Attachment 2 Draft PBAC_PWS_1.21.25.doc

Performance Work Statement (PWS)

Parcel Based Address Correction

U.S. Department of Homeland Security

Federal Emergency Management Agency

Recovery Technology Programs Division

January 21st, 2025

Table of Contents General

1.1 Background

1.2 Scope

Specific Requirements/Tasks

2.1 General Requirements

2.2 Interface and Data Requirements

Other Applicable Conditions

3.1 Period of Performance

3.2 Place of Performance

3.3 Travel

3.4 Post Award Conference

3.5 Project Plan

3.6 Business Continuity Plan

3.7 Progress Reports

3.8 Progress Meetings

3.9 Invoice Summary Report

Government Furnished Resources

Transition Plan

Quality Assurance Surveillance Plan

Performance Requirements Summary (PRS)

Contractor Staffing Plan and Key Personnel

Support and Technical Assistance Plan

Deliverables/Schedule

Security Insider Threat Training Foreign Travel and Government-Issued Equipment Background Investigations Facility Access “For Official Use Only” (FOUO) Information

Unauthorized Disclosure of Classified or Unclassified Information PIA/SORN Coverage Language

Glossary and Acronyms Appendix A: Current “As Is” Description

Appendix B: Data Transfer and Interface Design

1. General

1.1 Background

The Federal Emergency Management Agency (FEMA) provides disaster relief and emergency assistance to survivors through various channels, including toll-free call centers and online applications via DisasterAssistance.gov. FEMA tracks disaster assistance and operations using the National Emergency Management Information System (NEMIS), which manages the registration information of disaster survivors applying for Individual Assistance (IA). This system helps FEMA issue grants and other aid to individuals or families affected by disasters.

During the registration intake process, FEMA receives addresses in various formats and qualities, and it relies on a reliable resource for address correction and standardization to ensure accurate and timely assistance. Corrected address data supports FEMA's efforts to improve address-related processes, reduce manual operations, achieve postal savings, and enhance its floodplain determinations, geocoding, and spatial analysis. This capability is also vital for making automated eligibility determinations and advancing program innovations like virtual inspections, which verify damage claims without requiring on-site visits.

1.2 Scope

FEMA is seeking transactional-based data services that involve the exchange of data between FEMA and the contractor. The required services include:

· Address Correction and Standardization: Correcting addresses to the parcel level, including geocoding, which is the process of converting a text-based description of a location into geographic coordinates.

· Flood Mapping: The process of creating maps that show the likelihood of flooding in an area and assessing flood risks based on corrected addresses.

· Parcel Data: Providing non-spatial attribute data linked to corrected parcel numbers, for example ownership, acreage, boundaries, and usage.

· Reverse Address Lookup: Identifying addresses from geospatial data.

These services must integrate with FEMA’s existing Java Address Correction Service (JACS).

Quality of data is of high importance to FEMA, as is the frequency with which it is updated. FEMA requires the contractor to:

· Discuss data sources and how data is maintained.

· Provide a data sampling in the format and test interface.

· Identify the sourcing of the seeded database by providing the states, county and zip codes completing their repository (library) of data available to FEMA. Data from CONUS and OCONUS (includes American Samoa, Guam, Marianas, Puerto Rico, U.S. Virgin Islands) areas of the United States is required.

FEMA also requires access to a testing service during implementation and for continued testing through updates to FEMA’s systems.

FEMA currently uses Federal Information Processing Standards (FIPS) data; however, we continue to evolve and may be directed to or choose to implement a different standard in the future. The Contractor shall describe all other standards which can be supported.

2. Specific Requirements/Tasks

2.1 General Requirements

FEMA may request data transactions at various stages of the Individual Assistance (IA) process, such as during registration, inspections, or when processing address data. These transactions involve FEMA transmitting raw or uncorrected data to a contractor, who then provides a response back to FEMA. Address corrections are performed either during the initial registration or later in the case processing. Timely and reliable data services are crucial for FEMA’s operations, particularly given the unpredictable surge model they work under. While there may be periods of little activity, following a major disaster like a hurricane or earthquake, FEMA could require processing tens of thousands of registrations per day, necessitating a service capable of handling high volumes of work on short notice.

