Attachment 1 - Statement of Work.pdf

Statement of Work for Privacy Support Services

1.0 Background

Federal Mediation and Conciliation Service (FMCS) is an independent agency of the Federal Government responsible for promoting the development of sound and stable labor-management relationships, preventing or minimizing work stoppages by assisting labor and management to settle their disputes through mediation, and advocating collective bargaining, mediation and voluntary arbitration as the preferred process for settling issues between employers and representatives of employees. In addition, the FMCS mission includes developing the art, science and practice of conflict resolution, and fostering the establishment and maintenance of constructive joint processes to improve labor-management relationships, employment security and organizational effectiveness.

2.0 Purpose

The purpose of this requirement is to obtain privacy support services for FMCS’ Office of the Director. Areas of support will include establishment of a privacy program to include, but not limited to, drafting system of records notices and privacy impact assessments, and implementation and administration of the FMCS privacy program.

It is expressly agreed and understood that this is a non-personal services contract as defined in Federal Acquisition Regulation 37.101, under which the services performed by the contractor are rendered in its capacity as an independent contractor. The Government will evaluate the quality of the service provided, but retains no control over the contractor’s employees or agents. The contractor is solely liable for, and expressly agrees to indemnify the Government with respect to any liability producing acts or omissions by it or by its employees or agents.

3.0 Objective

The objective of this requirement is to obtain one (1) privacy specialist to provide support services to FMCS’ Office of the Director.

4.0 Personnel Requirements

4.1 The contractor shall have working knowledge of applicable laws (e.g., Privacy Act, FISMA, HIPAA, other civil liberties and privacy laws, etc.), Executive Orders, Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.

4.2 The contractor shall have experience reviewing, drafting, and processing Privacy Impact Assessments (PIAs).

4.3 The contractor shall have experience drafting and maintaining privacy policies and procedures.

4.4 The contractor shall have experience supporting compliance activities with agency privacy program requirements; and assessing privacy risk associated with programs, operations, and technology.

4.5 The contractor shall have experience identifying gaps, deficiencies, or any problems with established privacy policies and procedures.

4.6 The contractor shall have experience applying qualitative and quantitative techniques to analyze and measure the effectiveness and efficiency of procedures and practices that support the Privacy Act.

4.7 The contractor shall understand the template of, and have experience drafting, System of Record Notices (SORNs).

5.0 Tasks

The contractor shall be responsible for providing a technically qualified individual who meets the requirements of Section 4.0 to perform privacy support services to include the following tasks:

5.1 Draft agency privacy policies, directives, memorandums and procedures, including SORNs.

5.2 Support compliance activities with agency privacy program requirements including PIAs and Third Party Website and Application PIAs.

5.3 Review, draft, and process PIAs, and provide comments to FMCS’ Office of the

Director for consideration and action.

5.4 Review documented information privacy procedures to ensure that they are comprehensive and up-to-date, and coordinate revisions within FMCS Privacy Program, as necessary.

5.5 Identify privacy program implications of new and existing technologies or technology upgrades.

5.6 Support the privacy training and awareness program, as necessary.

5.7 Assist with the development and gathering of documentation, privacy incident reports, findings from privacy investigations, summaries, and other situational awareness information.

5.8 Assist with the creation of Standard Operating Procedures, reference manuals, and information sources, as well as the development of information that addresses privacy policy aspects and implications.

5.9 Consult organization-specific privacy policy criteria and assist in the identification of gaps and deficiencies; identifying any problems or issues encountered with the established policies or procedures by recording occurrences and reporting them to FMCS’ Office of the Director.

5.10 Collect information from stakeholders regarding privacy requirements and document them for consideration by management into organizational planning reports.

5.11 Assist with defining, interpreting, and implementing a privacy policy related to

Federal requirements and translating/tailoring these policies into a format that is clearly understood by a variety of audiences.

5.12 Identify privacy compliance gaps and collaborate with FMCS’ Office of the

Director to help resolve.

6.0 Deliverables

Bi-weekly status reports on progress of assigned tasks and activities performed under the task order are due to the Contracting Officer’s Representative (COR), showing the status of all active tasks. Additional deliverables may be requested in writing to the contractor by the Contracting Officer or COR, as appropriate.

7.0 Period of Performance

The Period of Performance (PoP) shall be twelve (12) months, to include a 6-month base period and a 6-month option period.

8.0 Place of Performance and Hours of Operation

8.1 The contractor shall provide up to thirty (30) hours per week of remote support to the Office of the Director, who is located at the FMCS Headquarters in Washington, D.C.

8.2 The operating hours consist of an eight-hour daily work schedule, which can begin not earlier than 0700 and end not later than 1800, Monday through Friday.

The core operating hours in which the contractor must be present are 0800 through 1630.

8.3 The Contractor is not required to provide service on the following U.S. Federal holidays: New Year’s Day, Martin Luther King Jr. Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas day.

8.4 When the Government grants administrative leave to Government employees as a result of inclement weather, potentially hazardous conditions, or other special circumstances, contractor personnel may work at a preapproved alternate location or be dismissed.

8.5 Work performed on holidays and other non-work time is not billable unless it is specifically requested by the COR or the Contracting Officer and approved in advance.

9.0 Government Furnished Property/Equipment/Facilities

FMCS will provide the contractor personnel with workspace, computer, printer, software and network access necessary to perform the work requirements.

All materials provided by the Government during the course of this task order will remain the property of the Government and will be returned on completion of the task order. The contractor or their designated representative shall sign the required Government tracking document for the necessary supplied equipment.

10.0 Access to Information Technology Systems

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and FMCS policies as FMCS, and FMCS personnel, regarding information and information systems security. Contractors must follow policies and procedures outlined in FMCS IT Security Program to ensure appropriate security controls are in place.

A contractor shall request logical (technical) and/or physical access to FMCS information and FMCS information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the task order, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the task order, and (3) individuals must satisfy the same conditions, requirements and restrictions comparable to FMCS employees in order to access the same type of FMCS information.

11.0 FMCS Information Custodial Requirements

Information made available to the contractor by FMCS for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer.

FMCS information shall not be co-mingled with any other data on the contractor’s/ subcontractor’s information systems/media storage systems in order to ensure FMCS requirements related to data protection and media sanitization can be met. FMCS also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization or disposal procedures to ensure they are in compliance with FMCS policy requirements.

Prior to termination or completion of this contract, the contractor shall not destroy information received from FMCS or gathered or created by the contractor in the course of performing this contract without prior written approval by the FMCS Contracting Officer. Any data destruction done on behalf of FMCS by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements.

The contractor shall receive, gather, store, back-up, maintain, use, disclose and dispose of FMCS information only in compliance with the terms of the contract and applicable Federal and FMCS information confidentiality and security laws, regulations and policies. Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST).

If Federal or FMCS information confidentiality and security laws, regulations and policies become applicable to the FMCS information or information systems after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in the contract.

The contractor shall not make copies of FMCS information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

If FMCS determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for FMCS to terminate the contract for default or terminate for cause under Federal Acquisition Regulation Part 12.

12.0 Personnel Conflicts of Interest

The term "personal conflict of interest" means that a contractor employee assigned to the task order has interests which (i) may diminish his/her capacity to give impartial, technically sound, objective assistance and advice in performing this task order, (ii) may otherwise result in a biased work product under this task order, or (iii) may result in an unfair competitive advantage.

A contractor employee shall not participate (i.e., recommend, influence, or decide) in any particular matters that:

• will have a direct and predictable effect on the financial interests of that employee, his/her spouse or minor child, or organization in which he/she serves as officer, director, trustee, general partner or employee,

• will have a direct and predictable effect on the financial interests of or any person or organization with whom he/she is negotiating or has an arrangement concerning prospective employment, or

• may otherwise cause a reasonable person to question his/her impartiality.