EPDS SOW_CLEAN 21AUG2024.docx

U.S. Immigration and Customs Enforcement (ICE)

Electronic Policy Development System Statement of Work (SOW)

Office of the Chief Information Officer (OCIO)

August 2024 Washington, DC

Procurement Sensitive. This document is confidential and intended solely for the use and information of the company to whom it is addressed.

Contents

i

GENERAL

1.1 Background Comment by Smith, Rosson C: Reviewed, concur with CAPT Brooks.

Immigration and Customs Enforcement ICE Health Service Corps (IHSC) administers direct care to approximately 16,500 detainees housed at 20 designated facilities throughout the nation to include medical, dental, mental health care, and public health services. IHSC-staffed facilities utilize applicable health care standards drawn from the American Correctional Association (ACA), the National Commission on Correctional Health Care (NCCHC), and ICE National Performance-Based Detention Standards to ensure that quality care is provided to ICE detainees. These standards support the IHSC’s internal quality improvement program.

The IHSC Office of Policy (IOP) supports IHSC business operations to and promotes coordination across the agency andto meet the IHSC mission. The IHSC policy team manages the life cycle of 170+ policy documents from development, through review, approval, publication and distribution, maintenance, and training. The policy must be organized into a logical plan from beginning to end, and each sentence, paragraph, and heading should do the same. In coordination with the IHSC Communications Unit, tThe IHSC policy team ensures a logical flow of information; reviews the document for information flow, clarity of the policy statement, responsibilities, and procedures,; and ensures document readability through proper use of sentence structure, active voice, common language, spelling, grammar, punctuation, capitalization, acronyms, web-based links, and pagination. The policy document must be routed through several layers of review and approval before the final version is prepared for signature.

1.2 Scope

The IOP requires a web-based and paperless policy development, distribution, compliance management, and archiving system and service. The intent of this electronic policy development system (ePDS) is to streamline the review and approval workflows of documents in development, increase the integrity of the policy documents, promote consistent formats, allow for collaboration between reviewers, and avoid duplicative or conflicting information, specifically for correctional health care standards. The milestones (develop, review, approve, sign, publish, train, archive) in the policy process are critical for effective and efficient IHSC business operations and compliance with accreditation standards for correctional health.

1.3 Objective

The primary objective of the ePDS is to automate and streamline the policy lifecycle to improve efficiency, accuracy, and productivity.

1.4 Reference Documents

The following documents may be helpful to the Contractor in performing the work described in this document:

1.4.1 IHSC Policy Management (IHSC Directive 11-05)

1.4.2 IHSC Policy Development and Review Guide (IHSC Guide 11-05 G-01)

2 SPECIFIC REQUIREMENTS/TASKS

2.1 TASK ONE. General

2.1.1 The Contractor shall complete site creation, training, and configuration within 30 days of purchase (Deliverable 10), if applicable. Comment by Moulder, Lauren: Should this be added in the deliverables table? Comment by Klueter, David: I would vote 'yes' to inclusion as a deliverable. 180 days seems like a long time. Is that acceptable? Comment by Katz, Laura E: @Brooks, Aisha K Updated for IOP’s consideration. Comment by Aisha K Mix: Concur with update.

2.1.2 The Contractor shall create and configure a web-based system with mobile access based on IHSC’s desired policy workflow processes (see IHSC Guide 11-05 G-01, Appendix B: Policy Development Workflow). The system shall meet the following credentials:

2.1.2.1 FISMA compliance,

2.1.2.2 FedRAMP compliance,

2.1.2.3 508 compliance, and

2.1.2.4 Support eGov initiative.

2.1.3 The Contractor shall ensure system availability.

2.1.3.1 The Contractor shall provide a logical test process that minimizes interruptions and avoids sustained downtime and presents a contingency procedure to be implemented in the event of systems failure during testing.

2.1.3.2 The Contractor shall ensure that the system has “offline” functionality in the event the network resources or server is inaccessible.

2.1.3.3 During the installation/test phase, the Government reserves the right to perform any of the Contractor performed inspections and tests to assure solutions conform to prescribed requirements. The Contractor shall be responsible for documenting deficiencies and tracking them until they are resolved. The Government will not be expensed for correcting deficiencies that were the direct result of the Contractor’s mistakes.

