Draft SOW PCIS-24-00032 RV1.docx

Cybersecurity and Infrastructure Security Agency (CISA) Infrastructure Security Division (ISD)

Infrastructure Assessments and Analysis

PCIS-24-00032

Statement of Work (SOW)

I. Introduction

Description of Products or Services

Resilience assessment methodology enhancements, data and information analysis, internal reviews, and enhancements of ISD programs and capabilities, development of capabilities and analysis for CISA Regional and Headquarters personnel, and other mission partners, disaster response and recovery support, and workforce training and development support. This support will help the DHS CISA ISD advance its program to better fulfill its mission and strategic objectives.

II. Background

CISA’s mission is to lead the national effort to protect and enhance the resilience of the nation’s physical and cyber infrastructure. CISA includes the CISA Mission Enabling Offices (MEOs) and six Divisions: the Cybersecurity Division (CSD), the Emergency Communications Division (ECD), the Integrated Operations Division (IOD), Infrastructure Security Division (ISD), the Stakeholder Engagement Division (SED), as well as, the National Risk Management Center (NRMC), which are headquartered in the National Capital Region (NCR).

The ISD coordinates the national effort to oversee the National Infrastructure Protection Plan (National Plan) and manage risks to the Nation’s critical infrastructure through coordination with private and public infrastructure partners. The clear majority of the Nation’s critical infrastructure is owned and operated by the private sector. ISD programs are based on building partnerships, planning for preparedness, and sharing information and tools to ensure the availability, security, and resilience of the Nation’s critical infrastructure.

The Infrastructure Assessments and Analysis subdivision’s (IAA) mission is to reduce the Nation’s vulnerability to terrorism and all hazards by developing, coordinating, integrating, and implementing plans/programs that identify, catalog, methodically assess, prioritize, and protect critical infrastructure in cooperation with all levels of government and private sector partners.

This SOW defines the support required for the CISA‘s Regional Resiliency Assessment Program (RRAP). RRAP projects are proposed and selected each year through a formal process. IAA distributed a request to the potential project idea originators in February 2024 to solicit project ideas for FY24 RRAP projects. Project ideas are driven by State Local Tribal and Territorial (SLTT) partner needs, which forms a foundation for success for each project, and must include a sound focus and the commitment and support from State and Local partners in the public and private sector.

Resiliency Assessments are intensive analytic studies addressing large, complex infrastructure-knowledge gaps in partnership with multiple stakeholder communities.

III. Scope

The scope of this SOW establishes the requirements for providing analytical and operational services to ISD in data acquisition, analysis, synthesis, workforce development, and product development. Rapid adaptation, staff reconfiguration, and a flexible approach to task management must be anticipated and planned for in order to accommodate real-world events that occur without warning.

The scope of this requirement does not include any information technology (IT) work. Any IT work requirements will be put on other contracts for execution.

Work under this SOW may include additional technical support for the Regional Resiliency Assessment Program to support changing priorities due to new and updated initiatives that support the evolving CISA and ISD mission space, respectively.

1.0 SPECIFIC REQUIREMENTS/TASKS

1.1 Monthly Status Report (MSR)

The Contractor shall submit an MSR containing financial and technical program status to the Contracting Officer Representative (COR), alternate COR, and Task Manager. The report shall be delivered in an electronic format by the 15th day of the month for each preceding month. The report shall consist of the following sections and details:

· Program Summary: The program section shall contain the SOW title, contract number, requisition number, period of performance, SOW, COR names, and Program Manager names. The contractor shall include the name of the primary point of contact for each project who supported and invoiced the contract during the month being reported.

· Accomplishments Summary: The accomplishments section shall be broken down into programmatic areas that cover each task listed in the SOW and other areas as directed by the COR.

· Financial Summary: The financial section shall include a summary of the monthly and total expenditures for funded work. Included in the summary will be a cost breakdown for each SOW task with actual costs.

· Projected Activities: The projected activities section shall contain a list of all upcoming activities associated with SOW tasks, activities that have been requested by ISD personnel and activities directed by the COR.

