Attachment A- Statement of Work- HRM Electronic Fingerprinting Services.pdf

CBP HRM Electronic Fingerprinting Services 70B06C20Q00000328

ATTACHMENT A

U.S. DEPARTMENT OF HOMELAND SECURITY

U.S. CUSTOMS and BORDER PROTECTION

STATEMENT OF WORK

FOR

Office of Human Resources Management

ELECTRONIC FINGERPRINT COLLECTION SERVICES

Table of Contents

1. BACKGROUND

2. SCOPE

3. APPLICABLE DOCUMENTS

4. GENERAL REQUIREMENTS

4.1. CONTRACTOR FURNISHED EQUIPMENT

4.2. FINGERPRINT FACILITIES

5. TASKS

5.1. TASK 1 – REQUESTS FOR SERVICES

5.2. TASK 2 – SCHEDULING FINGERPRINTS

5.3. TASK 3 – PROCESSING AND SUBMITTING FINGERPRINT RESULTS

5.4. TASK 4 - WEB SERVICES AND DATA REPORTING REQUIREMENTS

6. DELIVERABLES

6.1. SECURITY DELIVERABLES

6.2. QUALITY CONTROL PLAN AND PERFORMANCE MEASURES

6.3. REPORTS

7. GOVERNMENT-FURNISHED INFORMATION AND EQUIPMENT (GFE/GFI)

8. TERM OF CONTRACT

9. PLACE OF PERFORMANCE

10. SECURITY

11. OTHER CONSIDERATIONS

11.1.TRANSITION PROCESS

11.2.HOURS OF OPERATION

11.3.MEETINGS AND TRAVEL

11.4.CONTRACTOR PERSONNEL

11.5.INVOICING

11.6.SECTION 508 REQUIREMENTS.……….………………………………………………………………………………………………………………………………………………15

11.7.ENTERPRISE ARCHITECTURE COMPLIANCE…………………………………………………………………………………………………………………………………………16

1. BACKGROUND

1.1. As a component of the Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP) is responsible for protecting our Nation’s borders in order to prevent terrorists and terrorist weapons from entering the United States, while facilitating the flow of legitimate trade and travel. CBP is also responsible for apprehending individuals attempting to enter the U.S. illegally; stemming the flow of drugs and other contraband;

protecting our agricultural and economic interests from harmful pests and diseases; protecting American business from theft of their intellectual property; and regulating and facilitating international trade, collecting import duties, and enforcing U.S. trade laws. The Office of Human Resources Management (HRM) CBP Hiring Center (HC) supports the recruitment, hiring, and retention of qualified employees for various positions within

CBP.

1.2. All CBP employees, many contractors, consultants, and applicants, are required to undergo a background investigation to include fingerprints that are required for a National Agency Check (NAC).

2. SCOPE

2.1. The purpose of this document is to set forth the necessary requirements that the Contractor shall meet to provide CBP automated electronic fingerprint services for CBP employees, contractors, consultants, and applicants (hereafter collectively referred to as “candidates”).

2.2. The Contractor shall provide all fingerprinting facilities, all fingerprinting personnel, electronic communications of all fingerprint data, and all equipment necessary for completing an automated electronic fingerprint process.

2.3. The Contractor shall provide the following services in compliance with this Statement of Work (SOW):

2.3.1. Provide a means to schedule all participants for fingerprinting in coordination with the Hiring Center (HC), the Office of Professional Responsibility (OPR) / Personnel Security Division (PSD), and the Office of Information and Technology (OIT) / Workforce Management Division (WMD) as requested by the Contracting Officer’s Representative (COR).

2.3.2. Provide an automated self-scheduling capability to allow candidates to elect date, time and location for the electronic collection of their fingerprints.

2.3.3. Capture the electronic fingerprints for all CBP candidates requiring fingerprints as part of their background investigation NAC requirements.

2.3.4. Maintain a web-based data system, accessible remotely by CBP employees and contractor personnel per the Web Services and reporting requirements in this SOW.

2.3.5. Ensure that any and all data that is collected, generated, and/or tracked in the vendor system is exposed for integration via web service(s) and includes relationship and unique identifiers.

2.3.6. Provide all trained personnel to administer fingerprint functions at facilities nationwide as specified in this SOW.

The Contractor shall provide the fingerprinting sites in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

2.3.7. The services under this contract are subject to the needs of the Government and to the availability of funds; the volume of electronic fingerprints to be ordered is contingent upon the quantities of new hires approved by Congress, current CBP employees (i.e., periodic investigations), contractors requiring reinvestigations, and specific hiring requirements. CBP will make a good faith effort to keep the Contractor informed of anticipated or impending needs for services. The volume of requests sent by CBP to the Contractor shall vary widely by day – CBP may send up to several thousand requests in one day which shall be completed within the timelines specified in this SOW.

3. APPLICABLE DOCUMENTS

3.1. Electronic fingerprints collected under this contract shall be consistent with the requirements in this Statement of Work.

