Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

Region IX Emergency Services & Medical Access

PROCUREMENT SENSITIVE

INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

1.0 Background

FEMA Region IX’s Area of Response includes Pacific Territories, specifically Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands (CNMI). FEMA employees travel to this Area of Response on official business to provide support, coordination, and assistance. During emergency deployments or other official travel, FEMA employees may require medical assistance, clinical consultation, medical case management, medical escort, ground ambulance support, emergency transportation coordination, companion travel coordination, legal referral coordination, or medical evacuation.

2.0 Purpose

Due to the geographic isolation of the Pacific Territories and the limited availability of certain medical specialties and tertiary care resources in remote island locations, requesting and receiving timely medical services or advice from a traveler’s Continental United States-based insurance company or medical provider may not be practical. The purpose of this requirement is to obtain contractor managed emergency medical membership access services and related medical coordination and transportation support for covered FEMA personnel on official work-related assignments in the covered Region IX Pacific Territory locations.

3.0 Scope

FEMA has a need for Medical Membership Access. The Contractor shall provide emergency medical membership/access, 24/7 assistance center access, clinical intake, initial triage, medical case management, mission coordination, commercial medical escort coordination, ground ambulance coordination, fixed-wing air ambulance coordination and/or performance, specialty medical transport team support, specialty medical equipment, companion travel coordination, legal referral coordination, readiness validation, reporting, and related support services for covered FEMA personnel on official work-related assignment in Guam, American Samoa, and CNMI. Hawaii is excluded as a covered duty location. However, Hawaii may be used as a receiving destination when clinically appropriate and authorized by the Government.

The Contractor shall provide services for 15 covered FEMA personnel per membership year. The average trip length is anticipated to be 30 days.

4.0 Objective

The objective of this requirement is to provide FEMA with timely, reliable, and coordinated access to emergency medical assistance and medical transportation support for covered FEMA personnel traveling on official assignments in the Region IX Pacific Territories. The Contractor shall provide a single point of access for medical assistance, coordinate necessary clinical and transportation resources, support FEMA authorization and decision-making, monitor missions from activation through closeout, and provide documentation and reporting for services ordered and performed.

5.0 SPECIFIC REQUIREMENTS/TASKS

5.1 Annual Readiness and Membership Access

The Contractor shall provide annual readiness and membership access services for up to 15 covered FEMA personnel. The Membership Access shall include:

5.1.1 24/7 Assistance Center Access

The Contractor shall provide 24 hours per day, 7 days per week, 365 days per year access to an assistance center capable of receiving emergency medical assistance requests from covered FEMA personnel or authorized FEMA representatives.

The Contractor shall provide:

1. Live emergency intake capability.

2. Primary and backup emergency contact pathways.

3. Case opening and tracking capability.

4. Escalation procedures for urgent and emergent medical situations.

5. Access to clinical personnel for intake and triage coordination.

6. Access to transportation coordination resources.

7. Access to travel or legal documentation resources.

5.1.2 Program Management and Account Setup

The Contractor shall establish and maintain program management processes for performance under this contract. The Contractor shall develop and maintain:

1. Account setup procedures.

2. FEMA points of contact and authorization workflows.

3. Standard operating procedures for activation, escalation, authorization, and reporting.

4. Communication protocols for the Contracting Officer, Contracting Officer’s Representative, program office, and authorized FEMA representatives.

5. Procedures for documenting oral authorizations when permitted by the contract and confirming such authorizations in writing.

5.1.3 Provider Network Readiness

The Contractor shall maintain access to qualified medical, transportation, and support providers necessary to perform the requirements of this SOW.

The Contractor shall maintain procedures to verify, document, and monitor provider qualifications, which may include, as applicable:

1. Medical licenses and certifications.

2. Aviation operating authority.

3. Ground ambulance licenses.

4. Insurance coverage.

5. Accreditation or equivalent quality credentials.

6. Personnel qualifications.

7. Ability to support covered locations and anticipated evacuation routes.

8. Backup provider availability.

The Contractor shall not assign any provider to perform regulated medical, aviation, ground ambulance, or transportation services unless the provider possesses all required qualifications, authorizations, licenses, certifications, insurance, and approvals applicable to the mission.