1.2 Specialized Capabilities

· The contractor will apply specialized capabilities, expertise, and computing resources, as appropriate to conduct Regional Resiliency Assessments. This includes:

· Application of the All-Hazards Analysis (AHA) capability to support open-source data collection, organization, and development of dependency mapping of critical infrastructure in the region of interest. AHA was developed by the contractor to automate the collection of open-source infrastructure data and information, construct an initial picture of the dependency relationships present among infrastructure systems, and allow for additional data to be added that results from structured interviews with infrastructure owner/operators and other key stakeholders. While AHA is available to other users, the contractor maintains the most complete and up-to-date infrastructure database on their core server.

· The contractor has a team of infrastructure analysts with expertise in specific infrastructure sectors (e.g., energy, communications, etc.) both by virtue of advanced education and or industry experience and can draw from that pool of expertise as needed to support Regional Resiliency Assessments. Further, given the nature of the work, the contractor’s staff is adept at conducting detailed analyses, developing findings and recommendations, and developing specialized tools or other resources to aid stakeholders in implementing actions responsive to options for consideration. The contractor has access to specialized supercomputing resources that enable application of specialized analysis to support Regional Resiliency Assessments. This includes downscaling of climate models, specialized tools to analyze energy sector infrastructure, and analysis of natural hazard impacts to critical infrastructure.

2.0 Specific Task in Support of ISD

2.1 Project Management

The Contractor will provide effective management across all tasks, including status meetings with ISD and monthly reports, as directed by the COR and Task Manager. This task also includes managing budgets; coordinating with various ISD/IAA personnel to ensure overall satisfaction with deliverables; and coordinating internally on related work-streams, including RRAP implementation.

As part of this task, the Contractor shall prepare a project management plan (PMP) describing the technical approach, organizational resources, milestones, and management controls to be employed to meet the cost, performance, and schedule requirements throughout project management execution.

2.2 RRAP Program and Portfolio Support

The Contractor shall integrate internal and external data to produce unclassified Regional Resiliency Assessments for approval of the COR and/or designated Task Manager. The Contractor will create and deliver a report, as well as supporting material(s) (such as supplemental guides, appendixes, etc.) when required, for each project by supporting data collection, aggregation, and analysis and providing off-site subject matter expertise.

The conclusion of each individual RRAP Project effort is defined by the Government’s acceptance of a final RRAP Report that documents key findings from the effort, outlines resilience enhancement options, and summarizes improvements that could be achieved by implementing resilience enhancement options. The conclusion of each individual Regional Characterization effort is defined by the Government’s acceptance of a final report that documents key deliverables from the effort which may include development and standardization of RRAP methodologies; documenting unique approaches and analytic techniques; amalgamating findings from past RRAP projects; or operationalizing data sets. All reports will comply with applicable classification guidelines and document handling and control procedures of DHS. Draft reports will be submitted as required by the Government.

The Contractor shall perform the following major activities in support of each individual RRAP Resiliency Assessments as appropriate:

Specific RRAP Project Data Collection, Aggregation, and Analysis: The Contractor shall conduct preliminary research and develop background packages that form the basis of the individual RRAP project data collection activities. This information shall inform the process for selecting sites and partners for further data-gathering activities. The Contractor shall also support facilitated, scenario-specific, information sharing discussions with relevant private sector, local, State, and Federal stakeholders to collect data inputs for each individual RRAP. In addition, the Infrastructure Survey Tool (IST) shall remain an important input to each RRAP. ISTs are conducted by the Protective Security Advisor (PSA), but additional Contractor-supported site visits may be needed for specific RRAP projects. The Contractor shall also leverage relevant models, proprietary data, and research tools, where appropriate, to support RRAP projects. The Contractor shall support the aggregation, analysis, and use of all data collected during each individual RRAP and ensure such data is addressed in the individual draft and final RRAP reports.

Off-Site RRAP Support: In support of each individual RRAP, the Contractor shall provide interdependency/systems experts and other subject matter experts. The assessment support shall include dependency and inter-dependency information for sectors that are relevant to the scope of each individual RRAP project, such as energy (specifically the electricity sub-sector), water and wastewater, transportation, and telecommunications. Additional analysis of other complex systems (e.g., climate change) may be required based on the scope of the individual RRAP project. The off-site support shall assist in ensuring the availability of previously acquired information maintained within the CISA Gateway.

Support to RRAP Project Specific Assessment Methodology, Analysis, and Product Development: The Contractor shall develop the Draft Resiliency Assessment and all supporting documentation. This also includes the technical editing and word processing, and the development of all supporting graphics, maps, images, as well as any tools or reference guides deemed necessary. The Contractor shall support the ISD review process, including conducting any additional data collection and analysis necessary to respond to questions/comments/suggested changes, maintain a change matrix, and revise the RRAP Draft Resiliency Assessment, including coordinating technical editor support for necessary additional editing, word processing, graphics, maps and other requested changes or input.

Support to Implementation of Resilience Enhancement Options: In support of each individual RRAP, the Contractor shall support efforts to implement resilience enhancement options identified during the RRAP process. Activities may include tailored implementation workshops, training, exercises, technical reports, data integration, modeling and analysis, and tracking progress.

Projects supported by this SOW are:

2.3 Resiliency Assessments

· The Contractor will support at least five (5) resiliency assessments during this period of performance as described above. Specific project titles and areas will be established in the PMP.

2.4 Other Requirements

2.4.1 Post-Award Conference

The Contractor shall attend a Post-Award Conference (either in person or via videoconference or teleconference) with the Contracting Officer and the COR no later than 10 business days after the date of award. The purpose of the Post-Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract as well as the Project Management Plans to be drafted by the Contractor.

3.0 Key Milestones and Deliverables

Table 1

2.4

1.1

V. Project Timeline All PMPs will include the detailed deliverables and timelines for each task.

VI. Other IA Details

1. Period of Performance. The period of performance (POP) is 36 months from date of award.

2. Travel and Other Direct Costs (ODC). Travel may be required in the performance of the duties listed herein. Travel may include, but not be limited to, the following destination/s: the NCR, and other sites determined by the COR or task manager.

All travel required by the government outside the local commuting area(s) will be reimbursed in accordance with the Federal Travel Regulation, CISA, and DHS Policy, and on a non-fee bearing basis. The Contractor shall be responsible for obtaining COR approval (electronic mail is acceptable) for all reimbursable travel in advance of each travel event. All travel requests shall be submitted in writing in advance with a cost estimate to the COR.

Foreign travel shall require the facility management contractor to obtain the DHS Technical Representative’s approval and an approved DHS Foreign Travel Report 30 days in advance of the travel. .

3. DHS-Furnished Information (GFI) and Equipment (GFE).

DHS furnished information and property, if any, shall be provided in a numbered attachment to this SOW and listed in Section VIII, Applicable Documents. will not provide any GFE to the Contractor to fulfill the requirements.

4. Property Acquired by the Contractor (Other Direct Cost and Data Purchases) Any item(s) of property in excess of $5000 in value if any, acquired by the Contractor or its facility management contractor shall be identified in a numbered attachment to this SOW and listed in Section VIII, Applicable Documents at the contractor’s.

5. Place(s) of Performance. DOE will perform the work under this SOW at INL’s facilities, other government agencies, and commercial sites as identified by ISD.

6. Monthly Status Report. The Contractor shall deliver a monthly status report, in accordance with SOW Section 1.1 within the timeline stated in the deliverables table in SOW Section 3.0 Key Milestones and Deliverables.

7. Deliverables. The Contractor will provide all deliverables identified in this SOW to the Government in accordance with Section 3.0, Key Milestones and Deliverables

8. Invoicing. Invoices shall be prepared per included FAR clauses. In addition to invoice preparation as required by the FAR, the Contractor’s invoice shall include the following information:

1) Cover sheet identifying DHS;

2) Task Order Number;

3) Modification Number, if any;

4) UEI Number;

5) Month services provided

6) Contract Line Item Number (CLIN) and Accounting Classifications

7) CLIN and description for each billed item.

8) Any additional backup information as required by this contract (to include the name/title of contractor support personnel billed against each CLIN).

9) ATTN: CISA/ISD

The contractor shall submit invoices monthly. The Contractor shall submit the invoice electronically to the addresses in Section VII.

9. Security Requirements. Access to unclassified, but Security Sensitive Information may be required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination.

