SOW DR-4482 Predisio Furniture Lease 002.pdf

Department of Homeland Security (DHS)

November 2024 1

Federal Emergency Management Agency

STATEMENT OF WORK (SOW) FOR:

Presidio Furniture Lease DR4482

Demetria Carter, Contracting Officer

PROCUREMENT SENSITIVE INFORMATION

This document contains non-public information intended for use on a need-to-know basis within FEMA only.

Please protect this document as procurement sensitive and handle accordingly.

DEPARTMENT OF HOMELAND SECURITY (DHS)

DHS Statement of Work (SOW)

Learn more at fema.gov November 2024 2

Statement of Work (SOW)

1.0 GENERAL

1.1 BACKGROUND

The Federal Emergency Management Agency (FEMA) Region 9 coordinates the Federal Government 's role in all presidentially declared Emergencies and Major Disasters, whether natural or human-caused, including acts of terror.

To accomplish this mission FEMA regularly maintains commercial properties across various areas of responsibility (AOR) to include field offices to accommodate mission assignments serving the public before, during, and after disasters. The Region 9 Presidio office is expected to provide individual support and public assistance directly to individuals and households, as well as state, local, tribal, and territorial (SLTT) Governments under the Robert T.

Stafford Disaster Relief and Emergency Assistance Act. Leasing of office furniture at the proposed location shall enhance productivity and teamwork among FEMA responders reporting to San Francisco, CA and afford the necessary flexibility to support disaster-related activities.

1.2 SCOPE

The contractor shall be able to furnish, deliver, and install all office furniture in this SOW for the entire term of the contract, to include option years, exercised at the Government ’s discretion. The contractor shall also be able to pick up furniture at such time the Government determines it necessary.

1.3 OBJECTIVE

The objective of this requirement is to lease/rent furniture to furnish an office space leased to support disaster staff in San Francisco, CA. The space, comprised of two adjoined office suites will support approximately 50 FEMA responders, occupying an approximate 14,736 square feet of open office space. This requirement consists of providing, installing, and maintaining commercial office furniture for DR-4482 at the Region 9 Presidio Office located at 1163 Gorgas Avenue, Suite 120, San Francisco, CA 94129 and 1167 Gorgas Avenue, Suite 130, San Francisco, CA 94129. All vendors participating in contract solicitation shall be required to perform mandatory site walkthrough before submission of bid proposal.

1.4 APPLICABLE DOCUMENTS

All furniture must comply with all agencies’ policies and regulations in NISTIR 8119, March 2016. Layout of all furniture must comply with all federal, state, and local laws and regulations.

Learn more at fema.gov November 2024 3

1.4.1 REFERENCE DOCUMENTS

The following documents may be beneficial to the Contractor in performing the work described in this document:

• Attachment A – FEMA R9 Presidio - Overview of Furniture Layout Required 002 (PDF)

Attachment A - FEMA R9 Presidio - Overview

• Attachment B – FEMA R9 Presidio - Office & Cubicle Numbering Plan (PDF)

Attachment B - FEMA R9 Presidio - Office &

• Attachment C – FEMA R9 Presidio – Overview of Power & Water Supply Distribution (PDF)

Attachment C - FEMA R9 Presidio - Overview

• Attachment D – FEMA R9 Presidio - Office Space Square Footage Plan (PDF)

Attachment D - FEMA R9 Presidio - Office Sp

• Attachment E – FEMA R9 Presidio - Vendor Insurance Requirements

Attachment E - FEMA R9 Presidio - Vendor

Learn more at fema.gov November 2024 4

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK ONE - Design

The contractor shall provide a design and layout plan to FEMA for approval prior to receiving notification to proceed.

Attachment A-E are for the contractor’s reference only. It is the sole responsibility of the contractor to ensure all proposed furniture and layout fit the space available and meet the requirements of this SOW. The layout of furniture needs to account for existing electrical outlets to allow FEMA to connect electric furniture add-ons to existing outlets and reduce or eliminate the need for running new electrical drops. All furniture shall be uniform in appearance, finishes, colors, and manufacturers, to the fullest extent possible.

2.2 TASK TWO – Delivery and Installation

Contractor shall supply all materials and labor required to deliver and install the furniture, to include power and data connections specified on the design. All power and data connections shall be incorporated into existing connections.

