Attachment 2 - Contract Sensitivity Determination.pdf

Attachment 2 – Contract Sensitivity Determination

RFQ-CDF-23-FSandR

COMMUNITY DEVELOPMENT FINANCIAL INSTITUTIONS FUND (CDFI FUND)

INDUSTRIAL SECURITY INFORMATION

Security Categorization:

The clauses listed below apply to the Prime Contractor and any of its subcontractors employed during the course of this contract. The clauses below also apply to tasks, work requests or other identified method of requesting work be performed that flow from this document. No Contractor personnel may perform any work under this Contract until the Government grants specific permission to do so, regardless of existing clearance or investigation.

This Contract is categorized as unclassified at the Moderate (Tier 2/MBI) Level. This

Contract does have the requirements to issue Task Orders (/work/other identified method of requesting work). This Contract does not have Tasks that require different levels of investigations.

Contractors are required to comply with the Treasury Directive P 15-71, Treasury Security Manual in the handling, protection, and safeguarding of government information in their possession. The TD P 15-71 will be followed as it specifies Treasury-specific personnel, physical, industrial and information security policy, processes and requirements that apply to this contract.

General Security:

Department of Treasury, otherwise known as the Department, retains the right to request removal of Contractor personnel, regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government. Lack of the ability to obtain or maintain the required investigation level is included in the reasons the Department may remove a contractor employee. The reason for removal shall be documented in writing by the Contracting Officer. Additionally, the Contractor must notify the OSP of all terminations/resignations within 24 hours of occurrence. When and if such removal occurs, the Contractor is responsible for assigning qualified replacement personnel in a timely manner or ensuring that performance of the contract is not adversely affected. The Contractor shall return all Departmentally issued identification cards, building passes, keys, and any other government issued material of those terminated employees to the COR. If government issued material is not available to be returned, a report must be submitted to the COR referencing the number, name of individual to whom it was issued, the last known location, and disposition of the items. Failure to return government materials may result in remedial actions against the contractor. Contractor personnel shall visibly wear Departmentally issued identification badges when working in Government facilities. If any current or prospective employee is found to be ineligible for access to Government facilities or information by the Department, the COR will notify the contractor that the employee shall not continue to work or to be assigned to work under the contract. The Department may require drug screening for probable cause at any time. The contractor must also ensure that, prior to the end of the contract, all Departmental information, systems and equipment is returned to the appropriate Department personnel. All contractors must be vetted and approved by OSP prior to beginning work on any portion of this contract.

Any employee assigned to support the Department shall comply with Personal Identity Verification One and Two (PIV-1, PIV-2) requirements as described in Homeland Security Presidential Directive 12 (HSPD-12), “Policy for a Common Identification Standard for Federal Employees and Contractors,” and “Federal Information Processing Standard 201, Personal

Identity Verification Standards for Federal Employees and Contractors,” dated August 2013.

T2/Moderate Risk contract employees must be a U.S. Citizen or Lawful Permanent Resident Alien with at least three or more years of U.S. residency from the legal entry date in the U.S..

Contractor personnel will have access to Department facilities, information and equipment limited to that which is needed to perform contract scope.

The Contractor shall provide the CO the name of all entities to be used as subcontractors for each type of work to be performed prior to performing any work under this contract in accordance with the FAR Subpart 44.2. The Government reserves the right to accept or reject any subcontractors proposed. Contractors should not serve as the escort for their subcontractors or for any other contractor; escorts used should be Departmental Federal employees.

The Contractor is responsible for obtaining the approval of the CO prior to release of any information received or generated under the contract per 48 CFR 252.204-7000. The CO should complete this item as required by internal agency directives to direct the prime contractor to the appropriate office that has public release authority. Prime contractors should serve as focal point for their subcontractors’ public release requests and refer them to the CO. SBU (also known as Controlled Unclassified Information (CUI)) must be protected in accordance with EO 13556, 32 CFR 2002 (full implementation expected to be reached in November 2018), and Treasury Security Manual (TD P 15-71). For Official Use Only must be protected in accordance with the providing Agency’s directives. Data contained within all Department computer systems are governed by Agency Security Regulations as well as the Federal Privacy Act of 1974.

Contractor personnel assigned to this project will be held accountable for adherence to these regulations. If the security classification or security requirements are changed by the Government subsequent to the date of this Contract, and if the changes cause an increase or decrease in security costs or otherwise affects any other term or condition of this Contract, any resulting financial burden will be the sole responsibility of the Contractor.

Contractors and their subcontractors must perform all initial, annual, contemporaneous, specialized and termination training required per Department guidance and TD P 15-71 as appropriate for their position. This is in addition to any training their company requires them to have.

Per the TD P 15-71, the Contractor shall report to the COR within 24 hours any adverse information coming to its attention concerning employees working under this contract, to include loss or suspension of favorable adjudication, or security issues involving the scope being completed for the contract. Reports based on rumor or innuendo should not be made. The subsequent termination of an employee does not obviate the requirement of the contractor to submit this report. The report shall include each employee’s name, social security number, and the adverse information. The Contractor shall also report within 24 hours any event the Contractor becomes aware of that would be deemed a potential security incident, violation or any compromise involving Treasury systems, material, or data or systems with Treasury material or data on them. The Contractor shall comply with all Federal laws and regulations regarding computer security, information security and privacy.

While the Contractor’s personnel are at the government facility, the Contractor is responsible for compliance with all laws, rules, and regulations governing conduct with respect to security – not only as they relate to its employees and agents, but also to other personnel who are government employees or agents of the government and to property at the site regardless of ownership. While on government premises and in possession of government property, the Contractor is responsible for such property and any damages or compromise thereto by Contractor’s employees. The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions, and in the safeguarding of pre-decisional or sensitive information (privacy, etc.) from inadvertent release. At the completion of the contract vehicle, the Contractor shall send a written notice from the authorized principle of the company attesting that all file records pertaining to this contract in possession of the Contractor was destroyed.

The contractor will avoid any improprieties located in FAR Part 3 and 52.203-16 regarding gratuities, kickbacks, conflicts of interest and other ethics issues.

Work on this contract may require personnel to have access to private information covered by the Privacy Act, Title 5 of the U.S. Code, Section 552a (in addition to other types of non-public information). All Contractor personnel shall adhere to the requirements of the Privacy Act as well as any applicable Department or Federal rule/regulation regarding private information or other types of non-public information.

As a condition for access for Government‐Owned Systems and data, all Contractor personnel must pass background investigations in accordance with OMB Circular A‐130 which requires screening of all individuals involved with sensitive applications or data in Federal automated information systems.

Contractor will abide by requirements set forth in the applicable guidance for the protection of unclassified information. If Contractor fails to follow requirements above, this may result in revocation of favorable public trust adjudication for offending employees and potential negative actions against the contract vehicle itself.

Per FAR 52.222-54, the contractor is required to comply with enrollment and verification requirements for all contractors except those previously verified by acceptable means.

The contractor agrees and understands that the latest version (if superseded) of the

U.S.C., CFRs, Executive Orders, Treasury policies and all other government issued documents that are referenced above will be followed.