Rule14_Software_Subscription_RFQ.pdf

U.S. Department of Homeland Security Office of Procurement Operations

1229 Vermont Ave.

Washington, DC 20005

The Department of Homeland Security/Office of Procurement Operations requests a quote for Rule 14 Global Intelligence Tool Software, for the office of the Homeland Security Advanced Research Project Agency. This is a combined synopsis/solicitation for commercial items/services prepared in accordance with the format in Subpart 12.6 and 13.5, as supplemented with additional information included in this notice. This is a brand name/sole source announcement and constitutes the only solicitation; quote(s) are being requested.

This solicitation is being issued as a Request for Quotation (RFQ). The North American Industry Classification code for this procurement is 518210 entitled, “Data Processing, Hosting, and Related Services”. The small business size standard for this procurement is $32.5M. The government will evaluate quote(s) and make a selection based on the lowest priced, technically acceptable quotation, followed by delivery time frame. Delivery date is on or before 7 days after award. The bidder must be an authorized reseller of the Rule14 L.L.C.

products requested under this solicitation.

The following information shall be included on the cover page of the quote:

• Offeror Name • Email and Phone Number of POC

• Address • Cage Code

• Point of Contact (POC) • DUNs

The following items are requested in this solicitation:

See attachment J1, entitled “Rule14 Software, Subscription, and Training & Support”, Dated September 9, 2016.

Quote(s) should clearly separate each optional period and specify the cost associated with each line item for each of those periods. The quote must be for the specific items requested. Discounts must be clearly demarcated. The government reserves the right to award on a multiple award or an all or none basis. Quoter must be registered in the System for Award Management (SAM) database at www.sam.gov to be considered for award. Quote(s) must be received no later than Friday September 16, 2016 3:00 PM EST. All quote(s) must be sent directly to Jigisha.patel@hq.dhs.gov. The point of contact (POC) for this request for quote is Ms. Jigisha Patel, Contracting Officer, (202) 254-8207. Quote(s) received after the due date and time will not be considered for award and will be rejected.

mailto:Jigisha.patel@hq.dhs.gov

Part I – The Schedule

Section B. Supplies and Prices

B.1. Items and Price

The contractor shall provide the software and associated support services listed in Section A, Standard Form 1449.

B.2. Contract Type

This is a firm-fixed-price (FFP) type contract.

Section C. Statement of Work

Specification Document for Subscription for Workflow Management and Machine Learning with Open Source Data Collection; and Training and Support dated September 9, 2015.

Section D. Packaging and Marking

No physical shipments are required. The contractor shall mark all electronic document deliveries with the delivery order number.

Section E. Inspection and Acceptance

Inspection and acceptance shall be made in accordance with FAR 52.246-2 Inspection of Supplies – Fixed Price (AUG 1996,) FAR 52.246-4 Inspection of Services- Fixed Price (AUG 1996,)

Section F. Delivery and Performance

F.1. Place of Performance

The contractor shall furnish all items from its own location.

F.2. Delivery

All IT software and hardware maintenance, warranty, serial numbers, make, model, and type information is tracked by the S&T. Please ensure that the following aliases are used for communication of the above requirements. Contractor shall deliver the software electronically to stephen.dennis@hq.dhs.gov, and st.software@dhs.gov within 7 calendar days after contract award date. Download of software is the preferred method of delivery. The government’s understanding is that the term of the software licenses is perpetual.

mailto:stephen.dennis@hq.dhs.gov mailto:st.software@dhs.gov

Section G. Contract Administration

G.1. Contracting Officer’s Representative

The Contracting Officer’s Representative (COR) is designated in accordance with Homeland Security Acquisition Regulation (HSAR) 3052.242-72 Contracting Officer’s Technical Representative. The COR is:

Stephen Dennis Data Analytics Engine Director Homeland Security Advanced Research Projects Agency (HSARPA) Science and Technology Directorate U.S. Department of Homeland Security Phone: (202) 254-5788 Email: stephen.dennis@hq.dhs.gov