Requests for Exception to U.S. Citizenship Requirement: Special procedures apply for exception to the requirement that persons accessing DHS systems be U.S. citizens. Under normal circumstances, only U.S. citizens are allowed access to DHS systems and networks; but there is a need at times to grant access to foreign nationals. Access for foreign nationals is normally a long-term commitment, and exceptions to citizenship requirements are treated differently from security policy waivers. Exceptions to the U.S. citizenship requirement should be requested by completing a Foreign National Visitor Access Request, DHS Form 11052-1, which is available online or through the DHS Office of the Chief Security Officer (OCSO). Components who have access may file their request via the Foreign National Vetting Management System (FNVMS), a part of the DHS OCSO Integrated Security Management System’s (ISMS). For further information regarding the citizenship exception process, contact the DHS OCSO.

This Policy Directive and the DHS 4300A Sensitive Systems Handbook apply to all DHS employees, contractors, detailees, others working on behalf of DHS, and users of DHS information systems that collect, generate, process, store, display, transmit, or receive DHS information unless an approved waiver has been granted. This includes prototypes, telecommunications systems, and all systems in all phases of the Systems Engineering Life Cycle (SELC).

Post-Award Instructions Regarding Security Requirements for Non-Classified Contracts/Orders: The procedures outlined below shall be followed for the DHS Office of the Chief Security Officer (OCSO), Personnel Security Division (PSD) to process background investigations, Entry on Duty determinations, and fitness determinations, as required, in a timely and efficient manner.

Carefully read the security clauses in the contract. Compliance with the security clauses in the contract is not optional.

Contractor employees (to include applicants, temporaries, part-time and replacement employees), requiring access to sensitive information, shall undergo a position-sensitivity analysis based on the duties each individual will perform. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. All background investigations will be processed through the DHS OCSO-HQS PSD. Prospective contractor employees shall complete and submit a combination of the below forms to the DHS OCSO-HQS PSD. The Standard Form (SF) 85 must be completed electronically through the Office of Personnel Management’s e-QIP SYSTEM. The SF-85 signature pages and other completed forms must be given to the OCSO-HQS PSD no less than thirty days before the start date of the contract or thirty (30) days prior to the requested entry on duty date, for all Contractor employees whether a replacement, addition, subcontractor employee, or vendor. OCSO-HQS PSD does not process any requests until the contract has been awarded and released from.

Only complete packages will be accepted by the DHS OCSO-HQS PSD. Specific instructions on submission of packages will be provided upon award of the contract.

The DHS OCSO-HQS PSD may, as it deems appropriate, authorize, and grant a favorable EOD decision based on preliminary checks. A favorable EOD decision allows a contractor employee to commence work temporarily prior to the completion of the full background investigation. The granting of a favorable EOD decision shall not be considered as assurance that a favorable fitness determination will follow. In addition, a favorable EOD or fitness determination shall in no way prevent, preclude, or bar DHS from withdrawing or terminating access to government facilities or information, at any time during the term of the contract. No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable EOD or fitness determination by the DHS OCSO-HQS PSD.

Limited access to Government buildings is allowable without an EOD decision if the Contractor is escorted by a Government employee and the purpose of the visit is to attend a limited number (less than 5) of required briefings or nonrecurring meetings in order to facilitate transition. The intent of this statement is to allow a minimum amount of meetings/transition attendances to prepare for the new contract.

The DHS Security Office shall be notified of all terminations /resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Technical Representative (COR) all DHS issued identification cards and building passes that have either expired or have been collected from terminated employees. If an identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the pass or card number, name of individual to who it was issued and the last known location and disposition of the pass or card.

When sensitive Government information is processed on Department telecommunications and automated information systems, the Contractor shall provide for the administrative control of sensitive data being processed. Contractor personnel must have favorably adjudicated background investigations commensurate with the defined sensitivity level. Performers who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, whether or not the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

· Failure to follow these instructions may delay the completion of suitability determinations and background checks. Note that any delays in this process that are not caused by the government do not relieve a Contractor from performing under the terms of the contract.

· Your POC at the Security Office is:

DHS OCSO/PSD Security Customer Service Center Telephone: (202) 447-5010 E-mailbox: officeofsecurity@dhs.gov.