The contractor’s service(s) shall:

2.1.1 Leverage a high availability architecture and hot standby capability.

2.1.2 At time of award and thereafter, make the testing of the process and protocols available to predict the accuracy rates and compliance with industry best practices to meet or exceed the performance standards. The Contractor shall have a test interface and a set of test transactional data that will enable FEMA to validate that its requirements are met, and to aid in regression testing application changes that may not involve changes to the Contractor's interface.

2.1.3 Support a daily load capacity of 2,000 transactions per day and a surge capacity of up to 500,000 transactions per day and 50,000 transactions per hour during disasters.

2.1.4 Maintain 24x7 availability and 99.9% uptime.

2.1.5 Maintain a response time per transaction of six (6) seconds or less.

2.1.6 Maintain an accuracy rate of 99% or better for all transactions.

2.1.7 Accurately update data sets, preferably monthly, but quarterly will be acceptable. (OCONUS & CONUS updates) 2.1.8

Be Coding Accuracy Support System (CASS) certified and ensure address corrections follow the standard. CASS enables the Postal Service to evaluate the accuracy of address-matching software programs in three areas:

a. ZIP+4 delivery point coding

b. Carrier route coding

c. Five-digit coding CASS allows Contractors/mailers the opportunity to test their address verification software packages and after achieving a certain percentage of compliance, to be CASS certified by the Postal Service.

CASS does not measure the accuracy of ZIP+4 delivery point, five-digit ZIP, or carrier route codes in a mailer’s existing files. CASS enables mailers to measure and diagnose internally written, commercially available, address verification software packages.

2.1.9 Supply accurate attribution on 99% of parcel data.

2.1.10

Return parcel-level accuracy of Geocoded addresses more than 95% of the time.

2.1.11

Incorporate DPV (delivery point validation) and supply geocoded data with a DPV rate of 95%. DPV verifies whether the USPS can deliver to the doorstep of an address and returns a y/n. This helps eliminate range-based validation, which does not certify whether an actual structure bearing the address exists.

2.1.12 Incorporate the Locatable Address Conversion System (LACS). LACS keeps track of addresses that have been updated to match a national standard. This is crucial for emergency services nationwide.

2.1.13 Accept data parameters in from FEMA which include an applicant’s Street Address, City, State and Zip. Also accept GPS Coordinate (Lat/Long) as a parameter in.

2.1.14 Return appropriate data parameters back to FEMA based on the type of service call as explained in detail below in section 2.2:

2.2 Interface and Data Requirements

FEMA seeks multiple data transaction calls as explained in further detail in this section.

FEMA’s Java Address Correction Service (JACS) system uses both Representational State Transfer (REST) and Simple Object Access Protocol (SOAP) based web services.

The JACS interface uses SOAP to perform address corrections, get suggested addresses, and get flood plain mapping information. The Contractor’s solution shall work with FEMA’s JACS system interface and ensure that all transactions take the provided street address, city, state and zip code information or GPS coordinates as a parameter and return the general information as described in the table below:

Interface Descriptions

Parameters In: addressLine, lastLine Returns: An AddressCorrection object if successful; an Exception otherwise.

Parameters In: addressLine, lastLine

Returns: FloodPlainLookup

Parameters In: addressLine, lastLine

Returns: ParcelLookup

The individual and batch transactions take a GPS (or batch of) coordinate as a parameter and returns the information documented below. The polygon transaction takes several GPS coordinates that make up a polygon and returns individual records with the information documented below for all properties within the polygon. The ReverseAddressLookup functionality is not tied to a specific system and will be used by groups conducting preliminary damage assessments.

Parameters In: GPS Coordinate (Lat/Long)

Returns: Address and ParcelLookup

Specific data transaction parameters are further outlined below:

getAddressCorrection Parameter IN

e.g., Fort Lauderdale, FL

Parameter OUT

AddressCorrection

PostalAddress

e.g., FORT LAUDERDALE, FL 33309-1812

AS0 – Best location

AS1 – Street side is unknown.

E – Indicates no location is available

Z – Corrected to zip code level as address was not located

Code indicating any changes made to input address.

The match code is an alpha-numeric code that encapsulates information about the address standardization process – including whether a match was found, information about the type of match found (when applicable), and information about why no match was found (when applicable).

