Attachment 5 RandD SOW and RandD Contracts OBAA TS3 Template.doc

Attachment 8

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

<Enter Proposal Title> NOTES ON USING THIS TEMPLATE: This template is intended to assist you in preparing a comprehensive Statement of Work for services. The template provides a basic standard outline for the SOW and sample paragraph language. Your SOW should be tailored to meet the needs of your specific requirement. This template can be edited as you and your Contracting Officer deem necessary to delete areas that are not applicable to your requirement and/or to add areas that are unique to your requirement. The template can be used to prepare SOWs for contracts, task orders, and inter/intra-agency agreements.

IMPORTANT: All instructions (highlighted in blue), user notes (highlighted in pink), and user input guidance (highlighted in yellow) should be removed before finalizing the SOW document.

1.0 GENERAL

1.1 Background

Provide relevant background information that will be useful to contractors in understanding the need for the services and to assist the contractors in understanding how DHS past practices or current policies could impact future efforts.

Describe the project in general terms. Discuss the purpose of the project; why the project is being pursued; and, if relevant, how the project relates to other projects.

1.2 Scope

The scope should be a concise statement to provide the reader with an understanding of the magnitude and limitations of the work to be performed. It should specify the range and limits of the requested products and/or services. In some instances, including negative scope (i.e., what this SOW is not for or does not cover) may be appropriate.

1.3 OBJECTIVE

This should be a concise statement that describes the objective or desired goal you are trying to achieve with this solicitation. Provide a concise overview of the project and how the results or end products will be used.

1.4 APPLICABLE DOCUMENTS

Reference any documents (include date and version) that pertain to the requirement and are necessary for the contractor to perform the contract. If only portions of a document apply, be sure to clearly state the applicable portion(s). Also be sure to cite the document properly using conventional citation formats for statutes, regulations, etc. Be sure to attach, link, or otherwise make the required documents available to contractors.

1.4.1 Compliance Documents

The following documents provide specifications, standards, or guidelines that must be complied with in order to meet the requirements of this contract:

<Enter solicitation number, proposal identification number, and proposal title>

1.4.2 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

<List document references>

2.0 SPECIFIC REQUIREMENTS/TASKS

Describe in clear, understandable terms exactly what you want the contractor to do, including any deliverables you expect from the contractor. Number each task and sub-task in this section to make it clear when referring to tasks/sub-tasks in other sections of this document, or if contractors have a question about a specific task description. Do not put more than one task per numbered paragraph or sub paragraph. Individual paragraphs for each task description, identified in a logical progression, will facilitate costing, referencing and tailoring tasks.

Do not restate in the SOW information that will be incorporated in other sections of the solicitation. If you have to refer to information explained in other sections of the solicitation, provide the reference to that section, do not re-write the information.

Here are some other points to keep in mind:

· Use the word “shall” whenever a provision is mandatory. For example: “The contractor shall . . . .” The word “will” expresses clarity of purpose or intent and usually refers to the government.

· Use active, rather than passive voice for the requirements so the contract is clear about what the contractor must perform, (e.g., “The Contractor shall provide program management support,” not “Program management support shall be provided by the Contractor”).

· Use simple sentence structure.

· Avoid redundancy.

· Use verbs that correctly describe the work requirements, such as implement, install, track, document, use, identify, create, inform, maintain, conduct, record, define, develop, perform, integrate, test, revise, monitor, assist, provide, resolve, etc.

· Avoid using words such as ensure, assure, best, all, every, certify, average, adequate, equal, any, either, and/or, and to the extent necessary.

· Avoid using pronouns when the applicable noun can be used.

· Use the same term for a particular item. Do not use variations of the term.

· Avoid ambiguity. Be specific, (e.g., “support services” is ambiguous).

· Define terms that need to be defined. Define acronyms the first time they are used in the SOW.

· Ensure deliverables are clearly stated and described.

· Ensure performance standards you are requiring in the SOW are necessary, realistic, specific, verifiable, objective, and measurable.

· Ensure acceptance criteria are clearly stated. Acceptance criteria may be cited in the paragraph that describes the deliverable or you may insert another column on the Deliverables chart in SOW 9.0.

