Attachment 08 - Privacy Rec Mgmt Safeguarding Info_2026AUG.pdf

JULY 2026

A. Information Governance and Privacy

PRIVACY REQUIREMENTS FOR CONTRACTOR AND PERSONNEL

In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), 52.224-3 Privacy Training – Alternate I (FAR Class Deviation 17-03, Revision 2), and HSAR Clauses, the following instructions must be included in their entirety in all contracts.

Limiting Access to Privacy Act and Other Sensitive Information In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires contractor personnel to have access to information protected by the Privacy Act of 1974, the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at https://www.dhs.gov/system-records-notices-sorns. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching GovInfo, available at https://www.govinfo.gov that replaced the FDsys website in December 2018. SORNs may be updated at any time.

Prohibition on Performing Work Outside a Government Facility/Network/Equipment The Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

Prior Approval Required to Hire Subcontractors The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Separation Checklist for Contractor Employees Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and

(3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII.

https://www.dhs.gov/system-records-notices-sorns https://www.govinfo.gov/

In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

Contractor’s Commercial License Agreement and Government Electronic Information Rights Except as stated in the Performance Work Statement and, where applicable, the Contractor’s Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

Privacy Lead Requirements If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under the SOW or PWS’s required Contractor Personnel section. The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Unit, the Office of the Chief Information Officer, and the Records and Data Management Unit to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

The Privacy Lead:

• Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

• Must have excellent verbal communication and organizational skills.

• Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

• Must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of

2002.

• Must be able to work well with others.

If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement for a separate Private Lead specifically assigned under this contract may be waived provided the

Contractor agrees to have the existing Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance if required. The Contractor shall work with personnel from the program office, the ICE Office of Information Governance and Privacy, and the Office of the Chief Information Officer to ensure that the privacy documentation is kept on schedule, that the answers to questions in any privacy documents are thorough and complete, that all records management requirements are met, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

B. Data Ownership And Data Quality Requirements for Contracts

1. Key Definitions

• Program Data: Any data resulting from ICE mission, operational, or administrative functions (e.g., enforcement, case processing, field operations, HR, finance, acquisition, IT/management), whether performed by ICE or contractor personnel, systems, or services on behalf of the Government.

• Associated with this Acquisition: Program Data is associated with this contract if ICE activity is facilitated by the contractor and the data:

o Is stored by contractor personnel;

o Is stored in software managed, developed, or used by the contractor; or o Is stored in a repository managed, developed, or used by the contractor.

• Reference Data: Contextual data used to interpret Program Data (e.g., code tables, lookup values, geographic boundaries, classification and coding schemes).

• AI System: A machine-based system that makes predictions, recommendations, or decisions that influence real or virtual environments, including large language models, machine learning models, and other automated decision systems.

• Sensitive Data: Data classified as CUI, PII, Sensitive PII, or otherwise restricted by law, regulation, or DHS/ICE policy (e.g., Law Enforcement Sensitive data).

• Data Quality: The degree to which data is accurate, complete, consistent, timely, valid, and fit for its intended use across the data lifecycle.

2. Government Data Ownership, Data Rights, and Contractor Use Restrictions

2.1 Government Ownership

All Program Data associated with this acquisition is owned exclusively by the U.S. Government, including:

• All data provided by the Government;

• All data generated, processed, or derived by contractor systems, software, or personnel acting on behalf of the Government;

• All data generated, processed, or derived through AI systems developed, provided, or operated under this contract (including AI outputs and AI-processed data);

• Any derivative outputs of AI developed under this contract; and

• Any models trained, fine-tuned, or otherwise developed using ICE data.

The contractor obtains no intellectual property, licensing, or proprietary rights in Program Data, AI outputs, or models developed with ICE data by virtue of this contract. Government ownership is perpetual and survives contract expiration or termination.

2.2 Contractor Restrictions on Data and AI Use

The contractor shall not, without prior written authorization from ICE (through the CO and OCIO Chief Data Officer):

• Use non-public Program Data (inputs, outputs, or derivatives), including AI-generated data and AI outputs, to train, fine-tune, or validate any publicly or commercially available AI systems, or any non-ICE systems outside the scope of this contract;

• Use Government-furnished or AI-generated data for any purpose outside the scope of this contract;

• Share, sell, license, sublicense, disclose, or otherwise transfer Government data, AI models, or AI outputs to any third party;

• Retain copies of Program Data beyond the period required for contract performance, except as required by law or as authorized by a Government-approved Data Disposition Plan; or

• Incorporate Program Data into contractor proprietary datasets, benchmarks, training corpora, or commercial products.

