75P00120R00015_BASE_ACF OHSEPR Disaster Human Services Case Management.pdf

75P00120R00015_BASE_ACF OHSEPR Disaster Human Services Case Management

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

Disaster Human Services Case Management (DHSCM) program services in accordance with Section 426 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (Public Law 93-288. The scope of work for this contract includes deployment of disaster case managers and resource coordinators to disaster-impacted areas to 1. Assess disaster-caused unmet needs of individuals and families (Intake); 2. Provide disaster survivors with a single point of contact to facilitate access to a broad range of resources (Information and Referrals), and 3. Develop Recovery Plans for disaster survivors

B.2 TYPE OF CONTRACT

The contract type awarded is Indefinite Delivery Indefinite Quantity (IDIQ).

B.3 TYPE OF ORDERS (NC IDIQ)

Task or delivery orders issued under this IDIQ contract shall be: cost reimbursement.

B.4 MINIMUM AND MAXIMUM QUANTITIES (IDIQ)

During the contract period, the Government shall place orders totaling a minimum of $1,000.00.

This reflects the contract minimum for the entire period of performance, including any options.

The contract maximum for the entire period of performance, including any options, shall be for the placement of orders totaling a maximum of $99,000,000.00.

B.5 CONTRACT PRICING (NC IDIQ)

The price for each task order will be based on the negotiated prices listed below and estimated level of effort, to be determined at the time of task order award.

The Contractor will be reimbursed in accordance with pricing section of each task order for satisfactory performance of the work.

Fee – The Contractor shall not exceed the following ceiling rates:

Fixed Fee Ceiling for Prime Contractor (%)___ Fixed Fee Ceiling applied by Prime Contractor on Subcontracts (%)___

While ceiling rates are established, a fixed fee will be negotiated at the task order level.

Indirect Rates - Pursuant to the General Provisions of this contract, and FAR Clause 52.216-7, Allowable Cost and Payment, the following provisional and ceiling rates are established:

Type Provisional** Ceiling* Base Fringe Overhead G&A

*In addition, it is hereby agreed that the above ceiling rates are to be used for the life of the contract.

**For Contractors that have an approved Negotiated Indirect Cost Rate Agreement: The Contractor shall use the organization's current negotiated provisional indirect cost rates for billing purposes unless lower ceiling rates have been negotiated and established under the contract.

For Contractors that do not have a Negotiated Indirect Cost Rate Agreement: The Contractor shall submit an indirect cost rate proposal to their cognizant Federal agency within 90 days of contract award for the review and negotiation of provisional rates. The indirect cost rate proposal shall be submitted to the Contractor's cognizant Federal agency. If HHS is the cognizant Federal agency, the office responsible for the negotiation of indirect cost rates for HHS profit-making contractors is: Director, Division of Financial Advisory Services, Office of Acquisition Management and Policy, National Institutes of Health, 6100 Building, Room 6B05, 6100 Executive Blvd MSC-7540, Bethesda, MD 20892-7540. The cognizant Federal office responsible for the negotiation of indirect cost rates for nonprofit organizations where HHS has cognizance is: Program Support Center (PSC), Division of Cost Allocation (DCA). The PSC DCA is comprised of four field offices and a DCA Director's office. The contractor's specific DCA location is based on the location of the contractor. For example, if the contractor is located in Maryland, Virginia or DC, the Mid- Atlantic Field Office of the DCA located in Bethesda, Maryland would be the cognizant office. (Refer to the DHHS, PSC FMS website at https://rates/psc.gov, and click on Contact Information and Office Locations, for the specific office location to determine the office responsible for a specific contractor. A DCA point of contact for questions is Korina Bryant and she can be reached on 301-443-5625.

The Contractor shall submit its final indirect cost rate proposal to its cognizant Federal agency within 180 days of the completion of each Contractor fiscal year for the review and negotiation of final indirect cost rates. A proposal shall be submitted for each year the contractor has Government contracts. In the event the rates determined by the cognizant negotiated indirect cost official on the basis of actual allowable costs are less than the provisional and ceiling rates agreed to herein, then the lower rates as established by such cognizant official shall apply.

