CSS_STR006_Special_Terms_and_Conditions.pdf

CSS Attachment 2 – Special Terms and Conditions

70T05019R9NSTR006

CLM GPS RAILCAR TRACKING REPORTING SUPPORT SERVICES

Special Terms & Conditions – FAR, HSAR, & TSA Clauses

The following FAR clauses and provisions are incorporated by reference:

52.204-7 System for Award Management (Oct 2018) 52.243-1 Changes-Fixed Price (Aug 1987)

The full text of FAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html.

52.217-8 OPTIO N TO EXTEND SERVICES (NO V 1999)

The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days.

(End of clause)

52.217-9 Option to Extend the Term of the Contract (Mar 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within __30__ before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months.

3052.204-70 SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (JUN 2006)

(a) The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

(b) The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

(1) Within_30 days after contract award, the contractor shall submit for approval its IT Security Plan, which shall be consistent with and further detail the approach contained in the offeror's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

(2) The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

(3) The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

(c) Examples of tasks that require security provisions include--

(1) Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the contractor’s copy be corrupted; and

(2) Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

(d) At the expiration of the contract, the contractor shall return all sensitive DHS information and IT resources provided to the contractor during the contract, and certify that all non-public DHS information has been purged from any contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

(e) Within 6 months after contract award, the contractor shall submit written proof of IT Security accreditation to DHS for approval by the DHS Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 2.1, July 26, 2004) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

3052.204-71 CONTRACTOR EMPLOYEE ACCESS (SEP 2012)

(a) Sensitive Information, as used in this clause, means any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability.

Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting

Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All Contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized access to sensitive information, the Contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

Contract Administration Data

G.5200. 242.001 CONTRACTING OFFICER’S REPRESENTATIVE (COR) AND

TECHNICAL MONITORS (JUL 2015)

The principle role of the COR is to support the Contracting Officer in managing the contract. This is done through furnishing technical direction within the confines of the contract, monitoring performance, ensuring requirements are met within the terms of the contract, and maintaining a strong relationship with the Contracting Officer. As a team the Contracting Officer and COR must ensure that program requirements are clearly communicated and that the agreement is performed to meet them. The principle role of the Technical Monitor (TM) is to support the COR on all work orders, tasks, deliverables and actions that require immediate attention relating to the approved scope and obligated funding of the contract action.

The Contracting Officer hereby designates the individual(s) named below as the Contracting Officer's Representative(s) and Technical Monitor(s). Such designations(s) shall specify the scope and limitations of the authority so delegated.

TSA CORs: To be provided at time of award

NAME:

PHONE NUMBER:

EMAIL:

The COR(s) and TM(s) may be changed at any time by the Government without prior notice to the Contractor, but notification of the change, including the name and phone number of the successor COR, will be promptly provided to the Contractor by the Contracting Officer in writing.

The responsibilities and limitations of the COR are as follows:

• The COR is responsible for the technical aspects of the project and technical liaison with the

Contractor. The COR is also responsible for the final inspection and acceptance of all reports and such other responsibilities as may be specified in the contract.

• The COR may designate assistant COR(s) to act for him/her by naming such assistant in writing and transmitting a copy of such designation through the Contracting Officer to the Contractor.

• The COR will maintain communications with the Contractor and the Contracting Officer. The COR must report any observed fraud, waste, or opportunities to improve performance of cost efficiency to the Contracting Officer.

• The COR will immediately alert the Contracting Officer to any possible Contractor deficiencies or questionable practices so that corrections can be made before the problems become significant.

• The COR is not authorized to make any commitments or otherwise obligate the Government or authorize any changes which affect the contract’s price, terms or conditions. Any Contractor request for changes shall be referred to the Contracting Officer directly or through the COR. No such changes shall be made without the expressed prior authorization of the Contracting Officer.

• The COR is not authorized to direct the Contractor on how to perform the work.

• The COR is not authorized to issue stop-work orders. The COR may recommend the authorization by the Contracting Officer to issue a stop work order, but the Contracting Officer is the only official authorized to issue such order.

• The COR is not authorized to discuss new proposed efforts or encourage the Contractor to perform additional efforts on an existing contract or order.

The responsibilities and limitations of the TM are as follows:

• Coordinating with the COR on all work orders, task, deliverables and actions that require immediate attention relating to the approved scope and obligated funding of the contract action.