2.2.1 STANDARD WORKSTATION

Each standard workstation shall be 6’x6’ in size in an L-shaped layout with the following: a. 60” high acoustical panels, b. one lockable pedestal with two drawers and one file drawer, c. vertical cable pathways integral to the furniture and panels, d. a minimum of two power receptacles and one data punch out per workstation. Each workstation shall have an ergonomic chair design, black in color, mesh-backed, padded, and stain-resistant. They shall also include adjustable-height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider.

One standard workstation shall be designated as a reception desk with ergonomic design. The reception desk shall be approximately or at minimum 6’x 6’ in size in an L-shaped layout with the following: a. a reception desk countertop, b. one lockable pedestal with two drawers and one file drawer, c. vertical cable pathways integral to the furniture and panels, d. a minimum of two power receptacles and one data punch out. The reception workstation shall have an ergonomic chair design, black in color, mesh-backed, padded, and stain-resistant seat. The chair shall also include adjustable-height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider. The reception desk shall also have two black guest chairs, with armrests.

Two standard workstations shall be designated as a “security workstation” with ergonomic design. One security workstation shall be approximately 6’x 6’ in size in an L-shaped layout with the following: a. reception desk countertop, b. one lockable pedestals with two drawers and one file drawer, c. vertical cable pathways integral to the furniture and panels, d. a minimum of two power receptacles and one data punch out. The second security workstation shall be approximately ‘6 x 2’ in size in standard layout, without a return, with the following: a.

interconnected and adjoined to 6’ x 6’ security workstation, b. reception desk countertop, c. one lockable pedestals with two drawers and one file drawer, d. vertical cable pathways integral to the furniture and panels, e. a minimum of two power receptacles and one data punch out. Both security workstations shall have an ergonomic chair design, black in color, mesh-backed, padded, and stain-resistant seat. The chairs shall also include adjustable chair height, locking controls for front tilt, lumbar support, seat slider, and be equipped with no chair arms. The security workstation shall include two black guest chairs, with armrests.

Learn more at fema.gov November 2024 5

The contractor shall advise the Government during task one of the appropriate desk sizes available for reception and security workstations to maximize the usable space. The Government wants forty-six standard workstations and two security workstations located at 1163 Gorgas Avenue, Suite 120, San Francisco, CA 94129, encompassing an approximate 7,268 sq ft. In addition, the Government wants three standard workstations and a reception workstation located at 1167 Gorgas Avenue, Suite 130, San Francisco, CA 94129, encompassing an approximate 7,468 sq ft.

Standard Workstations: Desk #001 to #003, #005 to #050 Reception Workstation: Desk #004 Security Workstation: Desk #051

2.2.2 OFFICE CORNER DESKS

Office corner desks shall be 66”L x 30”D x 29”H with a return of 42”L x 24”D x 29”H in an L-shaped layout. Each office corner desk shall have a pedestal of three drawers and one of the drawers must be file-compatible and lockable. Each desk shall have an ergonomic chair design, black in color, mesh-backed, padded, stain-resistant seat. They shall also include adjustable height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider. Each office corner desk shall have one black guest chair with armrests and one round office table 42” inch diameter with two guest chairs with armrests.

There will be two office corner desks in total. Each office shall have one employee chair, three guest chairs, and one round office table. It would be left to the vendors to provide the Government the best value to maximize seats available and functionality of the space. See Attachment A and B for reference.

Private Offices: Room Number 105 and 106.

2.2.3 EXECUTIVE CORNER DESKS

Executive corner desks shall be 72”L x 36”D x 29”H with a return of 48”L x 24”D x 29”H in an L-shaped layout. Each executive corner desk shall have a pedestal of three drawers and one of the drawers must be file-compatible and lockable. Each desk shall have an ergonomic chair design, black in color, mesh-backed, padded, stain-resistant seat. They shall also include adjustable height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider. Each executive corner desk shall have one black guest chair with armrests, a wardrobe, and one round office table with three guest chairs with armrests.

In total, there will be three executive corner desks. Each office shall have one employee chair, four guest chairs, a wardrobe, and a round office table. Executive office #101 shall also include lounge furniture and have two sofas, four lounge chairs, one credenza, and one coffee table. The coffee table and credenza shall be wood finish, color TBD during task one. The contractor shall select appropriate size furniture to fit the space, during task one. See Attachment A and B for reference.