Notwithstanding the foregoing, the Contractor shall, in the case of an adjustment of the provisional rates, comply with the requirements of FAR 52.232-20 - Limitation of Cost.

In the case the Option is exercised, task orders whose period of performance extends beyond the base contract period of five years and the option period of five years, the Contractor shall use the rates in Option Period One through Option Period Four as adjusted by the Employment Cost Index from the Bureau of Labor Statistics. http:llwww.bls.gov1news.release/eci.t04.htm ·

B.6 READINESS

The Contractor shall provide Readiness for the life of the IDIQ contract. Responsibilities include but are not limited to: Project Management, Training, Reports, and Project Briefings, which are not disaster specific. All disaster specific costs shall be billed under each individual task order.

Responsibilities for Readiness are identified in the Statement of Work, Section C.2. Readiness costs not covered under the Readiness Task Order that are directly related to specific projects must be charged to individual task orders.

Readiness costs will be awarded by a Cost Plus Fixed Fee Task Order (the Readiness award Task

Order shall cover the minimum guarantee upon the base year award). Any applicable Readiness tasks (e.g., reporting, briefing, and quality control) that the Government requires past the contract expiration date will be directly charged to the specific task orders that remain open after formal contract expiration.

B.7 Contract Line Items

CLIN 1 – Readiness/Deployment Base Year: 12 Month POP This is a cost plus fixed fee term form line item. Task orders will be awarded under this CLIN as necessary.

Orders will be funded at the task order level. See section G.9 for ordering procedures

CLIN 2 – Readiness/Deployment Option Period One: 12 Month POP This is a cost plus fixed fee term form line item. Task orders will be awarded under this CLIN as necessary.

Orders will be funded at the task order level. See section G.9 for ordering procedures

CLIN 3 – Readiness/Deployment Option Period Two: 12 Month POP This is a cost plus fixed fee term form line item. Task orders will be awarded under this CLIN as necessary.

Orders will be funded at the task order level. See section G.9 for ordering procedures

CLIN 4 – Readiness/Deployment Option Period Three: 12 Month POP This is a cost plus fixed fee term form line item. Task orders will be awarded under this CLIN as necessary.

Orders will be funded at the task order level. See section G.9 for ordering procedures

CLIN5 – Readiness/Deployment Option Period Four: 12 Month POP This is a cost plus fixed fee term form line item. Task orders will be awarded under this CLIN as necessary.

Orders will be funded at the task order level. See section G.9 for ordering procedures

SECTION C - Description/Specifications/Statement of Work ACF OHSEPR Disaster Human Services Case Management

C.1 PROGRAM DESCRIPTION AND BACKGROUND

Purpose

The objective of this IDIQ contract is to ensure that the Administration for Children and Families’ (ACF) Office of Human Services Emergency Preparedness and Response (OHSEPR) is able to provide disaster human services connecting disaster survivors to available resources supporting their disaster-caused unmet needs.

Background

ACF OHSEPR operates the Disaster Human Services Case Management (DHSCM) program authorized through ACF appropriations within Children and Families Services.

After disasters, DHSCM case management services are provided through a partnership between the Federal Emergency Management Agency (FEMA) and ACF OHSEPR. In accordance with Section 426 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (Public Law 93-288; as amended through P.L. 115-254 enacted October 5, 2018) which authorizes the President to “provide case management services, including financial assistance, to state or local government agencies or qualified private organizations to provide such services, to victims of major disasters to identify and address unmet needs.”

When the President declares a major disaster under the Stafford Act, which includes FEMA’s Individual Assistance program, the declared state, tribe, or territory may request case management services. States, tribes, and territories have the option of applying to FEMA for:

1. DHSCM, commonly referred to as the federal Immediate Disaster Case Management program, which is funded by FEMA and mission assigned to ACF OHSEPR to deploy case managers to the disaster declared jurisdictions to provide time-limited case management services to survivors.

2. Disaster Case Management (DCM) grant, federal funding made available to the impacted state, territory, or tribal government to implement a DCM program by utilizing DCM providers to provide services to survivors with long-term disaster-caused unmet needs.

When FEMA approves a state, tribe, or territorial request for DHSCM, FEMA issues a Mission Assignment Task Order (MATO) to ACF OHSEPR to provide disaster case management services in the declared jurisdictions. ACF OHSEPR then activates its DHSCM program and deploys DHSCM case manager contractors who:

Assess disaster-caused unmet needs of individuals and families (Intake);

Provide disaster survivors with a single point of contact to facilitate access to a broad range of resources (Information and Referrals); and Develop recovery plans for disaster survivors

Additionally, when FEMA issues a Mission Assignment Task Order (MATO) to ACF OHSEPR to provide disaster case management services, ACF OHSEPR deploys DHSCM resource coordinators who:

Coordinate with federal, state, local and non-governmental partners to identify resource providers to whom case managers can refer disaster survivors for unmet needs.

Work throughout the duration of the MATO to develop and maintain an updated list of available resources to ensure that disaster survivors are referred to active resources.

While deployed, DHSCM case managers, DHSCM resource coordinators, supervisory and support staff may operate out of fixed and/or mobile locations.

In order to engage disaster survivors directly, DHSCM case managers may work in disaster recovery centers, community centers, or other facilities identified by ACF OHSEPR, FEMA, and/or the local jurisdiction. DHSCM case managers also conduct outreach and may engage disaster survivors in non-congregate sheltering settings (e.g., mobile home parks), hotels, community events, and other venues as identified by ACF OHSEPR, FEMA, and/or the local jurisdiction.

DHSCM case managers input intake assessments in ACF OHSEPR’s case management records system which is used to generate aggregate reports of disaster survivor demographics and referral requests by type, as well as track disaster survivors’ progress to recovery.

At the completion of a DHSCM mission assignment, ACF OHSEPR transfers accumulated DHSCM data to FEMA and the human services department of the impacted state, tribe, or territory to facilitate the implementation of the state-, tribe-, or territory- managed disaster case management program.

Program Goals and Objectives

The Contractor must provide all labor, supervision, and materials to support all recruiting, screening, credentialing, and training necessary to establish and maintain a cadre of DHSCM case managers and ensure the rapid availability of scalable cadre staff to meet DHSCM requirements identified in a MATO.

At a minimum, the Contractor must have no less than ninety (90) trained DHSCM case managers available at the ready at any given time for deployment throughout the Continental United States and Outside the Continental United States when activated by ACF OHSEPR upon issuance of a readiness task order. In addition, the Contractor must be able to surge up to two hundred and seventy (270) total case managers in order to staff three possible concurrent DHSCM operations. The Contractor must deploy these screened, trained, credentialed, deployment-ready DHSCM case managers to field locations identified in the MATO within 72 hours of issuance of a task order from the contracting officer.

The contractor must provide the initial triage and DHSCM services for a specified period, generally up to 135 days or longer as specified in the task order following a program activation, allowing time for the FEMA-funded and state-, tribe-, or territory- administered Disaster Case Management grant program to be initiated. The contractor must notify the Contracting Officer immediately if they are unable to provide requested services for the MATO request.

All Contractor staff supporting DHSCM steady-state program administration and post-disaster MATO field operations must comply with requirements established in the Privacy Act of 1974, 5 U.S.C. § 552a and work to prevent and mitigate the occurrence of any privacy incidents, such as breaches, as prescribed by the applicable portions of OMB Memorandum M-17-12 “Preparing for and Responding to a Breach of Personally Identifiable Information” and OMB Circular A-130, Managing Information as a Strategic Resource. The Contractor must ensure and affirm that all staff supporting DHSCM program administration and implementation have completed privacy and security training and understand the importance of protecting personally identifiable information of disaster survivors.

