Attachment 1 - Performance Work Statement.pdf

1145PC22Q0096

Diagnostic Laboratory Testing Services

Attachment 1 - Performance Work Statement

PERFORMANCE WORK STATEMENT (PWS)

FOR

Diagnostic Laboratory Testing Services

FOR

Office of Health Services

1.0 GENERAL

1.1 BACKGROUND:

The Peace Corps is an independent executive agency of the federal government established in 1961 by President John F. Kennedy to promote world peace and friendship through the service of American volunteers abroad. The volunteers’ service fulfills the three primary goals established in the founding legislation:

Improve the lives of people through grassroots assistance;

Foster a better understanding of Americans on the part of the people serve; and Foster a better understanding of other people on the part of Americans.

There are currently approximately 7,000 volunteers serving in posts located in over 60 developing countries worldwide. The posts are divided into three regions:

Africa (AF), Intra-America and Pacific (IAP), and Europe, Mediterranean and Asia

(EMA).

For information about where Peace Corps serves, please visit the Countries page on our website: https://www.peacecorps.gov/countries/.

For more information on the Peace Corps mandate and mission, see the Peace Corps website: http://www.peacecorps.gov/today/.

The mission of Peace Corps’ Office of Health Services (OHS) is to provide quality medical and mental health services and support to Peace Corps Invitees, Peace Corps Volunteers (PCVs), and Returned Peace Corps Volunteers (RPCVs). Peace Corps has an internal team of on-site doctors and other medical professionals at over 60 Peace Corps post locations worldwide. Peace Corps Medical Officers (PCMOs) located at overseas posts provide and coordinate needed health care services for PCVs and RPCVs.

PCMOs are responsible for obtaining and forwarding samples and laboratory specimens to an identified laboratory location using contractor-supplied testing supplies and materials, in accordance with procedures for proper packaging and shipping of specimens. Samples and laboratory specimens are sent to laboratories in the United States via diplomatic pouch, which is coordinated by American embassies. The Peace Corps has a need for testing services involving these clinical and anatomic laboratory specimens.

1.2 SCOPE:

Peace Corps medical staff may request testing and analysis in order to facilitate medical diagnoses and treatment decisions. In submitting specimens for testing and analysis, Peace Corps’ medical staff will follow the Contractor recommended procedures. Peace Corps medical staff may use the results to advise PCVs and RPCVs on health and medical issues.

1.3 OBJECTIVE:

The Contractor shall perform all testing and related services in compliance with all current Clinical Laboratory Improvement Act (CLIA) standards and other federal and state regulations applicable to such services and in accordance with any other commercial standards of care in this industry.

2.0 PERFORMANCE REQUIREMENTS:

In performing testing procedures, the Contractor’s responsibilities include, but are not limited to:

1) Processing, testing, analyzing, and monitoring samples submitted by PCMOs;

2) Transporting samples in such a manner as to ensure the integrity of the specimen;

3) Furnishing to the Peace Corps the requested quantity of all testing materials, special instructions and supplies necessary to prepare and transport specimens to the specified Contractor facility location for processing, testing, reporting and storage, including, but not limited to:

a. Required request/requisition forms

b. Supply order forms

c. Blood collection tubes and other related supplies/materials

d. Urine Collection tubes and other related supplies/materials

e. Needles required to obtain blood specimens for analysis, packing, shipping and transport materials

f. Transport media supplies and materials

g. Cytology, pathology and histology supplies/materials

h. Reference manuals and directory of services, including current list of tests with reference ranges and specimen requirements for each post;

i. Location of centralized business or laboratory for specimen receipt and distribution of testing supplies and materials.

All supplies and materials will be requested through a BPA Call order. The Contracting Officer's Representative (COR) will coordinate the request through the Acquisitions and Contracts Management Office within Peace Corps. Supplies and Materials shall be delivered to the specified Peace Corps’ Headquarters location within 7-10 business days following the request.

The Contractor shall commence the testing of all samples received within the acceptable industry standard time of receipt of the sample specimen to ensure that the lab test can be processed. If the Contractor requires clarification regarding the requisition or determines a submitted sample is not suitable for testing, the Contractor shall contact the Peace Corps within 24 hours of receiving the sample. In the event of the aforementioned circumstances, the Peace Corps will obtain and submit another sample or provide the requested information as soon as possible. If a test fails or a test result is invalid through no fault of the Peace Corps, the Contractor will not be paid for the test.