G.2. Contracting Officer

The contracting officer is the only person authorized to approve changes to any of the terms and conditions of this delivery order. In the event the contractor effects any changes at the direction of any person other than the contracting officer, the changes will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in costs incurred as a result thereof. The contracting officer shall be the only individual authorized to accept nonconforming work, waive any requirement of the contract, or to modify any term or condition of the contract. The contracting officer is the only individual who can legally obligate government funds. No cost chargeable to the proposed contract can be incurred before receipt of a fully executed contract, which includes any subsequent contract modifications or other specific written authorization from the contracting officer.

The contractor shall not comply with any order, direction or request of government personnel unless it is issued in writing and signed by the contracting officer, or is pursuant to specific authority otherwise included as a part of this contract. No order, statement, or conduct of government personnel, other than the contracting officer, who visit the contractor’s facilities or in any other manner communicate with contractor personnel during the performance of this contract shall constitute a change under the Changes clause of this contract.

The procuring and administering contracting officer for this contract is:

Jigisha Patel Science and Technology Acquisition Division Office of Procurement Operations U.S. Department of Homeland Security Phone: (202) 254-8207 Email: jigisha.patel@hq.dhs.gov mailto:jigisha.patel@hq.dhs.gov

G.3. Invoicing and Payment

Invoices shall be submitted to the mail box InvoiceSAT.Consolidation@ice.dhs.gov and CC the COR and contracting officer. Invoices will only be approved after the delivery has been made and successfully inspected and accepted by the Government.

Section H. Special Contract Requirements

Exercise of Optional Tasks Identified in Statement of Work

The Government may require the delivery of products, identified in the Statement of Work of the Contract as optional user(s) for the Base period, in the quantity and at the price/cost negotiated for the contract. If the Government elects to execute the base period optional CLINs identified in the Statement of Work, it will issue a unilateral contract modification.

Handling and Use of Government Provided Data

In furtherance of the purpose of this contract and statement of work forth in Attachment J1 of this contract the DHS must share certain DHS data sets with contractor.

DHS has, therefore, established data usage guidelines expressed in Attachment J2, “Data Management and Disposition Plan”, which the contractor and its employees who will be engaging in the statement of the work must adhere to. The data usage guidance in Attachment J2 is a considered a component of the policies and procedures in place to provide information security to the DHS Science & Technology (S&T) Data Analytics Engine (DA-E) program.

The data usage guidance expressed in Attachment J2 shall apply to DHS provided data, including but not limited to, personally identifiable information (PII), Sensitive Security Information (SSI), Sensitive but Unclassified (SBU) and Critical Infrastructure Information

(CII).

Security Clause

(a) DHS has and will exercise full control over granting, denying, withholding, or terminating unescorted Government facility and/or sensitive Government information access for Contractor employees, based upon the results of a background investigation. DHS may, as it deems appropriate, authorize and make a favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the contactor to commence work temporarily prior to the completion of the full investigation. The granting of a favorable EOD decision shall not be considered as assurance that a full employment contractor fitness (suitability) authorization will follow as a result thereof. The granting of a favorable EOD decision or a full contractor fitness (suitability) authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract. No employee of the contractor shall be allowed unescorted access to a Government facility, access to any sensitive information or access to DHS IT Systems without a favorable EOD decision or contractor fitness (suitability) determination by the mailto:InvoiceSAT.Consolidation@ice.dhs.gov

DHS Office of Security. Contract employees assigned to the contract not needing access to sensitive DHS information or recurring access to DHS facilities will not be subject to security contractor fitness (suitability) screening. Contract employees waiting and EOD decision may not begin work on the contract. Limited access to Government buildings is allowable prior to the EOD decision if the contractor is escorted by a Government employee. This limited access is to allow contractors to attend briefings, nonrecurring meetings, and begin transition work.

