Draft SOO - Moving Company BPA.pdf

PRE-AWARD – Not for Public Distribution or Release 1

Statement of Objectives

Moving Company Blanket Purchase Agreement

Introductions

The contractor shall provide all necessary labor, tools, and expertise to facilitate the efficient and professional relocation of office furniture within a professional office space. Services shall include the capability to disassemble and reassemble office system furniture, stick furniture, bookshelves, and conference room tables in multiple buildings located at 800 N. Loop 288, Denton, Texas

76209 and 600 N. Loop 288, Denton, Texas 76209. Additionally, the project aims to enforce stringent safety procedures, establish clear protocols for restricted areas, and promote environmental sustainability through responsible waste management practices.

General Requirements

Region 6 requires a general contractor for professional relocation of office furniture within a professional office space. The Contractor shall provide a Performance Work Statement (PWS) to describe how they will approach the activities listed below. The Contractor shall provide a Quality

Assurance Plan (QASP) to describe how they will complete the activities listed below. The contractor shall provide proper on-site Supervision throughout the lifecycle of the project.

The contractor shall ensure all material follows FEMA’s implementation of the Build America, Buy

America Act (BABAA) requirements and outline FEMA’s process for waiving “Buy America” preferences, when necessary.

The project has five main functional objectives:

A. Objective 1: Planning and Preparation

1. Conduct a pre-move assessment to identify furniture, equipment, and other items to be relocated.

2. Develop a detailed move plan, including timelines and resource allocation, to minimize disruption to office operations.

3. Coordinate with office management to address specific requirements, such as handling sensitive or valuable items.

4. The Contractor shall provide a written Quality Assurance Plan (QASP) to FEMA

5. The Contractor shall provide a written Performance Work Statement (PWS) to FEMA

B. Objective 2: Demolition/Disassembly

1. Safely disassemble office system furniture, including cubicles, desks, and shelving units, ensuring all components are accounted for.

2. Label and organize all disassembled components for efficient reassembly.

3. Protect furniture and surfaces from damage during the disassembly process.

4. The Contractor shall remove extra material, waste, and dispose of extra material off government property.

C. Objective 3: Installation

DRAFT

Moving Company Blanket Purchase Agreement

PRE-AWARD – Not for Public Distribution or Release 2

1. Reassemble office system furniture, stick furniture, bookshelves, and conference room tables at their designated locations.

2. Ensure proper alignment, functionality, and stability of all reassembled items.

3. Install any additional components or fixtures as needed to meet office layout specifications.

D. Objective 4: Cleanup

1. Remove and dispose of all debris and packing materials generated during the move.

2. Clean and restore the workspace to a neat and orderly condition following the relocation process.

3. Ensure all furniture and equipment are free of dust, fingerprints, or other marks.

4. The Contractor shall thoroughly clean the area daily, and properly dispose of all debris and surplus materials on FEMA grounds.

5. The Contractor shall perform the final clean up and return the area to original, or close to original condition.

6. The Contractor shall recycle metal waste from project and provide report to the COR.

E. Objective 5: Final Review and Inspection

1. Conduct a walkthrough with office management to verify that all furniture and equipment have been correctly relocated and installed.

2. Address any deficiencies or concerns identified during the walkthrough.

3. Provide a post-move report summarizing completed tasks and confirming adherence to the agreed-upon plan.

4. The Contractor and FEMA will do a joint inspection of the work area and the operation of the new equipment.

Deliverable Schedule

The government expects that a following deliverable schedule (or better) will be followed in delivering this Statement of Objectives. The cumulative days mentioned below are business days, not calendar days.

TASK DELIVERABLES Completion

Timeframe

Planning and

Preparation

The plan shall include detailed plan on how the project will be completed from inspection, providing written required documents, and handling sensitive items provide information on noise impacts, schematics, impacts to employees. Plans that detail how Contractor will manage health and safety of crew on site.

5 days

Roster Submission Upon award the contractor shall provide a list of employees on a NCIC form that will need access to the facility during the Period of Performance of the contract. Ensure a supervisor is onsite throughout the duration of the project.