10. Cybersecurity/Privacy. HSAR 15-01, Rev 1 – Safeguarding of Controlled Unclassified Information. FAR 52.224-3 Privacy Training – Alternate 1.

11. Protected Critical Infrastructure Information Compliance & Non-Disclosure The parties agree to comply with the Final Rule promulgating regulations at Title 6 Code of Federal Regulations Section 29 to govern procedures for handling critical infrastructure information. The regulations detailed in the Final Rule, which was effective upon publication pursuant to Section 808 of the Congressional Review Act, were promulgated pursuant to Title II, Section 214 of the Homeland Security Act of 2002, known as the “Critical Infrastructure Information Act of 2002” (CII Act).

The Contractor shall not request, obtain, maintain or use Protected Critical Infrastructure Information (PCII) without a prior written certification from the PCII Program Manager or a PCII Officer that conforms to the requirements of Section 29.8(c) of the Final Rule.

The Contractor shall comply with all requirements of the PCII Program set out in the CII Act, in the implementing regulations published in the Final Rule, and in the PCII Procedures Manual as they may be amended from time to time and shall safeguard PCII in accordance with the procedures contained therein.

The Contractor shall ensure that each of its employees, consultants, and subcontractors who work on the PCII Program have executed Non-Disclosure Agreements (NDAs) in a form prescribed by the PCII Program Manager (DHS Form 11000-6) and agrees that none of its employees, consultants or sub-contractors will be given access to PCII without having previously executed an NDA. The Contractor shall ensure that each of its employees cooperate with the PCII program should it need to conduct any oversight activities, to include audits or investigations about the storage, handling, or dissemination of PCII.

12. CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Requesting Agency Furnished Resources specified in SOW III and VI.3 above.

12.1 Property Inventory

The Contractor will ensure personnel apply a DHS-supplied barcode to all property purchased for CISA. Contractor must establish and maintain an accurate master inventory of all property purchase for CISA.

12.2 Notification of Property Receipt

Contractor will confirm receipt of CISA property purchased with the assigned CISA Accountable Property Officer (APO) and COR within 5 business days of receipt.

APO Name & Contact Information

12.3 Monthly Asset Management Report

Contractor will prepare a monthly Asset Management Report, which contains accurate information for all CISA property located at their facility. At a minimum, this report must include:

12.4 Invoice/Receipts

Contractor will ensure copies of all invoices/packing slips/receipts for property purchased for CISA accompanies the Monthly Asset Management Report.

13. Section 508 Requirements

Section 508 of the Rehabilitation Act (classified to 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Appendixes A, C & D, and available at https://www.ecfr.gov/cgi-bin/text-idx?SID=e1c6735e25593339a9db63534259d8ec&mc=true&node=pt36.3.1194&rgn=div5. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards. ICT includes IT and other equipment.

Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated November 12, 2018, and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated November 20, 2018, or any successor publication.

13.1 Section 508 Requirements for Technology Services

1. When developing or modifying ICT, the Contractor is required to validate ICT deliverables for conformance to the applicable Section 508 requirements. Validation shall occur on a frequency that ensures Section 508 requirements is evaluated within each iteration and release that contains user interface functionality.

2. When modifying, installing, configuring, or integrating commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

3. When developing or modifying electronic documents and forms provided in a Microsoft Office or Adobe PDF format, the Contractor shall demonstrate conformance to the applicable to the applicable Section 508 standards (including WCAG Level A and AA Level 2.0 Success Criteria) by conducting testing using the test methods published under “Accessibility Tests for Documents” at https://www.dhs.gov/compliance-test-processes.

