70RSAT22R00000022 Sections B - M Draft 20220930.pdf

DHS S&T ONL PIADC PICS STENS

DRAFT RFP 70RSAT22R00000022

SECTION B – SUPPLIES OR SERVICE AND PRICES / COSTS

B.1.0 CONTRACT TYPE

The this is a Cost-Plus-Fixed-Fee (CPFF) type contract for support services under North American Industry Classification System (NAICS) code 541620 for Environmental Consulting Services.

The Contractor shall provide all resources (except as may be expressly stated in this contract as furnished by the Government) necessary to furnish the services and items below in accordance with Section C, Statement of Work (SOW).

B.2.0 TRAVEL COSTS

All travel will be reimbursed at cost in accordance with the United States General Services Administration (GSA) Federal Travel Regulations (FTR). The Contractor shall seek written Government approval (Contracting Officer (CO) or Contracting Officer Representative (COR)) at least two weeks in advance, prior to incurring any costs associated with non-local travel.

Local travel will not be reimbursed within a 50-mile radius of the worksite. As the Contractor may locate personnel outside the Washington DC metropolitan area, for purposes of local travel only, the worksite shall be considered the Washington DC metropolitan area, or the location of Contractor’s personnel, whichever is within the 50-mile radius.

The Contractor shall use the federal lodging and per diem allowances in accordance with Federal Acquisition Regulation (FAR) subpart 31.205-46 and the applicable FTR governing the travel performed directly referable to this contract. The Government will not reimburse transportation costs in excess of coach class commercially scheduled air or ground transportation by the most expeditious route.

Travel reimbursement request must be submitted (in writing) in sufficient time for the CO or COR to give prior approval and must identify (i) the name of the traveler, (ii) destination (s) including itinerary, (iii) purpose of the travel, and (iv) cost breakdown.

To be reimbursed, invoices, including travel expenses must include a detailed breakdown of the actual expenditures invoiced. Information regarding FTR can be found at:

https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation.

B.3.0 COSTS AND PRICING

Costs and specific pricing are outlined in the CLINs above in Section A and in the detailed Final Negotiated Pricing Table located in Section J.

(End of Section B) https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation

SECTION C – DESCRIPTION / SPECIFICATIONS

See Section J, List of Attachments, for the complete SOW.

(End of Section C)

SECTION D – PACKAGING AND MARKING

D.1.0 MARKING AND DELIVERY

All information submitted to the Government, whether submitted electronically, through the postal system, or in person, shall clearly indicate the Project Title, Contract Number, and the names of the Contracting Officer (CO), Contract Specialist (CS) and Contracting Officer’s Representative (COR).

D.2.0 PAYMENT OF POSTAGE AND FEES

All postage and fees related to submitting information including forms, reports, submittals, etc.

to the CO, CS, and/or the COR shall be paid by the Contractor.

D.3.0 PRESERVATION, PACKAGING, AND PACKING

All materials shipped or mailed under this contract shall be afforded the degree of preservation, packaging, and packing required to prevent deterioration and damage due to the hazards to which they may be subjected during shipment, handling, and storage. All preservation, packaging, and packing for shipment or mailing shall be in accordance with good commercial practice and adequate to ensure acceptance by common carrier and safe transportation at the most economical rate(s). Materials and equipment shall be packaged in accordance with the Contractor's standard commercial practice to the degree required to prevent deterioration and damages due to the hazards of shipment, handling and storage. Packages shall be adequately marked to ensure delivery to proper destinations without delay and furnish notice of the existence of a warranty. A packing list will accompany each shipment.

D.4.0 DELIVERABLES MARKING

At a minimum, each shipping container shall be plainly and indelibly marked to show the following:

(a) Consignee

(b) Contract number

(c) A brief description of the items

(d) Quantity

(e) Contractor's name

(f) Any other markings that may be given to the Contractor prior to delivery.

D.4.1 MARKING OF SHIPMENTS (COMMERCIALLY PACKAGED ITEMS)

(i) Marking shall be in accordance with American Society for Testing and Materials (ASTM)-

D-3951-15 (most current edition) and with the information set forth in paragraph (ii) below. Unless specified elsewhere in this contract/order, bar coding is not required.

(ii) All unit and exterior containers/packs shall, as a minimum, be marked as follows:

1. National stock number (NSN), when available, or Federal stock number (FSN), when

NSN is not available, or part number when neither NSN or FSN are available.