S00 – No change in last line or address line

S80 – ZIP+4 was changed.

S90 – ZIP and ZIP+4 was changed

example: 12-digit FIPS code is 010010210001 where 01 = State; 001 = County; 021000 = Census Tract ID; & 1 = Census Block Group

getFloodPlain Parameter IN

e.g., Fort Lauderdale, FL

East_Bounding_Coordinate, North_Bounding_Coordinate, South_Bounding_Coordinate, State, District

FloodPlainLookup

FloodZone

ANI

AR-

B, BE, BX

C, CE, CX

D

FW, FWIC

IN

NM

OUT

UNDES

V, VE

X, X5, X500, X500IC

A1-A30, V1-V30

V0

N

Z

CBNP – Community base – Panel not printed.

CWPP – Countywide – Panel printed.

CWNP – Countywide – Panel not printed.

AOPN – Area outside FIRM panel neatline

UNMC – Unmapped community

EASE – Flowage Easement Area

STATE – State Encroachment area

getParcel Parameter IN

e.g., Fort Lauderdale, FL

ParcelLookup

Parcel

2=Masonry

2=Siding (Alum/Vinyl)

3=Brick

8=Concrete

12=Masonry

**APN ID and FIPS Code values are used to find others, which may or not exist, therefore, they can be NULL.

ReverseAddressLookup Parameter IN

ParcelLookup

Parcel

2=Masonry

2=Siding (Alum/Vinyl)

3=Brick

8=Concrete

12=Masonry

*Acceptable values or format (if applicable) identified in the tables above meet current system requirements. If values/format are not able to be satisfied, then offer shall address recommended value and formats.

**APN ID and FIPS Code values are used to find others, which may or not exist, therefore, they can be NULL.

3. Other Applicable Conditions

3.1 Period of Performance

The period of performance for this contract is a one-year base period followed by four one-year option periods.

3.2 Place of Performance

The primary place of performance will be the Contractor’s facilities.

3.3 Travel

No travel is anticipated at this time.

3.4 Post Award Conference

The Contractor shall attend a Post Award Conference with the Contracting Officer and the COR no later than ten (10) business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility or via teleconference.

3.5 Project Plan

The Contractor shall provide a draft Project Plan at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan to the COR not later than ten (10) business days after the Government has reviewed the draft Project Plan and returned it to the contractor for finalization.

3.6 Business Continuity Plan

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government. The BCP Plan shall be due ten (10) business days after the date of award and will be updated on an annual basis. The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following:

· A description of the Contractor’s emergency management procedures and policy.

· A description of how the Contractor will account for their employees during an emergency/disaster that may impact the Contractor.

· How the Contractor will communicate with the Government during emergencies.

· A list of Contractor points of contact for all Key Personnel, each with primary and alternate:

· Telephone numbers

· E-mail addresses

Individual BCPs shall be activated immediately after determining that an emergency/disaster that may impact the Contractor has occurred, shall be operational within 24 hours of activation or as directed by the Government, and shall be sustainable until the emergency is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately contact the Contractor Project Manager to ascertain the status of any Contractor personnel who were in Government controlled space affected by the emergency. When any disruption of normal, daily operations occurs, the Contractor Project Manager and the COR shall promptly open an effective means of communication and verify:

· Key points of contact (Government and contractor).

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.).

· Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.).

· Essential Contractor work products expected to be continued, by priority.

The Government and Contractor Project Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract and resulting call orders.

3.7 Progress Reports

The Project Manager shall provide a weekly progress report to the COR and Contracting Officer via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of transaction quantities by transaction category, and all direct costs by line item, for the previous week’s activity.

The Project Manager shall also provide a monthly progress report to the COR and Contracting Officer via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of transaction quantities by transaction category, all direct costs by line item, an assessment of technical progress, schedule status, and travel conducted and any Contractor concerns or recommendations for the previous reporting period. The report shall be provided the end of the 5th workday of each month for the previous month’s work.

3.8 Progress Meetings

The Contractor Project Manager shall be available to meet with the COR upon request to present deliverables, discuss progress, exchange information, and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

The Contractor Project Manager shall be responsible for keeping the COR informed about Contractor progress throughout the performance period of this contract and ensure Contractor activities are aligned with DHS objectives. At a minimum, the Contractor Project Manager shall review the status and results of Contractor performance with the COR monthly by email.

3.9 Invoice Summary Report

At the time of the billing, the Contractor shall submit a transaction summary and running accumulation report to support the monthly billed activity. File content, format and delivery method will be determined at the time of the award.

4. Government Furnished Resources

The Contractor shall use Government furnished information, data, and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data, and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data, and documents to outside parties without the prior and explicit consent of the Contracting Officer (See also Appendix C: Records Management Obligations).

5. Transition Plan

A transition from the current service provider within ninety (90) days from award of contract is required. Transition is defined as a seamless operation on a non-interference and non-interruption-in-services basis. The Contractor shall finalize a Transition Plan five (5) days after award. The Plan will address all facets of the transition that the Offeror deems important but, at a minimum, should address the timeline, actions, responsibilities, and the processes for transition, including adjusting to surge requirements on a 24/7 basis, should a disaster strike at the same time the transition takes place.

6. Quality Assurance Surveillance Plan

The Government will provide the Contractor a Quality Assurance Surveillance Plan (QASP). The Contractor’s performance will be monitored against specified performance measures outlined in the PWS.

6.1 Column 1 - Selected Service Performance Area (SSPA).

Lists the SSPA on which the Government will perform surveillance. The absence of any contract requirement from the PRS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provisions of the contract.

6.2 Column 2 - Standard.

Defines the standards of performance for each listed SSPA.

6.3 Column 3 - Performance Requirement.

Sets forth the maximum allowable deviation from standard performance for that service that may incur before the Government will invoke the payment computation formula, resulting in a deduction for unsatisfactory performance, or non-compliance with the contract.

6.4 Column 4 - Method of Surveillance.

Sets forth the surveillance methods the Government will use to evaluate the Contractor's performance for the listed tasks.

7. Performance Requirements Summary (PRS)

The Contractor shall perform all requirements outlined in this PWS and achieve the performance standards for each function of the operation as described below. These requirements are critical to mission success.

2. Periodic surveillance

3. Management reports

1. Random sampling

3. Management reports

3. Monthly invoices

Keep services accessible (Availability and Uptime)

A COOP plan shall be in place to ensure service is available.

1. Random sampling

2. Periodic surveillance

3. Management Reports

4. Contractor reports

8. Contractor Staffing Plan and Key Personnel

Contractor shall submit a Contractor Staffing and Key Personnel Plan outlining personnel involved in the project and their respective responsibilities. The Contractor’s Key Personnel shall have an organizational structure designated to interact with FEMA personnel. The Contractor shall include a Data QA/QC Liaison in addition to an Account/Project manager, a Data/Technical Lead, a Security Manager, and a Federal Contract Manager. Changes in the positions shall be provided to FEMA when they occur. Below is an example organizational chart depicting Key Personnel positions for this PWS.

Key Personnel Organizational Chart

Key Personnel

(a) The personnel described above are considered essential to the work being performed under this contract and may, with the consent of the contracting parties, be changed from time to time during the contract by adding or deleting personnel as appropriate.

(b) Before removing or replacing any of the specified individuals, the Contractor shall notify the Contracting Officer and Contracting Officer’s Representative, in writing, before the change becomes effective. The Contractor shall submit sufficient information to support the proposed action and to enable the Contracting Officer and Contracting Officer’s Representative to evaluate the potential impact of the change on this contract. The Contractor shall not remove or replace personnel until the Contracting Officer approves the change.

9. Support and Technical Assistance Plan

9.1 The Contractor shall provide a plan which identifies training and guidance documents for either their transaction-based service or their data.

9.2 The Contractor shall provide a plan which identifies QA/QC management including a process for problem identification and remediation and provisions for non-timely compliance.

9.3 The Contractor shall identify their proposed method for resolving issues identified during operations.

9.4 The Contractor shall demonstrate the ability to collaborate with FEMA during disaster activity.

10. Deliverables/Schedule

The contractor shall assist with and/or consult with the Contracting Officer Representative (COR), Program Manager (PM), and/or System Owner (SO) to ensure the appropriate Privacy Act Threshold Analysis (PTA), Privacy Impact Analysis (PIA), and system documentation documents are submitted and approved by FEMA and DHS Privacy organizations prior to the collection of Personally Identifiable Information (PII) related information associated with the services and/or technology included in this solicitation.