Executive Offices: Room #101, #102 and #103

Learn more at fema.gov November 2024 6

2.2.4 CONFERENCE TABLE

The conference table shall be wood finish; color TBD by the Government during task one. The tables shall have mounted power module(s) in grommets with a minimum of four power outputs and two LAN ports. The government wants a table with dimensions 180’L x 48”’W x 30”H, however, the contractor shall advise the Government during task one of the appropriate table sizes to maximize the number of participants in the usable space. All conference table chairs will have an ergonomic design, black in color, mesh-backed, padded, stain resistant seats. They shall also include adjustable height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider. The conference room shall also have black guest chairs, with armrests and casters. Contractor shall determine the exact number of chairs that will fit the available space during task one. Government wants seven guest chairs at minimum. See Attachment A and B for reference.

Conference Room: Room #108

2.2.5 MEETING TABLE

The meeting room shall have two tables: color and finish TBD by the Government during task one. The tables shall have mounted power modules in grommet(s) with a minimum of two power outputs and one LAN port. The government wants a table with dimensions 120’L x 48”W x 30H, however, the contractor shall advise the Government during task one of the appropriate table sizes to maximize the number of participants in the usable space. All meeting table chairs will have an ergonomic design, black in color, mesh-backed, padded, stain resistant seats. They shall also include adjustable height arms, adjustable chair height, and locking controls for front tilt, lumbar support, and seat slider. The meeting room shall also have black guest chairs, with armrests. Contractor shall determine the exact number of chairs that will fit the available space during task one. Government wants four guest chairs at minimum. See Attachment A and B for reference.

Meeting Room: Room #104

2.2.6 BREAKROOM TABLES

Breakroom tables shall include one round table with the approximate dimensions 48”L x 48”D x 29” H with five chairs. In addition, there shall be two rectangular tables along the corner of the breakroom with the approximate dimensions 72”L x 24”D x 30”H with two chairs at each table, or the appropriate number of chairs to maximize seating. The chairs will be black stackable chairs with a weight rating of at least 300 pounds. It would be left to the vendors to provide the Government the best value to maximize seats available and functionality of the space. See Attachment A and B for reference.

Breakroom: Room #107

2.2.7 SUPPLY AREA TABLE

Supply area tables shall be rectangular with the approximate dimensions 72”L x 24”D x 30”H. Each supply area table shall support use of stationary and administrative supplies and be located near copier/printer areas. The contractor shall advise the appropriate color, finish, and size of tables, during task one. See Attachment A and B for reference.

Copier/Printer Areas: C-1 and C-2

Learn more at fema.gov November 2024 7

2.2.8 WALL PARTITIONS

The contractor shall furnish and install free-standing wall partitions with the approximate height of 6’ feet. The contractor shall advise the Government of the available wall partitions sizes and options during task one. Wall partitions shall be modular and configured as shown in Attachment A. Wall partitions shall also comply with local and state building and fire codes, and regulations. Wall partitions shall be fire-resistant, stain-resistant, and provide the highest-level of visual and acoustic privacy to minimize sound transmission. Wall Partitions shall have fabric-covered or wood-finished panels, color TBD during task one, and doorway entrances. See Attachment A for reference.

Areas Requiring Partition Walls: Room #101 to #109

2.3 TASK THREE – Maintenance and Repair

Contractor shall provide full maintenance and repair services to include but not limited to replacement of products with like kind at no additional cost to the Government throughout the term of the contract, to include all options.

2.4 TASK FOUR - Pick Up

Contractor shall be responsible to disassemble and remove all leased/rented furniture from the facility upon the termination of the contract.

2.5 General Information

2.5.1- The contractor’s employees shall provide a photo ID to enter the FEMA facility.

2.5.2- The contractor shall remove, from the property of the FEMA facility, all trash, debris, and any broken or unusable systems furniture that accumulate during the completion of the installation.

2.5.3- The contractor shall be responsible for damage to building property and shall repair and/or replace the damaged property. Repairs shall be made, at the contractor’s expense, to correct any building damage caused by the reconfiguration team, including but not limited to damage to walls, ceiling, and floors. Any building damage shall be restored to the original condition it was in prior to the start of the furniture reconfiguration. This applies to all tasks in this SOW.

2.5.4- The contractor and each of its employees shall comply with all applicable local, state, federal, and authority rules, regulations, and practices. All electrical components shall meet UL safety requirements.

2.5.5- The contractor shall also be responsible for all injury to persons or damage to property that occurs as a result of the contractor’s negligence and shall take proper safety and health precautions to protect the work, the workers, the public, and the property of others.