2. Noun nomenclature cited on contract or order.

3. Quantity and unit of issue.

4. Contract, or order number.

5. From:_______________________________________________

(Contractor's Name)

(Address)

6. To: (See delivery address on page 1 or in Section F)

(iii) Markings may be applied by any means which provide legibility.

(iv) Additional markings required are stated below.

NONE

D.4.2 PREPARATION FOR DELIVERY (COMMERCIALLY PACKAGED ITEMS)

(a) Preservation, packaging, and packing shall be in accordance with ASTM-D-3951-15 (most current edition), "Standard for Commercial Packing." The unit pack quantity that applies to items under this contract is "Industry Standard."

(b) Prohibited Packing Materials. The use of asbestos, excelsior, loose fill polystyrene, newspaper or shredded paper (all types including waxed paper, computer paper and similar hydroscopic or non-neutral material) is prohibited.

(c) Non-Manufactured Wood Packing. All non-manufactured wood utilized in wood pallets and wood containers shall be heat treated to a minimum core temperature of 56 degrees centigrade for 30 minutes and certified by an accredited agency recognized by the American Lumber Standards Committee (ALSC). Non-coniferous (hardwood) and manufactured wood, such as particleboard and plywood, are exempt from this requirement.

(End of Section D)

SECTION E – INSPECTION AND ACCEPTANCE

E.1.0 INSPECTION OF SERVICES FAR CLAUSES

E.1.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

https://www.acquisition.gov

The following FAR provisions and clauses are incorporated by reference into this contract:

Clause Title and Date 52.246-5 Inspection of Services Cost-Reimbursement. (APR 1984) 52.246-25 Limitation of Liability – Services. (FEB 1997)

Inspection and acceptance of all work and services performed under this contract will be in accordance with the FAR clauses incorporated herein.

(End of clause)

E.2.0 INSPECTION AND ACCEPTANCE CRITERIA

In accordance with (IAW) FAR subpart 52.212-4(a) Inspection/Acceptance, the Contracting Officer (CO), Contract Specialist (CS), and Contracting Officer Representative (COR) will review draft and final deliverables to ensure accuracy, functionality, completeness, professional quality, and overall compliance within the guidelines/requirements of the contract and will inform the Contractor of its acceptability. The Contractor shall ensure the accuracy and completeness of all deliverables in accordance with referenced policy, regulations, laws, and directives. Reports and presentations shall be concise and clearly written. Errors, misleading or unclear statements, incomplete or irrelevant information, and/or excessive rhetoric, repetition, and "padding", or excessive length if a page limit is imposed, shall be considered deficiencies and will be subject to correction by the Contractor at no additional cost to the Government.

Unless otherwise indicated, the Government will require 10 workdays to review and comment on deliverables. If the deliverable does not meet the noted criteria, the Government will reject it.

A rejected deliverable will be handled in the following manner: after notification that the deliverable did not meet the acceptance criteria the Contractor shall resubmit updated/corrected version 10 workdays after receipt of Government comments.

Upon the Contractor’s re-submission, the Government will reapply the same acceptance criteria.

https://www.acquisition.gov/

E.3.0 HIGHER-LEVEL CONTRACT QUALITY REQUIREMENT

In accordance with FAR 52.246-11, Higher Level Contract Quality Requirement (DEC 2014)

(a) The Contractor shall comply with the higher-level quality standard(s) listed below.

• ISO 9001:2015; Quality Management Systems – Requirements;

• ISO 19011:2018; Guidelines for Auditing Management Systems;

• ISO 14001:2015; Environmental Management Systems – Requirements with guidance for use;

• ISO 35001:2019; Biorisk Management for Laboratories and other Organizations

• ISO 45001:2018: Occupational Health and Safety Management Systems –

Requirements with guidance for use; and

• ANSI/ASSP Z9.11-2016 Laboratory Decommissioning

Elements of additional high-level quality standards, determined as appropriate by the Contractor, should also be incorporated into the quality management approach. For example, this may include aspects of domains such as laboratory operations (e.g., ANSI/AIHA/ASSE Z9.5-2022 Laboratory Ventilation, Biosafety in Microbiological and Biomedical Laboratories (BMBL 6th Edition), building modification standards (e.g., International Building Code 2021, National Electric Code 2020), etc.

(b) The Contractor shall include applicable requirements of the higher-level quality standard(s) listed in paragraph (a) of this clause and the requirement to flow down such standards, as applicable, to lower-tier subcontracts, in -

(1) Any subcontract for critical and complex items (see 46.203(b) and (c)); or

(2) When the technical requirements of a subcontract require-

(i) Control of such things as design, work operations, in-process control, testing, and inspection; or

(ii) Attention to such factors as organization, planning, work instructions, documentation control, and advanced metrology.

(End of Section E)

SECTION F – DELIVERABLES OR PERFORMANCE

F.1.0 DELIVERABLES OR PERFORMANCE FAR CLAUSES

F.1.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this address:

https://www.acquistion.gov/far

The following FAR provisions and clauses are incorporated by reference into this contract:

Clause Title and Date 52.242-15 Stop Work Order (AUG 1989) 52.242-15 Alt I Stop-Work Order - Alternate I (APR 1984) 52.247-34 F.O.B. Destination (NOV 1991)

Deliverables or performance of all work and services performed under this contract will be in accordance with the FAR clauses incorporated herein.

F.2.0 PERIOD OF PERFORMANCE

The anticipated 10 (ten) year period of performance, including all options, if exercised, is listed below:

Period Duration Base Year 01/30/2023 to 01/29/2024

Option Year 1 01/30/2024 to 01/29/2025

Option Year 2 01/30/2025 to 01/29/2026

Option Year 3 01/30/2026 to 01/29/2027

Option Year 4 01/30/2027 to 01/29/2028

Option Year 5 01/30/2028 to 01/29/2029

Option Year 6 01/30/2029 to 01/29/2030

Option Year 7 01/30/2030 to 01/29/2031

Option Year 8 01/30/2031 to 01/29/2032

Option Year 9 01/30/2032 to 01/29/2033 https://www.acquistion.gov/far

F.3.0 PLACE OF PERFORMANCE

The primary place of performance shall be the Plum Island, New York, with the mailing address:

DHS PIADC

40550 Route 25 Orient Point, NY 11957.

Some work, however, may be also required at Orient Point, New York.

F.4.0 HOURS OF OPERATION

Work on Plum Island shall generally be performed between the hours of 6:00 am and 4:30 pm Eastern Time, Monday through Friday (except Federal Holidays).

F.5.0 DELIVERABLES

Deliverables shall be in accordance with requirements described the SOW.

F.6.0 GOVERNMENT FURNISHED PROPERTY (GFP) / GOVERNMENT

FURNISHED INFORMATION (GFI)

The Government will provide Government-Furnished Property (GFP) if required in support of the Science, Technology and Engineering Support (STENS) program delivery, the Contractor requests, and the COR concurs. Upon completion of this contract, the Contractor shall submit, to the Program Office, a complete inventory of all GFP remaining in their possession. The Program Office will provide disposition instructions on all property furnished and/or purchased under this contract.

GFI (software, manuals, drawings, test data, etc.) will be provided by the Government if required in support of the STENS program delivery, the Contractor requests, and the COR concurs. The list shall include description (title, data, and author), quantities and license numbers. Upon completion of this contract, the Contractor shall submit, to the Program Office, a complete inventory and all GFI remaining in their possession under the contract. The Program Office will provide disposition instructions on all property furnished or purchased under this contract.

F.6.1 PROPERTY ACCOUNTABILITY

• When Contractors are furnished with GFP, DHS barcodes will not be removed. In all GFP cases, the Government retains title to the property;

• It is the Contractor’s responsibility to use contract property as it was authorized, and for the purpose intended. In the event the Contractor uses contract property for other purposes without written authorization from the CO and COR, the Contractor may be liable for rental, without credit, of such items for each month or part of a month in which such unauthorized use occurs;

• Contractor is directly responsible and accountable for all contract property in its possession in accordance with the requirements of the particular contract; this also includes any contract property in the possession or control of a subcontractor;

• Physical inventory: In addition to requirements provided under the contract’s government property clause;

• The Contractor shall, minimum annually, perform, record, and disclose physical inventory results of GFP to CO and COR;

• Annual inventory results will be completed, certified and submitted by close of business on or before the last day of the calendar year (December 31st) of each year to the CO and COR;

• The Contractor shall, upon request, perform, record, and disclose physical inventory results of GFP to CO and COR; and

• As requested, inventory results will be completed, certified and submitted, in the timeframe defined at the time of request, to CO and COR.