Classified information is Government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the contractor has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility. If the contractor is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

Access to Software/Subscription

(a) No government personnel or authorized DHS contractor will execute or will be required to sign any contractor or software/subscription agreement in order to access any of subscription systems that are the subject of this contract.

(b) Contractor and any other third party agreements will not be referenced in the contract.

This contract will only be governed within the terms and conditions herein.

(c) Software/subscription may require user to “click agree” to license terms and conditions in order to gain access to the Software/Subscription. Government or authorized DHS contractor personnel will “click agree” to gain access but not actually agree to or be bound by those terms. Instead, the terms of this contract solely governs the use by Government and authorized DSH contractor personnel. The entirety of this contract is within pages XXX, only.

Part II – Contract Clauses

Federal Acquisition Regulation (48 CFR CHAPTER 1)

The following Federal Acquisition Regulation (FAR) clauses are incorporated by reference into this contract:

Clause Number Title Date 52.202-1 Definitions Jan 2012 52.203-3 Gratuities Apr 1984 52.203-5 Covenant Against Contingent Fees Apr 1984 52.203-6 Restrictions on Subcontractor Sales to the Government Sep 2006 52.203-7 Anti-Kickback Procedures Oct 2010 52.203-8 Cancellation, Rescission, and Recovery of Funds for Illegal or Improper Activity Jan 1997

52.203-10 Price or Fee Adjustment for Illegal or Improper Activity Jan 1997

52.203-12 Limitation on Payments to Influence Certain Federal Transactions Oct 2010 52.204-7 System for Award Management Jul 2013 52.204-9 Personal Identity Verification of Contractor Personnel Jan 2011 52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards Jun 2013 52.204-13 System for Award Management Maintenance

Jul 2013

52.204-19 Incorporation by Reference of Representations and Certifications Dec 2014 52.209-10 Prohibition on Contracting with Inverted Domestic Corporations. Nov 2015 52.212-1 Instructions to Offerors – Commercial Items Oct 2015 52.212-4 Contract Terms and Conditions – Commercial Items May 2015 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive

Orders – Commercial Items Feb 2016

52.213-2 Invoices Apr 1984 52.219-1 Small Business Program Representations Oct 2014 52.222-1 Notice to the Government of Labor Disputes Feb 1997 52.222-3 Convict Labor Jun 2003 52.222-21 Prohibition of Segregated Facilities Feb 1999 52.222-26 Equal Opportunity Mar 2007 52.222-35 Equal Opportunity for Veterans Sep 2010 52.222-36 Affirmative Action for Workers with Disabilities Oct 2010 52.222-37 Employment Reports on Veterans Sep 2010 52.222-50 Combating Trafficking in Persons Feb 2009 52.222-54 Employment Eligibility Verification Jul 2012 52.225-13 Restriction on Certain Foreign Purchases Jun 2008 52.228-5 Work on Government Installation Jan 1997 52.232-8 Discounts for Prompt Payment Feb 2002 52.232-33 Payment by Electronic Funds Transfer-System for Award Management Jul 2013 52.233-1 Disputes May 2014 52.237-2 Protection of Government Buildings, Equipment, and Vegetation Apr 1984 52.246-2 Inspection of Supplies—Fixed-Price Aug 1996 52.246-4 Inspection of Services—Fixed-Price Aug 1996 52.252-1 Solicitation Provisions Incorporated by Reference Feb 1998 52.252-2 Clauses Incorporated By Reference Feb 1998 52.252-5 Authorized Deviations in Provisions Apr 1984 52.252-6 Authorized Deviations in Clauses Apr 1984

Full text of Federal Acquisition Regulation provisions and clauses are available at:

https://www.acquisition.gov

52.209-2 Prohibition on Contracting with Inverted Domestic Corporations— Representation.