2.1 Reporting of Test Results

At the conclusion of testing and analysis, the Contractor shall electronically provide test results to ordering clinician (PCMO or other designated Peace Corps Personnel). Results shall be provided within [timeframe based on industry standards]. Standard industry language shall be used to explain test results and/or to identify extenuating circumstances.

The Contractor’s responsibilities for reporting shall include, but are not limited to:

1. Reporting individual test results for PCVs and RPCVs within the specified time frame in accordance with the nature of the testing, following all regulatory and accreditation requirements for reporting of patient results.

2. Providing test results within normal range, abnormal results or results indicative of pathology, via online portal or other secure electronic means within 24 to 48 hours, unless test methodology requires a longer period of time.

3. Providing expedited test results no later than 24 hours after receipt of specimen. Test reports must include:

a. Account information

b. Nature of Specimen

c. Dates specimen collected and received by lab

d. Date of test

e. Patient information

f. Test results – based on industry standards indication status such as normal, abnormal, or additional review

g. Reference ranges – if applicable

h. If specimen could not be processed an explanation as to why the specimen could not be processed

i. Delivering test results via secure online portal, secure email, automatic fax transmission or other secure means available, and in compliance with all HIPAA and Privacy Act regulations. A hard copy of results may also be mailed or securely faxed if other methods of dissemination are not available or deemed reliable.

j. Providing designated Peace Corps personnel with reports that are

98% accurate and accessible data in a secure format available for each overseas post and Washington, D.C. Headquarters location.

Results outside the margin of error shall be accompanied by an explanation of why 98% accuracy rate could not be attained.

2.2 ADMINISTRATIVE REPORTING

The Contractor shall submit administrative reports to the designated COR. The administrative report format shall be approved by the COR within 10 business days after contract award. The Contractor’s responsibilities for administrative reporting shall include:

2.2.1 Submission of an Activity Summary Report by the 15th of each month. The Activity Summary Report shall contain data from the tests performed the previous month. The Activity Summary Report shall list the number and type of tests performed, cost of test per patient (PCV/RPCV), and identify the ordering clinician for each test, as well as a list of abnormal tests, the number of lab tests that could not be processed, explanation why the lab test could not be processed, nature of specimen, date specimen was collected and received for each test.

2.2.2 Provide a quarterly report by the 15th of the month after the end of each quarter

(calendar year) reflecting a summarization of the Activity Summary Reports, frequency of tests performed, aggregate total costs of test performed for the quarter, the number of lab tests that could not be processed, explanation why lab test could not be processed, nature of specimen, date specimen was collected and received.

2.3 CUSTOMER SERVICE

The Contractor’s responsibilities for providing customer service shall include, but are not limited to:

2.3.1 Providing laboratory services during regular business hours and a toll-free customer service line accessible 24 hours per day, 7 days per week for technical support and logistical questions.

2.3.2 Providing a primary technical point of contact/account manager available to resolve account discrepancies during regular business hours.

2.3.3 Providing Peace Corps medical staff (both Post and Headquarters staff) a secure on-line portal/access to allow authorized users to review individual laboratory results.

Results must be electronically accessible to medical providers at Peace Corps Headquarters and overseas posts.

2.3.4 Setting up and providing password information for new additional accounts within 48 hours of request.

2.3.5 Providing written instructions on how to access and/or set up new accounts.

2.3.6 Providing additional individual reports, as requested, via secure email, online portal or automatic fax transmission.

3.0 DELIVERABLES:

3.1 DELIVERABLES

3.1.1 DELIVERABLES TABLE: All deliverables shall be delivered in accordance with the table below to the Peace Corps personnel identified in the requisition:

TESTING

PWS

Reference

Deliverable

Frequency Deliver to Format Due

2.0 Analyze

Samples

As Needed Online Portal Promptly after receipt of completed requisition form and acceptable sample from Peace Corps

2.0 Requisition

forms, testing material, instructions, specimen containers, etc.

One time & if a resupply is needed

Peace Corps HQs

Physical Supplies

Within 7-10 business days after BPA Call Order is issued

2.0 Reference

manuals and directory of services, including current list of tests with reference ranges and specimen requirements for all 60 overseas posts

One time/As updated

Peace Corps

HQ

Document Due within 20 days after BPA Call Order is issued

2.0 Provide

centralized business or laboratory location list for specimen receipt and distribution of testing supplies

One Time/ As Updated

Due within 7 days of award to Peace Corps

HQ

TEST RESULTS

2.1 Test Results

As needed Online Portal Digital results in portal

Due 24 to 48 hours after specimen is received unless nature of test requires longer time; 98% accuracy.

Indicate normal range, abnormal results and other required information

2.1 Expedited

Test Results

Online Portal Digital results in portal

Due 24 hours after specimen is received

Administrative Reports

2.2 Activity

Summary Report

Monthly COR Document

Due on the 15th of each month

2.2 Quarterly

Report

Quarterly COR Document Due Quarterly on the 15th of the month after the end of the quarter

2.2 Administrative

Report Format

One Time COR Document Approved by COR 10 days after award

CUSTOMER SERVICE: On-line Portal Access/ Secured Email Access

2.3.3 Establish new

accounts and passwords to authorized Peace Corps Medical Officers and HQs personnel

As needed Authorized Peace Corps Staff

Document

Within 15 days after award

2.3.4 Set-up and

provide password for additional Online access of test results for Peace Corps authorized personnel

As needed Authorized Peace Corps Staff

Document Due within 48 hours of request

IT Security Deliverables

5.5.3 System

Security Plan

(SSP)

One Time COR Document 15 days after award

5.5.3 Security

Assessment

Report (SAR)

One Time COR Document 15 days after award

5.5.3 Plan of Action

& Milestones

One Time COR Document 15 Days after award

5.5.4 Vulnerability

Scanning

Quarterly COR Document 15th of each month

5.5.4 Plan of Action

& Milestones

(POA&M)

Update

Quarterly COR Document 15th of each month

5.5.4 Updated System

Security Plan

Annually COR Document 15th of the month

5.5.4 Security

Assessment

Report

Every 3 years

COR Document 15th of the month

5.5.5 Privacy

Threshold

Assessment

(PTA)

Annually COR Document 15th of the month

5.5.5 Privacy Impact

Assessment

(PIA)

Every 3 years

COR Document 15th of the month

4.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Service Output Performance Objective

Acceptable Quality Level

(AQL)

Method of Surveillance

Testing Supplies All required service performed within the specified time requirements.

Contractor meets the specified time requirement 95% of the time

Periodic surveillance by the COR

Test Results All required service performed within the specified time requirements

Contractor meets the specified time requirement 100% of the time

Periodic surveillance by the COR

Administrative Reports

All required service performed within the specified time requirements

Contractor meets the specified time requirement 95% of the time

Periodic surveillance by the COR

Customer Service

All required service performed within the specified time requirements

Contractor meets the specified time requirement 95% of the time

Periodic by the COR

Service Output Performance Objective

Acceptable Quality Level

(AQL)

Method of Surveillance

IT security Deliverables

All required service performed within the specified time requirements

Contractor meets the specified time requirement 95% of the time

Periodic by the COR

5.0 ADDITIONAL CONTRACTOR REQUIREMENTS:

5.1 RELEVANT LAWS AND REGULATIONS

The term, medical data, as used in this Performance Work Statement, includes clinical records of PCVs and RPCVs, test results and other medical information provided to the Contractor in the course of performing this agreement or contract. The Contractor shall treat medical data as confidential and comply with all applicable federal and state laws and regulations regarding the use and disposition of such data. The Contractor shall not manipulate, aggregate, integrate, compile, merge, reorganize, or regenerate the data except as required to perform under this agreement or contract. The data, including derivative works that utilize the data, shall not be disseminated to third parties except as provided for in this agreement or contract or as may be required by law. This prohibition on the dissemination of information includes information reflecting the number or type of test results provided under this agreement or contract. Upon written request, the Contracting Officer or other designated personnel may waive the restrictions in this paragraph if such waiver is set forth in writing. The provisions of this paragraph shall survive expiration or termination of this agreement.

The Contractor shall handle all personally identifiable information (PII) and protected health information (PHI) as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Privacy Act (5 USC 522a). Electronic transmission of identifiable patient information shall be compliant with HIPPA requirements and the federal Privacy Act requirements and regulations.

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L.

105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this agreement or contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The complete text of Section 508 Standards can be accessed at http://www.access-board.gov/ or at http://www.section508.gov.