At least one supervisor and two installers shall submit paperwork to obtain a

PIV badge.

5 days

PRE-AWARD – Not for Public Distribution or Release 3

Demolition/Removal

Remove and dispose of all debris and packing materials generated during the move. Clean and restore the workspace to a neat and orderly condition following the relocation process.

1 day

Installation Installation, connection, reassemble office system furniture, stick furniture, bookshelves, and conference room tables at their designated locations based on identified task order requirements.

10 days

Cleanup Remove and dispose of all debris and packing materials generated during the move. Clean and restore the workspace to a neat and orderly condition following the relocation process.

2 days

Review and Inspection Contractor provides associated reports: Recycled product; construction debris disposition report; accident reporting (if applicable)

3 Days

Place of Performance

The place of performance is FEMA Region 6 Denton Campus located at 600 and 800 N. Loop 288, Denton Texas 76209. The hours of operation for the FEMA Denton Campus are from 6:00 am to

6:00 pm Monday through Friday central standard time (CST) excluding Federal Holidays. Work performed under this contract shall be completed by 4:00 pm daily M-Th, Fridays all work shall be completed by 3:00 pm (includes daily cleanup), unless otherwise approved in advance by the CO and/or COR.

Cleanup

The Contractor shall thoroughly clean the area and no debris from the service is visible on FEMA grounds. There should be a daily clean-up of materials to prevent any hazards. When work is completed in each area, the contractor should complete a thorough cleanup of the area worked. The

Contractor shall perform the final cleanup of all areas and will conduct a joint walk through with the

Project Officer/COR.

Period Of Performance

The Period of Performance (POP) for the contract task of the furniture work shall be agreed upon by the contractor and FEMA. The contractor shall provide service no later than (5) five days of receiving the notice to proceed from the designated Contractor Officer. The contractor must communicate in writing if there is any reason the services are not performed based on the identified during scheduled period of performance.

Security

3052.204-71 Contractor employee access.

As prescribed in (HSAR) 48 CFR 3004.470-4(a), insert the following clause with appropriate alternates:

CONTRACTOR EMPLOYEE ACCESS (JULY 2023)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than

PRE-AWARD – Not for Public Distribution or Release 4 classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following

CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical

Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the

Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism

Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the

PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including

Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of

Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland

Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the

Department;

(6) International Agreement Information means information the Department of Homeland

Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526

PRE-AWARD – Not for Public Distribution or Release 5 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to

Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive

Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration

Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

PRE-AWARD – Not for Public Distribution or Release 6

(H) System authentication information, such as mother’s birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer.

Upon the Contracting Officer’s request, the Contractor’s employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use

CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government’s activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(g) Each individual employed under the contract shall be a citizen of the United States of

America, or an alien who has been lawfully admitted for permanent residence as evidenced by a

Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department's

Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S.

citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

3052.204-72 Safeguarding of Controlled Unclassified Information.

As prescribed in (HSAR) 48 CFR 3004.470-4(b), insert the following clause:

SAFEGUARDING OF CONTROLLED UNCLASSIFIED INFORMATION (JULY 2023)

PRE-AWARD – Not for Public Distribution or Release 7

(a) Definitions. As used in this clause—

Adequate Security means security protections commensurate with the risk resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information. This includes ensuring that information hosted on behalf of an agency and information systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability protections through the application of cost-effective security controls.

Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following

CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical

Facility Anti-Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the

Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism

Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure

Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII’s implementing regulations (6 CFR part 29), the

PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of

Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including

Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of

Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland

Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the

Department;

(6) International Agreement Information means information the Department of Homeland

Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any

PRE-AWARD – Not for Public Distribution or Release 8 element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to

Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive

Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration

Numbers (A-numbers), financial account numbers, and biometric identifiers.

PRE-AWARD – Not for Public Distribution or Release 9

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother’s birth name, account

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

Federal information means information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.

Federal information system means an information system used or operated by an agency or by a Contractor of an agency or by another organization on behalf of an agency.

Handling means any use of controlled unclassified information, including but not limited to marking, safeguarding, transporting, disseminating, re-using, storing, capturing, and disposing of the information.

Incident means an occurrence that—

(1) Actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(2) Constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

Information Security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

(1) Integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

(2) Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

PRE-AWARD – Not for Public Distribution or Release 10

(3) Availability, which means ensuring timely and reliable access to and use of information.

Information System means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

(b) Handling of Controlled Unclassified Information.

(1) Contractors and subcontractors must provide adequate security to protect CUI from unauthorized access and disclosure. Adequate security includes compliance with DHS policies and procedures in effect at the time of contract award. These policies and procedures are accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors.

(2) The Contractor shall not use or redistribute any CUI handled, collected, processed, stored, or transmitted by the Contractor except as specified in the contract.

(3) The Contractor shall not maintain SPII in its invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions. It is acceptable to maintain in these systems the names, titles, and contact information for the Contracting Officer’s Representative (COR) or other government personnel associated with the administration of the contract, as needed.

(4) Any government data provided, developed, or obtained under the contract, or otherwise under the control of the Contractor, shall not become part of the bankruptcy estate in the event a Contractor and/or subcontractor enters bankruptcy proceedings.

(c) Incident Reporting Requirements.

(1) Contractors and subcontractors shall report all known or suspected incidents to the Component Security Operations Center (SOC) in accordance with Attachment F, Incident Response, to DHS Policy Directive 4300A Information Technology System

Security Program, Sensitive Systems. If the Component SOC is not available, the

Contractor shall report to the DHS Enterprise SOC. Contact information for the DHS

Enterprise SOC is accessible at https://www.dhs.gov/dhs-security-and-training-requirements-contractors. Subcontractors are required to notify the prime Contractor that it has reported a known or suspected incident to the Department. Lower tier subcontractors are required to likewise notify their higher tier subcontractor, until the prime contractor is reached. The Contractor shall also notify the Contracting Officer and COR using the contact information identified in the contract. If the report is made by phone, or the email address for the Contracting Officer or COR is not immediately available, the Contractor shall contact the Contracting Officer and COR immediately after reporting to the Component or DHS Enterprise SOC.

(2) All known or suspected incidents involving PII or SPII shall be reported within 1 hour of discovery. All other incidents shall be reported within 8 hours of discovery.

(3) CUI transmitted via email shall be protected by encryption or transmitted within secure communications systems. CUI shall be transmitted using a FIPS 140-2/140-3

Security Requirements for Cryptographic Modules validated cryptographic module

DRAFT

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors

PRE-AWARD – Not for Public Distribution or Release 11 identified on https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules. When this is impractical or unavailable, for Federal information systems only, CUI may be transmitted over regular email channels. When using regular email channels, Contractors and subcontractors shall not include any

CUI in the subject or body of any email. The CUI shall be included as a password-protected attachment with the password provided under separate cover, including as a separate email. Recipients of CUI information will comply with any email restrictions imposed by the originator.

(4) An incident shall not, by itself, be interpreted as evidence that the Contractor or

Subcontractor has failed to provide adequate information security safeguards for CUI or has otherwise failed to meet the requirements of the contract.

(5) If an incident involves PII or SPII, in addition to the incident reporting guidelines in

Attachment F, Incident Response, to DHS Policy Directive 4300A Information

Technology System Security Program, Sensitive Systems, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Unique Entity Identifier (UEI);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime

Contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for

Award Management (address, position, telephone, and email);

(v) Contracting Officer POC (address, telephone, and email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms, or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where CUI resided at the time of the incident, both at the

Contractor and subcontractor level;

(xii) Description of the government PII or SPII contained within the system;

and

(xiii) Any additional information relevant to the incident.

(d) Incident Response Requirements.

(1) All determinations by the Department related to incidents, including response activities, will be made in writing by the Contracting Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of incidents.

https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules

PRE-AWARD – Not for Public Distribution or Release 12

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections;

(ii) Investigations;

(iii) Forensic reviews;

(iv) Data analyses and processing; and

(v) Revocation of the Authority to Operate (ATO), if applicable.

(4) The Contractor shall immediately preserve and protect images of known affected information systems and all available monitoring/packet capture data. The monitoring/packet capture data shall be retained for at least 180 days from submission of the incident report to allow DHS to request the media or decline interest.

(5) The Government, at its sole discretion, may obtain assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

(e) Certificate of Sanitization of Government and Government-Activity-Related Files and

Information. Upon the conclusion of the contract by expiration, termination, cancellation, or as otherwise indicated in the contract, the Contractor shall return all CUI to DHS and/or destroy it physically and/or logically as identified in the contract unless the contract states that return and/or destruction of CUI is not required. Destruction shall conform to the guidelines for media sanitization contained in NIST SP 800–88, Guidelines for Media Sanitization. The Contractor shall certify and confirm the sanitization of all government and government-activity related files and information. The

Contractor shall submit the certification to the COR and Contracting Officer following the template provided in NIST SP 800–88, Guidelines for Media Sanitization, Appendix G.

(f) Other Reporting Requirements. Incident reporting required by this clause in no way rescinds the Contractor’s responsibility for other incident reporting pertaining to its unclassified information systems under other clauses that may apply to its contract(s), or as a result of other applicable statutory or regulatory requirements, or other U.S. Government requirements.

(g) Subcontracts. The Contractor shall insert this clause in all subcontracts and require subcontractors to include this clause in all lower tier subcontracts when subcontractor employees will have access to CUI; CUI will be collected or maintained on behalf of the agency by a subcontractor; or a subcontractor information system(s) will be used to process, store, or transmit

CUI.

3052.204-73 Notification and Credit Monitoring Requirements for Personally Identifiable

Information Incidents.

As prescribed in (HSAR) 48 CFR 3004.470-4(c), insert the following clause:

3052.204-73 NOTIFICATION AND CREDIT MONITORING REQUIREMENTS FOR PERSONALLY

IDENTIFIABLE INFORMATION INCIDENTS (JULY 2023)

(a) Definitions. Privacy Information includes both Personally Identifiable Information (PII) and

Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual’s identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, PRE-AWARD – Not for Public Distribution or Release 13 or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, the DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(1) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver’s license or State identification numbers, Alien Registration Numbers

(A-numbers), financial account numbers, and biometric identifiers.

(2) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual’s name or other unique identifier plus one or more of the following elements:

(i) Truncated SSN (such as last 4 digits);

(ii) Date of birth (month, day, and year);

(iii) Citizenship or immigration status;

(iv) Ethnic or religious affiliation;

(v) Sexual orientation;

(vi) Criminal history;

(vii) Medical information; and

(viii) System authentication information, such as mother’s birth name, account

(3) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) PII and SPII Notification Requirements.

(1) No later than 5 business days after being directed by the Contracting Officer, or as otherwise required by applicable law, the Contractor shall notify any individual whose PII or

SPII was either under the control of the Contractor or resided in an information system under control of the Contractor at the time the incident occurred. The method and content of any notification by the Contractor shall be coordinated with, and subject to prior written approval by, the Contracting Officer. The Contractor shall not proceed with notification unless directed in writing by the Contracting Officer.

(2) All determinations by the Department related to notifications to affected individuals and/or Federal agencies and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer.

(3) Subject to government analysis of the incident and direction to the Contractor regarding any resulting notification, the notification method may consist of letters to affected individuals sent by first-class mail, electronic means, or general public notice, as approved by

PRE-AWARD – Not for Public Distribution or Release 14 the Government. Notification may require the Contractor’s use of address verification and/or address location services. At a minimum, the notification shall include:

(i) A brief description of the incident;

(ii) A description of the types of PII or SPII involved;

(iii) A statement as to whether the PII or SPII was encrypted or protected by other means;

(iv) Steps individuals may take to protect themselves;

(v) What the Contractor and/or the Government are doing to investigate the incident, mitigate the incident, and protect against any future incidents; and

(vi) Information identifying who individuals may contact for additional information.

(c) Credit Monitoring Requirements. The Contracting Officer may direct the Contractor to:

(1) Provide notification to affected individuals as described in paragraph (b).

(2) Provide credit monitoring services to individuals whose PII or SPII was under the control of the Contractor or resided in the information system at the time of the incident for a period beginning the date of the incident and extending not less than 18 months from the date the individual is notified. Credit monitoring services shall be provided from a company with which the Contractor has no affiliation. At a minimum, credit monitoring services shall include:

(i) Triple credit bureau monitoring;

(ii) Daily customer service;

(iii) Alerts provided to the individual for changes and fraud; and

(iv) Assistance to the individual with enrollment in the services and the use of fraud alerts.

(3) Establish a dedicated call center. Call center services shall include:

(i) A dedicated telephone number to contact customer service within a fixed period;

(ii) Information necessary for registrants/enrollees to access credit reports and credit scores;

(iii) Weekly reports on call center volume, issue escalation (i.e., those calls that cannot be handled by call center staff and must be resolved by call center management or DHS, as appropriate), and other key metrics;

(iv) Escalation of calls that cannot be handled by call center staff to call center management or DHS, as appropriate;

(v) Customized Frequently Asked Questions, approved in writing by the Contracting

Officer in coordination with the Component or Headquarters Privacy Officer; and

(vi) Information for registrants to contact customer service representatives and fraud resolution representatives for credit monitoring assistance.

Safety Requirements FEMA requires the submittal and “acceptance” by FEMA’s safety representative of a written Site

Safety Plan for projects that involve activities covered under the OSHA Construction standard (29

CFR 1926) and OSHA General Industry standard (29 CFR 1910). The selected vendor(s) shall be responsible for identifying all reasonably anticipated job and activity hazards associated with the

PRE-AWARD – Not for Public Distribution or Release 15 project and address the identified hazards with precautions, training, and PPE that would be considered at a minimum “industry standard”. The Site Safety Plan should address at a minimum:

A. Site Specific Safety Rules

1. Smoking in designated areas on worksite

2. Daily “toolbox” safety meetings (required)

3. Pre-project safety meeting (required)

B. Job Hazard and Activity Hazard Analysis for the project. Examples of hazards that should be addressed include, but are not limited to:

1. Chemical Hazards

2. Physical Hazards

3. Biological Hazards (ex. Mold) (if applicable)

4. Radiological Hazards (if applicable)

C. Hazard Communication requirements including Safety Data Sheets (SDS) for materials brought onsite. All chemicals shall be accepted at least two (2) days in advance by FEMA’s safety representative.

D. Training

1. Proof of current training for all equipment that requires operator certification under regulation or has recommended/required training from the manufacturer.

2. Proof that personnel are trained in accordance with regulation for activities identified

(ex. OSHA 30 Hour course)

3. Respiratory Protection (if applicable)

4. Hearing Conservation (if applicable)

E. Accident Reporting - The Contractor shall include a description of their accident reporting and prevention program to include:

1. Reporting of injuries, near-misses, reports of unsafe/unhealthful acts.

2. Policy of assistance with any accident investigations, either internal, FEMA requested, or 3rd party requested.

F. PPE – Describe the use of PPE as it relates to the Job Hazard and Activity Hazard Analysis

G. Emergency Contact Information

H. Subcontractor Site Safety Plan (if applicable)

Note: The FEMA Safety & Occupational Health Specialist Safety Officer will write a strong justification to the COR for corrective action and/or suggest stopping work until issues have been resolved when life safety and health is at risk.

Warranty

The work will be guaranteed during the contract award date and result of work is accepted by the

U.S. Government. The Contractor shall give a one-year warranty on parts and labor after final acceptance by the government.

PRE-AWARD – Not for Public Distribution or Release 16

Project Officer

The project officers for this work:

Primary: Ray Hixon: 940-898-5345; Raymond.hixonjr@fema.dhs.gov