SOW.pdf

Executive Office for Immigration Review

Office of Information Technology

Encompass/VIQ Software Support and Maintenance

February 25, 2016

UNCLASSIFIED/FOR OFFICAL USE ONLY

Prepared for:

United States Department of Justice

Information Resource Management

5107 Leesburg Pike, Suite 2300

Falls Church, VA 22041

This page intentionally left blank

TABLE OF CONTENTS

1. BACKGROUND, OBJECTIVE, AND SCOPE

1.1. BACKGROUND

1.2. OBJECTIVE

1.3. SCOPE

2. STATEMENT OF WORK

2.1.1. Service Packs

2.1.2. Software Updates

3. SPECIAL CONTRACT REQUIREMENTS

4. INSPECTION AND ACCEPTANCE

5. PERFORMANCE PERIOD AND PLACE OF PERFORMANCE

5.1. PERIOD OF PERFORMANCE

5.2. PLACE OF PERFORMANCE

6. PRICE AND PAYMENT

6.1. PRICE

6.2. INVOICES

7. TASK ORDER ADMINISTRATION

7.1. CONTRACTING OFFICER

7.2. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

7.3. DOJ SECURITY PROGRAMS MANAGER (SPM)

7.4. CONTRACTOR REPRESENTATIVE FOR TASK ORDER ADMINISTRATION

7.5. RELEASE OF CLAIMS

1. BACKGROUND, OBJECTIVE, AND SCOPE

1.1.Background

The Executive Office of Immigration Review (EOIR) has developed the Digital Audio Recording

(DAR) system to integrate with the Case Access System for EOIR (CASE). The DAR system will serve all EOIR courts and the EOIR headquarters. The system will provide EOIR employees access to case information and audio files through a single interface. Through this single interface, DAR files will have the ability to be burned on to CDs and distributed outside EOIR to individuals requesting a copy of the audio recording from a specific proceeding.

The Digital Audio system architecture utilizes the features available in the Voice IQ (VIQ)

Encompass Pro Suite an enterprise-level digital recording and management solution to include

Encompass Workstations, the recording workstations that capture digital audio, video and case information; the Middle Tier Serves that serve as an intermediate repository for real-time or on-demand synchronization, providing immediate redundancy; and the Central Server; a final repository for the storage and management of audio and case information for the entire system.

The system is also comprised of the CourtFlow, Integrated Case Management (ICM) Tool, and

CourtAble COTS products. The architecture integrates the courtroom audio capture, middle tier storage, and management, and central site storage and management. The process involved in the integration of each component of the architecture is managed by the COTS package and is transparent to the end user.

1.2.Objective

EOIR pursued a contractor to provide support and maintenance for licenses (Digital Recording

Audio).

1.3.Scope

The contractor shall provide software support and maintenance for the following Encompass application products:

Encompass

VIQ-Media Manager

Encompass Mid-tier Server

VIQ-ICM Tool Lite

Encompass Central Server

2. STATEMENT OF WORK

2.1 Software Support

The contractor shall provide email and Telephone Software Support (TSS). Toll free telephone assistance shall be provided to EOIR’s designated caller or either of two designated alternates

Monday through Friday, excluding holidays observed, during the ten consecutive hours from

8AM to 6PM Eastern Standard Time. TSS shall include software problem diagnosis consisting of problem isolation and definition; and assistance with the proper operation of the application products listed in section 1.3. In critical situations, the contractor shall attempt to provide an emergency bypass or temporary workaround.

The contractor shall provide off hours Software Support (OTSS). Telephone assistance shall be provided to an EOIR designated caller or either of two designated alternates Monday through

Friday between the hours of 6:01PM to 7:59AM Eastern Standard Time, weekends including holidays observed. OTSS shall include software problem diagnosis consisting of problem isolation and definition; and assistance with the proper operation of the application products listed in section 1.3. In critical situation, the contractor shall attempt to provide an emergency bypass or temporary workaround.

2.1.1. Service Packs

The contractor shall provide automatic receipt of all patches and service packs released by VIQ.

A patch is defined as a minor correction to the product, including software modifications and fixes. Service packs shall be made available through download, or distributed by the authorized

VIQ vendor.

2.1.2. Software Updates

The contractor shall provide software updates to their supported products. A software update is defined as a new version of a VIQ Solutions product that substantially enhances the functionality of the product. The software updates shall include mechanisms for automatically changing passwords and have the capability to establish passwords that comply with DOJ password policies and procedures.

3. SPECIAL CONTRACT REQUIREMENTS

3.1 Security Requirements - Unclassified

(a) The work to be performed under this order will involve access to unclassified information. All references to “contract(or) personnel” and “contract employee” in this clause include all individuals who will perform under this contract, including individuals employed by the Contractor, team member, subcontractor, consultant, and/or independent contractor.