5.2 – ACCREDITATION AND LICENSES

The manner and method of performance under the resultant agreement or contract are the sole responsibility of the Contractor. However, the Contractor shall perform the services in accordance with standard industry practices and federal regulations mandated to operate a clinical laboratory as specified in the CLIA.

The Contractor shall:

5.2.1 Continuously possess, and keep current, all licenses, permits, accreditations and certifications required by law and regulation to perform the services required under this agreement or contract;

5.2.2 Be accredited by the College of American Pathology (CAP) or the American Board of Pathology (Clinical Pathologist), and if appropriate, another nationally recognized accreditation organization;

5.2.3 All laboratories performing testing under this agreement or contract shall hold and maintain current CLIA certificate.

The Contractor shall provide upon request documentation evidencing compliance with the aforementioned requirements. The Contractor shall notify the contracting officer immediately, in writing upon loss of any required certification, accreditation, or licensure.

The Contractor shall maintain records as required by federal, state and local law and regulation.

The Contractor may be subject to certain reporting and record keeping requirements required by federal law and regulations of the Department of Health and Human Services (HHS). These requirements involve records and information relevant to this agreement or contract. In some cases, this may involve providing information to the Comptroller General of the United States or HHS. The Contractor is responsible for the discovery and required to comply with applicable federal requirements regarding record keeping and reporting.

5.3 – PACKAGING AND MARKING

5.3.1 Diagnostic Testing Services shall be prepared, packaged, marked, and conducted in accordance with commercial best practices.

5.4 DATA RIGHTS

5.4.1 The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.” FAR clause 52.227-14 “Rights in Data- General” (May 2014), is hereby incorporated by reference and made a part of this contract.

5.4.2 Government Furnished Data and Materials. The Peace Corps shall retain all rights and privileges, including those of patent and copy, to all Government furnished data.

The Contractor shall neither retain nor reproduce for private or commercial use any data or other materials furnished under this agreement or contract. The Contractor agrees not to assert any rights at common law or in equity or establish any claim to statutory copyright in such data. These rights are not exclusive and are in addition to any other rights and remedies to which the Government is otherwise entitled elsewhere in this agreement or contract.

5.4.3 Contractor Produced Data and Materials. All property rights, including publication rights, in the information and materials produced by the Contractor in connection with this agreement or contract shall vest in the Government.

5.5 IT Security and Privacy Requirements

5.5.1 Required Policies and Regulations for PC Contracts

Federal Laws, Regulations, and Guidance:

The contractor shall comply with all applicable Federal Laws, Regulations, and

Guidance.

FISMA of 2014, “The Federal Information Security Modernization Act of 2014”

Privacy Act of 1974, “5 USC, § 552a” E-Government Act of 2002 section 208, “44 USC 3501” 32 FR Part 2002, “Controlled Unclassified Information” OMB Circular A-108, “Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act” OMB Memo 03-22, “OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002”

Federal Standards and Guidance:

The contractor shall comply with the following Federal Information Processing Standards

(FIPS) and NIST guidelines.

FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems” NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal

Information Systems and Organizations” NIST SP 800-171, Revision 2, “Protecting Controlled Unclassified

Information in NIST SP 800-171A, “Assessing Security Requirements for Controlled

Unclassified Information” PC Policies: The contractor shall comply with the following PC Directives/Policies.

• MS 542, “PC Information Security Program”

• MS 892, “Records Management”

• MS 897, “Privacy Act Administration”

• MS 899, “Breach Notification Response Plan”

The PC policies listed in this paragraph must be followed, if applicable.

• MS 542, “General Rules of Behavior”

PC Procedural Guides:

• CIO-SEC-PLN-05, “Incident Response Plan”

• CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M)”

Note: PC’s Procedural Guides are updated frequently; to make sure you have the most recent version of publicly available procedural guides, visit https://in.peacecorps.gov/HQ/cio/ignITion/rc/ITRC/Security%20Policies/Forms/ReadView.

aspx?PageView=Shared&InitialTabId=Ribbon.WebPartPage&VisibilityContext=WSSWeb PartPage. If a non-publicly available guide is needed, contact the contracting officer who will coordinate with the PC Chief Information Security Officer to determine if it can be made available.