5.1.4 Operational Readiness and Performance Requirements

The Contractor shall maintain operational readiness necessary to provide or coordinate services under this SOW.

5.1.4.1 Personnel Readiness

The Contractor shall maintain staffing necessary to perform the requirements of this SOW and shall ensure assigned personnel maintain current medical, aviation, and mission-specific licenses, certifications, credentials, and qualifications required for their assigned duties.

5.1.4.2 Equipment and Aircraft/Vehicle Availability

The Contractor shall maintain, or ensure that assigned providers maintain, required aircraft, vehicles, and other mission-critical equipment in mission-ready status, subject to applicable safety, maintenance, operational, and regulatory requirements.

5.1.4.3 Dispatch and Communications Capability

The Contractor shall maintain available and tested communications systems necessary to receive requests, coordinate services, monitor authorized missions, and communicate with authorized FEMA representatives. The Contractor shall acknowledge dispatch notifications in a timely manner when conditions permit.

5.1.4.4 Credentialing and Regulatory Compliance

The Contractor shall maintain compliance with applicable aviation, medical, safety, licensing, insurance, privacy, and recordkeeping requirements. The Contractor shall ensure that providers and personnel assigned to perform regulated services possess the qualifications, authorizations, licenses, certifications, insurance, and approvals applicable to the assigned mission.

5.1.5 Legal Referral Coordination

The Contractor shall provide legal referral coordination as part of the annual membership access services for covered FEMA personnel. Legal referral coordination shall be included in the annual membership fee and shall not be separately priced, invoiced, or treated as a mission-specific service.

Legal referral coordination is limited to identifying and facilitating contact with local legal resources or referral networks in Guam, American Samoa, CNMI, or another Government-authorized mission-related location. The Contractor shall not provide legal advice, legal representation, legal opinions, attorney-client services, or legal decision-making on behalf of FEMA, the Government, or covered FEMA personnel.

Legal referral coordination may include identifying available legal referral resources, providing contact information for those resources, facilitating an initial referral or introduction when authorized by the Government, and documenting coordination activities in the applicable case record using minimum necessary information.

5.2 Case Activation and Clinical Intake

The Contractor shall provide case activation and clinical intake services when a covered FEMA employee or authorized FEMA representative requests assistance.

5.2.1 Case Opening and Eligibility Confirmation

The Contractor shall open a case record upon notification of a potential medical assistance requirement. The Contractor shall document:

1. Date and time of request.

2. Requestor name and contact information.

3. Covered employee name or identifier.

4. Location of covered employee.

5. Available contact information.

6. Nature of the request.

7. Initial urgency level.

8. FEMA authorization status, when applicable.

Eligibility confirmation shall not delay emergency intake or urgent coordination needed to protect the covered employee’s health or safety.

5.2.2 Initial Clinical Intake and Triage

The Contractor shall initiate clinical intake and triage using appropriately qualified clinical personnel.

The Contractor shall gather available clinical information necessary to assess the appropriate next steps.

The Contractor shall coordinate with treating providers, local clinics, hospitals, or other medical personnel, as appropriate and authorized, to obtain minimum necessary clinical information.

5.2.3 Initial Medical Review and Recommendation

The Contractor shall provide an initial medical review and recommendation based on available information. Recommendations may include, as applicable:

1. Continued local treatment.

2. Telehealth or medical consultation.

3. Referral to a local or regional provider.

4. Commercial medical escort.

5. Ground ambulance.

6. Fixed-wing air ambulance.

7. Specialty medical transport.

8. Receiving facility coordination.

9. Companion travel coordination, when authorized by the Government.

10. Legal referral coordination, when requested and authorized by the Government.

11. Other medically appropriate support.

The Contractor shall not make final Government authorization decisions. The Contractor shall support the Government’s decision-making by providing clinical, operational, routing, timing, and pricing information.

5.3 Medical Case Management and Mission Coordination

The Contractor shall provide medical case management and mission coordination for all activated cases. The Contractor shall coordinate appropriate clinical, logistical, transportation, communication, and documentation support based on the covered FEMA employee’s medical needs and the Government’s authorization.

