DRAFT Statement of Work 5-15-2025.docx

U.S. Immigration and Customs Enforcement (ICE) Office of Acquisition Management (OAQ)

Statement of Work (SOW) Automated Purchase Card Approval System

Contents

1 Overview

This Statement of Work (SOW) is being issued to obtain a solution that provides a robust, automated government purchase card routing system. The solution sought must provide the minimum requirements outlined in the Scope section of this SOW.

These requirements will enable the Department of Homeland Security (DHS), Immigration and Customs Enforcement (ICE) the ability to provide a streamlined and robust solution for the government purchase card program users.

The approximate users of the system will include, but are not limited to, the following:

2 Background

The Department of Homeland Security (DHS), Immigration and Customs Enforcement (ICE), Office of Acquisition Management (OAQ) has a need for a commercial off the shelf (COTS) Automated Purchase Card Approval System. The solution must provide an automated, paperless purchase card approval processing system with customizable options.

DHS Purchase Card Policy requires cardholders to complete a purchase card worksheet prior to placing an order. The process is manual and often labor intensive, leading to unnecessary administrative cost. This requirement is intended to reduce the manual effort, using an automated processing solution that provides paperless approvals, routing, policy compliance, and audit readiness capabilities.

With an automated purchase card worksheet solution, the purchase card program can efficiently manage cost, streamline audit requirements, and provide stakeholders with additional oversight over the program. An automated solution will be used to assist with mitigating risks associated with the program.

3 Scope

The scope of this SOW is to provide a COTS solution that supports the number of users outlined in Section 1 and meets all the following minimum requirements:

· Paperless – The system must be a paperless, automated enterprise procurement system for purchase card (credit card) requests.

· Form – The system must have a fillable request form that routes for approvals. DHS has a form (DHS Form 1501) that must include all of the required fields identified on the form (see Section 21 form example). The system must be dynamic and able to allow for customizing new fields when/if necessary, without incurring additional charges or fees.

· Routing – The system must route requests for review and approvals. The approvals route through a minimum of four (4) individuals (Cardholder, Funding Official, Approving Official, third-party Receiver). However, the approvals may include additional individuals (Property Custodian, Local Field Office). Therefore, the solution must include functionality to include additional approvals.

· Hierarchy – The system should be capable of integrating with agency’s bank hierarchy structure. The hierarchy structure will be provided to the awardee.

· Visibility – The system must provide access to designated purchase card managers over all transaction documentation. The access will provide managers the ability to retrieve information and documents related to transactions. The access must provide robust search capabilities. Search options include by:

· Cardholder

· Approving Official

· Merchant

· Amount of request

· Description of items/service

· Date of transaction

· Establish Rules – The system must provide established rules to comply with DHS policies and procedures. The system must be flexible to incorporate new rules. Rules will be provided to the awardee. Although not all inclusive, rules may include but are not limited to the following:

· Separation of Duties for review and approvals.

· Tracking that shows approval and routing dates, comments, and changes to the request.

· Reminder notification for recurring expenses; reminding the user to obtain approvals.

· All request must have supporting documentation. Reminders/alerts must be incorporated to ensure users attach supporting documentation to their requests.

· Reminder notification to close out requests timely. This includes capturing the third-party receiver’s signature.

· Email notification to the individuals in the routing process when the request is in their que for approval/signature.

· Accessibility – The system must allow accessibility of documents from any location via computer, smart phone or other.

· Retention - Document must be accessible for a period of 6 years from the transaction date.

· Reporting – The system must have reporting capabilities to include, but not limited to:

· Track spending

· Track users

· Track pending requests

· Socio-economic spend

· Custom reports

· Track merchants/vendors

· Track details on items purchases (example: uniforms, cable service, etc.)

· Search Function – The system must have a search function that allows purchase card managers to search for specific information. Example: Search for amount, card holder name, merchant, product.

· Matching – The system must be able to match bank’s transaction report to an approved document, matching between the request/DHS 1501, receiver, and invoice. 3-Way matching capability between request, receiving signature, and invoice.

· Reconciliation and Document close out – The system must be capable of importing purchase card data from the agency’s servicing bank’s system (currently Citimanager) at any time. The data must be auto-matched to purchasing and invoice data and presented to the purchase card holders to allow them to match transactions and close out active requests.

· Auditing – The system should have the functionality to provide various alerts to the administrator and purchase card holders of potential audit flags that should be reviewed. Audit flags may include, but are not limited to, audit test attributes such as taxes were charged. The audit test attributes will be provided to the awardee.

· Receiving – The system must allow for partial receipt as well as full receipt of order.

· Property Management – The system must capture property custodian’s signature for pilferable items when applicable.

· B2B Punchout and Catalog Ordering – The system should have “punch out” capability allowing the user to access merchant websites and catalogs that have been approved by the agency administrator. The system should also have the capability of loading catalogs and/or spreadsheets with approved items. Catalog searches should enable comparison shopping, and comparison supporting documentation must be automatically attached to the purchase request when desired.

· Integration – The system must provide an integrated e-commerce shopping experience for requestors to include catalogs, punch out to vendor’s websites and manual requests.

· Favorites – The system must allow users to create a favorites list which integrates with (catalogs, punch outs and manual requests)

· Financial – The system should provide financial tracking capabilities and be customizable. The tracking may include the ability to enter a beginning balance and draw down from that balance. The system does not interface with ICE’s financial system. Therefore, the tracking should be an option available to the user if they choose to use the functionality.

· Printing/Download – The system must allow users and administrators to print and/or download all documentation.

· Printing/downloading one request – The system must be capable of generating a consolidated document output that includes the DHS Form 1501 and all attachments into one document; this should be a click and print ability.

· Printing/downloading multiple request – The system should have the ability to print multiple requests with associated attachments via a batch printing/download capability.

· Support – The vendor must provide customer support to agency users. This includes assistance with the system and any updates to the system deemed necessary by the administrator.

· Access – The system must have restricted access to approved ICE personnel. Any other access to ICE documentation must be approved by the administrator via written request.

· Logging – The system must have the capability to log user access and action.

· Training – The vendor must provide user training. The training shall be provided to the administrators as a train-the-trainer type of training. This will allow the administrator to deliver training that aligns with other training requirements. In addition, the vendor must provide a recorded how-to video and a how-to manual.

4 Objectives, Requirements, and Deliverables

The Contractor shall provide a solution that meets or exceeds the minimum requirements as outlined in Section 3, supports the approximate number of users outlined in Section 1, and satisfies any other requirements outlined in the SOW and/or Attachment 2 – Terms and Conditions. The Contractor’s system must be FedRamp Certified. The Contractor shall provide all deliverables as described in the below Deliverables Table.

The Contractor shall attend a Post Award Conference with the Contracting Officer, COR, and all other applicable Government stakeholders no later than five (5) business days after the date of contract award. The purpose of the Post Award Conference, which will be chaired by the COR, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan for comments/finalization. The Post Award Conference will be held virtually via Microsoft TEAMS.

The Contractor shall provide a draft Project Plan at the Post Award Conference for the Government’s review and comment. The Contractor shall provide a final Project Plan to the Contracting Officer’s Representative (COR) no later than ten (10) business days after the Post Award Conference.

The Project Plan shall address, at a minimum:

· The Contractor’s overall approach to management of the task.

· The roles and responsibilities of team members.

· A timeline to fulfill all deliverables and deliver a fully functioning solution that has been integrated, tested, and approved by all applicable ICE personnel. The timeline shall include any expected coordination with the ICE Office of the Chief Information Officer (OCIO) specific to ATOs or any other IT security requirements.

All deliverables shall be prepared in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows and Microsoft Office Applications) as applicable. Deliverables shall be delivered electronically to the COR/technical representative by the close of business Central Time (CT), unless otherwise stated in the Deliverable Table. In the event the Contractor anticipates difficulty in complying with any deliverable, the Contractor shall provide written notification immediately to the COR. Each notification shall give pertinent details, including the date by which the Contractor expects to make delivery.

The COR will review deliverables prior to acceptance and provide the contractor with an e-mail that provides documented reasons for non-acceptance. If the deliverable is acceptable, no notification will be sent to the Contractor; no response equals acceptance of the deliverable. The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the SOW and/or Contractor’s proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions. The Contractor shall have ten (10) business days to make corrections and redeliver. The Contractor shall immediately inform the COR if unable to meet the resubmission deadline.

Acceptance by the Government of satisfactory products/services will be made once all the terms, conditions and requirement in this SOW are fulfilled including the following delivery requirements:

Deliverables Table

4.1 Government Furnished Information

The Government will provide information/documents to the contractor to meet the requirements of this SOW. Documents may include member’s list, bank hierarchy structure, object class codes, punch out merchant shopping information and any other documents within the scope of the contract. The contractor shall coordinate with the Contracting Officer’s Representative (COR) to obtain requested documents.