5.5.2 PC Security Compliance Requirements

To comply with the Federal standard, nonfederal systems and organizations shall implement the specific security requirements in NIST SP 800-171, Revision 2, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” for protecting the confidentiality of Controlled Unclassified Information (CUI). NIST SP 800- 171 controls requirements have been tailored for non-federal entities, eliminating requirements, controls, or parts of controls that are uniquely Federal, not directly related to protecting the confidentiality of CUI; or expected to be routinely satisfied by nonfederal organizations without specification. NIST SP 800-171 controls are derived from FIPS PUB 200, “Minimum Security Requirements for Federal Information and Information Systems,” and the moderate security control baseline in NIST SP 800-53, Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations” and are based on the CUI regulation 32 CFR Part 2002, “Controlled Unclassified Information.”

The basic and derived security requirements in NIST SP 800-171 provide protection from unauthorized disclosure and unauthorized modification of CUI. The requirements apply only to the components of non-federal systems that process, store, or transmit CUI, or that provide security protection for such components.

5.5.3 Security Assessment Activities and Required Documentation

The non-federal system/organization shall implement the NIST SP 800-171, Revision2 controls; conduct an independent security assessment using NIST SP 800-171A, “Assessing Security Requirements for Controlled Unclassified Information” with results documented in a security assessment report; and security vulnerabilities or gaps in security requirements documented in a Plan of Action and Milestones. The resultant documents including the System Security Plan, Security Assessment Report, and Plan of Action and Milestones will be critical inputs to a risk management decision by the PC to process, store, or transmit CUI on a system hosted by a nonfederal organization and whether it is advisable to pursue an agreement or contract with the non-federal organization. The failure to implement the NIST SP 800-171, Revision 2 controls and maintain the supporting documentation will result in the termination of the agreement or contract. The non-federal system must have a new independent security assessment conducted at least every three (3) years or at the discretion of the PC when there is a significant change to the system’s security posture or via continuous monitoring. The contractor shall create, maintain and update the following security documentation and make available to the Government:

• System Security Plan (SSP) completed in agreement with NIST SP 800-171, Revision 2, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” using the template provided by the PC.

• Security Assessment Report (SAR) completed in accordance with NIST SP 800-171A, "Assessing Security Requirements for Controlled Unclassified Information” using the template provided by the PC. Nonfederal information systems must have an independent assessment performed and authorized every three (3) years or whenever there is a significant change to the non-federal system's security posture. The independent assessor shall be a FedRAMP accredited Third Party Assessment Organizations (3PAOs) or be approved by the PC if not a 3PAO.

• Plan of Action & Milestones (POA&M) document completed in accordance with PC CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M).”

5.5.4 Reporting and Continuous Monitoring

Maintenance of security will be through continuous monitoring of security controls of the nonfederal system and its environment of operation to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated and submitted to PC per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the security state and risk posture of the information system(s). They allow PC to make credible risk-based decisions regarding the continued usage of non-federal systems and initiate appropriate responses as needed when changes occur.

Deliverables to be provided Quarterly to the PC Information System Security Officer

(ISSO),

Information System Security Manager (ISSM), and/or Contracting Officer (COR)

1. Vulnerability Scanning Reference: NIST SP 800-171, Revision 2 Security Requirement 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Provide the most recent Web Application and Operating System vulnerability scan reports.

2. Plan of Action & Milestones (POA&M) Update Reference: NIST SP 800-171, Revision 2 Security Requirement 3.12.2

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. Provide POA&M updates in accordance with requirements and the schedule set forth in CIO-SEC-PRC-10, “Plan of Action and Milestones (POA&M).”

Deliverables to be provided Annually or when there is a major change to the PC ISSO, ISSM, and/or COR

1. Updated System Security Plan Reference: NIST 800-171, Revision 2 Security Requirement 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. The System Security Plan must be in accordance with NIST SP 800-171, Revision 2, using the Security Plan template provided by the PC.

Deliverables to be provided every three years or when there is a major change to the PC ISSO, ISSM, and/or COR

1. Security Assessment Report Reference: NIST 800-171, Revision 2 Security Requirement 3.12.1 Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. Deliver the results of the security assessment conducted using the assessment procedures in NIST SP 800-171A, “Assessing Security Requirements for Controlled Unclassified Information”, using the Security Assessment Report template provided by the PC.

5.5.5 Privacy Assessment Activities and Required Documentation Assessment of the privacy posture of the non-federal system and its environment of operation will be through continuous monitoring of privacy controls to determine if they remain effective over time in light of changes that occur in the system and environment.

Through continuous monitoring, privacy controls and supporting deliverables are updated and submitted to PC per the schedules below. The submitted deliverables (or lack thereof) provide a current understanding of the privacy risk posture of the information system(s).

