APAT SOW_Draft RFI.docx

Statement of Work United States Secret Service Hosting, Maintenance, and Administration of the United States Secret Service Applicant Physical Abilities Testing Contents

1.0 OBJECTIVE

This Statement of Work (SOW) outlines and defines the United States Secret Service (Secret Service), Office of Human Resources, Research and Assessment Division’s (HRR) requirements for contractor support in the maintenance, hosting, administration, and scoring of physical abilities testing used for employment consideration and selection of Secret Service law enforcement personnel.

2.0 BACKGROUND

The Secret Service is one of the most elite law enforcement organizations in the world. It has earned this reputation throughout more than 150 years of unparalleled service to the nation. As one of the oldest federal law enforcement agencies in the country, the Secret Service has an integrated mission that is comprised of safeguarding the financial infrastructure of the United States and protecting national leaders (e.g., President, Vice President), visiting heads of state, and heads of government. This includes providing security for special events such as the United Nations General Assembly. Due to this integrated mission, the Secret Service must ensure that individuals selected into the Special Agent and Uniformed Division Officer positions can meet the varied physical demands of the job.

Special Agents carry out assignments to support the organization’s integrated mission of investigation and protection. In addition to protecting members of the executive branch and their families, Special Agents investigate violations of laws relating to financial crimes such as credit card and access device fraud, as well as computer-based attacks on the nation’s banking and telecommunications infrastructure. Special Agents must be available to be assigned to duty stations anywhere in the world.

The Uniformed Division’s mission is to protect facilities and venues secured for Secret Service protectees. In recent years, the Uniformed Division has grown both in size and scope of responsibility and is mandated by law to provide physical security for the White House Complex and the Vice President’s residence at the Naval Observatory. It also provides security for the Treasury Department building and foreign diplomatic missions in Washington, DC.

Based on job analysis and test validation information, a battery of physical ability tests was identified to assess the physical requirements of the Secret Service Special Agent and Uniformed Division Officer jobs. This test battery is called the Applicant Physical Abilities Test (APAT) and is designed to provide a safe and efficient method of evaluating an applicant’s strength, agility, endurance, and other physical capabilities based on the physical requirements needed upon entry into the Special Agent and Uniformed Division Officer positions. Applicants must successfully pass the APAT before proceeding to the next steps of the hiring process. The APAT consists of the following four components: Push-ups, Sit-ups, Illinois Agility Run, and a 1.5-Mile Run.

3.0 SCOPE OF WORK

Currently, Secret Service personnel administer the APAT to applicants applying for Special Agent and Uniformed Division positions using indoor and/or outdoor static facilities (e.g., schools, universities, gymnasiums, sport and health clubs, recreation centers, police academies, military bases) that are designated and approved by Secret Service. The Secret Service seeks contractor support for all aspects of APAT administration including, but not limited to, the following functions:

a. Provide testing facilities and assessment equipment at testing locations throughout the United States and Internationally.

b. Provide personnel who are certified in cardiopulmonary resuscitation (CPR) and fit for duty to administer the APAT.

· Facilities and assessment personnel must be available to conduct APAT testing during regular business hours, evenings, and weekends.

c. Maintain an automated registration and self-scheduling service for Secret Service applicants using secure individual online accounts, including the capability to send system-generated email notifications to applicants and track undelivered emails;

d. Provide Application Programming Interface (API) via Real-Time Import by registering Applicant Lifecycle Information System (ALIS) applicants provided by Secret Service for APAT.

· ALIS is a Secret Service web-based application that allows Secret Service personnel to manage information about the hiring process of applicants for employment.

e. Utilize API to transfer applicant performance and test data between the Contractor and the Secret Service.

f. Support Secret Service approved accommodations for Americans with Disabilities Act (ADA)-related disabilities in accordance with Section 508 Guidelines and provide reasonable accommodation for respective applicants provided by Secret Service.

The following testing parameters will be required for APAT administration:

Privacy:

The APAT consists of four test components: Push-ups, Sit-ups, Illinois Agility Run, and a 1.5-Mile Run. For Push-ups, Sit-ups, and the Illinois Agility Run, a dedicated space is needed where administrators can be confident that no external parties (non USSS applicants or APAT Administrators) will enter into the exercise space during the performance period. During the 1.5-mile run, it is acceptable for applicants and external parties to make simultaneous use of the performance space (e.g., a track), provided that external traffic is not anticipated to impact applicant performance.

Weather Conditions:

APAT testing may be conducted indoors or outdoors. However, testing will only be conducted outdoors when the temperature is at or above 32 degrees Fahrenheit, the heat index is at or below 85 degrees Fahrenheit, and the Air Quality Index (AQI) is at or below 150 (“orange” status).

Space and Surface Requirements:

The designated test facility must have an indoor or outdoor space that meets the requirements for each test component listed below.

• Push-Ups and Sit-Ups: A flat floor space with sufficient room for one (1) applicant to complete the exercise with two APAT Administrators (proctors) in attendance. One proctor will time and count reps, and the second proctor will hold the foam block during the push-ups segment and applicant’s feet during the sit-ups segment. As a general guideline, a minimum 8’ x 8’ floor space is recommended.

• Illinois Agility Run: A flat, non-slippery floor space with minimum dimensions of 15’ x 30’. An asphalt, concrete, or gymnasium floor (hardwood or composite) can be used. The surface should allow for changes in direction without slipping. A grass, or gravel surface is not permitted.

• 1.5-Mile Run: To complete the 1.5-mile run, applicants should run no more than eighteen (18) laps. The shortest lap distance allowable is 146.67 yards or 134.08 meters. The approved location must be a level/flat hard surface. A track, asphalt, astroturf, or concrete surface may be used. The surface should allow for changes in direction without slipping. A grass or gravel surface is not permitted.

4.0 TASKS, DELIVERABLES, AND REQUIREMENTS

4.1 Task 1: Provide and Maintain Facilities for APAT Administration

4.1.1 During the base year and subsequent option years of this contract, the Contractor shall administer the APAT at Contractor testing sites and/or alternate testing facilities approved by the Secret Service. Testing facilities and assessment equipment must be pre-approved by Secret Service prior to testing. For approval, photos of the standard testing environment must be sent to the Secret Service and should capture the space to be designated for each APAT component (push-ups, sit-ups, Illinois Agility Run, 1.5-mile run). Photos must include surface material, the marked course if not using a conventional track, and anything that can cause potential disadvantages or distractions such as presence of pedestrians (e.g., if using a public park, ensure there will be no interruptions from pedestrians’ simultaneous park use). The Contractor shall provide photos upon request by the Secret Service if an alternate testing site is used to administer the APAT.

4.1.2 The Contractor shall ensure that test administration of the APAT is reliable and that test centers have adequate personnel and proper testing equipment to administer assessments without issues. This includes ensuring sufficient test administrators to properly administer testing, proper maintenance of test equipment, and that test centers are free of unreasonable distractions to applicants. Facility equipment used for APAT administration that has been lost, broken, or is in poor condition should be repaired or replaced prior to each test session. All equipment must be replaced with equipment of the same specifications and standards that are approved by Secret Service.

4.1.3 The Contractor shall implement changes to the APAT assessments as requested by the Secret Service. Changess include, but are not limited to, changes that impact scoring algorithms, testing components, or the assessment workflow. If any significant updates are needed for the APAT, the Secret Service will provide the requirements to the Contractor. The Contractor shall work with the Secret Service to develop a plan and timeline for implementation of the updates so that there is minimal impact on applicant testing.

4.2 Task 2: Provide Automated Applicant Registration and Self-Scheduling

4.2.1 The Contractor shall provide a web-based automated registration and self-scheduling system for Secret Service applicants. This registration and self-scheduling system shall meet, but is not limited to, the following requirements:

a. Use applicant information provided by the Secret Service to create and maintain a secure user account for each applicant. The Secret Service will provide the Contractor with applicant information, including but not limited to a unique applicant identifier, email address, and zip code. Additional security requirements are included in Appendix A.

b. Provide applicants the ability to schedule their APAT assessment during their approved testing window. The system shall allow applicants to view test session appointment information including date, time, and address of APAT testing locations, as well as providing applicants with the ability to schedule, cancel, and reschedule their assessment, as needed.

c. Provide applicants the ability to request accommodations for Americans with Disabilities Act (ADA)-related disabilities in accordance with Section 508 Guidelines. All accommodation requests must be approved by the Secret Service, who will provide the Contractor with the applicant authorizations, including accommodation requirements, to allow applicants to test with reasonable accommodation in accordance with the ADA.

d. Allow the Secret Service to change or extend the testing window for a particular applicant or applicants and to reauthorize an applicant to complete a test. These determinations will be made on a case-by-case basis.

4.2.2 The Contractor shall track applicants by an individual Applicant Tracking System (ATS) number and prevent applicants who failed the APAT from re-testing within 30 days of the testing date on which they obtained a failing score. The Contractor shall notify the COR if a request was sent by Secret Service to authorize an applicant who failed the APAT to re-test within 30 days.

4.2.3 The Contractor’s scheduling system shall allow applicants to select their test location in accordance with the following:

a. The Secret Service will provide the Contractor with a applicant file that shall include applicant zip codes. The Contractor’s system shall identify static test locations located up to 180 miles driving distance of the applicant’s zip code.

b. The system shall allow applicants to enter an alternate zip code which will be used to identify test sites within 180 miles driving distance of that zip code.

4.2.4 The scheduling system shall allow the applicant to select the session date and time from among all available sessions for their APAT assessment during the testing window at the selected testing location. Test sessions must be available on multiple days and times within the testing window. The Contractor shall provide weekend or evening sessions as required.

4.2.5 The Contractor’s system shall generate and send email notifications to applicants for test-related events including, but not limited to: invitations to schedule testing, schedule confirmations and reminders, test window expiration reminders, etc. Content of the email notifications will be reviewed and approved by the Secret Service and will be updated as needed.

4.2.6 The Contractor shall generate and send email notifications to applicants notifying them of scheduled or unscheduled outages or closures of the testing center that are in excess of 3 hours in duration that occur 24 hours prior to a scheduled testing session. In the event of such closures or outages, the Contractor shall allow applicants to reschedule their testing session, at no cost to the Secret Service.

4.2.7 The Contractor shall provide 24/7 customer support for account creation or access, scheduling, rescheduling, and cancelling testing appointments, requests for accommodations, accessing score results, and any other issues or questions related to the Contractor’s scheduling, testing centers, or testing center staff.

4.2.8 The Contractor shall provide the Secret Service with access to reporting features, but not limited to the following information or capability:

a. Applicant APAT assessment information including, but not limited to: applicant scheduling and testing status, location of testing, system-generated communications including date and time stamp, and accommodation requests.

b. A listing of applicants based on, but not limited to: assigned testing window, scheduling status, and testing status.

c. Applicants by application of entry-level position (i.e., Special Agent or Uniformed Division), who request ADA accommodations, to include the status of the request and the accommodation requested.

4.2.9 In addition, the contractor shall have the capability to provide Application Programming Interface (API) via Real-Time Import for the following:

a. Retrieve data to register Applicant Lifecycle Information System (ALIS) applicants to the APAT assessment via API.

b. Send ALIS applicant post-assessment status (“No Show”, “Pass”, “Fail”, “Illness/Injury”, “Disqualification”) via API

c. Send ALIS applicant assessment scores and assessment history via API

d. Retrieve ADA and other standard test reporting updates via API

4.2.10 The Contractor shall be able to grant Secret Service personnel with various levels of administrator access to the above information and capabilities for the APAT assessment.

4.3 Task 3: Administer Proctored Assessments

4.3.1 The Secret Service has offices all over the United States as well as offices in international locations. Testing of applicants occurs in proximity to these geographically dispersed offices. Thus, the Contractor shall administer the APAT assessment at company owned or alternate testing centers in the United States and internationally. Proposals submitted in response to this SOW must include a list of all company-owned (i.e., non-franchised) and/or any alternate testing locations. Testing locations within the United States shall be provided within 180 miles driving distance of the following cities:

4.3.2 The Contractor shall be able to provide physical testing at testing centers outside the continental United States including U.S. Virgin Island and Puerto Rico, and international locations including Europe, Asia, Canada, Mexico, and Central America.

4.3.3

4.3.4 The Secret Service will have final decision regarding applicants testing at Contractor-provided test sites. The Secret Service will have the ability to determine which, if any of the Contractors testing centers to utilize or not utilize for the APAT. The Secret Service may choose to activate or deactive testing centers to accommodate testing needs.

4.3.5 The Contractor shall ensure that test administration facilities and environment are secure, distraction-free, and shall otherwise meet acceptable standards for a commercial marketplace that is conducive for physical testing.

4.3.6 The Contractor shall complete all APAT testing within the designated testing windows specified by the Secret Service, unless testing outside of the windows is approved by the Secret Service.

4.3.7 Upon completion of an initial in-person APAT Train-the-Trainer session provided by Secret Servic, the Contractor shall provide, at each testing facility, proctors to monitor the testing and administer the assessments according to the documented testing protocols. Test proctors at testing locations shall be:

a. APAT trained by the Contractor in the administration of the APAT, and CPR certified;

b. proficient in English;

c. Knowledgeable and trained in the use of the Contactor’s provided equipment and facility; and

d. be able to:

i. Ensure that the facility has the availability to host the APAT

ii. Confirm that the minimum number of required APAT Administrators meet administration requirements and are available when the following conditions are met:

· A minimum of two (2) APAT Test Administrators will be required for up to eight (8) applicants, and at least one (1) Test Administrator should be certified in CPR

iii. greet applicants as they arrive;

iv. check applicants in and out;

v. verify applicants’ identification prior to beginning the assessment;

vi. provide any test-related materials and/or required documentation to applicants (if applicable);

vii. monitor applicants throughout the testing session, and;

viii. provide applicants with assistance throughout their testing appointment such as, but not limited to, demonstration of physical assessments, resolving environmental or equipment problems, rescheduling applicants when the test center is unable to accommodate a completed test appointment, etc..

4.3.8 Upon approval by the Secret Service, the Contractor shall make appropriate accommodation for Americans with Disabilities Act (ADA)-related disabilities in accordance with Section 508 Guidelines. Requests for accommodation that extend beyond increased time limits or specified requirements to complete the assessment will be approved by the Secret Service (e.g., provisions for inhaler, water bottle, heart monitor, applicant scheduling assistance, additional testing time, etc.. .

4.4 Task 4 : Alternate Physical Testing Sites (Optional Task)

4.4 The Secret Service defines alternate physical testing sites as a testing site that the Contractor establishes for a determined period of time that is pre-approved by the Secret Service and is set up to meet specific testing demands including, but not limited to, international testing needs, large-scale testing events, alternate testing locations due to inclement weather, and testing demands in an area where no acceptable permanent testing center exists. The Contractor shall provide all resources necessary to conduct testing at an alternate testing site including, but not limited to, personnel to check-in/check-out applicants and administer testing, equipment and materials needed to administer the test. Alternate testing sites must meet the standards of commercial marketplace physical testing facilities and the standards outlined in this SOW. Alternate testing sites may be stood up at a vendor provided location, or another location (e.g., schools, gymnasiums, military bases, sport health clubs, recreation centers, etc.). The Secret Service will have final decision regarding testing logistics at alternate test administration facilities.

4.5 Task 5: Ensure Adherence to Test Administration Protocol

4.6.1 The Contractor

shall provide the Secret Service with a proctor’s manual documenting the administration protocol for each component of the APAT, including a supplement to the manual that addresses ADA accommodations (see Deliverable Table below). The administration protocol shall address check-in and check-out procedures (to include liability waivers), emergency evacuations of the site during the testing sessions, power failures and, address ADA related accommodations, and matters related to applicants who experience an injury or illness during testing. The administration protocol shall include procedures for reporting any incident or unusual occurrence during a testing session to include a plan for emergency medical support for injuries, heart attacks, heat stokes, etc. The administration protocol shall provide a way for the test administrator to administer the APAT assessment for each applicant and send applicant information to the Secret Service. The Contractor shall ensure proper administration of the APAT as approved by the Secret Service for all Secret Service applicants. The Secret Service shall not be held liable for any legal fees and/or cost associated with any form of litigation encomposing administration of the APAT administered by the Contractor.

4.5 4.5.1

4.6.2 The Contractor shall provide the Secret Service with a plan for how the Contractor shall ensure the test administration protocol is followed. This plan should also address what will occur if an administrator is not present, is late to a testing session, or if a Secret Service applicant disagrees or contest a failing APAT score result. Should an applicant contest his/her APAT score, the contractor shall provide notice and consult with the Secret Service as the resolution authority for these disputes.

4.6.3 The Contractor shall allow for Secret Service staff to conduct announced and unannounced site visits at testing centers to ensure testing locations, testing center staff, and test administration adheres to the standards outlined in this SOW and the procedures specified for each component of the APAT. In the event that site visits identify issues, the Contractor shall provide the Secret Service with a plan to address any issues identified within 5 days of notification of the issues. The plan should include a timeline for when issues identified will be addressed and metrics for tracking improvement.

4.7 Task 6: Calculate and Report Assessment Results

4.7.1 The Contractor shall provide both raw (counts/times) and scored assessment data at the component level and an overall APAT assessment score level based on the established APAT scoring criteria. The Contractor shall provide the Secret Service with test results via API that will contain, at a minimum, applicant testing session information, raw responses, scored responses, overall assessment score, and overall assessment status (i.e., Pass or Fail).

4.7.2 The Contractor’s shall have the capability to retain historical testing records for each applicant, including, but not limited to component level raw data and scores, and overall assessment scores.

4.8 Task 7: Document Activities and Provide Reports

The Contractor shall document activities and provide reports to the Secret Service as identified in the Deliverable Table in Section 5.4. Report definitions are listed below:

a. End of Month Report: A detailed report of applicant APAT activity to support the monthly invoice.

b. Scheduling Report: A daily cumulative report which summarizes scheduling APAT, for a specific testing window.

c. Testing Report: A daily cumulative report which summarizes testing activity during a specific testing window.

d. Ad hoc Incident Report: An ad hoc report which provides information on any incident (including injuries/illnesses) that has been reported by a proctor during the contract period of performance.

e. International Testing Report: A report of all APAT applicants who indicated during a scheduled testing window the need for international testing.

f. Ad hoc Retest Activity Report: An ad hoc report which provides information (including applicant failure, disqualification, inlnees/injury) on retest activity for APAT during the contract period of performance.

g. Ad hoc Americans with Disability Act (ADA) Report: An ad hoc report which provides information on APAT on applicants who have requested an ADA accommodation.

h. Ad hoc Late-Tester Report: An ad hoc report which provides APAT testing information on applicants who have been approved by the COR to take the assessment outside of a specified testing window (e.g., rescheduling).

i. Applicant Feedback Survey Results: A report of applicant responses to feedback surveys for each APAT assessment (e.g., professionalism of staff members, timeliness of test administrators, environment and/or facility cleanliness, etc.).

5.0 REQUIREMENTS AND TIMELINES

5.1 Scope of Deliverable Inspection

The data item deliverables or work products that are required under this contract shall be delivered in accordance with the schedule set forth in the contract. There is a detailed timeline provided for all reports at the end of this section. The Contractor shall provide drafts and final versions of all deliverables for review by the COR and other relevant Secret Service personnel. Deliverables shall be marked with the Secret Service award number and “For Official Use Only.” Unless designated otherwise, the Government shall review and approve or return with corrections/comments all draft deliverables and any syntax or algorithms used to create deliverables no later than fifteen (15) business days after receipt. Rejected deliverables shall be corrected and returned by the contractor within five (5) business days of return receipt from the COR, unless otherwise noted. If for any reason a deliverable cannot be delivered within the scheduled time frame, the Contractor shall notify the COR in writing with cause of delay and the proposed revised schedule. This delay notice shall include the impact of the delay on the overall project.

5.2 Basis of Deliverable Acceptance

The basis for inspection/acceptance shall be in compliance with the requirements set forth in the Statement of Work, the contractor’s proposal, and other terms and conditions of the contract. Deliverable items rejected shall be corrected in accordance with the applicable Federal Acquisition Regulation clauses. Reports, documents, and narrative-type deliverables will be accepted when all discrepancies, errors, or other deficiencies identified in writing by the Government have been corrected. If the draft deliverable is adequate, the Government may accept the draft and provide comments for incorporation into the final version.

All of the Government's comments to deliverables must either be incorporated in the succeeding version of the deliverable or the Contractor must demonstrate to the Government's satisfaction why such comments should not be incorporated.

If the Government finds that a draft or final deliverable contains spelling errors, excessive grammatical errors, improper format, or otherwise does not conform to the requirements stated within this contract, the document may be immediately rejected without further review and returned to the Contractor for correction and resubmission. If the Contractor requires additional Government guidance to produce an acceptable draft, the Contractor shall arrange a meeting with the COR.

The Contractor shall provide applicant and assessment data in a format compatible with Microsoft Excel 2010 or a later format.

5.3 Deliverable Submission

All tests, test-related materials, data, syntax, and algorithms used, collected, or created during the performance of the tasks within this statement of work shall be the sole property of the Secret Service.

The Contractor must complete all electronic data transfers using a Application Programming Interface (API) process. This requirement applies to both data provided to Secret Service as well as data provided from the Secret Service. All Contractor-provided data must be made available via a secure API process. This data shall be accessible via API that return data in an agreed-upon format.

5.4 Deliverable Timeframes

Base Year and Option Years (1-4)

The Contractor shall include in their proposal options for volume-based pricing of applicant testing fees. Pricing proposals should include at least one option with per-applicant test fees and at least one option for a firm fixed price for applicant test fees according to projected testing volume. Proposals incuding per-applicant test fees shall restrict applicant no-show fees to no more than 50% of any per applicant test fees. Proposals including a firm fixed price for applicant testing shall not include separate applicant no-show fees. For firm fixed price proposals the Contractor acknowledges that the projected testing volumes are estimates and actual testing numbers may be lower or higher than projected within a period of performance and the agreed upon price shall be firm with no adjustments if the actual testing volume exceeds the projected testing volume. In the event that the Secret Service exceeds or is likely to exceed the projected number of applicants within a given period of performance the Contractor shall work with the Secret Service to develop a plan to continue testing.

6.0 MEETINGS, CONFERENCES, AND REVIEWS

Meetings shall be held regularly as required to ensure effective program management and efficient and effective resolution of problems throughout the life of the contract. The types and frequencies of these meetings shall include, at a minimum, those described in the following subparagraphs. At least ten (10) working days before any meeting, unless otherwise stated, the hosting office shall notify the other offices of the time, date, and location of the meeting. The Contractor shall provide these items (Agendas for Meetings, Conferences and Reviews; Minutes, as required) under applicable Contract Line Item Numbers.

6.1 Post Award Conference

At the Government’s discretion, a Post Award Conference may be held, at a facility designated by the Government, approximately fifteen (15) calendar days after contract award. This conference is anticipated to be approximately one hour in duration. The location will be in the Washington, DC metropolitan area.

6.2 In-Progress Review (IPR) Meetings

At the direction and discretion of the COR, the Contractor shall conduct IPR meetings not less frequently than every 90 days. They may be conducted at the Contractor’s facility, at a Government facility, a subcontractor’s facility, or virtually as appropriate for the major topics of discussion. The Contracting Officer may require more frequent IPRs if the Contracting Officer believes there are technical problems, schedule risks, or issues that require Government attention. The purpose of the IPR is for the Contractor to present a detailed contract status, discuss and track action items and proposed solutions, review potential and actual technical and programmatic problem areas, evaluate performance relative to milestones set forth in any master program plan or schedule, and provide a forum for highlighting activity planned for the next period. Hard copies of presentation materials shall be made available at the IPR for all participants. The contractor shall publish the agenda 24 hours prior to the IPR. The contractor shall prepare and distribute the minutes within 3 business days of each IPR. The minutes shall include a narrative summation of each issue discussed at the IPR, a list of attendees, list of action items, and a schedule of planned activities.

6.3 Project Status Meetings

At the direction and discretion of the COR, the Contractor shall conduct regular project status meetings as required to ensure effective program management and efficient and effective resolution of problems throughout the life of the contract. The meetings may be conducted via tele-conference, web-conference, or in-person at the contractor’s facility, at a Government facility, or a subcontractor’s facility, as appropriate for the major topics of discussion. The contractor shall publish the agenda 24 hours prior to the status meeting. The contractor shall prepare and distribute the minutes within 3 business days of each status meeting.

7 PLACE OF PERFORMANCE

It is anticipated that contract work will be conducted at the Contractor’s facility, or at an alternate testing site pre-approved by Secret Service. The Contractor shall be available for consultation during Secret Service’s normal operating hours of 9:00 AM to 5:30 PM Monday through Friday, excluding Federal holidays. The Secret Service will provide access to applicable existing documentation, procedures, guides and practices, and other technical documentation or information in its existing form as soon as the Contractor has been approved by Secret Service Personnel Security to receive such information.

8 PERIOD OF PERFORMANCE

The period of performance for this contract will include a base period up to 12 months, plus four (4) optional 12 month performance periods. The Government’s obligation under this contract is contingent upon the availability of appropriated funds from which payment for contract purposes can be made – FAR 52.232-18.

9 GENERAL SECURITY REQUIREMENTS

Contract work will involve access to sensitive but unclassified data. Personnel working on this project must be U.S. citizens. Documentation will be required to confirm citizenship. No special security clearances are necessary for this contract. Contractor personnel, however, shall be subject to a limited background investigation. Clearance of personnel assigned to the project is required to be in place prior to any personnel beginning work on the contract.

All contractor personnel requiring access to Secret Service facilities must complete forms:

a. Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act

b. DHS-11000-25: Contractor Fitness/Security Screens Request Form

c. SSF 3237: Contractor Personnel Access Application

d. SSF 4024: Conditional Access to Sensitive but Unclassified Information Nondisclosure Agreement

e. Contractor’s Agreement to Protect Non-Public Information

10 TECHNICAL DATA RIGHTS AND SECURITY

In accordance with FAR 52.227-17 – Rights in Data-Special Works, and other provisions related to data rights in the contract, all data compiled as a result of this project, whether electronic or written form, will be owned by and returned to the Secret Service. All tests and test-related materials will be the sole property of the Secret Service. Notwithstanding other security policies and procedures, the Contractor shall not remove, copy, or otherwise transmit any source document, notes, work products, or data from the premises without the prior written approval of the COR and the Contracting Officer. Specifically, no documentation or source code shall be removed or otherwise transmitted from Secret Service Headquarters premises. Nor shall Secret Service enterprise data be exported to another device or otherwise transmitted from the Secret Service Headquarters premises or facility.

Although no specific physical security accreditation of the Contractor’s facility is mandated in the performance of this contract, the Contractor shall make every effort to implement a strong physical security posture. To ensure integrity of the assessments, assigned contractors on this procurement shall be briefed on the proper safeguarding and storage of the software and hardware associated with the assessments. Items included are: proper automated information systems access; software tracking, storage, and markings; access control to the designated areas of development, which includes only authorized personnel assigned to this contract. When necessary, sanitize the project performance area when cleaning crews or maintenance personnel enter these areas, due to the sensitivity of the work being performed.

The Contractor shall not use Secret Service assessment data for purposes other than the explicit procedures required in this Statement of Work.

End of Statement of Work

Appendix A (Security Requirements)

SECURITY CAPABILITIES AND CHARACTERISTICS

The security model for the Contractor will be founded on OMB, National Institute of Standards and Technology (NIST), Federal Information Processing Standard (FIPS), the Privacy Act of 1974, Department of Homeland Security (DHS) Management Directive (MD) 4300A, The Sensitive Systems Handbook, which is used as the baseline for a number of Government-wide initiatives. FIPS 200, Minimum Security Requirements for Federal Information and Information Systems, is a mandatory Federal standard by NIST in response to the Federal Information Security Management Act of 2002 (FISMA) and the Federal lnformation Security Modernization Act of 2014 (FISMA). To comply with the Federal standard, the Contractor will determine the security category of the Contractor information system(s) in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems¸ and derive the information system impact level from the security category in accordance with FIPS 200. The Contractor will then apply, at a minimum, the appropriately tailored set of baseline security controls in NIST Special Publication 800-53, which in combination help ensure that appropriate security requirements and security controls are applied to all Federal information systems.

The purpose of this security model is to adequately protect U.S. Government data. If the SECRET SERVICE CIO determines that risks have not been adequately mitigated, the Contractor will not be permitted to process, store, or transmit U.S. Government data. The Contractor is responsible for providing the SECRET SERVICE Chief Information Security Officer (CISO) security documentation for this contract including, but not limited to the Security Plan (SP), Security Assessment Report (SAR), Incident Response Plan (IRP), Contingency Plan (CP), Continuity of Operations Plan (COOP), Configuration Management Plan (CMP), the Contingency Plan Test (CPT) Report, and the Continuity of Operations Test ((COOPT) Report.

The Contractor shall provide a physical and logical environment with robust logical and physical protection schemes, including information security (INFOSEC).

1. The Contractor shall provide a Contractor-owned, hosted, and operated service. As such, the data and component systems shall reside outside Government security devices. The Contractor shall follow NIST requirements for all Federal Information systems other than those systems designated a national security systems as defined in 44 U.S.C., Section 3542.9. The tasks described in this section are in alignment with the five phases (Initiation, Development/Acquisition, Implementation, Operations/Maintenance, and Disposal) outlined in NIST SP 800-37 Rev 4, Guided for Applying the Risk management Framework to Federal Information Systems: A Security Life Cycle Approach. The Contractor shall follow an issue resolution process for any identified vulnerability or issue identified throughout the Certification and Accreditation (C&A) process. Issue resolution is to be used to communicate issues to key stakeholders and to document risk-based decisions to included risk acceptance, correcting vulnerabilities, and re-testing, and creating a Plan of Action and Milestones (POA&M). Issue resolution provides an audit trail, accelerates the C&A, an documents management accountability; and

2. The Contractor’s information system(s) must be certified and accredited at least every two (2) years or whenever there is a significant change to the system’s security posture in accordance with NIST 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, and DHS MD-4300A, Sensitive Systems Handbook. (Security Categorization, Risk Assessment, and Certification and Accreditation). The Contractor shall be responsible for all costs associated with C&As.

3. Government information security guidelines do not distinguish between services and products, nor do they distinguish whether the hosting systems are Government-owned or contractor-owned. All Contractor components within the accreditation boundary that contain U.S. Government data shall be required to achieve and maintain the same level of security and protection required for Government-owned information systems.

4. The Contractor shall comply with the following Authorization Process for non-cloud based systems.

a. The Contractor shall engage a FedRAMP-approved Third Party Assessment Organizations (3PAO) to develop a security authorization package and complete an assessment. FedRAMP-approved 3PAOs perform the initial and periodic assessments of cloud systems.

b. The Contractor shall develop a System Security Plan and submit it to the SECRET SERVICE for review.

c. The 3PAO shall develop the Security Assessment Plan (SAP) and submit it to the SECRET SERVICE for review.

d. The 3PAO completes testing and submits the Security Assessment Report (SAR) to the SECRET SERVICE for review.

e. The Contractor creates the Plan of Action & Milestones (POA&M) based on the findings from testing.

f. The Contractor begins remediation of POA&M’s to be completed by documented suspense dates for each POA&M.

g. The SECRET SERVICE determines whether or not to authorize the system to operate.

5. The Contractor shall comply with the FedRAMP authorization process for cloud-based systems. The SECRET SERVICE determines whether or not to authorize the system to operate.

6. The SECRET SERVICE reserves the right to withdraw the authority to operate for the Contractor system at any time for failure to meet the terms of the Security Characteristics and Capabilities section of the contract.

MANDATORY REQUIREMENTS

The Contractor shall achieve and maintain the authority to operate for systems within the accreditation boundary.

The Contractor shall meet or exceed security standards in accordance with the following mandatory requirements for security standards in accordance with OMB, NIST, DHS, and other Federal laws and mandates within the accreditation boundary.

Within the accreditation boundary, the Contractor shall protect all aspects of data as sensitive information at the sensitive level selected during the system categorization as defined by FIPS 199, NIST SP 800-60: Guided for Mapping Types of Information and Types of Information Systems to Security Categories, and the Privacy Act. As Government laws, regulations, policies, and guidance on security changes the SECRET SERVICE COR will notify the Contractor of these requirements and assure compliance and the Contractor shall assure compliance with these changes through their service lifecycle management processes, and notify the SECRET SERVICE COR of their impact. The SECRET SERVICE will publish notice to document the Contractor’s use of PII in accordance with the Privacy Act. The Privacy Act is specifically included, though it is applicable as Federal law, as it defines personally identifiable information (PII) and is an overarching basis for much of the applicable guidance.

The protection level for the sensitivity of information shall be in accordance with Federal law, Presidential Directive, OMB mandate, and DHS policy which grants the authority to NIST Standards and Guidance, NIST Standards and Guidance, and other requirements with authority over all Federal information systems.

The Contractor shall comply with DHS policy as a supplement to the controls included in the above authorities. All of these mandates will be implemented in accordance with the requirement herein and/or the SECRET SERVICE CIO who has the responsibility to make final judgments to include revoking the Contractor’s authorization to process, store, or transmit Government data if authoritative requirements, such as future laws and guidance are not met.

1. At a minimum, the Contractor shall:

a. The Contractor shall only process, transmit, and store U.S. Government information used to support SECRET SERVICE operations within the accreditation boundary.

b. The Contractor shall apply the latest versions of all Federal laws, Federal regulations, DHS policies, NIST guidelines, and FIPS guidelines to all aspects of this contract.

c. The Contractor shall apply NIST security risk management standards or map to NIST commercially accepted security risk management standards, processes, and frameworks (e.g. ISO 27000, PCI, COBIT, SAS70 type II, /SSAE No. 16, etc.) that achieve the intended objectives of Government C&A requirements for all components outside the accreditation boundary. This would be accomplished using a commercially accepted or combination of commercially accepted frameworks that can be mapped back to achieve the same desired security outcomes found under FISMA, NIST, and DHS Policy. Specifically, security control objectives based on the NIS 800-53 control Families (i.e., Access Control, Awareness & Training, Audit & Accountability, Security Assessment & Authorization, Configuration Management, Contingency Planning, Identification & Authentication, Incident Response, Maintenance, Media Protection, Physical & Environmental Protection, Planning, Personnel Security, Risk Assessment, System & Service Acquisition, System & Communication Protection, System & Information Integrity, Program Management ) shall be met.