70T05018Q3NOSO018_RFQ.pdf

70T05018Q3NOSO018

SECTION II – STATEMENT OF WORK

Product, Service or Outcome Needed:

The Transportation Security Administration (TSA), Office of Security Operations has the need to procure certain supplies in support of the National Emergency Resupply Program.

This delivery order is for the acquisition and delivery of the following items: Pallets of Meals, Ready-to-Eat (MREs). These MREs must be the packages that do not contain a heating element.

Scope of product, Service, or Outcome:

Vendor will provide TSA with the items listed below within ninety (90) days of the Award Date.

CLIN Item Description Quantity Unit Total Price

00001 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

LMM International Airport Terminal D Suite 4010

Carolina PR 00979

720 Case

00002 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

Daniel K. Inouye International Airport 300 Rodgers Blvd., #45

Honolulu, HI 96819-1897

768 Case

00003 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

355 Chalan Pasaheru Suite B375A

Tamuning, Guam 96913

336 Case

00004 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

Saipan International Airport 1 Fandang Airport Way

Saipan MP 96950

192 Case

00005 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

BTM Rota International Airport Sinapalo 1

Rota MP 96951

48 Case

00006 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

1 Kahului Airport Rd.

288 Case

Kahului, HI 96732

00007 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

73-5618 Maiau St., Suite A101 Kailua-Kona, HI 96740

240 Case

00008 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

4280 Rice St. Building B.

Lihue, HI 96766

144 Case

00009 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

5757 W. Century Blvd.

Suite GF-06

Los Angeles, CA 90045

96 Case

00010 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

ONT Airport 2500E Airport Dr

Ontario, CA 91761

192 Case

00011 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

SNA Airport 18601 Airport Way

Santa Ana, CA 92707

192 Case

00012 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

7677 Oakport St.

Suite 900

Oakland, CA 94621

144 Case

00013 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

202 NW Graham Rd. Bay 14 Troutdale, OR 97060

192 Case

00014 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

2522 Jesse Butler Cir. #7 Redmond, OR 97756

48 Case

00015 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

1 Copley Parkway Suite 600

Morrisville, NC 27560

48 Case

00016 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

4200 George J. Bean Parkway Suite 2120

Tampa, FL 33610

48 Case

Delivery Period:

Items to be delivered within 7 days of the Award Date. Award Date is provided on the Optional Form 347, Box 1.

00017 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

1136 NW 78th Ave Miami, FL 33126

48 Case

00018 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

200 Croften Road Bldg 9, Bay E

Kenner, LA 70063

144 Case

00019 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

16503 Air Center Blvd.

Suite B

Houston, TX 77032

384 Case

00020 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

8876 Gulf Freeway, Suite 125 Houston, TX 77017

48 Case

00021 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

Valley International Airport 3002 Heritage Way, Ste. 16

Harlingen, TX 78550

48 Case

00022 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

Corpus Christi International Airport 1000 International Dr. Ste. 101

Corpus Christi, TX 78406

48 Case

00023 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

100 International Drive Pearl, MS 39208

96 Case

00024 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

1110 Northpoint Dr.

Suite 400

Coppell, TX 75019

1440 Case

00025 Meals, Ready to Eat WITHOUT HEATING ELEMENT Deliver to:

7401 Dowden Rd Orlando, FL 32827

2160 Case

Place/Location of Performance/Delivery:

Supplies procured under this Delivery Order shall be delivered to the delivery locations CONUS and OCONUS. Specific addresses and quantities are listened in Attachment A

Requirements for Handling Sensitive, Classified, Proprietary Information

N/A

Government Furnished Resources and Information

N/A

SECTION III – CONTRACT ADMINISTRATION

TSA TERMS AND CONDITIONS

1. Type of Contract: Firm Fixed Price Delivery Order

Contract Terms and Conditions:

This order is subject to the terms and conditions of the awardee’s GSA Federal Supply

Schedule.

The following Clauses and supplemental terms and conditions are applicable.

G.4202.242.002 – SUBMISSIONS OF INVOICES (JUL 2015)

(a) Background: The Transportation Security Administration (TSA) partners with the United

States Coast Guard Finance Center for financial services in support of TSA operations, including the payment of contractor invoices. Therefore, all contractor invoices must be submitted to, and will be paid by, the U.S. Coast Guard Finance Center (FinCen).