• Monitoring the Contractor’s performance in relation to the technical requirements of the assigned functional area of the contract to ensure that the Contractor’s performance is strictly within the contract’s scope and obligated funding.

• Ensuring that all recommended changes in any work under the contract are coordinated and submitted in writing to the COR for consideration.

• Informing the COR if the Contractor is not meeting performance, cost, schedule milestones.

• Performing technical reviews of the Contractor’s proposals as directed by the COR.

• Performing acceptance of the Contractor’s deliverables as directed by the COR.

• Reporting any threats to the health and safety of persons or potential for damage to Government property or critical national infrastructure which may result from the Contractor’s performance or failure to perform the contract’s requirements.

(End of term)

G.5200.242.003 SUBMISSION OF INVOICES (JUL 2015)

Background: The Transportation Security Administration (TSA) partners with the United States Coast Guard Finance Center for financial services in support of TSA operations, including the payment of contractor invoices. Therefore, all contractor invoices must be submitted to, and will be paid by, the U.S.

Coast Guard Finance Center (FinCen).

A. Invoice Submission Method: Invoices may be submitted via facsimile, U.S. Mail, or email.

Contractors shall utilize ONLY ONE method per invoice submission. The submission information for each of the methods is as follows in order of preference:

1. Facsimile number is: 757-413-7314

The facsimile number listed above shall be used by contractors for ORIGINAL invoice submission only. If facsimile submission is utilized, contractors shall not submit hard copies of invoices via the U.S.

mail. It is the responsibility of the contractor to verify that invoices are received, regardless of the method of submission used. Contractors may inquire regarding the receipt of invoices by contacting the U.S. Coast Guard Finance Center via the methods listed in subparagraph (d) of this term.

2. Address to mail invoices:

United States Coast Guard Finance Center TSA Commercial Invoices P.O. Box 4111 Chesapeake, VA 23327-4111

3. Email Address: FIN-SMB-TSAInvoices@uscg.mil or www.fincen.uscg.mil

B. Invoice Process: Upon receipt of contractor invoices, FinCen will electronically route invoices to the appropriate TSA Contracting Officer’s Representative and/or Contracting Officer for review and approval. Upon approval, the TSA will electronically route the invoices back to FinCen. Upon receipt of certified invoices from an Authorized Certifying Official, FinCen will initiate payment of the invoices.

C. Discounts on invoices. If desired, the Contractor should offer discounts directly upon the invoice submitted, clearly specifying the terms of the discount. Contractors can structure discounted amounts for payment for any time period less than the usual thirty day payment period specified under Prompt Payment requirements; however, the Contractor should not structure terms for payment of net amounts invoiced any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

Discounts offered after invoice submission. If the Contractor should wish to offer a discount on a specific invoice after its submission for payment, the Contractor should submit a letter to the Finance Center identifying the specific invoice for which a discount is offered and specify the exact terms of the discount offered and what time period the Government should make payment by in order to receive the discount. The Contractor should clearly indicate the contract number, invoice number and date, and the specific terms of the discount offered. Contractors should not structure terms for net amount payments any sooner than the standard period required under FAR Subpart 32.9 regarding prompt payments for the specified deliverables under contract.

D. Payment Status: Contractors may inquire on the payment status of an invoice by any of the following means:

mailto:FIN-SMB-TSAInvoices@uscg.mil

1. Via the internet: https://www.fincen.uscg.mil Contacting the FinCen Customer Service Section via telephone at 1-800-564-5504 or (757) 523-6940 (Voice Option #1). The hours of operation for the Customer Service line are 8:00 AM to 5:00 PM Eastern Time, Monday through Friday. However, the Customer Service line has a voice-mail feature that is available 24 hours per day, 7 days per week.

2. Via the Payment Inquiry Form: https://www.fincen.uscg.mil/secure/payment.htm

E. Invoice Elements: Invoices will automatically be rejected if the information required in subparagraph

(a)(2) of the Prompt Payment Clause, contained in this Section of the Contract, including EFT banking information, Taxpayer Identification Number (TIN), and DUNS number are not included in the invoice.

All invoices must clearly correlate invoiced amounts to the corresponding contract line item number and funding citation. The Contractor shall work with the Government to mutually refine the format, content and method of delivery for all invoice submissions during the performance of the Contract.

