1.2.1-SOW Relocation Support Services.pdf

Statement of Work (SOW)

Immigration and Customs Enforcement (ICE) Relocation Counseling Support Services

Part 1: Task Order Information

1.1 General

This is a services contract to provide Relocation Counseling Support Services.

1.2 Description of Services/Introduction

ICE requires professional relocation counseling support services to facilitate the direct travel reimbursements, real estate transactions, and household goods moving services of transferring employees.

1.3 Background

The services are intended to aid ICE in matters pertaining to Permanent Change of Station (PCS). Workload will coincide with all requirements necessary to meet relocation goals and efforts.

1.4 Scope

The Relocation Counseling Support Services provided by the Contractor will accomplish the PCS relocation tasks set out by the ICE Program Manager. These services will help fulfill the responsibilities of ICE’s relocation mission. Further details are located in SOW Part 5: Relocation Support Services.

1.5 Period of Performance

The anticipated period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

The Period of Performance reads as follows:

Period Start Date End Date Base 7/15/2024 7/14/2025 Option Year 1 7/15/2025 7/14/2026 Option Year 2 7/15/2026 7/14/2027 Option Year 3 7/15/2027 7/14/2028 Option Year 4 7/15/2028 7/14/2029

Part 2: Relocation Counseling Support Services Tasks

3.1 Overview

The support services description will include key ICE relocation functions. The primary services can be broken down into these 14 key tasks:

1. Processing the selection notifications received from Human Resources

2. Processing the Authorized Discretionary Form received from Program Office

3. Processing the Relocation Questionnaire returned by transferees to prepare the Travel Authorization

4. Perform the research needed to generate the Travel Authorization Cost Estimate using mLINQS

5. Generate the actual cost estimate for TA based on the research

6. Applying the Funding Code to the TA and releasing the official TA

7. Sending the TA /PCS Orders to the transferee

8. Sending the TA to the RSP for authorization

9. Finalizing all updates in mLINQS and the Share Drive

10. Processing relocation PCS vouchers

11. Finalizing all forms and data in the ICE (FFMS) and MLINQS systems

12. Proactively providing counseling to ICE transferring families regarding entitlements and allowances

13. Respond to transferring employee inquiries via telephone, email and RSP chat, as appropriate

14. Provide guidance to ICE relocation staff regarding industry and RSP relocation matters and processes, as appropriate

Within the primary responsibilities, ICE processes, forms and systems are all used agencywide. The Dallas FSC is the central PCS management center for all ICE employee moves, domestic and international.

The Contractor’s role includes serving as the principal contact for the customer, managing, advising, and overseeing the full relocation and/or assignment cycle. These services include managing the customers’ requirements, ensuring that appropriate third-party service provisions are in line with the agreements, and cooperating with internal RSP departments to facilitate relocations.

3.2 Key Accountabilities

Relocation Support Services include most or all of the following responsibilities, but are not limited to:

▪ Lead briefings and orientations of each customer in the authorized services and policies to be provided, including compensation details where applicable.

▪ Perform the role of a subject matter expert on RSP and client portfolios of services and product offerings including relocation-related requirements, housing preferences, household goods movement, education requirements, immigration requirements, language training needs, etc. as appropriate.

▪ Manage all activities and services for customers in alignment with authorized services, including co-ordination of multiple internal departments and third-party providers

▪ Pro-actively liaise with clients’ mobility team and other relevant stakeholders to understand and meet client needs as appropriate.

▪ Ensure that internal systems are kept up to date with key milestones, documentation, and communications so that system data can be used confidently and reliably to drive and inform other company processes.

▪ Champion and use RSP site and mobile application with customers to ensure customer is aware of available tools and self-service support.

▪ Gather reports from company systems as well as from third parties to identify trends and to inform internal stakeholders of performance or service issues.

3.3 Support Service Qualifications, Skills, and Experience

▪ 3 years’ experience in a customer service role. Prior global talent mobility experience is an advantage.