(b) Invoice Submission Method: Invoices may be submitted via facsimile, U.S. Mail, or email. Contractors shall utilize ONLY ONE method per invoice submission. The submission information for each of the methods is as follows in order of preference:

1) Facsimile number is: 757-413-7314

The facsimile number listed above shall be used by contractors for ORIGINAL invoice submission only. If facsimile submission is utilized, contractors shall not submit hard copies of invoices via the U.S. mail. It is the responsibility of the contractor to verify that invoices are received, regardless of the method of submission used. Contractors may inquire regarding the receipt of invoices by contacting the U.S. Coast Guard Finance

Center via the methods listed in subparagraph (d) of this clause.

2) U.S. Mail:

United States Coast Guard Finance Center TSA Commercial Invoices

P.O. Box 4111 Chesapeake, VA 23327-4111

3) Email Invoices:

FIN-SMB-TSAInvoices@uscg.mil or www.fincen.uscg.mil

(c) Invoice Process: Upon receipt of contractor invoices, FinCen will electronically route invoices to the appropriate TSA Contracting Officer’s Technical Representative and/or

Contracting Officer for review and approval. Upon approval, the TSA will electronically route the invoices back to FinCen. Upon receipt of certified invoices from an Authorized

Certifying Official, FinCen will initiate payment of the invoices.

Note for discounts offered:

Discounts on invoices. If desired, the Contractor should offer discounts directly upon the invoice submitted, clearly specifying the terms of the discount. Contractors can structure discounted amounts for payment for any time period less than the usual thirty-day payment period specified under Prompt Payment requirements; however, the

Contractor should not structure terms for payment of net amounts invoiced any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

Discounts offered after invoice submission. If the Contractor should wish to offer a discount on a specific invoice after its submission for payment, the Contractor should submit a letter to the Finance Center identifying the specific invoice for which a discount is offered and specify the exact terms of the discount offered and what time period the

Government should make payment by in order to receive the discount. The Contractor should clearly indicate the contract number, invoice number and date, and the specific terms of the discount offered. Contractors should not structure terms for net amount payments any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

(d) Payment Status: Contractors may inquire on the payment status of an invoice by any of the following means:

(1) Via the internet: https://www.fincen.uscg.mil

Contacting the FinCen Customer Service Section via telephone at 1-800-564-5504 or

(757) 523-6940 (Voice Option #1). The hours of operation for the Customer Service line are 8:00 AM to 5:00 PM Eastern Time, Monday through Friday. However, the Customer

Service line has a voice-mail feature that is available 24 hours per day, 7 days per week.

(2) Via the Payment Inquiry Form: https://www.fincen.uscg.mil/secure/payment.htm

(e) Invoice Elements: Invoices will automatically be rejected if the information required in subparagraph (a)(2) of the Prompt Payment Clause, contained in this Section of the

Contract, including EFT banking information, Taxpayer Identification Number (TIN), and

DUNS number are not included in the invoice. All invoices must clearly correlate invoiced amounts to the corresponding contract line item number and funding citation.

The Contractor shall work with the Government to mutually refine the format, content and method of delivery for all invoice submissions during the performance of the

Contract.

(f) Supplemental Invoice Documentation: Contractors shall submit all supplemental invoice documentation (e.g. copies of subcontractor invoices, travel vouchers, etc.) necessary to approve an invoice along with the original invoice. The Contractor invoice must contain the information stated in the Prompt Payment Clause in order to be received and processed by FinCen. Supplemental invoice documentation required for review and approval of invoices may, at the written direction of the Contracting Officer, be submitted directly to either the Contracting Officer, or the Contracting Officer’s

Technical Representative. Note for “time-and-material” type contracts: The Contractor must submit the following statement with each invoice for labor hours invoiced under a

“time-and-materials” type contract, order, or contract line item: “The Contractor hereby certifies in accordance with paragraph (c) of FAR 52.232-7, that each labor hour has been performed by an employee (prime or subcontractor) who meets the contract’s specified requirements for the labor category invoiced.”

(g) Additional Invoice Preparation Instructions for Software Development and/or Hardware.

The Contractor shall clearly include a separate breakdown (by CLIN) for any software development activities (labor costs, subcontractor costs, etc.) in accordance with

Federal Accounting Standards Advisory Board Statement of Federal Financial Accounting

Standards Number 10 (Preliminary design costs, Development costs and post implementation costs) and cite payment terms. The contractor shall provide make and model descriptions as well as serial numbers for purchases of hardware and software

(where applicable.)

(h) Frequency of Invoice Submission. Invoices shall be submitted on a monthly basis in accordance with the schedule.