2.1.3.4 In the event the system or application has not met the availability rate of 97% after 60 calendar days, the Government reserves the right to require replacement of the component(s) adversely affecting the availability rate at no additional cost. Comment by Katz, Laura E: @Brooks, Aisha K What is the required availability rate? Comment by Aisha K Mix: I suggest 97%. The document contains standard SOW language so we had not discussed this previously. If my suggestion is not appropriate; please advise or let me know what questions to consider.

2.1.4 The Contractor will provide customer support and assistance via an IT Help Desk, Monday through Friday, from 8:00 AM – 6:00 PM ET, except Federal holidays.

2.2 TASK TWO. Access to standards and performance indicators

The ePDS shall have immediate access to up-to-date correctional health care standards and performance indicators.

2.2.1 The system shall provide access to NCCHC correctional health standards and ICE Performance Based National Detention Standards (PBNDS).

2.2.2 The system shall allow for digital comparisons of standards and performance indicators with IHSC source documents.

2.2.3 The system shall include an internal library of standards and performance indicators to ensure consistent use of language by document authors.

2.3 TASK THREE. Document management

The ePDS shall have the capacity to handle parallel and simultaneous/concurrent document reviewers throughout the document life cycle and at multiple geographic locations.

2.3.1 Development

2.3.1.1 The system shall have a configurable workflow engine that controls the timely flow of collaboration from draft development through review to final approval and signature.

2.3.1.2 The system shall enable policy coordinators (e.g., in each IHSC unit and program) to manage the assignment, due dates, and comment consolidation within their unit or program and require that they do so within the parameters established by the IHSC Office of PolicyIOP.

2.3.2 Review

2.3.2.1 The system shall allow for concurrent review where visible edits and comments can be conducted on multiple, unique documents at the various stages of their life cycle and hierarchy of review.

2.3.2.2 The system shall allow for authors and reviewers to have clear visibility of their comments and recommended changes to the document.

2.3.2.3 The system shall present the principal author with a set of final comments that have been vetted at each level of the review hierarchy and allow the principal author to respond to and resolve issues and proposed changes.

2.3.3 Publishing

2.3.3.1 The system shall possess a robust search engine capable of searching by document title, number, date issued, review date, responsible office, and free text search capability.

2.3.3.2 The system shall provide an automated means for browsing, searching, and retrieving IHSC policies online from a repository of the archived, draft, and current directives and associated documentation.

2.3.3.3 The system shall provide access to an online content management system that can be customized to send final documents and associated records and references and is accessible to IHSC staff through the ICE intranet.

2.4 TASK FOUR. Metrics

2.4.1 The system shall provide configurable and pre-defined reports that provide access to reviewer assignments, due dates, completion status, and comments during the review process.

2.4.2 The system shall provide process analysis, performance metrics, and process status reporting tools designed to evaluate the effectiveness of the policy development and implementation processes.

2.5 TASK FIVE. Quality Control

The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this SOW.

The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The system shall include quality control measures to maintain the integrity of the document through its life cycle.

2.5.1 The system shall allow for an electronic signature upon approval.

2.5.2 The system shall maintain version control.

2.5.3 The system shall have the ability for notifications to be customized and scheduled.

2.5.3.1 The system shall provide alerts for expiring or expired documents, with options to archive, revise, or to review and reset the effective date with no changes. Comment by Lim, Christopher: Does this mean no revisions or archiving? Comment by Katz, Laura E: @Brooks, Aisha K please consider clarifying (… reset the effective date with 1. no changes, 2. revise, or 3. archive.) Comment by Aisha K Mix: Language updated. Even if there are no changes, the system must capture that a review was completed. The most recent review date is captured on the document.

2.5.3.2 The system shall track documents and alert the policy administrator, principal author, and other selected users of the document status, upcoming milestones, and past due assignments.

2.5.3.3 The system shall automatically remind/notify users when a document is ready for review or comment.

2.5.4 The system shall have the ability to expire published documents, remove them from public access, and place them in the policy administrator’s queue for resolution or archive. Public access refers to visibility by IHSC staff.

2.5.5 The Contractor shall provide access for read-only and username/password authentication.

2.6 TASK SIX. Training

2.6.1 The Contractor shall provide access to online, self-paced training, and user guides (Deliverable 9). Comment by Moulder, Lauren: Do these need to have specific timelines since they are in the deliverables table? Or a general within 180 days as specified above for training and site creation? Comment by Katz, Laura E: Deliverables table updated to reflect frequency/due by date or similar

2.6.2 The Contractor shall provide remote, instructor-led training for system users as part of the onboarding process of the ePDS (Deliverable 10).