▪ U.S. citizens who have passed RSP’s background check and/or possess a Non-Sensitive or Public Trust security clearance either active or inactive

▪ Must be customer-oriented with excellent listening and consultative skills

▪ Experience providing highly organized delivery, demonstrable problem-solving skills and high attention to detail

▪ Experience of exercising judgement in owning complex processes through to completion and resolution, including problem resolution across multiple stakeholders

▪ Experience dealing with emotionally sensitive customer service scenarios

▪ Experience operating in a team environment as well as working independently, demonstrable experience of prioritizing and managing multiple assignments simultaneously

▪ Ability to quickly appraise the status of an unfamiliar workload and process it seamlessly

▪ Proficient in Microsoft Office environment and web applications

▪ Excellent written and verbal communication and interpersonal skills. Professional spoken and written English, proficiency in other languages would be advantageous

3.4 Implementation

During the implementation phase, in consultation with ICE, the Contractor will finalize the support services it will provide.

While the Contractor’s team will primarily work from Contractor designated locations, the Contractor’s support service team will be available for on-site meetings at ICE’s Dallas facility, if both parties assent.

In addition to the Contractor’s internal technical training, ICE designated PCS Coordinators, the ICE PM, the COR, the Supervisory Accountant, and the Unit Chief will all participate in ICE directed training concerning ICE’s specific requirements related to this engagement.

3.5 mLINQS

ICE, Savantage, and mLINQS are stakeholders in a bilateral interface between the Federal Financial Management System (FFMS) and mLINQS Relocation Management System. The Contractor must have experience using mLINQS technology to prepare travel authorizations, research the cost estimates, obligate the funding, prepare the final authorization, track reimbursements, and reconcile the final expenditures against allowances. If the Contractor requires access to the FFMS-mLINQS interface, they must receive and pass the proper training, submit, and receive the system access forms and permissions, and agree to abide by all behavior guidelines. The ICE mLINQS Systems Administrator will the point of contact for the contractor’s mLINQS access. Additionally, a non-disclosure (NDA) with mLINQS may be required in the future. If such a document is a necessity (i.e. if the Contractor’s mission intersects with the activities the NDA covers) the Contractor is required to sign.

Part 3: General Information

3.1 General Information

3.2 Recognized Holidays

The contractor is not required to perform services on these federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth

3.3 Hours of Operation

The contractor is responsible for conducting business between the hours of 8:00AM to 5:00 PM CST Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. At all times the Contractor must maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

3.4 Place of Performance

The work to be performed under this task order will be performed at the contractor’s site.

3.5 Type of Contract

The government anticipates a Firm-Fixed Price Task Order.

3.6 Security Requirements

Contractor personnel performing Relocation Consultant Support Services work under this task order must have a Moderate Risk (5N) Non-IT Position Risk Level at start of the contract and must maintain the level of security required for the life of the task order. The security requirements are in accordance with ICE Personnel Security policies.

3.7 Physical Security

The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use.

3.8 Post Award Conference/Periodic Progress Meetings

The Contractor agrees to attend any post award conference convened by the contracting activity or task order administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

3.9 Key Contractor Personnel

The following positions are considered key personnel:

3.10 Program Manager (PM)

• Five (5) or more years of experience in Government/corporate relocations

• Certified Relocation Professional (CRP)

• Knowledge of the Federal Travel Regulations (FTR)

The designated Program Manager shall act as the central point of contact with the Government for all program-wide technical issues and will represent the Contractor at all post-award status meetings. The Program Manager shall be responsible for all issue resolution, program management, and other administrative support including providing comprehensive relocation support for the Task Order. The Program Manager shall be a single point of contact for the Contracting Officer (CO), the Contracting Officer’s Representative (COR), and ICE’s Program Manager (ICE PM).

The Program Manager shall be available to the ICE PM and/or the COR via telephone between the hours of 8:00am- 5:00pm (CST), Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within twenty-four (24) hours of notification.

3.11 Replacement of Key Personnel

Before replacing any individual designated as Key, the Contractor shall notify the Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement, and provide the name, resume, and qualifications of any proposed substitute. All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced. The Contractor shall not replace Key Contractor personnel without written acknowledgement from the Contracting Officer. The Contracting Officer will provide written acknowledgement within seven (7) days after receiving notification.

3.12 Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

3.13 Contractor Travel

Contractor will not be required to travel. Any travel by the Contractor to visit the agency will be at the Contractor’s own expense.