F. Supplemental Invoice Documentation: Contractors shall submit all supplemental invoice documentation (e.g. copies of subcontractor invoices, travel vouchers, etc.) necessary to approve an invoice along with the original invoice. The Contractor invoice must contain the information stated in the Prompt Payment Clause in order to be received and processed by FinCen. Supplemental invoice documentation required for review and approval of invoices may, at the written direction of the Contracting Officer, be submitted directly to either the Contracting Officer, or the Contracting Officer’s Representative. Note for “time-and-material” type contracts: The Contractor must submit the following statement with each invoice for labor hours invoiced under a “time-and-materials” type contract, order, or contract line item: “The Contractor hereby certifies in accordance with paragraph (c) of FAR 52.232-7, that each labor hour has been performed by an employee (prime or subcontractor) who meets the contract’s specified requirements for the labor category invoiced.”

G. Additional Invoice Preparation Instructions for Software Development and/or Hardware. The

Contractor shall clearly include a separate breakdown (by CLIN) for any software development activities (labor costs, subcontractor costs, etc.) in accordance with Federal Accounting Standards Advisory Board Statement of Federal Financial Accounting Standards Number 10 (Preliminary design costs, Development costs and post implementation costs) and cite payment terms. The contractor shall provide make and model descriptions as well as serial numbers for purchases of hardware and software (where applicable.)

H. Frequency of Invoice Submission. Invoices shall be submitted on a monthly basis in accordance with the schedule.

G. 5200.243.001 CONTRACTING OFFICER (CO) (JUL 2015)

The Contracting Officer is the only person authorized to make any changes, approve any changes in the requirements of this contract, issue orders, obligate funds and authorize the expenditure of funds, and notwithstanding any term contained elsewhere in this contract, such authority remains vested solely in the Contracting Officer. (For further information, the Contracting Officer is a federal government employee who is specifically authorized and appointed in writing under specified agency procedures and granted the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.) In the event, the Contractor makes any changes at the direction of any person other than the

Contracting Officer, the change will be considered to have been without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof.

The following Primary Contracting Officer is assigned to this contract. Alternate Contracting Officers may be assigned:

TSA Contracting Officer:

NAME: Guy Galloway

PHONE NUMBER: 571-227-3727

EMAIL: Guy.Galloway@tsa.dhs.gov

(End of term)

H.5200.204.002 CONTRACTOR PERSONNEL ACCESS TO TSA FACILITIES, INFORMATION

AND/OR SYSTEMS (SEP 2018)

A. All Contractor personnel requiring access to TSA facilities, information systems, and/or information will be subject to the security procedures set forth in this contract.

B. All contractor employees seeking to provide services to TSA under a TSA contract are subject to a fitness determination to assess whether their initial employment or continued employment on a TSA contract protects or promotes the efficiency of the agency. TSA, by and through the Law Enforcement/Federal Air Marshall Service’s, Personnel Security Section (PerSec), will allow a contractor employee to commence work on a TSA contract only if a review of the contractor employee’s preliminary background check is favorable. Contractor employees with unfavorable preliminary background checks will not be allowed to work on a TSA contract.

C. A fitness determination involves the following three phases:

1. Phase 1: Enter On Duty Fitness Determination: a review of a contractor employee’s consumer credit report, criminal history records, and submitted security forms to determine, to the extent possible, if the contractor employee has bad debt and/or criminal offenses and/or falsification issues that would prohibit employment as a TSA contractor. This determination may include verification of citizenship for contractor employees born outside of the United States. A favorable Enter On Duty Suitability Determination is not a final fitness determination; rather, it is a preliminary review of external data sources that allows the contractor employee to commence work prior to the required background investigation being completed.

When a contractor employee is deemed eligible to commence work on a TSA contract, TSA PerSec will notify the appropriate Contracting Officer’s Representative (COR) of the favorable determination. Similar notifications will be sent when a contractor employee has not passed the preliminary background check and has been deemed unsuitable.