2.6.3 The Government may require the vendor conduct additional training as a result of substantial upgrade to existing software modules, with significant functionality changes (Deliverable 8).

2.6.4 The Contractor shall provide a schedule of remote, instructor-led training events no less than one month in advance of trainings (Deliverable 7) Comment by Katz, Laura E: @Brooks, Aisha K please edit as needed. Comment by Aisha K Mix: Accurate as written. Comment by Katz, Laura E: @Brooks, Aisha K for your consideration; please revise/remove if not needed. Comment by Aisha K Mix: Concur as written

3.0 CONTRACTOR PERSONNEL

3.1 Qualified Personnel

The Contractor shall provide qualified personnel to perform all requirements specified in this SOW. Comment by Lim, Christopher: Suggest adding contractor provide proof of qualifications via biographical sketches or resume attachments. Comment by Katz, Laura E: See 3.3 for substitutions. Otherwise, can be part of eval criteria/proposal

3.2 Continuity of Support

Before replacing any individual designated as Key by the Government, the Contractor shall notify the Contracting Officer no less than 15 business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute(s). All proposed substitutes shall possess qualifications equal to or superior to those of the Key Personnel being replaced unless otherwise approved by the Government. The Contractor shall not replace Key Contractor personnel without approval from the Contracting Officer.

The following Contractor personnel are designated as Key for this requirement. Note: The Government may designate additional Contractor personnel as Key at the time of the award.

· Project Manager

· System Administrator

· System Trainer

3.3.1 Project Manager

3.3.1.1 The Contractor shall provide a Project Manager who shall be a single point of contact for the Contracting Officer and the COR and who is responsible for all Contractor work performed under this SOW. Additionally, the Contractor shall not replace the Project Manager without prior approval from the Contracting Officer.

3.3.1.2 The Project Manager shall be available to the Project Lead and COR via telephone between the hours of 8:00 AM and 6:00 PM ET, Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within 48 hours of notification.

3.3.1.3 The name of the Project Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Project Manager, shall be provided to the Government as part of the Contractor’s proposal.

3.3.1.4 During any absence of the Project Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract.

3.3.1.5 The Project Manager and all designated alternates shall be able to read, write, speak, and understand English.

3.3.2 System Administrator

3.3.2.1 The Contractor shall provide a system administrator who serves as the technical lead and analyzes IHSC business requirements to inform development and administration of the ePDS.

3.3.2.2 The system administrator shall have working knowledge of the IHSC Policy Development Workflow.

3.3.3 System Trainer

3.3.3.1 The Contractor shall identify a system trainer who serves as an instructor for IHSC personnel and coordinates tasks identified in Section 2.6 of this document.

3.3.3.2 The system trainer shall have working knowledge of the IHSC Policy Development Workflow.

3.4 Removing Employees for Misconduct or Security Reasons

3.4.1 The Government may, at its sole discretion (via the Contracting Officer), direct the Contractor to remove any Contractor employee for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract.

3.4.2 The Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

3.5 Additional Contractor Requirements

3.5.1 Data Rights

3.5.1.1 The Contractor shall provide to the Government all processes, programs, scripts, operating instructions, databases, system files, documentation, test files and test conditions used to develop each approved system change request.

3.5.1.2 The Contractor shall conduct software security, web services development, web services testing, smart phone or other IT device applications and testing, security layer integration, database clean-up, data wrapping, and data conversion.

3.5.1.3 The Contractor shall provide performance improvement recommendations, identify changes in Government equipment or regulations, and make the recommended performance improvement or equipment changes as requested by the Government.

3.5.1.4 The Contractor shall ensure that all system or application deliverables meet the requirements of DHS and ICE Information Assurance policy. Furthermore, the Contractor shall ensure that personnel performing Information Assurance activities obtain, and remain current with, required technical and/or management certifications.

3.5.1.5 The Contractor shall be advised that for any data that ICE provides to them, ICE establishes that it owns the data, including any data that is processed through the vendor’s application.

4.0

4.1 GENERAL

The United States Immigration and Customs Enforcement (ICE) has determined that performance of the tasks as described in this contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor) have access to sensitive DHS information, and that the Contractor will adhere to the following.