3.14 Organizational Conflict of Interest

Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

3.15 Phase in/Phase out Period

To minimize any decreases in productivity and to prevent possible negative impacts on additional services, and if contract award is timely enough, the Contractor shall have personnel on board, during the 30-day phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements to commence full performance of services on the contract start date.

Part 4: Government Furnished Property, Equipment, and Services

The Government will provide:

4.1 Services

The fillable security forms required for the Contractor to receive Fitness Approval (security clearance) from the ICE Personnel Security Unit Submission of the security forms to ICE PSD after the forms are completed by the Contractor Scheduling assistance with PIV card issuance, after ICE PSD Fitness Approval Scheduling assistance with the ICE Service Desk to set up LAN access and email address

4.2 Facilities

The PIV card issuing facility – usually an ICE office and if needed, an ICE IT office for provisioning an ICE LAN account.

4.3 Utilities

Use of bathrooms, a kitchenette, and appropriate meeting spaces – if the Contractor is working at ICE’s physical PCS office.

4.4 Equipment

Equipment which includes but is not limited to laptops, desktops, docking stations, external displays, laptop power adapters, PIV cards, and card readers.

4.5 Materials

Training and reference materials as needed

Part 5: Deliverables

5.1 Deliverables Schedule

Deliverable Frequency Medium/Format Submit To Transition and Implementation plan

5th calendar day after kick off meeting

PDF or Microsoft Excel

ICE PM & COR

Support Services Provided

- Phone Calls

- Emails

- Authorizations Created

- Vouchers Created

- Invoices Created

Monthly or as requested Microsoft Excel ICE PM & COR

Monthly Status Report Monthly on the 10th calendar day of the month.

Microsoft Excel CO, ICE PM, COR

Progress Meetings Monthly Virtual ICE PM & COR

5.2 Estimated Workload Data

These services are currently being fulfilled by three full-time equivalent positions. This information is not actual requirements for the new Task Order. The contractor is responsible for proposing the appropriate fixed price to perform the requirements of this SOW. This is provided for informational purposes only.

Appendix A: SBU Contract Security Language

This Security Language is required to be used for

Sensitive But Unclassified (SBU) Contracts

1. Do not alter this language.

2. Additional Program Office specific contract requirements should be incorporated into Statement of Work/Objectives outside of this language.

SECURITY REQUIREMENTS

GENERAL

The United States Immigration and Customs Enforcement (ICE) has determined that performance of the tasks as described in Contract requires that the Contractor, subcontractor(s), vendor(s), etc. (herein known as Contractor) have access to sensitive DHS information, and that the Contractor will adhere to the following.

PRELIMINARY FITNESS DETERMINATION

ICE will exercise full control over granting, denying, withholding or terminating unescorted government facility and/or sensitive Government information access for Contractor applicants/employees, based upon the results of a Fitness screening process. ICE may, as it deems appropriate, authorize and make a favorable expedited preliminary Fitness determination based on preliminary security checks. The preliminary Fitness determination will allow the Contractor employee to commence work temporarily prior to the completion of a Full Field Background Investigation. The granting of a favorable preliminary Fitness shall not be considered as assurance that a favorable final Fitness determination will follow as a result thereof. The granting of preliminary Fitness or final Fitness shall in no way prevent, preclude, or bar the withdrawal or termination of any such access by ICE, at any time during the term of the contract. No employee of the Contractor shall be allowed to enter on duty and/or access sensitive information or systems without a favorable Fitness determination by the Office of Professional Responsibility (OPR), Personnel Security Operations (PSO). No employee of the Contractor shall be allowed unescorted access to a Government facility without a favorable Fitness determination by OPR PSO. Contract employees are processed under DHS Instruction 121-01-007-001 (Personnel Security, Suitability and Fitness Program), or successor thereto; those having direct contact with Detainees will also have 6 CFR § 115.117 considerations made as part of the Fitness screening process. Sexual Abuse and Assault Prevention Standards implemented pursuant to Public Law 108-79 (Prison Rape Elimination Act (PREA) of 2003)).