They allow PC to make credible risk-based decisions regarding the continued protection of CUI residents in non-federal systems and initiation of appropriate responses as needed when changes occur.

Deliverables to be provided Annually or when there is a major change to the PC ISSO, ISSM, and/or COR

1. Privacy Threshold Assessment (PTA) Reference: NIST SP 800-171 Revision 2 Security Requirement 3.1.9 and 3.1.22 The contractor shall prepare a PTA to confirm and document whether Personally Identifiable Information (PII) is in scope or not, and to determine which other categories of CUI will be stored, processed, or transmitted by the system. The PTA must be completed before PC begins using the non-federal system.

If through the initial PTA PC finds that no PII or other CUI is in scope, then vendor shall both:

a. Recertify the PTA on an annual basis to confirm the absence of such sensitive information; AND

b. Update the PTA any time there is a change that may impact the privacy posture of the system or its environment of operation (e.g., collection of a new information type (see OMB Circular A-108, paragraph 6(b) for additional examples of significant changes requiring a PTA update).

Deliverables to be provided every three years or when there is a major change to the PC ISSO, ISSM, and/or COR

1. Privacy Impact Assessment (PIA)

Reference: NIST SP 800-171 Revision 2 Security Requirement 3.12.12 For any system that collects, maintains or disseminates PII or other CUI, a PIA must be completed by the contractor and provided to the PC Privacy Office for review. Then vendor shall:

a. Limit system access to those with a Lawful Government Purpose; display login notifications or warning banners that CUI is present in the system and must be protected consistent with the CUI Program;

b. Prohibit any CUI from being posted or processed on publicly accessible systems;

c. Recertify the PIA every three years to confirm the collection, maintenance or dissemination of such sensitive information;

d. Update the PIA any time there is a change that may impact the privacy posture of the system or its environment of operation (e.g., collection of a new information type (see OMB Circular A-108, paragraph 6(b) for additional examples of significant changes requiring a PIA update).

2 NIST SP 800-53 provides guidance on security and privacy controls for systems and organizations.

OMB’s PIA guidance: OMB Guidance for Implementing the Privacy Provisions of the EGovernment Act of 2002

• If PII is in scope, the vendor shall include the following NIST SP 800-53, Revision 4 Appendix J controls in its SSP. Privacy controls are the administrative, technical, and physical safeguards employed within organizations to protect and ensure the proper handling of PII.

AR-2 Privacy Impact and Risk Assessment AR-3 Privacy Requirements for Contractors and Service Providers AR-5(a) Privacy Awareness and Training AR-7 Privacy-Enhanced System Design and Development DI-1 Data Quality DM-1 Minimization of Personally Identifiable Information DM-3 Minimization of PII used in Testing, Training and Research IP-1 Consent

IP-2(a) Individual Access IP-4 Complaint Management TR-1 Privacy Notice UL-1 Internal Use UL-2(a), (c), (d) Information Sharing with Third Parties

The full text of each privacy control, along with their security counterparts, can be found in their entirety in NIST SP 800-53.

• A Privacy Policy/Notice shall be provided to users prior to their use of the application on what data is being collected and why, as well as the impact of not providing some or all of

it. The Privacy Policy/Notice must be available to the individual directly on the form used to collect the information. Providing a link back to the Policy/Notice from the form is acceptable.

Other requirements: Government-approved terms of service.

5.5.6 Additional Stipulations

1. The Contractor shall comply with Section 1634 of Public Law 115-91 that prohibits use of any hardware, software, or services developed or provided, in whole or in part, by— (1) Kaspersky Lab (or any successor entity); (2) any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (3) any entity of which Kaspersky Lab has majority ownership.

2. The Contractor shall comply with 52.204-25 of the Federal Acquisition Regulation (FAR). It prohibits, under Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232), contractors from providing to the Government any equipment, system, or service that uses telecommunications equipment or video surveillance services from certain named companies as a substantial or essential component of any system, or as critical technology as part of any system , unless an exception or waiver is granted per the FAR. It also prohibits, under Section 889(a)(1)(B), contractors from using any equipment, system, or service that uses telecommunications or video surveillance equipment or services from certain named companies as a substantial or essential component of any system or as critical technology as part of any system, unless an exception or waiver is granted per the FAR. The proscribed companies are Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company and their subsidiaries and affiliates.