infrastructure.

(5) Revocation of ATO. In the event of a sensitive information incident, the Government may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor IT system under this contract.

Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal reporting requirements.

Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal

Year 2014 DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for Contractor systems.

(f) Sensitive Information Incident Reporting Requirements.

(1) All known or suspected sensitive information incidents shall be reported to the

Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the Headquarters or Component SOC, the Contractor shall also notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-CERT using the contact information identified in the contract. If the incident is reported by phone or the

Contracting…