BACKGROUND INVESTIGATIONS

Contractor employees (to include applicants, temporary, part-time and replacement employees) under the contract, needing access to sensitive information and/or ICE Detainees, shall undergo a position sensitivity analysis based on the duties each individual will perform on the contract. The results of the position sensitivity analysis shall identify the appropriate background investigation to be conducted. Background investigations will be processed through OPR PSO.

Contractor applicant/employees nominated by a Contracting Officer Representative for consideration to support this contract shall submit the following security vetting documentation to OPR PSO, through the Contracting Officer Representative (COR), within 10 days of notification by OPR PSO of nomination by the COR and initiation of an Electronic Questionnaire for Investigation Processing (e-QIP) in the Office of Personnel Management (OPM) automated on-line system.

1. Standard Form 85P (Standard Form 85PS (with supplement to 85P required for those with direct contact with detainees or armed positions)), “Questionnaire for Public Trust Positions” form completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

2. Signature Release Forms (Three total) generated by OPM e-QIP upon completion of Questionnaire (e-signature recommended/acceptable). Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

3. Electronic fingerprints taken at an approved facility OR two (2) SF 87 Fingerprint Cards (current revision) sent to OPR PSO. Additional information regarding fingerprints will be sent to the Contractor applicant/employee from OPR

PSO.

4. Optional Form 306 Declaration for Federal Employment. This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSO. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

5. If occupying PREA designated position: Questionnaire regarding conduct defined under 6 CFR § 115.117 (Sexual Abuse and Assault Prevention Standards). This document is sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSO. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

6. One additional document may be applicable if the Contractor applicant/employee was born abroad. If applicable, the document will be sent as an attachment in an e-mail to the Contractor applicant/employee from OPR PSO. Completed online and archived by the Contractor applicant/employee in their OPM e-QIP account.

Contractor employees who have an adequate, current investigation by another Federal Agency may not be required to submit complete security packages; the investigation may be accepted under reciprocity. The questionnaire related to 6 CFR § 115.117 listed above in item 5 will be required for positions designated under PREA.

An adequate and current investigation is one where the investigation is not more than five years old, meets the contract risk level requirement, and applicant has not had a break in service of more than two years. (Executive Order 13488 amended under Executive Order 13764/DHS Instruction 121-01-007-01)

Required information for submission of security packet will be provided by OPR PSO at the time of award of the contract. Only complete packages will be accepted by OPR PSO as notified by the COR.

To ensure adequate background investigative coverage, Contractor applicants/employees must currently reside in the United States or its Territories. Additionally, Contractor applicants/employees are required to have resided within the United States or its Territories for three or more years out of the last five (ICE retains the right to deem a Contractor applicant/employee ineligible due to insufficient background coverage). This timeline is assessed based on the signature date of the standard form questionnaire submitted for the applied position. Contractor employees falling under the following situations may be exempt from the residency requirement: 1) work or worked for the U.S. Government in foreign countries in federal civilian or military capacities; 2) were or are dependents accompanying a federal civilian or a military employee serving in foreign countries so long as they were or are authorized by the U.S. Government to accompany their federal civilian or military sponsor in the foreign location; 3) worked as a Contractor employee, volunteer, consultant or intern on behalf of the federal government overseas, where stateside coverage can be obtained to complete the background investigation; 4) studied abroad at a U.S. affiliated college or university; or 5) have a current and adequate background investigation (commensurate with the position risk/sensitivity levels) completed for a Federal or Contractor employee position, barring any break in federal employment or federal sponsorship.

Only U.S. citizens and Legal Permanent Residents are eligible for employment on contracts requiring access to DHS sensitive information unless an exception is granted as outlined under DHS Instruction 121-01-007-001. Per DHS Sensitive Systems Policy Directive 4300A, only U.S. citizens are eligible for positions requiring access to DHS Information Technology (IT) systems or positions that are involved in the development, operation, management, or maintenance of DHS IT systems, unless an exception is granted as outlined under DHS Instruction 121-01-007-001.

CONTINUED ELIGIBILITY

ICE reserves the right and prerogative to deny and/or restrict facility and information access of any Contractor employee whose actions conflict with Fitness standards contained in DHS Instruction 121-01-007-01, Chapter 3, paragraph 6.B or who violate standards of conduct under 6 CFR § 115.117. The Contracting Officer or their representative can determine if a risk of compromising sensitive Government information exists or if the efficiency of service is at risk and may direct immediate removal of a Contractor employee from contract support. OPR PSO will conduct periodic reinvestigations every 5 years, or when derogatory information is received, to evaluate continued Fitness of Contractor employees.