5.3.1 Non-Evacuation Medical Case Management

For cases that do not require medical evacuation or transportation, the Contractor shall provide or coordinate appropriate support, which may include:

1. Medical consultation.

2. Local medical provider referral.

3. Follow-up care coordination.

4. Telehealth or remote medical consultation coordination.

5. Coordination with local clinics, hospitals, or treating providers, as appropriate and authorized.

6. Case monitoring until the case is resolved, transferred, or otherwise closed.

7. Communication and status updates to authorized FEMA representatives.

8. Case closure documentation.

5.3.2 Evacuation Mission Coordination

For cases that may require medical evacuation or transportation, the Contractor shall coordinate and manage mission planning activities, as appropriate and authorized by the Government. Mission coordination may include:

1. Assessment of clinical transport requirements.

2. Coordination with the origin facility, treating provider, or local medical personnel.

3. Identification of an appropriate receiving facility and confirmation of facility acceptance.

4. Evaluation of available transportation modes.

5. Coordination of commercial medical escort, ground ambulance, fixed-wing air ambulance, or specialty medical transport resources, as applicable.

6. Coordination of ground ambulance services at the origin, destination, or transit locations, as required.

7. Identification and coordination of required medical equipment, supplies, and specialty transport capabilities.

8. Development of proposed routing, timing, and mission logistics.

9. Preparation of a mission-specific price quotation or not-to-exceed estimate, as applicable.

10. Submission of clinical, operational, routing, timing, and pricing information necessary to support

Government authorization.

11. Mission monitoring from activation through patient handoff to the receiving facility or other authorized provider.

12. Coordination of companion travel when authorized by the Government.

13. Initiation of legal referral coordination under Section 5.1.5, when requested and authorized by the

Government

14. Post-mission documentation, including mission status, services performed, provider information, and any relevant follow-up actions.

The Contractor shall not initiate a transportation mission, incur mission-specific charges, or make final authorization decisions without Government authorization, except as otherwise expressly authorized under the contract for urgent actions necessary to protect the covered FEMA employee’s health or safety.

5.4: Commercial Medical Escort Services

The Contractor shall provide or coordinate commercial medical escort services clinically appropriate and authorized by the Government.

Commercial medical escort services may include:

1. Registered Nurse medical escort.

2. Paramedic medical escort.

3. Physician medical escort.

4. Specialty medical escort, including respiratory therapist, pediatric, neonatal, behavioral health, or other specialty support.

The Contractor shall ensure that medical escorts possess appropriate qualifications, licenses, credentials, and experience for the assigned mission.

5.5 Ground Ambulance Services

The Contractor shall provide or coordinate ground ambulance services at origin or destination in the following zone.

1. Zone 1 – Guam

Ground ambulance services may include:

1. Basic Life Support ground ambulance.

2. Advanced Life Support ground ambulance.

3. Critical Care ground ambulance.

4. Specialty, bariatric, or isolation ground ambulance.

The Contractor shall ensure that ground ambulance providers are properly licensed, insured, equipped, and staffed for the jurisdiction and level of care required.

5.6: Fixed-Wing Air Ambulance Services, Standard

The Contractor shall provide or coordinate standard fixed-wing air ambulance services for authorized missions requiring BLS (Basic Life Support) or ALS (Advanced Life Support) -level air medical transportation.

Standard fixed-wing air ambulance zones may include but not limited to:

1. Zone 2 - Guam/CNMI to Hawaii.

2. Zone 3 - Guam/CNMI to CONUS West Coast (Arizona, California, Nevada, Including 153 Area Tribes.

3. Zone 4 - American Samoa to Hawaii.

4. Zone 5 - American Samoa to CONUS West Coast (Arizona, California, Nevada, Including 153 Area Tribes.

5. Zone 6 - Non-Zoned: Other Pacific Basin routes authorized by the Government.

5.7: Fixed-Wing Air Ambulance Services, Critical Care

The Contractor shall provide or coordinate fixed-wing air ambulance services for critical care patients when authorized by the Government.

Critical Care

Critical care missions may require:

1. Critical care clinical staff.

2. Advanced monitoring.

3. Ventilator support.

4. Infusion management.

5. Medication administration.

6. Patient-specific medical equipment.

7. Other clinically required critical care support.

Critical care fixed-wing routes may include:

1. Zone 2 - Guam/CNMI to Hawaii.

2. Zone 3 - Guam/CNMI to CONUS West Coast (Arizona, California, Nevada, Including 153 Area Tribes.

3. Zone 4 - American Samoa to Hawaii.

4. Zone 5 - American Samoa to CONUS West Coast (Arizona, California, Nevada, Including 153 Area Tribes.

5. Zone 6 – Non-Zoned: Other Pacific Basin routes authorized by the Government.

5.8 Task: Specialty Medical Transport Teams

The Contractor shall provide or coordinate specialty medical transport teams when clinically required and authorized by the Government.

Specialty medical transport teams may include:

1. Infectious disease or isolation team.

2. Respiratory therapist or ventilator support team.

3. Other specialty medical team approved by the Government.

The Contractor shall ensure specialty medical team personnel possess the qualifications, licenses, certifications, and experience required for the specific mission.

5.9: Waiting, Standby, Diversion, and Cancellation

The Contractor shall provide waiting, standby, diversion, and cancellation support when required by an authorized mission.

The Contractor shall apply only pre-priced event or hourly rates identified in the contract for:

1. Waiting or standby beyond an included grace period.

2. Cancellation after resource commitment.

3. Cancellation after aircraft positioning or launch.

4. Diversion or Government-directed route change.

The Contractor shall document the triggering event, time, mission status, and Government authorization supporting the charge.

5.10: Other Direct Costs (ODCs), Mission-Specific Extraordinary Requirements

The Contractor shall provide or coordinate mission-specific extraordinary requirements only when authorized by the Government.

ODCs may include:

1. Landing, handling, permit, or overflight requirements.

2. Customs, immigration, or border processing requirements.

3. Fuel or fuel surcharge not included in the fixed mission price.

4. Remote location fuel or technical stop requirements.

5. Receiving facility deposit or admission coordination.

6. Emergency lodging, crew rest, or transportation support.

7. Other Government-approved mission requirements.

8. The Contractor shall provide or coordinate specialty medical equipment beyond the routine transport configuration when clinically required and authorized by the Government. Specialty medical equipment may include isolation pods, bariatric equipment, neonatal equipment, ventilators, advanced monitoring equipment, and other Government-approved specialty medical equipment necessary to support the covered FEMA employee’s clinical needs during an authorized mission.

9. All ODCs shall be pre-approved by the task order CO and COR.

5.11: Reporting

The Contractor shall provide routine and post-mission reporting.

Reports may include:

1. Monthly utilization report.

2. Post-mission summary report.

3. Annual readiness report.

4. Case activity summary.

5. Performance metrics.

6. Invoice support documentation.

7. Corrective action tracking.

8. Provider network readiness information, as required by the Government.

5.12: Companion Travel Coordination

The Contractor shall coordinate companion travel when clinically appropriate and authorized by the Government. Companion travel may include coordination of a ticket or travel arrangement for one authorized companion to accompany or meet the covered FEMA employee during a medical transport, evacuation, repatriation, or receiving facility transfer.

The Contractor shall not authorize companion travel without Government approval. Companion travel shall be priced under the applicable CLIN or SUBCLIN as firm-fixed-price, fixed unit price, or mission-specific firm-fixed-price not-to-exceed. No cost-reimbursement pricing is authorized.

Companion travel coordination may include:

1. Commercial airline ticket coordination.

2. Ground transportation coordination for the companion, when authorized.

3. Lodging coordination for the companion, when authorized.

4. Coordination with the medical transport provider regarding space availability and travel restrictions.

5. Communication of itinerary information to the Government and authorized parties.

6.0 CONTRACTOR PERSONNEL

6.1 Employee Identification and Conduct

Contractor personnel visiting Government facilities shall comply with all Government facility access, identification, escort, and conduct requirements. Contractor personnel shall identify themselves as Contractor personnel when their status is not readily apparent.

6.2 Removal of Contractor Personnel

The Government may direct the Contractor to remove any Contractor employee from DHS or FEMA facilities for misconduct, security reasons, or failure to comply with applicable requirements. Removal does not relieve the Contractor of responsibility to perform the requirements of the contract.

7.0 OTHER APPLICABLE CONDITIONS

7.1 Security

Contractor access to unclassified but sensitive information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

Contractor access to classified information is not anticipated under this SOW.