3.1.1. Compliance with DHS Security Policy

All hardware, software, and services provided under this contract must be compliant with:

3.1.1.1. DHS 4300A Sensitive Systems Handbook

https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf https://www.dhs.gov/sites/default/files/publications/4300A%20Sensitive-Systems-Handbook-v12_0-508Cs.pdf

3.1.1.2. U.S. Customs and Border Protection (CBP) Information Systems Security Policies and Procedures Handbook, CIS HB 1400-05D (For Official Use Only- can be released at time of award to successful contractor)

3.1.1.3. DHS Handbook for Safeguarding Sensitive Personally Identifiable Information https://www.dhs.gov/publication/handbook-safeguarding-sensitive-personally-identifiable-information

3.1.1.4. OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, January 3, 2017 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf

3.1.1.5. U.S. Customs and Border Protection (CBP) Information Security Handbook, Office of Professional Responsibility (OPR), HB 1400-04A (Attachment A.1)

3.1.1.6. Privacy Act of 1974, as amended, 5 U.S.C. § 552a

https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a

3.1.1.7. Occupational Safety and Health Act of 1970, as amended https://www.osha.gov/laws-regs/oshact/completeoshact

4. GENERAL REQUIREMENTS

4.1. Contractor Furnished Equipment

4.1.1. To ensure consistent collection and submission of electronic fingerprints, the Contractor must coordinate with the sponsoring Facility Security Officer (FSO) to register their equipment with CBP and the Office of Professional Responsibility:

4.1.1.1. Hardware: Console or desk top computer;

4.1.1.2. Camera;

4.1.1.3. Flatbed scanner;

4.1.1.4. Driver license reader; and

4.1.1.5. Signature pad.

4.2. Fingerprint Facilities

4.2.1. The Contractor shall provide fingerprinting service in each of the forty-eight (48) Continental United States and in Alaska, Hawaii, Washington DC, Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan. The Contractor shall provide fingerprint services within a sixty (60) highway-mile radius of the candidate’s zip code to meet CBP’s background investigation timeline and other requirements addressed in this SOW.

4.2.2. If, in the course of performance, the Contractor becomes unable to schedule an appointment within the required timelines because a facility is not available within a 60 (sixty) highway-mile commuting radius, the Contractor shall notify the COR within one (1) business day of the initial request for services from CBP.

The Contractor shall then be provided two (2) additional business days to locate an acceptable facility.

4.2.2.1. If the Contractor is unable to locate an acceptable facility within the sixty (60) highway-mile radius, the Contractor shall obtain approval from the COR to arrange an alternative solution and shall bear all expenses that the Contractor may incur in executing that alternative solution.

4.2.3. The Contractor shall ensure that all the fingerprint locations meet the requirements of the Occupational Safety and Health Act (see Applicable Documents in this SOW).

4.2.4. Fingerprint Facility Requirements

4.2.4.1. Any firm or business under contract with CBP that requires access to sensitive information must possess a facility security clearance commensurate with the level of access required. This includes any firm or business entity that requires access to sensitive information to prepare a response to a request for proposal (RFP) or a request for bid and/or in performance of a sensitive contract.

4.2.4.2. Firms that do not possess a facility security clearance, or the requisite level of facility security clearance, must be sponsored for a DHS facility security clearance when a determination has been made by the CBP program office that the contract effort will require access to sensitive information.

https://www.dhs.gov/publication/handbook-safeguarding-sensitive-personally-identifiable-information https://www.dhs.gov/publication/handbook-safeguarding-sensitive-personally-identifiable-information https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf https://www.govinfo.gov/app/details/USCODE-2010-title5/USCODE-2010-title5-partI-chap5-subchapII-sec552a https://www.osha.gov/laws-regs/oshact/completeoshact

CBP offices must submit relevant sponsorship requests for facility security clearances to OPR for processing.

5. TASKS

5.1. Task 1 – Requests for Services

5.1.1. On a daily basis, or more frequently when available, CBP shall send via Excel file or via web services information regarding requests for services to be completed. Specific data items included and the format of this file shall be determined by CBP upon award of this contract. The file shall contain the following types of requests:

5.1.1.1. Fingerprint requirements;

5.1.1.2. Candidate’s contact information changes; and

5.1.1.3. Cancellation of requests for candidates who have been removed from the process.

5.1.2. Requests shall be rejected by the Contractor and not processed for various reasons, including, but not limited to, the following reasons:

5.1.2.1. Duplicate requirement requests from CBP candidates and,

5.1.2.2. Incorrect data formatting.

5.1.3. The Contractor shall provide a summary of requests processed and rejected within two (2) hours of receipt of the request. This summary shall include, at a minimum:

5.1.3.1. Number of fingerprint requests processed

5.1.3.2. Number of fingerprint requests processed at each location;

5.1.3.3. Number of requests not scheduled or completed; and,

5.1.3.4. For rejected requests only:

5.1.3.4.1. Candidate’s name and CBP identification number.

5.1.3.4.2. Fingerprint date, if applicable; and,

5.1.3.4.3. Reason for rejection.

5.2. Task 2 – Scheduling Fingerprints

5.2.1. The Contractor shall provide a standard script of language for use in the scheduling process to the COR within fifteen (15) business days of contract award. The script shall be approved by the COR prior to use.

5.2.2. The Contractor shall provide scheduling access to a web based system on a 24 hour 7 days per week, 365 days per year basis.

5.2.2.1. The Contractor shall have the ability to provide an automated self-scheduling capability to allow candidates to elect date, time, and location for fingerprint collection and the ability for the candidate to cancel up to 24 hours prior to their appointment.

5.2.2.1.1. The system shall provide a way to communicate whether an appointment was cancelled by the candidate or by the Contractor,

5.2.2.2. In addition to the requirements above, standard script language shall include:

5.2.2.2.1. Instruction to the candidate as to the necessary items required for the fingerprint process.

5.2.3. The Contractor shall be notified by CBP on a daily basis via vendor provided web-based portal or electronic exchange/web services regarding the fingerprint requests to be scheduled or cancelled. The following data will be provided:

5.2.3.1. Candidate name, contact information (including up to three (3) phone numbers and one (1) email address), and current address for scheduling location purposes;

5.2.3.2. CBP’s fingerprint identification numbers, and candidate identification numbers (including CBP-specific candidate ID number and/or social security number);

5.2.3.3. Position; and,

5.2.3.4. Candidate address changes, and candidates that need to be removed from the scheduling process as they are no longer being considered for positions.

5.2.3.4.1. Candidates who are no longer being considered by CBP, no longer on a contract with, or no longer current employees of CBP shall not be fingerprinted.

5.2.4. Within one (1) business day of receiving the fingerprint request, the Contractor shall identify the potential facility for the candidate to have their fingerprints captured and make the first contact attempt to schedule the process.

5.2.5. The Contractor shall provide the candidate with a unique barcode or ID number that they are expected to provide at their appointment along with two forms of government issued identification.

5.2.6. The Contractor shall use telephone/voicemail, email communication, and SMS text messaging when attempting to contact the candidate to schedule the fingerprint requirement.

5.2.7. Within three (3) business days of the initial request, the Contractor shall coordinate the scheduling of the fingerprints with the candidate and the facility to be administered as follows:

5.2.7.1. The Contractor shall offer fingerprint appointments a minimum of five (5) days per week between the hours of 7:00 am and 7:00 pm local time (unless otherwise instructed).

5.2.7.2. Fingerprinting shall be administered within ten (10) business days of the request from CBP.

5.2.8. If the Contractor is unable to schedule an appointment within the required timeline, the Contractor shall notify the COR within twenty-four (24) hours of making the determination via the Contractor’s web-based portal.

5.2.8.1. “Hard to reach” candidates are individuals whom the Contractor has been unable to reach after a minimum of three (3) documented attempts, on three (3) separate days, using all telephone numbers and email addresses available. The Contractor shall not close requests for at least two (2) business days following the third attempt to contact the candidate.

5.2.8.1.1. The Contractor shall make a minimum total of three (3) contact attempts on three (3) separate days using all provided telephone numbers and email addresses. These contact attempts shall be made at different times of the day before identifying a candidate as “Hard to Reach.”

5.2.8.1.2. The Contractor shall make, at a minimum, one (1) contact attempt using each method of communication provided by CBP before identifying a candidate as “Hard to Reach.”

5.2.8.2. The Contractor shall inform the COR via web services when a requested service is unable to be scheduled. Notification shall be sent within twenty-four (24) hours of making the determination that the service cannot be scheduled. The reasons for failure to schedule a service shall be clearly documented.

Examples include: refusal to schedule; candidate is unable to complete fingerprinting within the specified time frame; candidate is “Hard to Reach”; candidate is no longer interested in the position, is on leave, or is on Temporary Duty Assignment (TDY).

5.2.9. Within twenty-four (24) hours of scheduling the appointment, the Contractor shall send the candidate an email providing the appointment information, facility location, and any items the candidate is required to complete and bring to the appointment. The Contractor’s standardized email language shall be provided to the COR within ten (15) business days of award and shall be approved by the COR prior to use.

One (1) business day prior to the appointment date, the Contractor shall send the candidate a reminder email and SMS text message providing, at a minimum, the scheduled appointment information, facility location, and a reminder to bring the unique barcode or ID number that was provided by the Contractor to their appointment along with two forms of government issued identification. The email language/text message shall be provided to the COR during transition in and shall be approved by the COR prior to use.

If the candidate does not attend the scheduled appointment without prior notification to the Contractor, the candidate is deemed a “No Show.” At the time, the Contractor documents the No Show in the Contractor’s automated system, an email shall be sent to the candidate providing instructions to contact CBP due to the No Show. The email language shall be provided to the COR during transition in and shall be approved by the COR prior to use.

5.3. Task 3 – Processing and Submitting Fingerprint Results

5.3.1. The Contractor shall provide a mechanism whereby CBP can retrieve the electronic fingerprint file in CBP’s prescribed file format for processing and forwarding to the Office of Personnel Management (OPM) or the Defense Counterintelligence and Security Agency (DCSA):

5.3.1.1. The Contractor shall provide a web service delivered document indicating the number of fingerprints transmitted to Cornerstone on a daily basis.

5.3.2. All documentation shall be forwarded, without error, electronically to CBP via web services as soon as submitted to the delegated system and as soon as confirmation of receipt has been received.

5.3.3. Electronic Fingerprint files, along with all associated candidate data, shall be available via the

Contractor’s automated system within one (1) business day of the capture date.

5.3.4. The Contractor shall retain electronic copies of all fingerprint files to the extent required to comply with this SOW’s document retention requirement.

5.4. Task 4- Web Services and Data Reporting Requirements

5.4.1. The Contractor shall maintain a web-based data system, accessible remotely by CBP employees and contractor personnel that enables the user to chronicle all attempted and actual communication between the Contractor and the candidate, as well as fingerprint status. The data system shall have the capability to allow the Contractor to input candidate information and date of fingerprint capture, and for CBP to retrieve those results. Additionally, the system shall have the capability to produce ad hoc, weekly, and monthly reports for capturing the status of fingerprint capture and scheduling status.

5.4.2. The Contractor shall electronically exchange fingerprint status with CBP. Data sent via web services and in the web portal shall be in real-time. This electronic exchange of fingerprint information includes, but shall not be limited to:

5.4.2.1. All scheduling data;

5.4.2.2. Appointment attendance data;

5.4.2.3. Fingerprint capture data;

5.4.2.4. CBP ability to request an additional scheduling attempt;

5.4.2.5. CBP ability to authorize the release of fingerprints to OPM; and

5.4.2.6. Billing information;

5.4.3. The Contractor shall encrypt all Personally Identifiable Information (PII) information prior to sending to CBP via email. CBP shall approve the encryption prior to use according to encryption guidelines.

5.4.4. The Contractor shall maintain an automated database system accessible remotely by the COR and authorized CBP employees and contractor personnel which permits access to specific information about each fingerprint request received by the Contractor from CBP. The information available shall include:

5.4.4.1. The current status of a fingerprint requirement at any time and the dates that key events occurred in the process;

5.4.4.2. Date fingerprinting was requested;

5.4.4.3. Candidate contact information used by the Contractor (including phone numbers, email address, zip code, and any other contact information used in the scheduling process);

5.4.4.4. Correspondence with the candidate (including contact attempts by the Contractor to the candidate, date calls were returned by the candidate, date materials/forms were sent to candidate, etc.);

5.4.4.5. Appointment date and time;

5.4.4.6. Verification of appointment attendance;

5.4.4.7. “Hard to Reach” or “No Show” designations as applicable;

5.4.4.8. CBP identification numbers associated with the fingerprint requirement; and,

5.4.4.9. Any other data items that provide information on the status of the request.

5.4.5. The Contractor’s database system shall have the capability of transmitting all fingerprinting information via Web Services and allow all information to be uploaded into CBP’s automated systems daily.

5.4.6. The Contractor's database shall be accessible to the COR or other designated authorized CBP employees and contractor personnel to query as needed.

5.4.7. The technical and security requirements of Web Services are discussed in the Security section of this SOW.

6. DELIVERABLES

6.1. Security Deliverables

6.1.1. See Security section of this SOW for more detail on these documents. The following shall be submitted to the COR within 30 days of contract award (initial report), and throughout the life of the contract as stated in the table below:

Deliverable Delivery/Frequency

Risk Traceability Matrix Initial and updates when changes to policy occur. Included as Attachment B- Requirements Traceability Matrix (RTM) TEMPLATE v1.0.pdf

System Security Plan Initial and updates when changes to policy occur. Included as Attachment C- System Security Plan TEMPLATE.pdf

Contingency Plan Extensible Initial and updates when changes to policy occur. Included as Attachment D- Contingency Plan Extensible TEMPLATE v1.0.pdf

Contingency Plan Test Extensible Initial and updates when changes to policy occur. Included as Attachment E- Contingency Plan Test Extensible TEMPLATE v1.0.pdf

Security Assessments, Reviews and Reporting

Initial and annual assessments of security controls due at the beginning of each performance period.

6.2. Quality Control Plan (QCP)

6.2.1. Performance measures are based on the services required by this SOW and all attached documents. See below chart that includes but is not limited to the performance measures for this contract:

6.2.1.1. The acceptable quality level for this contract is 95% - all contract information and fingerprint administration services from the Contractor shall be at least 95% accurate. The Quality Control Plan shall include measures (see chart above) for the Contractor to achieve all performance goals. The Contractor shall be responsible for the quality and timely completion of all Contract services.

6.2.2. The Contractor’s Quality Control Plan shall include, at a minimum:

6.2.2.1. All items addressed in the Performance Measures Chart in this SOW;

6.2.2.2. Monitoring the performance of all subcontractors, including:

6.2.2.2.1. Process for identifying and correcting errors/ deficiencies and an error rate not to exceed five (5) percent for work completed by subcontractor(s);

6.2.2.2.2. Verifying the qualifications and training of all staff;

Performance Measures Chart

1. Provide facilities equipped for capturing electronic fingerprints in the forty-eight (48) continental United States as well as Washington, DC; Alaska; Hawaii; Puerto Rico; U.S. Virgin Islands; Guam;

and, Saipan.

2. Complete fingerprinting requirement within sixty (60) highway-mile radius of a candidate’s address.

3. Each facility meets minimum specification requirements set forth in the SOW.

4. Process electronic scheduling requests in accordance with the SOW.

5. Schedule a varying volume of requirements within the timeframes required in the SOW.

6. Provide, maintain, and protect from disclosure a data system accessible remotely by CBP to request, track, manage, and deliver electronic fingerprint data in accordance with the SOW.

7. Provide web services according to the data and reporting requirements of the SOW.

8. Ensure appropriate security of IT resources that are developed, processed, or used under this

Contract in accordance with the SOW.

9. Adhere to the Contractor’s Transition Plan.

10. Perform all services at the acceptable quality level by the end of the transition period as described in this SOW.

11. Assign key personnel that meet the required qualifications of the SOW.

12. Provide sufficient non-key personnel as required.

13. All personnel perform duties and complete tasks as required in this SOW.

14. Adhere to the Contractor’s Quality Control Plan, meet performance measures and acceptable quality levels as required, and meet or exceed the minimum QCP requirements of the SOW.

15. If applicable, adhere to the plan that has been agreed upon by CBP for subcontracting with small and small disadvantaged businesses, in accordance with the Subcontracting Plan Outline and established procedures to monitor and control the subcontracting effort.

6.2.2.2.3. Monitoring pending fingerprint requirements and follow-up to ensure the completion of services within required timeframes; and,

6.2.2.2.4. Verifying candidate attendance at scheduled appointments and ensuring that what is reported back to the Contractor from the subcontractors is accurate.

6.2.2.3. Monitoring the primary Contractor’s performance (including Key Personnel);

6.2.2.4. Contingency plan(s) for emergency operations when the Contractor's and/or subcontractor's services are impacted by natural disasters, severe weather, pandemics, etc.;

6.2.2.5. Contingency plan(s) for loss of information and security breach;

6.2.2.6. Detailed Plan for adhering to required deadlines;

6.2.2.7. The Contractor’s security procedures;

6.2.2.8. Detailed procedures to review and correct data entry errors in automated systems; and

6.2.2.9. Systems to review all information for completeness and accuracy prior to submission to CBP.

6.2.3. Monthly teleconference meetings with the Contractor shall be scheduled to discuss quality control and performance issues. Contractor attendance shall be at the Contractor’s expense.

6.2.3.1. The Contractor shall resolve any issues in accordance with this SOW or as directed by the COR.

6.2.3.2. The Contractor’s quality control effectiveness shall be noted in the annual performance evaluations.

6.2.4. The COR may request on occasion that the Contractor query its database for other statistical reporting. If the need for a particular report becomes more frequent, the COR may request that the report be made available on an ongoing basis to either be sent directly from the Contractor’s personnel to the COR or to be accessible on the Contractor’s data system that can be accessed remotely at any time.

6.3. Reports

6.3.1. The Contractor shall submit all reports to the COR within three (3) business days of the request unless otherwise specified in this SOW.

6.3.2. All reports shall be written to CBP's specifications, and shall be provided electronically via the Contractor’s automated database system in a format prescribed by CBP. The Contractor shall retain electronic copies of all data to the extent required to comply with this SOW’s document retention requirement.

6.3.3. The Project Status Report shall be provided no later than the tenth (10) day of each month containing data from the previous month. This report shall also be provided ad hoc with updated data for a given date range as requested by the COR. The report shall include, at a minimum, the following information separated by position for the given reporting period:

6.3.3.1. Status of all fingerprints for all candidates;

6.3.3.2. Total number of fingerprints captured per date, and the cumulative number of requests ordered for the given reporting period;

6.3.3.3. Total number of fingerprints captured per date, and the cumulative number of requests completed for the given reporting period;

6.3.3.4. Number of fingerprints invoiced;

6.3.3.5. Number of fingerprints closed without invoicing due to inability to contact the candidate(s) (“Hard to Reach”);

6.3.3.6. Number of fingerprints closed without invoicing due to the candidate(s) failure to attend their appointment (“No Show”);

6.3.3.7. Number of fingerprints closed without invoicing for other reasons;

6.3.3.8. Complaints received from candidates (include type of complaint and facility) and final resolutions; and,

6.3.3.9. Number of fingerprints (s) that have been ordered but not billed (i.e., “open” requests).

6.3.4. The Contractor shall provide additional ad hoc reports as requested by the COR. If the need for a particular report becomes frequent, the report shall be available on an ongoing basis.

6.4. Other Deliverables

6.4.1. Scheduling scripts; and,

6.4.2. Standardized email language. Reference section 5.2.9 of this SOW.

7. GOVERNMENT-FURNISHED INFORMATION AND EQUIPMENT (GFE/GFI)

7.1. There is no Government Furnished Equipment for this contract. All Contractor equipment is subject to the requirements outlined in Section 10, Security.

7.2. The Government shall provide contact information of candidates and location of candidates for scheduling purposes.

8. TERM OF CONTRACT

8.1. This single-award indefinite delivery/indefinite quantity contract shall be in effect for five (5) years, effective September 30, 2020 through September 29, 2025, in accordance with the terms and conditions of this contract. The contract shall contain five (5) ordering periods adhering to the following schedule:

Ordering Period 1: September 30, 2020 – September 29, 2021 Ordering Period 2: September 30, 2021 – September 29, 2022 Ordering Period 3: September 30, 2022 – September 29, 2023 Ordering Period 4: September 30, 2023 – September 29, 2024 Ordering Period 5: September 30, 2024 – September 29, 2025

9. PLACE OF PERFORMANCE

9.1. The Government shall not provide the Contractor with a work site(s). The Contractor’s administrative/business office may be at any location(s) in the United States; as for the radius requirement noted herein, only the facilities where the Contractor will perform the services shall be located within the required proximity to the candidates’ work/home address.

9.2. The Contractor shall provide the fingerprinting facilities in each of the forty-eight (48) continental United States as well as Alaska, Hawaii, Washington, D.C., Puerto Rico, the U.S. Virgin Islands, Guam, and Saipan.

10. SECURITY

10.1. The Contractor is fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance).

10.2. The Contractor has a responsibility to protect the information it possesses and processes; and to ensure the security of the information in its charge, the Contractor shall adhere to the same rules and regulations as Government employees.

10.3. All services provided under this contract must be compliant with DHS Information Security Policy, identified in DHS Directive 140-01, Information Technology Security Program and 4300A Sensitive Systems Handbook.

10.4. Security Clearances: Personnel Security Background Data

10.4.1. Performance under this contract is considered sensitive but unclassified and a security clearance is not required.

10.5. Security Requirements for Unclassified Information

10.5.1. The Contractor shall ensure that all information obtained in this Contract remains confidential and is not disseminated outside of CBP. All contract documents, records, and Personally Identifiable Information shall be stored in CBP approved secured locked, fireproof filing cabinets and in a secured room that is not accessible to the public or visitors. The Contractor shall take necessary precautions to ensure that all additional information is properly secured to prevent unauthorized access at all times. The Contractor shall comply with the DHS Handbook for Safeguarding Personally Identifiable Information as amended.

10.5.2. Sensitive Personally Identifiable Information (PII)

Sensitive PII information shall be provided to Contractor by the Government during this contract. When a Contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor shall Accredit (ATO) this information system to the (HHM) FIPS level. The Contractor and subcontractors shall have access to PII such as subject’s names, addresses, telephone numbers, e-mail addresses, date of birth, etc. Only the Contractor and its subcontractors with authorization and only on a need-to-know basis shall access this information. All Sensitive PII Information shall be stored in accordance with requirements by Office of Professional Responsibility (refer to HB 1400-05D attachment). The Sensitive PII information shall be transmitted electronically and encrypted as required in this SOW.

10.5.3. Security and Privacy Awareness Training

All Contractor employees and subcontractors that have access to sensitive DHS/CBP data and to Sensitive Personally Identifiable Information (SPII) are required to complete IT security awareness training on an annual basis. Contractors are required to submit an annual notification to the CBP COR indicating the required training has been completed for all Contractor employees and subcontractors. This notification will be in the form of an email titled, “IT Security Awareness Training.” This email must include the Last Name, First Name, and if applicable, the credential number of the individuals completing the training. This initial training and notification will be completed before any contract employee or subcontractor will be allowed to perform work related to this SOW. During the course of this effort, any new contract employees and/or subcontractors must complete this training before they will be allowed to perform work related to this SOW; and documentation of completion of training must be submitted to the COR. After initial training, each Contractor employee and subcontractor must annually complete this training within thirty (30) days of implementation of option years. The Contractor will submit one email listing all Contractor employees and subcontractors who have completed this training. Any Contractor employee or subcontractor who did not complete this training will not be allowed to perform work related to this SOW.

10.5.4. Release of Information

All information in this Contract shall comply with the Privacy Act, 5 USC § 552a. The information and records generated, maintained, and received shall be protected and used in compliance with CBP policy and regulations. The Contractor shall not release any information to any unauthorized individuals. All requests for information shall be immediately submitted to the COR.

10.5.5 Security Review

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Representative (COR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. The Contractor shall provide access to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

10.6. Encryption

10.6.1. All Contractor owned systems, removable media and storage devices being used to collect, process, disseminate, or maintain privacy and technical information at rest within a non-DHS facility must be encrypted;

and the Contractor shall employ at a minimum Advanced Encryption Standard (AES) algorithms with at least 256 bit encryption that have been validated under NIST Federal Information Processing Standard (FIPS) 140-2.

10.7. Physical and Information Security and Monitoring

10.7.1. The Contractor shall provide a facility using appropriate protective measures to provide for physical security of DHS/CBP IT assets, including data. The facility shall be located within the United States and its territories. The Contractor shall maintain a process to control physical access to DHS/CBP IT assets (which include data).

DHS/CBP IT Assets (including data) shall be monitored 24x7x365. A summary of unauthorized access attempts shall be reported to the CBP COR within 24 hours of any known attempt.

10.8. Anti-malware (e.g., virus, spam)

10.8.1. The Contractor shall design, implement, monitor and manage comprehensive anti-malware service. The Contractor shall provide all maintenance for the system being used to process and/or store DHS/CBP data, providing the anti-malware capabilities to include configuration, definition updates, and comply with DHS/CBP’s configuration management / release management requirements when changes are required. A summary of alerts shall be reported to the CBP COR in weekly status reports. If an abnormality or anomaly is identified, the Contractor shall notify the appropriate CBP point of contact in accordance with the Contractor’s incident response plan.

10.9. Vulnerability Scanning and Patch Management

10.9.1. All Contractor and subcontractor owned desktops, laptops, servers or other media storage devices being used to collect, process, disseminate, or maintain privacy and technical information (DHS/CBP data) must be subject to annual vulnerability assessment scans. All Contractor and subcontractors are responsible for communicating any security sensitive information such as incident reports, notifications, vulnerability alerts and operational statuses to the CBP Security Operations Center (SOC) via the CBP COR to ensure systems are patched in a timely and expeditious manner.

10.10. Contingency and Incident Response Plans

10.10.1. The following plans shall be created in accordance with the requirements identified in the DHS/CBP Security documentation, and the guidelines from the National Institute of Standards and Technology (NIST). NIST documentation can be found at: http://csrc.nist.gov/publications

10.10.2. Contingency Plan

10.10.2.1. Contingency plans provide guidance on the interim measures to recover information system services after a disruption, and may include the relocation of information systems and operations to an alternate site, recovery of information system functions using alternate equipment or the performance of information system functions using manual methods. The Contractor shall provide a plan that contains the detailed guidance and procedures for restoring a damaged system based on the impact levels and recovery requirements.

10.10.3. Incident Response Plan

10.10.3.1. Incident Response plans provide guidance on the appropriate procedures and responses to an incident and the capabilities required to successfully, efficiently, and effectively handle an incident. It encompasses all actions taken to quickly restore normal IT service and to minimize impacts on business operations.

10.10.3.2. The Contractor shall ensure that all privacy and computer security incidents are identified, reported, and appropriately responded to, in order to mitigate harm to DHS/CBP assets, information, and personnel. Privacy incidents must be reported to the CO and COR as soon as possible, but no later than within one hour of recognition that a privacy incident occurred. All privacy incidents must be reported, whether or not they involve information resources.

10.11. Security Breach

10.11.1. If a security breach occurs, in accordance with the Contractor’s Incident Response Plan, the Contractor shall notify the CO and COR within one business day of recognition that a security breach occurred. Within five (5) additional business days the Contractor shall issue and provide a report to the COR and CO detailing the research conducted by the Contractor, conclusions, and preventive measures that will be taken going forward.

The Contractor shall also notify the affected candidates and provide the list of those affected to the COR along with copies of the notification from the Contractor to the affected candidates. The Contractor shall provide, at the Contractor’s expense, identity and credit monitoring services to the affected candidates for no less than 18 months.

10.12. Document Retention

10.12.1. The Contractor shall maintain electronic copies of the associated documentation until OPR confirms receipt and completeness of the transmitted records at which time the Contractor shall then have 90 days to delete the Contractor’s copies. This is in compliance with General Records Schedule 4.2, item 130. Formal contract closeout shall include the CBP Office of Information Technology overseeing the Contractor destroying all data, as required by CBP regulation, which was obtained and retained per this contract.

10.13. Contractor Representation

10.13.1. In correspondence, all Contractor and subcontractor employees must identify themselves as contractors and subcontractors operating on behalf of CBP. E-mail signatures must adhere to the format set out in the Additional Contractor Personnel Requirements clause of the contract.

10.14. Security Assessments, Reviews and Reporting

10.14.1. Security is an integral element in the management of this contract. The Contractor shall conduct assessments, reviews and report the status of the implementation and enforcement of the security requirements contained in this contract.

10.14.2. The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford the Office of the CBP Chief Information Security Officer (CISO) and/or representatives of the CISO, access to the Contractor’s (and subcontractor’s) facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, http://csrc.nist.gov/publications availability, and confidentiality of DHS/CBP data or the function of computer systems operated on behalf of DHS/CBP, and to preserve evidence of computer crime.

10.15. Web Services

10.15.1. The system or application delivered by the Contractor shall provide Web Services functionality (in accordance with Federal security and privacy guidelines) that shall allow for the exchange or sharing of functions and data within its system to and from DHS and CBP owned or contracted systems.

10.15.2. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

10.15.3. Authorization from CBP shall be granted before sending any miscellaneous documentation that needs to be submitted to CBP outside of a web service interface (i.e., via e-mail).

10.15.4. Data input into Contractor systems are owned by DHS and CBP and must be delivered upon demand or at the termination of the contract, in an electronic file format specified by CBP. Upon the completion or termination of a contract and delivery of DHS’/CBP’s data as described, Contractors are required to destroy their local copies of the data upon approval by CBP.

10.15.5. Web Services Requirements

10.15.5.1. The Contractor shall complete all electronic data transfers using web services. This requirement applies to both data provided to and from CBP.

10.15.5.2. Any and all data that is collected, generated, and/or tracked in the vendor system, must be exposed for integration via web service(s) and are to include relationship and unique identifiers.

10.15.6. Technical Requirements of Web Services

10.15.6.1. All Contractor supplied data shall be made available via secure web services, including invoices. This data shall be accessible via a single web service that returns data in an agreed upon XML format. The web service shall accept filter criteria such as an effective date.

10.15.6.2. CBP and the Contractor will define the data needed to be exchanged or shared, the data file formats, the web services exchange mechanism and Application Program Interfaces (APIs) and architecture, as well as the periodicity (up to and including instantaneous, bi-directional data feeds between the Contractor system and CBP systems or databases).

10.15.6.3. Data requirements will change over time, but changes will not exceed four (4) times in a calendar year. The Contractor shall be required to modify their systems to be compliant with CBP changes, within thirty (30) calendar days of being notified of the change(s).

10.15.6.4. Data file transfers shall be performed through TLS Secured HTTP downloads from an authenticated website upon award and during the setup and testing of the web services. The file formats will be specified by CBP.

10.15.6.5. The Contractor’s web service shall conform to the following technical requirements:

10.15.6.5.1. The web service shall be WS-I Basic Profile 1.1 compliant;

10.15.6.5.2. The web service shall be secured via TLS and AES-256 bit encryption;

10.15.6.5.3. The web service shall provide an authentication mechanism that ensures only authorized requests are processed;

10.15.6.5.4. The web service shall execute requests within one second;

10.15.6.5.5. The web service shall execute against and return current, up to date data;

10.15.6.5.6. The web service shall be available for use at all times, 24 hours per day, seven days per week;

10.15.6.5.7. The Contractor shall submit a detailed description of its web service using a standard WSDL x document;

10.15.6.5.8. The Contractor shall provide an XML schema to describe the result set returned by the web service;

10.15.6.5.9. The Contractor shall provide detailed explanation for any error condition that may be raised as a result of web service operation;

10.15.6.5.10. The Contractor shall provide a list containing all possible error codes and a detailed description of each error; and

10.15.6.5.11. The Contractor shall provide end use documentation for its web service.

10.15.7. Web Services Expectations

10.15.7.1 The Contractor shall obtain and adhere to detailed requirements that define:

- Web Service method signatures;

- Input Parameters (filter criteria);

- Output fields;

- XML Schema of the results set returned by web service; and;

- Any additional business rules

10.15.7.2. CBP shall be given the opportunity for acceptance testing of the Contractor provided web service.

10.15.7.3. The COR shall be notified a minimum of two weeks prior to any modifications made to the web service; final approval by the COR shall be required before implementation.

10.15.7.4. All production versions of the deployed web service shall be available in production and removed only upon request from CO or with CBP’s explicit permission.

10.15.7.5. The COR shall be notified at least 24 hours in advance of any web service maintenance that shall require web service down time. During downtime, fingerprint results shall still be made available to the COR in an agreed method. The method shall be agreed upon after award, during initial transition meetings.

10.15.7.6. The Contractor’s web service support shall have a response time of 24 hours or less; however, the Contractor’s web service support personnel do not need to be available 24 hours per day, seven (7) days per week.

10.15.7.7. Safeguards shall also be put in place to protect the PII.

11. OTHER CONSIDERATIONS

11.1. Transition Process

11.1.1. The transition period shall begin once the contract is awarded and shall be completed no later than 60 days after the award. After the transition period, the Contractor shall be fully capable of executing all services required in this SOW. Once ordering starts, CBP may continually request fingerprints without breaks in ordering, subject to hiring requirements and the availability of funds.

11.1.2. The Contractor shall complete the following during the transition period:

11.1.2.1. Performing personnel security clearances/checks to the extent required by the contract;

11.1.2.2. Training all facilities and administrators performing the fingerprint process;

11.1.2.3. Testing and modification as necessary of automated database system;

11.1.2.4. Testing and modification as necessary of files for web services data transfers;

11.1.2.5. Testing and modification as necessary of files for electronic invoices;

11.1.2.6. Review and acceptance of all standardized materials received from authorized CBP staff;

11.1.2.7. Provide An overview of all reports the Contractor has available for the Government; and

11.1.2.8. Provide Access for all authorized CBP employees and contractor personnel to the Contractor’s remotely-accessible automated database system and any secure e-mail systems, etc. The COR shall provide information on CBP employees and contractor personnel that shall be granted this access.

11.2. Hours of Operation

11.2.1. The Contractor’s key personnel and other personnel who are involved in scheduling fingerprints shall be available from 9:00 am to 5:00 pm Eastern Time (unless otherwise instructed), Monday through Friday, except on Federal holidays; however, fingerprinting shall be conducted from 7:00 am to 7:00 pm local time (unless otherwise instructed) a minimum of five (5) days per week in all time zones.