2.3 Intellectual Property and Vendor Lock-In Prevention

Contracts must distinguish:

• Government-owned deliverables (e.g., data, reports, analytical outputs, custom-developed AI models and software created using ICE data or funding);

• Contractor pre-existing intellectual property; and

• Mixed-funded items, with rights negotiated under applicable federal acquisition regulations.

The contractor shall:

• Acknowledge that custom-developed AI models, algorithms, and software created under this acquisition are owned by the U.S. Government, with no additional royalties or fees;

• Recognize that the Government may require unlimited rights (including rights to source code, trained model files, and foundational artifacts) for certain deliverables to support long-term use, maintenance, and integration;

• Use open, non-proprietary formats for Program Data where practicable (e.g., JSON, CSV, XML, Parquet, PDF/A);

• Ensure all AI system inputs, outputs, and trained models are exportable in non-proprietary, machine-readable formats; and

Provide sufficient technical documentation and access (e.g., APIs, schemas, model documentation) to support long-term ICE use, maintenance, integration, and transition to other vendors or in-house operations.

2.4 Pre-Existing IP, Mixed-Funded Items, and Dispute Resolution For deliverables incorporating contractor pre-existing IP or mixed-funded items, the parties shall negotiate license rights consistent with applicable federal acquisition regulations. The Government will not require unlimited rights to contractor pre-existing IP unless necessary for ICE mission needs and mutually agreed upon. Disputes regarding IP rights will be resolved under the applicable disputes clause of the contract.

3. Data Access, Portability, and Interoperability

3.1 Minimum Data Access Capability

The contractor shall ensure that:

• The current version of all Program Data is accessible to the Government within 24 hours of request and according to any Government-defined schedule;

• Data is accessible via secure, Government-approved mechanisms, such as:

o APIs or web services, o Secure file transfer of structured files (e.g., CSV, Excel), or o Direct database query for authorized personnel; and

• All accessible Program Data:

o Is machine-readable and human-readable in plain text, and o Is formatted to support efficient processing by Government applications (e.g., partitioning large datasets as directed by the COR).

If the contractor cannot meet the 24-hour access requirement due to technical or mission-critical limitations, it shall notify the COR in writing within 24 hours with justification and a proposed alternative timeline. The CO may grant exceptions or extensions as appropriate.

3.2 Format and Interpretability

The contractor shall ensure ICE can interpret Program Data by:

• Clearly labeling data elements and groupings in the data or through a schema/file layout;

• Documenting table/column definitions and foreign key relationships in relational databases;

• Obtaining Government approval (via the Data Steward or COR) for labels, names, and definitions of data elements and groupings;

• Ensuring delivered Program Data conforms to Government-approved definitions; and

• Providing all necessary Reference Data (e.g., code tables, lookups) concurrently with Program Data.

3.3 Enhanced Access Capabilities

The contractor shall:

• Provide standards-based API access to Program Data (e.g., REST/JSON, GraphQL) with OpenAPI documentation, role-based access control, and federal-compliant authentication (e.g., PIV/OAuth 2.0);

• Implement Change Data Capture or equivalent incremental update mechanisms;

• Provide real-time or near real-time data streams where required; and

• Provide self-service analytical access (e.g., read-only ODBC/JDBC or SQL views) for authorized Government users.

3.4 Enterprise Architecture Alignment

Systems and interfaces under this contract must:

• Align with ICE and DHS enterprise architecture standards;

• Use open, standards-based interfaces to interoperate with ICE/DHS systems; and

• Use Government-provided shared services (e.g., identity/access management, logging, data platforms, API gateways) where directed.

4. Data Quality Framework and Controls

4.1 ICE Data Quality Framework

The contractor shall comply with DHS Directive 103-01 (Enterprise Data Management Policy), DHS Information Quality Guidelines, and ICE’s Data Quality Framework (DQF), consistent with the Federal Data Strategy and NIST guidance. The DQF addresses:

• Accuracy (e.g., ≥99% for critical fields);

• Completeness (e.g., ≥98% for mandatory fields as defined in the Data Dictionary);

• Consistency (no contradictions across integrated systems);

• Timeliness (data available within agreed latency/SLAs);

• Validity (correct types, formats, ranges, and code sets);

• Uniqueness (low duplicate rate for key entities); and

• Fitness for Use (appropriate for mission use).

Where constraints prevent meeting targets, the contractor shall document constraints, propose remediation, and seek CO approval for adjusted thresholds. Failure to maintain these Data Quality targets for two consecutive reporting periods shall constitute a performance deficiency and may result in a formal cure notice or deductions in accordance with the contract's Quality Assurance Surveillance Plan (QASP).

4.2 Data Quality Governance and Compliance

• Maintain data quality practices aligned with DHS/ICE standards, mapping contract-supported data domains and critical data elements to authoritative sources;

• Implement automated and manual data quality controls across collection, ingestion, processing, storage, distribution, and retirement;

• Provide, upon request, documentation of monitoring architecture, tool configurations, and validation reporting;

• Maintain escalation and remediation procedures to address non-compliance within mission timelines; and

• Designate a responsible data quality lead (e.g., Data Quality Officer) as primary POC for audits and inquiries.

4.3 Operational Data Quality

For operational data submissions (e.g., via APIs):

• All required records must be included; no omissions based on inactivity or status;

• All non-nullable fields must be populated with valid values (100% completeness for mandatory fields per submission);

• Values must conform to contract data specifications (types, formats, allowable values);

• Automated schema validation shall be implemented at entry/ingestion to flag non-conforming records, with prompt remediation; and

• Code sets, labels, or definitions shall not be changed without prior written approval;

approved changes require crosswalks.

5. AI-Specific Data, Metadata, and Quality Requirements

5.1 Metadata Requirements

For Program Data used in or produced by AI systems, the contractor shall create and maintain metadata including:

• Descriptive (name, description, owner, custodian, update frequency, temporal/geographic scope);

• Structural (schema, data types, lengths, allowable values, keys/relationships);

• Administrative (classification, access controls, retention, legal holds, disposal authority);

• Lineage (source system, transformations, timestamps, versions); and

• Quality (scores by dimension, last validation date, open defects).

Metadata shall be maintained in a format compatible with the Government’s enterprise data catalog (e.g., DCAT-US, ISO 19115, or as directed) and updated within 5 business days of structural or content changes.

5.2 Data Dictionary

Within 60 business days of award, and upon each major system change, the contractor shall maintain a Data Dictionary that:

• Lists all data elements with definitions, data types, formats, and allowable values;

• Documents business rules and constraints;

• Provides crosswalks to legacy names/identifiers; and

• Includes a glossary of domain terms.

Labels and names require Government approval and must align with approved definitions.

5.3 System of Record Schema (SORS)

For systems supporting AI use, the contractor shall maintain a current SORS including:

• ER diagrams;

• DDL scripts;

• Stored procedure documentation; and

• API schema specifications (e.g., OpenAPI 3.x or equivalent).

SORS shall be updated within 10 business days of structural changes and maintained under version control accessible to the Government. The contractor may request extensions for major structural changes by submitting justification and a proposed timeline to the CO. The Government may grant extensions contingent upon the complexity of the changes as documented in the contractor’s submitted timelines.

5.4 AI Policy Compliance and Governance

Where Program Data is used for AI, the contractor shall:

• Comply with applicable federal, DHS, and ICE AI policies and governance processes;

• For AI supporting law enforcement or civil actions:

o Maintain human-in-the-loop oversight; and o Clearly label or document AI-generated content influencing decisions; and

• Ensure AI outputs are not the sole basis for punitive or enforcement actions, or for decisions made on improper or unlawful bases.

5.5 Traceability, Documentation, and Explainability

• Maintain Training Data Sheets for each AI model (data sources, collection, labeling, known risks, representativeness, versioning);

• Document provenance and versions of third-party models (source, licensing, version history);

• Maintain diagrams and documentation of AI data flows, interfaces, and algorithmic components; and

• Ensure AI outputs are traceable, auditable, and explainable to non-technical users, and that AI inputs/outputs (including prompts, where applicable) are logged and retained per records requirements.

If technical limitations prevent full explainability or traceability, the contractor shall document limitations and propose alternative oversight methods for Government approval.

5.6 Bias, Drift, and Performance Monitoring

The contractor shall:

• Conduct bias and representativeness assessments prior to AI deployment consistent with applicable DHS, OMB, and NIST guidance;

• Continuously monitor for data distribution drift and model performance degradation;

• Configure alerts and reporting when thresholds are exceeded and take timely corrective actions; and

• Avoid techniques that introduce, amplify, or obscure systematic bias in outputs.

5.7 Sensitive Data Restrictions and Exceptions

In accordance with DHS Directive 139-08 and applicable privacy laws, the contractor shall:

• Not use sensitive non-public input data or AI outputs to train or improve publicly or commercially available AI systems;

• Apply appropriate privacy-preserving techniques (as directed by the Government) for AI systems processing Sensitive Data; and

• Support completion of Privacy Impact Assessments and other required assessments before deploying AI systems processing PII or materially changing their use.

If compliance with sensitive data handling requirements is not feasible, the contractor shall promptly notify the COR and ICE Privacy Office and propose alternatives. The Government may authorize alternative methods or exceptions consistent with legal and policy requirements.

6. Security, Privacy, and Protection of Sensitive Information

6.1 Protection Obligations

The contractor shall:

• Treat all Program Data as Sensitive but Unclassified at minimum and protect CUI, PII, law enforcement sensitive data, and other DHS sensitive information in accordance with FISMA, the Privacy Act, DHS policy, and ICE/OCIO security requirements;

• Ensure DHS sensitive information resides within known, secure contractor- or DHS-controlled environments; and

• Process, store, and transmit Program Data only on systems with appropriate DHS/ICE security authorization or written Government approval.

6.2 Cloud and Hosting Requirements

For cloud-hosted systems processing Program Data, the contractor shall:

• Use FedRAMP-authorized services at the Government-specified impact level;

• Ensure all Program Data and backups reside in U.S. data centers unless otherwise approved;

• Restrict administrative access to personnel meeting DHS/ICE suitability, clearance, and citizenship requirements; and

• Maintain logical and physical separation among development, test, staging, and production, and prohibit use of live PII/Sensitive PII in non-production environments without written authorization and protections.

6.3 Breach and Incident Response

• Implement controls to prevent unauthorized access, disclosure, alteration, or destruction of data;

• Report any actual or suspected PII breach to the COR and ICE Privacy Office within one hour of discovery; and

• Report other data security incidents as required by contract and policy.

7. Operational Data Submission, Latency, and Unavailability

7.1 API-Based Submission and Encryption

Where operational data must be transmitted to ICE systems, the contractor shall:

• Use secure APIs with:

o Encryption in transit (e.g., TLS 1.2 or higher) and at rest (e.g., AES 256 or equivalent), o Multi-factor authentication for API access, and o PIV-based authentication for federal users in accordance with HSPD-12; and

• Maintain current interface documentation and update it within 5 business days of changes.

7.2 Latency Requirements

• Changes in the contractor’s system of record must be reflected in data exposed to ICE within 15 minutes.

• The contractor shall:

o Implement automated monitoring and alerting for latency violations;

o Report any breach of the 15-minute requirement to the COR within 2 hours of detection; and o Document latency breaches and corrective actions in monthly data quality reports.

7.3 Data Unavailability Procedures

If required data elements cannot be provided, the contractor shall:

• Notify the COR in writing within 48 hours of identifying the issue (affected fields, cause, expected duration);

• Submit a Corrective Action Plan within 5 business days (root cause, corrective steps, timeline, preventive measures);

• Continue submitting all other data on schedule, clearly indicating missing or degraded elements; and

• Acknowledge that repeated or unresolved unavailability may be treated as a performance deficiency.

8. Data Transition, Disposition, and Audit

8.1 Transition and Exportability

Within 90 business days of award (or upon Government request), the contractor shall submit a Data Transition Plan including:

• Inventory of all Program Data (formats, volumes, locations);

• Strategy and timeline for transferring data to ICE or a successor contractor;

• Validation procedures for completeness and integrity; and

• Knowledge transfer and documentation handoff 30 days prior to contract end.

Within 30 business days of award, the contractor shall execute a functional verification of system data export capabilities in a non-production environment, demonstrating that all data elements and artifacts are extractable in industry-standard, non-proprietary formats (e.g., JSON, CSV, Parquet, XML) without proprietary tools or vendor intervention. This verification shall occur in the presence of Government technical personnel, who are the final authority on successful export functionality.

8.2 Phased Implementation for Legacy and Proprietary Systems

For legacy or proprietary systems where immediate non-proprietary export is not feasible, the contractor shall submit a phased implementation plan within 30 business days of award. The Government may authorize interim solutions or extensions to ensure data transition integrity.

8.3 Data Return and Destruction

Upon contract completion or termination:

• All Program Data shall be returned to the Government in agreed formats within 30 business days prior to contract end.;

• After ICE confirms receipt, the contractor shall destroy remaining copies using NIST-compliant methods and provide a Certificate of Destruction within 15 business days; and

• Destruction applies to all media, backups, archives, and cloud storage, except where legal holds or records retention requirements apply.

If the contractor cannot meet destruction timelines due to volume, distributed environments, or legal holds, it shall request an extension and proposed destruction plan at least 5 business days before the deadline. Approval is at the Government’s sole discretion.

8.4 Government Audit Rights

ICE may audit, inspect, and verify contractor compliance with data ownership, data quality, AI, and security requirements at any time during the contract. The contractor shall cooperate and provide access to relevant systems, documentation, and personnel. Audit activities shall be conducted after at least five (5) business days’ written notice and in a manner that protects contractor proprietary information and third-party confidentiality. Scope will be limited to systems, documentation, and personnel directly related to contract performance and compliance, with any proprietary concerns addressed through mutually agreed procedures.

C. Records Management

REC: 1.1: Required DHS Basic Records Management Training: The contractor shall provide DHS basic records management training for all Government contractor employees and Subcontractors at the outset of their work on the contract and every year thereafter. A hardcopy of the training will be provided as vendors will not have access to ICE systems The contractor shall maintain copies of certificates as a record of compliance. The contractor must submit an annual e-mail notification to the Contracting Officer’s Representative that the required training has been completed for all the contractor’s employees and Subcontractors.

REC 1.2: Federal Records are the Property of the U.S. Government: The contractor shall treat all federal records (as defined in 44 U.S.C. § 3301) under the contract as the property of the U.S.

Government for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. Any records containing information regarding detainees are considered Federal records and the contractor shall comply with 8 C.F.R. §236.6. The contractor shall not retain, use, sell, or disseminate copies of any deliverable without the expressed permission of the Contracting Officer or Contracting Officer’s Representative. As consistent with Federal records schedules and the terms of this contract, the contractor shall certify in writing the destruction or return of all Government data at the conclusion of the contract or at a time otherwise specified in the contract. Prior to any destruction, the contractor shall consult with the Contracting Officer or Contracting Officer’s Representative to ensure any such destruction follows the governing National Archives and Records Administration (NARA) records control schedule. The Agency owns the rights to all information and records produced as part of this contract.

REC 1.3: Contractor Shall Not Create or Maintain Unauthorized Records: The contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records. The contractor shall not create or maintain any records containing any Government agency data that are not specifically tied to or authorized by the contract.

REC 1.4: Agency Owns Rights to Electronic Information: The Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation created as part of this contract. The contractor must deliver sufficient technical documentation with all data deliverables to permit the Agency to use the data.

REC 1.5: Comply With All Records Management Requirements: The contractor agrees to comply with Federal records management laws, regulations, and Agency policies, including those associated with the safeguarding of records covered by the Privacy Act of 1974, 44 U.S. Code Chapter 31 (Records Management By Federal Agencies), and CFR Title 36 Chapter XII Subchapter B (Records Management). These include the preservation of all records created or received regardless of format, mode of transmission, or state of completion.

REC 1.6: No Disposition of Documents without Prior Written Consent: No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the governing NARA records control schedules. The contractor must report any unlawful or accidental removal, defacing, alteration, or destruction of records to the COR immediately upon discovery.

REC 1.7: Return of all Federal and Agency Records: Upon termination or expiration of the contract, the Contractor must return all Federal and Agency records created or maintained as part of the contract. These records must be returned to the Contracting Officer, Contracting Officer’s Representative, or other Designated Agency Representative in a format that ensures they are accessible to the Agency without the use of proprietary software that requires the Agency to engage in additional acquisition or procurement actions.