G.5200. 242.001 - CONTRACTING OFFICER’S REPRESENTATIVE (COR) AND TECHNICAL

MONITORS (JUL 2015)

Prescription: The Contracting Officer shall include this language into each TSA contract in which a COR and/or technical monitor is intended to be appointed.

1. The principle role of the COR is to support the Contracting Officer in managing the contract. This is done through furnishing technical direction within the confines of the contract, monitoring performance, ensuring requirements are met within the terms of the contract, and maintaining a strong relationship with the Contracting Officer. As a team the Contracting Officer and COR must ensure that program requirements are clearly communicated and that the agreement is performed to meet them. The principle role of the Technical Monitor (TM) is to support the COR on all work orders, tasks, deliverables and actions that require immediate attention relating to the approved scope and obligated funding of the contract action.

2. The Contracting Officer hereby designates the individual(s) named below as the

Contracting Officer's Representative(s) and Technical Monitor(s). Such designations(s) shall specify the scope and limitations of the authority so delegated:

TSA COR

NAME: William “Carson” Spence

PHONE NUMBER: 703-563-3446

EMAIL: William.Spence@tsa.dhs.gov

3. The COR(s) and TM(s) may be changed at any time by the Government without prior notice to the Contractor, but notification of the change, including the name and phone number of the successor COR, will be promptly provided to the Contractor by the

Contracting Officer in writing.

4. The responsibilities and limitations of the COR are as follows:

The COR is responsible for the technical aspects of the project and technical liaison with the Contractor. The COR is also responsible for the final inspection and acceptance of all reports and such other responsibilities as may be specified in the contract.

The COR may designate assistant COR(s) to act for him/her by naming such assistant in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

The COR will maintain communications with the Contractor and the Contracting Officer.

The COR must report any observed fraud, waste, or opportunities to improve performance of cost efficiency to the Contracting Officer.

The COR will immediately alert the Contracting Officer to any possible Contractor deficiencies or questionable practices so that corrections can be made before the problems become significant.

The COR is not authorized to make any commitments or otherwise obligate the

Government or authorize any changes which affect the contract’s price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the expressed prior authorization of the Contracting Officer.

The COR is not authorized to direct the Contractor on how to perform the work.

The COR is not authorized to issue stop-work orders. The COR may recommend the authorization by the Contracting Officer to issue a stop work order, but the Contracting Officer is the only official authorized to issue such order.

The COR is not authorized to discuss new proposed efforts or encourage the Contractor to perform additional efforts on an existing contract or order.

5. The responsibilities and limitations of the TM are as follows:

Coordinating with the COR on all work orders, task, deliverables and actions that require immediate attention relating to the approved scope and obligated funding of the contract action.

Monitoring the Contractor’s performance in relation to the technical requirements of the assigned functional area of the contract to ensure that the Contractor’s performance is strictly within the contract’s scope and obligated funding.

Ensuring that all recommended changes in any work under the contract are coordinated and submitted in writing to the COR for consideration.

Informing the COR if the Contractor is not meeting performance, cost, schedule milestones.

Performing technical reviews of the Contractor’s quotes as directed by the COR.

Performing acceptance of the Contractor’s deliverables as directed by the COR.

Reporting any threats to the health and safety of persons or potential for damage to

Government property or critical national infrastructure which may result from the Contractor’s performance or failure to perform the contract’s requirements.

G.5200.243.001 CONTRACTING OFFICER (CO) (JUL 2015)

The Contracting Officer is the only person authorized to make any changes, approve any changes in the requirements of this contract, issue orders, obligate funds and authorize the expenditure of funds, and notwithstanding any term contained elsewhere in this contract, such authority remains vested solely in the Contracting Officer. (For further information, the

Contracting Officer is a federal government employee who is specifically authorized and appointed in writing under specified agency procedures and granted the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.) In the event, the Contractor makes any changes at the direction of any person other than the

Contracting Officer, the change will be considered to have been without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

The following Primary Contracting Officer is assigned to this contract. Alternate Contracting

Officers may be assigned:

TSA Contracting Officer

NAME: Susan Mielke

PHONE NUMBER: 571-227-2430

EMAIL: susan.mielke@tsa.dhs.gov

H3052.209-79 Representation by Corporations Regarding a Felony Criminal Violation under any Federal or State Law or Unpaid Federal Tax Liability.

(a) In accordance with sections 561 and 562 of Division F, Title V of the Consolidated

Appropriations Act, 2014 (Pub. L. 113-76), none of the funds made available by that Act may be used to enter into a contract with any corporation that:

(1) Was convicted (or had an officer or agent of such corporation acting on behalf of the corporation convicted) of a felony criminal violation under any Federal or State law within the preceding 24 months, where the awarding agency is aware of the conviction, unless the agency has considered suspension or debarment of the corporation, or such officer or agency, and made a determination that this further action is not necessary to protect the interests of the Government.

(2) Has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability, where the awarding agency is aware of the unpaid tax liability, unless the agency has considered suspension or debarment of the corporation and made a determination that this further action is not necessary to protect the interests of the Government.

(b) The Quoter represents that:

(1) It is [ ] is not [ ] a corporation that was convicted (or had an officer or agent of such corporation acting on behalf of the corporation convicted) of a felony criminal violation under any Federal or State law within the preceding 24 months.

(2) It is [ ] is not [ ] a corporation that has any unpaid Federal tax liability that has been assessed, for which all judicial and administrative remedies have been exhausted or have lapsed, and that is not being paid in a timely manner pursuant to an agreement with the authority responsible for collecting the tax liability.

(c) If the Quoter represents in (b) above that it is a corporation that was convicted (or had an officer or agent of such corporation acting on behalf of the corporation convicted) of a felony criminal violation under any Federal or State law within the preceding 24 months, or that it is a corporation that has unpaid Federal tax liability that has been assessed, the Quoter shall provide all information related to the felony or tax liability within 3 business days of the Government’s request.

(End of provision)

H5200.204.001 - MAJOR BREACH OF SAFETY OR SECURITY (JUL 2015)

(a) Safety is the freedom from those conditions that can cause death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment.

Safety is essential to TSA and compliance with safety standards and practices is a material part of this contract. A major breach of safety may constitute a breach of contract that entitles the Government to exercise any of its rights and remedies applicable to material parts of this agreement, including termination for default. A major breach of safety must be related directly to the work on the agreement. A major breach of safety is an act or omission of the Contractor that consists of an accident, incident, or exposure resulting in a fatality, serious injury, or mission failure; or in damage to equipment or property equal to or greater than $1 million; or in any "willful" or "repeat" violation cited by the Occupational Safety and Health Administration (OSHA) or by a state agency operating under an OSHA approved plan.

(b) Security is the condition of safeguarding against espionage, sabotage, crime (including computer crime), or attack. A major breach of security may constitute a breach of contract that entitles the Government to exercise any of its rights and remedies applicable to material parts of this agreement, including termination for default. A major breach of security may occur on or off Government installations, but must be related directly to the work on the agreement. A major breach of security is an act or omission by the Contractor that results in compromise of classified information or sensitive security information or sensitive but unclassified information, including contractor proprietary information, illegal technology transfer, workplace violence resulting in criminal conviction, sabotage, compromise or denial of information technology services, equipment or property damage from vandalism greater than

$250,000, or theft greater than $250,000. NOTE: Breach of Security for the purposes of this definition should not be confused with breach of security in screening operations.

NOTE: Breach of Security for the purposes of this definition should not be confused with breach of security in screening operations.

(c) In the event of a major breach of safety or security, the Contractor shall report the breach to the Contracting Officer. If directed by the Contracting Officer, the Contractor shall conduct its own investigation and report the results to the Government. The

Contractor shall cooperate with the Government investigation, if conducted.

H5200.205.001 - PUBILICITY AND DISSEMINATION OF CONTRACT INFORMATION (JUL 2015)

Publicity releases or commercial advertising in connection with or referring to this contract or effort shall not be made by the Contractor unless prior written approval has been receive d from the Contracting Officer.

The Contractor shall not publish, permit to be published, or distribute for public consumption, any information, oral or written, concerning the results or conclusions made pursuant to the performance of this contract, without the prior written consent of the Contracting Officer. Two copies of any material proposed to be published or distributed shall be submitted to the

Contracting Officer.

A minimum of five full business days’ notice is required for requests made in accordance with this provision.

H5200.224.001 DISCLOSURE OF INFORMATION (JUL 2015)

Information furnished by the Contractor under this contract may be subject to disclosure under the Freedom of Information Act (FOIA). Therefore, all items that are confidential to business, or contain trade secrets, proprietary, or personally-identifiable information must be clearly marked.

Any information made available to the Contractor by the Government must be used only for the purpose of carrying out the requirements of this contract and must not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract.

In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and information and must ensure that all work performed by its Subcontractor(s) shall be under the supervision of the Contractor or the

Contractor’s employees.