F.6.2 PROPERTY DISPOSAL

• All documentation and goods are the property of the United States Government and, if applicable, the Contractor shall return or destroy appropriately upon request. The Contractor shall comply with applicable Government rules and regulations for disposal of Government property. Further, the Contractor shall provide necessary information to the CO and COR for all excess property prior to taking any action. Excess personal property ”means any personal property under the control of a federal agency that the agency head determines is not required for its needs or for the discharge of its responsibilities”;

• Lost, Stolen, Damaged or Destroyed (LDD) property: unless otherwise provided in the contract, the Contractor is liable for LDD of contract property, except for reasonable wear and tear in accordance with the contract’s government property clause. Any occurrence of LDD must be investigated and fully documented by the COR, who will promptly notify the CO. The Contractor will submit a report of any incident of LDD contract property to the COR in accordance with the contract’s government property clause and as detailed below, as soon as it becomes known;

• When GFP is LDD, the Contractor must report within 24 hours of discovery of the event to the COR who will initiate a Report of Survey;

• A Report of Survey will be prepared, regardless of whether or not preliminary research of a LDD event indicates positive evidence of negligence, misconduct, or unauthorized use and the responsible individual refuses to admit pecuniary liability;

• The Contractor must forward this document with all supporting documentation to the COR within 5 business days of the LDD event for review;

• The COR must submit the completed package within five (5)s business days of receipt from the Contractor; and

• Contractor and COR must supply all requested information and any subsequent requests for information.

(End of Section F)

SECTION G – CONTRACT ADMINISTRATION DATA

G.1.0 CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The Contracting Officer has designated the COR to assist in monitoring the work under this contract. The COR is responsible for the administration of the contract and technical liaison with the Contractor. The COR IS NOT authorized to change the scope of work or specifications as stated in the contract, to make any commitments or otherwise obligate the Government or authorize any changes which affect the contract cost/price, delivery schedule, period of performance or other terms or conditions.

The Contracting Officer is the only individual who can legally commit or obligate the Government for the expenditure of public funds. The technical administration of this contract shall not be construed to authorize the revision of the terms and conditions of this contract. Any such revision will be authorized in writing by the Contracting Officer.

NOTE: When, in the opinion of the Contractor, the COR or PM requests effort outside the existing scope of the contract, the Contractor shall promptly notify the Contracting Officer in writing. No action shall be taken by the Contractor under such direction until the Contracting Officer has issued a modification to the contract; or until the issue has otherwise been resolved.

Contract Officer (CO): Joseph P. Pianese, Joseph.Pianese@hq.dhs.gov Contract Specialist (CS): Robert Marosz; Robert.Marosz@hq.dhs.gov Contracting Officer’s Representative (COR): Michael Santillo, Michael.Santillo@st.dhs.gov.

G.2.0 CONTRACTING OFFICER’S (CO) AUTHORITY

A warranted Contracting Officer is the only person authorized to issue modifications to the contract, approve changes in any of the requirements, or obligate funds. Notwithstanding any clause/provision contained elsewhere in this contract, the authority to modify the contract remains solely with the Contracting Officer. If the Contractor makes any contract changes at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract to cover any increases in charges that may result. The Contracting Officer has the authority to perform any and all post-award functions in administering and enforcing the contract in accordance with its terms and conditions.

G.3.0 SUBMISSION OF INVOICES

The payment address for DHS S&T payments is as follows:

Invoices should be e-mailed to: InvoiceSAT.Consolidation@ice.dhs.gov; with Cc to the COR at Michael.Santillo@st.dhs.gov and CS at Robert.Marosz@hq.dhs.gov. A submitted invoice shall include all content as required within FAR 52.212-4(g).

(End of Section G) mailto:Joseph.Pianese@hq.dhs.gov mailto:Robert.Marosz@hq.dhs.gov mailto:Michael.Santillo@st.dhs.gov mailto:InvoiceSAT.Consolidation@ice.dhs.gov mailto:Michael.Santillo@st.dhs.gov mailto:Robert.Marosz@hq.dhs.gov

SECTION H – SPECIAL CONTRACT REQUIREMENTS

H.1.0 SPECIAL CONTRACTS REQUIREMENTS FAR CLAUSES

H.2.0 SECURITY REQUIREMENTS

All work under this SOW is unclassified.

