CISA Infrastructure Security IT Systems_DRAFT SOW.pdf

DEPARTMENT OF HOMELAND SECURITY (DHS)

STATEMENT OF WORK (SOW)

FOR

Cybersecurity and Infrastructure Security Agency (CISA) Infrastructure Security IT Systems

1.0 GENERAL

1.1 BACKGROUND

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions: the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered within the National Capital Region (NCR).

CISA’s information technology (IT) landscape has historically produced networks and systems individually managed and maintained within each of its Divisions as well as its MEOs. This task order is to provide development and operations & maintenance support to CISA/OCIO to maintain and enhance the CISA Infrastructure Security IT capabilities. These IT capabilities shall support CISA’s ability to continue establishing a modern IT infrastructure; adoption of cloud native services; supporting the CISA Infrastructure IT system environments; and continually improving the performance, security, and availability of the CISA Infrastructure Security IT services.

1.2 SCOPE

The Contractor shall perform the services listed below for the functional areas and shall ensure the services are integrated, well defined, and documented, standardized, repeatable, accurate and timely. All the associated processes in all functional areas shall produce secure, high quality and cost-effective services, work products and IT solutions, and shall be properly documented using the ITIL v3 framework. The Contractor shall perform these services in a manner that will drive efficiencies through continual maintenance and improvement of documented processes.

This SOW details CISA’s requirement for the following services:

• Program / Project Management

• Technical Solutions Engineering and Implementation

• Operations and Maintenance Support

1.3 OBJECTIVE

CISA’s objective is to obtain expertise to support the:

• Development of new capabilities and tools to support CISA’s Infrastructure Security mission. This will require architecting, designing, developing, and supporting the capabilities including, but not limited to, databases, web application services, cloud hosted environments, applications, and system development.

• Modernization of existing capabilities and tools to enable further adoption of cloud native resources. This will require reviewing existing cloud migrations that have been performed to IT systems, optimizing IT systems to leverage cloud native and managed services to include but not limited to databases, serverless capabilities, Application Program Interfaces (APIs) gateways and containerized platforms.

• Adoption and incorporation of CISA’s enterprise services into IT systems supporting CISA’s Infrastructure Security mission.

• Providing Tier II and III level support to users of CISA’s IT Infrastructure Security systems. This includes but is not limited to responding to tickets and issues escalated from CISA’s Technical Operations Center, resolving tickets that require specialized knowledge of the specified IT system(s), troubleshooting and diagnosing issues with application configurations and user privileges, development of knowledge and technical articles to support first call resolution and ensuring system backups are occurring on their scheduled basis.

1.4 APPLICABLE DOCUMENTS

1.4.1 Compliance Documents

DHS Management Directive 140-01, “Information Technology System Security Program, Sensitive Systems”

• DHS 4300A Policy Directive (Version 13.3, February 13, 2023).

1.4.2 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

• Federal Information Technology Acquisition Reform Act (FITARA), 2015: 1

Provides the statutory basis for Federal-wide IT reform.

• Federal Information Technology Shared Services Strategy, May 2, 2012: 2

Provides organizations in the Executive Branch of the United States Federal Government (Federal Agencies) with policy guidance on the full range and lifecycle of intra- and inter-agency IT shared services that enable mission, administrative, and infrastructure-related IT functions.

• Federal CIO 25 Point Implementation Plan to Reform Federal Information Technology Management, Dec 9, 2010: 3

Specifies that “Agencies must focus on consolidating existing data centers, reducing the need for infrastructure growth by implementing a Cloud First policy for services, and increasing the use of available cloud and shared services”.

• Federal Risk and Authorization Management Program (FedRAMP): 4 Provides joint "provisional" authorizations and continuous security monitoring services applicable to “Executive departments and agencies procuring commercial and non-commercial cloud services that are provided by information

1 Title VIII, Subtitle D of the National Defense Authorization Act (NDAA) for Fiscal Year 2015, Pub. L. No. 113- 291.

2 https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/shared_services_strategy.pdf.

3 https://www.dhs.gov/sites/default/files/publications/digital-strategy/25-point-implementation-plan-to-reform-federal-it.pdf 4 https://www.fedramp.gov/about-us/about/ systems that support the operations and assets of the departments and agencies, including systems provided or managed by other departments or agencies, contractors, or other sources”.

• Federal Cloud Computing Strategy, Feb 8, 2011: 5 Intends to articulate the benefits, considerations, and trade-offs of cloud computing by: providing a decision framework and case examples to support agencies in migrating towards cloud computing; highlighting cloud computing implementation resources; and, identifying Federal Government activities and roles and responsibilities for catalyzing cloud adoption.