Learn more at fema.gov November 2024 8

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement.

PROJECT MANAGER

Note: The Government may designate additional Contractor personnel as Key at the time of award.

3.3.1 CONTRACTOR KEY PERSONNEL SHALL NOT BE ASSIGNED BY THE CONTRACTOR TO MORE

THAN ONE KEY POSITION FOR THIS REQUIREMENT.

3.4 Project Manager

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the COR. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak, and understand English. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

Learn more at fema.gov November 2024 9

3.4.1 THE PROJECT MANAGER SHALL BE AVAILABLE TO THE COR VIA TELEPHONE BETWEEN THE HOURS OF 0800 AND 1700 PST, MONDAY THROUGH FRIDAY, AND SHALL RESPOND TO A REQUEST FOR DISCUSSION OR RESOLUTION OF TECHNICAL PROBLEMS WITHIN 1 BUSINESS DAY OF NOTIFICATION.

3.5 EMPLOYEE IDENTIFICATION

3.5.1 CONTRACTOR EMPLOYEES VISITING GOVERNMENT FACILITIES SHALL WEAR AN IDENTIFICATION BADGE THAT, AT A MINIMUM, DISPLAYS THE CONTRACTOR’S NAME, THE EMPLOYEE’S PHOTO, NAME, CLEARANCE-LEVEL, AND BADGE EXPIRATION DATE.

Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and always display all identification and visitor badges in plain view above the waist.

3.5.2 CONTRACTOR EMPLOYEES WORKING ON-SITE AT GOVERNMENT FACILITIES SHALL WEAR A

GOVERNMENT-ISSUED IDENTIFICATION BADGE. ALL CONTRACTOR EMPLOYEES SHALL IDENTIFY

THEMSELVES AS CONTRACTORS WHEN THEIR STATUS IS NOT READILY APPARENT (IN MEETINGS, WHEN ANSWERING GOVERNMENT TELEPHONES, IN E-MAIL MESSAGES, ETC.) AND DISPLAY THE GOVERNMENT-

ISSUED BADGE IN PLAIN VIEW ABOVE THE WAIST AT ALL TIMES.

3.6 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees always present a professional appearance and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Project Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations, and policies concerning safety and security.

3.7 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer*), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

4.0 Other Applicable Conditions

The contractor shall, without an additional expense to the Government, be responsible for obtaining all licenses, certifications, insurance, and permits which are necessary to fulfill the requirements of the Statement of Work. The

Learn more at fema.gov November 2024 10 contractor shall also obtain and pay the costs of any royalties and licenses for any patented or copyrighted items used in the performance of work.

Insurance requirements for successful vendor (proof required and submitted before work to begin).

a. Workers compensation Insurance as required by state law.

b. Commercial general liability insurance in the minimum amount of two million dollars, including a general aggregate in the minimum amount of three million dollars.

c. Employer’s liability insurance in the minimum amount of one million dollars.

d. Business automobile insurance in the minimum amount of one million dollars.

4.1 Security

Contractor will not have access to unclassified or Security Sensitive Information under this SOW. All the contractor’s employees and personnel working in the FEMA facility will be required to check in at the building security office and shall be required to have a FEMA escort at all times while working inside the FEMA facility.

4.2 Period of Performance

The base contract period of performance is from the date of award to 45 days from date of award. See solicitation for option periods.

4.3 Place of Performance

The primary place of performance will be the Department of Homeland Security, FEMA, Region 9 Presidio Office located at 1163 Gorgas Avenue, Suite 120, San Francisco, CA 94129 and 1167 Gorgas Avenue, Suite 130, San Francisco, CA 94129.

4.4 Hours of Operation

Contractor employees shall generally perform all work between the hours of 0800 and 1700 PST, Monday through Friday (except Federal holidays). However, there may be occasions when Contractor employees shall be required to work other than normal business hours, including weekends and holidays, to fulfill requirements under this SOW.

4.5 Travel

Contractor travel shall not be required for this contract.

4.6 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than 5 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held via teleconference, as determined by the Contracting Officer.

Learn more at fema.gov November 2024 11

4.7 Project Plan

The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment.

The Contractor shall provide a final Project Plan to the COR not later than 10 business days after the Post Award Conference.

