ECG SOW 70RSAT25RFI000002.pdf

Statement of Work

70RSAT25RFI000002

Department of Homeland Security Science and Technology Directorate

Export Controls Group Support

1.0 GENERAL

1.1 BACKGROUND: EXPORT CONTROLS GROUP (ECG)

The Department of Homeland Security (DHS) is committed to using cutting edge technologies and scientific talent in our quest to make America safer. DHS Science & Technology (S&T) Directorate is tasked with researching and organizing the scientific, engineering, and technological resources of the United States and leveraging these existing resources into technological tools to help protect the homeland. Central to the integrity and advancement of these endeavors is the need to ensure departmental compliance with applicable federal laws, regulations, and guidelines. Support services are required to provide the requisite technical expertise and programmatic assistance to meet this need, with a focus on compliance with multilateral and U.S. export controls, such as the Export Administration Regulations (EAR) administered by the Department of Commerce; the International Traffic in Arms Regulations (ITAR) administered by the Department of State; Office of Foreign Assets Control (OFAC) regulations administered by the Department of Treasury; and various multilateral regimes.

1.2 SCOPE

The scope of this effort will be to support the operation of a centralized, comprehensive export controls compliance program to be managed within S&T, to ensure that all activities conducted or sponsored by the Department shall comply fully with:

• U.S. export control laws and regulations,

• (Surge Position) Intra-Departmental reviews of CFIUS cases.

In fulfilling these oversight functions, the program will also ensure compliance with associated DHS policies and procedures.

This task order is limited to S&T staffing only. Any other activity, such as specific project funding, shall require a different funding vehicle.

2.0 SPECIFIC REQUIREMENTS

Important note for all content under section 2.0: The management structure for the Export Controls Group (ECG) is governed by various federal employees, currently, the ECG Manager, the Export Technical Lead, and the Compliance Assurance Program Office Manager (CAPM). The task order staff will closely support the federal management on all elements discussed in this SOW. All supporting work noted in the SOW is delivered to the federal staff for their review and validation prior to processing for dissemination. The federal staff will give final approvals for all reviews and recommendations conducted by the task order staff.

All task order staff are expected to provide high quality reviews and assignments which do not need significant grammatical, concept-based feedback, or edits from other staff (unless designated to serve in this function) or the federal program managers (PMs) analysis of quality will be conducted on a biannual basis by the applicable team lead or designee. Once cleared to work independently, the rate of error for each contract staff member should be ≤10% for all applicable work products provided to the Federal PMs.

The support services involved in this effort will include support for a centralized, comprehensive assessment program for the DHS export controls compliance and provide policy support in this area, to include:

2.0.1 Providing support to the Government in developing or revising DHS directives, instructions, policies, procedures, guidance, and other information to ensure export controls compliance for activities conducted, sponsored, or funded by DHS.

2.0.2 Support for the identification of DHS activities subject to export controls and assistance in acquiring appropriate project documentation.

2.0.3 Systematic assessment of export control compliance of selected DHS programs, projects, technologies, technical data and/or transactions.

2.0.4 Support the DHS export control compliance databases for all export control reviews.

2.0.5 Support an outreach program to sensitize program managers and researchers to export control compliance requirements.

2.0.6 Provide DHS and/or interagency policy and technical support related to export control issues, questions, and meetings.

2.0.7 (Surge) Provide technical and regulatory support to identify CFIUS transactions that have a nexus with S&T’s mission space, including emerging and foundational technologies with homeland security applications.

3.0 PROGRAM TASKS

3.1 TASK ONE – PROGRAM MANAGEMENT AND ADMINISTRATION

3.1.1 The Contractor shall provide programmatic and task management support to DHS/S&T.

Effectively support a comprehensive DHS export controls compliance program. As a priority, the Contractor shall support the development of the administrative policy, structure, and processes necessary to maintain a DHS compliance program. The Contractor shall support and facilitate DHS program management meetings, maintain communications with compliance offices in other executive departments and agencies as well as external export controls compliance stakeholders in the Federal, academic, non-profit, and private sectors.

3.1.2 (Surge) The Contractor shall provide technical support for DHS/S&T reviews of CFIUS cases.