REQUIRED REPORTS

The Contractor will notify OPR PSO, via the COR, of all terminations/resignations of Contractor employees under the contract within five days of occurrence. The Contractor will return any expired ICE issued identification cards and building passes of terminated/resigned employees to the COR. If an identification card or building pass is not available to be returned, a report must be submitted to the COR referencing the pass or card number, name of individual to whom issued, the last known location and disposition of the pass or card. The COR will return the identification cards and building passes to the responsible ID Unit.

The Contractor will report any adverse information coming to their attention concerning Contractor employees under the contract to OPR PSO, via the COR, as soon as possible. Reports based on rumor or innuendo should not be made. The subsequent termination of employment of an employee does not obviate the requirement to submit this report. The report shall include the Contractor employees’ name and social security number, along with the adverse information being reported.

The Contractor will provide, through the COR, a Quarterly Report containing the names of Contractor employees who are active, pending hire, have departed within the quarter or have had a legal name change (Submitted with documentation). The list shall include the Name, Position and SSN (Last Four) and should be derived from system(s) used for Contractor payroll/voucher processing to ensure accuracy.

CORs will submit reports to psu-industrial-security@ice.dhs.gov

Contractors, who are involved with management and/or use of information/data deemed “sensitive” to include ‘law enforcement sensitive” are required to complete the DHS Form 11000-6-Sensitive but Unclassified Information Non- Disclosure Agreement (NDA) for Contractor employee access to sensitive information. The NDA will be administered by the COR to all contract personnel within 10 calendar days of the entry on duty date. The completed form shall remain on file with the COR for purpose of administration and inspection.

Sensitive information as defined under the Computer Security Act of 1987, Public Law 100-235 is information not otherwise categorized by statute or regulation that if disclosed could have an adverse impact on the welfare or privacy of individuals or on the welfare or conduct of Federal programs or other programs or operations essential to the national interest. Examples of sensitive information include personal data such as Social Security numbers; trade secrets; system vulnerability information; pre-solicitation procurement documents, such as statements of work; and information pertaining to law enforcement investigative methods; similarly, detailed reports related to computer security deficiencies in internal controls are also sensitive information because of the potential damage that could be caused by the misuse of this information. All sensitive information must be protected from loss, misuse, modification, and unauthorized access in accordance with DHS Management Directive 11042.1, DHS Policy for Sensitive Information and ICE Policy 4003, Safeguarding Law Enforcement Sensitive Information.”

Any unauthorized disclosure of information should be reported to ICE.ADSEC@ice.dhs.gov.

SECURITY MANAGEMENT

The Contractor shall appoint a senior official to act as the Corporate Security Officer. The individual will interface with OPR PSO through the COR on all security matters, to include physical, personnel, and protection of all Government information and data accessed by the Contractor.

The COR and OPR shall have the right to inspect the procedures, methods, and facilities utilized by the Contractor in complying with the security requirements under this contract. Should the COR determine that the Contractor is not complying with the security requirements of this contract, the Contractor will be informed in writing by the Contracting Officer of the proper action to be taken to effect compliance with such requirements.

INFORMATION TECHNOLOGY SECURITY

When sensitive government information is processed on Department telecommunications and automated information systems, the contract company agrees to provide for the administrative control of sensitive data being processed and to adhere to the procedures governing such data as outlined in DHS MD 4300.1, Information Technology Systems Security (or its replacement). Contractor employees must have favorably adjudicated background investigations commensurate with the defined sensitivity level.

Contractor employees who fail to comply with Department security policy are subject to having their access to Department IT systems and facilities terminated, regardless if the failure results in criminal prosecution. Any person who improperly discloses sensitive information is subject to criminal and civil penalties and sanctions under a variety of laws (e.g., Privacy Act).