2. Phase 2: Background Investigation: Once the contractor employee commences work on a TSA contract, TSA PerSec will process all submitted security forms to determine whether the contractor has previously been the subject of a federal background investigation sufficient in scope to meet TSA minimum investigative requirements. Contractor employees who have a federal investigation sufficient in scope will immediately be processed for final fitness adjudication. Those contractor employees who do not have a previous federal background investigation sufficient in scope will be scheduled for the appropriate level background investigation through the submission of their security forms to the Office of Personnel Management (OPM).

3. Phase 3: Final Fitness Adjudication: TSA PerSec will complete the final fitness determination after receipt, review, and adjudication of the completed OPM background investigation. The final fitness determination is an assessment made by TSA PerSec to determine whether there is reasonable expectation that the continued employment of the TSA contractor will or will not protect or promote the efficiency of the agency. An unfavorable final fitness determination will result in a notification to the COR that the contractor employee has been deemed unfit for continued contract employment and that he/she shall be removed from the TSA contract.

D. The period of performance may begin 60 days after contract award to allow for the Enter On Duty

Fitness Determination. A contract modification shall be executed to revise the period of performance once the determination process is completed. For Fixed price awards, in the event of staggered completed determinations the parties may negotiate fixed monthly rates so that performance can begin with partial staff.

E. Whenever personal identity verification (PIV ) cards are required for issuance or re-issuance to contractor personnel for authorized access to Government facilities, under the guidance of the Contracting Officer’s Representative (COR), the Contractor is responsible for making all arrangements for affected Contractor personnel to report in-person at the nearest Government issuing facility to initiate and complete procedures for PIV card issuance. The Government will not be able to provide PIV card issuance at any other locations than those officially designated as available. PIV card issuing facilities that are available for the completion of this requirement for TSA contractors are as listed by the TSA Personnel Security Section, and the COR will advise the Contractor about Government PIV card issuing facility locations that are nearby the contractor’s location(s) of performance that will be potentially available for card issuance when required.

If the contractor will require access to Government Information Systems, include following paragraphs:

F. Computer Access Agreement. All Contractor employees (users, managers, and operators of the TSA network) must sign TSA Form 1403, Computer Access Agreement. A copy of which shall be provided to the TSA contracting officer’s representative for retention for the duration of the contract.

G. Personnel Security.

1. Privileged access users are individuals who have access to an information technology (IT) system with privileges of Administrator or above and have access to sensitive network infrastructure data.

Privileged access users will be appropriately screened on entry into the privileged access position and the initial screening shall be refreshed every two years,

2. Individuals terminating voluntarily or involuntarily from a Contractor performing under contract at

TSA must have an exit briefing, conducted by a supervisory or management-level employee of the Contractor in order to identify and explain their post-employment responsibilities to the TSA.

3. Records of exit interviews will be signed and maintained by the Contractor as part of the individual employment record for a period of not less than two years following the termination of the individual’s employment.

4. The Contractor shall notify the Contracting Officer's Representative and the Contracting Officer with proposed personnel changes. Written confirmation is required. This includes, but is not limited to, name changes, resignations, terminations, and reassignments to another contract.

5. The Contractor shall notify the TSA, in writing of any requested change in access requirements for its employees no later than one day after any personnel changes occur. This includes name changes, resignations, terminations, and transfers to other company engagements. The Contractor shall provide the following information to TSA: full name, social security number, effective date, and reason for change.

6. The Contracting Officer must approve all personnel replacements. Estimated completion of the necessary background investigation for employee access to government facilities and information systems is approximately 30 days from the date the completed forms are received (and acknowledged as complete) in the Security Programs Division.

Failure of any Contractor personnel to pass a background investigation, without timely substitution that meets the contracts requirements, may be grounds for termination of the contract.

H. Non-Disclosure Agreements.

1. All TSA contractor employees and consultants must execute a DHS Form 11000-6, Sensitive But Unclassified Information Non-Disclosure Agreement (NDA) upon initial assignment to TSA and before being provided access to TSA “sensitive and/or mission critical information.” The original NDA will be provided to the TSA contracting officer’s representative for retention for the duration of the contract.

2. The Contractor, and those operating on its behalf, shall adhere to the requirements of the non-disclosure agreement unless otherwise authorized in writing by the Contracting Officer.

I. Performance Requirements.

1. The Contractor shall not be liable for any injury to Government personnel or damage to Government property arising from the use of equipment maintained by the Contractor, unless such injury or damage is due to the fault or negligence of the Contractor.