2.0 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK One. Program / Project Management

This task encompasses program management and project management support to include overall reporting to the Contracting Officer’s Representative (COR), management and reporting of progress and activities in all task areas, coordinating and reporting on Contractor work on projects as directed by the Government project managers and leads, conducting the Kick-Off Meeting, and performing transition in/out activities.

2.1.1 Program Management Services

The Contractor shall provide program management support including, but not necessarily limited to, overall reporting to the COR and management and reporting of progress and activities in all task areas. The Contractor shall designate a Program Manager as a single point of contact (POC) capable of program management disciplines, task order administration, and effectively interfacing with subcontractors and CISA at various levels. Contractor shall develop and provide recommendations to improve the support procedures and documentation.

The Program Manager and supporting staff shall perform program management activities that include, but are not necessarily limited to the following:

• Performance tracking and reporting

• Quality control

• Risk management

• Invoicing

• Staffing

• Sub-contractor management

• Submitting Weekly Status Reports (WSRs), Monday NLT 2:00 pm EST

2.1.2 Monthly Program Management Reviews

The Contractor Program Manager and/or supporting staff shall coordinate, facilitate, and attend the monthly Program Management Review (PMR) meeting to brief Government management regarding the operational performance under this task order 10 business days after the end of the month. The Contractor shall be responsible for all aspects of the review, including preparing meeting agendas, reports, support documentation, providing meeting minutes, and tracking and reporting action items.

5 https://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/federal-cloud-computing-strategy.pdf

2.1.3 Program Management Support

The Contractor shall coordinate work activities on projects as directed by the Government project manager or lead and provide a Quality Control Plan final plan due 10 business days after the kickoff meeting. The Contractor shall perform project management activities that include, but is not limited to:

• Developing or providing input to a project schedule as directed by the government project manager

• Tracking and reporting project progress with respect to the project plan and schedule

• Staffing projects to implement the project plan and achieve the project objectives

• Coordinating performance of project tasks

• Identifying project risks and develop a mitigation strategy

• Performing quality control for project deliverables

2.2 TASK TWO. Technical Solutions Engineering, Development, Automation, and

Implementation

CISA requires flexibility and agility to innovate, deploy and evolve capabilities at speed as its mission and agency requirements continue to evolve in its execution of infrastructure and system architecture, design, implementation, integration, and maintenance. The Contractor shall support CISA with the adoption of new digital solutions to support achieving the economies of scale that support the business case for digital platforms and requires support to achieve CISA’s goals. The contractor shall employ Development, Security, and Operations (DevSecOps) with the use of principles such as Infrastructure as Code (IAC) and Continuous Integration/Continuous Deployment (CI/CD) pipelines to make infrastructure environments available on demand with the necessary security accreditation built in to provide the delivery of mission and business value to end users with higher quality solutions and technical maturity.

The Contractor’s software development shall be delivered in an incremental, fast-paced style to reduce the risk of failure. The Contractor shall deliver working software into users’ hands as early as possible to give the design and development team opportunities to adjust based on user feedback about the service. A critical capability is being able to automatically test and deploy the service so that new features can be added often and be put into production easily.

Development practices shall employ practices such as design and code in sections, automated testing, verifying code against Common Weakness Enumeration (CWE), Common Vulnerabilities Exposures (CVE), Open Worldwide Application Security Project (OWASP) to identify and remedy code vulnerabilities, test automation, issue resolution, and prototyping.

2.2.1 Technology Design

Contractor shall engineer and design secure technologies supporting CISA locations and remote work that meets CISA standards and other functional and business requirements to support CISA end-users’ requirements based on site type, applications, location, and processing needs. The Contractor shall develop a comprehensive Detail Design Document (DDD) based on the System Design Document (SDD) for CISA sites. Contractor shall review and update the DDDs on a periodic basis to reflect a new design(s) and/or technologies.

2.2.2 System Technology Infrastructure

Contractor shall engineer, design, test, and implement the CISA Infrastructure Security IT system(s). These services shall include but not limited to:

• Application and systems development,

• Cloud services

The contractor shall leverage latest technologies, trends, and best practices to provide a secure, robust, high performance, and reliable network that supports all existing and future CISA applications. In addition, these services shall improve CISA’s business agility and resilience, lower total cost of ownership (TCO), and increases operational efficiency. The Contractor shall develop a comprehensive Technical Requirements Document (TRD) and Detailed Design Document (DDD) for each system, capability, or service, consistent with FRD and SDD and/or comparative Agile Methodology documentation as applicable for the associated system or solution, before transitioning to Information Technology (IT) Operations subdivision. Contractor shall update the DDD when there is a change in the design and/or technologies. Contractor shall develop a standard Test Plan Template that shall be used to test all systems to verify that it meets requirements and shall work as designed prior to implementing in the production environment. Contractor shall collaborate with all stakeholders and submit a test report along with the Implementation plan for each change that Contractor shall perform on the production network. Manage system hardware and software releases, changes, moves and installation to minimize disruption.