INFORMATION TECHNOLOGY SECURITY TRAINING AND OVERSIGHT

In accordance with Office of the Chief Information Officer (OCIO) requirements and provisions, all Contractor employees accessing Department IT systems or processing DHS sensitive data via an IT system will require an ICE issued/provisioned Personal Identity Verification (PIV) card. Additionally, Cybersecurity Awareness Training (CSAT) will be required upon initial access and annually thereafter. CSAT training will be provided by the appropriate component agency of DHS.

Contractor employees, who are involved with management, use, or operation of any IT systems that handle sensitive information within or under the supervision of the Department, shall receive periodic training at least annually in security awareness and accepted security practices, systems rules of behavior, to include Unauthorized Disclosure Training, available on PALMS or by contacting ICE.ADSEC@ice.dhs.gov. Contractor employees with significant security responsibilities shall receive specialized training specific to their security responsibilities annually. The level of training shall be commensurate with the individual’s duties and responsibilities and is intended to promote a consistent understanding of the principles and concepts of telecommunications and IT systems security.

All personnel who access Department information systems will be continually evaluated while performing these duties.

System Administrators should be aware of any unusual or inappropriate behavior by personnel accessing systems. Any unauthorized access, sharing of passwords, or other questionable security procedures should be reported to the local Security Office or Information System Security Officer (ISSO).

Appendix B: Information Governance and Privacy

FAR 52.224-3 Privacy Training – Alternate I (Deviation), as per DHS FAR Class Deviation 17-03, Revision 1

PRIVACY TRAINING (JAN 2017)

(a) Definition. As used in this clause, "personally identifiable information" means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. (See Office of Management and Budget (OMB) Circular A-130, Managing Federal Information as a Strategic Resource).

(b) The Contractor shall ensure that initial privacy training, and annual privacy training thereafter, is completed by contractor employees who-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information on behalf of an agency; or

(3) Design, develop, maintain, or operate a system of records (see also FAR subpart 24.3 and 39.105).

(c) The contracting agency will provide initial privacy training, and annual privacy training thereafter, to Contractor employees for the duration of this contract.

(d) The Contractor shall maintain and, upon request, provide documentation of completion of privacy training to the Contracting Officer.

(e) The Contractor shall not allow any employee access to a system of records, or permit any employee to create, collect, use, process, store, maintain, disseminate, disclose, dispose or otherwise handle personally identifiable information, or to design, develop, maintain, or operate a system of records unless the employee has completed privacy training, as required by this clause.

(f) The substance of this clause, including this paragraph (f), shall be included in all subcontracts under this contract, when subcontractor employees will-

(1) Have access to a system of records;

(2) Create, collect, use, process, store, maintain, disseminate, disclose, dispose, or otherwise handle personally identifiable information; or

(3) Design, develop, maintain, or operate a system of records.

HSAR Class Deviation 15-01, Revision 1: Information Technology Security Awareness Training (JULY 2023)

INFORMATION TECHNOLOGY SECURITY AWARENESS TRAINING (JULY 2023)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Security Training Requirements.

(1) All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of Homeland Security (DHS) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing sensitive https://www.acquisition.gov/far/subpart-24.3#FAR_Subpart_24_3 https://www.acquisition.gov/far/39.105#FAR_39_105 information under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter not later than October 31st of each year. Any new Contractor employees assigned to the contract shall complete the training before accessing sensitive information under the contract. The training is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award.

Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 31st of each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

(2) The DHS Rules of Behavior apply to every DHS employee, Contractor and subcontractor that will have access to DHS systems and sensitive information. The DHS Rules of Behavior shall be signed before accessing DHS systems and sensitive information. The DHS Rules of Behavior is a document that informs users of their responsibilities when accessing DHS systems and holds users accountable for actions taken while accessing DHS systems and using DHS Information Technology resources capable of inputting, storing, processing, outputting, and/or transmitting sensitive information. The DHS Rules of Behavior is accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors. Unless otherwise specified, the DHS Rules of Behavior shall be signed within thirty (30) days of contract award. Any new Contractor employees assigned to the contract shall also sign the DHS Rules of Behavior before accessing DHS systems and sensitive information. The Contractor shall maintain signed copies of the DHS Rules of Behavior for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, the Contractor shall e-mail copies of the signed DHS Rules of Behavior to the COR not later than thirty (30) days after contract award for each employee. The DHS Rules of Behavior will be reviewed annually, and the COR will provide notification when a review is required.

