B08_Attachment_3_2024_Statement_of_Work.docx

Statement of Work Actuarial Work Related to the USPP Pension Plan NPS is subject to an annual audit of our financial statements, as required by the Chief Financial Officers Act of 1990. A recurring necessity has been estimating the United States Park Police (USPP) pension liability. This requires actuarial knowledge and expertise. Since NPS does not possess the actuarial knowledge or expertise to perform these tasks, we intend to contract for those services for the current fiscal year. Furthermore, in order to facilitate the review and calculation process going forward, with options extending for a term of one year each for a maximum of 5 years total.

The contractor will need to measure the pension benefit obligation for the USPP for the fiscal year ending September 30, 2024. The contractor will use particular data obtained from the plan administrator, using methods and assumptions agreed by both the contractor and the AOC Internal Control Team. The contractor will comply with all aspects of the Statement of Federal Financial Accounting Standards (SFFAS) 33. These measurements must be certified by the Enrolled Actuary, who is also a member of the American Academy of Actuaries.

The contractor will need to perform additional services related to the audit of the year-end actuarial estimate, as determined by the National Park Service’s external auditor.

The contractor will need to provide a final deliverable to the AOC Internal Control Team and the USPP, specifically a USPP pension liability valuation report, to include the following:

· Reconciliation of the benefit obligation

· Actuarial methods and assumptions

· Plan provisions

· Simplifications, estimates, and computation shortcuts

· Participant data Supporting Information

· The place of performance will be the contractor’s work site.

· The period of performance will be from date of award for a period of one year. Option periods intended to be one year each for a maximum of Four (4) options..

· No Government Furnished Equipment will be provided.

· There are no special considerations for this project.

Estimated Level of Effort:

Labor Category * Engagement Execution Advisor II - 23.25 Hours Project Execution Lead II – 85 Hours Project Execution Specialist I – 29 Hours

1.1 DOI Security Standards

1.1.1 Non-disclosure and Network Access Agreements: Contractors that will have access to DOI information or develop custom applications need to sign a non-disclosure agreement (NDA), read and sign Responsibilities for Computer Use and completely fill out a Remote Access Request Form prior to gaining access. The COR will provide the documents mentioned above.

1.1.2 Performance under this scope requires contractor personnel to have a federal government-issued personal identification card (PIV) before being allowed access to a DOI facility and/or information system. The COR will be the sponsoring official and will make the arrangements for personal identity verification and card issuance. Acquired services shall comply with the Homeland Security Presidential Directive-12 that requires all federal entities to ensure that all Contractor employees have current and approved security background investigations that are equivalent to investigations performed with the federal employee workforce.

At least two (2) weeks before the start of contract performance, the Contractor will identify all contract and subcontractor personnel who will require physical and/or logical access for performance of work under this contract. The Contractor must make their personnel available at the place and time specified by the COR in order to initiate screen and background investigations. The following forms, or their equivalent, may be used to initiate the credentialing process:

-OPM Standard Form 85 or 85P

-OF 206

-Fingerprint card (local procedures may require the fingerprinting to be done at a police station; in this case, any charges are to be borne by the contractor).

-Release to Obtain Credit Information -PIV card application (web-based)

1.1.3 Personnel Changes: The contractor must notify the COR immediately when an employee working on a DOI system is reassigned or leaves the contractor’s employ, and PRIOR to an unfriendly termination.

1.1.4 Rights in Data: DOI will own the unlimited rights to any data, computer database, computer software and computer software documentation developed on its behalf per Federal Acquisition Regulation (FAR) section 52.227-14 Rights in Data - General.

1.1.5 Quality Control: Software/hardware must be free of defects and malicious code.

1.1.6 Security Self-Assessment: The Government will reserve the right to conduct such an assessment using Government personnel or another contractor. The contractor will take appropriate and timely action to correct or mitigate any weaknesses discovered during such testing, generally at no additional cost.

1.1.7 IT Security Training: Contractor employees must take DOI’s end-user computer security awareness training prior to being granted access to DOI data or being issued a user account. Training must be renewed annually. The COR will provide training information mentioned above.

1.1.8 Logon Banner: Contractor employees who access Service information systems must acknowledge a Government-approved Legal Warning Banner prior to them logging on to the system. The network warning banner communicates that there is no expectation of privacy in the authorized or unauthorized use of Service information systems. The use of warning banners on Service computers and networks provides legal notice to anyone accessing them that they are using a U.S. Government system that is subject to monitoring. Users should also be notified of the possible sanctions, such as loss of privileges or even prosecution, if they misuse or access the network without authorization. All Service systems must display warning banners upon connection to a given system. These banners will display a warning that states the system is for legitimate use only, is subject to monitoring, and carries no expectation of privacy. Service networks and information systems do not inherently provide users a right of privacy. As such, the Service reserves the right to monitor use in accordance with Department and NPS Information Security Program policies.

1.1.9 Security Controls: Contractors will be required to ensure compliance with the security control requirements of the current version of NIST SP 800-53.

1.1.10 Incident Reporting: The contractor shall be responsible for recognizing and reporting computer security incidents affecting DOI data or systems in accordance with the DOI Computer Incident Response Guide. Solicitations must include either the complete publication or a reference to public facilities, such as a website or office, where it may be accessed. COR will provide document mentioned above.

1.1.11 Information systems and system services provided to the DOI by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance.

1.1.12 Contractors shall comply with the requirements of the Privacy Act of 1974 and shall not remove personally identifiable information (PII) or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity.

1.1.13 Products, platforms, and services delivered as part of a contract statement of work that use information and communication technology (ICT), shall confirm to the ICT Accessibility Revised 508 Standards of the Rehabilitation Act.

1.1.14 Contractors shall comply with all applicable records management laws and regulations that includes National Archives and Records Administration (NARA) records guidance and departmental policy.

1.1.15 Contractors must manage Controlled Unclassified Information (CUI) in accordance with applicable laws, regulations, executive orders, and policies.

1.1.16 If a portion of the contract requirement seeks information from ten or more members of the public, the Contactor employees shall work with the Bureau Information Collection Clearance Officer to obtain a Paperwork Reduction Act clearance from the Office of Management and Budget (OMB).

2.0 Quality Control

The contractor must ensure that services are performed in accordance with the attached performance requirements summary (PRS).

2.1 Quality Control Plan. The contractor must provide a quality control plan to the contracting officer for acceptance no later than the pre-performance conference. The contracting officer will notify the contractor of acceptance or required modifications to the plan before the contract start date. The contractor must make appropriate modifications and obtain acceptance of the plan by the contracting officer before the contract start date. The plan must include:

2.1.1 A description of the inspection system to cover all services listed on the PRS. The description must include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of the organization placement of the inspectors.

2.1.2 Additionally, control procedures for any government-provided keys or lock combinations must be included.

2.1.3 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

2.1.4 A description of the records to be kept to document inspections and corrective or preventative actions taken.

2.2 Records. The records of inspections must be kept and made available to the contracting officer, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims under this contract.

3.0 Quality Assurance.

According to the Inspection of Services clause located in the contract additional terms and conditions addendum, the government will evaluate the contractor's performance under this contract. For those takes listed on the PRS (Section 9.0) the contractor's officer's representative (COR) will evaluate the contractor's performance. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the project manager or representative at the site to initial the observation. The initially of the observation does not necessarily constitute concurrence with the observation, only acknowledgement that he or she has been made aware of the defective performance. Government surveillance of tasks not listed in the PRS or by methods other than those listed in the PRS (such as provided for by the Inspection of Services clause) may occur during the performance period of this contract. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the contracting officer as a result of surveillance will be in accordance with the terms of this contract.

HSPD 12 and Information Technology Section 1.0 – Information Technology and Cybersecurity Requirements A. Applicability This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements Information systems and system services provided to the Department by the Contractor must comply with DOI IT Cybersecurity and Privacy Control Standards, privacy policies, and other related guidance. Contracts that involve Industrial Control System (ICS) products and services should be evaluated on an individual basis and contain language specific to ICS. Please contact the Bureau of Reclamation (BOR) at ICSsecurity@usbr.gov for ICS issues and guidance.

The Contractor and the contractor-managed systems shall comply with all federal regulations and guidance, including but not limited to:

1. Federal Information Security Modernization Act of 2014 (FISMA) accessible at https://www.cisa.gov/federal-information-security-modernization-act

2. Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems accessible at https://www.fedramp.gov

3. Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW- 107publ347.pdf

4. Privacy Act of 1974 accessible at https://www.justice.gov/opcl/privacy-act-1974

5. Federal Information Processing Standards (FIPS) and the National Institute of Standards and Technology (NIST) 800-Series Special Publications (SP) accessible at https://www.nist.gov

6. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, accessible at https://www.cio.gov/policies-and- priorities/circular-a-130/

C. Information Systems The Contractor shall manage information in accordance with applicable laws, regulations, executive orders, and policies regarding the marking, safeguarding, and dissemination of

DOI

Baseline

Compliance

Contract

Guidelines

Page Controlled Unclassified Information (CUI). Personally Identifiable Information (PII) is a subset of information designated as CUI, and Sensitive PII is a subset of PII that requires additional controls and safeguards. (See section 3, Privacy Requirements)

The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

All Contractor personnel requiring access to DOI information data and/or systems shall be cleared at appropriate levels as set forth:

1. Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation.

2. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI).

3. High Risk position will require a Background Investigation (BI).

D. Security Training and Reviews All users of federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing federal information systems under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter. New Contractor employees assigned to the contract shall complete the training before accessing federal information systems under the contract. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification each year. The e-mail notification shall state that all Contractor and subcontractor employees have completed the required training.

The government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced, particularly when contractors build and operate or maintain systems on behalf of the Department. In such cases, the Contractor shall afford DOI, the Office of the Inspector General, and other government organizations access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. The Contractor shall provide access, to the extent necessary as determined by the government, for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of government data or the function of computer systems used in performance of the contract and to preserve evidence of computer crime. Cloud Service Providers should not be expected to grant physical access to government inspectors.

E. Contractor Personnel Security and Suitability Requirements

Performance of this contract requires contractor personnel to have a Federal government-issued Personal Identity Verification (PIV) credential before being allowed unsupervised access to a DOI [facility and/or information system]. The Contracting Officer's Representative (COR) or Contracting Officer's Technical Representative (COTR) will be the requesting official, and will make arrangements through a DOI Access Card Sponsor for personal identity verification and DOI Access Card issuance.

At least two weeks before start of contract performance, the Contractor must identify all contractor and subcontractor personnel who will require [physical and/or logical] access for performance of work under this contract. Physical Access means routine, unescorted or unmonitored access to nonpublic areas of a federally-controlled facility. Logical Access means routine, unsupervised access to a Level 3 or 4 federally-controlled information system. The Contractor must make their personnel available at the place and time specified by the COR/COTR or DOI Access Card Sponsor in order to initiate screening and background investigations. The following forms and inquiries, or their equivalent, will be used to initiate the credentialing process:

● OPM Standard Form 85 or 85P

● OF 306

● National Criminal History Check (NCHC) (local procedures may require the fingerprinting to done at a police station; in this case, any charges are to be borne by the contractor)

● Release to Obtain Credit Information

● PIV card application (web-based)

Before starting work under this contract, a National Criminal History Check (NCHC) will be initiated to verify the identity of the individual applying for clearance and to determine the individual's suitability for the position. If the NCHC adjudication is favorable, a DOI Access Card will be issued for that individual. If the adjudication is unfavorable, the credentials will not be issued and the contractor must make other arrangements for performance of the work. In the event of a disagreement between the Contractor and the Government concerning the suitability of an individual to perform work under this contract, DOI shall have the right of final determination.

Contractor employees must give, and authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. Refusal or failure to furnish or authorize provision of information may constitute grounds for denial or revocation of credentials. Government personnel may contact the contractor personnel being screened or investigated in person, by telephone or in writing, and the Contractor must ensure they are available for such contact.

Alternatively, if an individual has already been credentialed by another agency through OPM, and that credential has not yet expired, further investigation may not be necessary. In that case, the contractor must provide the COR/COTR with documentation that supports the individual's credentialed status.

Contractor employees who have been successfully adjudicated will be issued DOI Access Cards, which must be activated at a USAccess Credentialing Center. Those Contractor employees not located within a reasonable travel time of a USAccess Credentialing Center will be screened and issued alternate credentials, such as temporary access badges.

During performance of the contract, the Contractor must keep the COR/COTR apprised of changes in personnel to ensure that performance is not delayed by compliance with credentialing processes. Cards that have been lost, damaged, or stolen must be reported to the COR/COTR and Issuing Office within 24 hours. If reissuance of expired credentials is needed, it must be coordinated through the COR/COTR.

At the end of contract performance, or when a contractor employee is no longer working under this contract, the Contractor must ensure that all identification cards are returned to the COR/COTR.

This requirement must be incorporated into any subcontracts that require subcontractor personnel to have routine unsupervised access to a federally-controlled facility for more than 180 calendar days or any unsupervised access to a federally-controlled Level 3 or 4 information system.

Section 2.0 – Cybersecurity Incident Response A. Applicability This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions.

As used in this term-

“Incident” means an occurrence that

1. actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

2. constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

C. Requirements All Contractor employees and information system service providers shall be responsible for recognizing and reporting security incidents. Information system service providers shall receive the current version of the DOI Incident Response Plan, Policy, and Handbook at the time of award, in addition to bureau- or office-specific guidance for appropriate reporting and response at all levels. All suspected or confirmed information security incidents shall be reported in accordance with the requirements listed below, even if it is believed the incident may be limited, small, or insignificant. For hosting environments, including cloud systems and services, this includes incidents occurring on the service provider’s underlying infrastructure supporting containers utilized by the Department. In such cases, the vendor’s primary security operations and/or incident response unity shall engage directly with the DOI Cyber Security Operations (CSO) Section and provide DOI CSO with security and event logs covering the period of the incident and up to six months prior. The DOI CSO and Bureau or Office Incident Response Teams will determine when an incident requires additional focus and attention.

All Contractor employees and information system service providers shall report all information security incidents to the appropriate Bureau or Office Incident Response Team and to the DOI Computer Incident Response Center (DOI CIRC) immediately, no later than 1 hour after “becoming aware of the incident,” at DOICIRC@ios.doi.gov, (703) 648-5655, regardless of day or time. Any contractor action to investigate, identify, respond to, contain, remediate, or recover from a security event (which includes “suspected” incidents) constitutes “becoming aware of the incident.”

When notifying the DOI CIRC and the appropriate Bureau or Office Incident Response Team, the Contractor shall include the CO and COR on the correspondence email to DOICIRC@ios.doi.gov and the appropriate Bureau or Office Incident Response Team. If the Contractor reported the incident by phone, then immediately following the reporting, the Contractor shall notify the CO and COR via e-mail. The Contractor is responsible for verifying that all notification was received and acknowledged by the CO or COR. If the Contractor has any questions regarding these procedures, they shall contact the CO or the COR.

The Contractor shall not include any controlled information in the subject or body of any e-mail. Contractor shall transmit controlled information using validated encryption methods compliant with the current NIST FIPS 140 version to protect controlled information in e-mail attachments. Passwords must not be communicated in the same email as the attachment. Contractor shall contact the CO or COR if encryption software is needed for guidance on appropriate, federally approved encryption methods.

Section 3.0 – Privacy Requirements A. Applicability.

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions. As used in this term- Breach: the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other-than- authorized purpose.

1. PII - information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.

2. Sensitive PII (SPII) is a subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. SPII is CUI and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. SPII includes but is not limited to full or truncated Social Security Number (SSN), driver's license or state identification number; financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; and system authentication information such as passwords, personal identification numbers or mother's maiden name.

C. Privacy Act Requirements The Contractor shall comply with the requirements of the Privacy Act of 1974 and shall not remove PII or Privacy Act material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity. When Privacy Act records, information, data, documentary material, and equipment is no longer required, the Contractor shall return it to the Department’s control or hold it until otherwise directed. Items returned to the government shall be hand carried, mailed, emailed, or securely electronically transmitted to the CO.

D. Privacy Controls The Contractor shall meet the privacy requirements of the E-Government Act, FISMA, applicable federal privacy laws, NIST, OMB, and DOI (including but not limited to those listed in the contract table of authorities) for the collection, handling, processing, and sharing of PII, and ensure compliance with the privacy controls requirements of NIST SP 800- 53, FIPS 199, FIPS 200, and DOI Privacy Control standards as appropriate for the sensitivity of the system. The Contractor shall monitor the information system and update controls for continued privacy compliance on an ongoing basis and shall provide status reports to the Department upon request.

The Contractor shall be required to provide all necessary support to assist the Department in meeting the requirements of the Privacy Act and related laws and shall provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes timely responding to requests for information from the Department about the access, creation, collection, use, storage, maintenance, transmission, sharing, or disposition of PII on the Contractor’s system or processes, and providing timely review of relevant compliance documents for factual accuracy.

E. Privacy Breach Reporting Requirements The Contractor shall provide notice to DOI CIRC or the appropriate Bureau or Office Incident Response Team of any known or suspected breach of PII and meet breach reporting and mitigation requirements in accordance with the DOI Privacy Breach Response Plan or bureau or office applicable response plan. The report of a breach of PII shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information or has otherwise failed to meet the requirements of the contract.

The Contractor shall report all known or suspected breaches in electronic or physical form to the CO, COR, and the DOI CIRC or bureau or office point of contact no later than one hour following discovery via email at DOICIRC@ios.doi.gov or (703) 648-5655, regardless of day or time and as specified within the DOI Privacy Breach Response Plan and the applicable bureau or office response plan.

The Contractor shall not include any controlled information in the subject or body of any e-mail and shall not include any SPII. Where necessary, SPII shall be transmitted using encryption methods to protect CUI in attachments in accordance with cryptographic requirements prescribed by the current NIST FIPS 140 version. Passwords shall be securely communicated separately.

The Contractor shall not contact individuals impacted by a breach involving PII until directed by the government. Department officials will make all determinations related to response activities, appropriate notifications to individuals and federal agencies and other organizations, and any remedial actions.

The Contractor shall take immediate action to contain and mitigate the impact of the breach and cooperate with DOI officials to investigate the breach and determine remedial measures as follows:

· The Contractor shall provide full access and cooperation for all activities—determined by the Department to be required—to ensure an effective breach response, including providing all requested images, log files, and event information to facilitate rapid resolution of breaches.

· Breach response activities—determined to be required by the Department—may include but are not limited to inspections, investigations, forensic reviews, data analyses and processing, and final determinations of responsibility for the breach and/or liability for any additional response activities.

· The Department, at its sole discretion, may obtain the assistance of federal agencies and/or third-party firms to aid in breach response activities, as needed.

The Contractor shall provide a detailed written analysis with the following data elements available at the time of the breach, and a follow up report with any additional information or updates within 24 hours of the initial breach report, that shall address all relevant information concerning the compromise:

· Government programs, platforms, or systems involved

· Location(s) of the breach

· Date and time the breach was discovered

· Nature of the event (loss, theft, or unauthorized access)

· Description or summary of events

· Description of PII involved, such as name, Social Security number, date of birth, etc.

· Number of potentially impacted individuals

· Estimated number of records exposed or compromised The Contractor shall collaborate with DOI officials on breach remedial activities to include notifications, credit monitoring, establishing a call center, or other relief to affected individuals as appropriate under the circumstances of the breach as prescribed in the contract. The Contractor shall have the capability to notify individuals whose PII resided in the Contractor system at the time of the breach not later than five business days after being directed by DOI officials to notify affected individuals. The Contractor shall not proceed with notifications unless the CO has directed in writing that notification is appropriate, subject to prior approval by DOI Privacy Officials, in accordance with the DOI Privacy Breach Response Plan. Notification may require the Contractor’s use of address verification and/or address location services. All determinations, including response activities, notifications to affected individuals and/or federal agencies, and related services will be made by authorized DOI officials at DOI’s discretion.

If an SPII or PII breach occurs because of the violation of a term of the contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the CO and at no cost to the government, without delay correct or mitigate the violation. If the Department incurs a cost for individual notifications and remediation services procured as the result of a breach of SPII or PII, the COR will contact the CO to coordinate appropriate remedies per contract terms and conditions.

F. Privacy Training Requirements All Contractor and subcontractor employees are required to take privacy awareness training prior to accessing DOI information or information systems. All Contractor and subcontractor employees must also complete role-based privacy training prior to accessing PII or Privacy Act data. All required privacy training shall be completed within 30 days of contract award and prior to granting access to DOI information systems or any PII, and must be completed on an annual basis thereafter, not later than September 30th of each year. Any new Contractor employees assigned to the contract shall also meet these privacy training requirements. Privacy training shall meet the requirements of FAR 52.224-3 Privacy Training (January 2017).

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than 30 days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 30th of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

Section 4.0 – Accessibility Requirements (Section 508) Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C § 794 (d)) requires that when federal agencies develop, procure, maintain, or use information and communication technology (ICT), it must be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to and use of information and data that is comparable to people without disabilities.

When ICT conforming to one or more requirements in the Revised 508 Standards is not commercially available, the agency shall procure the ICT that best meets the agency’s business needs and the Revised 508 Standards, in accordance with 36 CFR 1194 E202.7 and FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DOI Section 508 Office according to 375 DM 8.

A. Applicability This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements

1. Products, platforms, and services delivered as part of a statement of work that are ICT, or contain ICT, shall conform to the Revised 508 Standards, which are located at 36 CFR § 1194.1 and Appendices A, C and D and available at https://www.access- board.gov/ict/. In the revised regulation, ICT replaced the term Electronic and Information Technology (EIT) used in the original 508 standards.

a. Applicable Functional Performance Criteria: All functional performance criteria in chapter 3 of the Revised 508 Standards apply when using an alternative design or technology that results in substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in chapters 4 and 5 of the Revised 508 Standards, or when chapters 4 or 5 do not address one or more functions of ICT.

b. Applicable 508 requirements for electronic content features and components (including electronic training materials): All requirements in E205 of the revised.

c. 508 Standards apply, including all Web Content Accessibility Guidelines (WCAG) 2.0 Level AA Success Criteria.

d. Applicable 508 requirements for software features and components (including Software infrastructure): All requirements in chapter 5 apply, including all WCAG 2.0 Level AA Success Criteria, 502 Interoperability with Assistive Technology, and 503 Application.

e. Applicable 508 requirements for hardware features and components: All requirements in chapter 4 apply.

f. Applicable 508 requirements for support services and documentation: All requirements in chapter 6 apply.

2. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item’s level of Section 508 conformance prior to the services being performed.

3. When providing maintenance upgrades, substitutions, and replacements to ICT, the Contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution, or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed substitutions and replacements prior to acceptance.

4. Contractors shall provide an ACR for each commercially available ICT item offered through this contract. The ACR should be created using the Voluntary Product Accessibility Template (VPAT) Version 2.4 Rev 508 (or later), located at https://www.itic.org/policy/accessibility/vpat.

5. When developing or modifying ICT for the government, the Contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the Contractor shall not reduce the original ICT item’s level of Section 508 conformance.

6. When developing or modifying web and software ICT, the Contractor shall demonstrate Section 508 conformance by providing Section 508 test results based on the versions of the DHS Trusted Tester Methodology currently approved for use, as defined at https://www.dhs.gov/compliance-test-processes. The Contractor shall use testers who are certified by DHS on how to use the DHS Trusted Tester Methodology (e.g., “DHS Certified Trusted Testers”) to conduct accessibility testing. Information on how testers can become certified is located at https://www.dhs.gov/publication/trusted-tester-resources.

7. Contractor personnel shall possess the knowledge, skills, and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

8. Exceptions for statements of work have been determined by DOI and only the exceptions described in 375 Departmental Manual (DM) 8 DOI Section 508 Program and Responsibilities, dated February 5, 2016, may be applied. Any request for additional exceptions shall be sent to the COR and a determination will be made according to 375 DM 8.

Section 5.0 – Contractor Personnel Security Requirements Acquired services shall comply with the following regulations and requirements. Homeland Security Presidential Directive-12 requires that all federal entities ensure that all Contractors gaining physical access to federally controlled facilities or logical access to federally controlled information systems have current and approved security background investigations that are equivalent to investigations performed on federal employees; see section 1.0, part C of this document. The Contractor shall comply with the contract terms and conditions. The Office of Personnel Management (OPM) will perform background investigations.

Section 6.0 – Controlled Unclassified Information Requirements A. Applicability This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions

1. Sensitive Information - any information that warrants a degree of protection and administrative control as defined in law, regulation, governmentwide policy, or judicial opinion.

2. Controlled Unclassified Information (CUI) - information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law regulation or governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. Legacy materials may retain For Official Use Only (FOUO), Sensitive But Unclassified (SBU), or other markings until the artifact is no longer considered “data at rest;” it is revised, reused, or goes in motion.

3. Personally Identifiable Information (PII) - a subset of information designated as CUI. See section 3.0, Privacy Requirements, for additional requirements.

4. Sensitive PII - subset of PII that requires additional controls and safeguards. See section 3.0, Privacy Requirements, for additional requirements.

C. Authorities

1. EO 13556, Controlled Unclassified Information, November 4, 2010

2. 32 CFR 2002, Controlled Unclassified Information (Implementing Directive)

3. The Federal CUI Registry

4. Departmental standards

D. Requirements

1. The Contractor must manage CUI in accordance with applicable laws, regulations, executive orders, and policies.

2. The Contractor must identify, and safeguard controlled information from unauthorized release into public domain, or to unauthorized persons, organizations, or subcontractors.

3. The Contractor or subcontractor must not disclose or release the materials provided to the Contractor to any individuals of the Contractor's organization not directly engaged in providing services under the contract or that do not have a valid need-to-know. All technical data provided to the Contractor by the government must be protected from public or private disclosure in accordance with the markings printed on them.

4. The Contractor must not release to anyone outside the Contractor’s organization any sensitive information unless the CO has given prior written approval. This includes, but is not limited to, news releases, marketing promotions, articles, interviews, reports, social media posts, and any other media releases. Requests for approval must identify the specific information to be released, the medium to be used, the purpose for the release, and a description of the need-to-know. The Contractor must submit its request to the CO at minimum ten business days before the proposed date for release. Subcontractors must submit requests for authorization to release through the prime Contractor to the CO.

5. If the Contractor believes that CUI information has been compromised, they will follow the incident response procedures in the DOI Incident Response Policy and Plan.

E. Training Individuals originating or working with sensitive information must complete CUI training to become an authorized holder. CUI must only be disseminated to authorized holders in the furtherance of a lawful government purpose.

Section 8.0 – Paperwork Reduction Act of 1995 If a portion of the contract seeks information from ten or more members of the public, the contactor will work with the Bureau Information Collection Clearance Officer to obtain a Paperwork Reduction Act clearance from the OMB.

Section 9.0 – Reference Documents All DOI-specific documents referenced in this document necessary for Contractor review and reference can be provided by the CO/COR.

Section 10.0 – Glossary Please refer to the NIST online glossary at: https://csrc.nist.gov/glossary.