H.2.1 GENERAL

Security Instructions

The procedures outlined below shall be followed for the DHS Security Office to process background investigations and suitability determinations, as required, in a timely and efficient manner.

Carefully read the security clauses in the contract. Compliance with the security clauses in the contract is not optional.

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, requiring access to sensitive information, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through the DHS Security Office.

Prospective Contractor employees shall submit the following completed forms to the DHS Security Office. The Standard Form 85P will be completed electronically, through the Office of Personnel Management's e-QIP SYSTEM. The completed forms must be given to the DHS Security Office no less than thirty (30) days before the start date of the contract or thirty (30) days prior to entry on duty of any employees, whether a replacement, addition, sub-Contractor employee, or vendor:

• Standard Form 85Ps must be given to Public Trust Positions

• FD Form 258, 85Ps must be given to Public Trust Positions (2 copies)

• DHS Form 11000-6s must be given to Public Trust Positions no less than thirty (30) days before the start date of the contract

• DHS Form 11000-9s must be given to Public Trust Positions no less than thirty (30) days before the start date of the contract

Only complete packages will be accepted by the DHS Security Office. Specific instructions on submission of packages will be provided upon award of the contract.

DHS shall have and exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable entry on duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the employees to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment suitability authorization shall follow as a result thereof. The granting of a favorable EOD decision or a full employment suitability determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD decision or suitability determination by the Security Office. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS’ facilities shall not be subject to security suitability screening.

Contract employees awaiting an EOD decision may begin work on the contract provided they do not access sensitive Government information. Limited access to Government buildings is allowable prior to the EOD decision if the Contractor is escorted by a Government employee.

This limited access is to allow Contractors to attend briefings, non-recurring meetings and begin transition work.

The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the pass or card number, name of individual to who it was issued and the last known location and disposition of the pass or card.

When sensitive Government information is processed on Department telecommunications and automated information systems, the Contractor shall provide for the administrative control of sensitive data being processed. Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractors who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

Failure to follow these instructions may delay the completion of suitability determinations and background checks. Note that any delays in this process that are not caused by the Government do not relieve a Contractor from performing under the terms of the contract.

Your Point of Contact (POC) at the Security Office is: TBD

All services provided will be in accordance with DHS Management Directive 4300.l as implemented by DHS 4300A and/or 4300B Policies and Handbooks.

Access to DHS IT Systems is governed by DHS 4300A Sensitive Systems Policy, and DHS 4300B, DHS National Security System Handbook.

Access to Unclassified Facilities, Information Technology Resources, and Sensitive Information.

The assurance of the security of unclassified facilities, Information Technology (IT) resources, and sensitive information during the acquisition process and contract performance are essential to the DHS mission. DHS Management Directive (MD) 11042.l Safeguarding Sensitive but Unclassified (For Official Use Only) Information, describes how Contractors must handle sensitive but unclassified information. DHS MD 4300.l Information Technology Systems Security and the DHS Sensitive Systems Handbook prescribe policies and procedures on security for IT resources. Contractors shall comply with these policies and procedures, any replacement publications, or any other current or future DHS policies and procedures covering Contractors specifically for all contracts that require access to DHS facilities, IT resources or sensitive information. Contractors shall not use or redistribute any DHS information processed, stored, or transmitted by the Contractor except as specified in the contract.

H.2.2 BACKGROUND INVESTIGATIONS

Contract employees (to include applicants, temporaries, part-time and replacement employees) under the contract, needing access to sensitive information, shall undergo a position sensitivity analysis based on the duties each individual shall perform on the contract. All of the Contractors’ employees will be required to pass DHS suitability requirements. PIV cards will be required for all Contractor staff accessing DHS network or facility, but not all on this procurement. The Program Office will provide the Contractors with the proper security paperwork for obtaining the PIV cards and will ensure that all PIV cards are returned at the end of the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted.

All background investigations shall be processed through the Security Office. Prospective Contractor employees shall submit the following completed forms to the Security Office through the COR no less than 30 days before the starting date of the contract or 30 days prior to entry on duty of any employees, whether a replacement, addition, subcontractor employee, or vendor:

• Standard Form 85P, “Questionnaire for Public Trust Positions”

• FD Form 258, “Fingerprint Card” (2 copies)

• Conditional Access to Sensitive But Unclassified Information

• Non-Disclosure Agreement

• Disclosure and Authorization Pertaining to Consumer Reports

H.2.3 PURSUANT TO THE FAIR CREDIT REPORTING ACT

Required forms shall be provided by DHS at the time of award of the contract. Only complete packages shall be accepted by the Security Office. Specific instructions on submission of packages shall be provided upon award of the contract.

Be advised that unless an applicant requiring access to sensitive information has resided in the U.S. for three of the past five years, the Government may not be able to complete a satisfactory background investigation. In such cases, DHS retains the right to deem an applicant as ineligible due to insufficient background information.

The use of non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of this contract for any position that involves access to or development of any DHS IT system. DHS shall consider only U.S. Citizens and LPRs for employment on this contract. DHS shall not approve LPRs for employment on this contract in any position that requires the LPR to access or assist in the development, operation, management or maintenance of DHS IT systems. By signing this contract, the Contractor agrees to this restriction. In those instances where other non-IT requirements contained in the contract can be met by using LPRs, those requirements shall be clearly described. The security requirements for this contract include:

• Personnel security

• Information technology security

• Facility security

Standard U.S. Government security clauses will apply. All Contractor employees performing work under this contract must be U.S. Citizens.

H.2.4 EMPLOYEE IDENTIFICATION

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as a Contractor when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

H.2.5 SECURITY REQUIREMENTS FOR CONTRACTOR PERSONNEL

a. Compliance with Security Regulations.

(1) The Contractor shall comply with the security regulations in force at all Government Sites. Company-granted clearances are not valid for access to restricted areas or information. If access to these areas or information is involved, Contractor personnel must possess a government-granted clearance based on formal investigative actions. Contractor personnel may be required to fill out a form regarding involvement with alcohol or dangerous drugs, police records, relatives living abroad, and personal foreign travel as a condition for receiving a clearance.

(2) If applicable, special security provisions for access to classified information are set forth in the attached DD Form 254, Contract Security Classification Specifications.

(3) For unclassified visits, the visit request shall include the following information on each person visiting the Government Site. The request shall be on company letterhead stationery with company address/telephone number and provide the following information:

Name_________________________________________________________________ Job Title/Position________________________________________________________ Government Security Clearance, if any ______________________________________

SSN__________________________________________________________________

Date/Place of Birth______________________________________________________ Citizenship____________________________________________________________ Current Residence Address________________________________________________ Length of Visit (if known) ________________________________________________

(4) It is the Contractor's responsibility to collect and account for all personnel identification passes/badges and vehicle passes issued to his employees when no longer needed.

The Contractor must return all passes/badges to the facility security office within three (3) days of the separation of an individual from employment on this contract.

(5) It is the Contractor's responsibility to assure that his employees are aware of, and comply with, the security requirements of the facility or ship as set forth in the contract and as explained at the pre-award or post-award conference, if applicable. Noncompliance by an individual can result in denial of access to the facility or ship.

(6) The Contracting Officer's Representative (COR) appointed in this contract; a listing of persons employed on the contract indicating that they have been briefed on the facility security requirements shall be submitted to the COR within 14 days after award of the contract.

The list is in addition to that shown in paragraphs above. The list shall also include a description of all company vehicles, including road equipment and office supply trailers, to be employed on the facility, along with license numbers, if applicable. The Contractor shall promptly revise the list of any changes, and provide a copy of the updated list to the COR.

H.3.0 HOMELAND SECURITY ACQUISITION REGULATION (HSAR) PRIVACY

PROVISIONS

H.3.1 HSAR CLASS DEVIATION 15-01 – ATTACHMENT 01: SAFEGUARDING OF

SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-Contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official

Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance http://www.dhs.gov/dhs-security-and-training-requirements-contractors

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation.

Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

http://csrc.nist.gov/groups/STM/cmvp/standards.html

(1) Complete the Security Authorization process. The SA process shall proceed according to the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), or any successor publication, and the Security Authorization Process Guide including templates.

• Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following:

Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

• Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

• Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

http://www.dhs.gov/privacy-compliance

Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods:

(1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or

(2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The 90 day review process is independent of the system production date and therefore it is important that the Contractor build the review into project schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of Contractor systems from Government tools and infrastructure.

(5) Revocation of ATO. In the event of a sensitive…