Personally Identifiable Information (PII) is any information that permits the identity of an individual to be directly or indirectly inferred, including other information that is linked or linkable to an individual. PII constitutes “Controlled Unclassified Information”.

Privacy Incident refers to the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than the authorized user accesses or potentially accesses PII or

(2) An authorized user accesses or potentially accesses PII for an unauthorized purpose. The term encompasses both suspected and confirmed incidents involving PII, whether intentional or inadvertent, which raises a reasonable risk of harm.

C.2 SCOPE OF READINESS TASK ORDER PWS (Readiness)

C.2.1 DHSCM Recruiting and Screening

The Contractor must maintain and manage all phases of recruiting, screening, credentialing and training associated with the DHSCM cadre as required by the contract.

The Contractor must develop a DHSCM Recruitment Plan to be approved by ACF OHSEPR.

When new cadre personnel are added to the readiness roster, and when updates are required, the Contractor must submit the revised plan to ACF OHSEPR for approval. Once approved, the contractor must follow the ACF OHSEPR- approved DHSCM Recruitment plan. Upon request, the contractor must furnish the Curriculum Vitaes (CVs) of the Essential Contractor Staffing.

The Contractor must maintain records and report on the number of qualified, trained and ready DHSCM cadre members. The Contractor must provide required basic employment screening and other credentialing requirements as required and directed by ACF OHSEPR and in accordance with Homeland Security Presidential Directive 12 (HSPD-12): Policy for a Common Identification Standard for Federal Employees and Contractors guidelines.

SEE READINESS TASK ORDER PWS for additional requirements C.2.2 DHSCM Training

The Contractor shall provide disaster case managers with training that includes the role and responsibilities of the disaster case manager throughout the DHSCM MATO mission, intake and screening, assessment, recovery planning, resource identification and coordination, referrals and follow-up, case transfer, case closure, file retention, and reporting. The training shall also include the principles of disaster case management, Privacy Act compliance and confidentiality, an overview of a FEMA-funded DHSCM MATO, the FEMA sequence of delivery, the avoidance of duplication of benefits, and data entry of cases.

Additionally, the training shall address the importance of cultural competency; as well as the importance of inclusion and supporting individuals with disabilities and others with functional and access needs. Disaster case manager training must be conducted before the DHSCM services begins. The Contractor shall provide on- going training to ensure that all new disaster case managers receive training prior to working with disaster survivors.

SEE READINESS TASK ORDER SOW

C.2.4 DHSCM Cadre Readiness Roster Database

The Contractor must establish and maintain a cadre management database to monitor, track, report, and manage all phases of recruiting, screening, credentialing and training associated with the readiness of DHSCM cadre. The DHSCM database must be Microsoft compliant and meet ACF’s information technology policies and standards for privacy and information security requirements. ACF must have full administrative rights, intellectual property rights, access, and use of the substantive information contained within the DHSCM database.

C.2.5. Project Management

In the management of this contract, the contractor shall utilize Project Progress Management tools/techniques to track and monitor the cost and schedule of the project. The contractor shall submit the project progress management report to the CO and COR on a monthly basis.

C. 3 SCOPE OF IDIQ (DHSCM DEPLOYMENTS)

The scope of the DHSCM deployment requirements include the deployment of disaster case managers and resource coordinators to disaster-impacted areas. The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in each task order.

The Contractor must, upon CO notification, deploy DHSCM cadre within 72 hours of issuance of a unilateral task order from the CO.

C.3.2 DHSCM Demobilization

Early planning for demobilization, reconstitution, and closeout of contracted DHSCM services is an integral component of a DHSCM deployment. This section details the expectations for the demobilization and reconstitution and closeout of ACF OHSEPR deployment task orders and provides the expected timelines for required reports.

