Attachment E.pdf

14. Security Language: By accepting this contract/agreement, the Contractor/Cooperator and other external organizations (hereafter called Contractor) providing Information Technology (IT) resources or services to the US Forest Service (FS) agrees to comply with the applicable IT security policy as outlined in this document. The Contractor and other external organizations will be responsible for IT security for all systems connected to the FS network or operated by the Contractor and other external organizations for the FS, regardless of location. This clause is applicable to all or any part of the contract that includes IT resources or services in which the Contractor and other external organizations must have physical or electronic access to FS sensitive information that directly support the mission of the FS. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130.

The Contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this task. The Contractor shall also protect all unclassified Government data, equipment, etc., by treating information as sensitive business, confidential information, controlling and limiting access to the information, and ensuring the data and equipment are secured within their facility.

The Contractor or other external organization will not publish or disclose in any manner, without the FS Contracting Officer’s written consent, the details of any programs, documentation, data, or safeguards either designed or developed by the Contractor or other external organization under this Contract or otherwise provided by the Government. The Contractor may be required to sign non-disclosure or other appropriate security agreements. A written agreement between the FS and any contractors and other external organizations will be entered into before FS data and information otherwise exempt from public disclosure may be disclosed to the contractors and other external organizations. The Contractor and other external organizations will agree to establish and follow security precautions considered by the FS to be necessary to ensure proper handling of data and information. As may be identified elsewhere in this contract, the Contractor agrees that:

• The draft and final deliverables and all associated working papers and other materials deemed relevant by the COTR that have been generated by the Contractor in the performance of this contract are the property of the U.S. Government and must be submitted to the COTR at the conclusion of the tasks.

• All documents produced for this project are the property of the U.S. Government and cannot be reproduced or retained by the Contractor.

To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor will afford the Government access to the Contractor’s or other external organization’s facilities, installations, technical capabilities, operations, documentation, records, and databases. The Contractor will cooperate with Federal agencies and their officially credentialed representatives during official inspections or investigations concerning the protection of FS information.

Cooperation may include providing relevant documentation showing proof of compliance with federal and agency requirements and rendering other assistance as deemed necessary.

If new or unanticipated threats or hazards are discovered by either the Government or the Contractor or other external organizations, or if existing safeguards have ceased to function, the discoverer will immediately bring the situation to the attention of the other party. The Contractor will report real or suspected security incidents or violations to:

The USDA’s Incident Security Center (ISC) 24-Hour USDA Cyber Security Incident Hotline: 1-

(866) 905-6890 | Cyber.Incidents@usda.gov

The Contractor shall insert these clauses in all subcontracts when the Sub-contractor is required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system. Failure to comply with said requirements will constitute cause for termination.

The Contractor Agrees To –(a) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—

(i) The systems of records; and

(ii) The design, development, or operation work that the Contractor is to perform;

(b) Include the Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and

(c) Include this clause, including this paragraph (3), in all subcontracts awarded under this contract that requires the design, development, or operation of such a system of records.

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

Definitions of the clause:

(a) “Operation of a system of records,” as used in this clause, means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

(b) “Record,” as used in this clause, means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and that contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint or a photograph.

(c) “System of records on individuals,” as used in this clause, means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

The Contractors and other external organizations will ensure that the following banner is displayed on all FS systems that contain Privacy Act information operated by the Contractors and other external organizations prior to allowing anyone access to the system: “This system contains information protected under the provisions of the Privacy Act of 1974 (Public Law 93- 579). Any privacy information displayed on the screen or printed must be protected from unauthorized disclosure. Employees who violate privacy safeguards may be subject to disciplinary actions, a fine of up to $5,000, or both.”

15.Compliance with Internet Protocol version 6 (IPv6): Any system, hardware, software, firmware or networked component (voice, video or data) developed, procured or acquired in support or performance of this contract shall be capable of transmitting, receiving, processing, forwarding and storing digital information across system boundaries utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test Program. In addition, this system shall maintain interoperability with IPv4 systems and provide at least the same level of performance and reliability capabilities of IPv4 products.

Specifically, any new IP product or system developed, acquired, or produced must:

• Interoperate with both IPv6 and IPv4 systems and products, and

• Have available contractor/vendor IPv6 technical support for development and implementation and fielded product management.

As IPv6 evolves, the Contractor commits to upgrading or providing an appropriate migration path for each item developed, delivered or utilized at no additional cost to the Government.

The Contractor shall provide technical support for both IPv4 and IPv6.

Any system or software must be able to operate on networks supporting IPv4, IPv6 or one that supports both.

Any product whose non-compliance is discovered and made known to the Contractor within one year after acceptance shall be upgraded, modified or replaced to bring it into compliance at no additional cost to the Government.

16 Section 508 Compliance and Required Security Language

16.1 Section 508 Accessibility of Electronic and Information Technology

16.1.1 This PWS is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by the workforce Investment Act of 1998 (P.L. 105- 220). Specifically, subsection 508(a)(1) requires that when the Federal Government procures Electronic and Information Technology (EIT), the EIT must allow Federal employees and individuals of the public with disabilities comparable access to and use of information and data that is provided to Federal employees and individuals of the public without disabilities.

16.1.2 The EIT accessibility standards at 36 CFR Part 1194 were developed by the Architectural and Transportation Barriers Compliance Board ("Access Board") and apply to contracts and task/delivery orders, awarded under indefinite quantity contracts on or after June 25, 2001.

16.1.3 Each EIT product or service furnished under this contract shall comply with the EIT Accessibility Standards (36 CFR 1194), as specified in the contract, as a minimum. If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing.

16.1.3.1 If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

16.1.3.1.1 Cancellation of the contract, delivery or task order, purchase or line item without termination liabilities; or

16.1.3.1.2 In the case of custom Electronic and Information

Technology (EIT) being developed by a Contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant EIT, with the Contractor liable for reimbursement to the Government for any expenses incurred thereby.

16.1.4 The Contractor must ensure that all EIT products that are less than fully compliant with the accessibility standards are provided pursuant to extensive market research and are the most current compliant products or services available to satisfy the contract requirements.

16.1.5 For every EIT product or service accepted under this contact by the Government that does not comply with 36 CFR 1194, the Contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date; whichever shall occur first.

16.2 ICT Accessibility Requirements:

16.2.1 General Exceptions Electronic Content Satellite Emergency Notification, GPS Tracking, and 2-Way Texting (Applicable to SENDs, Websites, Technical and Support Services, and Reports)

Technical Criteria:

• E205.1 General -Electronic content shall comply with E205.

• E205.3 Agency Official Communication - Electronic content that is not public facing shall conform to the accessibility requirements specified in E205.4 when such content constitutes official business and is communicated by an agency through one or more of the following:

o An emergency notification;

o An initial or final decision adjudicating an administrative claim or proceeding;

o An internal or external program or policy announcement;

o A notice of benefits, program eligibility, employment opportunity, or personnel action;

o A formal acknowledgement of receipt;

o A survey questionnaire;

o A template or form;

o Educational or training materials; or o Intranet content designed as a Web page.

• E205.4 Accessibility Standard (WCAG 2.0).

• E205.4.1 Word Substitution when Applying WCAG to non-Web Documents -For non-Web documents, wherever the term "Web page" or "page" appears in WCAG

2.0 Level A and AA Success Criteria and Conformance Requirements, the term "document" shall be substituted for the terms "Web page" and "page". In addition, in Success Criterion in 1.4.2, the phrase "in a document" shall be substituted for the phrase "on a Web page".

The following standards are applicable:

• All WCAG A & AA Success Criteria apply.

• 602 Support Documentation

• 603 Support Services

• 302 Functional Performance Criteria

The following standards are applicable:

• All WCAG A & AA Success Criteria - except

◾2.4.1 Bypass Blocks ◾2.4.5 Multiple Ways ◾3.2.3 Consistent Navigation ◾3.2.4 Consistent Identification

• 602 Support Documentation

• 603 Support Services

• 302 Functional Performance Criteria

Exceptions:

• 2.4.1 Bypass Blocks

• 2.4.5 Multiple Ways

• 3.2.3 Consistent Navigation

• 3.2.4 Consistent Identification

16.2.2 SENDs Hardware or Equivalent.

Technical Criteria:

• E206.1 General (/ict-accessibility#e206_1) - Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

• E401.1 Scope (/ict-accessibility#e401_1) -

The requirements of Chapter 4 shall apply to ICT that is hardware where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

• E402.1 General (/ict-accessibility#e402_1_general) - ICT with closed functionality shall be operable without requiring the user to attach or install assistive technology other than personal headsets or other audio couplers, and shall conform to 402.

• E402.2 Speech-Output Enabled (/ict-accessibility#e402_2_speech_output_enabled)

ICT with a display screen shall be speech-output enabled for full and independent use by individuals with vision impairments.

• E402.3 Volume (/ict-accessibility#e402_3) -

ICT that delivers sound, including speech output required by 402.2, shall provide volume control and output amplification conforming to 402.3.

• E402.3.1 Private Listening (/ict-accessibility#e402_3_1) - Where ICT provides private listening, it shall provide a mode of operation for controlling the volume. Where ICT delivers output by an audio transducer typically held up to the ear, a means for effective magnetic wireless coupling to hearing technologies shall be provided.

• E402.3.2 Non-private Listening (/ict-accessibility#e402_3_2_non_private_listening) -

Where ICT provides non-private listening, incremental volume control shall be provided with output amplification up to a level of at least 65 dB. A function shall be provided to automatically reset the volume to the default level after every use.

• E404.1 General (/ict-accessibility#e404_1) - ICT that transmits or converts information or communication shall not remove nonproprietary information provided for accessibility or shall restore it upon delivery.

• E406.1 General (/ict-accessibility#e406_1) - Where data connections used for input and output are provided, at least one of each type of connection shall conform to industry standard non-proprietary formats.

• E407.1 General (/ict-accessibility#e407_1__e407_2) - Where provided, operable parts used in the normal operation of ICT shall conform to 407.

• E407.2 Contrast (/ict-accessibility#e407_1__e407_2) - Where provided, keys and controls shall contrast visually from background surfaces.

Characters and symbols shall contrast visually from background surfaces with either light characters or symbols on a dark background or dark characters or symbols on a light background.

• E407.3.1 Tactilely Discernible (/ict-accessibility#e407_3_1__e407_3_2__e407_3_3) -

Input controls shall be operable by touch and tactilely discernible without activation.

• E407.3.2 Alphabetic Keys (/ict-accessibility#e407_3_1__e407_3_2__e407_3_3) - Where provided, individual alphabetic keys shall be arranged in a QWERTY-based keyboard layout and the “F” and “J” keys shall be tactilely distinct from the other keys.

• E407.3.3 Numeric Keys (/ict-accessibility#e407_3_1__e407_3_2__e407_3_3) - Where provided, numeric keys shall be arranged in a 12-key ascending or descending keypad layout. The number five key shall be tactilely distinct from the other keys.

Where the ICT provides an alphabetic overlay on numeric keys, the relationships between letters and digits shall conform to ITU-T Recommendation E.161 (incorporated by reference, see 702.7.1).

• E408.1 General (/ict-accessibility#e408_1) - Where provided, display screens shall conform to 408.

• E408.3 Flashing (/ict-accessibility#e408_3) -

Where ICT emits lights in flashes, there shall be no more than three flashes in any one second period.

• E409.1 General (/ict-accessibility#e409_1__e410_1) - Where provided, status indicators shall be discernible visually and by touch or sound.

• E410.1 General (/ict-accessibility#e409_1__e410_1) - Where provided, color coding shall not be used as the only means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.

• E411.1 General (/ict-accessibility#e411_1) - Where provided, audible signals or cues shall not be used as the only means of conveying information, indicating an action, or prompting a response.

16.2.3 SEND Technical and Training Support Services (Also Applicable to Reports).

Technical Criteria:

• E208.1 General (/ict-accessibility#e208_1_general) - Where an agency provides support documentation or services for ICT, such documentation and services shall conform to the requirements in Chapter 6.

• E601.1 Scope (/ict-accessibility#e208_1_general) – The technical requirements in Chapter 6 shall apply to ICT support documentation and services where required by 508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

• E602.1 General (/ict-accessibility#e602_1_general) - Documentation that supports the use of ICT shall conform to 602.

• E602.2 Accessibility and Compatibility Features (/ict-accessibility#e602_1_general) - Documentation shall list and explain how to use the accessibility and compatibility features required by Chapters 4 and 5. Documentation shall include accessibility features that are built-in and accessibility features that provide compatibility with assistive technology.

• E602.3 Electronic Support Documentation (/ict-accessibility#e602_1_general) - Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.3 Electronic Support Documentation (/ict-accessibility#e602_3__e602_4) Documentation in electronic format, including Web-based self-service support, shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0 (incorporated by reference, see 702.10.1).

• E602.4 Alternate Formats for Non-Electronic Support Documentation (/ictaccessibility#e602_1_general) - Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E602.4 Alternate Formats for Non-Electronic Support Documentation (/ictaccessibility#e602_3__e602_4) – Where support documentation is only provided in non-electronic formats, alternate formats usable by individuals with disabilities shall be provided upon request.

• E603.1 General (/ict-accessibility#e603_1 e603_2 e603_3) -

ICT support services including, but not limited to, help desks, call centers, training services, and automated self-service technical support, shall conform to 603.

• E603.2 Information on Accessibility and Compatibility Features (/ict- accessibility#e603_1_e603_2_e603_3) -

ICT support services shall include information on the accessibility and compatibility features required by 602.2.

• E603.3 Accommodation of Communication Needs (/ict- accessibility#e603_1_e603_2_ e603_3) -

Support services shall be provided directly to the user or through a referral to a point of contact. Such ICT support services shall accommodate the communication needs of individuals with disabilities.

Functional Performance Criteria (Applicable to SENDs, Websites, Technical and Support Services, and Reports):

• 301.1 Scope - The requirements of Chapter 3 shall apply to ICT where required by

508 Chapter 2 (Scoping Requirements), 255 Chapter 2 (Scoping Requirements), and where otherwise referenced in any other chapter of the Revised 508 Standards or Revised 255 Guidelines.

• 302.1 Without Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that does not require user vision. 302.2 With Limited Vision - Where a visual mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited vision.

• 302.3 Without Perception of Color - Where a visual mode of operation is provided, ICT shall provide at least one visual mode of operation that does not require user perception of color.

• 302.4 Without Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that does not require user hearing.

• 302.5 With Limited Hearing - Where an audible mode of operation is provided, ICT shall provide at least one mode of operation that enables users to make use of limited hearing.

• 302.6 Without Speech - Where speech is used for input, control, or operation, ICT shall provide at least one mode of operation that does not require user speech.

• 302.7 With Limited Manipulation - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that does not require fine motor control or simultaneous manual operations.

• 302.8 With Limited Reach and Strength - Where a manual mode of operation is provided, ICT shall provide at least one mode of operation that is operable with limited reach and limited strength.

• 302.9 With Limited Language, Cognitive, and Learning Abilities - ICT shall provide features making its use by individuals with limited cognitive, language, and learning abilities simpler and easier.

16 Section 508 Compliance and Required Security Language