Attachment 1-Performance Work Statement PWS Actuarial Consulting Services-11-20-25.pdf

Federal Emergency Management Agency National Flood Insurance Program

Performance Work Statement

Actuarial Services

1. Background:

The Federal Insurance Directorate (FID) is a component of the Department of Homeland Security (DHS), Federal Emergency Management Agency (FEMA), which operates the National Flood Insurance Program

(NFIP).

FEMA is committed to building a culture of preparedness across the nation. Purchasing flood insurance is the first line of defense against flood damage and a step toward a quicker recovery following a flood.

Since the 1970s, rates have been predominantly based on relatively static measurements, emphasizing a property’s elevation within a zone on a Flood Insurance Rate Map (FIRM).

The 1970s legacy methodology was relatively simplistic relying on fewer variables and a limited number of data sources compare to the current NFIP pricing approach. FEMA is building on years of investment in flood hazard information by incorporating private sector data sets, catastrophe models, and evolving actuarial science. In addition, the 1970s legacy rating methodology did not account for the cost of rebuilding a home. Policyholders with lower-valued homes were paying more than their share of the risk while policyholders with higher-valued homes may have been paying less than their share of the risk.

NFIP’s pricing approach enables FEMA to set rates that are fairer and ensures up-to-date actuarial principles based upon new technology, including modeling.

With NFIP’s pricing approach, FEMA is using new capabilities and tools to develop insurance rates based on risk and actuarial science by incorporating more flood risk variables. These include flood frequency, multiple flood types—river overflow, storm surge, coastal erosion and heavy rainfall—and distance to a water source along with property characteristics such as elevation and the cost to rebuild.

With the implementation of NFIP’s pricing approach in 2021, FEMA is now able to distribute premiums across all policyholders based on home value and a property’s flood risk.

2. Contract Type:

The Government anticipates a firm fixed price, single award contract for this requirement.

3. Scope:

The Government seeks to procure actuarial services to provide technical actuarial and geospatial capabilities, analytics, advice, and guidance on activities related to ratemaking and insurance pricing for the NFIP. NFIP ratemaking encompasses a set of interlinking analyses that the Actuarial and Catastrophic Modeling (ACM) branch and its Actuarial Contractor undertake to monitor, evaluate, assess, and measure flood risk to maintain a financially and actuarially sound flood insurance price structure. A description of the current pricing methodology used, including the geospatial data and methodologies, can be found attached or at: FEMA Risk Rating Methodology and Data Appendix January 2022.

https://www.fema.gov/sites/default/files/documents/FEMA_Risk-Rating-2.0_Methodology-and-Data-Appendix__01-22.pdf https://www.fema.gov/sites/default/files/documents/FEMA_Risk-Rating-2.0_Methodology-and-Data-Appendix__01-22.pdf

4. Description of Services This Performance Work Statement (PWS) includes services for the rate development, continuous improvement of actuarial techniques for the NFIP, geospatial support, audit and litigation support, and other actuarial activities. All work described in this PWS will be conducted on FEMA systems accessed through government furnished equipment. FEMA does not desire the use of proprietary tools or software. All work will be completed using FEMA approved software and analytical tools. All analyses done under this Contract are subject to management oversight and technical peer review to ensure that changes in the model and rates are in alignment with the NFIP mission and compliant with the applicable statutory and regulatory provisions. This includes compliance with the Actuarial Standards of Practice promulgated by the Actuarial Standards Board and the Casualty Actuarial Society Statements of Principles.

The Contractor will provide project management services for the work discussed in the Objectives below. The Contractor will work closely with ACM and government program and project managers, to ensure all work is coordinated closely across the Government and contracting teams.

Objective 1: Learn NFIP Rating Methodology and Complete Transition with Outgoing Contractor (if applicable)

The Contractor will work with the NFIP Actuaries and the outgoing NFIP actuarial contractor to fully understand the NFIP’s rating methodology. The Contractor should be confident in their ability to replicate the development of rates using this methodology. The Government is planning on up to a 90-day overlap between contracts to ensure a successful transition.

The Contractor will adopt the data and tools used to conduct rate updates under the NFIP’s rating methodology. This includes learning the historical rationale for using the selected data sets, tools, and methodologies. Many decisions were driven based on programmatic policy and regulations, data availability and applicable methodologies. It will be important to understand that history, in order to make recommendations and develop courses of action to improve data and tools during future advancements of the rating methodology.