(b) Duplication or disclosure of the data and other information to which the Contractor may have access as a result of this order is prohibited by Public Law and is subject to criminal penalties.

3.1.1 Contractor Personnel

(a) All Contractor personnel will be subject to a Public Trust Investigation (PTI). Except where specifically noted otherwise (e.g., 3.1.1.5(a)), the Government will be responsible for conducting the investigation and the cost of the investigation. All investigations will be conducted in accordance with applicable Executive Orders, DOJ Orders, Office of Personnel

Management (OPM) guidance, Homeland Security Presidential Directive 12 (HSPD-12), and

Federal Information Processing Standard Publication 201 (FIPS 201).

(b) PTI certifications will be accepted from other Federal agencies provided the investigation performed by the other agency meets or exceeds DOJ requirements.

(c) The Contractor will not be permitted to commence performance under this order until a sufficient number of its personnel, as determined by the COR and Security Program Manager

(SPM), have received the requisite security approval.

(d) During the life of the order, the Contractor shall ensure that no contract employee commences performance hereunder prior to receipt of a written authorization from the

Contracting Officer, the COR, or the SPM.

3.1.1.1 Access to Unclassified Information

(a) Contractor personnel requiring access to unclassified information will fall under the following categories:

(1) High Risk. High risk positions are those positions that have the potential for exceptionally serious impact on the integrity and efficiency of the DOJ and involve duties especially critical to the DOJ or a program mission with broad scope of policy or program authority.

(2) Moderate Risk. Moderate risk positions are those positions that have the potential for moderate to serious impact on the integrity and efficiency of the DOJ. Duties involved are very important to the DOJ or program mission with significant program responsibility or delivery of services.

(3) Low Risk. Low Risk positions are those positions that have limited potential for adversely affecting the national security operations of the Department.

3.1.1.2 Pre-Appointment Background Investigations and Waivers

(a) Background investigations must be conducted and favorably adjudicated for each contract employee prior to commencing work on this contract. However, where programmatic needs do not permit the Government to wait for completion of the entire background investigation, a pre-appointment background investigation waiver can be granted by the SPM, in consultation with the cognizant COR. The extent of the background investigation will vary depending upon the Risk Category associated with each position and whether each position is long- or short-term. Short-term is defined as contract employees having access to Federally-controlled information systems and/or unescorted access to Federally-controlled facilities or space for six months or fewer. The requisite background investigation does not need to be initiated for short-term positions as part of the pre-employment waiver except in the case of non-

U.S. citizen contract employees. However, long-term contract employees requiring unescorted access to Federally-controlled facilities and/or access to any Federally-controlled information system shall be subject to the requisite background investigations described below. A waiver will be disapproved if the pre-appointment background checks reveal derogatory and/or questionable information that has not been resolved in the contract employee’s favor. When a waiver has been disapproved, the COR, in consultation with the SPM, will determine (1) whether the contract employee will no longer be considered for work on a DOJ contract or (2) whether to wait for the completion and favorable adjudication of the background investigation before the contract employee commences work on a Department contract. The minimum pre-appointment investigative requirements are as follows:

(1) High Risk Positions. The minimum background investigation required is a five year scope Background Investigation (BI), and the five year reinvestigation required is an Access

National Agency Check with Inquiries (ANACI). The Standard Form (SF) 85P, Questionnaire for Public Trust Positions, is required.

(2) Moderate Risk Positions. The minimum background investigation required is a

Minimum Background Investigation (MBI) for “moderate” impact on the integrity and efficiency of the DOJ or a Limited Background Investigation (LBI) for “serious” impact potential on the

DOJ’s integrity and efficiency. The five year reinvestigation required is a National Agency Check with Law and Credit (NACLC). The SF-85P is required.

(3) Low Risk/Non-Sensitive Positions. The minimum background investigation required for Low Risk/Non-Sensitive positions is a National Agency Check with Written

Inquiries (NACI) and the required five year reinvestigation is also a NACI. The SF-85, Questionnaire for Non-Sensitive Positions, is required.

(b) The pre-appointment background investigation waiver requirements include:

(1) Favorable review of the security questionnaire form;

(2) Favorable FBI fingerprint results;

(3) Verification of citizenship (copy of a birth certificate, Naturalization

Certificate, or U.S. Passport);

(4) Verification of compliance with the DOJ residency requirement;

(5) Favorable credit report for contract personnel in High Risk and Moderate

Risk positions; and

(6) Verification of the initiation of the appropriate background investigation for long-term Contractor personnel.

3.1.1.3 Required Security Forms

(a) The following forms must be completed and submitted by the Contractor’s Corporate

Security Officer for each contract employee PTI:

(1) FD-258 Applicant Fingerprint Card. Two sets are required per applicant.

The Contractor may schedule appointments with the SPM to be digitally fingerprinted; otherwise, fingerprinting by the FBI or a law enforcement entity is required. All pertinent information must be completed by the individual taking the prints, or by the FBI if prints are taken there.

(2) SF-85 Questionnaire for Non-Sensitive Positions -or- SF-85P

Questionnaire for Public Trust Positions. The contract employee shall complete the SF-85/SF-85P via the Electronic Security Questionnaires for Investigations Processing (e-QIP) System after first obtaining access to e-QIP from the designated eQIP Initiator (see paragraph (c) below).

The Contractor shall also submit a hard copy of the form, which must include the original signature pages, with the remainder of the security package.

(3) DOJ-555 Fair Credit Reporting Act Disclosure. Authorizes DOJ to obtain one or more consumer/credit reports on the individual. This is required for Contractor personnel in High Risk and Moderate Risk positions.

(4) Foreign National Relatives and Associates Statement. This is only required if any relatives listed on the SF-85/SF-85P are foreign nationals.

(5) Confidentiality Agreement for Contractor and Subcontractor Employee.

See Section 3.3 for confidentiality requirements.

(6) Form I-9 Employee Eligibility Verification. This form is to be held on file by the Contractor’s Corporate Security Officer.

(b) The Contractor shall also submit a credit report for each individual designated at the

High Risk or Moderate Risk level, and have resolved satisfactorily any individual credit issues.

(c) Using e-QIP. 0Immediately after contract award, the Contractor shall designate an employee as its “e-QIP Initiator” and provide the name of this person to the COR. The e-QIP

Initiator must have, at a minimum, a favorably adjudicated MBI and the appropriate DOJ security approval before being given access to e-QIP. After the e-QIP Initiator’s security approval is granted, the Contractor will be configured in e-QIP as a sub-agency to DOJ. The Contractor will then be responsible for initiating all contract personnel in e-QIP for completion of the security questionnaire form and forwarding the electronic form along with a hard copy of the form (as completed and signed by the contract employee) with the remainder of the security package to the

COR. Subject to the prior approval of the SPM, the Contractor may designate an e-QIP Initiator for each subcontractor. Subcontractor e-QIP Initiators must have, at a minimum, a favorably adjudicated MBI and the appropriate DOJ security approval before being given access to e-QIP.

3.1.1.4 Citizenship and Residency Requirements

(a) Residency Requirement. Contract employees, both United States (U.S.) citizens and non-U.S. citizens, must meet the Department’s Residency Requirement, i.e., he/she must have lived in the U.S. three of the last five years immediately prior to employment under the

Department contract; and/or worked for the U.S. overseas in a Federal or military capacity; and/or be a dependent of a Federal or military employee serving overseas. At the Department’s sole discretion, the residency requirement may be waived by the Department Security Officer (DSO) on a case-by-case basis where justified by extenuating circumstances.

(b) Citizenship. The DOJ gives strong priority to contract employees that are U.S.

citizens and nationals. Any prospective contract employee who is a foreign national must be from a country allied with the U.S. (See http://www.opm.gov/employ/html/Citizen.htm). At the

Department’s sole discretion, a waiver of the allied nations list requirement may be granted by the

DSO, or designee, on a case-by-case basis where justified by extenuating circumstances. The

Contractor is responsible for verifying that all non-U.S. citizens working under this contract have been lawfully admitted to the U.S. Contract employees requiring access to DOJ Information

Technology (IT) resources are subject to the following additional restriction:

Non-U.S. citizens are not authorized access to or permitted to assist in the development, operation, management or maintenance of DOJ IT systems unless a waiver has been granted by the Head of the DOJ component, with the http://www.opm.gov/employ/html/Citizen.htm concurrence of the DSO and the DOJ Chief Information Officer (CIO). Such a waiver will be granted only in exceptional and unique circumstances. It should be noted that the Justice Consolidated Office Network (JCON) is a sensitive

“DOJ IT system” and any contract employee that will need access to JCON must be a U.S. citizen or have received a waiver.

(c) Dual Citizenship. U.S. citizens who hold dual citizenship with a foreign country may be considered for contract employment. However, how the contract employee obtained or exercises his or her dual citizenship status will be a consideration in the adjudication process.

3.1.1.5 Procedures for Pre-Screening Applicants and Investigation

(a) The Contractor shall perform the following pre-screening and investigation duties for all persons proposed for work under this contract:

(1) Furnish to each proposed contract employee the forms described in

Section 3.1.1.3 above and ensure that adequate instructions for completing the forms are provided to each applicant.

(2) Ensure that applicants obtain two (2) complete sets of their fingerprints on the prescribed Form FD-258 from an organization qualified to take fingerprints.

(3) Collect completed forms from each applicant and review all forms for completeness and correctness. This includes, for example, satisfactory resolution of address issues or discrepancies. Return any incomplete or incorrect form(s) to applicant(s) to be corrected and re-submitted.

(4) Submit completed forms to the COR by no later than (14) calendar days after receipt of the blank forms and access to e-QIP has been initiated.

(5) As directed by the COR, initiate pre-appointment waivers for certain positions. This may entail performing credit history checks and submission of these checks as part of the security package, including satisfactory resolution of any issues prior to submission to the

Government.

(6) As directed by the COR, review all forms prior to their being submitted to DOJ to ensure that candidates meet DOJ requirements, including residency and citizenship requirements.

(b) The Department will be responsible for the following:

(1) Determine the appropriate risk level for each contract employee position.

(2) 0Provide the Contractor an adequate supply of forms and instructions for completing the forms within five business days after contract award. Ensure that the Contractor is provided access to the e-QIP system as described in 3.1.1.3(c).

(3) Ensure that completed security forms are forwarded to the appropriate investigating agency in accordance with appropriate internal procedures.

The investigating agency will conduct the requisite investigations.

(4) Determine whether pre-appointment background investigation waivers will be needed, and if so, which positions will require such waivers. The

COR will notify the Contractor which pre-appointment waivers to initiate.

(5) Notify the Contractor of the results of background investigations as they are completed and adjudicated. The COR will notify the Contractor of any applicants who are found ineligible for employment security approval so that the Contractor can immediately recruit and initiate paperwork to clear replacement applicants.

(6) Notify the Contracting Officer when a sufficient number of contract employees have received employment security approvals or pre-appointment waivers approvals. Upon receipt of this information and any other information which may be required elsewhere in the contract, the Contracting Officer will issue the Contractor a Notice to Proceed which permits the commencement of work under the contract.

(7) Maintain an up-to-date file of Certificates of Investigation (COI) and other background investigation-related documentation for all contract employees throughout the life of the contract.

(c) The investigating agency will furnish to the relevant SPM the results of each proposed contract employee’s investigation through issuance of an investigation report. Upon receipt of the investigation report and any other pertinent documents from the investigating agency, the SPM will determine whether or not each proposed contract employee should be granted employment security approval. This decision process is called “adjudication.” The SPM will notify, if required, the investigating agency of the adjudicative determination of each investigation. If the Office of Personnel Management (OPM) is the investigating agency, this will be accomplished by the SPM completing and submitting to OPM an INV Form 79A, “Report of Agency Adjudicative Action.”

3.1.1.6 Identity Proofing and Badging

(a) During the life of this contract, the right to unescorted access to Federally-controlled facilities and/or access Federally-controlled information systems shall be made available after the contract employees have (1) met the identity proofing requirements outlined below, and (2) completed all other security requirements stated elsewhere in this contract. During all operations on Government premises, the contract employees shall comply with the rules and regulations governing the conduct of personnel and the operation of the facility. The Government reserves the right to require contract employees to "sign-in" upon entry and "sign-out" upon departure from the DOJ facility.

(b) All contract employees requiring unescorted access to Federally-controlled facilities and/or access to Federally-controlled information systems (regardless of whether they will be issued a DOJ badge), shall comply with the identity proofing and registration requirements outlined below:

(1) Contract employees must present two forms of identification in original form prior to commencement of work under this contract and badge issuance (acceptable documents are listed in Form I-9, OMB No. 1615-

0047, “Employment Eligibility Verification,” and at least one document must be a valid State or Federal government-issued picture ID); and,

(2) Contract employees must appear in person at least once before a DOJ official who is responsible for checking the identification documents.

This identity proofing must be completed prior to commencement of work under this contract and badge issuance (as applicable), and must be documented by the DOJ official.

(c) All contract employees requiring unescorted access to a DOJ controlled facility shall comply with the badge requirements outlined below:

(1) When any contractor employees enter a DOJ building for the first time, the contract employees shall allow one hour for security processing and the fabrication of buildings access badges.

(2) Building access badges shall be subject to periodic review by the

Contractor's Supervisor and checked against the employee's personal identification. The contract employees shall present themselves for the issuance of renewed badges when required by the Government as scheduled by the COR or his designee. The Contractor shall immediately notify the COR when employee badges are lost and apply for reissuance of a replacement badge. The Contractor shall pay for reissued building access badges. It is the Contractor's responsibility to collect and return badges to the COR or his designee when a contract employee is dismissed, terminated or assigned to duties not within the scope of this contract.

3.1.1.7 Replacement Personnel

(a) Security investigations are very costly to the Government. The Contractor shall make every effort to preclude incurrence of costs by the Government for security investigations for replacement of employees, and in so doing, shall assure that otherwise satisfactory and physically able employees assigned hereunder remain in contract performance for at least one (1) year. The Contractor shall take all necessary steps to assure that Contractor personnel who are selected for assignment to this contract are professionally qualified and personally reliable, of reputable background and sound character, and meet all other requirements stipulated herein.

(b) The fact that the Government performs security investigations shall not in any manner relieve the Contractor of its responsibility to assure that all personnel furnished are reliable and of reputable background and sound character. Should a security investigation conducted by the Government render ineligible a Contractor furnished employee, the Contracting

Officer will investigate the cause and determine whether the Contractor has abdicated its responsibilities to make every effort to select reliable employees of reputable background and sound character. Should there be need to replace a contract employee due to nonperformance, the

Contracting Officer will determine whether the Contractor has abdicated its responsibilities to make every effort to select trained and experienced employees.

(c) Should the Contracting Officer determine that the Contractor has failed to comply with the terms of Section 3.1.1.5(a), the Contractor may be held monetarily responsible, at a minimum, for all reasonable and necessary costs incurred by the Government to (a) provide coverage (performance) through assignment of individuals employed by the Government or third parties in those cases where absence of Contractor personnel would cause either a security threat or DOJ program disruption and (b) conduct security investigations in excess of those which would otherwise be required.

(d) Nothing in this Clause shall require the Contractor to bear costs involved in the conduct of security investigations for replacement of an employee who becomes deceased or severely ill for a long period of time.

(e) Acceptance by the Government of consideration to which the Government may be entitled pursuant to paragraph (c) above shall not be construed to establish a course of conduct which will serve to limit the rights and remedies otherwise available to the Government. Under no circumstances shall the Contractor fail to comply with the terms and conditions set forth herein without assuming liability for such failure as may be established pursuant to this Clause.

The rights and remedies conferred upon the Government by this Clause are in addition to all and other rights and remedies specified elsewhere in this contract or established by law.

3.1.2 Contractor Facility

(a) The Contractor shall implement physical controls as necessary to maintain the integrity and confidentiality of all data/information in its possession. At a minimum, the following requirements shall be in effect for Contractor controlled spaces where information is processed and/or stored:

(1) Access to the facility shall be limited to Contractor personnel or those escorted by Contractor personnel.

(2) Document/media storage areas shall be restricted to persons requiring access to them on a need-to-know basis and have a security access approval or clearance granted by the DOJ.

(3) All designated storage areas/containers must be made available for inspection upon initial award of a contract and semiannually or as otherwise directed by the

SPM, COR or COR designee.

3.1.3 Automation Equipment and Media Materials

(a) At the conclusion of the contract period, all media materials used in conjunction with this contract shall be turned in to the DOJ for destruction. This includes not only paper records, but also all removable, "consumable" media such as floppy disks, magnetic tapes, typewriter ribbons, CD-ROMs, DAT tapes, etc. Any of these media materials that become defective during contract performance shall be immediately turned in to the DOJ for destruction. The Government will not compensate the Contractor for the costs of these media materials.

(b) At the conclusion of the contract period, the Contractor shall sanitize all other media which has been used in connection with contract work, such as PC hard drives and memory, network server hard drives and memory, etc. according to DOJ approved procedures. For example, the Government will require the Contractor to degauss all such media, or to write over the media a specified number of times (e.g., five times using software such as Norton Disk Wipe).

The Contractor will also be required to provide itemized certification that the degaussing has been completed for all equipment used in connection with the contract. If the Contractor is unable to degauss or sanitize the media to the satisfaction of the SPM, the Contractor must turn the media over to the Government for destruction. The Government will not compensate the Contractor for the cost of this effort.

(c) If any PCs, hard drives, memory, servers, etc. used in connection with the contract become defective during the contract performance period, the Contractor must either turn the media over to the Government for destruction, or sanitize the media in accordance with

Government approved procedures and certify the sanitization. This also applies, of course, to equipment/media the Contractor chooses to sell or dispose of for other reasons. The Government will not compensate the Contractor for the cost of this effort.

(d) The Government reserves the right to inspect any equipment/media certified by the

Contractor as having been degaussed or sanitized.