2.2.3 Cloud Environment

Contractor shall engineer, design, test, and implement secure and reliable cloud services (e.g., commercial cloud services providers (CSPs), private cloud, and hybrid cloud). Contractor shall develop a comprehensive Technical Requirement Document (TRD) and a Detailed Design Document (DDD) associated FRD and DDD and/or comparative Agile Methodology documentation as applicable. Contractor shall update the DDD when there is change in the cloud design and/or technologies. Contractor shall collaborate with all stakeholders to test all cloud related systems to verify that the systems meet requirements and are able to host applications with no degradation to performance or security. The Contractor shall submit a test report along with the Implementation Plan for each change the Contractor performs on the system.

2.2.4 Configuration/Change Management Support

Contractor shall prepare Change Requests (CRs) with supporting documentation (e.g., DDDs, Implementation Plans, Test Plans, and As-Is Diagrams), enter the CR into the configuration management tool, present the CR at various review gates, coordinate with all stakeholder(s) for information sharing, approval, and support.

2.2.5 Hardware and Software Testing and Implementation

Contractor shall conduct thorough testing of all new hardware/software and its command line recommended by the vendors to remediate software bugs and/or vulnerabilities in CISA Development Environment to ensure the new hardware and/or software integrates well with the existing environment and no secondary bug and/or vulnerability that causes other issues. Once testing of new hardware and/or software is completed, the Contractor shall submit a comprehensive test report to the Government for review and approval. Contractor shall manage system hardware and software releases, changes, moves, installation, and transition to minimize disruption.

2.2.6 Transition to Operations

Contractor shall prepare necessary artifacts, diagrams, procedures, and additional information and data as required to ensure the systems is supportable.

2.3 TASK THREE. Operations and Maintenance Support

This task encompasses operations and maintenance (O&M) of capabilities and solutions transitioned to Operations for their operations, maintenance, and management. These responsibilities include, but are not limited to, system administration; network management, system hosting and access; information assurance management; certification and accreditation support; software patches and upgrades; configuration management; user management and support; backup and recovery; and network and performance monitoring.

2.3.1 Operations Support

The contractor shall provide the necessary operations, maintenance, and maintenance support of capabilities and solutions delivered to Operations. Support shall include but is not limited to

• Logistics

• Service desk support (Tier II and III)

• Trouble ticket incident tracking and management

• Application management and monitoring

• Systems performance monitoring and capacity planning

• System performance evaluation

• Identity and access management

• Technology integration

• System administration

• Data management

• Infrastructure support

• Asset management

• Image management

• Software patches and upgrades

• Information security vulnerability management

• Information security compliance

• Upgrades

• Fault resolution

• Patch management

• Change, configuration, and release management

• Disaster recovery

• Emerging technology assessments

• Testing processes including all tasks related to production deployment

• System artifact and process maintenance

• Technical refresh

2.3.2 Service Desk Support (Tier II and III)

The contractor shall provide Tier II and III level support to users of CISA’s IT Infrastructure Security systems. Support shall include but is not limited to:

• Responding to tickets and issues escalated from CISA’s Technical Operations Center.

• Resolving tickets that require specialized knowledge of the specified IT system(s).

• Troubleshooting and diagnosing issues with application configurations and user privileges.

• Development of knowledge and technical articles to support first call resolution.

2.4 TASK Four. Surge Support (Optional)

This optional Surge support is for the Government to request additional services to complete tasks in this SOW during any period of performance under this task order. Surge Efforts will be awarded on a Not to Exceed Labor Hour basis. The Government may define the work to be performed, working hours, labor categories, deliverables and duration of assignment in writing prior to authorizing performance. The Government may authorize a ceiling price for additional work in support of mission support services. The contractor shall only be authorized to work to the amount funded for the Surge CLIN.

3.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates.