HSAR 3052.204-71 Contractor Employee Access (July 2023)

Contractor Employee Access (JUL 2023)

(a) Controlled Unclassified Information (CUI) is any information the Government creates or possesses, or an entity creates or possesses for or on behalf of the Government (other than classified information) that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. This definition includes the following CUI categories and subcategories of information:

(1) Chemical-terrorism Vulnerability Information (CVI) as defined in 6 CFR part 27, “Chemical Facility Anti- Terrorism Standards,” and as further described in supplementary guidance issued by an authorized official of the Department of Homeland Security (including the Revised Procedural Manual “Safeguarding Information Designated as Chemical-Terrorism Vulnerability Information” dated September 2008);

(2) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (title XXII, subtitle B of the Homeland Security Act of 2002 as amended through Pub. L. 116–283), PCII's implementing regulations (6 CFR part 29), the PCII Program Procedures Manual, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security, the PCII Program Manager, or a PCII Program Manager Designee;

(3) Sensitive Security Information (SSI) as defined in 49 CFR part 1520, “Protection of Sensitive Security Information,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or designee), including Department of Homeland Security MD 11056.1, “Sensitive Security Information (SSI)” and, within the Transportation Security Administration, TSA MD 2810.1, “SSI Program”;

(4) Homeland Security Agreement Information means information the Department of Homeland Security receives pursuant to an agreement with State, local, Tribal, territorial, or private sector partners that is required to be protected by that agreement. The Department receives this information in furtherance of the missions of the Department, including, but not limited to, support of the Fusion Center Initiative and activities for cyber information sharing consistent with the Cybersecurity Information Sharing Act of 2015;

(5) Homeland Security Enforcement Information means unclassified information of a sensitive nature lawfully created, possessed, or transmitted by the Department of Homeland Security in furtherance of its immigration, customs, and other civil and criminal enforcement missions, the unauthorized disclosure of which could adversely impact the mission of the Department;

(6) International Agreement Information means information the Department of Homeland Security receives that is required to be protected by an information sharing agreement or arrangement with a foreign government, an international organization of governments or any element thereof, an international or foreign public or judicial body, or an international or foreign private or non-governmental organization;

(7) Information Systems Vulnerability Information (ISVI) means:

(i) Department of Homeland Security information technology (IT) systems data revealing infrastructure used for servers, desktops, and networks; applications name, version, and release; switching, router, and gateway information; interconnections and access methods; and mission or business use/need. Examples of ISVI are systems inventories and enterprise architecture models. Information pertaining to national security systems and eligible for classification under Executive Order 13526 will be classified as appropriate; and/or

(ii) Information regarding developing or current technology, the release of which could hinder the objectives of the Department, compromise a technological advantage or countermeasure, cause a denial of service, or provide an adversary with sufficient information to clone, counterfeit, or circumvent a process or system;

(8) Operations Security Information means Department of Homeland Security information that could be collected, analyzed, and exploited by a foreign adversary to identify intentions, capabilities, operations, and vulnerabilities that threaten operational security for the missions of the Department;

(9) Personnel Security Information means information that could result in physical risk to Department of Homeland Security personnel or other individuals whom the Department is responsible for protecting;

(10) Physical Security Information means reviews or reports illustrating or disclosing facility infrastructure or security vulnerabilities related to the protection of Federal buildings, grounds, or property. For example, threat assessments, system security plans, contingency plans, risk management plans, business impact analysis studies, and certification and accreditation documentation;

(11) Privacy Information includes both Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII). PII refers to information that can be used to distinguish or trace an individual's identity, either alone, or when combined with other information that is linked or linkable to a specific individual; and SPII is a subset of PII that if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. To determine whether information is PII, DHS will perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available, in any medium or from any source, that would make it possible to identify an individual. Certain data elements are particularly sensitive and may alone present an increased risk of harm to the individual.

(i) Examples of stand-alone PII that are particularly sensitive include: Social Security numbers (SSNs), driver's license or State identification numbers, Alien Registration Numbers (A-numbers), financial account numbers, and biometric identifiers.