Prohibition on Contracting with Inverted Domestic Corporations—Representation (Nov 2015)

(a) Definitions. “Inverted domestic corporation” and “subsidiary” have the meaning given in the clause of this contract entitled Prohibition on Contracting with Inverted Domestic Corporations (52.209-10).

https://www.acquisition.gov/

(b) Government agencies are not permitted to use appropriated (or otherwise made available) funds for contracts with either an inverted domestic corporation, or a subsidiary of an inverted domestic corporation, unless the exception at 9.108-2(b) applies or the requirement is waived in accordance with the procedures at 9.108-4.

(c) Representation. The Offeror represents that—

(1) It □ is, □ is not an inverted domestic corporation; and

(2) It □ is, □ is not a subsidiary of an inverted domestic corporation.

CONTRACTOR MUST CHECK A BOX.

(End of Clause)

HSAR 3052.204-71 Contractor employee access.

CONTRACTOR EMPLOYEE ACCESS (SEP 2012)

(a) Sensitive Information, as used in this clause, means any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

(b) “Information Technology Resources” include, but are not limited to, computer equipment, networking equipment, telecommunications equipment, cabling, network drives, computer drives, network software, computer software, software programs, intranet sites, and internet sites.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer.

Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted, or subject to other investigations as required. All Contractor employees requiring recurring access to Government facilities or access to sensitive information or IT resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under Departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized access to sensitive information, the Contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

(End of clause)

ALTERNATE I

(SEP 2012)

When the contract will require Contractor employees to have access to Information Technology (IT) resources, add the following paragraphs:

(g) Before receiving access to IT resources under this contract the individual must receive a security briefing, which the Contracting Officer’s Technical Representative (COTR) will arrange, and complete any nondisclosure agreement furnished by DHS.

(h) The Contractor shall have access only to those areas of DHS information technology resources explicitly stated in this contract or approved by the COTR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information technology resources not expressly authorized by the statement of work, other terms and conditions in this contract, or as approved in writing by the COTR, is strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for the DHS Component. It is not a right, a guarantee of access, a condition of the contract, or Government Furnished Equipment

(GFE).

(j) Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department’s Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) There must be a compelling reason for using this individual as opposed to a U.

S. citizen; and

(2) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

(End of clause)

HSAR 3052.205-70 Advertisements, Publicizing Awards, and Releases (Sep 2012)

(a) The Contractor shall not refer to this contract in commercial advertising or similar promotions in such a manner as to state or imply that the product or service provided is endorsed or preferred by the Federal Government or is considered by the Government to be superior to other products or services.

(End of clause)

HSAR 3052.228-90 INSURANCE (DEC 2003)

In accordance with the clause entitled “Insurance - Work on a Government Installation" [or Insurance - Liability to Third Persons] in Section I, insurance of the following kinds and minimum amounts shall be provided and maintained during the period of performance of this contract:

(a) Worker's compensation and employer's liability. The contractor shall, as a minimum, meet the requirements specified at (FAR) 48 CFR 28.307-2(a).

(b) General liability. The contractor shall, as a minimum, meet the requirements specified at (FAR) 48 CFR 28.307-2(b).

(c) Automobile liability. The contractor shall, as a minimum, meet the requirements specified at (FAR) 48 CFR 28.307-2(c).

HSAR 3052.242-72 Contracting Officer’s Technical Representative (Dec 2003) The Contracting Officer may designate Government personnel to act as the Contracting Officer’s Representative (COR) to perform functions under the contract, such as review or inspection and acceptance of supplies, services, including construction, and other functions of a technical nature. The Contracting Officer will provide a written notice of such designation to the Contractor within five working days after contract award or for construction, not less than five working days prior to giving the Contractor the notice to proceed. The designation letter will set forth the authorities and limitations of the COR under the contract.

The Contracting Officer cannot authorize the COR or any other representative to sign documents, such as contracts, contract modifications, etc., that require the signature of the Contracting Officer.

Part III – List of Documents, Exhibits, and Other Attachments

Section J. List of Attachments

Attachment J1: Specification Document for Rule14 Software, Subscription, and Training & Support, Dated September 9, 2016.

Attachment J2: Data Management and Disposition Plan http://farsite.hill.af.mil/reghtml/regs/far2afmcfars/fardfars/Far/28.htm#P379_65780

Attachment J1:

September 9, 2016

Specification Document for Rule14 Software, Subscription, and Training &

Support Department of Homeland Security (DHS)

Homeland Security Advanced Research Projects Agency (HSARPA) Science and Technology (S&T) Data Analytics

Engine (DA-E) Program

Background:

The U.S. Department of Homeland Security (DHS) is committed to using cutting-edge technologies and scientific talent in its quest to make America safer. The DHS Directorate of Science and Technology (S&T) is tasked with researching and organizing the scientific, engineering, and technological resources of the United States and leveraging these existing resources into technological tools to help protect the homeland. The Homeland Security Advanced Research Projects Agency (HSARPA) mission is to facilitate revolutionary research and development to transform and improve the homeland security mission space through rapid prototyping, demonstrations, technology transition, test and evaluation and commercialization of new and highly effective capabilities for the homeland security enterprise.

Scope of Requirement:

DHS HSARPA requires a tool for experimenting with flexible workflow management, extraction and machine learning with open source media platforms that tracks and searches publically available data and other authorized government information utilizing state-of-the-art programming analytics and crowd-sourcing techniques for the most up to date situational awareness to support the S&T DA-E program mission. Additional license users may be added in the future via modification(s).

Objective of Requirement:

The objective of this requirement is for the DHS HSARPA, S&T DA-E program to acquire software that serves as one of several methods for querying electronic data sources, monitoring traditional and e-data sources through semantic analytic and crowd-sourcing techniques, performing machine learning experiments to generate real time information gathering on various worldwide matters.

Delivery Requirements:

Data Limitations:

• Product must be able to monitor up to 6 social media channels with unlimited keywords and data plan.

Base Period: 12 months (09/30/2016- 09/29/2017)

Product Code Product Description Quantity Months

R14GI-LM-PU-HS

Monthly license subscription to Rule14 Global Intelligence Tool for Open Source Social Media Monitoring.

Includes web harvester and up to six (6) social media ingest channels, cloud-based storage, multi-lingual lexicon-based scoring and sentiment analysis, configurable rules engine, individual profile aggregation, customized dashboards, and configurable alerts.

***Additional usage fees may apply if channel volumes exceed 5 million records per month.

R14GI-IT-004-HS

Initial training provided by Rule14 Global Intelligence Tool (“R14 GIT”) product experts for up to four (4) days on-site. This training will be customized by the R14 GIT team for up to ten (10) users, based upon the specific initial implementation requirements of the client.

1 n/a

R14GI-QT-004

Quarterly training provided by Rule14 Global Intelligence Tool (“R14 GIT”) product experts for up to two (2) days on-site. This training will be customized by the R14 GIT team for up to ten (10) users, based upon the specific requirements of the client.

3 12

R14GI-PRM-PM

Project Management for a Rule14 Global Intelligence Tool (“R14 GIT”) implementation to support up to ten (10) users. This service will include a project manager to serve as the single point of contact from contract kick-off onwards, to interface with the client appointed project manager.

1 12

R14GI-SM-PU Rule14 Global Intel Standard Maintenance and Support 13 12

***Must explain how the software will notify the user once the channel volume has reached 5 million records per month. Contractor shall notify the contracting officer representative AND the contracting officer once the limit is reached. The contractor is not obligated to provide subscription services once limit is reached. Any charge to the Government in excess of the limit without notification to the contracting officer will be at no cost to the Government and shall be borne by the Contractor.

Optional CLIN within Base Period

Product Code Product Description Quantity Months

R14GI-LG2M-PU

Enhances the subscription for 13 users by adding listening capabilities for 6 additional social media channels.

From date of optional CLIN exercise to the end of Base Period

Period of Performance: Up to a total of 12 months from order effective date. Optional CLINs within the base period may be executed in parallel in order to cover six additional social media channels at the discretion of the Contracting Officer as the need arises. Once the base period has passed, the optional CLIN cannot be exercised; hence the optional CLIN cannot extend the base period of performance.

Government Furnished Information: The Government may provide that information, materials, and forms unique to DHS and for the successful completion of this mission to the contractor as deemed necessary by the Government. The COR will be the point of contact (POC) for identification of any required information to be supplied by DHS.

Government Furnished Facilities, Supplies, and Services. If work at Government-provided facilities is necessary for the services being performed under this Delivery Request, such facilities will be provided at S&T’s office in Washington, D.C. Parking facilities are not provided, however several commercial parking facilities are located near S&T’s office. Basic facilities such as work space and associated operating requirements (e.g., phones, desks, utilities, and consumable and general purpose office supplies) will be provided to the contractor personnel working in S&T’s office

Government Furnished Property. Government property will not be provided to the contractor unless otherwise agreed in a task order issued under this Delivery Request. In such instances, the government will maintain property records.

UNCLASSIFIED / FOR OFFICIAL USE ONLY

Attachment J2

DHS S& Technology

Homeland Security Advanced Research Projects Agency

TBD

Data Management and Disposition Plan

Prepared for

DHS

Science & Technology Directorate

Version 1.0 Release Date: 12/29/2015

THE ATTACHED MATERIALS CONTAIN DEPARTMENT OF HOMELAND SECURITY

INFORMATION THAT IS “FOR OFFICIAL USE ONLY”, OR OTHER TYPES OF

SENSITIVE BUT UNCLASSIFIED INFORMATION REQUIRING PROTECTION AGAINST

UNAUTHORIZED DISCLOSURE. THE ATTACHED MATERIALS MUST BE HANDLED

AND SAFEGUARDED IN ACCORDANCE WITH DHS MANAGEMENT DIRECTIVES

GOVERNING PROTECTION AND DISSEMINATION OF SUCH INFORMATION.

AT A MINIMUM, THE ATTACHED MATERIALS WILL BE DISSEMINATED ONLY ON A

“NEED-TO-KNOW” BASIS AND WHEN UNATTENDED, MUST BE STORED IN A

LOCKED CONTAINER OR AREA OFFERING SUFFICIENT PROTECTION AGAINST

THEFT, COMPROMISE, INADVERTANT ACCESS, AND UNAUTHORIZED

DISCLOSURE.

Table of Contents 1 INTRODUCTION/Background

1.1 Purpose and Scope

1.2 Points of Contact

1.3 Project References

1.4 Glossary

2 DATA MANAGEMENT and SYSTEM DISPOSITION

2.1 Access

2.2 Secure Data Transfer

2.3 Data Retention

2.4 Audit

2.5 Notifications

2.6 Purging Requirements

3 Appendix A – Acronyms and selected word definitions 4 Appendix B – Certifcate of data destruction

1 INTRODUCTION/BACKGROUND

The TBD Data Handling and Disposal Guide is established to provide data usage guidelines for the firms’ employees while engaged in contract TBD with DHS Science and Technology. This guide is a component of the policies and procedures in place to provide information security to the DHS Science & Technology (S&T) Data Analytics Engine (DA-E) program.

1.1 Purpose and Scope

This document is to ensure proper management and disposition of DHS data sets that S&T provides to the contractor for test and evaluation purposes. The policies and procedures established in this document apply to all DHS provided data including but not limited to, personally identifiable information (PII), Sensitive Security Information (SSI), Sensitive but Unclassified (SBU) and Critical Infrastructure Information (CII).

1.2 Points of Contact

Points of contact for disposition of this data include:

Stephen Dennis Director, HSARPA Data Analytics Engine DHS Science & Technology Directorate (DHS S&T) Homeland Security Advanced Research Programs Agency (HSARPA)

(202) 254-5788 stephen.dennis@hq.dhs.gov

James Younger Information Systems Security Officer (ISSO) Battelle Memorial Institute

(202) 254-6949 James.younger@associates.dhs.gov

1.3 Project References

Contract TBD, hereon referred to as “contract”.

DHS Sensitive System Handbook 4300A NIST Special Publication (SP) 800-53, rev. 4 NIST Special Publication (SP) 800-88 Media Sanitation Guide Homeland Security Systems Engineering & Development Institute, Statement of

Objectives, January 2015 mailto:stephen.dennis@hq.dhs.gov mailto:James.younger@associates.dhs.gov

1.4 Glossary

See Appendix A

2 DATA MANAGEMENT AND SYSTEM DISPOSITION

TBD agrees to manage and dispose of the data per the requirements outlined below in addition to any restrictions or conditions established in accordance with the contract terms and conditions.

2.1 Access

TBD will provide the data only to individuals who have a valid need to know in order to support the requirements of the test as outlined in the TBD contract. TBD shall provide the names and titles of all individuals who will have direct access to the data to DHS S&T. All Offeror’s employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Offeror’s shall maintain signed copies of the NDA for all employees as a record of compliance. The Offeror’s shall provide copies of the signed NDA to DHS no later than two (2) days after execution of the form.

TBD products will ensure that all personnel who handle the data have been trained on the data handling and security requirements provided by DHS S&T as documented in this plan.

2.2 Secure Data Transfer

Data shall be encrypted prior to transport. This includes data transmission to/from DHS

S&T and TDB. DHS data will be encrypted/decrypted using the Air Force Encryption Wizard tool provided by DHS S&T. Any encryption used must be implemented using FIPS 197 Advanced Encryption Standard (AES) algorithms with at least 256 bit encryption that has been validated under FIPS 140-2.

2.3 Data Retention

TBD may retain the data for the length of the period of performance outlined in the contract.

2.4 Audit

TBD shall comply with requests to be audited and provide responses within three business days to requests for data, information, and analysis from the DHS S&T DA-E and DHS management, as directed by the contract.

2.5 Notifications

S&T will provide data disposition dates to applicable parties. S&T will provide both oral and written guidance on data disposition instructions and associated timelines for compliance.

2.6 Purging Requirements

DHS S&T and TBD will purge all data records at the conclusion of the testing periods as established by in the contract. TBD must provide a certificate of data destruction, see Appendix B, providing assurance of purging date and method to DHS S&T. S&T will create a final data disposition report with a complete certification at the end of the testing period.

Data should be purged using methods as outlined in NIST Special Publication 800-88, Guidelines for Media Sanitation and in DHS 4300A , Sensitive System Policy , section

4.3.3 Media Sanitation and Disposal.

3 APPENDIX A – ACRONYMS AND SELECTED WORD DEFINITIONS

Acronym Description

DA-E Data Analytics Engine DHS Department of Homeland Security DHS S&T Department of Homeland Security Science & Technology Directorate FN Foreign National FOUO For Official Use Only HSARPA Homeland Security Advanced Research Projects Agency RFP Request For Proposal SFTP Secure File Transfer Protocol SOO Statement of Objective SOW Statement of Work SSI Sensitive Security Information STA Security Threat Assessment

4 APPENDIX B – CERTIFCATE OF DATA DESTRUCTION

CERTIFICATE OF DATA DESTRUCTION

The undersigned hereby certifies that all copies, both physical and electronic, of the following data that the DHS/ Homeland Security Advanced Research Programs Agency, Science & Technology Directorate provides to TBD on MM/DD/YYYY for test and evaluation support have been destroyed as described below. Description of files to be destroyed:

Data set / File name

Data Medium (physical, electronic)

Method of destruction

Date of destruction

Electronic

Comments:

Submitter:

Please Print or Type Name and Job Position

Signature

Date

Brand Name JA