Deliverables are due to the Contracting Officer (CO), Contracting Officer’s Representative (COR), and Program Manager (PM) as reflected below:

11. Security A Security Plan which outlines the security policies, protocols, and controls related to the project is required. Personal identifiable information shall be made available to the Contractor through actions in the performance of the contract. The Contractor shall identify the method to safeguard personal identifiable information.

All personnel require access to information up to the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure contractor employees receive a favorably adjudicated public trust suitability prior to entry on duty (EOD). All individuals will be U.S. citizens. The contractor shall follow the standards established within DHS and FEMA policy.

12. Insider Threat Training Insider Threat training for Contractors can be found at: Insider Threat Awareness (usalearning.gov) Certificate of training is required for all cleared contractor employees who are working with classified or unclassified information. All certificates must be sent to the assigned FEMA Contracting Officer Representative, before the Contractor or Subcontractor is granted access to classified or unclassified information but no later than 30 calendar days after awarded contract. All cleared contractor personnel are required to recertify Insider Threat training annually thereafter. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

13. Foreign Travel and Government-Issued Equipment

Per DHS and FEMA IT policy, FEMA employees and contractors are not authorized to take government-issued equipment, including cell phones, computers, or tablets such as iPads, outside of the United States regardless of the reason for travel. If government-issued equipment is required for official foreign travel, FEMA government employees may request a temporary loaner device through the Mobility Service Center.Office of the Chief Information Officer, Service Center for the duration of their trip. FEMA contractors must contact their contracting officer’s representative (COR) for further guidance.

If your device is detected as operating outside of the United States and its territories it will be disabled, and your information will be forwarded to the Office of Professional Responsibility for review.

14. Background Investigations All contractor personnel who require access to DHS or FEMA information systems, routine access to DHS or FEMA facilities, or access to sensitive information, including but not limited to Personally Identifiable Information (PII), shall be subject to a full background investigation commensurate with the level of the risk associated with the job function or work being performed. FEMA’s Personnel Security Division (PSD) will determine the risk designation for each contractor position by comparing the functions and duties of the position against those of a same or similar federal position, applying the same standard for evaluating the associated potential for impact on the integrity and efficiency of federal service.

Low Risk without Information System Access

Contractor personnel occupying positions or performing functions with a Low-Risk designation and who do not require access to DHS or FEMA information systems may undergo a Tier 1 investigation with a credit check and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

(Also reference Facility Access)

Low Risk with Information System Access

Contractor personnel occupying positions or performing functions with a Low-Risk designation and who require access to DHS or FEMA information systems shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Moderate Risk

Contractor personnel occupying positions or performing functions with a Moderate Risk designation shall undergo a Tier 2 Suitability Background Investigation (T2) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

High Risk

Contractor personnel occupying positions or performing functions with a High-Risk designation shall undergo a Tier 4 Suitability Background Investigation (T4) and must receive a favorable adjudication thereof from FEMA PSD prior to performing work under this contract.

Background Investigation Process

To initiate the request to process contractor personnel, the Contractor shall provide the FEMA Contracting Officer’s Representative (COR) with all required information and comply with all necessary instructions to complete Section II of the FEMA Form 121-3-1-6, “Contract Fitness/Security Screening Request.” The FEMA COR shall ensure that all other applicable sections of the FEMA Form 121-3-1-6 are complete prior to submitting the form to FEMA PSD for processing. The Contractor shall also provide the FEMA COR with completed OF 306, “Declaration for Federal Employment,” forms for all contractor personnel.

Contractor personnel who already have a favorably adjudicated background investigation, may be eligible to perform work under this contract without further processing by FEMA PSD if:

· the investigation was completed within the last five years,

· it meets or exceeds the minimum requirement for the position they will occupy or functions they will perform on this contract,

· the contractor personnel have not had a break in employment since the prior favorable adjudication, and,

· FEMA PSD has verified the investigation and confirmed that no new derogatory information has been disclosed which may require a reinvestigation.