5 Place and Period of Performance

The primary place of performance will be at Contractor’s facility. The period of performance is outlined in the table below. The Government is not obligated to exercise the optional periods of performance. It will be the Government’s unilateral right to exercise the option years. Once the option is exercised, the Contractor is required to perform/deliver all services and/or requirements when ordered during the scheduled period of performance of this contract.

6 Compliance Requirements

The solution will be housed on the merchant’s host site with secure access for users. The solution will not interface with the Government’s servers. The solution should be flexible to enable interface with the Government’s systems and/or applications with FedRamp boundaries and approvals. Any Personal Identifiable Information (PII) must remain secure. PII is defines as: any representation of information that permits the identity of the individual to whom the information applies to be reasonably inferred by either direct or indirect means.

7 Government Roles and Responsibilities

The following personnel will oversee and coordinate surveillance activities.

7.1 Contracting Officer (CO)

The CO will ensure performance of all necessary actions for effective contracting, ensure compliance with the contract terms, and will safeguard the interests of the United States in the contractual relationship. The CO will also assure that the contractor receives impartial, fair, and equitable treatment under this contract. The CO is ultimately responsible for the final determination of the adequacy of the contractor’s performance.

7.2 Contracting Officer’s Representative (COR)

The COR is responsible for technical administration of the contract and will assure proper government surveillance of the contractor’s performance. The COR provides technical direction to the Contractor within the scope of the contract. The COR will provide requested documents to meet the objective of the contract. The COR is not authorized to alter the contract’s terms or conditions. Such changes must be authorized by the Contracting Officer in a written modification to the contract.

8 Travel

There will be no contractor travel in performance of this contract. No travel will be reimbursed.

9 Privacy and Records Requirements

All records received, created, used, and maintained by the contractor for this effort shall be protected as sensitive data, in accordance with government laws, to include the FAR, Part 24, Protection of Privacy and Freedom of Information, and shall be returned and provided to the government upon contract completion.

All data created for government use and delivered to or falling under the legal control of the government are federal records and shall be managed in accordance with records management legislation as codified at 44 U.S.C. Chapters 21, 29, 31, and 33, the Freedom of Information Act (5 U.S.C. 552), and the Privacy Act (5 U.S.C. 552a), and shall be scheduled for disposition in accordance with 36 CFR 1228.

As prescribed in FAR 24.104, under the Privacy Act Notification Clause (Apr 1984), the contractor shall comply with clauses 52.224-1 and 52.224-2. Clause 52.224-1 specifically states that when the design, development, or operation of a system of records on individuals is required to accomplish an agency function, the contractor will be required to design, develop, or operate a system of records on individuals to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

Clause 52.224-2 The contractor agrees to- Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies the systems of records and the design, development, or operation work that the contractor is to perform

In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

All contractor employees for this effort will also be required to sign a Non-disclosure statement, Acknowledgement and Agreement Handling Sensitive Government Data and Other Government Property and are subject to the security requirements of the SOW. This form will be signed prior to beginning work for this effort.

Privacy Requirements For Contractor And Personnel In addition to FAR 52.224-1 Privacy Act Notification (APR 1984), 52.224-2 Privacy Act (APR 1984), FAR 52.224-3 Privacy Training (JAN 2017), and HSAR Clauses, the following instructions must be included in their entirety in all contracts.

Limiting Access to Privacy Act and Other Sensitive Information In accordance with FAR 52.224-1 Privacy Act Notification (APR 1984), and FAR 52.224-2 Privacy Act (APR 1984), if this contract requires contractor personnel to have access to information protected by the Privacy Act of 1974, the contractor is advised that the relevant DHS system of records notices (SORNs) applicable to this Privacy Act information may be found at https://www.dhs.gov/system-records-notices-sorns. Applicable SORNS of other agencies may be accessed through the agencies’ websites or by searching GovInfo, available at https://www.govinfo.gov that replaced the FDsys website in December 2018. SORNs may be updated at any time.

Prohibition on Performing Work Outside a Government Facility/Network/Equipment The Contractor shall perform all tasks on authorized Government networks, using Government-furnished IT and other equipment and/or Workplace as a Service (WaaS) if WaaS is authorized by the statement of work. Government information shall remain within the confines of authorized Government networks at all times. Except where telework is specifically authorized within this contract, the Contractor shall perform all tasks described in this document at authorized Government facilities; the Contractor is prohibited from performing these tasks at or removing Government-furnished information to any other facility; and Government information shall remain within the confines of authorized Government facilities at all times. Contractors may only access classified materials on government furnished equipment in authorized government owned facilities regardless of telework authorizations.

Prior Approval Required to Hire Subcontractors The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (Subcontractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any Subcontractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Separation Checklist for Contractor Employees Contractor shall complete a separation checklist before any employee or Subcontractor employee terminates working on the contract. The separation checklist must verify: (1) return of any Government-furnished equipment; (2) return or proper disposal of sensitive personally identifiable information (PII), in paper or electronic form, in the custody of the employee or Subcontractor employee including the sanitization of data on any computer systems or media as appropriate; and (3) termination of any technological access to the Contractor’s facilities or systems that would permit the terminated employee’s access to sensitive PII.

In the event of adverse job actions resulting in the dismissal of an employee or Subcontractor employee, the Contractor shall notify the Contracting Officer’s Representative (COR) within 24 hours. For normal separations, the Contractor shall submit the checklist on the last day of employment or work on the contract.

As requested, contractors shall assist the ICE Point of Contact (ICE/POC), Contracting Officer, or COR with completing ICE Form 50-005/Contractor Employee Separation Clearance Checklist by returning all Government-furnished property including but not limited to computer equipment, media, credentials and passports, smart cards, mobile devices, PIV cards, calling cards, and keys and terminating access to all user accounts and systems.

Contractor’s Commercial License Agreement and Government Electronic Information Rights Except as stated in the Statement of Work and, where applicable, the Contractor’s Commercial License Agreement, the Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation and associated metadata created as part of this contract. All deliverables (including all data and records) under the contract are the property of the U.S. Government and are considered federal records, for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

Privacy Lead Requirements If the contract involves an IT system build or substantial development or changes to an IT system that may require privacy documentation, the Contractor shall assign or procure a Privacy Lead, to be listed under the SOW required Contractor Personnel section. The Privacy Lead shall be responsible for providing adequate support to DHS to ensure DHS can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance. The Privacy Lead shall work with personnel from the program office, the ICE Privacy Unit, the Office of the Chief Information Officer, and the Records and Data Management Unit to ensure that the privacy documentation is kept on schedule, that the answers to questions in the PIA are thorough and complete, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

The Privacy Lead:

· Must have excellent writing skills, the ability to explain technology clearly for a non-technical audience, and the ability to synthesize information from a variety of sources.

· Must have excellent verbal communication and organizational skills.

· Must have experience writing PIAs. Ideally the candidate would have experience writing PIAs for DHS.

· Must be knowledgeable about the Privacy Act of 1974 and the E-Government Act of 2002.

· Must be able to work well with others.

If a Privacy Lead is already in place with the program office and the contract involves IT system builds or substantial changes that may require privacy documentation, the requirement for a separate Private Lead specifically assigned under this contract may be waived provided the Contractor agrees to have the existing Privacy Lead coordinate with and support the ICE Privacy POC to ensure privacy concerns are proactively reviewed and so ICE can complete any required PTA, PIA, SORN, or other supporting documentation to support privacy compliance if required. The Contractor shall work with personnel from the program office, the ICE Office of Information Governance and Privacy, and the Office of the Chief Information Officer to ensure that the privacy documentation is kept on schedule, that the answers to questions in any privacy documents are thorough and complete, that all records management requirements are met, and that questions asked by the ICE Privacy Unit and other offices are answered in a timely fashion.

10 Data Ownership

1. Accessibility of Government-owned Data All stored program data associated with this acquisition shall be owned by the Government. As such, it shall be made accessible to the Government in accordance with the Minimum Data Access Capability described below. This accessibility is required to allow full data transparency, flexibility in performing data analytics, and integration with data from other government programs.

In addition to the Minimum Data Access Capability, the Government prefers, but does not require, that program data be accessible via Enhanced Access Capabilities as described below.

Definition of “program data”: Program Data refers to any data resulting from ICE and DHS organizational activity. Examples of such data include but are not limited to administrative data resulting from human resource, management, and financial actions, as well as operational data resulting from performance of the ICE mission.

Definition of “associated with this acquisition”: Program Data is associated with an acquisition if it is created by DHS organizational activity that is facilitated by the contractor. Examples of how a contractor might facilitate organizational activity follow:

· Program data is stored by contractor personnel

· Program data is stored by software that is managed, developed, or used by the contractor

· Program data is stored in a repository that is managed, developed, or used by the contractor

2. Minimum Data Access Capability

· The current version of all Program Data is accessible to the Government within 24 hours of request, as well as on any pre-defined schedule as required by the Government.

Data access can occur by various means, provided that Government security requirements are met, and data is accessible in a format that is acceptable to the Government. Examples include but are not limited to APIs that are consumable by the Government, files made available for Government download (e.g., Excel Spreadsheets), or direct database query by federal or contractor personnel.

· The contractor shall format program data accessed by the Government to anticipate the maximum file size of any data to be accessed. File size shall be small enough to assure rapid processing by government applications.

· The contractor shall provide the means for the Government to interpret accessible Program Data as follows:

· Data elements and groupings of data elements shall be clearly identifiable by labels embedded in the data itself, or by a separate schema or file layout which allows such elements and groupings to be identified.

In the case of a relational database schema defined through Data Definition Language (DDL), data elements would be represented as columns, and groupings of data would be represented as tables. In addition, relationships between tables would be described as foreign key relations.

· Labels or names used to identify data elements and groupings of data elements shall be approved by the Government. In addition, each label or name shall be associated with a government approved definition which describes the content of data held therein.

· Program data delivered to the Government shall conform to the Government approved definition for each data element and grouping of data elements.

· All data accessible by the Government shall be both machine readable and human-readable in plain text.

· All reference data associated with Program Data also needs to be accessible to the Government. Such reference data is required to provide complete understanding of a record.

Reference Data Example: Program data may include a city code which uniquely identifies a city. Reference data associated with a city code may include its name, geographic boundaries, population, median income, etc. This example is provided for clarification of the meaning of reference data and may or may not apply to this specific acquisition. Examples of other reference data codes would include codes representing eye color, gender, country of origin, etc.

3. Enhanced Access Capabilities The Government prefers that sharing of program data take place via an Application Programming Interface (API) or multiple APIs. APIs allow the Government to efficiently consume data via a widely recognized standard where the data has been completely abstracted from the technology platform that produces it.

In addition, the Government prefers that sharing of program data take place using techniques that enhance efficiency, such as Change Data Capture (CDC). CDC enhances efficiency of data transfer by providing only incremental updates to program data as opposed to providing all program data each time data is shared.

11 Cyber Security Requirements

Compliance with DHS Security Policy Terms and Conditions:

All hardware, software, and services provided under this Statement of Work must be compliant with DHS 4300A DHS Sensitive System Policy and DHS Policy Directive 4300A.

Security Review Terms and Conditions The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

Supply Chain Risk Management Terms and Conditions The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Representative (COR/CO) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents a risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standard certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the CO. Contractors shall provide only Original Equipment Manufacturer (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. "grey market, "previously used) components only with formal Government approval. Such components shall be procured from their original source and have them shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e., until the “end of life"). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the U.S. Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use of tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government's request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipping and handling, unless the damage, deterioration, or loss is due to the Government. The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being ship (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

Privacy Expectations Government contractor employees do not have a right, nor should they have an expectation, of privacy while using Government provided devices at any time, including accessing the Internet and using e-mail and voice communications. To the extent that employees wish that their private activities remain private, they should avoid using the Government provided device for limited personal use. By acceptance of the government provided device, employees imply their consent to disclosing and/or monitoring of device usage, including the contents of any files or information maintained or passed -through that device.

Contractor IT Security Accreditation Within 6 months after contract, the contractor shall submit written proof of IT Security accreditation to DHS for approval by DHS CO. Accreditation will proceed according to the criteria of DHS Sensitive System Policy Publication, 4300A (most current version) or any replacement publication, which the CO will provide upon request. This accreditation will include a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. This accreditation, when accepted by the CO, shall be incorporated into the contract as a compliance document. The contractor shall comply with the approved accreditation documentation.

Contractor Employee Access (Sep 2012) Sensitive Information, as used in this clause, means any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy.

This definition includes the following categories of information:

Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the CO. Upon the CO's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All Contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

The CO may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason. Including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the CO. For those Contractor employees authorized access to sensitive information, the Contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

Security Training Requirements

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors . The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually and the COR will provide notification when a review is required.

Privacy Training Requirements.

All Contractor and subcontractor employees that will have access to Personally Identifiable Information (PII) and/or Sensitive PII (SPII) are required to take Privacy at DHS: Protecting Personal Information before accessing PII and/or SPII. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors . Training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall also complete the training before accessing PII and/or SPII. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

Encryption Compliance Terms and Conditions If encryption is required, the following methods are acceptable for encrypting sensitive information:

ISA Terms and Conditions Interconnections between DHS and non-DHS IT systems shall be established only through controlled interfaces and via approved service providers. The controlled interfaces shall be authorized at the highest security level of information on the network. Connections with other Federal agencies shall be documented based on interagency agreements; memoranda of understanding, service level agreements or interconnection security agreements.

Personal…