2. Contracting Officer’s Representative (COR) and IT Security Division shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

H.5200.204.004 REQUIREMENTS FOR HANDLING SENSITIVE SECURITY INFORMATION

(SSI) (SEP 2018)

Pursuant to 49 U.S.C. § 114(r), Sensitive Security Information and Nondisclosure of Security Activities, Sensitive Security Information (SSI) is a category of sensitive but unclassified (SBU) information that must be protected because it is information that, if publicly released, would be detrimental to the security of transportation. Under 49 Code of Federal Regulations Part 1520.5(a), the SSI Regulation also provides additional reasons for protecting information as SSI beyond the condition that the release of the information would be detrimental to the security of transportation. TSA, however, primarily uses the criterion of “detrimental to the security of transportation” when determining whether information is SSI.

Title 49 of the Code of Federal Regulations, Part 1520 defines the scope, categorization, handling requirements and disposition of information deemed SSI is the 49 C.F.R. Part 1520

(http://ecfr.gpoaccess.gov/). Persons authorized to access specific SSI (i.e., covered persons) include those contracted to DHS or TSA with a need-to-know basis for specific information in the course of fulfilling their TSA contractual obligations. TSA may deliver SSI materials to the Contractor. Also, materials created by the Contractor may require SSI designation and protection, and the Contractor has the responsibility to identify such materials to TSA as possible SSI. For guidance while working on TSA and DHS matters, see the TSA SSI Application Guide, 2011_04_01 for identifying the type of information covered by the regulation.

For purposes of this term, the term “Contractor” shall include an individual or other legal entity who performs work for or on behalf of TSA or DHS under a contract, interagency agreement, or other transaction agreement. Such contracts include, but are not limited to, contracts between any non-Federal entity and/or TSA or DHS and subcontracts, joint venture agreements, and teaming agreements between any non-Federal entity and another non-Federal entity to perform work related to the primary contract with the TSA or DHS.

While SSI is not classified national security information subject to the handling requirements governing classified information, it is subject to certain legal disclosure limitations. To ensure regulatory compliance, the Contractor shall be subject to the following requirements and include this entire term as flow-down in subcontracts, etc.:

A. Handling and Safeguarding. The TSA Contractor shall safeguard and handle any SSI in accordance with the policies and procedures outlined in 49 C.F.R. Part 1520, as well as the DHS and TSA policies and procedures for handling and safeguarding SSI. These safeguarding procedures shall include SSI recognition, identification and marking of materials that possibly contain SSI, including Contractor-created materials, as well as following restrictions on disclosure, storage, handling, sharing, dissemination and destruction of SSI. The Contractor, without exception, shall place this requirement in all subcontracts, joint venture agreements, and teaming agreements related to the performance of this contract.

B. Non-Disclosure Agreements (NDAs). (DHS Form 11000-6, NDAs are required to be signed by all

Contractor personnel when access to SSI is necessary for performance of the contract. By signing the NDA, the recipient certifies in writing that they will take the necessary steps to prevent the unauthorized disclosure and use of information.

C. Request for Access to SSI materials. Pursuant to 49 C.F.R. Part 1520.9(a)(3), the Contractor must contact SSI@tsa.dhs.gov for guidance on handling requests to access to SSI (before using SSI materials) for any other purpose besides activities falling within the scope of the contract by other persons, including requests from experts, consultants, and legal counsel (“requesters”) hired by the Contractor. The Contractor shall include the Contracting Officer (CO) and Contracting Officer Representative (COR) as a carbon copy “cc” recipient of its contact to SSI@tsa.dhs.gov . The TSA SSI Office must first make a determination as to whether the requesters are a “covered person” with a “need to know” under 49 C.F.R. Parts 1520.7 and 1520.11. Special request processing and handling requirements apply to contractor employees who may be foreign nationals. The Contractor must clearly identify any employees who are not US citizens who are otherwise requested to have access to SSI; the requirements of TSA Management Directive 2810.3”Management of Foreign Access to Sensitive Information” apply.