C.3.2.1 Demobilization Plan

Based on the initial demobilization strategy approved by ACF OHSEPR, the Contractor must submit a final demobilization plan to ACF OHSEPR 30 days prior to the end of the MATO performance period. The development of the plan will include input from FEMA, ACF OHSEPR, and the state, tribe, or territory to best determine the course of action to transition from ACF OHSEPR DHSCM services to the state-, tribe-, or territorial-managed DCM program.

The demobilization plan shall be reviewed and updated throughout the course of a MATO to determine an adequate level of staffing needed to maintain DHSCM services as ACF OHSEPR DHSCM program transitions to the state-, tribe-, or territory- managed DCM program.

The demobilization plan must be reviewed by ACF OHSEPR for approval. Updates to the demobilization plan shall be included in the monthly report and made readily available to ACF OHSEPR, the state, tribe, or territory, and FEMA, as needed.

C.3.2.2 Transfer of Open Disaster Survivor Cases

The demobilization plan shall include a designation for each disaster survivor case file that includes priority tier levels as defined by FEMA. Disaster survivor cases will be prioritized as urgent, priority, and routine to better assist the management agency responsible for the state-, tribe-, or territory- managed DCM program.

Prioritization of cases will enable both the DHSCM Contractor and the state-, tribe-, or territory- managed DCM program to maintain services and minimize disruptions for disaster survivors. The demobilization plan shall include a strategy to identify disaster survivor cases that will not achieve full recovery prior to the completion of the DHSCM MATO and will continue to need support for disaster-caused unmet needs.

C.3.2.3 Disaster Survivor Case Transfer/Transition Process

The contractor must participate in the transfer of disaster survivor data files as required by ACF OHSEPR. This includes transitioning disaster survivor’s records to local entities providing long-term recovery assistance and at any point in time during the DHSCM service lifecycle.

Before transitioning any survivor records the contractor must develop and provide ACF OHSEPR with a plan to protect disaster survivors’ Personally Identifiable Information

(PII1).

The case transfer process must include:

Disaster survivors will be informed at least 30 days in advance that their case will be transferred, and a complete final assessment of the unmet needs be provided

1 Personally Identifiable Information (PII). The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual.

If the survivor requests that the case be transferred to another provider, the case supervisor shall document the request and make the necessary referrals

The case file shall be photocopied or electronically transferred to the new case manager in order to reduce duplication of benefits and provide continuity of services

At a minimum, within the final 30 days of the MATO period of performance, the DHSCM cadre must make positive contact with every disaster survivor head of household and inform them that their DHSCM services file will be transferred to the state, tribe, or territory for long-term case management services.

All DHSCM records must be reviewed and signed off by a supervisor for completeness and closeout of all tasks and validated by the contractors DHSCM program manager.C4.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to the IDIQ’s Readiness task orders to monitor the quality of the Contractor’s performance for the life of the contract. The oversight provided in the QASP will help to ensure that service levels are reached and maintained to the required levels throughout the contract term.

Further, the QASP provides the IDIQ with a proactive way to avoid unacceptable or deficient performance and provides verifiable input for the required Past Performance Information Assessments. The QASP will be developed by the Government in conjunction with the performance work statement. It will be finalized upon award and a copy provided to the Contractor after task order award. The QASP shall provide the basis for performing and controlling the project’s activities in accordance with the Contract.

C5. SECTION 508 ACCESSIBILITY STANDARDS

The following Section 508 accessibility standards apply to the work to be performed:

To be completed in individual task orders, when applicable.

C.6 IT Security Requirements

Purpose

The Standard Security, Privacy and Task language is designed to provide ACF with a baseline set of requirements and task language to be used in its procurements. Specifically, procurements involving IT services or access to personally identifiable information (PII) or Federal IT systems.

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information as required to perform their work. Access is contingent upon positive adjudication of background check.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the ACF mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of ACF regardless of location.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system. The contractor shall work with the ACF security team to categorize information or information systems. The categorization can change at any time throughout the lifecycle of the system. The contractor shall ensure proper controls are implemented based on the categorization.

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to ACF control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by ACF or collected by the contractor on behalf of ACF shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any ACF records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and ACF policies. Unauthorized disclosure of information will be subject to the HHS/ACF sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Websites and Digital Services. All new and existing public-facing government websites shall comply with the Integrated Digital Experience Act (IDEA).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents, if applicable, to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and ACF-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to implementation of the solution.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the ACF non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – When applicable, the Contractor shall assist the ACF Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the ACF SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the ACF SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/ACF Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/ACF Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual ACF Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines.

D. Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The Contractor (and/or any subcontractor) shall comply with ACF’s Incident Response Policy dated July 10, 2018, including any subsequent updates.

of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident.

2) Notify affected individuals only as instructed by the Contracting Officer or designated representative.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the ACF Incident Response Team (IRT), COR, CO, ACF SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic as defined in ACF’s Incident Response Policy.

4) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within 3 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 24 hours of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

F. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

The Contractor (and/or any subcontractor) and its employees shall comply with computing and security standards including:

Federal Information Security Management Act (FISMA) as part of the e-government Act of 2002

Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

Office of Management and Budget (OMB) Memorandum (M)05-24; and

Federal Information Processing Standards Publication (FIPS PUB) Number 201, FAR Subpart 4.13 (https://acquisition.gov/sites/default/files/current/far/compiled_html/subpart_4.13.html), FAR Subpart 52.204-9 (https://www.acquisition.gov/?q=browsefar), and

HHS HSPD-12 policy

The Contractor shall refer to the HHS-OCIO Policy for Information Systems Security and Privacy, dated July 7, 2011. The Contractor shall become familiar with the HHS Departmental Information Security Policies, which may be found at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/index.html. The HHS Cybersecurity Program develops policies, procedures, and guidance to serve as a foundation for the HHS information security program. These documents implement relevant Federal laws, regulations, standards, and guidelines that provide a basis for the information security program at the Department. The Contractor must become familiar with HHS Cybersecurity Program guidelines as presented at https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/information-security-privacy-program/index.html.

G. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Solution Development Life Cycle (SDLC) processes, ACF Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the ACF SDLC framework and methodology.

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 48 hours before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or ACF policies.

6) The Contractor (and/or any subcontractor) shall perform and document the actions identified in the ACF Contractor Employee Separation Checklist when an employee terminates work under this contract within 3 days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

H. Records Management and Retention

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/ACF policies and shall not dispose of any records unless authorized by HHS/ACF.

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/ACF policies.

Records Management

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability

This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

1. includes ACF records.

2. does not include personal materials.

3. applies to records created, received, or maintained by Contractors pursuant to their ACF contract.

4. may include deliverables and documentation associated with deliverables.

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

Electronic information system means an information system that contains and provides access to computerized Federal records and other information. (36 CFR 1236.2) The following types of records management controls are needed to ensure that Federal records in electronic information systems can provide adequate and proper documentation of agency business for as long as the information is needed. Agencies must incorporate controls into the electronic information system or integrate them into a recordkeeping system that is external to the information system itself. (36 CFR 1236.10)

(a) Reliability: Controls to ensure a full and accurate representation of the transactions, activities or facts to which they attest and can be depended upon in the course of subsequent transactions or activities.

(b) Authenticity: Controls to protect against unauthorized addition, deletion, alteration, use, and concealment.

(c) Integrity: Controls, such as audit trails, to ensure records are complete and unaltered.

(d) Usability: Mechanisms to ensure records can be located, retrieved, presented, and interpreted.

(e) Content: Mechanisms to preserve the information contained within the record itself that was produced by the creator of the record.

(f) Context: Mechanisms to implement cross-references to related records that show the organizational, functional, and operational circumstances about the record, which will vary depending upon the business, legal, and regulatory requirements of the business activity.

(g) Structure: Controls to ensure the maintenance of the physical and logical format of the records and the relationships between the data elements.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation. accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

3. ACF and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of ACF or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report it to ACF immediately. The agency must report promptly to NARA in accordance with 36 CFR 1230.

4. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract.