Attachment 01. Statement of Work_A00001.pdf

DR-4796-IA

STATEMENT OF WORK DIRECT

LEASE PROGRAM (DL) DR-4796-IA

SEVERE STORMS, FLOODING,

STRAIGHT-LINED WINDS, AND

TORNADOES

PURPOSE:

The Department of Homeland Security (DHS) Federal Emergency Management Agency (FEMA) has a requirement for Direct Lease Contractors/Property Managers (PM), Housing Solutions Vendors and/or Property Owners (PO). FEMA Direct Lease is a housing assistance program to lease existing rental units for the purpose of providing temporary housing to eligible applicants who are displaced due to the presidentially declared major disaster designated FEMA DR-4796- IA as a result of Severe Storms, flooding, straight-line winds, and tornadoes for June 22, 2024. Note: the term Contractor will be used to refer to Contractor/Property Managers/Housing Solutions Vendors/Property Owners from this point on.

SCOPE:

Contractor shall make available properties that are within thirty (30) minutes to up to sixty (60) minutes commuting distance from the damaged dwelling and that do not place an undue hardship on qualified disaster applicants. This should include existing residential properties advertised for lease (e.g., corporate apartments, vacation rentals, and second homes), vacant residential properties that are listed for sale (single family and multiple occupancy), and bank owned properties (e.g., foreclosures) or any other type of residential property that meets the criteria of a Direct Lease property as defined by FEMA and the standards identified in this Statement of Work. Contractor shall provide FEMA with regular progress reports related to their property inventory.

Contractor and FEMA shall evaluate each property to ensure the property is safe, sanitary, secure, and functional. Safe means secure from disaster-caused hazards or threats to occupants. Sanitary means free of disaster-caused health hazards. Functional means an item or home capable of being used for it intended purpose.

The following items and services are to be performed by the Contractor for the Direct Lease Program:

1. Identify Properties. Contractor shall only rent existing residential property.

a. Contractor may only lease properties that comply with federal, state, and local occupancy standards, to provide complete and independent living facilities for one or more persons, including permanent provisions for living, sleeping, cooking, and sanitation. All utilities, appliances, and any furnishings provided by the property must be safe and functional.

i. Contractor shall prioritize properties that include accessibility features or can easily be conformed to accessible requirements; and are in proximity to accessible public transportation, as well as wrap around services.

b. The monthly cost per unit may not exceed the amounts established in Figure 1 below, unless an increase is approved by the Contracting Officer (CO).

i. The Government will establish a contract line item for one (1) month security deposit not-to-exceed one (1) month rent. The security deposit is a cost reimbursable contract line item and will not be disbursed at the signing of the contract. The security deposit will be held by the Government in the event any

70FBR724Q00000020_A00001 Attachment 01 damages (other than normal wear and tear) occur and will be invoiced based on the actual costs of damages verified between the Government and the Contractor. All damages above the cost of monthly rent shall be the responsibility of the contractor and or applicant upon confirmation of the cause of damage.

ii. Damages-Security Deposit must be approved by CO prior to submission of invoice.

Contractor must submit request for damages/security deposits within 7-days of Move-Out Inspection (MOI). Documentation including repair costs and time stamp photo documentation must be submitted with request.

c. Contractor shall implement and update a tracking spreadsheet for approved properties throughout the Direct Lease process. The tracking system must be approved by the COR prior to implementation. An example is provided at Attachment 2, Direct Lease Property Tracking Sheet.

Figure 1 - Maximum Monthly Rent FY25 Fair Market Rent (FMR) Documentation 1

County 1 BED 2 BEDS 3 BEDS 4 BEDS

Buena Vista $727 $954 $1,169 $1,265 Cherokee $792 $877 $1,229 $1,473

Clay $697 $877 $1,158 $1,163 Sioux $719 $904 $1,190 $1,232

2. Property Inspections. Contractor/FEMA shall inspect each property to ensure compliance with

HUD’s Housing Quality Standards (HQS) and with Federal, State, and local occupancy standards prior to executing lease agreements with housing applicants. Each inspection will also verify property owner’s capability to provide all property management services, including building maintenance.

3. Contacting Applicants. FEMA will identify eligible applicants for the Direct Lease program and provide the following applicant information to Contractor: applicant name, co- applicant names (if applicable), damage dwelling address, mailing address, phone numbers and email addresses.

4. Matching Applicants. Once units are reported as available, FEMA will initiate contact to the applicant within one (1) day and coordinate with the applicant to match the Direct Lease unit that fits the needs of the applicant. FEMA will also inform each applicant of the next steps towards their placement in a Direct Lease Unit, such as having background checks for properties that require it.

a. Contractor shall notify FEMA, within one (1) day, in each instance regarding an applicant being denied due to adverse information in their background check.

5. Execute Lease Agreements. Contractor shall execute lease agreements with DHS-FEMA through completion of Attachment 4 of this document, the Direct Lease Contract Terms and Conditions.