FEMA PSD will notify the COR of the names of the contractor personnel eligible to work based on prior, favorable adjudication. The COR will, in turn, notify the Contractor of the names of the favorably adjudicated contractor personnel, at which time the favorably adjudicated contractor personnel will be eligible to begin work under this contract.

For those contractor personnel who do not have an acceptable, prior, favorable adjudication or who otherwise require reinvestigation, FEMA PSD will issue an electronic notification via email directly to the contractor applicant/personnel that contains the following documents, which are incorporated into this contract by reference, along with a link to the Office of Personnel Management’s (OPM) Electronic Questionnaires for Investigation Processing (e-QIP) system and instructions for submitting the necessary information:

· Standard Form 85P, “Questionnaire for Public Trust Positions”

· Optional Form 306, “Declaration for Federal Employment”

· SF 87, “Fingerprint Card” (2 copies)

· DHS Form 11000-6, “Non-Disclosure Agreement”

· DHS Form 11000-9, “Disclosure and Authorization Pertaining to Consumer Reports Pursuant to the Fair Credit Reporting Act”

FEMA PSD will only accept complete packages consisting of all of the above document and Standard Form 85P, which must be completed electronically through the Office of Personnel Management’s e-QIP system. The Contractor is responsible for ensuring that all contractor personnel timely and properly submit all required background information.

Once contractor personnel have properly submitted the complete package of all required background information, FEMA’s Personnel Security Division, at its sole discretion, may grant contractor personnel temporary eligibility to perform work under this contract prior to completion of the full background investigation if the Personnel Security Division’s initial review of the contractor personnel’s background information reveals no issues of concern. In such cases, FEMA’s Personnel Security Division will provide notice of such temporary eligibility to the COR who will then notify the Prime Contractor, at which time the identified contractor personnel will be temporarily eligible to begin work under this contract. Neither the Prime Contractor nor the contractor personnel have any right to such a grant of temporary eligibility. The grant of such temporary eligibility shall not be considered as assurance that the contactor personnel will remain eligible to perform work under this contract upon completion of and final adjudication of the full background investigation.

Upon favorable adjudication of the full background investigation, FEMA’s Personnel Security Division will update the contractor personnel’s security file and take no further action. In any instance where the final adjudication results in an unfavorable determination FEMA’s Personnel Security Division will notify the contractor personnel directly, in writing, of the decision and will provide the COR with the name(s) of the contractor personnel whose adjudication was unfavorable. The COR will then forward that information to the Contractor. Contractor personnel who receive an unfavorable adjudication shall be ineligible to perform work under this contract. Unfavorable adjudications are final and not subject to review or appeal.

Continued Eligibility and Reinvestigation

Eligibility determinations based on a Low Risk T1, Moderate Risk T2S or High Risk T4 are valid for five years from the date that the investigation was completed and closed. Contractor personnel required to undergo a background investigation to perform work under this contract shall be ineligible to perform work under this contract upon the expiration the background investigation unless and until the contractor personnel have undergone a reinvestigation and FEMA’s Personnel Security Division has renewed their eligibility to perform work under this contract.

Exclusion by Contracting Officer

The Contracting Officer, independent of FEMA’s Personnel Security Division, may direct the Contractor be excluded from working on this contract. Any contractor found or deemed to be unfit or whose continued employment on the contract is deemed contrary to the public interest or inconsistent with the best interest of the agency may be removed.

15. Facility Access The Contractor shall comply with FEMA Directive 121-1 “FEMA Personal Identity Verification Guidance,” FEMA Directive 121-3 “Facility Access,” and FEMA Manual 121-3-1 “FEMA Credentialing Access Manual,” to arrange for contractor personnel’s access to FEMA facilities, which includes, but is not limited to, arrangements to obtain any necessary identity badges for contractor personnel.

Contractor personnel working within any FEMA facility who do not require access to DHS or FEMA IT systems and do not qualify for a PIV Card may be issued a Facility Access Card (FAC). FACs cannot exceed 180 days; all contractors requiring access greater than 180 days will need to qualify for and receive a PIV card before being allowed facility access beyond 180 days.

Contractor personnel shall not receive a FAC until they have submitted a SF 87, “Fingerprint Card,” and receive approval from FEMA PSD. Contractor personnel using a FAC for access to FEMA facilities must be escorted in Critical Infrastructure areas (i.e., server rooms, weapons rooms, mechanical rooms, etc.) at all times.

FEMA may deny facility access to any contractor personnel whom FEMA’s Office of the Chief Security Officer has determined to be a potential security threat.

The Contractor shall notify the FEMA COR of all terminations/resignations within five calendar days of occurrence. The Contractor must account for all forms of Government-provided identification issued to contractor employees under a contract (i.e., the PIV cards or other similar badges) must return such identification to FEMA as soon as any of the following occurs:

· When no longer needed for contract performance.

· Upon completion of a contractor employee’s employment.

· Upon contract completion or termination.

If an identification card or building pass is not available to be returned, the Contractor shall submit a report to the FEMA COR, referencing the pass or card number, name of the individual to whom it was issued, and the last known location and disposition of the pass or card.

The Contractor or contractor personnel’s failure to return all DHS- or FEMA-issued identification cards and building passes upon expiration, upon the contractor personnel’s removal from the contract, or upon demand by DHS or FEMA may subject the contractor personnel and the Contractor to civil and criminal liability.

16. “For Official Use Only” (FOUO) Information

In accordance with DHS Management Directive 11042.2 contractors, consultants and others to whom access is granted will abide by 11042.2; DHS policy regarding the identification and safeguarding of sensitive but unclassified information originated within DHS. It also applies to other sensitive but unclassified information received by DHS from other government and non-governmental activities. The contractor will:

1. Be aware of and comply with the safeguarding requirements for “For Official Use Only” (FOUO) information as outlined in this directive.

2. Participate in formal classroom or computer-based training sessions presented to communicate the requirements for safeguarding FOUO and other sensitive but unclassified information.

3. Be aware that divulging information without proper authority could result in administrative or disciplinary action.

Contractors and Consultants shall:

Execute a DHS Form 11000-6, Sensitive but Unclassified Information Non Disclosure Agreement (NDA), as a condition of access to such information. Other individuals not assigned to or contractually obligated to DHS, but to whom access to information will be granted, may be requested to execute an N DA as determined by the applicable program manager. Execution of the N DA shall be effective upon publication of this directive and not applied retroactively.

17. Unauthorized Disclosure of Classified or Unclassified Information

All contractors and subcontractors are required to train on Unauthorized Disclosure of Classified or Unclassified Information to perform duties established by the Government during the performance period of and execution of this contract.

Access to the training can be obtained at:

Unauthorized Disclosure of Classified Information and Controlled Unclassified Information Send the certificate of completion to the FEMA Contracting Officer Representative no later than 30 calendar days after awarded contract. New employees entering the contract must receive the briefing within ten (10) business days of joining the contract.

18.PIA/SORN Coverage Language

To accomplish the tasks outlined in this contract, FEMA will provide the contractor access to Individual Assistance/ National Emergency Management Information System (NEMIS) which includes all PII/SPII collected in NEMIS.

The information sharing outlined in this contract is authorized by the following System of Records Notice(s) and Routine Use(s):

DHS/FEMA-008 - Disaster Recovery Assistance Files. 87 Fed. Reg. 7852 (February 10, 2022); Routine Use F.

The information sharing outlined in this contract is authorized by the following Privacy Impact Assessments:

DHS/FEMA/PIA-059 Individual Assistance (IA) Systems Need to Know The contractor will limit access to the PII provided by FEMA under this contract only to the contractor’s authorized personnel who need to know the information to accomplish the tasks outlined in this contract.

Prohibition on Computer Matching The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(a)(8), will occur for the purpose of establishing in or verifying eligibility or compliance as it relates to cash or in-kind assistance or payments under federal benefit programs.

Recipient Requirement If at any time during the term of this contract any part of FEMA PII, in any form, that the contractor obtains from FEMA ceases to be required by the contractor for the performance of the contract, or upon the termination of the contract, whichever occurs first, the contractor shall, within fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at FEMA’s written request destroy, un-install and/or remove all copies of such PII in the contractor’s possession or control, and certify in writing to FEMA that such tasks have been completed.

19. Glossary and Acronyms

Glossary