7.2 Period of Performance

The period of performance shall consist of a one-year base period and four one-year option periods.

Period Dates

Base Period TBD

Option Period One TBD

Option Period Two TBD

Option Period Three TBD

Option Period Four TBD

7.3 Place of Performance

The primary place of performance shall be the Contractor’s facilities. Services shall support covered FEMA personnel on official work-related assignment in Guam, American Samoa, and CNMI. Medical transportation and related mission services may occur at origin, destination, receiving facility, transit, or support locations as authorized by the Government.

7.4 Hours of Operation

The Contractor shall provide emergency assistance access 24 hours per day, 7 days per week, 365 days per year. Routine program management, reporting, and administrative support shall be available during normal business hours, Monday through Friday, excluding Federal holidays, unless otherwise required for emergency support.

7.5 Travel

Contractor travel may be required to support readiness validation, mission coordination, or other services ordered by the Government.

No cost-reimbursement travel is authorized. Any Contractor travel shall be included in the applicable firm-fixed-price CLIN, fixed unit price, or mission-specific firm-fixed-price not-to-exceed amount. The Contractor shall not invoice the Government for actual travel costs.

7.6 Post-Award Conference

The Contractor shall attend a post-award conference with the Contracting Officer and COR no later than 10 business days after the date of award. The post-award conference may be held virtually unless otherwise directed by the Government.

7.7 Project Plan

The Contractor shall provide a draft Project Plan at the post-award conference for Government review.

The Contractor shall provide a final Project Plan no later than 10 business days after receiving Government comments.

The Project Plan shall include:

1. Program management approach.

2. Points of contact and escalation procedures.

3. Activation and authorization process.

4. Provider network readiness approach.

5. Case management procedures.

6. Mission coordination process.

7. Companion travel coordination procedures.

8. Legal referral coordination procedures.

9. Reporting procedures.

10. Quality control procedures.

11. Privacy and information safeguarding procedures.

12. Continuity and backup procedures.

7.8 Progress Reports

The Contractor shall provide monthly progress reports to the COR and Contracting Officer. The report shall include:

1. Number of active and closed cases.

2. Type of services provided.

3. Response-time metrics.

4. Open issues.

5. Missions performed.

6. Companion travel coordination actions, if any.

7. Legal referral coordination actions, if any.

8. Readiness status.

9. Provider network updates.

10. Contractor concerns or recommendations.

11. Corrective actions, if any.

7.9 Progress Meetings

The Contractor shall meet with the COR monthly, or as otherwise requested by the Government, to discuss performance, open issues, reports, missions, lessons learned, and corrective actions.

7.10 General Report Requirements

The Contractor shall provide all written reports in electronic format compatible with current DHS/FEMA standard office productivity applications.

7.11 Protection of Information

The Contractor may have access to Privacy Act information, personally identifiable information (PII), protected health information (PHI), procurement-sensitive information, and other sensitive information.

The Contractor shall safeguard all such information against unauthorized access, use, disclosure, modification, or dissemination in accordance with applicable law, regulation, policy, and contract requirements.

The Contractor shall use the minimum necessary information to perform authorized services and shall limit access to personnel with a need to know.

8.0 GOVERNMENT FURNISHED RESOURCES

The Government will provide information necessary for the Contractor to perform authorized services under this contract, which may include:

1. Authorized FEMA points of contact.

2. Activation and authorization procedures.

3. Covered population information, as determined by FEMA.

4. Deployment or travel information necessary to confirm eligibility and coordinate services.

5. Available historical utilization information, if any.

6. Other Government information necessary to support mission authorization and performance.

The Contractor shall use Government-furnished information only for performance under this contract.

The Contractor shall not release Government-furnished information to outside parties without prior authorization from the Contracting Officer or as otherwise permitted under the contract for approved medical and transportation coordination.

9.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, personnel, systems, materials, equipment, providers, transportation coordination, clinical support, communications tools, and services necessary to fulfill the requirements of this contract, except for Government-furnished resources specified in Section 8.0

10.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the Contractor with written notification of acceptance or documented reasons for non-acceptance.

10.1 Rejection and Correction

The COR may reject or require correction of deliverables that do not meet contract requirements. The Contractor shall correct rejected deliverables and resubmit them within the timeframe directed by the

COR.