4. When developing or modifying ICT deliverables that contain the ability to automatically generate electronic documents and forms in Microsoft Office and Adobe formats, or when the capability is provided to enable end users to design and author web based electronic content (i.e. surveys, dashboards, charts, data visualizations, etc.), the Contractor shall demonstrate the ability to ensure these outputs conform to the applicable Section 508 standards (including WCAG 2.0 Level A and AA Success Criteria). The Contractor shall demonstrate conformance by conducting testing and reporting test results based on representative sample outputs. For outputs produced as Microsoft Office and Adobe PDF file formats, the Contractor shall use the test methods published under “Accessibility Tests for Documents”, which are published at https://www.dhs.gov/compliance-test-processes. For outputs produced as web based electronic content, the Contractor shall use the DHS Trusted Tester for Web Methodology Version 5.0, or successor versions. This methodology is published at https://www.dhs.gov/trusted-tester

13.2 Section 508 Deliverables

1. Section 508 Test Plans: When developing or modifying ICT pursuant to this contract, the Contractor shall provide a detailed Section 508 Conformance Test Plan. The Test Plan shall describe the scope of components that will be tested, an explanation of the test process that will be used, when testing will be conducted during the project development life cycle, who will conduct the testing, how test results will be reported, and any key assumptions.

2. Section 508 Test Results: When developing or modifying ICT pursuant to this contract, the Contractor shall provide test results in accordance with the Section 508 Requirements for Technology Services provided in this solicitation.

3. Section 508 Accessibility Conformance Reports: For each ICT item offered through this contract (including commercially available products, and solutions consisting of ICT that are developed or modified pursuant to this contract), the Offeror shall provide an Accessibility Conformance Report (ACR) to document conformance claims against the applicable Section 508 standards. The ACR shall be based on the Voluntary Product Accessibility Template Version 2.0 508 (or successor versions). The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed by following all of the instructions provided in the template, including an explanation of the validation method used as a basis for the conformance claims in the report.

14. DHS ENTERPRISE ARCHITECTURE COMPLIANCE

All solutions and services shall meet DHS and CISA Enterprise Architecture policies, standards, and procedures. Specifically, the contractor shall comply with the following Homeland Security Enterprise (HLS) Architecture (EA) requirements:

All developed solutions and requirements shall be compliant with the HLS EA.

All IT hardware and software shall be compliant with the HLS EA Technical Reference Model (TRM) Standards and Products Profile. Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the CISA Chief Data Officer for review, approval and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository. Development of data assets, information exchanges and data standards will comply with the DHS Data Management Policy MD 103-01 and CISA’s Enterprise Data Management Program Policy and all data-related artifacts will be developed and validated according to DHS and CISA data management architectural guidelines.

Applicability of Internet Protocol Version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS Enterprise Architecture (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All EA-related component acquisitions shall be IPv6 compliant as defined in the U.S. Government Version 6 (USGv6) Profile (National Institute of Standards and Technology (NIST) Special Publication 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

15. DHS Geospatial Information System Terms and Conditions

All implementations including geospatial data, information, and services shall comply with the policies and requirements set forth in the DHS Geospatial Information Infrastructure (GII), including (but not limited to) the following:

All data built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Data Reference Model. All software built to the GII, whether adopted or developed, shall be submitted to the government for review and insertion into the DHS Technical Reference Model.

VII. Points of Contact

The DHS POCs (name, mailing address, office phone number and email address) are as follows:

CISA/ISD Technical Representative and Task Manager:

Jaysen Goodwin U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency Infrastructure Security Division, Infrastructure Assessments and Analysis jaysen.goodwin@cisa.dhs.gov Phone: 202-880-4948

DHS ISD Contracting Officer Representative (COR):

Babatope Dada U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency Infrastructure Security Division, Infrastructure Assessments and Analysis Phone: 202-309-6136 babatope.dada@cisa.dhs.gov

CISA ISD Invoicing Burlington Finance Office P.O. Box 1279 Attn: CISA Williston VTCISAInvoice.consolidation@ice.dhs.gov

VIII. Applicable Documents

The following documents provide specifications, standards, or guidelines that must be complied with to meet the requirements:

· DHS security guidelines, applicable information handling requirements, and training materials

· Information pertinent to sites to be visited

· Information pertinent to sites requiring background research reports

· Infrastructure sector/segments for development of IPRS reports

· Concept of Operations (CONOPS) or guidance documents for technical support activities

· Mission statements and organizational materials

· Policy and procedure manuals, as appropriate

· Protected Critical Infrastructure Information (PCII) pertinent to sites or to analysis and technical support

· Threat and risk information (classified or unclassified) pertinent to sites or to analysis and technical support

· DHS Furnished Property Listing

· Contractor Purchased Property Listing