(e) The Contractor must ensure that sensitive/classified information does not remain on the storage media, including hard disks and floppy disks, when the PC is removed from the

Contractor's area for maintenance or other use. Maintenance personnel must be escorted and monitored by Department or Contractor personnel when allowed to perform on-site maintenance for the equipment. The storage media must be removed from the PC prior to removal of the PC from the area for maintenance.

(f) Any removable storage media must be appropriately marked with the classification level. Critical NSI or classified information must be backed up on storage media that are stored in a security container, preferably apart from the immediate work area.

3.1.4 Data Communications

(a) The Contractor is responsible for ensuring the security of all data transmitted internally (e.g., within and between Contractor facilities) and data transmitted between the

Contractor and its subcontractors. For transmission of sensitive, non-classified data, the COR may require the data to be encrypted in compliance with Federal Information Processing Standard

(FIPS) 46-2, Data Encryption Standard (DES) and "Security Level 1" of FIPS 140-1, Security

Requirements for Cryptographic Modules, or their successors.

(b) All encryption devices must be made available for inspection upon initial award of a contract and semiannually or as otherwise directed by the SPM, COR or COR designee.

3.2 Security of Systems and Data Including Personally Identifiable Data

3.2.1 Systems Security

(a) The work to be performed under this contract requires the handling of data that originated within the Department, data that the contractor manages or acquires for the

Department, and/or data that is acquired in order to perform the contract and concerns

Department programs or personnel.

(b) For all systems handling such data, the contractor shall comply with all security requirements applicable to Department of Justice systems, including but not limited to all

Executive Branch system security requirements (e.g., requirements imposed by OMB and NIST), DOJ IT Security Standards, and DOJ Order 2640.2E. The contractor shall provide DOJ access to and information regarding the contractor’s systems when requested by the Department in connection with its efforts to ensure compliance with all such security requirements, and shall otherwise cooperate with the Department in such efforts. DOJ access shall include independent validation testing of controls, system penetration testing by DOJ, FISMA data reviews, and access by the DOJ Office of the Inspector General for its reviews.

(c) The use of contractor-owned laptops or other media storage devices to process or store data covered by this clause is prohibited until the contractor provides a letter to the contracting officer (CO) certifying the following requirements:

(1) Laptops must employ encryption using a NIST Federal Information

Processing Standard (FIPS) 140-2 approved product.

(2) The contractor must develop and implement a process to ensure that security and other applications software is kept up-to-date.

(3) Mobile computing devices will utilize anti-viral software and a host-based firewall mechanism.

(4) The contractor shall log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required. All DOJ information is sensitive information unless designated as non-sensitive by the Department.

(5) Contractor-owned removable media, such as removable hard drives, flash drives, CDs, and floppy disks, containing DOJ data, shall not be removed from

DOJ facilities unless encrypted using a NIST FIPS 140-2 approved product.

(6) When no longer needed, all removable media and laptop hard drives shall be processed (sanitized, degaussed, or destroyed) in accordance with security requirements applicable to DOJ.

(7) Contracting firms shall keep an accurate inventory of devices used on DOJ contracts.

(8) Rules of behavior must be signed by users. These rules shall address at a minimum: authorized and official use; prohibition against unauthorized users;

and protection of sensitive data and personally identifiable information.

(9) All DOJ data will be removed from contractor-owned laptops upon termination of contractor work. This removal must be accomplished in accordance with DOJ IT Security Standard requirements. Certification of data removal will be performed by the contractor’s project manager and a letter confirming certification will be delivered to the CO within 15 days of termination of contractor work.

3.2.2 Data Security

(a) By acceptance of, or performance on, this contract, the contractor agrees that with respect to the data identified in paragraph 3.2.1, in the event of any actual or suspected breach of such data (i.e., loss of control, compromise, unauthorized disclosure, access for an unauthorized purpose, or other unauthorized access, whether physical or electronic), the contractor will immediately (and in no event later than within one hour of discovery) report the breach to the

DOJ CO and the contracting officer’s representative (COR).

(b) If the data breach occurs outside of regular business hours and/or neither the CO nor the COR can be reached, the contractor shall call the DOJ Computer Emergency Readiness Team

(DOJCERT) at 1-866-US4-CERT (1-866-874-2378) within one hour of discovery of the breach.

The contractor shall also notify the CO as soon as possible during regular business hours.

3.2.3 Personally Identifiable Information Notification Requirement

The contractor further certifies that it has a security policy in place that contains procedures to promptly notify any individual whose personally identifiable information (as defined by OMB) was, or is reasonably believed to have been, breached. Any notification shall be coordinated with the Department, and shall not proceed until the Department has made a determination that notification would not impede a law enforcement investigation or jeopardize national security. The method and content of any notification by the contractor shall be coordinated with, and be subject to the approval of, the Department. The contractor assumes full responsibility for taking corrective action consistent with the Department’s Data Breach

Notification Procedures, which may include offering credit monitoring when appropriate.

3.2.4 Pass-through of Security Requirements to Subcontractors

The requirements set forth in paragraphs 3.2.1 through 3.2.3 above, apply to all subcontractors who perform work in connection with this contract. For each subcontractor, the contractor must certify that it has required the subcontractor to adhere to all such requirements. Any breach by a subcontractor of any of the provisions set forth in this clause will be attributed to the contractor.

3.3 Confidentiality of Data

00(a) Duplication or disclosure of the data and other information to which the Contractor will have access as a result of this order is prohibited. The terms “Contractor” and “contract employee” in this clause include all entities and individuals that will perform under this order, including the Contractor, team member, subcontractor, consultant, and/or independent contractor.

It is understood that throughout performance of this order, the Contractor will have access to confidential data which is either the sole property of the Department of Justice or is the sole property of other than the contracting parties. The Contractor agrees to maintain the confidentiality of all data to which access may be gained throughout performance of this order, whether title thereto vests in the Department of Justice or otherwise. The Contractor agrees not to disclose or divulge any such information except to persons who:

Have a DOJ security approval, Have signed the DOJ Non-Disclosure Agreement, and

Have a need to know.

(b) The Contractor agrees to not disclose said data, any interpretations and/or translations thereof, or data derivative there from, to unauthorized parties in contravention of these provisions, without the prior written approval of the Contracting Officer or the party in which title thereto is wholly vested. The Contractor may be held responsible for any violations of confidentiality.

(c) The Contractor agrees that upon termination of the order, it has no property or possessory right to any of the correspondence, files or materials, of whatever kind and description, or any copies or duplicates of such, whether developed/prepared by him or furnished by the technical office in connection with the performance of this order; and that, upon demand, the Contractor will surrender immediately to the COR such items, matters, materials, and copies.

(d) All contract employees who will have access to materials will be asked to sign a

Confidentiality Agreement. It is the responsibility of the Contractor to assure that such

Agreements have been signed before access to material is permitted.

4. INSPECTION AND ACCEPTANCE

(a) The Government shall have thirty (30) calendar days from receipt of each invoice to inspect and accept items delivered/work performed under the task order.

Rejected work and/or comments on all deliverables will be provided to the Contractor by the COR. The Contractor shall be responsible for replacement or corrections to the work or deliverable as necessary to meet the standards of acceptance identified in the contract and the task order. The cost to replace or correct nonconforming work or deliverables shall be borne as specified in FAR Clause 52.246-6.

(b) The Government will only be responsible for the cost of those corrections ordered above the performance standard specified in the task order.

5. PERFORMANCE PERIOD AND PLACE OF PERFORMANCE

5.1. Period of Performance

(a) The Contractor shall provide all services and supplies necessary to support the

EOIR operations on a Firm-Fix-Price basis as defined in this task order.

(b) This task order is for

Task Order Period of Performance

Base Period 04/01/16 Thru 03/31/17

Option Year 1 04/01/17 thru 03/31/18

Option Year 1 04/01/18 thru 03/31/19

Option Year 3 04/01/19 thru 03/31/20

Option Year 4 04/01/20 thru 03/31/21

(c) For continued performance beyond the stated period, the Contracting Officer will issue a written modification by the first day of successive option period or within thirty (30) calendar days after funds for that option period become available.

(d) In the event the Contractor encounters difficulty in either meeting performance requirements, anticipates difficulty in complying with task order delivery schedule or date, or has knowledge that any actual or potential situation is delaying or threatens to delay the timely performance of this task order, the Contractor shall immediately notify the Contracting Officer and the COR, in writing, giving pertinent details. This provision will not be construed as a waiver by the Government of any delivery schedule or date or of any rights or remedies provided by law or under this task order.

5.2. Place of Performance

The primary place of performance will be at the contractor facility.

6. PRICE AND PAYMENT

6.1. Price

(a) This is a firm-fixed-price type task order. All prices are fixes unit prices that include all costs and profit necessary to provide the services specified in the task order.

The awarded task order will incorporate the Contractor’s pricing table as proposed and accepted by the Department.

(b) The Contractor shall provide a price breakdown which identifies the level of effort and mix of labor proposed to perform all the services and provide all deliverables described herein based on the Contractor’s GSA schedule contract rates (less any discount being offered).

6.2. Invoices

(a) The Contractor shall render invoices not more frequently than monthly, in an original only (i.e., one copy only) to the COR at the address listed in Section 7.2. To constitute a proper invoice, the following information and/or attached documentation shall be included with the invoice (as applicable):

1. Name and address of the Contractor

2. Invoice date

3. Contract number

4. Task order number

5. CLIN number and description, quantity, unit price and extended total for the period covered (see also paragraph (b) below)

6. Shipping and payment terms

7. Name and address of Contractor official to whom payment is to be sent (must be the same as that in the contract or in a proper notice of assignment)

8. Taxpayer Identification Number

9. DUNS Number

(b) In addition to the invoice requirements listed in paragraph (a) above, each invoice shall include (as applicable):

(c) All follow-up invoices shall be marked "Duplicate of Original." Contractor questions regarding payment information or check identification should be directed to the

DOJ Vendor Assistance Hotline (202) 616-6260.

7. TASK ORDER ADMINISTRATION

7.1. Contracting Officer

(a) Upon award, a Contracting Officer's Representative (COR) will be designated to manage the technical aspects of this task order. All modifications to this task order must be approved by the COR prior to issuance by the Administrative Contracting

Officer. The COR for this task order is:

(b) The Contracting Officer has the overall responsibility for the administration of this task order. He/she alone, without delegation, is authorized to take actions on behalf of the Department to amend, modify, or deviate from the task order terms, conditions, requirements, specifications, details, and/or delivery schedules. However, the

Contracting Officer may delegate certain other responsibilities to his/her authorized representatives. This task order will be administered by:

7.2. Contracting Officer's Representative (COR)

(a) Upon award, a Contracting Officer's Representative (COR) will be designated to manage the technical aspects of this task order. All modifications to this task order must be approved by the COR prior to issuance by the Administrative Contracting

Officer. The COR for this task order is:

Kelvin Doan

U. S. Department of Justice Telephone: (703)756-8460

Executive Office for Immigration Review Fax: (703) 305-0911

Office of Information Technology Email: kelvin.doan@usdoj.gov

5107 Leesburg Pike, Suite # 2300

(b) The COR has the responsibility to inspect all services/deliverables and authorization to certify (but not to reject or deny) invoices for payment. The authority to reject or deny performance and associated invoice payment is expressly reserved for the

CO. The CO is the only individual who can legally commit or obligate the Government for the expenditure of public funds. The technical administration of this task order shall not be construed to authorize the revision of the terms and conditions of this task order.

Any such revision shall be authorized in writing by the Administrative Contracting

Officer.

7.3. DOJ Security Programs Manager (SPM)

(a) Upon task order award, a Security Programs Manager (SPM) will be designated to coordinate those aspects of this task order which pertain to obtaining and maintaining favorably adjudicated background investigations at the appropriate levels for

Contractor personnel performing hereunder.

(b) During the pre-award phase of this task order, the SPM is responsible for performing the following duties:

1) Provide the Contracting Officer with the appropriate Contractor personnel security screening requirements (including waiver requirements, if appropriate) and background investigation (BI) requirements for obtaining services of non-federal employees under the resultant task order.

2) Determine the risk level for each Contractor position. The risk level must be based on an overall assessment of the damage that an untrustworthy Contractor could cause to the efficiency or the integrity of Departmental operations. The SPM shall provide this information to the Contracting Officer for inclusion in the resultant task order.

3) Certify that the personnel security requirements of the task order are adequate to ensure the security of Departmental operations, information and personnel. The SPM shall provide this written certification to the Contracting Officer prior to release of the Request for Quotation.

(c) The SPM for this task order is:

James P. McDaniels Telephone: (703) 305-1095

U.S. Department of Justice Fax: (703) 605-0762

Executive Office for Immigration Review Email: james.p.mcdaniels@usdoj.gov

Office of Security

5107 Leesburg Pike, Suite 1901

(d) The personnel security requirements of this task order are set forth in Section

3.1. Following award of this task order, the SPM shall ensure that the personnel security requirements set forth herein are followed. In addition, the SPM shall comply with the supplemental guidelines provided to him or her by the Assistant Director, Contract

Administration Service, Procurement Services Staff.

7.4. Contractor Representative for Task Order Administration

(a) The Contractor's representative to be contacted for all task order administration matters:

Higdon Business Solutions Telephone: (410) 243-6585

P.O. Box 44455 Fax: (443) 743-2498

Baltimore, MD 21236 E-mail:

rmorgan@higdoninc.com

(b) The Contractor's representative shall be responsible for all task order administration issues and shall act as the central point of contact with the Government for all such issues. The representative shall have full authority to act for the Contractor in all contractual matters.

7.5. Release of Claims

At the conclusion of this task order, and prior to final payment, the Contractor shall furnish to the Contracting Officer, a release of claims against the United States arising out of the task order, other than claims specifically excepted from the operation of the release. Copies of the required form may be obtained from the COR.