6. Move-in of Applicants. Contractor and FEMA will be responsible for the move-in process for applicants into Direct Lease units. Contractor and DHS-FEMA shall conduct a walkthrough of the temporary housing unit with the applicant and ensure all necessary paperwork is completed prior to completing a move-in. Within three (3) business days of completion, Contractor shall prepare and provide the COR with the following documentation:

a. A copy of the inspection record confirming the property complies with Federal, State, and local occupancy standards; HUD (Attachment 3). The completed HUD inspection checklist shall be submitted prior to award.

b. A copy of the Direct Lease Contract Terms and Conditions (Attachment 4) that was completed in executing the lease agreement and specifies the monthly rent rates.

c. A copy of the Direct Lease Occupant Lease Agreement (Attachment 5), and

d. A copy of the Temporary Housing Agreement (Attachment 6).

e. A copy of the lease agreement between the Contractor and the property owner.

7. Lease Agreement Payments. FEMA shall make rental payments to Contractor in accordance with the rental or lease agreements for each property that is awarded under the contract.

8. Terminate Lease Agreements. FEMA will be responsible for any termination of assistance to applicants. Contractor shall be responsible for eviction of applicants whose assistance has been terminated by FEMA. FEMA may terminate the lease for the housing unit by providing Contractor with a written sixty (60) calendar day Termination Notice.

9. Utilities. The Government is not responsible for utilities, unless utilities are included in the monthly rental fee and do not exceed the established monthly rental rates established in Figure 1. Applicants are responsible for obtaining their own utility accounts.

10. Access and Functional Needs. A provision allowing Contractor to make, at FEMA’s expense, reasonable modifications, or improvements to the property to provide a reasonable accommodation for an eligible applicant with a disability or other access or functional needs. All modifications or improvements will be coordinated with the COR for, FEMA approval prior to execution or incurrence of costs. All costs above $3,000 must be approved by the CO.

INSPECTION

Properties are subject to inspection by FEMA and other applicable Government agencies. Contractor shall participate by responding to all requests for information and inspection or review findings by regulatory agencies. Contractor shall allow FEMA, or an entity or organization approved by FEMA, to conduct inspections of rental units, as required, to ensure an acceptable level of services and acceptable conditions of housing as determined by FEMA. No notice to Contractor is required prior to an inspection.

FEMA will share findings of the inspection with Contractor (See Attachment 3).

PLACE OF PERFORMANCE

Within thirty (30) minutes to up to sixty (60) minutes commuting distance of disaster impacted counties.

PERIOD OF PERFORMANCE

The period of performance (POP): Base Period: 12-months, with two (2) 3-month Option Periods (if needed)

POINTS OF CONTACTS:

CONTRACTING OFFICER:

Name: Stewart Knotts Phone: 202-445-7811 Email: Stewart.Knotts@fema.dhs.gov

CONTRACTING OFFICER REPRESENTATIVE(S):

Name: Sandra Hunter Phone: 202-538-4996 Email: Sandra.Hunter@fema.dhs.gov

Name: Tritina Faulkner Phone: 540-771-6118 Email: Tritina.Faulkner@fema.dhs.gov mailto:Stewart.Knotts@fema.dhs.gov mailto:Sandra.Hunter@fema.dhs.gov mailto:Tritina.Faulkner@fema.dhs.gov

FEMA PROGRAM MANAGER

Name: Anita Jeanette Phone:202-805-7082 Email: Anita.Jeanette@fema.dhs.gov

APPLICABLE ATTACHMENTS:

• Direct Lease Property Tracking Sheet

• Direct Lease Property Inspection Checklist (HUD)

• Direct Lease Contract Terms and Conditions

• Direct Lease Occupant Lease Agreement Template

• Direct Lease-Lease Addendum

• Temporary Housing Agreement

• FEMA Decision to Terminate DTHA Notice

• Pricing Schedule

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law, or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

• applies to records created, received, or maintained by Contractors pursuant to their FEMA contract; and

• may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for mailto:Anita.Jeanette@fema.dhs.gov

Government use or created, while performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records, and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any subcontractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

8. The Contractor shall not create or maintain any records containing any nonpublic FEMA information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. FEMA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls. Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement.

The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

G. Medical information; and H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

i. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form. Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency. Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information. Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology. Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information. Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors.

Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery.

All other incidents shall be reported within 8 hours of discovery.

(2) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic

70FBR724Q00000020_A00001 Attachment 01 https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors

Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validationprogram/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level; (vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network; (viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest. (5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and Information.

Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required.

Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements.

Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts.

The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

Information Technology Security Awareness Training (Jul 2023)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

Privacy Training Requirements All Contractor and subcontractor employees that will have access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors.

Training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall also complete the training before accessing PII and/or SPII. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

Information Sharing To accomplish the tasks outlined in this contract, FEMA will share with the property management contractors the following PII data elements: Disaster Survivor’s Name, FEMA Registration Number, Phone numbers and Email Addresses if provided by the Disaster Survivor.

The information sharing outlined in this contract is authorized by the following DHS/FEMA/PIA-049 - Individual Assistance (IA) Program (January 11, 2018).

SORN coverage should be provided by the following: Routine Use F of, DHS/FEMA-008 - Disaster Recovery Assistance Files. 78 Fed. Reg. 25,282 (April 30, 2013).

Need to Know The contractor will limit access to the PII provided by FEMA under this contract only to the contractor’s authorized personnel having a need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

Return or Destruction of Data when no longer needed If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.