10.2 Review Period

The COR will have 10 business days to review routine deliverables and provide comments or acceptance. The Contractor shall have 5 business days to correct and resubmit routine deliverables unless otherwise directed by the COR.

For urgent post-mission reports or emergency-related deliverables, the COR may establish a shorter review and correction period.

11.0 DELIVERABLES

Individual Deliverable tables may be laid out specifically in each task order awarded off the overall IDIQ contract vehicle. Generally, all major deliverables shall be submitted to the COR, unless otherwise agreed upon. All work products must satisfy the requirements of this SOW.

Deliverable

SOW

Reference Description Due Date/Frequency Recipient

Post-Award Conference

Section 7.6

Attend a post-award conference to discuss contract requirements, points of contact, activation procedures, reporting, and performance expectations.

Within 10 business days after contract award

CO and COR

Draft Project Plan Section 7.7

Submit a draft Project Plan addressing the required program management, activation, provider readiness, case management, mission coordination, reporting, quality control, privacy, and continuity procedures.

At the post-award conference

CO and COR

Final Project Plan Section 7.7 Submit a final Project Plan incorporating Government comments.

Within 10 business days after receiving Government comments

CO and COR

Routine and Post- Mission Reports

Sections

5.11 and 7.8

Provide monthly progress and utilization information, case activity summaries, response-time metrics, Monthly for routine reports; within 5 business days after each

CO and COR

Deliverable

SOW

Reference Description Due Date/Frequency Recipient readiness and provider network updates, performance metrics, invoice support documentation, corrective action tracking, and post-mission summary reports. Reports shall include companion travel and legal referral coordination actions, when applicable.

authorized medical transportation or evacuation mission for post-mission reports, unless otherwise directed by the COR

Annual Readiness Report

Sections

5.1 and 5.11

Report on membership readiness, assistance center availability, provider network readiness, backup resources, and identified readiness concerns.

Annually, no later than 30 calendar days before the end of each membership year

CO and COR

Corrective Action Plan

Sections

5.11 and 7.8

Provide a corrective action plan to address performance deficiencies, mission issues, or readiness concerns when requested by the Government.

Within 10 business days after Government request, unless otherwise directed

CO and COR

12.0 Miscellaneous

FAR 52.224-3 PRIVACY TRAINING – ALTERNATE I (SEE FAR CLASS DEVIATION 17-03, REVISION 1)

(a) Definition. As used in this clause, personally identifiable information means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A–130, Managing Federal Information as a Strategic Resource).

(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or

(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.1 and 39.105).

(c) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract. Contractor employees shall satisfy this requirement by completing Privacy at DHS: Protecting Personal Information accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Training shall be completed within 30 days of contract award and be completed on an annual basis thereafter not later than October 31st of each year.

(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will—

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS (JULY 2023) (HSAR DEVIATION 25-12)

(Effective November 3, 2025)

a. Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

1. Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

2. Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

3. Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the

Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

4. Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

5. Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

6. International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

7. Information Systems Vulnerability Information (ISVI) means:

i. Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release;

switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models.

Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

ii. Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

8. Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

9. Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

10. Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

11. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration

Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and

H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

iii. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

b. Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

c. Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

d. The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

e. Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

f. The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

HSAR 3052.240-71 CONTRACTOR EMPLOYEE ACCESS ALT I (HSAR DEVIATION 25-12) (Effective November 3, 2025)

(g) Before receiving access to information resources under this contract, the individual must complete a security briefing; additional training for specific categories of CUI, if identified in the contract; and any nondisclosure agreement furnished by DHS. The Contracting Officer's Representative (COR) will arrange the security briefing and any additional training required for specific categories of CUI.

(h) The Contractor shall have access only to those areas of DHS information resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the COR, are strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for DHS. It is not a right, a guarantee of access, a condition of the contract, or government-furnished equipment (GFE).

(j) Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management, or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department's Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(2) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

HSAR 3052.240-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (HSAR

DEVIATION 25-12) (Effective November 3, 2025)

a. Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

1. Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

2. Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

3. Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

4. Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

5. Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

6. International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

7. Information Systems Vulnerability Information (ISVI) means:

i. Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release;

switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models.

Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

ii. Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

8. Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

9. Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

10. Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

11. Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an…