(ii) Multiple pieces of information may present an increased risk of harm to the individual when combined, posing an increased risk of harm to the individual. SPII may also consist of any grouping of information that contains an individual's name or other unique identifier plus one or more of the following elements:

(A) Truncated SSN (such as last 4 digits);

(B) Date of birth (month, day, and year);

(C) Citizenship or immigration status;

(D) Ethnic or religious affiliation;

(E) Sexual orientation;

(F) Criminal history;

(G) Medical information; and

(H) System authentication information, such as mother's birth name, account passwords, or personal identification numbers (PINs).

(iii) Other PII that may present an increased risk of harm to the individual depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. The context includes the purpose for which the PII was collected, maintained, and used. This assessment is critical because the same information in different contexts can reveal additional information about the impacted individual.

(b) Information Resources means information and related resources, such as personnel, equipment, funds, and information technology.

(c) Contractor employees working on this contract must complete such forms as may be necessary for security or other reasons, including the conduct of background investigations to determine suitability. Completed forms shall be submitted as directed by the Contracting Officer. Upon the Contracting Officer's request, the Contractor's employees shall be fingerprinted or subject to other investigations as required. All Contractor employees requiring recurring access to government facilities or access to CUI or information resources are required to have a favorably adjudicated background investigation prior to commencing work on this contract unless this requirement is waived under departmental procedures.

(d) The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to CUI. The Contractor shall access and use CUI only for the purpose of furnishing advice or assistance directly to the Government in support of the Government's activities, and shall not disclose, orally or in writing, CUI for any other purpose to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized to access CUI, the Contractor shall ensure that these persons receive initial and refresher training concerning the protection and disclosure of CUI. Initial training shall be completed within 60 days of contract award and refresher training shall be completed every 2 years thereafter.

(f) The Contractor shall include this clause in all subcontracts at any tier where the subcontractor may have access to government facilities, CUI, or information resources.

(End of clause)

Alternate I (JUL 2023)

When the contract will require Contractor employees to have access to information resources, add the following paragraphs:

(g) Before receiving access to information resources under this contract, the individual must complete a security briefing; additional training for specific categories of CUI, if identified in the contract; and any nondisclosure agreement furnished by DHS. The Contracting Officer's Representative (COR) will arrange the security briefing and any additional training required for specific categories of CUI.

(h) The Contractor shall have access only to those areas of DHS information resources explicitly stated in this contract or approved by the COR in writing as necessary for performance of the work under this contract. Any attempts by Contractor personnel to gain access to any information resources not expressly authorized by the terms and conditions in this contract, or as approved in writing by the COR, are strictly prohibited. In the event of violation of this provision, DHS will take appropriate actions with regard to the contract and the individual(s) involved.

(i) Contractor access to DHS networks from a remote location is a temporary privilege for mutual convenience while the Contractor performs business for DHS. It is not a right, a guarantee of access, a condition of the contract, or government-furnished equipment (GFE).

(j) Contractor access will be terminated for unauthorized use. The Contractor agrees to hold and save DHS harmless from any unauthorized use and agrees not to request additional time or money under the contract for any delays resulting from unauthorized use or access.

(k) Non-U.S. citizens shall not be authorized to access or assist in the development, operation, management, or maintenance of Department IT systems under the contract, unless a waiver has been granted by the Head of the Component or designee, with the concurrence of both the Department's Chief Security Officer (CSO) and the Chief Information Officer (CIO) or their designees. Within DHS Headquarters, the waiver may be granted only with the approval of both the CSO and the CIO or their designees. In order for a waiver to be granted:

(1) There must be a compelling reason for using this individual as opposed to a U.S. citizen; and

(2) The waiver must be in the best interest of the Government.

(l) Contractors shall identify in their proposals the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

(End of clause)

Alternate II (JUL 2023)

When the Department has determined contract employee access to controlled unclassified information or Government facilities must be limited to U.S. citizens and lawful permanent residents, but the contract will not require access to information resources, add the following paragraphs:

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I–551). Any exceptions must be approved by the Department's Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the Contracting Officer.

(End of clause)

HSAR 3052.204-72 Safeguarding of Controlled Unclassified Information (July 2023)

Safeguarding of Controlled Unclassified Information (JUL…