CBPHRM_COACA_SOW.docx

70CMSD18FR0000233 Attachment A: PWS

Customs and Border Protection

March 19, 2019/September 30, 2019

Statement of Work CBP Online Applicant Competency Assessment Service (COACA)

1.0 BACKGROUND

U.S. Customs and Border Protection (CBP) was created in 2003 with the mission of safeguarding America's borders thereby protecting the public from dangerous people and materials while enhancing the Nation's global economic competitiveness by enabling legitimate trade and travel. On a typical day, CBP welcomes nearly one million visitors, screens more than 67,000 cargo containers, arrests more than 1,100 individuals, and seizes nearly 6 tons of illicit drugs. Annually, CBP facilitates an average of more than $3 trillion in legitimate trade while enforcing U.S. trade laws.

CBP, Office of Human Resources Management, Planning, Program Analysis, and Evaluation Directorate, Personnel Research and Assessment Division, is responsible for the development and implementation of assessments for entry-level selection and promotion of its mission-critical occupations, including Border Patrol Agents (BPA) and Customs and Border Protection Officers (CBPO). Applicants to BPA and CBPO positions apply to a vacancy announcement through USA Jobs. Following self-certification of minimum qualifications, applicants complete the written entrance examination. Applicants passing the entrance examination, following verification of minimum qualifications, are referred to additional steps in the hiring process, including physical fitness, medical, drug, and suitability screening.

The entrance examination for each occupation is a custom-developed assessment battery created based on a comprehensive job analysis. Currently, the assessments are administered in two hurdles. The first hurdle is an online unproctored non-cognitive assessment. Applicants who complete the unproctored assessment within the allotted timeframe move on to the second hurdle and are invited to complete the proctored test battery at vendor managed test sites located throughout the United States. Trained test administrators ensure the proper identification of applicants prior to testing, assist applicants with accessing the appropriate tests on the computer, secure all test-related materials, ensure their return to storage, and ensure online submission of test answers through an online testing platform. Applicants who pass the entrance exam are notified in writing of their results by the CBP Hiring Center and are scheduled for further processing.

CBP currently uses the Office of Personnel Management’s (OPM) USA Hire system to administer entrance examinations to applicants. In FY 2018, approximately 42,000 CBPO applicants completed the unproctored assessment and 25,000 completed the proctored assessment. In FY 2018, approximately 25,000 BPA applicants completed the unproctored assessment and 16,000 completed the proctored assessment.

2.0 SCOPE

The Contractor shall manage the competency-based assessment of CBP applicants for frontline positions, mainly CBPOs and BPAs. The Contractor shall provide a computer-based test administration system that shall provide secure web-based administration of Government provided tests which may be adaptive or non-adaptive, applicant self-scheduling of testing appointments, integration with CBP systems test scoring, and reporting. The Contractor shall manage communications with applicants to schedule and complete testing and shall provide applicant support to complete testing. The Contractor shall provide physically proctored test administration, remote/technologically proctored test administration, and unproctored test administration. The Contractor shall monitor for unauthorized test exposure. The Contractor shall ensure system security through compliance with all relevant regulations including system monitoring.

CBP’s promotions assessment programs are outside the scope of this SOW.

· Federal Information Security Management Act of 2002 (FISMA) (Title III of the E-Government Act, Public Law (PL) 107-3479)

· Privacy Act of 1974, PL 93-579, as amended

· OMB Circular A-123 – Management’s Responsibility for Enterprise Risk Management and Internal Control OMB Circular A-130 – Managing Federal Information as a Strategic Resource

· Computer Fraud and Abuse Act of 1986, PL 99-474

· Computer Security Act of 1987, PL 100-235

· Paperwork Reduction Act of 1980, as amended

· Section 508 of the Rehabilitation Act, as amended

3.2 Policies, Directives, and Instructions

3.2.1 DHS Security and Training Requirements for Contractors

· Personnel Security Policy

· DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program

· Information Security Policy

· DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

· DHS Management Directive 11056.1 Sensitive Security Information (SSI)

· Information Technology Security Policy

· DHS Sensitive Systems Policy Directive 4300A

· DHS 4300A Sensitive Systems Handbook

· DHS 4300A Attachment G – Rules of Behavior

· Security Authorization Process Guide

· DHS Security Authorization Templates

· DHS Information Security Performance Plan

· Information System Security Officer (ISSO) Guide

· IT Security Awareness and Privacy Training

· Link Provided at Site

· Privacy Safeguards

· DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

· DHS Privacy Incident Handling Guidance

3.2.2 CBP Handbooks

· CBP HB-1400-05D, Information Systems Security Policies and Procedures Handbook

· CBP HB1400-02B, Security Policy and Procedures Handbook

· CBP Information Security Handbook (HB 1400-04A), July 29, 2016

3.2.3 Standards and Guidelines

· National Institute of Standards and Technology (NIST):

· Federal Information Processing Standard (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems

· FIPS 200, Minimum Security Requirements for Federal Information and Information Systems

· Special Publication (SP) 800-18, Guide for Developing Security Plans for Federal Information Systems

· SP 800-30, Guide for Conducting Risk Assessments

· SP 800-34, Contingency Planning Guide for Federal Information Systems

· SP 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy

· SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations

· SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans

· SP 800 60, Guide for Mapping Types of Information and Information Systems to Security Categories: Volume 1- Guide Volume, Volume 2 - Appendices

· SP 800-88 Guidelines for Media Sanitization

3.2.4 The above references can be found at:

· Office of Management and Budget (OMB): https://obamawhitehouse.archives.gov/omb/circulars_default

· NIST – http://csrc.nist.gov/publications/sp

· DHS/CBP – https://www.dhs.gov/dhs-security-and-training-requirements-contractors; www.dhs.gov/xlibrary/assets/privacy/privacy_guide_pihg.pdf

· Other Legislation – can be found by searching on the title

4.1.1 The Contractor shall support the Government to achieve full operational capability of the system including Authorization to Operate (ATO) within six (6) months of contract award. The Contractor shall

4.1.1.1 Support transition activities at the time of contract start and termination, to include knowledge and data transfer

4.1.1.2 Develop a contract start Ingress Transition Plan within thirty (30) calendar days of contract award;

4.1.1.3 Host/participate in contract start ingress knowledge transfer sessions as required by CBP;

4.1.1.4 Perform import of historical applicant data within two (2) weeks of ATO being granted;

4.1.1.5 Develop a contract termination Egress Transition Plan ninety (90) business days before contract end date;

4.1.1.6 Host/participate in contract termination egress knowledge transfer sessions as required by CBP; and

4.1.1.7 Perform contract termination egress migration of applicant data.

4.1.1.8 Provide all necessary system information for the security authorization effort as required by the Contracting Officer or COR. A written ATO granted by the CBP Authorizing Official (AO) is required prior to processing operational data or connecting to any CBP network.

4.1.1.9 Not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an ATO signed by the Headquarters or Component Chief Information Officer (CIO), or designee, in consultation with the Headquarters or Component Privacy Officer.

4.1.1.10 Adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

4.1.2 Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: (i) Security Plan, (ii) Contingency Plan, (iii) Contingency Plan Test Results, (iv) Configuration Management Plan, (v) Security Assessment Plan, (vi) Security Assessment Report, (vii) Control Allocation Table, and (viii) ATO Letter. Additional documents that may be required include, but are not limited to, a Plan(s) of Action and Milestones, Memorandum of Understanding/Agreement and Interconnection Security Agreement(s). During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the contract as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

4.1.3 Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

4.1.4 Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use Personally Identifiable Information (PII), and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones. Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy. Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

4.1.5 Continuous Monitoring and/or Ongoing Authorization. The SA process shall be supported by continuous monitoring and/or ongoing authorization. The Contractor is required to update its SA package as part of continuous monitoring and/or ongoing authorization and report on various security controls. The continuous monitoring and/or ongoing authorization process may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place. The Government may elect to perform IT security scanning of Contractor systems from Government tools and infrastructure.

4.1.6 Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime.

4.1.7 Security Posture. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the performance requirements identified in the Fiscal Year 2017 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis.

4.1.8 Revocation of ATO. In the event of a sensitive information incident, the Government may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor IT system under this contract. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

4.1.9 Federal Reporting Requirements. Contractors operating information systems on behalf of the Government or operating systems containing sensitive information shall comply with Federal reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2017 DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for Contractor systems.

4.2 Task 3 Assessment Content Readiness

4.2.1 The Contractor shall upload, ensure accuracy of content, and ensure content is viewable and displayed correctly at the request of the Government within the timelines specified below:

4.2.1.1 Contractor provided test content within 10 business days.

4.2.1.2 Government provided test content with 10 business days.

4.2.1.3 Third-party provided test content within 30 calendar days.

4.2.2 4.3.2 Content shall be ready for use immediately after acceptance by the Government.

4.3 Task 4: Appointment Scheduling

4.3.1 The Contractor shall provide appointment scheduling and management services. The scheduling system shall:

4.3.1.1 Be online and accessible via personal computers and mobile devices (e.g., cell phones, tablets).

4.3.1.2 Allow only one account per individual email address.

4.3.1.3 Allow multiple test-takers to schedule assessments concurrently.

4.3.1.4 Enable or disable the ability for test-takers to select assessments in accordance with business rules to be provided by the Government after contract award. Business rules will be based on multiple criteria including but not limited to position applied for, grade, and last test date.

4.3.1.5 Allow test-takers the capability to schedule during the Government defined scheduling periods and cancel or reschedule test sessions (in accordance with the Government business rules that will be established or modified post contract award. Business rules will govern criteria such as number of cancellations allowed, late arrivals, lifetime failures, etc.). When approved by the COR, allow test-takers to schedule and complete assessments outside of the pre-determined scheduling and testing periods.

4.3.1.6 Be capable to run simultaneous scheduling and testing periods for the same occupation/test series.

4.3.1.7 Be capable to simultaneously running multiple programs, including separate scheduling and test windows.

4.3.1.8 Be capable to apply different business rules and scheduling rules depending on the opening type (e.g., regularly scheduled vs. hiring hubs), as directed by the Government.

4.3.1.9 Be capable to automatically triggering Assessment Order Request (AOR).

4.3.1.10 Be capable to manually triggering an AOR (e.g., after review of minimum qualifications).

4.3.1.11 Be capable to support same-day application and testing for special opening types (e.g., hiring hubs).

4.3.1.12 Be capable of configuration for special opening types such that on-site AOR can be generated or manually entered (e.g., on-demand one-off ad hoc AOR generation).

4.3.1.13 Allow test-takers to select their preferred test center/location, date, and time when scheduling an appointment.

4.3.1.14 Allow test-takers to view test session appointment information, including date, time, and address.

4.3.1.15 Allow test-takers to select their preferred mode of communication, including text messaging, email, or both.

4.3.1.15.1 Automatically send a message to the test-taker to confirm the scheduled test session utilizing the preferred mode of communication selected by the test-taker.

4.3.1.15.2 Email and text message content shall be Government approved. The confirmation email/text shall include the test date and time, location, test site requirements (e.g. the IDs needed for identification, length of test, etc.), and instructions for canceling or rescheduling the test session.

4.3.1.15.3 Email and text message shall be sent within one (1) hour of scheduling an assessment or changing an appointment.

4.3.1.16 Automatically send a reminder message to the test-taker utilizing the preferred mode of communication selected by the test-taker.

4.3.1.16.1 The reminder email/text shall be Government approved, shall include the test date and time, location, test site requirements (e.g. the IDs needed for identification, length of test, etc.), and instructions for canceling or rescheduling the test session.

4.3.1.16.2 The reminder message shall be sent at least 24 hours prior to the start of the late cancelation period.

4.3.1.16.3 If at the time the appointment is scheduled there are fewer than 24 hours prior to the late cancelation period, the reminder message shall be sent immediately.

4.3.1.17 Automatically generate emails that invite applicants to set up an account and/or schedule to test.

4.3.1.17.1 Email content shall be Government approved.

4.3.1.17.2 Provide a summary report of issues with invitation emails to applicants, to include when applicant emails are not delivered, to the Government on a monthly basis.

4.3.1.18 Allow the Government to make revisions to the notification messages to test takers as needed. Requested changes shall be completed within five (5) business days of the request.

4.3.1.19 Provide advance notice two (2) weeks prior of any upcoming changes to the production environment that impact or change applicant navigation instructions.

4.3.1.19.1 If navigation changes occur after the Contractor has received the Government approved templates for applicant communication, the Contractor shall update the communications as soon as is practicable at no additional charge.

4.3.1.20 Have the capability for the system to notify test-takers both individually and en masse of changes to scheduled test sessions utilizing the preferred mode of communication selected by the test-taker.

4.3.1.21 Allow test-takers with disabilities the option to request reasonable accommodation (in accordance with the Americans with Disabilities Act (ADA)) prior to or at the time of scheduling a test. The system shall also allow test-takers to cancel a request for an accommodation. The system shall automate notification to the Government and provide the Government with the ability to approve or disapprove an accommodation.

4.3.1.22 Interface and transfer data bi-directionally with all the Government Hiring (Government furnished and third-party) Systems and applicant self-scheduling systems in accordance with system security requirements (e.g., FISMA, NIST).

4.4 Task 6: Assessment Administration

4.4.1 The Contractor shall administer automated assessments in proctored and non-proctored environments. The Contractor shall provide the Contracting Officer Representative (COR) with a Proctor’s Manual documenting the administration protocols for physically proctored administration and remote/technologically proctored administration, including a supplement to the proctor’s manual that addresses the ADA accommodations. The administration protocols shall address emergency evacuations of the site during the testing session, power failures, and computer failures, address ADA related accommodations as outlined by the Government, and matters related to test-takers who are suspected of cheating. The administration protocols shall include procedures for reporting any incident or unusual occurrence during a test session. The administration protocol for proctored administration shall provide a way for the assessment administrator to securely access assessment related materials that are unique to each test-taker and securely dispose of any paper generated test material.

4.4.2 Physically Proctored Administration

4.4.2.1 Administer computer-based, online assessments in physically proctored, Contractor-owned or managed facilities within 30 miles, calculated as actual driving distance, of each CBP port, station, and branch, and have the capability to administer such assessments near military bases (see Appendix C for locations).

4.4.2.2 Administer computer-based, online assessments in physically proctored, Contractor-owned or managed facilities at international locations on a limited basis as needed by the Government (see Appendix C for locations).

4.4.2.3 Provide temporary/mobile testing sites when Contractor-owned/managed physically proctored static test sites are not available or will not meet the Government’s needs.

4.4.2.4 Ensure that all test sites, whether static or mobile, have seating/testing capacity commensurate with the Government requirements.

4.4.2.5 Provide the Government with the capability to administer computer-based online assessments in Government proctored environments.

4.4.2.6 Upload data accumulated through offline assessment administration into the COACA system.

4.4.2.7 Provide a secure testing environment that prohibits test taker from accessing the following while in the test environment, as applicable:

4.4.2.7.1 Copy and paste functions;

4.4.2.7.2 Other tests;

4.4.2.7.3 Other applications, programs, and utilities;

4.4.2.7.4 Print functions;

4.4.2.7.5 Other Internet sites.

4.4.2.8 At each Contractor-owned/managed test administration facility, provide a proctor to monitor the test and follow documented testing protocols.

4.4.2.9 Test proctors at contracted locations shall wear name badges or shall otherwise identify themselves as Contractors in support of the Government in any in-person interaction or correspondence.

4.4.2.10 The test proctor shall be:

4.4.2.10.1 Trained by the Contractor in the administration of tests and testing system, test security standards, technology troubleshooting, and reporting requirements.

4.4.2.10.2 Proficient in English.

4.4.2.10.3 The test proctor shall: greet test-takers as they arrive; check-in and check-out test-takers; verify test-taker identity prior to the assessment in accordance with the Government standards; print test-related materials and provide them to test-takers as needed; monitor test-takers throughout test session to ensure test-taker compliance with testing policies; record any incidents (e.g., applicant issues, computer issues, power outages, fire drills, etc.) on a standard incident report form. The Contractor shall ensure the Government is notified of incidents timely (within one business day); accommodate approved reasonable accommodation requests (e.g., additional testing time); be qualified to provide test-takers with assistance throughout their testing appointment including, but not limited to, resolving problems with the test room environment, troubleshooting system problems, rescheduling test-takers when the test center is unable to accommodate a completed test appointment; and securely dispose of assessment related materials in compliance with guidance set forth by DHS Management Directive (MD) 11042.1, Safeguarding Sensitive But Unclassified (SBU) Information.

4.4.2.11 At each testing site, the Contractor shall:

4.4.2.11.1 Require a user authentication for proctored assessments, a Government issued picture identification is required (per requirements established by the Government’s business rules, to be provided post contract award).

4.4.2.11.2 Provide the Government with a daily verified roster and record of attending/non-attending test-takers.

4.4.2.11.3 Have a secure encryption procedure to transmit and receive roster information.

4.4.2.11.4 Have the capability to transmit attendance information and provide incident reports.

4.4.2.11.5 Ensure adherence to test administration protocol.

4.4.2.11.6 Ensure at least one proctor remains in the test room at all times during a test appointment to answer questions and address technical issues.

4.4.2.11.7 Ensure all test material issued to applicants is collected and destroyed in accordance with Government provided directions so that no test material leaves the test room.

4.4.2.12 Administer assessments in accordance with Government provided Directions for Conducting (DFC). Provide a plan for how the Contractor shall ensure test administrators/proctors consistently follow guidelines. The plan shall address corrective actions to be taken when test takers report deviations from DFC.

4.4.2.13 Provide new test versions/series of previously automated tests, as defined by the Government, when applicants are required to re-test within the six-month Government’s restriction period

4.4.2.14 Create and implement protocols for the safety and security of test center staff.

4.4.2.15 Develop and provide policy on bringing items into the test room to include what items are prohibited (Proctor Manual and Proctor Training Plan shall be provided with proposal).

4.4.2.16 Implement emergency protocols (e.g., fire, earthquake).

4.4.2.17 Implement disaster recovery protocols and procedures (e.g., fire alarm, power failure not affecting computer terminals).

4.4.2.18 Provide the COR a Test administration protocol quality assurance plan for how the Contractor shall ensure the test administration protocol is followed for Contractor-proctored assessments within two (2) months of receiving the Government’s test administration protocol. This plan should also address what will occur if a proctor is not present or is late to a testing session. In the event it is necessary to retest a test-taker due to failure to follow test administration procedures, the Contractor shall retest the test-taker at no cost to the Government.

4.4.2.19 Accommodate any test-taker reschedules based on the Government’s review of incident reports.

4.4.2.20 Provide weekend or evening sessions as required by the Government. Testing volume for particular positions may have a larger volume of weekend test administrations and test seat capacity should be commensurate with need.

4.4.2.21 Ensure the Contractor-owned/managed test administration facilities, whether static or mobile, meet acceptable standards for a commercial marketplace computer-based testing environment including but not limited to:

4.4.2.21.1 A secure testing environment that prevents unauthorized users from accessing the testing room while testing is in progress, and that prevents unauthorized users from accessing the computers at any time.

4.4.2.21.2 The site is set up in such a way that the proctor can monitor all test takers either in person or by video throughout the testing session.

4.4.2.21.3 A minimum of five feet exists between test takers, or in situations where 5-feet between test takers is not possible, privacy carrels are utilized and/or computers are positioned such that test takers may not view each other’s responses and/or work.

4.4.2.21.4 A comfortable room temperature is maintained (approximately 70-75 degrees).

4.4.2.21.5 Testing rooms and facilities are clean and amenities such as restrooms are nearby.

4.4.2.21.6 Lighting is illuminated to General Services Administration (GSA) standards (http://www.gsa.gov/portal/content/101308) and glare on computer screens is minimized or eliminated.

4.4.2.21.7 Chairs are sturdy and comfortable.

4.4.2.21.8 Parking is available for test-takers including handicapped accessible spaces.

4.4.2.21.9 The test center is ADA compliant, including the availability of accessible restrooms.

4.4.2.21.10 Sufficient bandwidth is available for all test-takers, internet speed, monitor size, image quality, hardware requirements, sound/headphone requirements, etc. so that a variety of types of assessments can be effectively administered (e.g., video-based simulations, avatar based simulations, multiple choice assessments, etc.).

4.4.2.21.11 The test center is capable of accommodating applicants with special testing requirements (e.g., quiet room, extended time, large fonts, instructor-read instructions).

4.4.2.22 Conduct regular inspections to ensure test centers meet qualifications as set forth in the Contractor’s Proctor Training Plan.

4.4.2.23 The test administration facilities shall have pens, scratch paper, and highlighters available for test-taker use and shall have a functioning printer.

4.4.2.24 Convert an online assessment to a format that can be administered via paper-and-pencil test administration, or another test administration format that is accessible by all sites as needed.

4.4.2.25 A functionally equivalent offline-solution that includes, but is not limited to the following:

4.4.2.25.1 Scannable offline forms;

4.4.2.25.2 Distribution of blank offline forms;

4.4.2.25.3 Services for the offline forms to include receiving completed forms, scanning, error checking and attempting to resolve errors (review forms and log issues), and reporting of logs;

4.4.2.25.4 Create .PDF formatted files for offline test results to include all item responses (for scored and unscored items) and subtest scores;

4.4.2.25.5 Upload all possible forms into Web-based COACA and compile with Web-based COACA data;

4.4.2.25.6 Manage retention of all forms in accordance with the Government’s Records Management requirements (stored in a locked room and/or filing cabinet, retained for 5 years, prepared for and shipped to National Archives and Records Administration (NARA) facility, etc.);

4.4.2.25.7 Interface with other Government vendors to send and receive data between the COACA system and third-party vendor system when the third-party is administering the test/assessment.

4.4.2.26 Ensure that the assessments, both the online system and functionally equivalent offline-solution, shall be available for Government personnel to administer at a Government or other facility as the Government requires.

4.4.3 Remote/Technologically Proctored Administration

4.4.3.1 Administer computer-based, online assessments in a remote/technologically proctored, environment.

4.4.3.2 The Contractors shall monitor test-takers for deviations from test policy and shall report any suspected deviations within one (1) business day.

4.4.3.3 The system shall use technological controls to maximize standardization across the system used by test-takers.

4.4.3.4 The system shall ensure test-taker systems are compatible before initiating a test.

4.4.3.5 Provide a secure testing environment that prohibits test taker from accessing the following while in the test environment, as applicable:

4.4.3.5.1 Copy and paste functions;

4.4.3.5.2 Other tests;

4.4.3.5.3 Other applications, programs, and utilities;

4.4.3.5.4 Print functions;

4.4.3.5.5 Other Internet sites.

4.4.3.6 The Contractor shall provide test-takers with assistance throughout the test administration including, but not limited to, troubleshooting system issues.

4.4.3.7 Provide weekend or evening sessions as required by the Government. Testing volume for particular positions may have a larger volume of weekend or evening remote/technologically proctored test administrations and proctoring capacity should be commensurate with need.

4.4.3.8 The Contractor shall provide quality checks of remote/technologically proctoring sessions to ensure compliance with government test security and test administration policies.

4.4.4 Unproctored Administration

4.4.4.1 The test administration system shall provide the ability to prohibit or allow the use of mobile devices for unproctored administration.

4.4.4.2 Administer unproctored assessments in accordance with industry standards and best practices, as approved by the Government.

4.4.4.3 The system shall use technological controls to maximize standardization across the system used by test-takers.

4.4.4.4 The system shall ensure test-taker systems are compatible before initiating a test.

5.0 SECURITY

6.1 The Contractor shall provide all of the personnel, operational resources, and facilities, and functional management processes necessary to execute the requirements of the SOW. Before performing work under this contract, the Contractor personnel must be deemed suitable by CBP Personnel Security and are required to sign a non-disclosure agreement.

6.2 The Contractor shall turn over all materials and documents to CBP at the end of the contract. CBP shall have ownership rights over all materials and content developed under the course of this contract in accordance with the attached FAR data rights clauses.

6.3 Contractor access to unclassified, but Security Sensitive Information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

6.4 Security Impact Levels

6.4.1 This section is based on ICMS information security categorization levels as determined by the FIPS 199 Information Security Categorization process and tool. The data for Table 2 is determined through the Security Categorization Process and the NIST SP 800-53 Security Categorization (RA-2) control.

6.4.2 The ICMS security impact levels for each of the three security objectives of confidentiality, integrity, and availability are identified in Table 1.

6.5 DHS Security Policy

6.5.1 All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy and the DHS 4300A Sensitive Systems Handbook.

6.5.2 The Contractor shall ensure that the design conforms to the Department of Homeland Security (DHS) and Customs and Border Protection (CBP) Enterprise Architecture (EA), the DHS and CBP Technical Reference Models (TRM), and all DHS and CBP policies and guidelines (such as the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework), as promulgated by the DHS and CBP Chief Information Officers (CIO), Chief Technology Officers (CTO) and Chief Architects (CA).

6.5.3 The Contractor shall conform to the Federal Enterprise Architecture (FEA) model and the DHS and CBP versions of the FEA model, as described in their respective EAs. All models will be submitted using Business Process Modeling Notation (BPMN 1.1 or BPMN 2.0 when available) and the CBP Architectural Modeling Standards. Universal Modeling Language (UML2) may be used for infrastructure only. Data semantics shall be in conformance with the National Information Exchange Model (NIEM). Development solutions will also ensure compliance with the current version of the DHS and CBP target architectures.

6.5.4 Where possible, the Contractor shall use DHS/CBP approved products, standards, services, and profiles, as reflected by the hardware, software, application, and infrastructure components of the DHS/CBP TRM/standards profile. If new hardware, software, or infrastructure components are required to develop, test, or implement the program, these products will be coordinated through the DHS and CBP formal Technology Insertion (TI) process (to include a trade study with no less than four alternatives, one of which reflecting the status quo and another reflecting multi-agency collaboration). The DHS/CBP TRM/standards profile will be updated as TIs are resolved.

6.5.5 All developed solutions shall be compliant with the Homeland Security (HLS) EA.

6.5.6 All IT hardware and software shall be compliant with the HLS EA.

6.5.7 Compliance with the HLS EA shall be derived from and aligned through the CBP EA.

6.5.8 Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval, and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

6.5.9 Development of data assets, information exchanges, and data standards will comply with the DHS Data Management Policy MD 103-01. All data-related artifacts will be developed and validated according to DHS Data Management Architectural Guidelines.

6.5.10 Applicability of Internet Protocol version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS EA (per OMB Memorandum M-05-22, August 2, 2005), regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant, as defined in the USGv6 Profile (NIST Special Publication 500-267) and the corresponding declarations of conformance, defined in the USGv6 Test Program.

6.6 Security Requirements for Unclassified Information Technology Resources

6.6.1 The Contractor shall be responsible for Information Technology (IT) security for all systems connected to a DHS network or operated by the Contractor for DHS, regardless of location. This clause applies to all or any part of the contract that includes information technology resources or services for which the Contractor must have physical or electronic access to sensitive information contained in DHS unclassified systems that directly support the agency’s mission.

6.6.2 The Contractor shall provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

6.6.2.1 Within 45 days after contract award, the Contractor shall submit for approval an IT Security Plan, which shall be consistent with and further detail the approach contained in the Contractor's proposal. The plan, as approved by the Contracting Officer, shall be incorporated into the contract as a compliance document.

6.6.2.2 The Contractor’s IT Security Plan shall comply with Federal laws that include, but are not limited to, the Computer Security Act of 1987 (40 U.S.C. 1441 et seq.); the Government Information Security Reform Act of 2000; and the Federal Information Security Management Act of 2002; and with Federal policies and procedures that include, but are not limited to, OMB Circular A-130.

6.6.2.3 The security plan shall specifically include instructions regarding handling and protecting sensitive information at the Contractor’s site (including any information stored, processed, or transmitted using the Contractor’s computer systems), and the secure management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

6.6.2.3.1 Tasks that require security provisions include

6.6.2.3.2 Acquisition, transmission or analysis of data owned by DHS with significant replacement cost should the Contractor’s copy be corrupted; and

6.6.2.3.3 Access to DHS networks or computers at a level beyond that granted the general public (e.g., such as bypassing a firewall).

6.6.3 At the expiration of the contract, the Contractor shall return all sensitive CBP information and IT resources provided to the Contractor during the contract, and certify that all non-public DHS information has been purged from any Contractor-owned system. Components shall conduct reviews to ensure that the security requirements in the contract are implemented and enforced.

6.6.4 Within 6 months after contract award, the Contractor shall submit written proof of IT Security accreditation to CBP for approval by the CBP Contracting Officer. Accreditation will proceed according to the criteria of the DHS Sensitive System Policy Publication, 4300A (Version 2.1, July 26, 2004) or any replacement publication, which the Contracting Officer will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the Contracting Officer, shall be incorporated into the contract as a compliance document. The Contractor shall comply with the approved accreditation documentation.

6.7 Encryption Compliance Requirement

6.7.1 FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

6.7.2 National Security Agency (NSA) Type 2 or Type 1 encryption.

6.7.3 Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the Department of Homeland Security (DHS) IT Security Program Handbook (DHS Management Directive (MD) 4300A) for Sensitive Systems).

6.7.4 Handling Sensitive PII Data

6.7.5 When a Contractor, on the behalf of CBP, handles Sensitive PII data, stores and transmits, the Contractor will Accredit (ATO) this information system to the (HHM) FIPS level.

6.8 Security Review

6.8.1 The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced.

6.8.2 The Contractor shall afford DHS, including the organization of the CBP Office of the Chief Information Officer, the Office of the Inspector General, authorized COR, and other Government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract.

6.8.3 The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of Government oversight organizations external to the DHS.

6.8.4 Access shall be provided to the extent necessary for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

6.8.5 Required Protections for DHS Systems Hosted in Non-DHS Data Centers

6.8.6 Contractors are fully responsible and accountable for ensuring compliance with all Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS), and related DHS security control requirements (to include configuration guides, hardening guidance, DHS Security Policy, Procedures, and Architectural guidance). The Contractor security procedures shall be the same or greater than those that are provided by DHS Enterprise Data Center(s). Please note that all of the subsections from Security Authorization to Log Retention are included in this requirement.

6.9 Security Authorization

6.9.1 A Security Authorization of any infrastructure directly in support of the DHS information system shall be performed as a general support system (GSS) prior to DHS occupancy to characterize the network, identify threats, identify vulnerabilities, analyze existing and planned security controls, determine likelihood of threat, analyze impact, determine risk, recommend controls, perform remediation on identified deficiencies, and document the results. The Security Authorization shall be performed in accordance with the DHS Security Policy and the controls provided by the hosting provider shall be equal to or stronger than the FIPS 199 security categorization of the DHS information system.

6.9.2 At the beginning of the contract, and annually thereafter, the Contractor shall provide the results of an independent assessment and verification of security controls. The independent assessment and verification shall apply the same standards that DHS applies in the Security Authorization Process of its information systems. Any deficiencies noted during this assessment shall be provided to the COR for entry into the DHS’ Plan of Action and Milestone (POA&M) Management Process. The Contractor shall use the DHS’ POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies shall be corrected within the timeframes dictated by the DHS POA&M Management Process. Contractor procedures shall be subject to periodic, unannounced assessments by DHS officials. The physical aspects associated with Contractor activities shall also be subject to such assessments.

6.9.3 On a periodic basis, the DHS and its Components, including the DHS Office of Inspector General, may choose to evaluate any or all of the security controls implemented by the Contractor under these requirements. Evaluation could include, but it not limited to vulnerability scanning. The DHS and its Components reserve the right to conduct audits at their discretion. With ten working days’ notice, at the request of the Government, the Contractor shall fully cooperate and facilitate in a Government-sponsored security control assessment at each location wherein DHS information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of DHS, including those initiated by the Office of the Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by DHS in the event of a security incident.

6.10 Enterprise Security Architecture

6.10.1 The Contractor shall utilize and adhere to the DHS Enterprise Security Architecture in accordance with applicable laws and DHS policies to the satisfaction of the DHS COR. Areas of consideration could include:

6.10.2 Use of multi-tier design (separating web, application and data base) with policy enforcement between tiers

6.10.3 Compliance to DHS Identity Credential Access Management (ICAM)

6.10.4 Security reporting to DHS central control points (i.e. the DHS Security Operations Center (SOC) and integration into DHS Security Incident Response

6.10.5 Integration into DHS Change Management (for example, the Infrastructure Change Control Board (ICCB) process)

6.11 Continuous Monitoring

6.11.1 The Contractor shall participate in DHS’ Continuous Monitoring Strategy and methods or shall provide a Continuous Monitoring capability that the DHS determines acceptable. The DHS Chief Information Security Officer (CISO) issues annual updates to its Continuous Monitoring requirements via the Annual Information Security Performance Plan. At a minimum, the Contractor shall implement the following processes:

6.11.1.1 Asset Management

6.11.1.2 Vulnerability Management

6.11.1.3 Configuration Management

6.11.1.4 Malware Management

6.11.1.5 Log Integration

6.11.1.6 Security Information Event Management (SIEM) Integration

6.11.1.7 Patch Management

6.11.2 Providing near-real-time security status information to the DHS SOC

6.12 Specific Protections

6.12.1 Specific protections that shall be provided by the Contractor include, but are not limited to the following:

6.12.1.1 Security Operations

6.12.1.1.1 The Contractor shall operate a SOC to provide the security services described below. The Contractor shall support regular reviews with the DHS Information Security Office to coordinate and synchronize the security posture of the Contractor hosting facility with that of the DHS Data Centers. The SOC personnel shall provide 24x7x365 staff to monitor the network and all of its devices. The Contractor staff shall also analyze the information generated by the devices for security events, respond to real-time events, correlate security device events, and perform continuous monitoring.