REC 1.8: Submission of a Records Plan: Prior to the start of the contract, the contractor must submit a Records Plan outlining how it will maintain ICE records throughout the duration of the contract period to ICERecords-GeneralMailbox@ice.dhs.gov. The plan must include the following items:

a. A statement acknowledging awareness of relevant General Records Schedules (GRS);

DHS records schedules; and ICE records schedules and their intent to comply with the applicable retention requirements. (ICE records schedules can be found at the following link: Records Control Schedules | National Archives)

b. A summary of recordkeeping activities it plans to undertake to ensure all records are properly maintained during the entire records lifecycle (e.g., creation, disposition, etc.).

This summary must include where and how ICE records will be stored in an acceptable climate-controlled environment.

c. A summary of electronic recordkeeping activities it plans to undertake to ensure compliance with electronic records management (ERM) practices that are currently underway in ICE (e.g., cloud storage, metadata management, etc.). The plan must include details regarding any video/audio records it creates or uses and how they will be stored during lengthy periods of time.

d. A point of contact for addressing recordkeeping issues and rectifying any discrepancies noted during a records assessment and/or inspection.

mailto:ICERecords-GeneralMailbox@ice.dhs.gov https://www.archives.gov/records-mgmt/rcs/schedules/index.html?dir=/departments/department-of-homeland-security/rg-0567

The Records Plan must be approved by the ICE Records Officer no sooner 30 days before the start of the contract period.

D. Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Program 4300A version 13.3 Feb. 13, 2023 and attachments.

E. Security Review Terms and Conditions

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract.

The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

F. Privacy Expectations

Government contractor employees do not have a right, nor should they have an expectation, of privacy while using Government provided devices at any time, including accessing the Internet and using e-mail and voice communications. To the extent that employees wish that their private activities remain private, they should avoid using the Government provided device for limited personal use. By acceptance of the government provided device, employees imply their consent to disclosing and/or monitoring of device usage, including the contents of any files or information maintained or passed -through that device.

G. Mobile Information Technology Device Usage

Users who conduct official DHS ICE business on a mobile IT device must:

a) Sign the Remote Access and Mobile IT Device User Agreement Form.

b) Operate the device in compliance with this policy, all applicable federal requirements, and the DHS ICE Remote Access and Mobile Information Technology Guide.

c) Not process or access Classified information on the device.

d) Use only approved and authorized DHS ICE owned devices to physically attach to

DHS ICE IT systems.

e) Store only the minimum amount, if any, of Personally Identifiable Information

(PII) and electronic Protected Health Information (ePHI) necessary to do one’s work, and immediately delete the PII or ePHI when no longer needed. Users shall receive written approval from their supervisor before accessing, processing, transmitting, or storing DHS ICE Sensitive Information such as PII or ePHI.

f) Exercise extra care to preclude the compromise, loss, or theft of the device, especially during travel.

g) Immediately contact the DHS ICE Service Desk and their immediate supervisor if the IT device is lost, stolen, damaged, destroyed, compromised, or non-functional.

h) Abide by all federal and local laws for using the device while operating a motor vehicle (e.g. users are banned from text messaging while driving federally owned vehicles, and text messaging to conduct DHS ICE business while driving non-government vehicles).

Users who are issued a DHS ICE owned mobile IT device must also:

a. Comply with DHS DHS Policy Directive 4300A Attachment Q.

b. Not disable or alter security features on the device.

c. Only use the DHS ICE owned device for official government use and limited personal use.

d. Reimburse the OCIO for any personal charges incurred that are above the established fixed cost for the Agency’s use of the device (e.g. roaming charges incurred for personal calls).

e. Be required to reimburse DHS ICE if the mobile IT device is lost, stolen, damaged or destroyed as a result of negligence, improper use, or willful action on the employee’s part and if determined by ICE.

H. Contractor Employee Access (July 2023)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to

Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer.

Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

Alternate II (JULY 2023) When the Department has determined contract employee access to controlled unclassified information or Government facilities must be limited to U.S. citizens and lawful permanent residents, but the contract will not require access to information resources, add the following paragraphs:

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department's Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S.

citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

I. Safeguarding of Controlled Unclassified Information (July 2023)

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information.

This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland…