Attachment B COVID-19 Testing Statement of Objectives.pdf

STATEMENT OF OBJECTIVES 1

COVID 19 Rapid Field Testing 2

FEMA OCFO FBO 3

Biloxi, MS 4

BACKGROUND: Enabling a rapid response health and welfare capability for federal staff 7 during emergency events is a mission-critical requirement. The Federal Emergency 8 Management Agency (FEMA) leads the nation in preventing, preparing for, responding to, 9 and recovering from the adverse effects emergencies and disasters create, by supporting our 10 communities' ability to withstand adversity, strengthening our resilience and response 11 systems, and enhancing readiness. FEMA provides resources to their federal partners to 12 enable effective response to emergencies and catastrophic events, which overwhelm the 13 capacity of state and local emergency systems. The Mission of the OCFO FBO is to enhance 14 the capabilities of the OCFO FBO analytics unit in data mining large volumes of financial 15 information related to disaster grants, and in response to DHS/OMB/HAC/SAC/OIG/GAO 16 and senior leadership situational awareness used in policy decision making and external 17 testimony and reporting on the use of billions of dollars of appropriated disaster funding. 18

SCOPE OF WORK/SPECIFICATIONS: FEMA intends to acquire commercial services to 21 provide equipment and personnel to conduct rapid antigen COVID-19 Testing of federal staff 22 and disaster responders at the OCFO FBO offices in Biloxi, Mississippi. While certain tests and 23 capabilities are described below, the government reserves the right to introduce new 24 technologies and testing capabilities for the vendor to administer, as they come online. The 25 government expects that the contractor shall keep up to date on new and emerging testing 26 capabilities and be prepared to utilize them if required by the government. 27

The contractor shall process an estimate volume of 60 to 80 personnel tests on a weekly basis at 29

OCFO FBO. The contractor shall be able to ramp up and be on site within 48 hours of issuance 30 of a Call Order for OCFO FBO in Biloxi, Mississippi. 31

OCFO FBO testing assumptions: 33

Daily Estimated # of Tests

Category Sun Mon Tues Wed Thurs Fri Sat

Staff at OCFO FBO 7

Disaster Responders 30 30

Testing will take place at one FEMA location utilizing a mobile testing unit: 40

220 Popps Ferry Road Biloxi, MS 39531: 0700 to 0900 Monday and Thursday. 42

Testing will also include a temperature check. 43

PCR confirmation testing will not be required, but will be made available at one of the 44 contractor’s locations. 45

The contractor shall provide all the resources necessary to carry out these requirements, such as 47 (but not limited to) personnel, administration, PPE, diagnostic testing, vital sign measurement, 48 and biomedical waste collection. The contractor shall provide near real time results in 15 to 45 49 minutes and convey those results to the individuals being tested in a manner that ensures privacy 50 standards are maintained (hard copy preferred). The contractor must have a CLIA waiver in 51 order to perform the requested lab tests. 52

The contractor shall provide this capability based on State and local Public Health requirements. 54 The government reserves the right to expand the requirement to include concurrent operations at 55 multiple facilities. The contractor shall provide confirmatory reverse transcriptase-polymerase 56 chain reaction (RT- PCR) testing where positives are identified from the initial screening and/or 57 where false positives are suspected (e.g., antigen or isothermal amplification testing). 58 The contractor shall provide adequate environmental controls (e.g. HVAC and humidity control) 60 for all required equipment, storage, and use. The contractor shall be responsible for the disposal 61 of any biomedical waste generated during the testing process, as per local, state, and federal 62 regulations. 63

The contractor shall provide the government with a Performance Work Statement (PWS) that 65 outlines specifically how they intend to meet the requirements listed in this Statement Of 66

Objectives (SOO), the sequence of instituting said requirements, and a timeline acceptable to the 67 government of when each of these capabilities will be fully activated. The contractor shall abide 68 by all local, state, and federal safety protocols, legal requirements, and information security 69 requirements. The contractor shall provide in the PWS specific actions they will take to ensure 70 privacy, protected personally identifiable information (PII) pursuant to the Privacy Act of 1974, 71 and protected health information (PHI), as appropriate per the Health Insurance Portability and 72 Accountability Act (HIPAA), as applicable. 73 The contractor shall provide COVID-19 diagnostic testing and associated services as a managed 75 service, to include on-site screening, testing, and results tracking, on a routine basis at DHS 76 designated locations. The contractor shall provide managed services with FDA approved or FDA 77 EUA test kits or using government furnished test kits. Specific requirements will be stated at the 78 order level. 79 Services shall also include: 81

• Provisioning of all personnel, equipment, supplies, facilities, tools, materials, supervision and 83 other items and services necessary to conduct testing and provide results. This includes a 84 requirement to provide Personal Protective Equipment (PPE) for medical personnel 85 administering tests, in accordance with Centers for Disease Control and Prevention (CDC) 86 and Occupational Safety and Health Administration (OSHA) guidelines for “Preferred PPE.” 87

• FDA approved or emergency authorized use COVID-19 antigen test that detects for the 88 presence of the SARS-CoV-2 virus with an accuracy rate aligned to best technology and 89 current industry practice 90

• A HIPAA and Privacy Act compliant, secure portal for information collection and 91 notification of results. Scripts of engagement between the vendor and responder must be 92 provided in advance to ensure meeting FEMA privacy requirements 93

• Access to licensed physician(s) who can answer any questions by test takers about the test 94 results and help determine next steps in care 95

• A capability to provide a phone call notification when the virus is detected, with prompt 96 access to a licensed health professional 97

• An anonymized aggregate report with the total number of participants tested and the total 98 number of participants who tested positive for the virus versus negative for the virus 99

• Any other pertinent reports required by the government as directed by the Contracting 100 Officer (CO) or Contracting Officer’s Representative (COR) 101

• The capability to provide Individual results report in electronic fashion or hard copy, 102 downloadable by the identified employee 103

• Access to individual results and reports with customizable access restriction to ensure 104 compliance with privacy and information security requirements 105

• The ability to enable contact tracing, meeting CDC guidance and state and local reporting 106 requirements. 107

ADDITIONAL REQUIREMENTS: COVID-19 diagnostic testing acquired through this 108 vehicle must be carried out in compliance with 5 C.F.R Part 339, the Rehabilitation Act, 29 109 U.S.C. § 701 et seq., and Americans with Disabilities Act (ADA), 42 U.S.C. §§ 12102 et seq. 110 Components may only carry out such testing after a determination has been made that their 111 planned testing program complies with the Fourth Amendment, Rehabilitation Act, the ADA, 5 112 C.F.R. Part 339, and any other applicable law. In carrying out COVID-19 diagnostic testing 113

Components must ensure compliance with its collective bargaining requirements. 114

Any information collected and disclosed pursuant to COVID-19 diagnostic testing acquired 116 through this IDIQ must be collected and disclosed in compliance with, as applicable, the Privacy 117 Act of 1974, as amended, 5 U.S.C. § 552a, the CARES Act, HIPAA (when otherwise applicable) 118 and any other applicable law. 119

Privacy Act compliance requires that information collected and disclosed pursuant to COVID-19 121 diagnostic testing acquired through this IDIQ be covered by an applicable system or records 122 notice (SORN) prior to such collection and disclosure. Components shall coordinate with their 123 Component Privacy Office and legal counsel in planning testing in order to ensure that a SORN 124 governs the population to be tested and the information to be collected and disclosed. 125

DELIVERABLES: 127

• As described in Scope/Specifications sections above 128

• Itemized Invoice every thirty (30) days during the period of performance 129

PERIOD OF PERFORMANCE: 60 days from date of award, 0700 to 0900 Monday and 131

Thursday, with an option to extend services for an additional 30 days, if required. 132 CONTRACTOR FURNISHED PROPERTY: All the required materials to support the 134 implementation of the SOO per PWS. 135

REPORTING REQUIREMENTS: The contractor shall report on all activities supported as 137 directed by the COR and provide an itemized Invoice every thirty (30) days during the period of 138 performance. 139 SECURITY AND SECURITY TRAINING: All personnel require access to information up to 141 the sensitive but unclassified, for official use only (FOUO) levels. Contractor must ensure 142 contractor employees receive a favorably adjudicated public trust suitability prior to entry on 143 duty (EOD). All individuals will be U.S. citizens. The contractor shall follow the standards 144 established within DHS and FEMA policy. 145

Security Training. Certificate of training is required for all cleared contractor employees who 147 are working with classified or unclassified information. All certificates must be sent to the 148 assigned FEMA Contracting Officer Representative (COR), before the contractor or 149 subcontractor is granted access to classified or unclassified information but no later than 30 150 calendar days after awarded contract. Send certificates of completion for Unauthorized 151 Disclosure, OPSEC, and Insider Threat to the FEMA COR no later than 30 calendar days after 152 awarded contract. New employees entering the contract must receive the briefing within ten (10) 153 business days of joining the contract. 154

Unauthorized Disclosure of Classified or Unclassified Information. Contractors and 156 subcontractors who are working on this contract shall receive Unauthorized Disclosure of 157

Classified or Unclassified Information training. Access to the training can be obtained at 158 https://securityawareness.usalearning.gov/disclosure/index.html 159

OPSEC Training. Contractors and subcontractors who are working on this contract shall 161 receive the OPSEC Awareness Brief. Access to the briefing can be obtained at 162 https://securityawareness.usalearning.gov/opsec/ 163 Insider Threat Training. Insider Threat training for contractors can be found at: 165 https://securityawareness.usalearning.gov/itawareness/index.htm# 166

For Official Use Only (FOUO) Information. In accordance with DHS Management Directive 168

11042.1 contractors, consultants and others to whom access is granted will abide by 11042.1; 169 DHS policy regarding the identification and safeguarding of sensitive but unclassified 170 information originated within DHS. It also applies to other sensitive but unclassified information 171 received by DHS from other government and non-governmental activities. 172

The contractor shall: 175

1. Be aware of and comply with the safeguarding requirements for “For Official Use 176

Only” (FOUO) information as outlined in this directive. 177

2. Participate in formal classroom or computer-based training sessions presented to 178 communicate the requirements for safeguarding FOUO and other sensitive but unclassified 179 information. 180

3. Be aware that divulging information without proper authority could result in 181 administrative or disciplinary action. 182

Contractors and consultants shall execute a DHS Form 11000-6, Sensitive but Unclassified 184

Information Non¬ Disclosure Agreement (NDA), as a condition of access to such information. 185

Other individuals not assigned to or contractually obligated to DHS, but to whom access to 186 information will be granted, may be requested to execute an NDA as determined by the 187 applicable program manager. Execution of the NDA shall be effective upon date of the DHS 188

Policy and not applied retroactively. 189

INFORMATION SHARING: 190

The FEMA contractor shall only collect or maintain information from and about FEMA employees 192 only. To accomplish the tasks outlined in this contract, FEMA may only share with or allow access 193 to by the contractor the following PII data elements: 194

Identification number/Account number 196 Name 197

Date of birth (DOB) 198 Gender 199 Mailing address 200

Email address 201 Occupation (Optional) 202

Testing Kits 203 Testing Results 204

The information sharing outlined in this contract is authorized by the following System of 206

Records Notice(s) and Routine Use(s): DHS/ALL-047 Records Related to DHS Personnel, 207

Long-Term Trainees, Contractors, and Visitors During a Declared Public Health Emergency 208 System of Records, Routine use G. 209

The contractor shall limit access to the PII provided by FEMA under this contract only to the 211 contractor’s authorized personnel who need to know the information to accomplish the tasks 212 outlined in this contract. 213 The contractor shall ensure no computer matching, as that term is defined in 5 U.S.C. § 552a(o), 215 will occur for the purpose of establishing or verifying eligibility or compliance as it relates to 216 cash or in-kind assistance or payments under federal benefit programs. 217

If at any time during the term of this contract any part of FEMA PII, in any form, that the 219 contractor obtains from FEMA ceases to be required by the contractor for the performance of the 220 contract, or upon termination of the contract, whichever occurs first, the contractor shall, within 221 fourteen (14) days thereafter, promptly notify FEMA and securely return PII to FEMA, or, at 222 FEMA’s written request destroy, un-install and/or remove all copies of such PII in the 223 contractor’s possession or control, and certify in writing to FEMA that such tasks have been 224 completed. 225

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015) 228

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 230 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert 231 the substance of this clause in all subcontracts. 232

(b) Definitions. As used in this clause— 234 “Personally Identifiable Information (PII)” means information that can be used to distinguish 235 or trace an individual's identity, such as name, social security number, or biometric records, 236 either alone, or when combined with other personal or identifying information that is linked or 237 linkable to a specific individual, such as date and place of birth, or mother’s maiden name. 238 The definition of PII is not anchored to any single category of information or technology. 239

Rather, it requires a case-by-case assessment of the specific risk that an individual can be 240 identified. In performing this assessment, it is important for an agency to recognize that non-241 personally identifiable information can become personally identifiable information whenever 242 additional information is made publicly available—in any medium and from any source—243 that, combined with other available information, could be used to identify an individual. 244