The Contractor will review the NFIP data collection and augmentation process, to understand the NFIP raw data collected, the assumptions that are made to augment the NFIP data, and the data sets that have been procured to augment the NFIP data. The Contractor will learn how the non-NFIP data sets, market basket, uniform and orthogonal books, were built and used. The Contractor will review the FEMA developed and commercial catastrophe model runs and their output.

The Contractor will review the developed Target Rate Level (TRL) exhibits, generalized linear models (GLMs) and other models and analyses, as well as selected rating factors. The Contractor should learn in-depth how the TRL, GLMs and other models were created and analyzed. The Contractor should strive to understand the history of rating factor selection and desired points of improvement from both the NFIP actuaries and the incumbent actuarial contractor.

The rating methodology will require the Contractor to use and apply Geographic Information System (GIS) data extensively. The Contractor will learn the current GIS data and plans for GIS improvements.

Additionally, the NFIP has a set of regulations and programmatic rules that apply to how rates are developed and implemented. A few of these include, pre-firm subsidies, capped rate increases, Community Rating System (CRS) program, etc. The Contractor should spend time during transition to understand these rules, their application to rate development, and their impact on the financial standing of the NFIP.

The Contractor will in the first 90-days of the period of performance complete a full review and training provided by the incumbent contractor and the NFIP actuaries of the current rating methodology.

Objective 2: Complete Update to Combined Rating Plan

The current rating methodology consists of two separate rating plans, one for leveed locations and one for non-leveed locations. ACM is beginning to explore ways to combine all policyholders under one rating plan that encompass both levee and non-levee locations. Prior to the start of this Contract, FEMA plans to have developed a new “test” framework for the Combined Rating Plan. The Contractor will finish a full rate analysis using the Combined Rating Plan “test” framework as the structure for the rate update. The scope of a full rate analysis can be found in Objective 4.2.

The Contractor will support the documentation and implementation of the Combined Rating Plan as discussed in Objective 4.3.

Objective 3: Annual Rate Review and Update of Target Rate Level

3.1 Annual Rate Review

The Contractor will assist in the running of NFIP catastrophe models on FEMA systems, review catastrophe model results, update NFIP expenses, review geospatial updates, and review any other relevant year on year changes. Based on this annual review, the Contractor will provide recommendations on rate updates for both near term (modular changes) and long-term (multi-year changes). The extent of changes to the rates on any given year can vary and are dependent on factors such as: significant updates to commercial catastrophe models or newly available catastrophe models, improvements or additions to the underlying data sources, updates to FEMA-developed models, significant changes to the book of business, etc. The Contractor will develop a summary of findings and impacts to be incorporated into the FEMA-developed Annual Rate Review document.

3.2 Update Target Rate Level

On an annual basis, the Contractor will complete the analysis for the Target Rate Level (TRL) for the NFIP. The Contractor will assist in catastrophe modeling required for the development of the TRL. FEMA will provide the necessary data inputs required to develop the TRL, to include loss selections, provisions for underwriting expense, historical claim data, loss adjustment expense (“LAE”), and the net cost of reinsurance. The TRL should be developed on multiple bases: Coverage type, Occupancy type, Peril, and by Region, State and Territory. The AALs produced by the catastrophe models are used in concert with NFIP historical loss experience to inform the selection of an overall expected loss level. The Contractor will provide advice and guidance during FEMA’s selections for Target Rate Level and document the selection.

Objective 4: Update the Rating Plan

Based on the annual rate review (Objective 3), FEMA in consultation with the Contractor, will determine a plan for updating rates. ACM plans to move to a modular approach to ratemaking (Objective 4.1). The Contractor will also be responsible for one full ratemaking analysis over the course of the Contract (Objective 4.2).

4.1 Modular Updates

FEMA expects to make adjustments to the rating plan on an incremental or modular basis, not more than annually for any given element. Modular updates can be implemented as standalone changes or in combination of other changes. The implementation of these adjustments will be determined after the annual rate review. FEMA may elect to implement one or many of the adjustments. These adjustments include:

• Expenses: Based on data provided by FEMA, the Contractor will assist in reviewing and loading changes in loss adjustment expenses and other expenses into premiums.

• Deductibles and Policy Limits: The Contractor will assist in updating analyses of the deductibles and policy limits.

• Updates to factors: The factors need to be reviewed by the Contractor and NFIP Actuaries against performance metrics and loss experience. Based on these reviews and recommendations from the Contractor, FEMA may elect to make adjustments to rating factors for different portions of their book of business.

• Geospatial changes: Based on the work done under Objective 5, the Contractor will implement geospatial changes as requested.

• Catastrophe Provision (Net Retained Risk/Ceded Reinsurance): The Contractor will assist in helping determine a catastrophe load based on the NFIP’s exposure. High variability of losses is a significant risk for the NFIP, and much of that variability is due to geographical concentrations of policyholders. Policyholders in highly concentrated areas expose the program to the additional risk while policyholders in less concentrated areas do not. The catastrophe provision should consider the additional risk posed by concentration. Some of the variability risk is ceded to reinsurers, and the cost of that reinsurance provides a starting point for reflecting concentration in underwriting profit and the catastrophe provision. The remaining variability in the risk retained should also be provided for. Please note, the NFIP does not include a profit load in the rate structure.

• Levees: The Contractor will update levee rating factors based on data received from the U.S.

Army Corps of Engineers (USACE), National Levee Database (NLD) and associated data to determine risk reduction for homes and other buildings in leveed areas. One goal of The Combined Rating Plan (Objective 2) is to develop a way to input new levee data on an annual basis, without requiring an update to rating factors and base rates the same time.

• Community Rating System – As CRS communities experience changes in class level, there will be an impact on the state-wide premium collections. The Contractor will assist in off-balancing base rates back to state target levels.

• Off-balancing: The Contractor will assist in off-balancing base rates to maintain the integrity of the rating plan or remain premium neutral when incorporating incremental changes discussed in the bullets above and/or to update to the new TRL.

• Other: The Contractor will assist in determining any additional rate changes that can be incorporated without fully re-running the actuarial models and historical analyses.

FEMA desires a more steady-state rate update plan and cadence. As the modular approach is developed and tested, the Contractor will assist FEMA in developing, implementing, and documenting a steady-state rate cycle plan for these more incremental changes.

4.2 Full Analysis of Rates

The Contractor will complete one full rate analysis during the course of the five-year contract. This analysis is in addition to finishing any work regarding the update to the Combined Rating Plan (Objective 3). The purpose of this objective is to do a comprehensive analysis of rating factors (GLMs or other models), HLRs, and to incorporate larger changes into the rating algorithm. Changes in the geospatial datasets may or may not be included in the full analysis.

The full rate analysis will utilize model runs and a TRL developed in Objective 3. ACM will determine data vintage and TRL to be used for the purposes of this full rate update.

The Contractor will perform catastrophe model runs on the market basket, uniform and orthogonal books. The Government is currently using three commercial storm surge and inland flood models, as well as a tsunami model. ACM may decide to incorporate one or two new commercial catastrophe models or remove existing models. The Contractor will assist in the review of the AALs produced from the different models to ensure the results are reasonable. They will check and address any anomalies in the AALs to ensure trends and losses vary as expected. The Contractor will assist in reviewing and refining FEMA-developed models, as necessary.

The Contractor will lead the development of revised and new rating factors using tools and methodologies consistent with actuarial standards and government resources. Currently, FEMA uses Generalized Linear Models (GLMs) with the catastrophe model AAL output files and geographic, structural and coverage specific data as the inputs. FEMA is interested in understanding and incorporating other potential factors produced by methods other than the GLMs. For example, currently Coastal Erosion is not modeled by any of the catastrophe models and uses a different technique to develop a rating factor

The Contractor will develop residual plots, lift charts and residual maps as tools for reviewing the GLMs ( or other modeling techniques) with the ACM team. Using these tools, the Contractor and ACM will determine the quality of the fit for existing predictive variables and determine if any new rating variables should be considered. Once selections are made, the Contractor will rerate the Correlated Market Baskets using selected factors to create estimated AALs. The Contractor will develop expected loss ratios (“ELRs”) by each catastrophe model, peril, and rating variable as a final check on the soundness of the GLMs. The Contractor will engage ACM to check for anomalies or other areas of concerns in the GLMs. The Contractor will develop territory factors after the completion of GLMs based on the residuals on the Correlated Market Basket.

The Contractor will develop Historic Loss Ratios (HLRs) using FEMA provided historical loss data.

Indicated HLRs are calculated by rerating the historical exposures at proposed rates using preliminary rating factors derived from the catastrophe models. Based on review of the indicated HLRs, and at ACM direction, the Contractor will adjust some rating factors and rerate the historical exposures. The Contractor will provide guidance to ACM in the selection of final rating factors by comparing the resulting selected HLRs with the indicated HLRs.

Finally, the Contractor, in partnership with FEMA, will work to complete the PCW (note: this may not remain in the current excel format) by incorporating adjustments to other parts of the rating algorithm that are not modeled. These non-modeled rating elements include:

• Coverage and deductible rating variables

• Statutory Discounts

• Assessment, Fees, and Surcharges

• Minimum and Maximum premiums

The Contractor will also complete the NSFH analysis by primarily leveraging the information from the SFH analysis. This has been done by adjusting the final SFH values rating factors and rates to reflect the unique elements of NSFH.

The Contractor will develop dislocation exhibits to demonstrate impacts of rate changes. The Contractor will assist in development of materials for ACM leadership for final review and concurrence of the full rate cycle update.

4.3 Documentation and Technical Product Delivery

The Contractor will develop materials to support rate updates that are equivalent or similar in nature to a state rate-filing. In addition to the rate-filing, extensive documentation is required for Government record-keeping processes. The Contractor will provide any updates made to the rating structure (both incremental and large-scale) to the NFIP programmatic, IT and insurance delivery teams to ensure changes are effectively implemented. The Contractor will assist ACM in developing all required documentation for the activities described above, including a premium calculation worksheet (PCW).

All decisions made on ratemaking should be well-documented and provided to the Government on an ongoing basis. All intermediate work products should be provided to the Government on an ongoing basis.

In addition to decision memos and executive summaries, the Contractor will document all analytical work related to the ratemaking process with explanatory memos, worksheets, exhibits, coding files, or any other supporting element. Examples of these supporting documentation files are:

• SQL and R scripts used in the ratemaking model

• Rate Revision Explanatory Memo

• Data files with specifications and documentation

• GLM diagnostics and output files

• Rating Factor Exhibits and Excel files

• Expected Loss Ratio (ELR) Exhibits and Excel files

• Territory Factor Exhibits and Excel files

• HLR Exhibits and Excel files

• Base Rate Exhibits and Excel files

• Target Rate Level Exhibits and Excel files including the LCM

• Dislocation Exhibit and Excel files

The Contractor will focus on updating the scripts used in ratemaking, so they are efficient and optimized to enhance performance. The Contractor will move the PCW from an excel file to an independent rater that can be used to test and validate the rating algorithm. The Contractor will develop visuals or dashboards for the PCW.

4.4 Audit and Litigation Support

The NFIP has been subject to considerable litigation and auditing of the rating methodology developed under Risk Rating 2.0. The Contractor will assist in the production of materials to support any future audits or litigation activities related to NFIP pricing approach.

Objective 5: Geospatial Review and Incorporation

5.1 Update Geospatial Datasets

The Contractor will provide recommendations for updates to geospatial data sets used for NFIP rate development. The Contractor will evaluate the currently used data sets and make recommendations for improvements. In consultation with federal staff, a plan will be developed for the improvement of the rating GIS variables.

Based on the agreed upon plan, the Contractor will develop and implement the requested updates to the GIS layers and computational methodologies. This will be the focus of the Base Year and Option Year

1. Some improvements already identified include:

• Updating the coastline dataset by defining the tidal water extents nationwide and create detailed coastal ocean polygons enriched with relevant metadata,

• Redefining hydrographic inland riverine dataset and incorporate/updated missing features, canals, creeks, channels, etc.

• Validating existing DEM derived from USGS data and incorporating new data sources such as higher resolution data, and

• Updating and implementing new tsunami, coastal erosion, and great lakes peril data.

• Develop methodology and datasets to validate structure elevation using local terrain characteristics or another methodology.

Additionally, the Contractor will review and make more efficient the relational spatial databases rating algorithm to deliver to the FEMA engine team.

After the delivery of initial updated geospatial layers, the Contractor will be responsible for continuous improvements in the geospatial datasets throughout the remaining option years, to be incorporated into rate-making cycles at appropriate intervals of time.

5.2 Update Market Baskets

The Contractor will assist in updating the market baskets (uniform, uncorrelated, and correlated) based on the changes and improvements in data. This might require helping to identify external sources of updated market basket locations, such as the National Structure Inventory, Microsoft and/or OpenStreetMap. The Contractor will harmonize these datasets and other sources with derived datasets to ensure completeness and accuracy. The Contractor will work to augment building and financial features. This will be the focus of Option Years 2 and 3. A description of the different books can be found below:

• The Uniform Book is a representative sample of locations of single-family homes (SFHs).

Each location was assigned identical property and coverage characteristics.

• Uncorrelated Market Basket includes locations that were assigned generally uncorrelated property and policy characteristics that are not necessarily representative of the state or territory’s true distributions. This book was utilized to understand non-geographic (i.e.

property and coverage) risk differences.

• Correlated Market Basket includes single-family homes with property and coverage characteristics that generally reflect the distributions of those characteristics in each state/territory.

Please reference Appendix B of the attached FEMA Risk Rating Methodology and Appendix for detailed information on the market baskets used in the NFIP rating plan.

The Contractor will be responsible for documenting methodologies and maintaining these different books. Planning work and discussions may occur in the first two years of the task order to prepare for the update.

5.3: Prepare geospatial guidance and documentation.

The Contractor will be responsible for the creation and maintenance of geospatial materials. This includes both internal and external (published) guidance, operating materials, and training documents.

All decisions made on geospatial variables that impact the rating plan should be well-documented and provided to the Government on an ongoing basis. All intermediate work products should be provided to the Government on an ongoing basis.

Additionally, the Contractor will maintain geospatial layers, geodatabases, and data dictionaries used in rate development. The Contractor will establish governance frameworks and quality assurance processes to ensure the integrity, reliability, and consistency of geospatial data. The NFIP datasets often contains sensitive information about individuals and properties. Therefore, data management practices must include measures to protect privacy according to government standards.

The Contractor will maintain a well-documented script repository and will provide all scripts developed for the purposes of this Contract upon request.

Objective 6: Research Track

Research and development are integral to the NFIP ratemaking model to ensure continuous improvement and adaptation to changing conditions. Research and Development is an ongoing activity that runs parallel to all the other activities. The Contractor will support a reasonable amount of research on an ongoing basis (no more than 400 hours a year), through the attendance of ad hoc meetings, perform analysis and review of data as required. Some examples of improvements:

• Increasing the ability to develop and customize depth-damage functions used in FEMA developed and commercial catastrophe models;

• Addressing certain sub-perils such as alluvial fans;

• Incorporating more models into state allocation view and territory factors;

• Exploring alternatives for pricing retained risk;

• Alternatives to generalized linear modeling approaches for rating factor development;

• Exploring if loss constant should vary by peril; and

• Developing rating methodologies to incorporate additional mitigation credits that result in a reduction in risk that can be offered to policyholders.

Additionally, ACM have historically worked closely with the Engineering Divisions within FEMA to be able to utilize FEMA-develop flood models in their rating methodology. The current models used are the Mapping Data Integration (MDI) Approach and the Probabilistic Flood Risk Analysis (PFRA). The FEMA Engineers are in the early stages of developing their probabilistic flood modeling techniques. It is the desire of the Government to include these and any other FEMA-developed models in the insurance rates as the models mature. The Contractor will assist in model development by reviewing model runs, providing quality checks, asking questions about performance, and comparing the model results to industry catastrophe flood models. This process is iterative and ongoing.

Objective 7: Product Development

The National Flood Insurance Program is currently rewriting their flood insurance policy forms to align with industry standards and best practices. The policy forms are written in regulations, and therefore, rulemaking is required to change these forms. Prior to implementing the new policy forms, the Contractor will assist ACM in evaluating and adjusting the rating methodology to account for the policy changes occurring with the implementation of new forms.

Examples of policy changes in the new forms that will also impact pricing are tailored forms for commercial and non-residential exposures, the possible separation of tsunami as an optional coverage, changes in definitions, inclusion of endorsements, etc.

Objective 8: Transition Out-Going

The Contractor will provide extensive transition to the Government and the follow-on contractor prior to completion of the contract period of performance at the direction of the Government.

The Contractor will collaborate with the government and follow-on contractor to ensure the complete and comprehensive transition of services. The Contractor will provide a complete review and training to the incoming contractor and the NFIP actuaries on the rating methodology.

5. Key Personnel

Managing Actuary

The Contractor shall provide a Managing Actuary that is responsible for all activity under the Actuarial Services Contract including but not limited to the production of the rate updates, management of geospatial and catastrophe modeling work, ongoing research and improvement, and providing support with audits and litigation.

The Managing Actuary must be an Associate or Fellow of an American or International actuarial society, with significant relevant work experience (over 10 years) in developing risk rating and classification plans for property and casualty insurance companies, with a significant portion (over 5 years) of that experience being in natural catastrophe rating.

Senior Actuary

The Contractor shall provide a Senior Actuary that support all activity under the Actuarial Services Contract including but not limited to the production of the annual rate updates, recommendations for improvement, and providing support with audits and litigation.

The Senior Actuary must be an Associate or Fellow of an American or International actuarial society, with significant relevant work experience (over 7 years) in developing risk rating and classification plans for property and casualty insurance companies, with a significant portion (over 3 years) of that experience being in natural catastrophe rating.

6. Deliverables

DESCRIPTION FREQUENCY DUE DATES

Monthly Status Progress Report

Monthly Tenth (10th) of every month

Record of the knowledge transfer activities completed (Objective 1)

Once One Hundred and twenty (120) calendar days from contract award

Delivery of rates for combined rating plan - Exhibits, data, and documentation (Objective 2)

Once No later than eighteen (18) months from contract award

Annual Rate Review Summary (Objective 3.1) Annually At the direction of the COR Target Rate Level exhibits (Objective 3.2) Annually At the direction of the COR

Delivery of modular rates – Exhibits, data, and documentation (Objective 4.1 and 4.3)

Ongoing At the direction of the COR

Delivery of full analysis rates – Exhibits, data, and documentation (Objective 4.2 and 4.3)

Once Prior to completion of Contract

Plan and implementation for the improvement of geospatial data layers (Objective 5.1)

Once per Layer

At the direction of the COR

Updated Market Baskets (Objective 5.2) Once Prior to end of OPY3

Geospatial Documentation and Script Repository (Objective 5.3)

Annually At the direction of the COR

Project based on Research Track (Objective 6) Ongoing At the direction of the COR

Updated Rates Based on Policy Forms (Objective 7)

Once per product change

At the direction of the COR

Transition out Plan (Objective 8) Once Upon Completion of the Contract

Note: Deliverables will be delivered to the COR by the due date listed. The COR then has twenty (20) business days to review the deliverable and request corrections from the Contractor before the document is accepted by the Government. Some of these deliverables could be shared with other FEMA stakeholders. Deliverables may be delivered in electronic format using Microsoft products.

7. Government Furnished Equipment

• Portable laptops and access to systems to conduct work behind the FEMA firewall o All contractor personnel performing work using or reviewing FEMA data and non-public information will require a laptop

• Work space for the Contractor at FEMA facilities during quarterly visits.

• Access to appropriate personnel to complete all Objectives of the PWS.

• Full description of the current rating methodology can found online at: FEMA Risk Rating

Methodology and Data Appendix January 2022.

8. Period of Performance The performance period of the contract will be up to five (5) years consisting of one twelve (12) month base and four (4) twelve (12) month options.

https://www.fema.gov/sites/default/files/documents/FEMA_Risk-Rating-2.0_Methodology-and-Data-Appendix__01-22.pdf https://www.fema.gov/sites/default/files/documents/FEMA_Risk-Rating-2.0_Methodology-and-Data-Appendix__01-22.pdf

9. Place of Performance Due to the collaborative nature of the work, the Government anticipates frequent teleconferences and videoconferences and requires the Managing Actuary and/or Senior Actuary (or alternatives, as approved by the Government) to be present in Washington, DC at least once a quarter, as allowed by travel and safety restrictions. As determined by the Government, the Contractor is allowed access to the FEMA Headquarters located in Washington, DC. The Government is allowed access to Contractor workspace for meetings and workshops related to this PWS.

10. Security Requirements (Reserved)

11. Privacy Requirements

11.1 SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

(d) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of

Homeland Security (including the Revised Procedural Manual “Safeguarding

Information Designated as Chemical-Terrorism Vulnerability Information” dated

September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical

Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland

Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the

Department of Homeland Security, the PCII Program Manager, or a PCII Program

Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland

Security (including the Assistant Secretary for the Transportation Security

Administration or designee), including Department of Homeland Security MD

11056.1, “Sensitive Security Information (SSI)” and, within the Transportation

Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of

Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement.

The Department receives this information in furtherance of the missions of the

Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information

Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of

Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of

Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information;

interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under

Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the

Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and

Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual;

and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not

PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual.

Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social

Security numbers (SSNs), driver’s license or State identification numbers, Alien

Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual.

SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(d) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with

DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(d) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the

Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System

Security Program, Sensitive Systems. If the Component SOC is not available, the

Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS

Enterprise SOC is accessible https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3

Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels.

When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or

Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information

Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime

Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for

Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the

Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and

Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The

Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix

G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S.

Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

(h) Authority to Operate. The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee.