SOL-DOC 75ACF123R00004-Attachment 1 - Overarching PWS PRLRS MA-IDIQ.docx

PERFORMANCE WORK STATEMENT (PWS)

Post Release Legal and Related Services (PRLRS)

Multiple-Award Indefinite Delivery Indefinite Quantity (MA-IDIQ Contract)

August 25, 2023

Part 1 General Information

1. General

This is a non-personal service(s) MA-IDIQ contract under which the personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees. Task orders will be for firm-fixed price (FFP) services priced by case type and/or by the estimated number of hours required to complete a task.

Supervision of Contractor Personnel.

The Government will not directly or indirectly supervise or direct Contractor employees. If the Contractor accepts the direction of any Government employee other than the CO/COR, it will not be considered contractually binding. The COR will only provide the Contractor with technical direction in accordance with the terms of the contract. Any action(s) taken by the Contractor in response to any direction given by any person acting on behalf of ACF or any Government official other than the CO or authorized COR will be at the Contractor’s risk.

1.1 Background

The Office of Refugee Resettlement (ORR) provides new populations with the opportunity to achieve their full potential in the United States. ORR programs provide people in need with critical resources to assist them in becoming integrated members of American society.

ORR’s Unaccompanied Children Program (ORR/UCP) provides temporary shelter care and child welfare-related services to unaccompanied children (UC) referred from other Federal entities. Unaccompanied children are housed in a network of shelters operated by state-licensed entities and other ORR-funded influx and care providers. Residential services begin once ORR admits an unaccompanied child for placement and primarily end when ORR releases the unaccompanied child to a suitable sponsor, when the unaccompanied child turns 18 years of age, or when disposition of the unaccompanied child’s immigration case results in the unaccompanied child receiving legal status, or if the unaccompanied child departs from the United States (including through voluntary departure).

The William Wilberforce Trafficking Victims Protection Reauthorization Act of 2008 (TVPRA of 2008), requires, “[T]he Secretary of Health and Human Services shall ensure, to the greatest extent practicable, … that all unaccompanied alien children who are or have been in the custody of the Secretary or the Secretary of Homeland Security … have counsel to represent them in legal proceedings or matters and protect them from mistreatment, exploitation, and trafficking. To the greatest extent practicable, the Secretary of Health and Human Services shall make every effort to utilize the services of pro bono counsel who agree to provide representation to such children without charge.” (TVPRA of 2008), 8 U.S.C. §1232(c)(5). This PRLRS initiative is focused on expanding legal representation for unaccompanied children who have been released from ORR and are now living with their sponsors or otherwise living in a community in the United States.

Recipients funded under the PRLRS initiative must comply with applicable state and/or federal licensing requirements, pertinent federal laws and regulations; and applicable ORR policies and procedures, including, at a minimum, the ORR UC Program Policy Guide and the Unaccompanied Children Program Field Guidance | The Administration for Children and Families (hhs.gov), both as written on the effective date of the award and as amended subsequent to the effective date. Accordingly, recipients must also implement internal policies and procedures for the prompt dissemination, training, and implementation of new or updated ORR policies, procedures, and field guidance.

1.2 Scope

The PRLRS MA-IDIQ contract shall provide analytical and professional services to establish increased capacity for legal representation for unaccompanied children post-release from ORR care and custody, who are not otherwise receiving immigration and related legal services. This contract shall also provide legal services for other populations eligible for legal services funded by the ORR, if requested by the government. The Homeland Security Act of 2002, Section 462(g)(2), defines an unaccompanied child as a child who: (1) has no lawful immigration status in the United States; (2) has not attained 18 years of age; and (3) with respect to whom (i) there is no parent or legal guardian in the United States, or (ii) no parent or legal guardian in the United States is available to provide care and physical custody. Contractor support shall expand the number of unaccompanied children who have access to legal representation, as part of ORR’s goal of ensuring all unaccompanied children have access to immigration legal services. Changes to the mission environment will likely require the parties to negotiate prices for new work and/or renegotiate prices for existing work, as underlying levels of effort increase or decrease. If this occurs, both ORR and the Contractor agree to negotiate in good faith using ACF workload estimates and Service Contract Labor Standards (SCLS) requirements as the initial basis for new pricing. Proposed price changes based on anything other than HHS workload estimates or SCLS requirements will require the requesting party to submit compelling rationale explaining the basis of its position. Moreover, any newly negotiated prices will need to be deemed fair and reasonable by the Contracting Officer (CO) prior to incorporation into the contract.

1.3 Objectives:

The Objective of this IDIQ is to provide post release legal services in support of ACF’s mission. Objectives for each task order will be provided on each IDIQ order.

1.4 General Information:

1.4.1 Quality Control Plan (QCP)

The Contractor shall develop, implement, and maintain a QCP to ensure services are performed in accordance with (IAW) this IDIQ PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor's QCP is the means by which it assures that the work provided complies with the requirements of the contract.

The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this performance work statement. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The Contractor’s Quality Control Plan shall be delivered within 30 days after date of contract award to the COR. A comprehensive written Quality Control Plan shall be submitted to the COR within five working days (Monday – Friday) when changes are made thereafter. After acceptance of the quality control plan the Contractor shall receive the CO acceptance in writing of any proposed change to his quality control system.

The Contractor’s QCP shall be submitted to the Contracting Officer (CO) and the Contracting Officer’s Representative (COR) appointed on the task order for review within ten (10) business days of task order award (Deliverable #A.001).

The Government will review and either notify the Contractor in writing of acceptance of the plan or return their comments to the Contractor within ten (10) business days. If the Government has provided comments, the Contractor shall then have three (3) business days to submit a final QCP. After receipt of the final QCP, the Contractor is required to receive CO acceptance in writing. Any proposed changes to the accepted QCP are required to be resubmitted through the Task Order COR to CO for acceptance no later than thirty (30) business days prior to the anticipated change and before implementation by the Contractor. The timeline noted above will apply for review and acceptance for proposed changes. At a minimum, the QCP must include and answer the following to be acceptable:

a. A chart showing the organizational structure and lines of authority, the names, qualifications, duties, responsibilities, and classification of each member of the Contractor's Quality Control Team.

b. How will the Contractor monitor work to ensure that performance complies with all deliverables (etc. timelines, deadlines, and goals)?

c. How will the Contractor monitor work to ensure that performance complies with all specifications and requirements of the contract, including clauses?

d. How will the Contractor inventory and track maintenance of all Government Provided Equipment/Materials?

e. How will the Contractor identify, investigate, and correct any non-conforming performance and prevent similar deficiencies in the future?

f. How will the Contractor file and save all Quality Control related documents for the life of the contract plus 5 years?

1.4.1.1 The Contractor shall inform the task order COR of issues or potential issues that might affect the performance within two (2) working hours of identifying those issues. Verbal reports shall be followed up by written reports within three (3) business days (Deliverable #A.002).

1.4.2 Quality Assurance

The Government will evaluate the Contractor’s performance under this contract in accordance with the Contractor’s Quality Control Plan and the Government’s Quality Assurance Surveillance Plan (QASP). The QASP is a Government developed and applied document used to make sure systematic quality assurance methods are used in the administration of the Performance Based Service Contract (PBSC) standards included in this PWS and contract. The intent is to ensure that the Contractor performs in accordance with the performance metrics and the Government receives the quality of services called for in the contract. The QASP details how the performance standards identified in the PWS will be measured, who will perform the measurement, the frequency of surveillance, and the acceptable defect rate(s). The QASP may be updated from time to time by the Government. (PWS Attachment 2 - Quality Assurance Surveillance Plan (QASP)).

1.4.3 Recognized Holidays

The following provides information on recognized holidays for the purpose of the PWS. If submittal of any documentation (e.g., deliverables, submittals, etc.) deadlines fall on a holiday, the closest business day prior to the holiday will apply as the deadline for submittal.

1.4.3.1 U.S. Holidays

Work shall not be performed on U.S. holidays occurring during the normal workweek unless otherwise directed by the CO or directed on the IDIQ Task Order PWS. When a U.S holiday occurs on a Saturday or a Sunday, the holiday is observed on the preceding Friday or following Monday, respectively.

In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Presidential Inauguration Day

• Any other day designated by the President’s Proclamation

It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the Contractor’s personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

When the Federal, State, Local or other Governmental entity grants excused absence to its employees, assigned Contractor personnel may also be dismissed. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and must be guided by the instructions issued by the CO or COR.

If Government personnel are unavailable due to furlough or any other reason, the Contractor must contact the CO or the COR to receive direction. It is the Government's decision as to whether the contract price/cost will be affected. Generally, the following situations apply:

· Contractor personnel who are able to continue contract performance (either on-site or at a site other than their normal workstation), must continue to work and the contract price shall not be reduced or increased.

· Contractor personnel who are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort. This may result in a reduction to the IDIQ.

US Federal Holidays

1.5 Contractor Work Plan:

RESERVED – Information will be provided on each task order, if required/applicable.

1.6 Place of Performance: PRLRS are to be conducted in all 50 states, Washington, District of Columbia, and all commonwealths and U.S. Trust Territories. The Contractor shall need to provide for various languages spoken in these areas.

1.7 Security Requirements

1.7.1 Baseline Security Requirements Applicability. The requirements herein apply whether the entire MA-IDIQ or task order or portion thereof, includes either or both of the following:

1.7.2 Safeguarding Information and Information Systems: IAW the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

1.7.2.1 Protect government information and information systems in order to ensure:

a. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this MA-IDIQ, including means for protecting personal privacy and proprietary information;

b. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

c. Availability, which means ensuring timely and reliable access to and use of information.

1.7.2.2 Provide security for any Contractor systems, and information contained therein, connected to an HHS network, or operated by the Contractor on behalf of ACF regardless of location.

1.7.2.3 Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this MA-IDIQ or to which the Contractor may otherwise have access under this MA-IDIQ.

1.7.3 Information Security Categorization. IAW FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the Information Systems to Security Categories, and based on information provided by the Information System Security Officer (ISSO), Chief Information Security Officer (CISO), or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system. The Contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The contractor shall ensure proper controls are implemented based on the categorization.

1.7.4 Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including at a minimum marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this MA-IDIQ, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected IAW NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to ACF control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished IAW NIST SP 800- 88 Revision 1, Guidelines for Media Sanitization.

1.7.5 Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive IAW OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

1.7.6 Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by ACF or collected by the contractor on behalf of ACF shall be used only for the purpose of carrying out the provisions of this MA-IDIQ contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the MA-IDIQ contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any ACF records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected IAW HHS and ACF policies. Unauthorized disclosure of information will be subject to the HHS/ACF sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each Contractor (and/or any subcontractor) employee having access to non-public government information under this agreement shall complete the ACF non-disclosure agreement. (Deliverable #A.003).

1.7.7 Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

1.7.8 Websites and Digital Services. All new and existing public-facing government websites shall comply with the 21st Century Integrated Digital Experience Act (IDEA).

1.7.9 Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal facing websites, the HTTPS is not required, but it is highly recommended.

1.7.10 Standard for Encryption.

The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI],proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and ACF-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to implementation of the solution.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the MA-IDIQ.

1.7.11 Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA). When applicable, the Contractor shall assist the ACF Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this MA-IDIQ to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the ACF SOP or designee with completing a PIA for the system or information within 30 calendar days after completion of the PTA and IAW HHS policy and M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the ACF SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

1.8 Training

1.8.1 Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this MA-IDIQ contract shall complete the applicable HHS/ACF Contractor Information Security Awareness, Privacy, and Records Management training (provided upon MA-IDIQ award) before performing any work under this MA-IDIQ. Thereafter, the employees shall complete HHS/ACF Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this MA-IDIQ. All provided training shall be compliant with HHS training policies. (Deliverable #A.004)

1.8.1.1 Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities IAW with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

1.8.2 Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this MA-IDIQ IAW HHS policy.

1.8.3 Rules of Behavior.

1.8.3.1 The Contractor (and/or any subcontractor) shall ensure that all employees performing on the MA-IDIQ contract comply with the HHS Information Technology General Rules of Behavior.

1.8.3.2 All Contractor employees performing on the MA-IDIQ task order level contract must read and adhere to the Rules of Behavior (ROB) before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the MA-IDIQ and at least annually thereafter, which may be done as part of annual ACF Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines. (Deliverable #A.004)

1.8.4 Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The Contractor (and/or any subcontractor) shall comply with ACF’s Incident Response Policy dated July 10, 2018, including any subsequent updates. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1.8.4.1 Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this MA-IDIQ contract so as to avoid a secondary sensitive information incident.

1.8.4.2 Notify affected individuals only as instructed by the CO or designated representative.

1.8.4.3 Report all suspected and confirmed information security and privacy incidents and breaches to the ACF Incident Response Team (IRT), COR, CO, ACF Standard Operating Procedure (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic as defined in ACF’s Incident Response Policy.

1.8.4.4 Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

1.8.5. Position Sensitivity Designations

Contractor employees and/or subcontractors will be subject to OPM suitability determination.

1.8.6 Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with computing and security standards including:

· Federal Information Security Management Act (FISMA) Act of 2002 as part of the E-Government Act of 2002;

· Homeland Security Presidential Directive (HSPD)-12: Policy for a Common Identification Standard for Federal Employees and Contractors;

· Office of Management and Budget (OMB) Memorandum M-05-24;

· Federal Information Processing Standards Publication (FIPS PUB) Number 201;

· FAR Subpart 4.13;

· FAR Clause 52.204-9 and

· HHS HSPD-12 policy

The Contractor shall refer to the HHS-OCIO Policy for Information Systems Security and Privacy, dated July 30, 2014. The Contractor shall become familiar with the HHS Departmental Information Security Policies, which may be found at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html.

The HHS Cybersecurity Program develops policies, procedures, and guidance to serve as a foundation for the HHS information security program. These documents implement relevant Federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The Contractor must become familiar with HHS Cybersecurity Program guidelines as presented at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html.

1.8.7 Security Requirements for Government-Owned/Contractor-Operated (GOCO) and Contractor-Owned/Contractor-Operated (COCO) Resources

1.8.7.1 Federal Policies. The Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, at a minimum, the HHS Information Security and Privacy Policy (IS2P); Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

1.8.7.3 Servers, Desktops, Laptops, and Other Computing Devices Required for Use by the Contractor:

The Contractor (and/or any subcontractor) shall ensure that all IT equipment (e.g., laptops, desktops, servers, routers, mobile devices, peripheral devices, etc.) used to process information on behalf of ACF are deployed and operated IAW approved security configurations and meet the following minimum requirements:

a. Encrypt equipment and sensitive information stored and/or processed by such equipment IAW ACF encryption standards;

b. Ensure end user devices do not store or process data outside of an IT system;

c. Maintain the latest operating system patch release and anti-virus software definitions within 14 days for critical, 30 days for high, 60 days for medium, 90 days for low from the release date of patch;

d. Validate the configuration settings after hardware and software installation, operation, maintenance, update, and patching and ensure changes in hardware and software do not alter the approved configuration settings; and

e. Automate configuration settings and configuration management IAW HHS security policies, including at a minimum:

1.9 Records Management Obligations

1.9.1 Applicability

All Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Part 2 of this PWS regardless of the medium in which the record exists.

1.9.2 Requirements

Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including at a minimum the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. Electronic information system means an information system that contains and provides access to computerized Federal records and other information. (36 CFR 1236.2)

The following types of records management controls are needed to ensure that Federal records in electronic information systems can provide adequate and proper documentation of agency business for as long as the information is needed. Agencies must incorporate controls into the electronic information system or integrate them into a recordkeeping system that is external to the information system itself. (36 CFR 1236.10)

1.9.3 Disposition: IAW 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

1.9.4 Maintenance of Records: IAW 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the MA-IDIQ and/or delivered to, or under the legal control of the Government and must be managed IAW Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

1.9.4.1 The Contractor shall not create or maintain any records containing any non-public HHS or ACF information that are not specifically tied to or authorized by the MA-IDIQ contract

1.9.4.2 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

1.9.5 Alienation or Unauthorized Destruction of Records: ACF and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of ACF or destroyed except for IAW the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report it to ACF immediately. The agency must report promptly to NARA IAW 36 CFR 1230.

1.9.6 Notification of Inadvertent or Unauthorized Disclosure of Information: The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the MA-IDIQ. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to ACF control, or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO or address prescribed in the MA-IDIQ. Destruction of records is EXPRESSLY PROHIBITED unless authorized IAW Paragraph 1.9.5.

1.9.7 Consent to Engage in Contractual Relationship with Disclosure of Information: The Contractor shall obtain the CO’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this MA-IDIQ contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this MA-IDIQ contract. The Contractor (and any sub-contractor) is required to abide by Government and HHS and ACF guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

1.9.8 Use of Government IT Equipment: The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the MA-IDIQ and IAW HHS and ACF policy.

1.9.9 Section 508 of the Rehabilitation Act of 1973:

In 1998, Congress amended the Rehabilitation Act of 1973 to require Federal agencies to make their electronic and information technology (EIT) accessible to people with disabilities. The law (29 U.S.C § 794 (d)) applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508, agencies must give disabled employees and members of the public access to information comparable to the access available to others.

The U.S. Access Board is responsible for developing Information and Communication Technology (ICT) accessibility standards to incorporate into regulations that govern Federal procurement practices. On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508, and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018.

The rule updated and reorganized the Section 508 Standards and Section 255 Guidelines in response to market trends and innovations in technology. The refresh also harmonized these requirements with other guidelines and standards both in the U.S. and abroad, including standards issued by the European Commission, and with the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG 2.0), a globally recognized voluntary consensus standard for web content and ICT.

https://www.section508.gov/manage/laws-and-policies

The Architectural and Transportation Barriers Compliance Board (Access Board issued final guidelines for accessibility, usability, and compatibility of telecommunications equipment and customer premises equipment covered by section 255 of the Telecommunications Act of 1996. Section 255 of the Communications Act, as amended by the Telecommunications Act of 1996, requires telecommunications products and services to be accessible to people with disabilities. Manufacturers must ensure that products are “designed, developed, and fabricated to be accessible to and usable by individuals with disabilities” when it is readily achievable to do so. Accessibility guidelines issued by the Board under Section 255 address the telecommunications products covered including:

1.10 Post Award Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office IAW Federal Acquisition Regulation (FAR) Subpart 42.5. The CO, task order COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the CO will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Either party may request an ad hoc meeting to discuss any situation that requires the attention of parties where it would not be appropriate to wait until the next scheduled periodic meeting.

1.11 Periodic Progress Meetings

The Contractor shall attend, participate in, and furnish input to scheduled and unscheduled meetings, conferences, and briefings that relate to the functions and services herein as required by the Government to provide effective communication and impart necessary information. The Program Manager (PM) or designated Contractor representative shall attend meetings as requested by the Government. Meeting attendees shall at times include Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. Meetings may start or end outside of regular duty hours. The Contractor shall document all meeting minutes and submit a copy to the Task Order COR, CS, and CO within five (5) business days (Deliverable #A.006). If the task order COR does not respond within three (3) business days, then the meeting minutes become final.

1.11 Contracting Officer’s Representative (COR)

Refer to Part 2 of this PWS for the definition of a COR. As determined by the CO at the task order level, a COR will be appointed and identified by letter of designation, a copy of which will be provided to the Contractor by the CO, herein referred to as the Task Order COR. No COR will be appointed to cover the entire MA-IDIQ contract. All CORs will be appointed on a per task order basis. The designation letter states the responsibilities and limitations of the task order COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The task order COR is not authorized to change any of the terms and conditions of the resulting task order. The task order COR monitors all technical aspects of the contract and assists in contract administration. The task order COR is not authorized to obligate the Government. If the work is not written in the contract, the task order COR is not authorized to request new work. The task order COR is authorized to perform the following functions:

· Assure that the Contractor performs the technical requirements of the contract,

· Perform inspections necessary in connection with contract performance,

· Maintain written and oral communications with the Contractor concerning technical aspects of the contract,

· Issue written interpretations of technical requirements, including Government drawings, designs, specifications,

· Monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies,

· Coordinate availability of Government property, and

· Coordinate site entry of Contractor personnel.

1.13 Key Personnel: RESERVED – Information will be provided on each task order, if required/applicable.

1.14 Identification of Contractor Employees

IAW FAR 37.114 “Special Acquisition Requirements”, all Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties must identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.15 Contractor Travel

The Contractor may be required to travel during the performance of a task order. Specific travel locations will be defined at the task order level. The Contractor may be authorized travel expenses at rates no higher than the substantive provisions of the Federal Travel Regulation (FTR). All travel requires task order COR approval prior to scheduled travel. All travel will be paid on a Firm Fixed Price basis, unless otherwise specified on the task order.

1.15.1 Local Travel: Travel within the local area or place of performance to attend meetings, conferences, seminars or perform work shall be considered a cost of doing business and shall not be separately reimbursed as a travel expense. Local area travel is defined as within a 100 mile radius of the primary place(s) of performance.

1.15.2 Non-Local Travel: Travel in excess of 100 miles outside the primary place(s) of performance shall be performed after receipt of an approved Travel Authorization Request (TAR). The Contractor shall generate a TAR and forward to the task order COR for approval prior to Contractor travel. Within five (5) business days of non-local travel completion, the Contractor shall submit a trip report to the Task Order COR detailing the meeting/survey/briefing activities that occurred (Deliverable #A.005). The Contractor shall also submit a copy of the completed travel payment request, to the task order COR for approval prior to invoicing. The travel payment request shall be submitted within 30 calendar days of completed travel.

1.16 Other Direct Costs (ODCs):

RESERVED - Information will be provided on each task order, if required/applicable.

1.17 Data Rights:

The Government has unlimited rights to all documents and materials produced under this MA-IDIQ contract, except for those documents and materials protected by attorney client privilege. Other than data protected by attorney-client privilege, all data collected by the Contractor or provided to the Contractor in the performance of this MA-IDIQ contract are the property of the Government. The Government retains all rights to the data used and all derivative works developed by the Contractor. The Contractor agrees that during performance of the contract and for a period of six (6) years after the completion of performance of this MA-IDIQ contract, the Contractor, including all divisions thereof, and any affiliate of the Contractor, any joint venture involving the Contractor, any entity into or with which it may subsequently merge or affiliate, or any other successor or assign of the Contractor, shall not supply information or material received from this MA-IDIQ contract, to the public or to any firm participating in or having a known prospective interest in the subject matter areas for which the sensitive information such as the name or mission of the government agency/department that provided the data was initially submitted.

The right does not abrogate any other Government rights under the applicable Data Rights clause(s).

1.18 Phase In/Phase Out Period:

RESERVED - Information will be provided on each task order, if required/applicable.

1.19 Government Property and Services

If applicable to a task order issued under this MA-IDIQ contract, refer to Part 3 of this PWS for Government Property (GP). For all issued GP under this MA-IDIQ contract, it will be annotated at the task order level with the appropriate information provided in the task order PWS and corresponding clauses, the Contractor shall submit a Property Management Plan to the CO and the task order COR via Property Administrator within thirty (30) business days after date of Task Order Award (Deliverable #A.013). Requirements of the plan shall be annotated on the Task Order PWS.

1.20 Mission/Emergency Essentials

If applicable to a task order issued under this MA-IDIQ contract some tasks may be mission/emergency essential. Contractor personnel performing mission/emergency essential tasks will be considered mission/emergency essential personnel. Mission/emergency essential tasks will be determined at the task order level.

1.21 Contractor Monthly Report

The Contractor shall submit Contractor monthly Reports for each Task Order (Deliverable #A.006). At a minimum this report shall cover funding, invoices, disbursements (invoice payments received by the Contractor), staffing levels, staffing challenges, open Nonconformance Reports (NCRs), and the status of any open concerns that need to be addressed by the Contractor, the Government, or both.

1.22 Ordering

Only a warranted CO is authorized to issue task orders against this contract; however, the COR will assign specific cases or items for Contractor performance up to the order amount. Any unliquidated order amount at the end of the task order performance period will be deobligated by the Government.

The Government intends to maintain a relatively equal allocation of workload between Contractors performing this requirement, but makes no guarantees as to the amount of work that any individual Contractor will receive apart from those expressly stated within each contract. The number of cases assigned to Contractors will fluctuate. Cases will first be assigned to the ORR staff based upon the workload capacity, requirements, and circumstances. Remaining cases will be assigned to the Contractors based on considerations that may include, but are not necessarily limited to, the following: workload balancing, minimum contractual guarantee, case prices, available Contractor capacity, Contractor performance, and job location.

1.23 Waivers

The Contractor shall inform the CO as soon as possible if it is apparent or suspected that it will be unable to adhere to the terms of the contract. In the event that circumstances outside the Contractor’s control inhibit or prohibit satisfactory contract performance, the Contractor may submit a formal written waiver request for the CO’s consideration. Each request must include sufficient supporting detail including, at a minimum the following:

· The section of the contract for which the waiver is requested;

·…