4.2 PRELIMINARY FITNESS DETERMINATION

ICE will exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor applicants/employees, based upon the results of a Fitness screening process. ICE may, as it deems appropriate, authorize and make a favorable expedited preliminary Fitness determination based on preliminary security checks. The preliminary Fitness determination will allow the Contractor employee to commence work temporarily prior to the completion of a Full Field Background Investigation. The granting of a favorable preliminary Fitness shall not be considered as assurance that a favorable final Fitness determination will follow as a result thereof. The granting of preliminary Fitness or final Fitness shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable Fitness determination by the Office of Professional Responsibility (OPR), Personnel Security Division (PSD). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable Fitness determination by OPR PSD. Contract employees are processed under DHS Instruction 121-01-007-001, Personnel Security, Suitability and Fitness Program, dated June 14, 2017, or successor thereto; those having direct contact with Detainees will also have 6 CFR § 115.117 considerations made as part of the Fitness screening process. Sexual Abuse and Assault Prevention Standards implemented pursuant to Public Law 108-79 (Prison Rape Elimination Act (PREA) of 2003)).

4.3 BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporary, part-time and replacement employees) under the contract, needing access to sensitive information and/or ICE Detainees, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through OPR PSD. Contractor applicant/employees are nominated by a Contracting Officer Representative (COR) for consideration to support this contract via submission of the DHS Form 11000-25 and ICE Supplement to the DHS Form 11000-25 to the PSD. This contract shall submit the following security vetting documentation to OPR PSD, through the COR, within 10 days of notification of initiation of an Electronic Questionnaire for Investigation Processing (e-QIP), or successor thereto, in the Office of Personnel Management (OPM) automated on-line system:

1. Standard Form 85P (Standard Form 85PS (with supplement to 85P required for those with direct contact with detainees or armed positions)), “Questionnaire for Public Trust Positions” form completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

2. Signature Release Forms (Three total) generated by OPM e-QIP upon completion of Questionnaire (e-signature recommended/acceptable). Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

3. Electronic fingerprints taken at an approved facility OR two (2) SF 87 Fingerprint Cards (current revision) sent to OPR PSD. Additional information regarding fingerprints will be sent to the Contractor applicant/employee from OPR PSD.

4. Optional Form 306 Declaration for Federal Employment. This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSD. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

5. If occupying PREA designated position: Questionnaire regarding conduct defined under 6 CFR § 115.117 (Sexual Abuse and Assault Prevention Standards). This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSD. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

6. One additional document may be applicable if the Contractor applicant/employee was born abroad. If applicable, the document will be sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSD. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

Contractor employees who have an adequate, current investigation by another Federal Agency may not be required to submit complete security packages; the investigation may be accepted under reciprocity. The questionnaire related to 6 CFR § 115.117 listed above in item 5 will be required for positions designated under PREA.

An adequate and current investigation is one where the investigation was favorably adjudicated within 5 years and not to exceed 7 years, meets the contract risk level requirement, and applicant has not had a break in service of more than two years. (Executive Order 13488 amended under Executive Order 13764/DHS Instruction 121-01-007-01)

Required information for submission of security packet will be provided by OPR PSD at the time of award of the contract. Only complete packages will be accepted by OPR PSD as notified by the COR.

To ensure adequate background investigative coverage, Contractor applicants/employees must currently reside in the United States or its Territories. Additionally, Contractor applicants/employees are required to have resided within the United States or its Territories for three or more years out of the last five (ICE retains the right to deem a Contractor applicant/employee ineligible due to insufficient background coverage). This timeline is assessed based on the signature date of the standard form questionnaire submitted for the applied position. Contractor employees falling under the following situations may be exempt from the residency requirement: 1) work or worked for the U.S. Government in foreign countries in federal civilian or military capacities; 2) were or are dependents accompanying a federal civilian or a military employee serving in foreign countries so long as they were or are authorized by the U.S. Government to accompany their federal civilian or military sponsor in the foreign location; 3) worked as a Contractor employee, volunteer, consultant or intern on behalf of the federal government overseas, where stateside coverage can be obtained to complete the background investigation; 4) studied abroad at a U.S. affiliated college or university; or 5) have a current and adequate background investigation (commensurate with the position risk/sensitivity levels) completed for a Federal or Contractor employee position, barring any break in federal employment or federal sponsorship.

Only U.S. citizens and Legal Permanent Residents are eligible for employment on contracts requiring access to DHS sensitive information unless an exception is granted as outlined under DHS Instruction 121-01-007-001. Per DHS Sensitive Systems Policy Directive 4300A, only U.S. citizens are eligible for positions requiring access to DHS Information Technology (IT) systems or positions that are involved in the development, operation, management, or maintenance of DHS IT systems, unless an exception is granted as outlined under DHS Instruction 121-01-007-001.

4.4 CONTINUED ELIGIBILITY

ICE reserves the right and prerogative to deny and/or restrict facility and information access of any Contractor employee whose actions conflict with Fitness standards contained in DHS Instruction 121-01-007-01, Chapter 3, paragraph 6.B or who violate standards of conduct under 6 CFR § 115.117. The Contracting Officer or their representative can determine if a risk of compromising sensitive Government information exists or if the efficiency of service is at risk and may direct immediate removal of a Contractor employee from contract support.

OPR PSD will conduct periodic reinvestigations every 5 years, or when derogatory information is received, to evaluate continued Fitness of Contractor employees.

The Federal Government is transitioning to Trusted Workforce (TW) 2.0. TW 2.0 is a whole-of-government background investigation reform effort overhauling the personnel vetting process by creating a government-wide system that allows transfer of trust across organizations. All contractor employees will be subjected to the transition and will be enrolled into continuous vetting at a date to be determined and via a to be determined continuous vetting system. Enrollment will include multiple requirements from all personnel and potential changes to processes, procedures, and systems. This contract will comply with all requirements that facilitate the mandated transition to TW 2.0.

4.5 REQUIRED REPORTS

The Contractor will notify OPR PSD, via the COR providing an ICE Form 50-005, Contractor Employee Separation Clearance Checklist, of all terminations/resignations of Contractor employees under the contract within five days of occurrence to the ICEDepartureNotification@ice.dhs.gov group box. The Contractor will return any expired ICE issued identification cards and building passes of terminated/resigned employees to the COR. If an identification card or building pass is not available to be returned, a report must be submitted to the COR referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card. The COR will return the identification cards and building passes to the responsible ID Unit.

The Contractor will report any adverse information coming to their attention concerning Contractor employees under the contract to OPR PSD, via the COR, as soon as possible. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the Contractor employees’ name and social security number, along with the adverse information being reported.

The Contractor will provide, through the COR, a Quarterly Report (on a Microsoft Excel Spreadsheet) containing the names of Contractor employees who are actively serving on their contract. The list shall include the Name, Position and SSN (Last Four) and should be derived from system(s) used for Contractor payroll/voucher processing to ensure accuracy. This list is what ICE Industrial Security uses to reconcile the contract quarterly. CORs will submit reports to PSD-Industrial-Security@ice.dhs.gov no later than the 10th day of each January, April, July and October.

Contractors, who are involved with management and/or use of information/data deemed “sensitive” to include ‘law enforcement sensitive” are required to complete the DHS Form 11000-6-Sensitive but Unclassified Information Non-Disclosure Agreement (NDA) for Contractor employee access to sensitive information. The NDA will be administered by the COR to all contract personnel within 10 calendar days of the entry on duty date. The completed form shall remain on file with the COR for purpose of administration and inspection.

Sensitive information as defined under the Computer Security Act of 1987, Public Law 100-235 is information not otherwise categorized by statute or regulation that if disclosed could have an adverse impact on the welfare or privacy of individuals or on the welfare or conduct of Federal programs or other programs or operations essential to the national interest. Examples of sensitive information include personal data such as Social Security numbers; trade secrets; system vulnerability information; pre-solicitation procurement documents, such as statements of work; and information pertaining to law enforcement investigative methods; similarly, detailed reports related to computer security deficiencies in internal controls are also sensitive information because of the potential damage that could be caused by the misuse of this information. All sensitive information must be protected from loss, misuse, modification, and unauthorized access in accordance with DHS Management Directive 11042.1, DHS Policy for Sensitive Information and ICE Policy 4003, Safeguarding Law Enforcement Sensitive Information.”

Any unauthorized disclosure of information will be reported to ICE.ADSEC@ice.dhs.gov.

4.6 SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OPR PSD through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OPR shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract, the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken to effect compliance with such requirements.

4.7 INFORMATION TECHNOLOGY SECURITY

When sensitive government information is processed on Department telecommunications and automated information systems, the contract company agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS MD 4300.1, Information Technology Systems Security (or its replacement). Contractor employees must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractor employees who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, regardless if the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

4.8 INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

In accordance with Office of the Chief Information Officer (OCIO) requirements and provisions, all Contractor employees accessing Department IT systems or processing DHS sensitive data via an IT system will require an ICE issued/provisioned Personal Identity Verification (PIV) card. Additionally, Cybersecurity Awareness Training (CSAT) will be required upon initial access and annually thereafter. CSAT training will be provided by the appropriate component agency of DHS.

Contractor employees, who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices, systems rules of behavior, to include Unauthorized Disclosure Training, available on the ICE Training System (ITS) or by contacting ICE.ADSEC@ice.dhs.gov. Contractor employees with significant security responsibilities shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties. System Administrators should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

1. OTHER APPLICABLE CONDITIONS

5.0

5.1 PERIOD OF PERFORMANCE

The period of performance for this contract is a one-year base period with four one-year option periods as follows:

5.2 PLACE OF PERFORMANCE

The primary place of performance will be the Contractor’s facilities.

5.3 HOURS OF OPERATION

The Contractor will provide access to the Service Desk Monday through Friday from 8:00 AM – 6:00 PM ET, except Federal holidays.

Recognized Holidays: Unless required under the terms of the contract or authorized by the contracting officer, the Contractor shall not work on any of the following holidays and the Government observed legal holidays: New Year’s Day; Martin Luther King, Jr. Birthday; Washington’s Birthday; Memorial Day; Juneteenth National Independence Day; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; and Christmas Day.

5.4 TRAVEL

Contractor travel shall not be required for this requirement.

5.5 POST AWARD CONFERENCE

The Contractor shall attend a Post Award Conference (Deliverable 1) with the Contracting Officer and the COR no later than 10 business days after the date of award. The purpose of the Post Award Conference, which will be chaired by the Contracting Officer, is to discuss technical and contracting objectives of this contract and review the Contractor's draft project plan. The Post Award Conference will be held at the Government’s facility, located at 500 12th Street Southwest, Washington, DC, or via teleconference.

5.6 PROJECT PLAN

The Contractor shall provide a draft Project Plan (Deliverable 2) at the Post Award Conference for Government review and comment. The Contractor shall provide a final Project Plan (Deliverable 3) to the COR not later than 10 business days after the Post Award Conference. Comment by Lim, Christopher: Add Project Plan to 17.0 DELIVERABLES table. Comment by Katz, Laura E: Listed, reference updated

5.7 BUSINESS CONTINUITY PLAN

The Contractor shall prepare and submit a Business Continuity Plan (BCP) to the Government. The BCP Plan shall be due 10 business days after the date of award (Deliverable 4) and will be updated on an annual basis (Deliverable 5). The BCP shall document Contractor plans and procedures to maintain support during an emergency, including natural disasters and acts of terrorism. The BCP, at a minimum, shall include the following: Comment by Lim, Christopher: Add BCP to 17.0 DELIVERABLES table. Comment by Katz, Laura E: Listed, reference updated

· A description of the Contractor’s emergency management procedures and policy

· A description of how the Contractor will account for their employees during an emergency

· How the Contractor will communicate with the Government during emergencies

· A list of primary and alternate Contractor points of contact, each with primary and alternate:

· Telephone numbers

· E-mail addresses

5.7.1 Individual BCPs shall be activated immediately after determining that an emergency has occurred, shall be operational within 12 hours of activation or as directed by the Government, and shall be sustainable until the emergency is resolved and normal conditions are restored, or the contract is terminated, whichever comes first. In case of a life-threatening emergency, the COR shall immediately contact the Contractor Project Manager to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal operations occurs, the Contractor Project Manager and COR shall promptly open an effective means of communication and verify:

· Key points of contact (Government and Contractor)

· Temporary work locations (alternate office spaces, telework, virtual offices, etc.)

· Means of communication available under the circumstances (e.g., email, webmail, telephone, FAX, courier, etc.)

· Essential Contractor work products expected to be continued, by priority

5.7.2 The Government and Contractor Project Manager shall make use of the resources and tools available to continue contracted functions to the maximum extent possible under emergency circumstances. Contractors shall obtain approval from the Contracting Officer prior to incurring costs over and above those allowed for under the terms of this contract. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

5.8 PROGRESS REPORTS

The Project Manager shall provide a monthly progress report (Deliverable 6) to the Contracting Officer, COR and Project Lead via electronic mail. This report shall include a summary of all Contractor work performed, including a breakdown of labor hours by labor category, all direct costs by line item, an assessment of technical progress, schedule status, and any Contractor concerns or recommendations for the previous reporting period. Comment by Lim, Christopher: Add Monthly Progress Reports to 17.0 DELIVERABLES table.

Specify when each month to submit the monthly progress report. Ex. Monthly, each 5th day or next following business day.e Comment by Katz, Laura E: Listed, reference updated.

5.9 PROGRESS MEETINGS

The Project Manager shall be available to meet with the Project Lead and COR upon request to present deliverables, discuss progress, exchange information and resolve emergent technical problems and issues. These meetings shall take place via teleconference.

5.10 GENERAL REPORT REQUIREMENTS

The Contractor shall provide all written reports in electronic format with read/write capability using applications that are compatible with DHS workstations (Windows and Microsoft Office Applications).

5.11 PROTECTION OF INFORMATION

Contractor access to proprietary information is required under this SOW. Contractor employees shall safeguard this information against unauthorized disclosure or dissemination in accordance with the law and Government policy and regulation.

5.12 SECTION 508 COMPLIANCE Comment by Katz, Laura E: Is this left as is or replaced with DART language? Comment by Klueter, David: I'd remove this paragraph and reference the Section 508 Compliance attachment.

See DART Section 508 Requirements Attachment

6.0 ACRONYMS

COR – Contracting Officer’s Representative DHS - Department of Homeland Security ICE - U.S. Immigration and Customs Enforcement IHSC - ICE Health Service Corps NCCHC - National Commission on Correctional Health Care ACA - American Correctional Association PBNDS – Performance Based National Detention Standards (ICE)

7.0 GOVERNMENT FURNISHED RESOURCES

The Government will not furnish any resources to the Contractor in support of this contract.

The Government will provide the following information, data, and documents to the Contractor for work required under this contract:

· Desired workflow processes for policy management.

· Identification of IHSC site administrators, users, and groups.

The Contractor shall use Government furnished information, data and documents only for the performance of work under this contract and shall be responsible for returning all Government furnished information, data and documents to the Government at the end of the performance period. The Contractor shall not release Government furnished information, data and documents to outside parties without the prior and explicit consent of the Contracting Officer.

8.0 CONTRACTOR FURNISHED PROPERTY

The Contractor shall furnish all facilities, materials, equipment and services necessary to fulfill the requirements of this contract, except for the Government Furnished Resources specified in SOW 2.0.

9.0 GOVERNMENT ACCEPTANCE PERIOD

The Government will review deliverables prior to the acceptance and provide the Contractor with an e-mail that provides documented reasons if not accepted. If the deliverable is acceptable, the Project Lead will send an e-mail to the Contractor notifying it that the deliverable has been accepted.

9.1 The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained in the Contractor’s accepted proposal. In the event of a rejected deliverable, the Contractor will be notified in writing by the COR of the specific reasons for rejection. The Contractor may have an opportunity to correct the rejected deliverable and return it per delivery instructions.

9.2 The Project Lead and COR will have 7 business days to review deliverables and make comments. The Contractor shall have 5 business days to make corrections and redeliver.

9.3 All other review times and schedules for deliverables shall be agreed upon by the parties based on the final approved Project Plan. The Contractor shall be responsible for timely delivery to Government personnel in the agreed upon review chain, at each stage of the review. The Contractor shall work with personnel reviewing the deliverables to ensure that the established schedule is maintained.

10.0 DELIVERABLES

The Contractor shall consider items in BOLD as having mandatory due dates. Items in italics are deliverables or events that must be reviewed and/or approved by the COR prior to proceeding to next deliverable or event in this SOW.

DISTRIBUTION

N/A

Project Lead, COR, Contracting Officer

General Cybersecurity Contract Requirements

A.1 In accordance with ITAR 4.5.3.4 and ITAR 4.5.4.4 – Security Review Security Review Terms and Conditions The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford ICE, including the organization of ICE Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer Representative (COR), and other government oversight organizations, access to the Contractor's facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact ICE Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to ICE. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of ICE data or the function of computer system operated on behalf of ICE, and to preserve evidence of computer crime.

A.2 In accordance with ITAR 4.5.3.7 – Supply Chain Risk Management Supply Chain Risk Management Terms and Conditions The Contractors supplying the Government hardware and software shall provide the manufacturer's name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state, and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

(i) How risks from the supply chain will be identified;

(ii) What processes and security measures will be adopted to manage these risks to the system or system components; and How the risks and associated security measures will…