H.5200.224.002 CONTROLLED UNCLASSIFIED INFORMATION DATA PRIVACY AND PROTECTION

(JUL 2015)

The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the Government ii) Government data transmitted by the contractor, and iii) Government data otherwise stored or processed by the contractor, regardless of who owns or controls the underlying systems while that data is under the contractor’s contro l. All Government data, including but not limited to Personal Identifiable Information (PII), Sensitive Security Information (SSI), and Sensitive But Unclassified (SBU), and/or Critical Infrastructure

Information (CII), shall be protected according to Department of Homeland Security information security policies and mandates.

At the expiration of the contract, the contractor shall return all Government information and IT resources provided to the contractor during the contract.

The contractor must satisfy requirements to work with and safeguard Sensitive Security Information (SSI), and Personally Identifiable Information (PII). All support personnel must understand and rigorously follow all applicable DHS Component Agency’s requirements, policies, and procedures for safeguarding SSI and PII. Contractor personnel will be required to complete online training for SSI, Informational Security and Privacy training, if required by the DHS Component Agency

The Contractor, and those operating on its behalf, shal l adhere to the requirements of the non-disclosure agreement unless authorized in writing by the Contracting Officer.

The Government will identify IT systems transmitting unclassified/SSI information that will require protection based on a risk assessment as applicable. If encryption is required, the following methods are acceptable for encrypting sensitive information:

a. Products Advanced Encryption Standard (AES) algorithms that have been validated under FIPS 140-2.

b. National Security Agency (NSA) Type 2 or Type 1 encryption.

c. Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the Department of Homeland

Security (DHS) IT Security Program Handbook (DHS Management Directive (MD) 4300A) for Sensitive Systems).

The contractor shall maintain data control according to the applicable DHS Component Agency’s security level of the data. Data separation will include the use of discretionary access control methods, VPN encryption methods, data aggregation controls, data tagging, media marking, backup actions, and data disaster planning and recovery. Contractors handling PII must comply with TSA MD 3700.4 if applicable.

Users of Government IT assets shall adhere to all system security requirements to ensure the confidentiality, integrity, availability, and non-repudiation of information under their control.

All users accessing Government IT assets are expected to actively apply the practices specified in the TSA Information Technology Security Policy (ITSP) Handbook, Chapter 3, Section 6, Privacy and Acceptable Use, or similar DHS Component Agency’s guidance or policy.

The contractor shall comply with the all data disposition requirements stated in the applicable

DHS Component Agency’s Information Security Policy. For all TSA orders the contractor shal l comply with Information Security Policy Handbook Chapter 3, Section 17 Computer Data Storage Disposition, as well as TSA Management Directive 3700.4.

(End of clause)

H.5200.224.003 SECURITY OF SYSTEMS HANDLING PERSONALLY IDENTIFIABLE

INFORMATION AND PRIVACY INCIDENT REPONSE (JUL 2015)

(a) Definitions.

“Breach” (may be used interchangeably with “Privacy Incident’) as used in this clause means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar situation where persons other than authorized users, and for other than authorized purpose, have access or potential access to Personally Identifiable Information, in usable form whether physical or electronic.

“Personally Identifiable Information (PII)” as used in this clause means any information that permits the identity of an individual to be directly or indirectly inferred, including any other information that is linked or linkable to that individual regardless of whether the individual i s a citizen of the United States, legal permanent resident, or a visitor to the United States.

Examples of PII include: name, date of birth, mailing address, telephone number, Social

Security Number (SSN), email address, zip code, account numbers, certif icate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), Internet protocol addresses, biometric identifiers (e.g., fingerprints), photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Personally Identifiable Information (Sensitive PII)” as used in this clause is a subset of

Personally Identifiable Information, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. , Complete social security numbers (SSN), alien registration numbers (A-number) and biometric identifiers (such as fingerprint, voiceprint, or iris scan) are considered Sensitive PII even if they are not coupled with additional PII. Additional examples include any groupings of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(1) Driver’s license number, passport number, or truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Financial information such as account numbers or Electronic Funds Transfer Information

(5) Medical Information

(6) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other Personally Identifiable information may be “sensitive” depending on its context, such as a list of employees with less than satisfactory performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains Personally Identifiable Information but it is not sensitive.

Sensitive PII have higher impact ratings for purposes of privacy incident handling.

(b) Systems Access. Work to be performed under this contract requires the handling of

Sensitive PII. The contractor shall provide the Government access to, and information regarding its systems, when requested by the Government, as part of its responsibility to ensure compliance with security requirements, and shall otherwise cooperate with the

Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act (FISMA) data reviews, and access by agency

Inspectors General for its reviews.

(c) Systems Security. In performing its duties related to management, operation, and/or access of systems containing Sensitive PII under this contract, the contractor, its employees and subcontractors shall comply with applicable security requirements described in DHS Sensitive System Publication 4300A or any replacement publication and rules of conduct as described in

TSA MD 3700.4¬

In addition, use of contractor-owned laptops or other media storage devices to process or store PII is prohibited under this contract until the contractor provides, and the contracting officer in coordination with CISO approves, written certification by the contractor that the following requirements are met:

(1) Laptops employ encryption using a NIST Federal Information Processing Standard (FIPS) 140-2 or successor approved product;

(2) The contractor has developed and implemented a process to ensure that security and other applications software are kept current;

(3) Mobile computing devices utilize anti-viral software and a host-based firewall mechanism;

(4) When no longer needed, all removable media and laptop hard drives shall be processed (i.e., sanitized, degaussed, or destroyed) in accordance with DHS security requirements.

(5) The contractor shall maintain an accurate inventory of devices used in the performance of this contract;

(6) Contractor employee annual training and rules of conduct/behavior shall be developed, conducted/issued, and acknowledged by employees in writing. Training and rules of conduct shall address at minimum:

(i) Authorized and official use;

(ii) Prohibition against use of personally-owned equipment to process, access, or store Sensitive PII;

(iii) Prohibition against access by unauthorized users and unauthorized use by authorized users; and

(iv) Protection of Sensitive PII;

(7) All Sensitive PII obtained under this contract shall be removed from contractor-owned information technology assets upon termination or expiration of contractor work. Removal must be accomplished in accordance with DHS Sensitive System Publication 4300A, which the contracting officer will provide upon request. Certification of data removal will be performed by the contractor’s Project Manager and written notification confirming certification will be delivered to the contracting officer within 15 days of termination/expiration of contractor work.

(d) Data Security. Contractor shall limit access to the data covered by this clause to those employees and subcontractors who require the information in order to perform their official duties under this contract. The contractor, contractor employees, and subcontractors must physically secure Sensitive PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss. When Sensitive PII is no longer needed or required to be retained under applicable Government records rete ntion policies, it must be destroyed through means that will make the Sensitive PII irretrievable.

The contractor shall only use Sensitive PII obtained under this contract for purposes of the contract, and shall not collect or use such information for any other purpose without the prior written approval of the contracting officer. At expiration or termination of this contract, the contractor shall turn over all Sensitive PII obtained under the contract that is in its possession to the Government.

(e) Breach Response. The contractor agrees that in the event of any actual or suspected breach of PII (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), it shall immediately, and in no event later than one hour of discovery, report the breach to the contracting officer, the Contracting Officer’s Representative (COR), and the TSA Director of Privacy Policy & Compliance (TSAprivacy@dhs.gov). The contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government parties.

(f) Personally Identifiable Information Notification Requirement. The contractor has in place procedures and the capability to promptly notify any individual whose Sensitive PII was, or is reasonably believed to have been, breached, as determined appropriate. The method and content of any notification by the contractor shall be coordinated with, and subject to the prior approval of the Government, based upon a risk-based analysis conducted by the Government in accordance with DHS Privacy incident Handling Guidance. Notification shall not proceed unless the Government has determined that: (1) notification is appropriate; and (2) would not impede a law enforcement investigation or jeopardize national security.

Subject to Government analysis of the breach and the terms of its instructions to the contractor regarding any resulting breach notification, a method of notif ication may include letters to affected individuals sent by first class mail, electronic means, or general public notice, as approved by the Government. At minimum, a notification should include: (1) a brief description of how the breach occurred; (2) a description of the types of personal information involved in the breach; (3) a statement as to whether the information was encrypted or protected by other means; (4) steps an individual may take to protect themselves; (5) what the agency is doing, if anything, to investigate the breach, to mitigate losses, and to protect against any further breaches; and (6) point of contact information identifying who affected individuals may contact for further information.

In the event that a PII breach occurs as a result of the violation of a term of this contract by the contractor or its employees, the contractor shall, as directed by the contracting officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected individuals for a period not to exceed 12 months from discovery of the breach. Should the Government elect to provide and/or procure notification or identity protection services in response to a breach, the contractor will be responsible for reimbursing the Government for those expenses.

(g) Pass-Through of Security Requirements to Subcontractors. The contractor agrees to incorporate the substance of this clause, its terms and requirements, in all subcontracts under this contract, and to require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the contractor.

HOMELAND SECURITY ACQUISITION REGULATION (FAR) CLAUSES

H3052.209-70 - PROHIBITION ON CONTRACTS WITH CORPORATE EXPATRIATES (JUN 2006)

(a) Prohibitions.

Section 835 of the Homeland Security Act, 6 U.S.C. 395, prohibits the Department of Homeland

Security from entering into any contract with a foreign incorporated entity which is treated as an inverted domestic corporation as defined in this clause, or with any subsidiary of such an entity. The Secretary shall waive the prohibition with respect to any specific contract if the

Secretary determines that the waiver is required in the interest of national security.

(b) Definitions. As used in this clause:

Expanded Affiliated Group means an affiliated group as defined in section 1504(a) of the

Internal Revenue Code of 1986 (without regard to section 1504(b) of such Code), except that section 1504 of such Code shall be applied by substituting ̀ more than 50 percent' for `at least

80 percent' each place it appears.

Foreign Incorporated Entity means any entity which is, or but for subsection (b) of section 835 of the Homeland Security Act, 6 U.S.C. 395, would be, treated as a foreign corporation for purposes of the Internal Revenue Code of 1986.

Inverted Domestic Corporation. A foreign incorporated entity shall be treated as an inverted domestic corporation if, pursuant to a plan (or a series of related transactions)—

(1) The entity completes the direct or indirect acquisition of substantially all of the properties held directly or indirectly by a domestic corporation or substantially all of the properties constituting a trade or business of a domestic partnership;

(2) After the acquisition at least 80 percent of the stock (by vote or value) of the entity is held —

(i) In the case of an acquisition with respect to a domestic corporation, by former shareholders of the domestic corporation by reason of holding stock in the domestic corporation; or

(ii) In the case of an acquisition with respect to a domestic partnership, by former partners of the domestic partnership by reason of holding a capital or prof its interest in the domestic partnership; and

(3) The expanded affiliated group which after the acquisition includes the entity does not have substantial business activities in the foreign country in which or under the law of which the entity is created or organized when compared to the total business activities of such expanded affiliated group.

Person, domestic, and foreign have the meanings given such terms by paragraphs

(1), (4), and (5) of section 7701(a) of the Internal Revenue Code of 1986, respectively.

(c) Special rules. The following definitions and special rules shall apply when determining whether a foreign incorporated entity should be treated as an inverted domestic corporation.

(1) Certain stock disregarded. For the purpose of treating a foreign incorporated entity as an inverted domestic corporation these shall not be taken into account in determining ownership:

(i) Stock held by members of the expanded affiliated group which includes the foreign incorporated entity; or

(ii) Stock of such entity which is sold in a public offering related to an acquisition described in section 835(b)(1) of the Homeland Security Act, 6 U.S.C. 395(b)(1).

(2) Plan deemed in certain cases. If a foreign incorporated entity acquires directly or indirectly substantially all of the properties of a domestic corporation or partnership during the 4-year period beginning on the date which is 2 years before the ownership requirements of subsection

(b)(2) are met, such actions shall be treated as pursuant to a plan.

(3) Certain transfers disregarded. The transfer of properties or liabilities (including by contribution or distribution) shall be disregarded if such transfers are part of a plan a principal purpose of which is to avoid the purposes of this section.

(d) Special rule for related partnerships. For purposes of applying section 835(b) of the

Homeland Security Act, 6 U.S.C. 395(b) to the acquisition of a domestic partnership, except as provided in regulations, all domestic partnerships which are under common control (with in the meaning of section 482 of the Internal Revenue Code of 1986) shall be treated as a partnership.

(e) Treatment of Certain Rights.

(1) Certain rights shall be treated as stocks to the extent necessary to reflect the present value of all equitable interests, incident to the transaction, as follows:

(i) warrants;

(ii) options;

(iii) contracts to acquire stock;

(iv) convertible debt instruments; and

(v) others similar interests.

(2) Rights labeled as stocks shall not be treated as stocks whenever it is deemed appropriate to do so to reflect the present value of the transaction or to disregard transactions whose recognition would defeat the purpose of Section 835.

(f) Disclosure. The quoter under this solicitation represents that [Check one]:

__ it is not a foreign incorporated entity that should be treated as an inverted domestic corporation pursuant to the criteria of (HSAR) 48 CFR 3009.108-7001 through 3009.108-7003;

__ it is a foreign incorporated entity that should be treated as an inverted domestic corporation pursuant to the criteria of (HSAR) 48 CFR 3009.108-7001 through 3009.108-7003, but it has submitted a request for waiver pursuant to 3009.108-7004, which has not been denied; or

__ it is a foreign incorporated entity that should be treated as an inverted domestic corporation pursuant to the criteria of (HSAR) 48 CFR 3009.108-7001 through 3009.108-7003, but it plans to submit a request for waiver pursuant to 3009.108-7004.

(g) A copy of the approved waiver, if a waiver has already been granted, or the waiver request, if a waiver has been applied for, shall be attached to the bid or quote.

FEDERAL ACQUSITION REGULATION (FAR) CLAUSES

FAR 52.204-1 APPROVAL OF CONTRACT (DEC 1989)

This contract is subject to the written approval of the Contracting Officer, Susan Mielke, and shall not be binding until so approved.

(End of clause)

Incorporated by Reference:

52-212-4 CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS (JAN 2017)

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS—COMMERCIAL ITEMS (JAN 2017).

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or

Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or

Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further

Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(3) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(4) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004)(Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the

Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1158787 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1146366 https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html#wp1113329 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t29t32+1665+30++%2831%29%20%20AND%20%28%2831%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_233_240.html#wp1113344 http://uscode.house.gov/

__ (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with

Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

__ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C.

3509)).

__ (3) 52.203-15, Whistleblower Protections under the American Recovery and

Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

__ (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards

(Oct 2016) (Pub. L. 109-282) (31 U.S.C. 6101 note).

__ (5) [Reserved].

__ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery

Contracts (Oct 2016) (Pub. L. 111-117, section 743 of Div. C).

__ (8) 52.209-6, Protecting the Government’s Interest When Subcontracting with

Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

__ (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility

Matters (Jul 2013) (41 U.S.C. 2313).

__ (10) [Reserved].

__ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (Nov 2011)

(15 U.S.C. 657a).

__ (ii) Alternate I (Nov 2011) of 52.219-3.

__ (12)(i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business

Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

__ (ii) Alternate I (JAN 2011) of 52.219-4.

__ (13) [Reserved]

_X_ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (Nov 2011) (15 U.S.C. 644).

__ (ii) Alternate I (Nov 2011).

__ (iii) Alternate II (Nov 2011).

__ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

__ (ii) Alternate I (Oct 1995) of 52.219-7.

__ (iii) Alternate II (Mar 2004) of 52.219-7.

__ (16) 52.219-8, Utilization of Small Business Concerns (Nov 2016) (15 U.S.C. 637(d)(2) and (3)).

__ (17)(i) 52.219-9, Small Business Subcontracting Plan (Jan 2017) (15 U.S.C. 637(d)(4)).

https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1137622 http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1141983 http://uscode.house.gov/ http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1144881 https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1141649 http://uscode.house.gov/ https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1151163 https://www.acquisition.gov/sites/default/files/current/far/html/52_200_206.html#wp1151299 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1140926 https://www.acquisition.gov/sites/default/files/current/far/html/52_207_211.html#wp1145644 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135955 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135955 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135970 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1135970 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136004 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136017 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136032 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20 https://www.acquisition.gov/sites/default/files/current/far/html/52_217_221.html#wp1136058 http://uscode.house.gov/uscode-cgi/fastweb.exe?getdoc+uscview+t13t16+492+90++%2815%29%20%20AND%20%28%2815%29%20ADJ%20USC%29%3ACITE%20%20%20%20%20%20%20%20%20

__ (ii) Alternate I (Nov 2016) of 52.219-9.

__ (iii) Alternate II (Nov 2016) of 52.219-9.

__ (iv) Alternate III (Nov 2016) of 52.219-9.

__ (v) Alternate IV (Nov 2016) of 52.219-9.

__ (18) 52.219-13, Notice of Set-Aside of Orders (Nov 2011) (15 U.S.C. 644(r)).

__ (19) 52.219-14, Limitations on Subcontracting (Jan 2017) (15 U.S.C. 637(a)(14)).

__ (20) 52.219-16, Liquidated Damages—Subcon-tracting Plan (Jan 1999) (15 U.S.C.

637(d)(4)(F)(i)).

__ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside

(Nov 2011) (15 U.S.C. 657 f).

__ (22) 52.219-28, Post Award Small Business Program…