· The SOW should provide the contractor with answers to six basic questions: who, what, when, where, how many or how much, and how well? It is important for the SOW to accurately answer these questions in order to allow the contractor the opportunity to accurately assess the level of expertise, the resources required, and the risks involved. Also, remember that a contractor will use the SOW to prepare its proposal, including its cost proposal, and a well written SOW also aids the Government in conducting the source selection evaluation and administering the contract performance after award.

· The SOW should identify only minimum requirements, eliminating the “nice to haves.” Consider the use of a program Work Breakdown Structure (WBS) to outline the required work effort. A WBS is an outcome-oriented analysis of the work involved in a project that defines the total scope of the project. It divides a project or major activity into successive levels, in which each level is a finer breakdown of the preceding one. In final form, a WBS is very similar in structure and layout to a document outline with each item at a specific level of a WBS numbered consecutively.

· The requirements/tasks should be presented in sequential or some other logical order.

· The SOW should follow the phase structure identified in the topic area.

· The SOW becomes the standard for measuring contractor performance. The sentences should be written so that there is no question of whether the contractor is obligated to perform specific tasks. As the contracted effort progresses, the government and the contractor look to the SOW to determine rights and obligations concerning what work is required to be performed. Often, how well the SOW is written determines the legal enforceability of the contract and also is the determining factor in resolving scope of work issues.

· Don’t assume anything. Keep asking yourself what is missing from the SOW.

2.1 TASK ONE. <Add title of specific task>

Xxxxxxx

2.1.1 Xxxxx (DEFINE QUANTITATIVE (performance or time) MILESTONE FOR EACH SUBTASK. Current phase should be more detailed than future phases. Each new phase should have these milestones defined.

2.1.2 Xxxxx

2.2 TASK TWO. <Add title of specific task>

Xxxxxxx

2.2.1 Xxxxx

2.2.2 Xxxxx

2.3 TASK THREE. <Add title of specific task>

Xxxxxxx

2.3.1 Xxxxx

2.3.2 Xxxxx

3.0 CONTRACTOR PERSONNEL

It is the responsibility of the contractor to propose qualified contractor personnel to perform all requirements specified in the SOW. As a general rule, the government should not specify education, experience or other qualifications for contractor personnel. In some instances, however, it may be necessary for the government to specify contractor qualifications, certifications, and/or education. For example, there may be a need for a Certified Public Accountant (CPA) for a requirement for financial support services. Similarly, you may deem it necessary to specify qualifications, certifications, and/or education for contractor Subject Matter Experts. And, it is recommended that you specify minimum qualifications, certifications, and/or education for contractor Key personnel and obtain resumes for those positions. Before including education, experience or other qualifications for contractor personnel in the SOW, discuss the matter with your Contracting Officer.

The government should not, as a general rule, specify the labor category(ies) the contractor should propose. In some instances, however, it may be necessary for the government to specify the labor category(ies) and even staffing levels. Before including labor categories and/or staffing levels in the SOW, discuss the matter with your Contracting Officer.

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

3.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all contract support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

3.3 Key Personnel

If resumes are required in response to the solicitation, the government will have the opportunity to review the qualifications, education and experience of proposed contractor personnel. In some instances, the government may determine that a position is “key” to the successful performance of the requirement. “Key” positions should be identified in the solicitation and the contractor should be requested to submit Employment Commitment Letters with its proposal. In these cases, the following paragraph should be included in the SOW:

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer. The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of award.

<List the positions designated as Key for the requirement, to include the Principle Investigator and Project Manager>

3.4 Project Manager

The Contractor shall provide a Project Manager who shall be responsible for all Contractor work performed under this SOW. The Project Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Project Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor's proposal. The Project Manager is further designated as Key by the Government. During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. The Project Manager and all designated alternates shall be able to read, write, speak and understand English. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

3.4.1 The Project Manager shall be available to the COR via telephone between the hours of XXXX and XXXX EST, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems

4.0 OTHER APPLICABLE CONDITIONS

This area should address other information the Contractor will need and/or requirements the Contractor will need to accomplish in the performance of the SOW. It is highly recommended that the topics included in SOW 4.1 through SOW 4.14 be addressed in the SOW. Additional topics may be added as appropriate.

4.1 SECURITY REQUIREMENTS

Contractor access to CWMD Research and Development Division (RDD)-owned data and information systems is not currently required under this SOW. The contractor will be collaborating with CBP OFO/NII DAC-TER, and will have access to RPM historical records, sanitized by CBP OFO/NII DAC-TER personnel to limit the level of sensitivity of the information provided to The Contractor to the level of For Official Use Only (FOUO).

Data ascertained by The Contractor from CBP DAC-TER will be relevant to state-of-health monitoring of RPM systems. This will include system and component signals pertaining, but not limited to, detector gross counts, calibration information, sensor voltages, sub-component voltages and status (e.g., photo-multiplier, multi-channel analyzers, input voltage from shore power, occupation sensors, etc.), binary (on/off) system status, and binary component/sub-component status.

DHS CWMD will furnish any needed Radiation Portal Monitor (RPM) sensor information for use in this effort through an existing Interagency Agreement with DHS CBP OFO/NII DAC-TER. The information furnished shall be handled in accordance with the procedures and guidance outlined below:

a. Definitions: “Sensitive Information” is defined as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

i. Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, and the applicable PCII Procedures Manual, as amended.;

ii. Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance under the regulation;

iii. Information designated as “Official Use Only,” (FOUO) which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

iv. Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

b. DHS CWMD will furnish RPM sensor-related data to The Contractor, sanitized and approved by CBP OFO/NII DAC-TER for execution of the work described in this SOW. The sensor data, unless otherwise specified by CWMD, is to be treated as FOUO data by The Contractor and access to it is to be restricted to project personnel.

Security categorization of information is necessary to assure that the safeguards of The Contractor are appropriate and sufficient for the data to be provided by DHS CWMD to The Contractor. Unless otherwise specified by DHS CWMD, the security category of this information to be provided to The Contractor maps to D.2.3, Catastrophic Defense Information Type in NIST Special Publication 800-60, Volume II, Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. The NIST SP800-60, Volume II, recommended categorization for unclassified anti-terrorism information is

Security Category Provisional = {(confidentiality, High), (integrity, High), (availability, High)}

For purposes of the effort described in this SOW, the forecast confidentiality, integrity and availability impacts to research and development activities are assessed to be substantially lower than the provisional impacts of NIST SP800-60, Volume II. The assessed security categorization of

Security Category Assessed = {(confidentiality, Low), (integrity, Low), (availability, Low)} is supported by the following considerations:

i. Confidentiality: The scope of this SOW provides for R&D analysis of RPM sensor data in the technology proof-of-concept (POC) demonstration. This information has no connection to monitoring and assessing the leadership, motivation, plans, or intentions of foreign and domestic terrorist groups and their state and non-state sponsors. As such, the considerations for the provisional determination of “High” for confidentiality impact are inappropriate. Instead, a “Low” determination better matches the guidance in FIPS 199; unauthorized information disclosure is not expected to have a serious adverse effect on DHS CWMD nor DHS CBP port-of-entry (POE) operations or mission capability.

ii. Integrity: The scope of this SOW covers information from the technology POC demonstration only, and not operationally deployed sensors or systems. Further, The Contractor will not be responsible for retaining the data set of official record - the responsibility for retaining the data set of official record for the sensors will be retained at DHS CBP OFO/NII DAC-TER facilities and information systems. The effort covered in this SOW is not part of a critical infrastructure protection operation. Unauthorized modification or destruction of information will not result in damage to infrastructures, key national assets, or loss of human life. As such, the considerations for the provisional determination of “High” for confidentiality impact are inappropriate. Instead, a “Low” determination better matches the guidance in FIPS 199; unauthorized modification or destruction of information could be expected to cause minor financial loss caused by project delays or a degradation in mission capability that is limited in extent and duration such that the organization is able to perform primary functions with reduced effectiveness.

iii. Availability: The scope of this SOW covers machine learning algorithm and prototype graphical user interface (GUI) development in the R&D stage for the technology POC demonstration. Further, The Contractor will not be responsible for retaining the data set of official record - the responsibility for retaining the data set of official record for the sensors will be retained at DHS CBP OFO/NII DAC-TER facilities and information systems. Disruption of access to information in this SOW scope will not degrade mission capability significantly, nor result in catastrophic consequences for critical infrastructure, key national assets, or human life. As such, the considerations for the provisional determination of “High” for confidentiality impact are inappropriate. Instead, a “Low” determination better matches the guidance in FIPS 199; disruption of access to information could be expected to cause minor financial loss caused by project delays or a degradation in mission capability that is limited in extent and duration such that the organization is able to perform primary functions with reduced effectiveness.

c. The Contractor will seek DHS CWMD permission before using the RPM sensor data for any purposes not outlined in this SOW, or before issuing external/public reports or presentations on the work done in this SOW, or before sharing the sensor data externally with others. If data is transmitted outside the DHS CWMD, DHS CBP OFO/NII DAC-TER or contractor facility, it will be encrypted.

d. Report and presentation deliverables are to be held as FOUO information. When transmitted outside of the DHS CWMD, DHS CBP OFO/NII DAC-TER and Contractor networks (e.g., over email), they are to be secured with encryption. The Contractor will seek DHS CWMD permission before sharing these reports with others.

e. The algorithm deliverables are to be treated as FOUO information. When algorithms, code, and related artifacts are transmitted outside of the DHS CWMD or Contractor facility, they will be encrypted. The Contractor will seek DHS CWMD permission before disseminating this code to others.

f. Compliance with DHS Security Policy Requirements for National Security Systems. All hardware, software, and services provided under this task order must be compliant with DHS National Security Systems Policy Directive 4300B series and/or the 4300C series for Sensitive Compartmented Information SCI systems.

g. Encryption Compliance Requirement: Information requiring encryption shall comply with the following standards:

1. Systems requiring encryption shall comply with FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

2. Systems requiring encryption shall comply with National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Only cryptographic modules that are FIPS 197 (AES 256) compliant and have received FIPS 140-2 validation at the level appropriate to their intended use may be used in systems requiring encryption.

h. Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within any IT system supporting DHS without an Authority to Operate (ATO).

i. Security Review. DHS may elect to conduct random periodic reviews to ensure that the security requirements contained in this SOW are being implemented and enforced. The Contractor agrees to afford DHS, its Office of the Inspector General, and other Government organizations access to Contractor facilities, installations, operations, documentation, databases and personnel used in the performance of this SOW. Access shall be provided, to the extent necessary as determined by DHS and other Government authorities, in order to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems used in performance of this SOW and to preserve evidence of computer crime.

j. Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall participate in DHS’ Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that the DHS determines acceptable. The DHS Chief Information Security Officer (CISO) issues annual updates to its Continuous Monitoring requirements via the Annual Information Security Performance Plan. At a minimum, the contractor shall implement the following processes:

1. Asset Management

2. Vulnerability Management

3. Configuration Management

4. Malware Management

5. Log Integration

6. Security Information Event Management (SIEM) Integration

7. Patch Management

8. Providing near-real-time security status information to the DHS ESOC

The Contractor shall establish a monitoring scope at least as comprehensive and stringent as described in DHS 4300A Sensitive Systems Handbook, Attachment F, “Incident Response.”

The Contractor will store monthly continuous monitoring data regarding DHS sensitive information at its location for a period of not less than one year from the date the data is created. The data shall be encrypted and shall not be stored on systems that are shared with other commercial entities.

k. Revocation of ATO. In the event of a sensitive information incident, DHS may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, DHS may advise The Contractor to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on any Contractor information technology system containing DHS sensitive information. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

l. Sensitive Information Incident Reporting Requirements. All known or suspected sensitive information incidents involving DHS information or data shall be reported to the DHS Enterprise Security Operations Center (ESOC) within 72 hours of discovery, in accordance with DFARS clause 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting”. When notifying ESOC, The Contractor agrees to also notify US-CERT in accordance with US- CERT standards and guidelines. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, The Contractor agrees to use encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same email as the attachment.

m. Sensitive Information Incident Response Requirements.

1. All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in consultation with the DHS Headquarters or Component Chief Information Officer (CIO) and Headquarters or Component Privacy Officer.

2. The Contractor agrees to provide full access and cooperation for all activities determined by DHS to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

3. Incident response activities determined to be required by DHS may include, but are not limited to, inspections, investigations, forensic reviews, and data analysis & processing.

4. DHS, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

n. Interconnection Security Agreement Requirements. Interconnections between DHS and non-DHS systems shall be established only through the Trusted Internet Connection (TIC) and by approved service providers. The controlled interfaces are authorized at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements, memorandums of understanding, Service Level Agreements (SLA) or Interconnection Security Agreements (ISA).

a. Special Requirements: None

b. Property Acquired in the Performance of Sponsored Research. All equipment and other property items acquired or developed by The Contractor in the performance of sponsored research are U.S. Government property.

c. Section 508 Requirements:

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

1. All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

Item that contains Information and Communications Technology (ICT): Provide any items that contain ICT.

Applicable Exception: N/A Authorization #: N/A

Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 apply to when using an alternative design or technology that results to achieve substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

Applicable 508 requirements for electronic content features and components (including Electronic reports): Does not apply

Applicable 508 requirements for software features and components (including Web, desktop, server, mobile client applications; Electronic content and software authoring tools and platforms): All requirements in Chapter 5 apply, including all WCAG Level AA Success Criteria Apply except 2.4.1 Bypass Blocks, 2.4.5 Multiple Ways, 3.2.3 Consistent Navigation, 3.2.4 Consistent Identification, 502 Interoperability with Assistive Technology, 503 Application, 504 Authoring Tools

Applicable 508 requirements for hardware features and components: Does not apply

Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply

1. When developing or modifying ICT for the government, the contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

2. When developing or modifying web and software ICT, the contractor shall demonstrate Section 508 conformance by providing Section 508 test results based on the versions of the DHS Trusted Tester Methodology currently approved for use, as defined at https://www.dhs.gov/compliance-test-processes. The contractor shall use testers who are certified by DHS on how to use the DHS Trusted Tester Methodology (e.g “DHS Certified Trusted Testers”) to conduct accessibility testing. Information on how testers can become certified is located at https://www.dhs.gov/publication/trusted-tester-resources.

3. When developing or modifying software that generates electronic content (e.g., an authoring tool that is used to create html pages, reports, surveys, charts, dashboards, etc.), the contractor shall ensure software can be used to create electronic content that conforms to the Section 508 standards.

4. Contractor personnel shall possess the knowledge, skills and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

5. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017.

6. Where ICT conforming to one or more requirements in the Revised 508 Standards is not commercially available, the agency shall procure the ICT that best meets the Revised 508 Standards consistent with the agency’s business needs, in accordance with 36 CFR E202.7. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017 and 36 CFR E202.6.

Instructions to Offerors

1. For each commercially available Information and Communications Technology (ICT) item offered through this contract, the Offeror shall provide an Accessibility Conformance Report (ACR). The ACR shall be created using the Voluntary Product Accessibility Template Version 2.2 508 (or later). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed in accordance with all the instructions provided in the VPAT template. Each ACR must address the applicable Section 508 requirements referenced in the Work Statement. Each ACR shall state exactly how the ICT meets the applicable standards in the remarks/explanations column, or through additional narrative. All “Supports”, “Supports with Exceptions”, “Does Not Support”, and “Not Applicable” (N/A) responses must be explained in the remarks/explanations column or through additional narrative. The offeror is cautioned to address each standard individually and with specificity, and to be clear whether conformance is achieved throughout the entire ICT Item (for example - user functionality, administrator functionality, and reporting), or only in limited areas of the ICT Item. The ACR shall provide a description of the evaluation methods used to support Section 508 conformance claims. The agency reserves the right, prior to making an award decision, to perform testing on some or all of the Offeror’s proposed ICT items to validate Section 508 conformance claims made in the ACR.

2. For each ICT Item that will be developed, modified, installed, configured, integrated, or hosted by the contractor pursuant to this contract, the offeror shall provide an acknowledgement of the Section 508 requirements and a detailed explanation of the Offerors plan to ensure conformance with the requirements. The Offeror shall also describe the evaluation methods that will be used to validate for conformance to the Section 508 Standards.

3. For each commercially available authoring tool offered that generates electronic content (e.g., an authoring tool that is used to create html pages, reports, surveys, charts, dashboards, etc.), the Offeror shall describe the level of Section 508 compliance supported for the content that can be generated.

The offeror shall describe plans for features that do not fully conform to the Section 508 Standards.

4.2 Period of Performance

The period of performance for this contract is a xx month base period with <insert number of option periods> option periods as follows:

Base Period/Phase xx insert length in months Option Period One/Phase xx insert length in months Option Period Two/Phase xx insert length in months Option Period Three/Phase xx insert length in months Option Period Four/Phase xx insert length in months

4.3 PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facilities with frequent visits to the Department of Homeland Security facilities in the Washington Metro Area.

4.4 Travel

Contractor travel shall be required to support this requirement. All travel required by the Government outside the local commuting area(s) will be reimbursed to the Contractor in accordance with the Federal Travel Regulations. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event.

4.5 POST AWARD/KICK-OFF MEETING

The Contractor shall attend a Post Award/Kick-off meeting with the Contracting Officer and the COR no later than 20 business days after the date of award. The purpose of the Post Award/Kick-off meeting, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility or via teleconference.

4.6 PROGRESS REPORTS

The Project Manager shall provide a monthly progress report to the Contracting Officer and COR via electronic mail based on a CWMD specified template. The report will be due on the 15th of every month. This report will include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, any travel conducted and any Contractor concerns or recommendations for the previous reporting period.

4.7 PROGRESS MEETINGS

The Project Manager shall meet with the COR on a quarterly basis and/or in association with end of the project phase to discuss progress, exchange information and resolve emergent technical problems and issues. Briefing materials will be prepared for these discussions in accordance with a Government provided template. These meetings will take place at either the Government’s or Contractor’s facilities, or other location as mutually agreed to by both parties, or via teleconference.

4.8 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows 7 and Microsoft Office Applications).

4.9 INTELLECTUAL PROPERTY

Per Federal Acquisition Regulation (FAR) 52.227-17 - Rights in Data - Special Works (DEC 2007):

(a)Definitions. As used in this clause -

Data means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

Unlimited rights means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b)Allocation of Rights.

(1) The Government shall have -

(i) Unlimited rights in all data delivered under this contract, and in all data first produced in the performance of this contract, except as provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced in the performance of this contract, and to obtain assignment of copyright in that data, in accordance with paragraph (c)(1) of this clause.

(iii) The right to limit the release and use of certain data in accordance with paragraph (d) of this clause.

(2) The Contractor shall have, to the extent permission is granted in accordance with paragraph (c)(1) of this clause, the right to assert claim to copyright subsisting in data first produced in the performance of this contract.

(c)Copyright -

(1)Data first produced in the performance of this contract:

(i) The Contractor shall not assert or authorize others to assert any claim to copyright subsisting in any data first produced in the performance of this contract without prior written permission of the Contracting Officer. When copyright is asserted, the Contractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402 and acknowledgment of Government sponsorship (including contract number) to the data when delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. The Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

(ii) If the Government desires to obtain copyright in data first produced in the performance of this contract and permission has not been granted as set forth in paragraph (c)(1)(i) of this clause, the Contracting Officer shall direct the Contractor to assign (with or without registration), or obtain the assignment of, the copyright to the Government or its designated assignee.

(2)Data not first produced in the performance of this contract. The Contractor shall not, without prior written permission of the Contracting Officer, incorporate in data delivered under this contract any data not first produced in the performance of this contract and that contain the copyright notice of 17 U.S.C. 401 or 402, unless the Contractor identifies such data and grants to the Government, or acquires on its behalf, a license of the same scope as set forth in paragraph (c)(1) of this clause.

(d)Release and use restrictions. Except as otherwise specifically provided for in this contract, the Contractor shall not use, release, reproduce, distribute, or publish any data first produced in the performance of this contract, nor authorize others to do so, without written permission of the Contracting Officer.

(e)Indemnity. The Contractor shall indemnify the Government and its officers, agents, and employees acting for the Government against any liability, including costs and expenses, incurred as the result of the violation of trade secrets, copyrights, or right of privacy or publicity, arising out of the creation, delivery, publication, or use of any data furnished under this contract; or any libelous or other unlawful matter contained in such data. The provisions of this paragraph do not apply unless the Government provides notice to the Contractor as soon as practicable of any claim or suit, affords the Contractor an opportunity under applicable laws, rules, or regulations to participate in the defense of the claim or suit, and obtains the Contractor's consent to the settlement of any claim or suit other than as required by final decree of a court of competent jurisdiction; and these provisions do not apply to material furnished to the Contractor by the Government and incorporated in data to which this clause applies.

4.10 PROTECTION OF INFORMATION

Contractor access to information protected under the Privacy Act is not required under this SOW. Contractor access to proprietary information is not required under this SOW.

6.0 GOVERNMENT FURNISHED RESOURCES

CWMD/RDD will request CBP OFO/NII DAC-TER to provide the following information, data and documents to the Contractor for work required under this contract:

· Sanitized Historical RPM Performance Records relevant for ARMOR development and by OFO/NII DAC-TER

The Contractor shall use Government-furnished information, data, and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government-furnished information, data, and documents to outside parties without the prior and explicit consent of the Contracting Officer. CWMD/RDD shall provide no data of its own; rather, CBP OFO/NII DAC-TER will provide very limited, sanitized samples of data to the Contractor. Contractor may work and participate in tests with real data resting on the ARDIS system (accessible at CBP OFO/NII DAC-TER facilities) only under CBP OFO/NII DAC-TER team member supervision unless Contractor SMEs are granted CBP Background Investigation (BI) status.

Data ascertained by The Contractor from CBP DAC-TER will be relevant to state-of-health monitoring of RPM systems. This will include system and component signals pertaining, but not limited to, detector gross counts, calibration information, sensor voltages, sub-component voltages and status (e.g., photo-multiplier, multi-channel analyzers, input voltage from shore power, occupation sensors, etc.), binary (on/off) system status, and binary component/sub-component status.

7.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0 and SOW 6.0.

8.0 GOVERNMENT ACCEPTANCE PERIOD

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, the COR will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

9.0 DELIVERABLES

The Contractor will consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

All deliverables shall be sent in accordance with the table to the Contracting Officer (CO) and Contracting Officer’s Representative (COR) identified in the contract Terms & Conditions. All financial and management reports shall be sent electronically to the COR, CO, and any Contract Specialist (CS) at the addresses listed in the contract Terms & Conditions.

10.0 POINTS OF CONTACT

<<Insert performer’s name>> Points of Contact (POCs) are as follows:

· Technical POC(s) – <<provide name, address, e-mail, phone for Principle Investigator and Project Manager>>

· Financial POC(s) – <<provide name, address, e-mail, phone for business POC>> <<Insert performer’s name>> may change the individual designated as a POC upon notice to the COR and CO of such change.

The DHS POCs are as follows (Note: Will be filled out by CWMD if selected for award):

· Contracting Officer <<CO name>>

Countering Weapons of Mass Destruction (CWMD) Office

U.S. Department of Homeland Security

<<Insert CO’s phone number>>

<<Insert CO’s e-mail >>

· Contracting Officer’s Representative <<COR name>>

Countering Weapons of Mass Destruction (CWMD) Office

U.S. Department of Homeland Security

<<Insert COR phone number>>

<<Insert COR e-mail >>

· Alternate Contracting Officer’s Representative <<COR name>>

Countering Weapons of Mass Destruction (CWMD) Office

U.S. Department of Homeland Security

<<Insert COR phone number>>

<<Insert COR e-mail >>

· Resource Manager <<Resource manager name>>

Countering Weapons of Mass Destruction (CWMD) Office

U.S. Department of Homeland Security

<<Insert Resource Manager’s phone number>>

<<Insert Resource Manager’s e-mail >>

DHS CWMD may change the individual designated as a POC upon notice to <<insert performer’s name>>.