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, 246 date of birth, mailing address, telephone number, Social Security number (SSN), email 247 address, zip code, account numbers, certificate/license numbers, vehicle identifiers including 248 license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric 249 identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other 250 unique identifying number or characteristic, and any information where it is reasonably 251 foreseeable that the information will be linked with other information to identify the 252 individual. 253

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee 255 Access, as any information, which if lost, misused, disclosed, or, without authorization is 256 accessed, or modified, could adversely affect the national or homeland security interest, the 257 conduct of Federal programs, or the privacy to which individuals are entitled under section 258

552a of Title 5, United States Code (the Privacy Act), but which has not been specifically 259 authorized under criteria established by an Executive Order or an Act of Congress to be kept 260 secret in the interest of national defense, homeland security or foreign policy. This definition 261 includes the following categories of information: 262

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure 264 Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 265 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of 266 Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as 267 amended, and any supplementary guidance officially communicated by an authorized official 268 of the Department of Homeland Security (including the PCII Program Manager or his/her 269 designee); 270

Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, 272

Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as 273 amended, and any supplementary guidance officially communicated by an authorized 274 official of the Department of Homeland Security (including the Assistant Secretary for the 275

Transportation Security Administration or his/her designee); 276

Information designated as “For Official Use Only,” which is unclassified information of a 278 sensitive nature and the unauthorized disclosure of which could adversely impact a person’s 279 privacy or welfare, the conduct of Federal programs, or other programs or operations 280 essential to the national or homeland security interest; and 281

(2) Any information that is designated “sensitive” or subject to other controls, safeguards 283 or protections in accordance with subsequently adopted homeland security information 284 handling procedures. 285 “Sensitive Information Incident” is an incident that includes the known, potential, or 287 suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized 288 acquisition, or unauthorized access or attempted access of any Government system, 289

Contractor system, or sensitive information. 290 “Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, 291 compromised or disclosed without authorization, could result in substantial harm, 292 embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive 293 as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), 294 driver’s license or state identification number, Alien Registration Numbers (A-number), 295 financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. 296

Additional examples include any groupings of information that contain an individual’s name 297 or other unique identifier plus one or more of the following elements: 298

(1) Truncated SSN (such as last 4 digits) 299

(2) Date of birth (month, day, and year) 300

(3) Citizenship or immigration status 301

(4) Ethnic or religious affiliation 302

(5) Sexual orientation 303

(6) Criminal History 304

(7) Medical Information 305

(8) System authentication information such as mother’s maiden name, account passwords 306 or personal identification numbers (PIN) 307

Other PII may be “sensitive” depending on its context, such as a list of employees and their 309 performance ratings or an unlisted home address or phone number. In contrast, a business 310 card or public telephone directory of agency employees contains PII but is not sensitive. 311

(c) Authorities. The Contractor shall follow all current versions of Government policies and 313 guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-314 contractors, or available upon request from the Contracting Officer, including but not 315 limited to: 316

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for 317 Official Use Only) Information 318

(2) DHS Sensitive Systems Policy Directive 4300A 319

(3) DHS 4300A Sensitive Systems Handbook and Attachments 320

(4) DHS Security Authorization Process Guide 321

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information 322

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security 323 Personnel Suitability and Security Program 324

(7) DHS Information Security Performance Plan (current fiscal year) 325

(8) DHS Privacy Incident Handling Guidance 326

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for 327 Cryptographic Modules accessible at 328 http://csrc.nist.gov/groups/STM/cmvp/standards.html 329

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 330

Security and Privacy Controls for Federal Information Systems and Organizations accessible 331 at http://csrc.nist.gov/publications/PubsSPs.html 332

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible 333 at http://csrc.nist.gov/publications/PubsSPs.html 334

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as 336 the policies and procedures described below, is required. 337

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel 339 security requirements are set forth in various Management Directives (MDs), Directives, and 340 Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) 341

Information describes how Contractors must handle sensitive but unclassified information. 342 DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified 343 information that is not otherwise categorized by statute or regulation. Examples of sensitive 344 information that are categorized by statute or regulation are PCII, SSI, etc. The DHS 345 Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook 346 provide the policies and procedures on security for Information Technology (IT) resources. 347 The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides 348 guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction 349 Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security 350 Program establishes procedures, program responsibilities, minimum standards, and reporting 351 http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors http://csrc.nist.gov/groups/STM/cmvp/standards.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html protocols for the DHS Personnel Suitability and Security Program. 352

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, 354 and/or transmitted by the Contractor except as specified in the contract. 355

(3) All Contractor employees with access to sensitive information shall execute DHS Form 357

11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition 358 of access to such information. The Contractor shall maintain signed copies of the NDA for 359 all employees as a record of compliance. The Contractor shall provide copies of the signed 360 NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after 361 execution of the form. 362

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to 364 support financial or other administrative functions shall not maintain SPII. It is acceptable 365 to maintain in these systems the names, titles and contact information for the COR or other 366 Government personnel associated with the administration of the contract, as needed. 367

(e) Authority to Operate. The Contractor shall not input, store, process, output, and/or 369 transmit sensitive information within a Contractor IT system without an Authority to 370

Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation 371 with the Headquarters or Component Privacy Officer. Unless otherwise specified in the 372 ATO letter, the ATO is valid for three (3) years. The Contractor shall adhere to current 373

Government policies, procedures, and guidance for the Security Authorization (SA) process 374 as defined below. 375

(1) Complete the Security Authorization process. The SA process shall proceed according to 377 the DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any 378 successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, 2012), 379 or any successor publication, and the Security Authorization Process Guide including 380 templates. 381

(i) Security Authorization Process Documentation. SA documentation shall be 383 developed using the Government provided Requirements Traceability Matrix and 384

Government security documentation templates. SA documentation consists of the 385 following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration 386 Management Plan, Security Assessment Plan, Security Assessment Report, and 387

Authorization to Operate Letter. Additional documents that may be required include a 388 Plan(s) of Action and Milestones and Interconnection Security Agreement(s). During the 389 development of SA documentation, the Contractor shall submit a signed SA package, 390 validated by an independent third party, to the COR for acceptance by the Headquarters or 391

Component CIO, or designee, at least thirty (30) days prior to the date of operation of the 392 IT system. The Government is the final authority on the compliance of the SA package 393 and may limit the number of resubmissions of a modified SA package. Once the ATO has 394 been accepted by the Headquarters or Component CIO, or designee, the Contracting 395 Officer shall incorporate the ATO into the contract as a compliance document. The 396 Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to 397 ensure the IT system controls are implemented and operating effectively. 398

(ii) Independent Assessment. Contractors shall have an independent third party validate 400 the security and privacy controls in place for the system(s). The independent third party 401 shall review and analyze the SA package, and report on technical, operational, and 402 management level deficiencies as outlined in NIST Special Publication 800-53 Security 403 and Privacy Controls for Federal Information Systems and Organizations. The 404

Contractor shall address all deficiencies before submitting the SA package to the 405 Government for acceptance. 406

Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of 408 the SA process, the Contractor may be required to support the Government in the 409 completion of the PTA. The requirement to complete a PTA is triggered by the creation, 410 use, modification, upgrade, or disposition of a Contractor IT system that will store, 411 maintain and use PII, and must be renewed at least every three (3) years. Upon review of 412 the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) 413 and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are 414 required. The Contractor shall provide all support necessary to assist the Department in 415 completing the PIA in a timely manner and shall ensure that project management plans 416 and schedules include time for the completion of the PTA, PIA, and SORN (to the extent 417 required) as milestones. Support in this context includes responding timely to requests for 418 information from the Government about the use, access, storage, and maintenance of PII 419 on the Contractor’s system, and providing timely review of relevant compliance 420 documents for factual accuracy. Information on the DHS privacy compliance process, 421 including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-422 compliance. 423

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be 425 renewed every three (3) years. The Contractor is required to update its SA package as part 426 of the ATO renewal process. The Contractor shall update its SA package by one of the 427 following methods: 428

(1) Updating the SA documentation in the DHS automated information assurance tool for 429 acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the 430 ATO expiration date for review and verification of security controls; or (2) Submitting an 431 updated SA package directly to the COR for approval by the Headquarters or Component 432

CIO, or designee, at least 90 days before the ATO expiration date for review and verification 433 of security controls. The 90 day review process is independent of the system production date 434 and therefore it is important that the Contractor build the review into project schedules. The 435 reviews may include onsite visits that involve physical or logical inspection of the Contractor 436 environment to ensure controls are in place. 437

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure 439 that the security requirements contained in this contract are being implemented and enforced. 440 The Contractor shall afford DHS, the Office of the Inspector General, and other Government 441 organizations access to the Contractor’s facilities, installations, operations, documentation, 442 http://www.dhs.gov/privacy-compliance http://www.dhs.gov/privacy-compliance databases and personnel used in the performance of this contract. The Contractor shall, 443 through the Contracting Officer and COR, contact the Headquarters or Component CIO, or 444 designee, to coordinate and participate in review and inspection activity by Government 445 organizations external to the DHS. Access shall be provided, to the extent necessary as 446 determined by the Government, for the Government to carry out a program of inspection, 447 investigation, and audit to safeguard against threats and hazards to the integrity, availability 448 and confidentiality of Government data or the function of computer systems used in 449 performance of this contract and to preserve evidence of computer crime. 450

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, 452 and/or transmit sensitive information shall meet or exceed the continuous monitoring 453 requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, 454 or successor publication. The plan is updated on an annual basis. The Contractor shall also 455 store monthly continuous monitoring data at its location for a period not less than one year 456 from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 457 Security Requirements for Cryptographic Modules and shall not be stored on systems that are 458 shared with other commercial or Government entities. The Government may elect to perform 459 continuous monitoring and IT security scanning of Contractor systems from Government 460 tools and infrastructure. 461

(5) Revocation of ATO. In the event of a sensitive information incident, the Government 463 may suspend or revoke an existing ATO (either in part or in whole). If an ATO is 464 suspended or revoked in accordance with this provision, the Contracting Officer may direct 465 the Contractor to take additional security measures to secure sensitive information. These 466 measures may include restricting access to sensitive information on the Contractor IT 467 system under this 468 contract. Restricting access may include disconnecting the system processing, storing, or 469 transmitting the sensitive information from the Internet or other networks or applying 470 additional security controls. 471

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of 473 the Government or operating systems containing sensitive information shall comply with 474

Federal reporting requirements. Annual and quarterly data collection will be coordinated by 475 the Government. Contractors shall provide the COR with requested information within three 476

(3) business days of receipt of the request. Reporting requirements are determined by the 477 Government and are defined in the Fiscal Year 2014 DHS Information Security Performance 478

Plan, or successor publication. The Contractor shall provide the Government with all 479 information to fully satisfy Federal reporting requirements for Contractor systems. 480

(f) Sensitive Information Incident Reporting Requirements. 482

(1) All known or suspected sensitive information incidents shall be reported to the 484 Headquarters or Component Security Operations Center (SOC) within one hour of discovery 485 in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting 486 requirements. When notifying the Headquarters or Component SOC, the Contractor shall also 487 notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-488

CERT using the contact information identified in the contract. If the incident is reported by 489 phone or the Contracting Officer’s email address is not immediately available, the Contractor 490 shall contact the Contracting Officer immediately after reporting the incident to the 491 Headquarters or Component SOC. The Contractor shall not include any sensitive information 492 in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall 493 use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption 494 methods to protect sensitive information in attachments to email. Passwords shall not be 495 communicated in the same email as the attachment. A sensitive information incident shall not, 496 by itself, be interpreted as evidence that the Contractor has failed to provide adequate 497 information security safeguards for sensitive information, or has otherwise failed to meet the 498 requirements of the contract. 499

(2) If a sensitive information incident involves PII or SPII, in addition to the reporting 501 requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, 502 Contractors shall also provide as many of the following data elements that are available at 503 the time the incident is reported, with any remaining data elements provided within 24 504 hours of submission of the initial incident report: 505

(i) Data Universal Numbering System (DUNS); 507

(ii) Contract numbers affected unless all contracts by the company are affected; 508

(iii) Facility CAGE code if the location of the event is different than the prime 509 contractor location; 510

(iv) Point of contact (POC) if different than the POC recorded in the System for 511

Award Management (address, position, telephone, email); 512

(v) Contracting Officer POC (address, telephone, email); 513

(vi) Contract clearance level; 514

(vii) Name of subcontractor and CAGE code if this was an incident on a 515 subcontractor network; 516

(viii) Government programs, platforms or systems involved; 517

(ix) Location(s) of incident; 518

(x) Date and time the incident was discovered; 519

(xi) Server names where sensitive information resided at the time of the incident, both at 520 the Contractor and subcontractor level; 521

(xii) Description of the Government PII and/or SPII contained within the system; 522

(xiii) Number of people potentially affected and the estimate or actual number of 523 records exposed and/or contained within the system; and 524

(xiv) Any additional information relevant to the incident. 525

(g) Sensitive Information Incident Response Requirements. 527

(1) All determinations related to sensitive information incidents, including response 529 activities, notifications to affected individuals and/or Federal agencies, and related services 530 (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation 531 with the Headquarters or Component CIO and Headquarters or Component Privacy 532 Officer. 533

(2) The Contractor shall provide full access and cooperation for all activities determined by 535 the Government to be required to ensure an effective incident response, including providing 536 all requested images, log files, and event information to facilitate rapid resolution of 537 sensitive information incidents. 538

(3) Incident response activities determined to be required by the Government may include, 540 but are not limited to, the following: 541

(i) Inspections, 543

(ii) Investigations, 544

(iii) Forensic reviews, and 545

(iv) Data analyses and processing. 546

(4) The Government, at its sole discretion, may obtain the assistance from other Federal 548 agencies and/or third-party firms to aid in incident response activities. 549

(h) Additional PII and/or SPII Notification Requirements. 551

(1) The Contractor shall have in place procedures and the capability to notify any individual 553 whose PII resided in the Contractor IT system at the time of the sensitive information 554 incident not later than 5 business days after being directed to notify individuals, unless 555 otherwise approved by the Contracting Officer. The method and content of any 556 notification by the Contractor shall be coordinated with, and subject to prior written 557 approval by the Contracting 558

Officer, in consultation with the Headquarters or Component Privacy Officer, utilizing the 559 DHS Privacy Incident Handling Guidance. The Contractor shall not proceed with 560 notification unless the Contracting Officer, in consultation with the Headquarters or 561

Component Privacy Officer, has determined in writing that notification is appropriate. 562

(2) Subject to Government analysis of the incident and the terms of its instructions to the 564

Contractor regarding any resulting notification, the notification method may consist of letters 565 to affected individuals sent by first class mail, electronic means, or general public notice, as 566 approved by the Government. Notification may require the Contractor’s use of address 567 verification and/or address location services. At a minimum, the notification shall include: 568

(i) A brief description of the incident; 570

(ii) A description of the types of PII and SPII involved; 571

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means; 572

(iv) Steps individuals may take to protect themselves; 573

(v) What the Contractor and/or the Government are doing to investigate the incident, 574 to mitigate the incident, and to protect against any future incidents; and 575

(vi) Information identifying who individuals may contact for additional information. 576

(i) Credit Monitoring Requirements. In the event that a sensitive information incident 578 involves PII or SPII, the Contractor may be required to, as directed by the Contracting 579

Officer: 580

(1) Provide notification to affected individuals as described above; and/or 582

(2) Provide credit monitoring services to individuals whose data was under the control of the 584 Contractor or resided in the Contractor IT system at the time of the sensitive information 585 incident for a period beginning the date of the incident and extending not less than 18 months 586 from the date the individual is notified. Credit monitoring services shall be provided from a 587 company with which the Contractor has no affiliation. At a minimum, credit monitoring 588 services shall include: 589

(i) Triple credit bureau monitoring; 591

(ii) Daily customer service; 592

(iii) Alerts provided to the individual for changes and fraud; and 593

(iv) Assistance to the individual with enrollment in the services and the use of fraud 594 alerts; and/or 595

(3) Establish a dedicated call center. Call center services shall include: 597

(i) A dedicated telephone number to contact customer service within a fixed period; 599

(ii) Information necessary for registrants/enrollees to access credit reports and 600 credit scores; 601

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot 602 be handled by call center staff and must be resolved by call center management or DHS, 603 as appropriate), and other key metrics; 604

(iv) Escalation of calls that cannot be handled by call center staff to call center 605 management or DHS, as appropriate; 606

(v) Customized FAQs, approved in writing by the Contracting Officer in coordination 607 with the Headquarters or Component Chief Privacy Officer; and 608

(vi) Information for registrants to contact customer service representatives and 609 fraud resolution representatives for credit monitoring assistance. 610

(j) Certification of Sanitization of Government and Government-Activity-Related Files and 612 Information. As part of contract closeout, the Contractor shall submit the certification to the 613

COR and the Contracting Officer following the template provided in NIST Special 614

Publication 800-88 Guidelines for Media Sanitization. 615

INFORMATION TECHNOLOGY SECURITY AND PRIVACY TRAINING (MAR 618

2015) 619

Applicability. This clause applies to the Contractor, its subcontractors, and Contractor 621 employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the 622 substance of this clause in all subcontracts. 623

Security Training Requirements. 625 All users of Federal information systems are required by Title 5, Code of Federal Regulations, 627 Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually 628 or whenever system security changes occur, or when the user’s responsibilities change. The 629

Department of Homeland Security (DHS) requires that Contractor employees take an annual 630 Information Technology Security Awareness Training course before accessing sensitive 631 information under the contract. Unless otherwise specified, the training shall be completed 632 within thirty (30) days of contract award and be completed on an annual basis thereafter not 633 later than October 31st of each year. Any new Contractor employees assigned to the contract 634 shall complete the training before accessing sensitive information under the contract. The 635 training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. 636

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor 637 employees as a record of compliance. Unless otherwise specified, initial training certificates for 638 each Contractor and subcontractor employee shall be provided to the Contracting Officer’s 639 Representative (COR) not later than thirty (30) days after contract award. Subsequent training 640 certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail 641 notification not later than October 31st of each year. The e-mail notification shall state the 642 required training has been completed for all Contractor and subcontractor employees. 643 The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that 645 will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall 646 be signed before accessing DHS systems and sensitive information. The DHS Rules of 647

Behavior is a document that informs users of their responsibilities when accessing DHS systems 648 and holds users accountable for actions taken while accessing DHS systems and using DHS 649 Information Technology resources capable of inputting, storing, processing, outputting, and/or 650 transmitting sensitive information. The DHS Rules of Behavior is accessible at 651 http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise 652 specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. 653

Any new Contractor employees assigned to the contract shall also sign the DHS Rules of 654

Behavior before accessing DHS systems and sensitive information. The Contractor shall 655 maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor 656 employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail 657 copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after 658 contract award for each employee. The DHS Rules of Behavior will be reviewed annually and 659 the COR will provide notification when a review is required. 660

Privacy Training Requirements. All Contractor and subcontractor employees that will have 662 access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to 663 http://www.dhs.gov/dhs-security-and-training-requirements-contractors take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The 664 training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-665 contractors. 666

Training shall be completed within thirty (30) days of contract award and be completed on an 668 annual basis thereafter not later than October 31 st of each year. Any new Contractor employees 669 assigned to the contract shall also complete the training before accessing PII and/or SPII. The 670 Contractor shall maintain copies of training certificates for all Contractor and subcontractor 671 employees as a record of compliance. Initial training certificates for each Contractor and 672 subcontractor employee shall be provided to the COR not later than thirty (30) days after 673 contract award. Subsequent training certificates to satisfy the annual training requirement shall 674 be submitted to the COR via e-mail notification not later than October 31 st of each year. The e- 675 mail notification shall state the required training has been completed for all Contractor and 676 subcontractor employees. 677 Records Management Obligations: 679

A. Applicability 680

This clause applies to all Contractors whose employees create, work with, or otherwise handle 681

Federal records, as defined in Section B, regardless of the medium in which the record exists. 682

B. Definitions 683

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of 684 form or characteristics, made or received by a Federal agency under Federal law or in connection 685 with the transaction of public business and preserved or appropriate for preservation by that 686 agency or its legitimate successor as evidence of the organization, functions, policies, decisions, 687 procedures, operations, or other activities of the United States Government or because of the 688 informational value of data in them. 689

The term Federal record: 690

• includes FEMA records. 691

• does not include personal materials. 692

• applies to records created, received, or maintained by Contractors pursuant to 693 their FEMA contract. 694

• may include deliverables and documentation associated with deliverables. 695

C. Requirements 697

Contractor shall comply with all applicable records management laws and regulations, as well as 699

National Archives and Records Administration (NARA) records policies, including but not 700 limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR 701

Chapter XII Subchapter B, and those policies associated with the safeguarding of records 702 covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of 703 all records, regardless of form or characteristics, mode of transmission, or state of completion. 704

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or 705 falling under the legal control of, the Government are Federal records subject to the provisions of 706

44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as 707 amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and 708 scheduled for disposition only as permitted by statute or regulation. 709

In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for 711

Government use or created in the course of performing the contract and/or delivered to, or under 712 the legal control of the Government and must be managed in accordance with Federal law. 713

Electronic records and associated metadata must be accompanied by sufficient technical 714 documentation to permit understanding and use of the records and data. 715

1. FEMA and its contractors are responsible for preventing the alienation or 716 unauthorized destruction of records, including all forms of mutilation. Records may 717 not be removed from the legal custody of FEMA or destroyed except for in 718 accordance with the provisions of the agency records schedules and with the written 719 concurrence of the Head of the Contracting Activity. Willful and unlawful 720 destruction, damage or alienation of Federal records is subject to the fines and 721 penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental 722 removal, defacing, alteration, or destruction of records, Contractor must report to 723

FEMA. The agency must report promptly to NARA in accordance with 36 CFR 1230. 724

2. The Contractor shall…