D. Training and Certification. All Contractor personnel who are covered persons with a need-to- know basis must complete the TSA-mandated SSI Awareness Training course prior to accessing SSI, and on an annual basis for the duration of the contract or for the duration of the requester’s need for access to http://ecfr.gpoaccess.gov/ mailto:SSI@tsa.dhs.gov mailto:SSI@tsa.dhs.gov

SSI, whichever is later. Contractor personnel must also review and adhere to the SSI Quick Reference Guide for DHS Employees and Contractors. The Contractor shall certify to the Contracting Officer annually that all covered persons have completed the mandated SSI training, that all SSI policies and procedures have been followed, and that those individuals with access understand their responsibilities to protect the information.

E. Breach. In accordance with 49 C.F.R. Part 1520.9(c), the Contractor agrees that in the event of any actual or suspected breach of SSI (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the Contractor shall immediately, and in no event later than one hour of discovery, report the breach to the Contracting Officer and the COR. The Contractor is responsible for positively verifying that notification is received and acknowledged by at least one of the foregoing Government officials.

In the event that an SSI breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, without delay correct or mitigate the violation.

For unauthorized disclosure of SSI, the Contractor and Contractor's employees and Contractor’s covered persons may also be subject to civil penalties and other consequences as set forth in 49 CFR Part 1520.17.

H.5200.204.005 NON-FEDERAL ACCESS TO TSA NATIONAL CAPITAL REGION

FACILITIES (SEP 2016)

A. Background. Department of Homeland Security (DHS) Visitor Access Policy mandates that visitors, to include all parties such as proposed subcontractors, accessing DHS National Capital Region (NCR) Component Headquarters and related Headquarters NCR facilities be subject to a criminal history check. To that end, in July 2016, TSA began requiring the submission of Personally Identifiable Information (PII) for all non-federal visitors and foreign national visitors entering TSA facilities in the National Capital Region, including TSA Headquarters, the Freedom Center, Annapolis Junction, Walker Lane, and the Transportation Security Integration Facility (TSIF), in order to process the required screening checks. Of note, for contracts requiring access to TSA facilities, information systems, or sensitive but unclassified information as part of contract performance, contractor employees are subject to a suitability determination. (See H.5200.204.002, CONTRACTOR PERSONNEL

ACCESS TO TSA FACILITIES, INFORMATION AND/OR SYSTEMS).

B. Purpose: The submitted information will be used to conduct screening checks to permit and maintain records of access to DHS NCR facilities pursuant to the authority of 40 U.S.C. § 1315; 41 C.F.R. Part 102-81; Executive Order. 9397.

C. Applicability: A Non-Federal Visitor or Foreign National Visitor is an individual who has not been issued a DHS Personal Identity Verification (PIV) card or is not a current Federal government employee. Non-TSA current Federal government employees will be recorded in the Visitor Request Form excluding any PII.

D. Routine Uses: The information requested may be shared externally as a "routine use" to the Department of Justice, Federal Bureau of Investigation and other government agencies as part of the screening process. A complete list of the routine uses can be found in the system of records notice, "Department of Homeland Security/ALL-024 Facility and Perimeter Access Control and Visitor Management System of Records."

https://ishare.tsa.dhs.gov/Offices/LawEnforcementFAMS/SecuritySvcAssessments/SSIBranch/Quick%20Reference%20Guides/SSI%20Quick%20Reference%20Guide%20for%20DHS%20Employees%20and%20Contractors.pdf https://ishare.tsa.dhs.gov/Offices/LawEnforcementFAMS/SecuritySvcAssessments/SSIBranch/Quick%20Reference%20Guides/SSI%20Quick%20Reference%20Guide%20for%20DHS%20Employees%20and%20Contractors.pdf https://www.gpo.gov/fdsys/pkg/FR-2010-02-03/html/2010-2206.htm https://www.gpo.gov/fdsys/pkg/FR-2010-02-03/html/2010-2206.htm https://www.gpo.gov/fdsys/pkg/FR-2010-02-03/html/2010-2206.htm

E. Consequences of Failure to Provide Information: Providing this information, including Social Security

Number (SSN), is voluntary. However, failure to provide the information requested may result in being denied access to a DHS facility; failure to provide the SSN may prevent completion of screening.