3.2 TASK TWO – INFORMATION MANAGEMENT

3.2.1 The Contractor shall collect, analyze, track, store, and archive compliance program information through a database and/or other means deemed acceptable by the Government.

3.2.2 The Contractor shall provide information management support, to include development and maintenance of DHS compliance review database(s) for departmental review, meetings, oversight, and administrative recordkeeping.

3.2.3 The Contractor shall develop and then maintain a system to track, manage, audit, and respond to ECG metrics.

3.3 TASK THREE – PROGRAM COMPLIANCE

3.3.1 Contractor shall facilitate DHS efforts to ensure export controls compliance by:

3.3.1.1 Informing program managers and investigators of applicable regulatory compliance issues, federal laws, regulations, and related DHS requirements, policies, and procedures.

3.3.1.2 Providing guidance and support to DHS Components, as well as DHS-sponsored and funded entities, in their efforts to achieve export control compliance.

3.3.1.3 Acquiring relevant information; preparing documentation, including but not limited to self-classification assessments, license requests, commodity jurisdiction determination requests, commodity classification requests, technical assistance agreements, advisory opinion requests, etc.; and maintaining records on DHS conducted, sponsored, or funded activities to ensure export control compliance.

3.3.1.4 Acquiring relevant information, preparing a compliance assessment, and maintaining records on relevant DHS conducted, sponsored, or funded activities in the area of export control compliance.

3.3.1.5 Reviewing activities for export controls compliance in accordance with departmental policy. Contractor shall provide programmatic, policy, and administrative support to relevant DHS staff in fulfilling the export control compliance program task areas.

Contractor shall document compliance review findings for DHS certification and communicate outcomes to program managers as appropriate. When necessary, Contractor shall recommend actions to resolve deficiencies and achieve compliance.

Contractor shall develop, upon request, reports and briefings pertaining to DHS compliance status and activities. Contractor shall serve as the focal point to support export control compliance guidance, requirements, policies, and procedures. Contractor shall develop processes to provide technical and instructional support and products in order to establish and maintain departmental awareness of export control compliance requirements.

3.3.1.6 Maintain export control compliance reviews, related documentation, and databases for relevant DHS conducted, sponsored, or funded activities.

3.4 TASK FOUR – TRAINING AND OUTREACH

3.4.1 Contractor shall develop processes to provide technical and instructional support and products and/or procure training and instructional products in order to establish and maintain departmental awareness of initiatives noted in Scope (section 1.2). Training and outreach programs shall be implemented in accordance with federal regulations, standards, and guidelines.

3.4.2 The Contractor shall support and facilitate outreach and training events to include materials, briefings, instructional media, training programs, curricula, and schedules.

3.4.3 Historical records indicate that ECG conduct approximately 10-20 training and outreach events per year. These events include internal S&T trainings, trainings for other DHS Components, and outreach/trainings to extramural performers of DHS-sponsored work.

3.5 TASK FIVE – POLICY SUPPORT

3.5.1 The Contractor shall support DHS policy development and initiatives in export control compliance areas, including support for DHS participation in interagency and/or international meetings, preparation of briefing materials, technical assessments of commodity jurisdiction requests, support for departmental/other data calls related to export controls compliance, and providing alerts, substantive analysis, and recommendations to address current issues and emerging trends in export.

3.5.2 The Contractor shall generate directives, instructions, guidance, briefing materials, presentations, reports, analysis, meeting notes, and other material to support federal and DHS policies, to include draft, interim, and final documents and related coordination history for Government approval and acceptance.

3.6 TASK SIX - OPTIONAL – SURGE

3.6.1 The ECG has traditionally provided in-depth analysis of technologies with a homeland security nexus including providing export classifications. The ECG has also been the lead for CFIUS reviews for S&T as well as providing expert analysis of technologies to support the Office of Strategy, Policy, and Plans.

3.6.2 Additional funding would be used to support technical analysis and CFIUS reviews. All of these positions require a Top-Secret clearance with SCI eligibility. CFIUS responsibilities require an active TS/SCI.

3.6.3 The technical background and expertise of the SMEs for this effort shall include: senior expert with deep knowledge of export control regulations (ITAR, EAR, OFAC) and technical relevance in export compliance and analysis. Leads complex regulatory and technical analysis of cutting-edge technology and commodity jurisdiction requests. Classifies products, technology, and software per U.S. export regulations; and knowledge and expertise in conducting technology reviews in CFIUS cases.

The labor mix for this effort shall include:

LCAT Hours Functional Specialist Up to 1,880/year Analyst Mid-Level Up to 1,880/year Senior Analyst Up to 3,760/year Senior Project Manager Up to 470/year

4.0 CONTRACTOR PERSONNEL

4.1 CONTINUITY OF SUPPORT

The Contractor shall ensure that the contractually required level of support for this requirement is maintained in accordance with the terms of the task order. The required level of staffing support for this task order is 75%. If the staffing level falls below 75%, then the Contractor shall notify the Contracting Officer’s Representative (COR) and the Government Program Manager(s) (PM). The Contractor shall ensure that all task order support personnel are present for all hours of the workday. If for any reason the Contractor staffing levels are not maintained due to vacation, leave, appointments, etc., and replacement personnel will not be provided, the Contractor shall provide e-mail notification to the COR, and the Federal Program Managers either via e-mail or through an alternate method approved by the COR or Government PMs, prior to employee absence. Otherwise, the Contractor shall provide a fully qualified replacement.

4.2 QUALIFIED PERSONNEL

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW.

Historically, successful completion of these tasks has been achieved with a level of effort of six (6) full time equivalent (FTE) personnel for twelve (12) months. However, recent budgetary constraints require approximately four (4) SME FTEs. Further growth may require the need for additional FTE personnel.

Contractors will require access to DHS classified information and physical spaces. The minimum level of clearance required for contractors is a Secret level Security Clearance, while the highest level of clearance required for contractors is Top Secret and Sensitive Compartmentalized Information (TS-SCI). Some work requires TS-SCI. (Surge) CFIUS reviews require a TS-SCI.

4.3 KEY PERSONNEL

Prior to removing or replacing any of the designated Key Personnel, the Contractor shall notify the CO, COR and the federal lead prior to making any changes in the Key Personnel identified in the proposal and/or assigned to this TO. All substitutions must be submitted in writing to the CO and COR at least fifteen (15) days in advanced of the proposed substitution. All requests for substitution must include a detailed explanation of the circumstances necessitating the proposed substitution. Requests for substitution shall include a complete resume of the proposed substitute and any other information required by the CO or COR that is necessary to approve or disapprove the proposed substitution. The Contractor shall demonstrate that the qualifications of the substitution are equal to or better than the qualifications of the personnel being replaced. The CO and COR will evaluate such requests. The COR will recommend, and the CO will approve or disapprove substitutions and promptly notify the Contractor of the Government decision in writing.

Key personnel designated for this requirement is the team lead for Export Controls who shall be located onsite.

4.3.1 Lead Analyst/Senior Associate (ECG Team Lead)

The Contractor shall provide a Team Lead who shall be responsible for all Contractor work performed under this SOW in the areas of Export Controls. The name of the ECG Team Lead, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the ECG Team Lead, shall be provided to the Government as part of the Contractor's proposal. The ECG Team Lead is further designated as Key by the Government. During any absence of the ECG

Team Lead, only one alternate shall have full authority to act for the Contractor on all matters relating to ECG work performed under this task order. The ECG Team Lead and all designated alternates shall be able to read, write, speak, and understand English.

4.4 EMPLOYEE IDENTIFICATION

4.3.1 Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

4.3.2 Contractor employees working on-site at Government facilities shall wear a Government issued identification badge. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent (in meetings, when answering Government telephones, in e-mail messages, etc.) and display the Government issued badge in plain view above the waist at all times.

4.3.3 Personal Identity Verification (PIV) Credentials and Identification Badges Contractor employees shall be required to always wear Department approved Personal Identity Verification (PIV) credentials/identification badges when working in Government facilities.

The Homeland Security Presidential Directive 12 (HSPD-12) requires the use of the Personal Identity Verification (PIV) credentials as the common means of authentication for access to DHS facilities, networks, and information systems. PIV credentials shall be used as the primary means of logical authentication for DHS sensitive systems. The Contractor must use his or her federal issued PIV credentials to access DHS resources to include IT applications and physical facility.

The DHS Security Office shall be notified of all terminations/resignations within five (5) days of occurrence. The Contractor shall return to the Contracting Officer Representative (COR) all DHS issued Personal Identity Verification (PIV) credentials/identification cards and building passes that have either expired or have been collected from terminated employees. If a PIV credential/identification card or building pass is not available to be returned, a report shall be submitted to the COR, referencing the PIV credential, pass or card number, name of individual to who it was issued and the last known location and disposition of the PIV credential, pass or card.

4.5 EMPLOYEE CONDUCT

Contractor’s employees shall comply with all applicable Government regulations, policies, and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of DHS uniforms, and possession of weapons) when visiting or working at Government facilities.

The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Department of Homeland Security. The Program Manager shall ensure Contractor employees understand and abide by Department of Homeland Security established rules, regulations, and policies concerning safety and security.

5.0 OTHER APPLICABLE CONDITIONS

5.1 Technical Direction

Performance of work under this task order shall be subject to the technical direction of the COR. The term “Technical Direction” is defined to include, without limitation, the following: (a) Directions to the Contractor which redirect the task order effort, shift work emphasis between work areas of tasks, require pursuit of certain lines of inquiry, fill in details or otherwise serve to accomplish contractual statement of work. (b) Provision of information to the Contractor that assists in the interpretation of drawings, specifications, or technical portions of the work description. (c) Review and, where required by the task order, approval of technical reports, drawings, specifications, and technical information to be delivered by the Contractor to the Government under the task order.

Technical direction must be within the general scope of work stated in the task order. The COR does not have authority to and may not issue any technical direction which (i) constitutes an assignment of additional work outside the general scope of the task order; (ii) constitutes a change as defined in the task order clause entitled “Changes” (FAR 52.243-1); (iii) in any manner cause an increase or decrease in the total task order cost or price, the fixed fee or the time required for task order performance; or (iv) changes any of the expressed terms, conditions, or specifications of the task order. All technical direction shall be issued in writing by the COR or shall be confirmed in writing within five (5) working days after issuance.

The Contractor shall proceed promptly with the performance of technical directions duly issued by the COR in the manner prescribed by this article. If, in the opinion of the Contractor, any instruction or direction issued by the COR is within one of the categories and defined in (i) through (iv) above, the Contractor shall not proceed but shall notify the CO in writing within five (5) working days after the receipt of any instruction or direction and shall request the CO to modify the task order accordingly. Upon receiving such notification from the Contractor, the CO shall issue an appropriate task order modification or advise the Contractor in writing that, in his/her opinion, the technical direction is within the scope of the task order. The Contractor shall thereupon proceed immediately with the direction given. A failure of the parties to agree upon the nature of the instruction or direction or upon the task order action to be taken with respect thereto shall be subject to the provisions of the task order clause titled, “Disputes” (FAR 52.233-1).

5.2 NON-DISCLOSURE AGREEMENT

Contractor shall sign "DHS Non- Disclosure Agreement DHS Form 11000-6 (08-04)" and/or "SF 312- Classified Information Nondisclosure Agreement (01-00)," upon award of Task Order, for all Contractor personnel assigned to this effort. Contracting Officer’s Representative (COR) shall make the determination as to which NDA will be signed.

5.3 SECURITY

5.3.1. Special Security Requirements- Contractor Pre-screening. Contractors requiring recurring access to Government facilities or access to sensitive but unclassified (SBU) information and/or logical access to Information Technology (IT) resources shall verify minimal fitness requirements for all persons/candidates designated for employment under any Department of Homeland Security (DHS) task order by prescreening the person/candidate prior to submitting their name for consideration to work on the task order. Pre- screening the candidate ensures that minimum fitness requirements are considered and mitigates the burden of DHS having to conduct background investigations on objectionable candidates.

The Contractor shall submit only those candidates that have not had a felony conviction within the past 36 months, illegal drug use within the past 12 months, or misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months from the date of submission of their name as a candidate to perform work under this task order. Contractors are required to follow this requirement down to subcontractors. Pre-screening involves contractors and subcontractors reviewing. Felony convictions within the past 36 months. An acceptable means of obtaining information on felony convictions is from public records, free of charge, or from the National Crime Information Center (NCIC). Illegal drug use within the past 12 months.

An acceptable means of obtaining information related to drug use is through employee self-certification, by public records check; or if the contractor or subcontractor already has drug testing in place. There is no requirement for contractors and/or subcontractors to initiate a drug testing program if they do not have one already in place. Misconduct such as criminal activity on the job relating to fraud or theft within the past 12 months. An acceptable means of obtaining information related to misconduct is through employee self-certification, by public records check, or other reference checks conducted in the normal course of business. Pre-screening shall be conducted within 15 business days after task order award. This requirement shall be placed in all subcontracts if the subcontractor requires routine physical access, access to sensitive but unclassified.

5.3.2. Access to DHS Facilities and Resources

DHS may exercise full control over granting, denying, withholding, or terminating unescorted access to DHS facilities, DHS systems, and/or sensitive DHS information for government/task order employees. Access will be based upon the results of a DHS fitness/suitability investigation. DHS may, as appropriate, make favorable entry of duty (EOD) decision based on preliminary security checks. The favorable EOD decision would allow the government/task order employee to commence work temporarily prior to the completion of the full investigation.

The granting of a favorable EOD decision shall not be considered as assurance that a full DHS fitness/suitability authorization will follow. The granting of a favorable EOD decision or a full DHS fitness/suitability authorization determination shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by DHS, at any time during the term of the contract/task order. No employee of the government/contractor shall be allowed unescorted access to a DHS facility, access to any sensitive DHS information, or access to DHS Systems without a favorable EOD decision or DHS fitness/suitability determination by the DHS HQ Office of Security. Government/contract employees assigned to the contract/task order not needing access to sensitive DHS information, DHS systems, or access to DHS facilities will not be subject to DHS fitness/suitability screening.

Government/contract employees waiting on an EOD decision may not begin work on the task order. Limited access to DHS facilities is allowable prior to the EOD decision if the government/contract employee is escorted by an approved DHS employee. This limited access is to allow government/contract employees to attend briefings, nonrecurring meetings, and begin transition work. During one’s limited access the government/contract employee will not have access to sensitive or classified DHS information.

Classified information is government information which requires protection in accordance with Executive Order 13526, National Security Information (NSI) as amended and supplemental directives. If the government/contract employee has access to classified information at a DHS owned or leased facility, it shall comply with the security requirements of DHS and the facility.

If the government/contract employee is required to have access to classified information at another Government Facility, it shall abide by the requirements set forth by the agency.

5.3.3. Additional Guidance Contractor access to classified information and physical spaces is required under this SOW. The details will be provided in a Department of Defense (DD) Form 254. DD Form 254- "Contract Security Classification Specification" requirement of TS-SCI. No safeguarding of classified information is required at the Contractor’s site. Access to all classified information will occur at DHS facilities only.

FAR clause 52.204-2 Security Requirements Clause (prescribes requirements, restrictions, and other safeguards that are necessary to prevent unauthorized disclosure of classified information and to control authorized disclosure of information released by the U.S. Government Executive Branch Departments and Agencies to their Contractors; the proscribed federal guidance is the National Industrial Security Program Manual [NISPOM]).

Some DHS projects are classified, and Sensitive Compartmentalized Information (SCI) materials, discs and documents need to be reviewed for Export Control. Therefore, the highest level of clearance contractors will require access to is TS-SCI. The DD Form 254 will include this requirement. The SCI material will be handled at Government controlled environments.

Contractors will require access DHS classified information and physical spaces. Requests for those personnel requiring TS-SCI clearance shall be submitted to the COR. They will be approved on a case-by-case basis with appropriate justification prior to submitting the required documentation to the COR for submission to DHS Security Office for clearance nomination.

The COR and/or CO will process a DD-254 and any required documentation to DHS Security Office as required.

5.4 SAFEGUARDING OF SENSITIVE INFORMATION

The S&T Privacy Office, Office of the Chief Information Officer, and the Office of the Chief Security Office require the of FAR 52.224-3 Privacy Training – Alternate I (DEVIATION) (see FAR Class Deviation 17-03, Revision 1); and Information Technology Security Awareness Training (July 2023).

5.4.1.Applicability. This clause applies to the awardee and its contractors, its subcontractors, and their employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

5.3.2 Definitions.

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case- by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107- 296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

5.3.3. Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year) http://www.dhs.gov/dhs-security-and-training-requirements-contractors

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessibleathttp://csrc.nist.gov/groups/STM/cmvp/standards.html National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html.

(10) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html.

5.3.4 Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information.

DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources.

The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the task order.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the task order, as needed.

5.3.5 Authority to Operate. The Contractor shall not input, store, process, output, and/or transmit sensitive information within a Contractor IT system without an Authority to Operate (ATO) signed by the Headquarters or Component CIO, or designee, in consultation with the Headquarters or Component Privacy Officer. Unless otherwise specified in the ATO letter, the ATO is valid for three years. The Contractor shall adhere to current Government policies, procedures, and guidance for the Security Authorization (SA) process as defined below.

(1) Complete the Security Authorization process. The SA process shall proceed according to the

DHS Sensitive Systems Policy Directive 4300A (Version 11.0, April 30, 2014), or any successor publication, DHS 4300A Sensitive Systems Handbook (Version 9.1, July 24, http://csrc.nist.gov/groups/STM/cmvp/standards.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html

2012), or any successor publication, and the Security Authorization Process Guide including templates.

(i) Security Authorization Process Documentation. SA documentation shall be developed using the Government provided Requirements Traceability Matrix and Government security documentation templates. SA documentation consists of the following: Security Plan, Contingency Plan, Contingency Plan Test Results, Configuration Management Plan, Security Assessment Plan, Security Assessment Report, and Authorization to Operate Letter.

Additional documents that may be required include a Plan(s) of Action and Milestones and Interconnection Security Agreement(s).

During the development of SA documentation, the Contractor shall submit a signed SA package, validated by an independent third party, to the COR for acceptance by the Headquarters or Component CIO, or designee, at least thirty (30) days prior to the date of operation of the IT system. The Government is the final authority on the compliance of the SA package and may limit the number of resubmissions of a modified SA package. Once the ATO has been accepted by the Headquarters or Component CIO, or designee, the Contracting Officer shall incorporate the ATO into the task order as a compliance document. The Government’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the IT system controls are implemented and operating effectively.

(ii) Independent Assessment. Contractors shall have an independent third party validate the security and privacy controls in place for the system(s). The independent third party shall review and analyze the SA package, and report on technical, operational, and management level deficiencies as outlined in NIST Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations. The Contractor shall address all deficiencies before submitting the SA package to the Government for acceptance.

(iii) Support the completion of the Privacy Threshold Analysis (PTA) as needed. As part of the SA process, the Contractor may be required to support the Government in the completion of the PTA. The requirement to complete a PTA is triggered by the creation, use, modification, upgrade, or disposition of a Contractor IT system that will store, maintain and use PII, and must be renewed at least every three (3) years. Upon review of the PTA, the DHS Privacy Office determines whether a Privacy Impact Assessment (PIA) and/or Privacy Act System of Records Notice (SORN), or modifications thereto, are required. The Contractor shall provide all support necessary to assist the Department in completing the PIA in a timely manner and shall ensure that project management plans and schedules include time for the completion of the PTA, PIA, and SORN (to the extent required) as milestones.

Support in this context includes responding timely to requests for information from the Government about the use, access, storage, and maintenance of PII on the Contractor’s system, and providing timely review of relevant compliance documents for factual accuracy.

Information on the DHS privacy compliance process, including PTAs, PIAs, and SORNs, is accessible at http://www.dhs.gov/privacy-compliance.

(2) Renewal of ATO. Unless otherwise specified in the ATO letter, the ATO shall be renewed every three (3) years. The Contractor is required to update its SA package as part of the ATO renewal process. The Contractor shall update its SA package by one of the following methods: (1) Updating the SA documentation in the DHS automated information assurance tool for acceptance by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls; or (2) Submitting an updated SA package directly to the COR for approval by the Headquarters or Component CIO, or designee, at least 90 days before the ATO expiration date for review and verification of security controls. The 90-day review process is independent of the system production date and therefore it is important that the Contractor build the review into project http://www.dhs.gov/privacy-compliance schedules. The reviews may include onsite visits that involve physical or logical inspection of the Contractor environment to ensure controls are in place.

(3) Security Review. The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this task order are being implemented and enforced. The Contractor shall afford DHS, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this task order. The Contractor shall, through the Contracting Officer and COR, contact the Headquarters or Component CIO, or designee, to coordinate and participate in review and inspection activity by Government organizations external to the DHS. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of Government data or the function of computer systems used in performance of this task order and to preserve evidence of computer crime.

(4) Continuous Monitoring. All Contractor-operated systems that input, store, process, output, and/or transmit sensitive information shall meet or exceed the continuous monitoring requirements identified in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The plan is updated on an annual basis. The Contractor shall also store monthly continuous monitoring data at its location for a period not less than one year from the date the data is created. The data shall be encrypted in accordance with FIPS 140-2 Security Requirements for Cryptographic Modules and shall not be stored on systems that are shared with other commercial or Government entities. The Government may elect to perform continuous monitoring and IT security scanning of Contractor systems from Government tools and infrastructure.

(5) Revocation of ATO. In the event of a sensitive information incident, the Government may suspend or revoke an existing ATO (either in part or in whole). If an ATO is suspended or revoked in accordance with this provision, the Contracting Officer may direct the Contractor to take additional security measures to secure sensitive information. These measures may include restricting access to sensitive information on the Contractor IT system under this task order. Restricting access may include disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

(6) Federal Reporting Requirements. Contractors operating information systems on behalf of the

Government or operating systems containing sensitive information shall comply with Federal reporting requirements. Annual and quarterly data collection will be coordinated by the Government. Contractors shall provide the COR with requested information within three (3) business days of receipt of the request. Reporting requirements are determined by the Government and are defined in the Fiscal Year 2014 DHS Information Security Performance Plan, or successor publication. The Contractor shall provide the Government with all information to fully satisfy Federal reporting requirements for Contractor systems.

5.3.5. Sensitive Information Incident Reporting Requirements.

(1) All known or suspected sensitive information incidents shall be reported to the Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the Headquarters or Component SOC, the Contractor shall also notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-CERT using the contact information identified in the task order. If the incident is reported by phone or the Contracting Officer’s email address is not immediately available, the Contractor shall contact the Contracting Officer immediately after reporting the incident to the Headquarters or Component SOC. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email.

Passwords shall not be communicated in the same email as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information or has otherwise failed to meet the requirements of the task order.

(2) If a sensitive information incident involves PII or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Data Universal Numbering System (DUNS);

(ii) Task order numbers affected unless all task orders by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award

Management (address, position, telephone, email);

(v) Contracting Officer POC (address, telephone, email);

(vi) Task order clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(xiii) Government programs, platforms or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where sensitive information resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the Government PII and/or SPII contained within the system;

(xiii) Number of people potentially affected, and the estimate or actual number of records exposed and/or contained within the system; and

(xiv) Any additional information relevant to the incident.

5.3.6. Sensitive Information Incident Response Requirements.

(1) All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation with the Headquarters or Component CIO and Headquarters or Component Privacy Officer.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

(3) Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(i) Inspections,

(ii) Investigations,

(iii) Forensic reviews, and

(iv) Data analyses and processing.

(4) The Government, at its sole discretion, may obtain the assistance from other Federal agencies and/or third-party firms to aid in incident response activities.

5.3.7. Additional PII and/or SPII Notification Requirements.

(1) The Contractor shall have in place procedures and the capability to notify any individual whose PII resided in the Contractor IT system at the time of the sensitive information incident not later than 5 business days after being directed to notify individuals, unless otherwise approved by the Contracting Officer.