4.8 Business Continuity Plan

Not Used

4.9 Progress Reports

The Project Manager shall provide a weekly progress report to the Contracting Officer and COR via electronic mail.

This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, and any Contractor concerns or recommendations for the previous reporting period.

Reports shall shift to monthly check-in with COR to ensure no issues are outstanding, after the invoice for delivery and installation has been paid by the Government.

4.10 Progress Meetings

The Project Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information, and resolve emergent technical problems and issues. These meetings shall take place via teleconference, email, and/or phone.

4.11 General Report Requirements

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows XP and Microsoft Office Applications).

4.12 Intellectual Property

Not Used

4.13 Protection of Information

Contractor access to information protected under the Privacy Act or proprietary information is not required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

4.14 Section 508 Compliance

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L. 105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology

Learn more at fema.gov November 2024 12

Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

5.0 Government Terms & Definitions

2.0 TBD - To Be Determined

5.1 COR - Contracting Officer’s Representative

5.2 DHS - Department of Homeland Security

6.0 Government Furnished Resources

The Government will not furnish any resources to the Contractor in support of this contract.

7.0 Contractor Furnished Property

The Contractor shall furnish all facilities, materials, equipment, and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0 and SOW 6.0.

8.0 Government Acceptance Period

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying them that the deliverable has been accepted.

8.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal.

In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

http://www.access-board.gov/ http://www.section508.gov/

Learn more at fema.gov November 2024 13

8.2 Inspection and Acceptance of deliverables shall be completed in accordance with

FAR 52.212.

8.3 All review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan.

The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to assure that the established schedule is maintained.

9.0 Deliverables

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to the next deliverable or event in this

SOW.

ITEM SOW

REFERENCE DELIVERABLE/EVENT DUE BY DISTRIBUTION

1 4.6 Post Award Conference 5 days after award

COR, Contracting Officer, PM

2 4.6, 4.7 Draft Contractor Project Plan During conference

COR, Contracting Officer

3 4.7 Final Contractor Project Plan 10 days or earlier, after conference. COR, Contracting Officer

4 4.9 Progress Reports Weekly COR, Contracting Officer

7 xxx Post Installation Check-in Monthly COR, Contracting Officer

Information Sharing

Authorities: This information sharing, including the collection and dissemination of information described in this contract, is authorized by 5 U.S.C. § 301, the Homeland Security Act, codified in Title 6 of the U.S. Code; the DHS/ALL/PIA-039 Physical Access and Control System (PACS) (July 2019) and Routine Uses F and H of the DHS/ALL-024 Department of Homeland Security Facility and Perimeter Access Control and Visitor Management, 75 Fed. Reg. 5609 (Feb. 2010), Final Rule for Privacy Act Exemptions, 74 Fed. Reg. 42578 (Aug. 2009).

Need to Know

Learn more at fema.gov November 2024 14

The Contractor will limit access to the PII provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching

The Contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), will occur for the purpose of establishing or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefits programs.

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

Recipient Requirement If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

The above Information Sharing terms are to be considered collectively with the terms stated below in the sections SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015) and INFORMATION TECHNOLOGY

SECURITY AND PRIVACY TRAINING (MAR 2015).

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes FEMA records;

• does not include personal materials;

applies to records created, received, or maintained by Contractors pursuant to their FEMA contract; and may include deliverables and documentation associated with deliverables.

C. Requirements Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, Learn more at fema.gov November 2024 15

29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

FEMA and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of FEMA or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to FEMA. The agency must report promptly to NARA in accordance with

36 CFR 1230.

The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the SOW. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to FEMA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the SOW. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and FEMA guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with FEMA policy.

The Contractor shall not create or maintain any records containing any non-public FEMA information that are not specifically tied to or authorized by the contract.

Learn more at fema.gov November 2024 16

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

The FEMA owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which FEMA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

Learn more at fema.gov November 2024 17

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release;

switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models.

Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

Learn more at fema.gov November 2024 18

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

i. Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

ii. Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

A. Truncated SSN (such as last 4 digits);

B. Date of birth (month, day, and year);

C. Citizenship or immigration status;

D. Ethnic or religious affiliation;

E. Sexual orientation;

F. Criminal history;

Learn more at fema.gov November 2024 19

G. Medical information; and H. System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

i. Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual. Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency. Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information. Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology. Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors.

https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors

Learn more at fema.gov November 2024 20

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-trainingrequirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validationprogram/validated-modules.

When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email.