F. Information Requirements. In accordance with the above:

1. Non-Federal Visitors. Non-Federal visitors to TSA facilities will need to provide Date of Birth and Social Security Number information. The required information shall be provided in a password protected Microsoft Excel spreadsheet emailed to the Contracting Officer at least one (1) full business day prior to the visit date. (For further information, the Contracting Officer is a federal government employee who is specifically authorized and appointed in writing under specified agency procedures and granted the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.) The Contracting Officer may delegate the receipt of this information to the respective Contracting Officer Representative (COR). In order to ensure protection of this information, the password for the password protected spreadsheet shall be sent to the Contracting Officer (or delegated COR) in a separate email, at the same time. If multiple non-federal visitors from one company require access to TSA Headquarters facilities, that company should submit a single complete spreadsheet. A DHS/TSA employee shall be responsible for both inputting the information into the Visitor Request Form and actual escorting the visitor(s) at all times. The submitted emails shall then be deleted by TSA.

2. Foreign National Visitors. Foreign Nationals visiting TSA facilities in the U.S. and its territories will need to submit additional information to screening purposes, specifically:

• Date of Birth

• Gender

• Country of Citizenship

• Country of Birth

• Passport Number and Expiration Date

• Position/Title

The required information shall be provided in a password protected Microsoft Excel spreadsheet emailed to the Contracting Officer at least seven (7) full business days prior to the visit date. The Contracting Officer may delegate the receipt of this information to the respective Contracting Officer Representative (COR). In order to ensure protection of this information, the password for the password protected spreadsheet shall be sent to the Contracting Officer (or delegated COR) in a separate email, at the same time. If multiple Foreign National visitors from one company require access to TSA Headquarters facilities, that company should submit a single complete spreadsheet. A DHS/TSA employee shall be responsible for both inputting the information into the Visitor Request Form and actual escorting the visitor(s) at all times. The submitted emails shall then be deleted by TSA.

H.5200.204.006 PERFORMANCE BY FOREIGN NATIONAL CONTRACTOR EMPLOYEES

(JUL 2018)

Special request processing and handling requirements apply to contractor employees who may be foreign nationals. The Contractor must clearly identify any employees who are not US citizens who are otherwise requested to have access to SSI; the requirements of TSA Management Directive 2810.3”Management of Foreign Access to Sensitive Information” apply. Notwithstanding the requirements in HSAR 3052.204- 71, Contractor Employee Access, contractors who propose to have contract work performed by contractor employees who are not United States Citizens or Lawful Permanent Residents and who will have access to sensitive by unclassified information in performance of their job shall be required to submit biographical information (e.g. name, date of birth, passport information, etc.) for vetting purposes.

The required vetting must occur both prior to the start of the contract, and annually thereafter. As such, the contractor must submit the necessary biographical information no later than ninety (90) days prior the start of the contract and prior to the end of the contract’s annual performance period. In the event such Contractor employees are no longer utilized for performance under the contract, the Contractor shall notify the Contracting Officer and Contracting Officer Representative (COR) by xx day and begin the replacement of personnel and vetting. The re-vetting of all said current personnel shall remain on the above annual schedule. Please note that this requirement under this contract’s Key Personnel clause(s) for any non-United States Citizens or Lawful Permanent Residents that are deemed key personnel remain in effect.

This annual vetting process requirement does not and will not affect the Government’s separate and unilateral discretion on whether to exercise the contract’s option(s) to extend the contract nor the Contracting Officer’s discretion on whether to issue a notification to exercise the contract’s option period.

The administrative requirement for contractor submission of vetting information (along with any vetting clearance results) will have no relationship as to whether the Contracting Officer issues a notice of intent to exercise an option and the Government’s discretion to exercise the option.

The required information shall be provided in a password protected Microsoft Excel spreadsheet emailed to the Contracting Officer. The Contracting Officer may delegate the receipt of this information to the respective COR. In order to ensure protection of this information, the password for the password protected spreadsheet shall be sent to the Contracting Officer (or delegated COR) in a separate email, at the same time. If multiple Foreign National employees from one company require vetting, that company must submit a single complete spreadsheet. All password protected submissions shall be protected by the Government and destroyed upon conclusion of the annual vetting exercise.

The Contracting Officer and/or COR will notify the contractor of the conclusion of the vetting process.

H.5200.205.001 PUBLICITY AND DISSEMINATION OF CONTRACT INFORMATION

(OCTOBER 2017)

The Contractor shall not publish, permit to be published, or distribute for public consumption, any information, oral or written, concerning the results or conclusions made pursuant to the award and/or performance of this contract without the prior written consent of the Contracting Officer. The Contractor shall submit any request for public release at least ten (10) business days in advance of the planned release.

Under no circumstances shall the Contractor release any requested submittal prior to TSA approval.

Any material proposed to be published or distributed shall be submitted via email to the Contracting Officer. The Contracting Officer will follow the procedures in Management Directives 1700.3 and 1700.4.

The Administrator retains the authority to deny publication authorization. Any conditions on the approval for release will be clearly described. Notice of disapproval will be accompanied by an explanation of the basis or bases for disapproval.

H 5200.237.004 CONTRACTOR RESPONSIBILITY, CONDUCT AND PERFORMANCE UNDER

TSA SERVICE CONTRACTS (JUNE 2019)

A. BASIC REQUIRED STANDARDS OF CONDUCT RELATED TO BUSINESS UNDER

GOVERNMENT CONTRACTS

1. General. The Government has the basic inherent expectations of timely, focused, effective, and competent performance by the Contractor under a contract. The Contractor has the basic inherent expectation of fair treatment under the contract, where the Contractor’s employees, when in Government facilities or in circumstances where the Government has primary control or responsibility, have the expectation of performance in a safe and non-hostile work environment.

2. Adherence to Standards. The Contractor shall adhere to the same professional and ethical standards of conduct required of Government personnel. See TSA Management Directive (MD) 1100.73-5, Employee Responsibilities and Code of Conduct. Contractor employees performing work under this contract shall not:

-Solicit new business (on-site at government spaces, or while on work during periods paid by Government) while performing work under the contract;

-Conduct business other than that which is covered by this contract during periods paid by the Government;

-Conduct business not directly related to this contract while on Government premises;

-Use Government computer systems or networks, Government property or materials, and/or Government facilities for company or personal business;

-Recruit while on Government premises or otherwise act to disrupt official Government business while on Government premises.

-Discuss with unauthorized persons any information obtained during the performance of work under this contract.- -Engage in harassment . See TSA MD 1100-73.3 Anti-Harassment Program .

3. Reporting Matters.

Illegal, and Unethical, or Inappropriate Conduct. The Contractor, and its employees shall immediately report to the Contracting Officer and/or Contracting Officer’s Representative, any illegal, or unethical, or inappropriate conduct observed, noticed, or discovered while on Government premises or during periods paid by the Government under this contract, without regard as to the source of such conduct (except that any matter involving only contractor employees, apart from any Government requirements or the specific requirements of this contract, is deemed to be strictly the concern of the Contractor). The Contractor shall immediately report to the Government all actual or suspected violations of Government information, personnel, or physical security requirements. The Contractor shall fully comply with all of the reporting requirements that are expressed for specified circumstances and issues identified in discrete Federal Acquisition Regulation or Homeland Security Acquisition Regulation terms in force under this contract.

4. Emergency Situations While on Government Premises. Contractor employees shall immediately report any emergency situations they may witness (any circumstance where actual or potential loss of life, serious injury, or critical damage to property, or other serious incidents, such as fires, or workplace violence, terrorist activities, or other criminal behavior is occurring) per standing TSA procedures while they are performing under contract in government facilities.

5. Government Employee Misconduct. In the event of misconduct by a government employee which is observed or witnessed by a Contractor employee, (or in the event of any unauthorized conduct to which a Government employee may subject a Contractor employee) the Contractor employee shall immediately report such to their on-site Contractor supervisor or other company-designated management official, the Contracting Officer and/or Contracting Officer’s Representative.

6. Workplace safety. In the event of any situation involving workplace safety, the Contractor employee shall immediately report such to their on-site Contractor supervisor or other company-designated management official, the Contracting Officer and/or Contracting Officer’s Representative.

7. The Contracting Officer may require dismissal from work under this contract and/or removal of access to government facilities, property, information and/or information systems those employees whose conduct the Contracting Officer deems contrary to the public interest or inconsistent with the best interest of national security.

8. Non-Disclosure Agreements are required to be signed by all Contractor personnel when their role requires them to come into contact with Sensitive but Unclassified, Government procurement sensitive information, and/or other sensitive information, or proprietary business information from other Contractors (e.g.,…