Attachment 4 - Statement of Work.pdf

U.S. Forest Service Chief Information Office

Hardware and Firmware Maintenance Support

Statement of Work 7/5/2024

Contents

1. Introduction

2. Business Requirements

3. Scope of Work

4. Technical Requirements

5. Period of Performance

6. Deliverables

Hardware and Software License Line Item Data

a. Deliverable Schedule:

b. Applicable Documents:

7. Equipment

8. Section 508 – Accessibility of Information and Communications Technology

Section 508 Compliance

WCAG 2.0 Compliance

9. IPv6 Requirements

10. Contract Officer Representative

11. Security Language for All Contracts/Agreements

12. Copyright Management and Responsibility

1. Introduction Established in 1905, the Forest Service (FS) is a federal agency that manages public lands in national forests and grasslands under a founding principle, "To provide the greatest amount of good for the greatest amount of people in the long run". The agency’s mission is to “sustain the health, diversity, and productivity of the Nation’s forests and grasslands to meet the needs of present and future generations”. The FS has the responsibility for stewardship of more than 193 million acres of the nation’s forests and grasslands; for developing and communicating scientific knowledge through research and development that leads to informed natural resource decision-making; for delivering technical assistance through state and private forestry programs; and for sharing knowledge and experience with others in the global community through international forestry. Performing this mission requires a strong and effective network of operational and administrative support.

The United States Forest Service (FS) Chief Information Office (CIO) requires Dell ME5084 Storage Array Hardware and Firmware Maintenance and Support services.

2. Business Requirements The Dell ME5084 Storage Array Hardware and Firmware Maintenance and Support services. is an integral part of the National Enterprise Support Service (NESS) and requires 24 by 7 support.

The U.S. Forest Service (FS) requires the acquisition of Hardware and Firmware Maintenance and Support services for the Dell ME5084 Storage Array located at the two data centers where Fire-IT National Enterprise Support Service (NESS) houses this equipment. The Dell ME5084 Storage Array Hardware and Support services will support the National Enterprise Support Service (NESS) environment at the Earth Resource Observation and Science Center (EROS), Sioux Fall SD. and Digital Infrastructure Service Center (DISC) Kansas City MO. This contract will provide much need stability and failover capability to the NESS high availability environment that supports multiple fire applications.

3. Scope of Work The U.S. Forest Service (FS) requires acquisition of Dell ME5084 Storage Array Hardware and Firmware Maintenance and Support and applicable requirements. The contractor shall provide all equipment, tools, materials, supervision, other items, and non-personal service necessary to provide Dell ME5084 Storage Array Hardware and Firmware Maintenance and Support services.

The task includes service and maintenance of necessary hardware and firmware.

4. Technical Requirements The contractor shall provide Hardware and Firmware Maintenance and Support services for the following hardware:

Product Type Serial Number

Unit Quantity

Dell ME5084 Storage Array

210-BBSE

EA 2

Dell Hardware Limited Warranty

871-8133

ProSupport Mission Critical 4-Hour 7X24 Onsite Service with

Emergency Dispatch 3 Years

871-8139

ProSupport Mission Critical 7X24 Technical Support and Assistance 3 Years

871-8140

Thank you choosing Dell ProSupport. For tech support, visit //www.dell.com/support or call 1-800-945-3355

989-3439

Keep your Hard Drive For Enterprise 3 Years

843-9832

ProDeploy Dell EMC Storage ME 5xxx 5U

871-8200

Dell ME5084 Shipping

340-DCFX

Dell PowerVault ME Series 5U-84, CE Marking

389-EERR

32Gb FC Type-B 8 Port Dual 5U Controller

403-BCPV

22TB Hard Drive SAS ISE 12Gbps 7.2K 512e 3.5in Hot-Plug AG

400-BPBC

EA 56

Rack Rails 5U

770-BCVH

Power Supply, 2200W, Redundant, WW

450-ALXP

C19 to C20, PDU Style, 2.5M Power Cord

450-AEJI

C19 to C20, PDU Style, 2.5M Power Cord

450-AEJI

2X SFP+, FC32, 32GB

492-BDCW

5. Period of Performance The contractor shall provide Hardware and Firmware Maintenance and Support services for the following Period of Performance:

10/01/2024 – 09/30/2024 with a 3 Year Warranty

6. Deliverables Hardware and Software License Line-Item Data

In accordance with Office of Management and Budget Memorandum M-16-12, Category Management Policy 16-1: Improving the Acquisition and Management of Information Technology: Software Licensing, USDA must maintain an inventory of its software licenses, including pricing data. The contractor shall provide line item pricing data on all software licenses provided to USDA at award and/or during performance of the contract/order. The attachment entitled “Software Template Line Item Pricing” must be completed and provided to the Contracting Officer’s Representative within 10 days of award, or within 10 days of activation for licenses provided after the award date.

a. Deliverable Schedule:

Deliverables:

- All licenses will be functional upon the date of delivery

- All software maintenance will be operational upon the date of award

Deliverable Submitted to: Due Date:

Hardware/Software Line Item Pricing

Contracting Officer’s Representative

Within 10 Days of Award, or Within 10 Days of Software Activation for Licenses Provided After Award Date

b. Applicable Documents:

The attached spreadsheet template with line item pricing of software will be delivered electronically to the COR listed below.

7. Equipment There is no government equipment furnished for this effort.

8. Section 508 – Accessibility of Information and Communications Technology

(a) This SOW is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). Specifically, subsection

508(a)(1) requires that when the Federal Government procures Information and Communications Technology (ICT)1, the ICT must allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities.

(b) The ICT accessibility standards as 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board (also known as the Access Board) and apply to contracts, task orders, and indefinite quantity contracts on or after June 25, 2001.

(c) Each Information and Communications Technology (ICT) product or service furnished under this contract shall comply with the Information and Communications Technology Accessibility Standards (36 CFR 1194), as specified in the contract, at a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within a period of time specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

1) Cancellation of the contract, delivery, or task order, purchase or line item without termination liabilities; or

2) In the case of custom Information and Communications Technology (ICT) being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the non-compliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

(d) The contractor must ensure that all ICT products and services that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.

(e) For every ICT product or service accepted under this contract by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

Section 508 Compliance

The Dell ME5084 Storage Array Hardware/Software shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this SOW, the SOW shall take precedence.

1 Please note that the term Information and Communications Technology (ICT) is synonymous with Electronic and Information Technology (EIT), the previously used term.

The term ICT will be used to meet international standards after the release of the Section 508 Refresh.

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

3) http://www.access-board.gov/sec508/508standards.htm (Section 508 standards)

4) FAR 39.2 (Section 508)

5) http://www.ocio.usda.gov/document/departmental-regulation-4030-001 (USDA standards, policies, and procedures for Section 508)

In addition, all contract deliverables are subject to these standards.

All web content or communications materials produced, regardless of format (text, audio, video, etc.), must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities comparable access to and use of information and data provided to Federal employees and members of the public without disabilities. All contractors (including sub-contractors) and consultants responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document above. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW shall be the responsibility of the contractor or consultant.

The following Section 508 provisions apply to the products and/or services identified in this

SOW:

• 36 CFR Part 1194.21 provisions a-l

• 36 CFR Part 1194.22 provisions a-p

• 36 CFR Part 1194.23 provisions a-k[4]

• 36 CFR Part 1194.24 provisions a-e

• 36 CFR Part 1194.25 provisions a-j[4]

• 36 CFR Part 1194.26 provisions a-d

• 36 CFR Part 1194.31 provisions a-f

• 36 CFR Part 1194.41 provisions a-c

The following Section 508 provisions apply for software development material identified in this SOW:

For software development, software applications, and operating systems the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended) http://www.access-board.gov/sec508/508standards.htm http://www.ocio.usda.gov/document/departmental-regulation-4030-001

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c

For web-based applications (intranet, internet information and applications, 16 rules), the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.22 provisions a-p

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For telecommunication products and services the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.23 provisions a-k

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c

For video and multimedia applications (including training materials), the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.24 provisions a-e

b. 36 CFR Part 1194.31 provisions a-f

c. 36 CFR Part 1194.41 provisions a-c

For self-contained and closed products, the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.25 provisions a-j

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For desktop and portable computers, the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.21 provisions a-l

b. 36 CFR Part 1194.26 provisions a-d

c. 36 CFR Part 1194.31 provisions a-f

d. 36 CFR Part 1194.41 provisions a-c

For help desk and other support services, the Vendor shall comply with the following standards, policies, and procedures:

Section 508 Accessibility Standards

1) 29 U.S.C. 794d (Rehabilitation Act as amended)

2) 36 CFR 1194 (Section 508 standards)

a. 36 CFR Part 1194.31 provisions a-f

b. 36 CFR Part 1194.41 provisions a-c

If the help desk or other support services include training, Vendor must also comply with the following standards, policies, and procedures in addition to 36 CFR Part 1194.31 provisions a-f and 36 CFR Part 1194.41 provisions a-c:

a. 36 CFR Part 1194.21 provisions a-l (installable and web-based training)

b. 36 CFR Part 1194.22 provisions a-p (web-based software)

All Information and Communications Technology (ICT) subject to the 36 CFR 1194 standards will have a Section 508 usability and acceptance test where Section 508 compliance will be validated. This test must be administered by a Federal Section 508 Testing Center.

All maintenance for Information and Communications Technology that requires upgrades, modifications, installations, and purchases will adhere to the Section 508 standards and 36

CFR 1194.

WCAG 2.0 Compliance

The Dell ME5084 Storage Array Hardware/Software shall comply with the standards, policies, and procedures below. In the event of conflicts between the referenced documents and this SOW, the SOW shall take precedence.

Custom ICT Development Services When Vendor provides custom ICT development services pursuant to this contract, Vendor shall ensure the ICT fully conforms to the applicable Revised 508 Standards prior to delivery and before final acceptance.

Installation, Configuration, and Integration Services When Vendor provides installation, configuration, or integration services for equipment and software pursuant to this contract, the offeror shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised 508 standards.

Maintenance, Upgrades, and Replacements Vendor shall ensure maintenance upgrades, substitutions, and replacements to equipment and software pursuant to this contract do not reduce the original level of conformance with the applicable Revised 508 standards at the time of the contract award.

Service Personnel Vendor shall ensure the personnel providing the labor hours possess the knowledge, skills, and ability necessary to address the applicable Revised 508 standards defined in this contract, and shall provide supporting documentation upon request.

Hosting Services When providing hosting services for electronic content provided by the agency, Vendor shall not implement the hosting services in a manner that reduces the existing level of conformance of the electronic content with applicable Revised 508 standards. Throughout the life of the contract, the agency reserves the right to perform testing on a vendor or contractor’s hosted solution to verify conformance with this requirement.

Validation for ICT Items When purchasing ICT where 1) 508 validation is not possible prior to award, 2) when ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, Vendor shall test and validate the ICT solution for conformance to the Revised 508 standards, in accordance with the requirement testing methods, as defined by the agency.

Throughout the life of the contract, the agency reserves the right to perform testing to verify conformance with this requirement.

Documentation

Vendor shall maintain and retain full documentation of the measures taken to ensure compliance with the applicable requirements, including records of any testing or demonstrations conducted.

Conformance Reporting Prior to acceptance, Vendor shall provide an Accessibility Conformance Report (ACR) for each ICT item that is developed, updated, configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary Product Accessibility Template (VPAT) provided by the Information Technology Industry Council (ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by ITI.

When the contractor is required to perform testing to validate conformance to the agency’s accessibility requirements, Vendor shall provide a Supplemental Accessibility Conformance Report (SAR) that contains the following information:

• Accessibility test results based on the required test methods.

• Documentation of features provided to help achieve accessibility and usability for people with disabilities.

• Documentation of core functions that cannot be accessed by persons with disabilities.

• Documentation on how to configure and install the ICT item to support accessibility.

• When an ICT item is an authoring tool that generates content (including documents, reports, videos, multimedia productions, web content, etc.)., provide information on how the ICT item enables the creation of accessible electronic content that conforms to the Revised 508 Standards, including the range of accessible user interface elements the tool can create.

• Before final acceptance, the contractor shall provide a fully working demonstration of the completed ICT Item to demonstrate conformance to the agency's accessibility requirements. The demonstration shall expose where such conformance is and is not achieved.

Before acceptance, the agency reserves the right to perform independent testing to validate that the ICT solution provided by the contractor conforms to the applicable Revised 508 standards.

Non-Compliance

Before final acceptance of any ICT item, including updates and replacements, if Vendor claims its products or services satisfy the applicable Revised 508 standards specified in the contract vehicle, and the contracting officer determines that any furnished ICT item is not in compliance with such requirements, the contracting officer will promptly inform Vendor in writing of the non-compliance. Vendor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

https://www.section508.gov/sell/vpat https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility http://www.itic.org/policy/accessibility

9. IPv6 Requirements Vendor shall provide Supplier Declaration of Conformity SDOC(s) documenting:

(a) Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products:

(b) Specifically, any new IP product or system developed, acquired, or produced must:

1) Interoperate with both IPv6 and IPv4 systems and products, and

2) Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

(c) As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

(d) The Contractor shall provide technical support for both IPv4 and IPv6.

(e) Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

(f) Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

10. Contract Officer Representative Robert Argo USDA – Forest Service – CIO Phone: 850-209-4231 Email: Robert.Argo@usda.gov

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements to the Contracting Officer, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract or order.

11. Security Language for All Contracts/Agreements

SECTION 1: By accepting this contract/agreement, the Contractor and other external organizations (hereafter called Contractor) providing Information Technology (IT) resources or services to the United States Forest Service (FS) agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or logical access to FS information that directly support the mission of the FS. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by Office of Management and Budget (OMB) Circular A-130.

1.2 The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

1.3 The Contractor or other external organization will not publish or disclose in any manner, without the FS Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. The Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the FS and any contractors and other external organizations will be entered into before FS data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The Contractor and other external organizations will agree to establish and follow security precautions considered by the FS to be necessary to ensure proper handling of data and information.

1.3.1 Data Rights. As may be identified elsewhere in this contract, the Contractor agrees that:

1.3.1.1 The draft and final deliverables and all associated working papers and other materials deemed relevant by the Contracting Officer’s Representative (COR) that have been generated by the Contractor in the performance of this contract are the property of the United States Government and must be submitted to the COR at the conclusion of the tasks.

1.3.1.2 All documents produced for this project are the property of the United States Government and cannot be reproduced or retained by the Contractor.

1.3.1.3 FS will retain unrestricted rights to all federally owned and/or federally managed data and/or metadata that FS either owns or manages that is handled under this contract. Specifically, FS retains ownership of any user created/loaded data and applications collected, maintained, used, or operated on behalf of FS and hosted on contractor’s infrastructure, as well as maintains the right to request full copies of these at any time. If requested, data shall be available to FS within one

(1) business day from request date or within the timeframe specified and provided using an encryption standard that meets FS requirements. In addition, the data shall be provided at no additional cost to FS. The contractor shall maintain all information in accordance with Executive Order 13556 – Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and FS policies and shall not dispose of any records unless authorized by FS. All contractors shall complete the applicable USDA/FS records management training at least annually during the life of this contract.

1.3.1.4 The contractor shall be accountable and document all activities associated with the transport of government information, devices, and media transported outside controlled areas and/or facilities. These include information stored on digital media (e.g., CD- ROM, tapes, etc.), non-digital media (e.g., paper), and mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards).

1.3.1.5 All information, devices and media shall be encrypted with FS-approved encryption mechanisms to protect the confidentiality, integrity, and availability of all government information transported outside of controlled facilities.

1.3.1.6 The contractor shall ensure all electronic and paper records are appropriately disposed of, and all devices and media are sanitized, in accordance with NIST SP 800-88 Rev 1, Guidelines for Media Sanitization. 1.4 To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of FS information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

1.5 If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organization, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will report real or suspected incidents or violations immediately upon discovery to the USDA Computer Incident Response and Recovery Branch (CIRRB), by e-mail, at cyber.incidents@usda.gov.

1.6 When the design, development, or operation of a system of records on individuals is required to accomplish an agency function, the Contractor will be required to design, develop, or operate a system of records on individuals subject to the Privacy Act of 1974, Public Law 93-579, December 31,1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

1.6.1 The Contractor agrees to –

1.6.1.1 Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

1.6.1.1.1 The systems of records; and

1.6.1.1.2 The design, development, or operation work that the contractor is to perform.

1.6.1.2 Include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

1.6.1.3 Include this clause, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

1.6.2 In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

1.6.3 Definitions include:

1.6.3.1 “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

1.6.3.2 “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

1.6.3.3 “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

1.6.3.4 “Personally Identifiable Information", as used in this clause, means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

1.6.4 The FS will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract.

1.6.5 Completion of a FS-developed or FS-conducted training course shall be deemed to satisfy these elements.

1.6.6 The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

1.6.7 The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

1.6.8 The substance of this clause, including this paragraph, shall be included in all subcontracts under this contract, when subcontractor employees will:

1.6.8.1 Have access to a system of records;

1.6.8.2 Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

1.6.8.3 Design, develop, maintain, or operate a system of records.

1.6.9 The contractors and other external organizations will ensure that the following banner is displayed on all FS systems that contain Privacy Act information operated by the contractors and other external organizations prior to allowing anyone access to the system:

“This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93-579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

SECTION 2. CONTRACTORS/COOPERATORS REQUIRE BUILDING ACCESS AND/OR

INFORMATION SYSTEM ACCESS

2.1 The Contractor shall insert these clauses in all subcontracts when the subcontractor is required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled system. Failure to comply with said requirements will constitute cause for termination.

2.2 IT Security Training: The Contractor and other external organizations will ensure that its employees performing under this contract fulfill all Forest Service requirements for mandatory security and privacy awareness and role-based advanced security training in accordance with OMB Circular A-130, FISMA, and NIST requirements, and sign all applicable FS statements of responsibilities.

2.3 Rules of Behavior: The contractor shall ensure that all employees performing on the contract sign and comply with the applicable USDA/FS Rules of Behavior (ROB) and any specific rules provided by the Program Office.

2.4 Background Investigations: All non-government employees with unescorted access to FS facilities, computer systems and/or FS information must have background investigations commensurate with the level of risk and magnitude of loss or harm. The FS will determine the level of background investigation and position classification needed.

2.5 Personal Identity Verification of Contractor Personnel: The Contractor shall be responsible for ensuring compliance by its employees with all applicable federal regulations, to include those of GSA, NIST, USDA, FS and HSPD-12. Contractors and their employees are subject to all Federal laws applicable to Government installations and are under the jurisdiction of the Federal Protective Service (FPS). The Contracting Officer Representatives (CORs; also known as Contracting Officer Technical Representatives), or other designated program/project officers, in conjunction with the FS HCM HSPD-12 staff, will assist the Contractor in processing the required Security Background Investigations/Clearances.

2.5.1 The Contractor shall comply with the personal identity verification (PIV) policies and procedures established by U.S. Department of Agriculture (USDA) Directives 3800 series.

2.5.2 Should the results of the PIV process require the exclusion of a Contractor’s employee; the Contracting Officer will notify the Contractor in writing.

2.5.3 The Contractor must appoint a representative to manage this activity and to maintain a list of employees eligible for a USDA PIV ID Badge required for performance of the work.

2.5.4 The responsibility of maintaining a sufficient workforce remains with the Contractor. Employees may be barred by the Government from performance of the work should they be found ineligible or to have lost eligibility for a USDA PIV ID Badge. Failure to maintain a sufficient workforce of employees eligible for a USDA PIV ID Badge may be grounds for termination of the contract.

2.5.5 The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have access to a federally controlled facility or system.

2.5.6 The PIV Sponsor for this contract is the Contracting Officer Representative, Program Manager, or delegated sponsor, unless otherwise specified in this contract. The PIV Sponsor will be available to receive contractor identity information from * (hours and days) to * (hours and days) at * (office address for registration). The Government shall notify the Contractor if there is a change in the PIV Sponsor, the office address, or the office hours for registration.

2.5.7 At this time, the Government will pay for and process all required security investigations/clearances, except as identified differently within this clause.

2.5.8 The Contractor should be aware of any of its employees possibly having had a background investigation through another government agency. The investigation that was conducted, if verifiable by the FS HSPD-12 staff, and if it was completed within the last 5 years, can be accepted by the Government in lieu of a background check. 2.5.9 The Contractor shall comply with any facility badging requirements for the issuance of building access, badges, etc.:

2.5.9.1 Ensure that each of the Contractor’s employees has been issued either a temporary or permanent badge from the Government. A permanent badge will not be issued until the security questionnaire has been completed and favorably reviewed. Temporary or visitor badges will be provided for persons who are identified as having an infrequent or temporary legitimate business need for access to the site. As noted above, periods that exceed 180 days will require a permanent badge. The badge must be worn at all times while in the facility. It must be displayed above the waist. The individual will retain possession of the badge as long as continued admittance to the site is needed.

2.5.9.2 Ensure the safekeeping, wearing, and visibility of Government-furnished badges.

2.5.9.3 Immediately return all badges and permits to the Government when such need ceases to exist.

2.5.10 The Contractor shall comply with any facility security requirements for access to the facility.

2.5.11 The Contractor shall comply with all applicable rules governing parking at USDA locations.

2.6 Hiring of Foreign Nationals. The Contractor acknowledges that personnel must be either U.S. citizens or Lawful Permanent Residents, also known as “green card” holders, in order to access:

2.6.1 USDA Mission Areas, Agencies and Staff Offices or controlled facilities; or

2.6.2 Information Technology (IT) systems or security items or products.

2.6.3 This includes contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories.

2.6.4 The Contractor must identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award must be reported to the Contracting Officer (CO) or Contracting Officer's Representative (COR).

SECTION 3.0 ACQUIRING AND/OR IMPLEMENTING SOFTWARE APPLICATIONS

3.1 Best Practices: The contractor shall follow secure coding best practice requirements, as directed by the United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP) that will limit system software vulnerability exploits.

3.2 Secure Coding Skills: Contractor certifies that at least one member of each programming team working on any code (including C, Java, .Net, ASP.NET, Visual Basic) to be delivered to the Forest Service has earned the Global Information Assurance Certification for Secured Software Programming or equivalent.

3.3 Source code testing, binary code testing, application scanning, and penetration testing: At least one week prior to delivery of any code due under this contract, Contractor will deliver to the FS Program Manager, or delegated sponsor, the following reports covering all code that will be delivered:

3.3.1 Source code testing results showing all potential security flaws identified by at least one of the commercial source code testing tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.” The Contractor must then correct the vulnerabilities, resend the code, and ensure the health of delivered source code.

3.3.2 For web applications, web application scanning test results showing all potential security flaws identified by at least one of the commercial web application scanning tools approved by the Office of the Chief Information Officer of USDA. On the report, the Contractor will highlight all vulnerabilities rated “critical” and “high.”

3.3.3 For all applications: application penetration results.

3.4 End of Life Compliance: The contractor shall use Commercial off the Shelf (COTS) software or other software that is supported by the manufacturer. In addition, the COTS/other software needs to be within one major version of the current version. Deviation from this requirement will only be allowed via the USDA waiver process (approved by USDA CISO). The contractor shall retire and/or upgrade all software/systems that have reached end-of- life. Under no circumstances will the Department allow contractors to utilize unsupported COTS applications, systems, components, programs or utilities without a specific written exception, signed and authorized by the CIO.

3.5 The contractor shall ensure IT applications designed and developed for end users (including mobile applications and software licenses) run in the standard user context without requiring elevated administrative privileges.

3.6 Copyright Management and Responsibility: By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the Government against copyright or other lawsuit resulting from the application or programming delivered

12. Copyright Management and Responsibility By delivering applications or programming code to the Federal Government, the vendor or Contractor certifies that they have the proper authority to transfer the property and will defend the government against copyright or other lawsuit resulting from the application or programming delivered.