ITEM SOW

REFERENCE DELIVERABLE / EVENT DUE BY DISTRIBUTION

1 5.18 Transition-In Plan Within 10 days after Kick Off meeting CO, COR

2 4.1 Staffing Plan Submit with Transition-In Plan CO, COR

3 2.1.2 Monthly Program management Reviews Monthly COR

4 4.1 Organizational Charts 25th of the month COR

5 5.19 Transition-Out Plan 120 days prior to contract expiration date

CO, COR

6 5.9 Post Award Conference 14 business days after date of award CO, COR

7 5.1 Project Plan

Draft due at Post Award Conference;

final due 14 business days after Post Award Conference

CO, COR

8 5.11 Business Continuity Plan

15 business days after the date of award; to be updated annually

CO, COR

9 5.12 Weekly Progress Status Reports (WSR)

Monday NLT 2:00

PM EST

COR, Task Leads

10 5.13 Progress Meetings Upon request CO or COR

ITEM SOW

REFERENCE DELIVERABLE / EVENT DUE BY DISTRIBUTION

11 4.3 Contractor Key Personnel

15 days in advance of change CO, COR

12 6.2 Asset Management Report Monthly COR

13 7 Invoices Monthly CO, COR

14 2.2.6 Data Management Plan As Required

COR, CDO

15 2.2.6 Data Quality Plan As Required

COR, CDO

16 2.2.6 Enterprise Conceptual Data Model As Required COR, CDO

17 2.2.5 Test Report

As Required COR

18 2.2.1 Detail Design Documents (DDD) based on the System Design Document (SDD) for each system consistent with FRD and SDD and/or comparative Agile Methodology documentation.

As Required COR

19 2.2.2 Comprehensive Technical Requirements Documents (TRD) & DDD for each system

As Required COR

20 2.2.4 Change Requests (CRs)

As Required COR

21 2.2.6 Artifacts, Diagrams, Procedures, Additional Information and Data for executing transfer of capabilities and solutions to Operations for operations, maintenance, and management.

As Required COR

3.1 Contracting Officer’s Representative (COR)

The COR provides technical direction and guidance based on the requirements identified in this SOW. The COR works closely with the contractor’s Program Manager and/or Project Manager to issue interpretations of technical requirements; to monitor the contractor’s performance under the contract and notify the CO of any deficiencies observed. The COR will provide no supervision to contractor personnel. The COR is not empowered to make any commitments or changes which affect the contract price or other items and conditions. Any such proposed changes must be brought to the immediate attention of the CO for action. The acceptance of any changes by the contractor without specific approval and written consent of the CO shall be at the contractor’s risk.

4.0 CONTRACTOR PERSONNEL

4.1 QUALIFIED Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. The Contractor shall furnish a detailed Staffing Plan that clearly demonstrates how the Contractor will obtain the required staff to meet the Government’s requirements as defined in this SOW. The plan shall include the names and resumes of key personnel, as defined in section 4.3, and any other key positions identified in this SOW. The staffing plan is due by the post award conference.

4.2 Continuity of Support

The Contractor shall ensure that the contractually required level of support for this requirement is maintained at all times. The Contractor shall ensure that all task order support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the Contracting Officer’s Representative (COR) prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

4.3 Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced, unless otherwise approved by the Contracting Officer. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer.

"Key Personnel" is defined as contractor personnel who are recognized by the Government and Contractor as essential to the successful completion and execution of this task order. Contractor shall provide resumes with the proposal for Key Personnel. Contractor shall identify the following positions as key personnel and provide personnel with the qualifications below:

• Program Manager - Contractor shall identify a program manager to oversee the day-to-day operations of the CISA Infrastructure Security IT system(s) Task Order and serve as the contractor’s Point of Contact (POC) for the Contracting Officer Representative (COR), and senior level Government managers. The contractor Program Manager should have the following qualifications:

o Project Management Professional (PMP) and ITIL v3 Foundation certified to ensure task order functions, program/project management services, performance tracking and reporting, and task order execution are conducted and managed according to industry best practices.

o A minimum of five (5) years of experience in IT program management.

o A bachelor’s degree in Management, computer science, or information systems.

o Experience with applying the Agile and Scrum methodologies.

o Shall have experience managing cross-functional teams in a highly collaborative work environment o Shall have experience with cloud and/or SaaS offerings and modernization efforts

• In lieu of a bachelor’s degree, the Government the PM should have an additional 10 years' experience in IT program management for a total of 15 years of experience.

• Lead Software Engineer – Contractor shall identify a Lead Software Engineer, as key personnel, to serve as the subject matter expert in the areas of application development, cloud architecture and design activities. The Lead Software Engineer shall lead application and system architecture and design efforts, assist the Government in developing business cases for new technologies and solutions, advise the Government on an information technology (IT) system strategy to meet business objectives and requirements, and research and evaluate new technologies to support the CISA mission.

In addition, the Lead Software Engineer shall demonstrate experience in developing business cases and determining the Return on Investment (ROI); identifying and architecting solutions and technologies to meet business and functional requirements;

and applying the Agile and Scrum frameworks and methodologies in support of projects.

The Lead Software Engineer shall possess a broad knowledge of application development frameworks and methodologies that can be leveraged to seamlessly integrate into the CISA enterprise network. The Lead Software Engineer should have the following qualifications:

o Have a minimum of ten (10) years of experience in software development.

o Experience in cloud architecture and technologies and a minimum of 5 years in network architecture.

o Possess a bachelor’s degree in engineering, computer science, or information systems.

• In lieu of a bachelor’s degree, the Government the Lead Software Engineer should have an additional 10 years' experience in software development and engineering for a total of 15 years of experience.

Contractor Key personnel shall not be assigned, by the Contractor, to more than one key position for this requirement.

4.4 Program Manager

The Program Manager shall be responsible for all Contractor work performed under this SOW.

The Program Manager shall be a single point of contact for the Contracting Officer and the COR. It is anticipated that the Program Manager shall be one of the senior level employees provided by the Contractor for this work effort. The name of the Program Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Program Manager, shall be provided to the Government as part of the Contractor's proposal. During any absence of the Program Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this task order. Additionally, the Contractor shall not replace the Program Manager without prior approval from the Contracting Officer.

The Program Manager shall be available to the COR via telephone between the hours of 0800 and 1600 ET, Monday through Friday, and shall respond with acknowledgement to a request for discussion or resolution of technical problems within 1 hour of notification. Discussion can be scheduled at a later date and time at the discretion of the government COR and government Program Manager.

4.6 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

4.6 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Program Manager shall ensure Contractor employees understand and abide by Department of Homeland Security and CISA established rules, regulations and policies concerning safety and security.

4.7 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Contracting Officer), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons.

Removal does not relieve the Contractor of the responsibility to continue providing the services required under the task order. The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

5.0 OTHER APPLICABLE CONDITIONS

5.1 SECURITY

Contractor access to CISA Sensitive Information, systems, networks, and reoccurring access to CISA facilities is required under this SOW; therefore, contractor employees will require DHS Fitness Determination to perform work.

1. 3052.204-72 SAFEGUARDING OF CONTROLLED UNCLASSIFIED

INFORMATION (JULY 2023)

f(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information.

This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “ss Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information;

interconnections and access methods; and mission or business use/need.

Examples of ISVI are systems inventories and enterprise architecture models.

Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual.

SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

and

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems. If the Component SOC is not available, the Contractor shall report to the DHS Enterprise SOC.

Contact information for the DHS Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3 Security Requirements for Cryptographic Modules validated cryptographic module identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

(iii) Facility CAGE code if the location of the event is different than the prime Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system; and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data.

The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and

Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit CUI.

ALTERNATE I (JULY 2023)

When Federal information systems, which include Contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI, add the following paragraphs:

(h) Authority to Operate. The Contractor shall not collect, process, store, or transmit CUI within a Federal information system until an ATO has been granted by the Component or Headquarters CIO, or designee. Once the ATO has been granted by the Government, the Contracting Officer shall incorporate the ATO into the contract as a compliance document.

Unless otherwise specified in the ATO letter, the ATO is valid for 3 years. An ATO is granted at the sole discretion of the Government and can be revoked at any time. Contractor receipt of an ATO does not create any contractual right of access or entitlement. The Government’s grant of an ATO does not alleviate the Contractor’s responsibility to ensure the information system controls are implemented and operating effectively.

(1) Complete the Security Authorization process. The Security Authorization (SA) process shall proceed according to DHS Policy Directive 4300A Information Technology System Security Program, Sensitive Systems (Version 13.3, February 13, 2023), or any successor publication; and the Security Authorization Process Guide, including templates. These policies and templates are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(i) Security Authorization Package. The SA package shall be developed using the government-provided Security Requirements Traceability Matrix and SA templates. The SA package consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter. Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s). The Contractor shall submit a signed copy of the SA package, validated by an independent third party, to the COR for review and approval by the Component or Headquarters CIO, or designee, at least 30 days prior to the date of operation of the information system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of modified documents.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the information system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800–53, Security and Privacy Controls for Information Systems and Organizations, or successor publication, accessible at https://csrc.nist.gov/publications/sp. The Contractor shall address all deficiencies before submitting the SA package to the COR for review.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the Contractor shall renew the ATO every 3 years.